ESET I.S. degrades UI performance of other software

[rawalanche 2]

Hi,

I am frequently using very expensive piece of 3D modeling software from Autodesk called 3ds Max. This software is known for relatively poor UI performance, however past few months, I've been noticing the performance of UI elements drawing was even worse then usual, having severely negative impact on my productivity. After recent issues with ESET I.S. ruining my upload speed, I was wondering if it could have something to do with the UI performance as well, since it's not uncommon for software to communicate with itself through the net ports. And sure enough, ESET I.S. is the reason my 3ds Max UI performance has been so bad past few months. I tried to uninstall it and the performance returned to normal. I installed ESET I.S. again after that, and the UI performance issue was back.

I have recorded a video, showing the performance of 3ds Max UI drawing with and without ESET I.S. installed:

(Especially visible if you compare 0:16 to 0:31 time marks)

I have tried to exclude the software process from Detection Engine, from realtime file system protection engine and from firewall, on all 3 places:

Yet no luck. The only way to get the performance back to acceptable levels is to completely uninstall ESET I.S.

Edited May 3, 2019 by rawalanche

[Marcos 5,070]

Does pausing real-time protection make a difference? If not, what about temporarily disabling HIPS and rebooting the machine?

As for the issues with upload speed, try updating from the pre-release channel that can be set in the advanced update setup and let us know if it resolves the issue.

[zamar27 5]

27 minutes ago, rawalanche said:

the performance of UI elements drawing was even worse then usual

Did you follow this? 😮

[rawalanche 2]

2 hours ago, Marcos said:

Does pausing real-time protection make a difference? If not, what about temporarily disabling HIPS and rebooting the machine?

As for the issues with upload speed, try updating from the pre-release channel that can be set in the advanced update setup and let us know if it resolves the issue.

No, disabling/pausing realtime protection makes no difference either. Only real uninstall works. As for the upload speed issue, yes I am aware of that - I was the one who reported it/made that thread, so I am already running on pre-release

[rawalanche 2]

2 hours ago, zamar27 said:

Did you follow this? 😮

This is completely unrelated. The article talks about GPU accelerated rendering. My issue is about speed of drawing of WinAPI UI elements.

[zamar27 5]

That should also ideally be GPU accelerated by 3ds Max proper setup. 

Edited May 3, 2019 by zamar27

[rawalanche 2]

12 hours ago, zamar27 said:

That should also ideally be GPU accelerated by 3ds Max proper setup. 

No, not at all. Especially not in 2016 version that doesn't use Qt yet. WinAPI UI framework has no GPU acceleration. Never did. Also, even if that was the case, which it isn't, there would be no reason for ESET I.S. to affect its performance.

[Marcos 5,070]

Please try the following:

1, In safe mode, rename "C:\Program Files\ESET\ESET Security\Drivers" to Drivers_bak
2, In safe mode, rename C:\Windows\System32\drivers\eamonm.sys  to eamonm.bak and C:\Windows\System32\drivers\ehdrv.sys to ehdrv.bak, one at a time
3, Check if the issue persist.

At the end of the test, rename "C:\Program Files\ESET\ESET Security\Drivers_bak" to Drivers.
You can also try temporarily uninstalling EIS and installing ESET NOD32 Antivirus to find out if it makes a difference. Please let us know about your findings.

[rawalanche 2]

4 hours ago, Marcos said:

Please try the following:

1, In safe mode, rename "C:\Program Files\ESET\ESET Security\Drivers" to Drivers_bak
2, In safe mode, rename C:\Windows\System32\drivers\eamonm.sys  to eamonm.bak and C:\Windows\System32\drivers\ehdrv.sys to ehdrv.bak, one at a time
3, Check if the issue persist.

At the end of the test, rename "C:\Program Files\ESET\ESET Security\Drivers_bak" to Drivers.
You can also try temporarily uninstalling EIS and installing ESET NOD32 Antivirus to find out if it makes a difference. Please let us know about your findings.

I have tried the procedure, and it did not help. However, I found out what does:

While the files were renamed and I.S. was inactive, I was able to shut down eguiProxy.exe and egui.exe processes. Once those were killed, the UI performance of 3dsMax was good. Not only that, but even Windows 10 window and start menu animations were completely smooth instead of a bit stuttery as usual. I did one more restart to verify it. As long as egui.exe and/or eguiProxy.exe are running, UI performance of many of the other pieces of software I run including windows it self is degraded.

[zamar27 5]

1 hour ago, rawalanche said:

As long as egui.exe and/or eguiProxy.exe are running, UI performance of many of the other pieces of software I run including windows it self is degraded.

I think these findings should be complemented by posting details of your PC hardware, so other Windows Eset users may get some idea to what degree they might be affected compare to you. 

In your case, I wonder if its possible to disable GUI in Eset Home products via Commandline, Registry, or Windows or Eset settings files similar to disabling it via Advanced setup in Eset commercial products? Can you test would it be sufficient to just disable Eset GUI without disabling its drivers to improve Windows graphics performance?

Edited May 4, 2019 by zamar27

[rawalanche 2]

18 hours ago, zamar27 said:

I think these findings should be complemented by posting details of your PC hardware, so other Windows Eset users may get some idea to what degree they might be affected compare to you. 

In your case, I wonder if its possible to disable GUI in Eset Home products via Commandline, Registry, or Windows or Eset settings files similar to disabling it via Advanced setup in Eset commercial products? Can you test would it be sufficient to just disable Eset GUI without disabling its drivers to improve Windows graphics performance?

 I am running i7 5930k with GTX1080Ti (with latest version of creator ready drivers) and 64GB DDR4 RAM. The system as well as the 3ds Max installation are on Samsung 960 EVO NVME SSD drive. Computer specs are certainly not a bottleneck here.

I have checked the links you are provided, but it appears that neither the GUI setting nor the admin console are available in EIS version.

[itman 1,659]

23 hours ago, rawalanche said:

While the files were renamed and I.S. was inactive, I was able to shut down eguiProxy.exe and egui.exe processes. Once those were killed, the UI performance of 3dsMax was good. Not only that, but even Windows 10 window and start menu animations were completely smooth instead of a bit stuttery as usual. I did one more restart to verify it. As long as egui.exe and/or eguiProxy.exe are running, UI performance of many of the other pieces of software I run including windows it self is degraded.

None of this makes any sense to me.

To begin with in ver. 12.1.34, equi.exe is only running if the Eset GUI is opened manually via the desktop. EquiProxy.exe is just a loader and unloader program for equi.exe. When the Eset GUI is manually closed, equi.exe should be terminated within a short time interval; less than 20 secs. based on my observations on Win 10 x(64) 1809. If equi.exe remains running for an extended period of time, either you have left the Eset GUI open for some reason, or there is something wrong with your Eset installation. As far as system resource usage by equiProxy.exe, it is nil for all practical purposes based on performance stats shown for it using Process Explorer.

If the 3ds Max software has a cloud access element to it, you might want to set its associated Internet access process in "List of SSL/TLS applications" Scan action setting to "Ignore" and see if that improves performance any.

Edited May 5, 2019 by itman

[itman 1,659]

Another and more likely source for your Autodesk software performance issue is Eset's deep behavior inspection processing introduced in ver. 12.1.34. As a test, disable this option in the Eset GUI HIPS section. A reboot may be required for the disabled status to become effective.

Now test the performance of your Autodesk software. If there is no longer any performance issues, you have found the source of the issue. At this point, you can re-enable deep behavior inspection processing and attempt to exclude your Autodesk executables. Retest with the Autodesk software to verify no performance issues exist. If Autodesk process exclusions do not solve the performance issues, then your only alternative is to disable Eset deep behavior inspection processing option when using your  Autodesk software. You can then open a support request with Eset over the problem.

Edited May 5, 2019 by itman

[zamar27 5]

On 5/4/2019 at 5:49 AM, Marcos said:

Please let us know about your findings.

Eset's deep behavior inspection is set by default to Automatic mode. I also noticed some CPU and laptop fan usage raise after recent Eset update. I wonder if Eset Deep Behavior Inspection Automatic mode means Auto Leaning mode, i.e. Eset checks a driver or launching EXE only once, and if allowed it no longer inspects its behavior at the future launches or activities?

Edited May 5, 2019 by zamar27

[zamar27 5]

7 hours ago, rawalanche said:

 neither the GUI setting nor the admin console are available in EIS version.

In previous Eset for Home releases one could disable egui.exe launch at PC startup in MSCONF. Now ecmds.exe at PC startup launches EGUI proxy, which seems to launch EGUI to show Splash at EIS launch, and then closes it. I don't think EGUI once closed represents a serious drawback for your system graphics performance. Just look at Process Explorer - its not running. 😉 One can switch off showing the Splash in Eset settings. Run resmon, eventvwr and other performance analysis tools to see what's hogging your PC.

Edited May 5, 2019 by zamar27

[itman 1,659]

1 hour ago, zamar27 said:

Eset's deep behavior inspection is set by default to Automatic mode.

Deep behavior inspection setting is either enabled or disabled. There is no "mode" setting for it. Believe you are referring to the HIPS filtering mode setting which is set by default to "Automatic mode." The HIPS filtering mode settings are explained below:

Quote

HIPS settings

Filtering mode can be performed in one of four modes:

•Automatic mode – Operations are enabled with the exception of those blocked by pre-defined rules that protect your system.

•Smart mode – The user will only be notified about very suspicious events.

•Interactive mode – User will be prompted to confirm operations.

•Policy-based mode – Operations are blocked.

•Learning mode – Operations are enabled and a rule is created after each operation. Rules created in this mode can be viewed in the Rule editor, but their priority is lower than the priority of rules created manually or rules created in automatic mode. When you select Learning mode from the HIPS Filtering mode drop down menu, the Learning mode will end at setting will become available. Select the time span that you want to engage learning mode for, the maximum duration is 14 days. When the specified duration has passed, you will be prompted to edit the rules created by HIPS while it was in learning mode. You can also choose a different filtering mode, or postpone the decision and continue using learning mode.

Mode set after learning mode expiration – Select the filtering mode that will be used after learning mode expires.

https://help.eset.com/eis/12/en-US/idh_hips_main.html

 

Edited May 5, 2019 by itman

[rawalanche 2]

I tried disabling HIPS and did not help. So far the only success aside from removing EIS completely was renaming those driver folders and files in safe mode and then killing all the ESET related processes. 

At this point, troubleshooting this has wasted me a lot more time than the price of my ESET licence, if I convert that time to money. I will have to look for other, more professional security solutions that do not reduce other software performance.

Edited May 5, 2019 by rawalanche

[zamar27 5]

1 hour ago, itman said:

Rules created in Learning mode can be viewed in the Rule editor, but their priority is lower than the priority of rules created manually or rules created in Automatic mode.

I don't see Windows GUI degraded by Eset at idle, only when installing Eset updates, and may be a little when verifying some launching EXE or downloads. But its unclear from above Help description, who creates rules for Automatic mode: are they created beforehand by Eset staff and added at program install, or they are generated by running Eset software? In this case, why they are called "predefined" and have priority over Learning mode rules also generated by Eset? 😊

Edited May 5, 2019 by zamar27

[itman 1,659]

Were these recommended directories and executables excluded in Eset?

https://knowledge.autodesk.com/search-result/caas/sfdcarticles/sfdcarticles/Are-there-antivirus-exclusions-I-can-implement-to-make-programs-run-better.html

[zamar27 5]

Excluded were in Eset? 😋

Eset becomes so multifacet by following protection market trends that "exclusion" option is offered directly or indirectly in multiple Advanced Settings sections. Of course Autodesk can't specify that in the article referring to any A/Vs. Its quite challenging for a typical user to differentiate actions of all options in various Eset Advanced Settings sections. On the other side, a user can contact Support with specific issues.

Edited May 6, 2019 by zamar27

[itman 1,659]

15 minutes ago, zamar27 said:

On the other side, a user can contact Support with specific issues.

That might be your next step since I am out of ideas.

[itman 1,659]

Here's an interesting posting: https://knowledge.autodesk.com/search-result/caas/sfdcarticles/sfdcarticles/chromium-host-executable-shows-high-cpu-usage.html . You might want to add the following to your Eset exclusions:

Quote

Add the acwebbrowser.exe *32 application to any Anti-Virus, Malware, Firewall or PC component tools/software as an exception (if applicable).

 

[Marcos 5,070]

Please enable advanced operating system logging in the advanced setup -> Tools -> Diagnostics. Then reproduce the problem, disable logging and provide us with the etl log generated in C:\ProgramData\ESET\ESET Security\Diagnostics in a compressed form.

Do not leave the logging enabled for longer than 1-2 minutes. Should it take longer to reproduce the problem, we'll provide you with further instructions.

[rawalanche 2]

On 5/6/2019 at 9:01 AM, Marcos said:

Please enable advanced operating system logging in the advanced setup -> Tools -> Diagnostics. Then reproduce the problem, disable logging and provide us with the etl log generated in C:\ProgramData\ESET\ESET Security\Diagnostics in a compressed form.

Do not leave the logging enabled for longer than 1-2 minutes. Should it take longer to reproduce the problem, we'll provide you with further instructions.

I've sent it to you in a PM.

[rawalanche 2]

I have sent the logs as requested and received no response. So I guess I've wasted even more of my time...