Jump to content

ehdrv.sys sometimes major performance impact in NtDuplicateObject even the protection is paused

Recommended Posts

this is a screenshot of dotTrace


even i stop the protection of eset, by pressing the 'pause protection'. this situlation still exists. (this trace in screenshot is run under protection paused.)

not every time calling NtDuplicateObject has such performance impact.

my program run query process handle info (many times, maybe 200+) every three seconds, usually it should not higher than 500ms, but some times this could tooks up 35+ seconds, so i run a trace on it, and this is the trace result.

is there a way to mitigation this issue? i means even i have already pause the protection (select until reboot).


thanks in advance!

Link to comment
Share on other sites

  • Administrators

Please raise a support ticket and provide step-by-step instructions how to reproduce it.

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Create New...