Memory Leak ? (ESS 7.0.302.0)

[Senteliks 0]

Ok so i know that this problem was presented in the past past with ESS 5 and ESS 6 but  i never encounter before.It always ran at optimal 40-90 MB but since i updated to ESS 7 last version it doesn't drop below 120-140 MB and it is only going higher.Also i have no idea if this is somehow related but my Local Security Authority Process is going wild (160MB of RAM and it doesn't drop below that) recently with no apparent reason (my machine isn't affected).This all started to happen two days ago.Now i know that this numbers aren't ,,big" but if you are using an laptop with 2GB ram of which only 1.7GB is usable then this present a problem.Does Advanced Memory Scanner has to do anything with this ?

Here,you can see on this screen shoot

 

hxxp://postimg.org/image/n8z9yj3x7/

I apologize if this already had been mentioned somewhere but right now i just don't have time to dig trough whole forum.

Edited October 20, 2013 by Senteliks

[Arakasi 549]

Its the program as a whole.

Each version keeps getting faster and faster and more advanced. ESET likes to use memory because its faster.

Mine uses 100-150mb from ekrn everyday. Those numbers are normal for me.

My thoughts are anyone with low memory, its time to upgrade. Were advancing computer technology everyday. Our apps are growing with it. You cant go with 256 OR 512mb of ram forever lol

I think Swex is the only one who can. haha

[Arakasi 549]

I dont think Eset is using your local authority service. Thats something else.

I see a few exe on yer computer that shouldnt be running lol.

[TGW 15]

This isn't normal, I never seen Local Security Authority Process (lsass.exe) taking more than few MBs of memory during normal operation.

Do you any chance have Anti-Theft feature enabled? If it is, then disable it and delete the user account it created, restart the computer then check your memory usage again, and post your findings please.

If this wasn't it, then you may want to check the 'lsass.exe' process is the actual legit Windows process, it can also be a virus using the same process name.

 

// EDIT

 

Just noticed your edit, I can see a suspicious process in the screenshot you posted (user.exe):

 

See: hxxp://www.threatexpert.com/files/user.exe.html

Please verify if it's a legit process or not, e.g. upload it to VirusTotal, check it with ESET Live Grid, digital signature validity (if any), etc.

VT: Task Manager > Right click the process > Open File Location > Copy it to desktop > Go to VirusTotal website and upload it (request re-analysis if the last analysis was long time ago).

ESET Live Grid: Task Manager > Right click the process > Open File Location > Right-click the file > Advanced options > Check file reputation using ESET Live Grid

 

I also recommend that you update ESS to latest available VSD, then run a full scan.

 

And post back the results.

Edited October 20, 2013 by TGW

[tommy456 12]

Yes i have seen the issue with LASS.EXE failing to release both physical and virtual memory following the stopping of processes EKRN.EXE  is the cause i have proved this by doing my own testing on my system running XPSP3  the eset EKRN.EXE also accumulates ram usage over time ,

The issue was present in V5 6 and now 7 it seems, And one of eset's main selling points is that it's light on system resources that to me also includes RAM or should do,

[SweX 871]

Its the program as a whole.

Each version keeps getting faster and faster and more advanced. ESET likes to use memory because its faster.

Mine uses 100-150mb from ekrn everyday. Those numbers are normal for me.

My thoughts are anyone with low memory, its time to upgrade. Were advancing computer technology everyday. Our apps are growing with it. You cant go with 256 OR 512mb of ram forever lol

I think Swex is the only one who can. haha

My ekrn.exe is using 96MB at the moment on XP SP3. Just like the last version 512 FTW   or Not 

[SweX 871]

And one of eset's main selling points is that it's light on system resources that to me also includes RAM or should do,

If ESET would re-design the product to use less RAM and more HDD, it would not result in a product that is lighter on your system.

 

Edit: here is a quote from Marcos....

 

~150 MB allocated by ekrn.exe and egui.exe don't seem too much nowadays. For best performance, not only the engine with signatures loads to memory but also shorter files are unpacked in memory without writing to the disk.

 

Edited October 20, 2013 by SweX

[Senteliks 0]

 

@TGW

First thing i did was checking if lsass.exe was legit or something managed to sneak into my pc.. but it turns out it is legit.Also Anti-Theft feature is always turned off,I never use it.Its more related to what tommy wrote.Anyway i think it could be something else that it is interfiering so i will check that out too before jumping to conclusions.

@Sweex

Yes i am well aware of Eset design ... its just that i am shocked that it is using 60-70 more RAM memory than previous version.

Edited October 20, 2013 by Senteliks

[SweX 871]

@TGW

First thing i did was checking if lsass.exe was legit or something managed to sneak into my pc.. but it turns out it is legit.Also Anti-Theft feature is always turned off,I never use it.Its more related to what tommy wrote.

But I thought that ESET had fixed the issue that tommy456 describes in V6 already. Or was that something else since I remember the discussion about this on the old forum 

[Senteliks 0]

 

// EDIT

 

Just noticed your edit, I can see a suspicious process in the screenshot you posted (user.exe):

 

 

See: hxxp://www.threatexp...s/user.exe.html

Please verify if it's a legit process or not, e.g. upload it to VirusTotal, check it with ESET Live Grid, digital signature validity (if any), etc.

VT: Task Manager > Right click the process > Open File Location > Copy it to desktop > Go to VirusTotal website and upload it (request re-analysis if the last analysis was long time ago).

ESET Live Grid: Task Manager > Right click the process > Open File Location > Right-click the file > Advanced options > Check file reputation using ESET Live Grid

 

I also recommend that you update ESS to latest available VSD, then run a full scan.

 

And post back the results.

 

That's process of file locker software which i use to forbid hide and forbid access to certain areas of my PC (i masked that process by giving it name ,,user.exe" so that if something bad happens like forgetting password of 18 chars , I can terminate software or delete it with proper tool because i know exactly where to look, I could named it svchost.exe but .....).Also its not causing this issue i already tested it. 

Edited October 20, 2013 by Senteliks

[tommy456 12]

 

@TGW

First thing i did was checking if lsass.exe was legit or something managed to sneak into my pc.. but it turns out it is legit.Also Anti-Theft feature is always turned off,I never use it.Its more related to what tommy wrote.

But I thought that ESET had fixed the issue that tommy456 describes in V6 already. Or was that something else since I remember the discussion about this on the old forum 

 

Same issue ,not completely fixed but improved, if you are like me leave the pc running all the time, and re boot only when really needed (once every 2/3 weeks) unless microsoft update requires a reboot before that, Eset with accumulate well over 200mb of physical memory , and the lass process will  sometimes not unload memory it no longer needs, If eset isn't installed the lass process doesn't behave this way ,

The possible causes are the combination of installed software on the affected pc, because not every one sees this behaviour , but pin pointing the actual underlying reasons is probably a very drawn out process,

[SweX 871]

Hi tommy.

 

Yeah now I remember, it was when the PC had been on for a long time that this could happen just like you say.

 

But no, I am not like you, I shutdown my computer at night or if I am not going to use it anymore that day.

[tommy456 12]

I have been using eset with SSL disabled , the LSASS.EXE  is not longer  behaving in the way it was, infact it never uses much memory any more,

But if i leave my machine  on for 7-8 days  the EKRN.EXE process  does still hog memory  it still accumulates, using the standard e-mail client Outlook express  seems to have an influence  and be partly responsible  because EKRN.EXE fails to release the ram all the it used to open & scan the outlook express process after i close my mail client

 

So there is quite possibly still a small memory leak with EKRN.EXE  even though it was supposed to have been fixed, the highest iv'e seen it is 225mb so far ,