WSA went haywire when uninstalling game

[Solved]WSA went haywire when uninstalling game

Was uninstalling a mmorpg and noticed the removal took way too long so I decided to launch task manager and saw 1 of WRSA.exe process consumed a whopping 851MB of ram:



Using the latest version of WSA AV v8.04.42 on 32-bit Windows 7 Ultimate SP1 PC.

 

Wow - that definitely is wrong. Could you right click the process and click "Create Dump File", then copy the dump file and send it to us to look into closer?

 

Sure but I immediately terminate the process when it took up that much ram and restarted WSA which everything appeared to function normally now so is it ok to create a dump?

 

I'd need to get the memory dump while the issue is occurring. It's possible that the logs will be helpful at least - could you try saving a log and send it to my username at gmail.com?

Thanks!

 

Noted and Sent.

 

Thanks, the log gives me what I need - because the uninstaller is untrusted in our database (it has yet to be whitelisted), WSA journaled all of the changes it was making while it was making them, hence the high RAM usage. The CPU usage is due to the processing and saving of this event data, which would finish after some time.

The fix for this is to have our threat team whitelist the uninstaller/installer, which I'm having them do as we speak.

Thanks!

 

Terminate the system WRSA.exe application?

So... How did you do this?

WSA disallows forced external termination of its processes from a kernel level. Even when "Protect against process termination" is not set (in that case it catches the attempt, blocks it anyway, and asks if you want to).

If you were able to kill it from Task Manager, then something got realllllllly broken at the kernel level.

 

Thank you for the help and the detailed explanation

It was done via the tray icon by shutting down WSA which the processes didn't quit and took too long to unload the resources in my case.