HIPS slow down our application

[jinlei801011 2]

Hi ESET,

 

Currently we are using ESET Endpoint Antivirus version 5.0.2214.4

 

We have been troubleshooting in the last weeks why one of our in house designed application (Customer management system) is very slow on our terminal server. Actually we find out that our application is very slow (on the client side) when it runs on a computer or server having ESET with HIPS turned on.

 

Currently takes 20 seconds to create an invoice but would take around 3 seconds if we disable the HIPS in the antivirus.​

 

The main program that is slow because of HIPS is Client.WinClient.exe. This is our main application developed internally using Microsoft .Net 2.0 framework. That’s a desktop base application connecting to webservices on another server.

 

Excluded related files from scanning and checking, also created HIPS rule, but issue still persist.

 

Please help

[Marcos 5,074]

Does enabling HIPS but temporarily disabling Advanced memory scanner solve the issue?

[jinlei801011 2]

Does enabling HIPS but temporarily disabling Advanced memory scanner solve the issue?

 

Tried disable advanced memory scanner only but issue still persist, must disable everything in HIPS

[Marcos 5,074]

What operating system and platform do you use? Would it be possible to get the application for troubleshooting purposes? Would you be willing to co-operate and install a logging version of HIPS?

Also please do the following:

- enable logging of blocked operations in the advanced HIPS setup

- clear the HIPS log

- reproduce the issue

- post the HIPS log records here

- disable logging.

[jinlei801011 2]

What operating system and platform do you use? Would it be possible to get the application for troubleshooting purposes? Would you be willing to co-operate and install a logging version of HIPS?

Also please do the following:

- enable logging of blocked operations in the advanced HIPS setup

- clear the HIPS log

- reproduce the issue

- post the HIPS log records here

- disable logging.

 

OS is Windows 7, Server is Win2008. HIPS log:

 

hipslog.txt

Edited October 26, 2015 by Marcos
Log moved to a text file

[Marcos 5,074]

Does the issue occur with HIPS enabled but self-defense disabled? If so, please post a fresh HIPS log.

[tarheel 0]

We are having a similar issue although it is not clear if HIPS is the issue.  We turned protocol filtering off but still we get reports that our web application is slow once ESET is installed with HIPS turned on.

Any resolution to this?

[Marcos 5,074]

4 hours ago, tarheel said:

We are having a similar issue although it is not clear if HIPS is the issue.  We turned protocol filtering off but still we get reports that our web application is slow once ESET is installed with HIPS turned on.

Any resolution to this?

Please drop me a pm with step-by-step instructions how to reproduce the issue.

[Miami 4]

Similar problems here. HIPS causing around 25% CPU load. On some computers is this just temporary on some almost all the time.

[Marcos 5,074]

9 minutes ago, Miami said:

Similar problems here. HIPS causing around 25% CPU load. On some computers is this just temporary on some almost all the time.

Please provide instructions how to reproduce the issue on our part. Does temporarily disabling Advanced memory scanner make a difference?

[Miami 4]

17 hours ago, Marcos said:

Please provide instructions how to reproduce the issue on our part. Does temporarily disabling Advanced memory scanner make a difference?

It looks like it could have something to do with enabled logging for available HIPS rules. What we have tried was dissabling logging on custom HIPS rules => it wasn't very helpfull. Then we changed minimum logging verbosity for all logs from Informative to warning and still nothing. After these chages we tried restart (disable/enable) HIPS and problem was gone.

So right now, I'm not sure which from described was helpfull. We will try to do some more testing on problematic clients.