jinlei801011 2 Posted October 24, 2015 Share Posted October 24, 2015 Hi ESET, Currently we are using ESET Endpoint Antivirus version 5.0.2214.4 We have been troubleshooting in the last weeks why one of our in house designed application (Customer management system) is very slow on our terminal server. Actually we find out that our application is very slow (on the client side) when it runs on a computer or server having ESET with HIPS turned on. Currently takes 20 seconds to create an invoice but would take around 3 seconds if we disable the HIPS in the antivirus. The main program that is slow because of HIPS is Client.WinClient.exe. This is our main application developed internally using Microsoft .Net 2.0 framework. That’s a desktop base application connecting to webservices on another server. Excluded related files from scanning and checking, also created HIPS rule, but issue still persist. Please help Link to comment Share on other sites More sharing options...
Administrators Marcos 4,704 Posted October 24, 2015 Administrators Share Posted October 24, 2015 Does enabling HIPS but temporarily disabling Advanced memory scanner solve the issue? Link to comment Share on other sites More sharing options...
jinlei801011 2 Posted October 24, 2015 Author Share Posted October 24, 2015 Does enabling HIPS but temporarily disabling Advanced memory scanner solve the issue? Tried disable advanced memory scanner only but issue still persist, must disable everything in HIPS Link to comment Share on other sites More sharing options...
Administrators Marcos 4,704 Posted October 24, 2015 Administrators Share Posted October 24, 2015 What operating system and platform do you use? Would it be possible to get the application for troubleshooting purposes? Would you be willing to co-operate and install a logging version of HIPS? Also please do the following: - enable logging of blocked operations in the advanced HIPS setup - clear the HIPS log - reproduce the issue - post the HIPS log records here - disable logging. Link to comment Share on other sites More sharing options...
jinlei801011 2 Posted October 26, 2015 Author Share Posted October 26, 2015 (edited) What operating system and platform do you use? Would it be possible to get the application for troubleshooting purposes? Would you be willing to co-operate and install a logging version of HIPS? Also please do the following: - enable logging of blocked operations in the advanced HIPS setup - clear the HIPS log - reproduce the issue - post the HIPS log records here - disable logging. OS is Windows 7, Server is Win2008. HIPS log: hipslog.txt Edited October 26, 2015 by Marcos Log moved to a text file Link to comment Share on other sites More sharing options...
Administrators Marcos 4,704 Posted October 26, 2015 Administrators Share Posted October 26, 2015 Does the issue occur with HIPS enabled but self-defense disabled? If so, please post a fresh HIPS log. Link to comment Share on other sites More sharing options...
tarheel 0 Posted March 13, 2017 Share Posted March 13, 2017 We are having a similar issue although it is not clear if HIPS is the issue. We turned protocol filtering off but still we get reports that our web application is slow once ESET is installed with HIPS turned on. Any resolution to this? Link to comment Share on other sites More sharing options...
Administrators Marcos 4,704 Posted March 13, 2017 Administrators Share Posted March 13, 2017 4 hours ago, tarheel said: We are having a similar issue although it is not clear if HIPS is the issue. We turned protocol filtering off but still we get reports that our web application is slow once ESET is installed with HIPS turned on. Any resolution to this? Please drop me a pm with step-by-step instructions how to reproduce the issue. Link to comment Share on other sites More sharing options...
Miami 4 Posted March 28, 2017 Share Posted March 28, 2017 Similar problems here. HIPS causing around 25% CPU load. On some computers is this just temporary on some almost all the time. Link to comment Share on other sites More sharing options...
Administrators Marcos 4,704 Posted March 28, 2017 Administrators Share Posted March 28, 2017 9 minutes ago, Miami said: Similar problems here. HIPS causing around 25% CPU load. On some computers is this just temporary on some almost all the time. Please provide instructions how to reproduce the issue on our part. Does temporarily disabling Advanced memory scanner make a difference? Link to comment Share on other sites More sharing options...
Miami 4 Posted March 29, 2017 Share Posted March 29, 2017 17 hours ago, Marcos said: Please provide instructions how to reproduce the issue on our part. Does temporarily disabling Advanced memory scanner make a difference? It looks like it could have something to do with enabled logging for available HIPS rules. What we have tried was dissabling logging on custom HIPS rules => it wasn't very helpfull. Then we changed minimum logging verbosity for all logs from Informative to warning and still nothing. After these chages we tried restart (disable/enable) HIPS and problem was gone. So right now, I'm not sure which from described was helpfull. We will try to do some more testing on problematic clients. Link to comment Share on other sites More sharing options...
Recommended Posts