I have little problem with svchost cpu usage after installing rehips
Quote from: Ozone on January 03, 2017, 04:09:55 PM
I just run process explorer and I noticed that svchost.exe (DcomLaunch) is using around 10 % CPU, after some testing I figured it started after I've installed rehips, so is this normal
cpu is i7-3610qm
security software: HMP.A (free - no anti-exploit), MBAE free, avast, wfc, sandboxie
Quote from: Ozone on January 03, 2017, 04:55:20 PM
ok tried to add rehips folder to exception (avast), still no change,
so I've tried to disable avast shields and reboot
And noticed that rehips gui won't start (forgot to check autostart after reinstall), svchost uses only 0.01 % CPU,
but after running HIPSGui64.exe, it will again use around 10 % even with avast disabled
For logs click advanced mode. A log tab will show, click on that and then click on the save button.
Btw i assume you don't isolate browsers or anything with both rehips and sandboxie together right?
nope I have to edit initial rules for chrome to be able to use it with sandboxie,
for firefox I use rehips when I need to
also each time I run rehips the log will be clean and it will show only
"time" Connected to Local Server
"time" Standard Mode activated
so should I wait more time to have more info, because right now there are only logs about how I saved log
btw
sandboxie is free so no forced folder or files
Quote from: Ozone on January 03, 2017, 05:57:10 PM
nope I have to edit initial rules for chrome to be able to use it with sandboxie,
for firefox I use rehips when I need to
also each time I run rehips the log will be clean and it will show only
"time" Connected to Local Server
"time" Standard Mode activated
so should I wait more time to have more info, because right now there are only logs about how I saved log
btw
sandboxie is free so no forced folder or files
yeah wait a bit until you see the cpu usage happening for afew minutes.
Also not sure what you mean edited rules for chrome. What exactly did you change?
it was set to run isolated so I have to change it to allow
Quote from: Ozone on January 03, 2017, 06:01:35 PM
it was set to run isolated so I have to change it to allow
Ok then try running the browser not sandboxed and see if the cpu is the same.
it's same even if I don't run anything, and log show nothing but process explorer still show that svchost has 10 % cpu usage
to be sure if it's not caused by process explorer I tried process hacker and skins in rainmeter but still same
Quote from: Ozone on January 03, 2017, 06:16:24 PM
it's same even if I don't run anything, and log show nothing but process explorer still show that svchost has 10 % cpu usage
to be sure if it's not caused by process explorer I tried process hacker and skins in rainmeter but still same
Post the logs anw someone might see something useful.
here is log
Quote from: Ozone on January 03, 2017, 06:24:54 PM
here is log
I see dll host launching and terminating again and again. I believe it's sandboxie so any change you remove it or disable service and gui and see how that goes?
disabled and process terminated but still same
Quote from: Ozone on January 03, 2017, 06:41:36 PM
disabled and process terminated but still same
Does the ddl show up in the logs again and again?
yeah
dllhost.exe allowed and after few s terminated
Quote from: Ozone on January 03, 2017, 06:50:37 PM
yeah
dllhost.exe allowed and after few s terminated
To confirm can you enable lockdown mode and then exit rehips? After that check cpu usage.
cpu usage is 0.01
but as I said if HIPSGui64.exe is not running cpu usage is 0.01
Quote from: Ozone on January 03, 2017, 07:11:38 PM
cpu usage is 0.01
but as I said if HIPSGui64.exe is not running cpu usage is 0.01
When you enable lockdown mode rehips still follows the rules and it's isolating. So there is a difference.
Assuming you enabled lockdown mode it's pretty clear the application launching dll again and again must be the problem. Only way to figure which on is it is to uninstall them one by one until you figure which one is it so you can report the issue. If i was you i would start with sandboxie.
ok thanks for help
I will try it later now I have to work, I will write if I find something
Quote from: Ozone on January 03, 2017, 07:20:55 PM
ok thanks for help
I will try it later now I have to work, I will write if I find something
Good luck mate.
It's strange, HIPSGui acts as a thin client and does practically nothing but communicates with Service and shows windows. Is it possible to find the thread eating CPU and show its callstack (both Process Hacker and Process Explorer can do that)? Along with that either upload DLLs from callstack or use symbols so it'd show correct function names instead of plain addresses. Maybe it'll give some hint of what's going on.
Hmm the only thing i had once was rehips gui cpu usage going up not svchost. Basically when something gets called again and again and you have it to inspect children(i think it was inspect maybe it was even allow) cpu usage goes up by a lot.
EDIT: Can't find the image. Will try and remember what app it was.
I did some testing:
I have multiboot, win 7 and win 10 (insider) installed on different HDD –> same hardwares except HDD
I have installed rehips in win 10 with same programs as in win 7 (except MS office, 2007 in win 7 , 2013 in win 10) and with same security settings for security program
in win 10 no problem at all
I have reinstalled OS (win 7), installed updates and drivers and then rehips, and after launching rehips gui there was same problem with svchost so I think it's caused by driver or updates
Quote from: Ozone on January 06, 2017, 11:28:29 PM
I did some testing:
I have multiboot, win 7 and win 10 (insider) installed on different HDD –> same hardwares except HDD
I have installed rehips in win 10 with same programs as in win 7 (except MS office, 2007 in win 7 , 2013 in win 10) and with same security settings for security program
in win 10 no problem at all
I have reinstalled OS (win 7), installed updates and drivers and then rehips, and after launching rehips gui there was same problem with svchost so I think it's caused by driver or updates
Good info then. Fixer will need to check it on win 7 then.
Did you try removing the security software one by one and see if it makes a difference?
Quote from: aDVll on January 06, 2017, 11:30:34 PM
Good info then. Fixer will need to check it on win 7 then.
Did you try removing the security software one by one and see if it makes a difference?
no I've reinstalled win 7
I've installed all windows updates, update nvidia, intel and realtek drivers, installed ms office 2007 and updates
than rehips
Quote from: Ozone on January 06, 2017, 11:58:28 PM
Quote from: aDVll on January 06, 2017, 11:30:34 PM
Good info then. Fixer will need to check it on win 7 then.
Did you try removing the security software one by one and see if it makes a difference?
no I've reinstalled win 7
I've installed all windows updates, update nvidia, intel and realtek drivers, installed ms office 2007 and updates
than rehips
Oh ok. Must admit never tried windows 7. Might be an issue like you are saying. I am sure the devs will check it out.
Quote from: fixer on January 05, 2017, 02:48:44 PM
It's strange, HIPSGui acts as a thin client and does practically nothing but communicates with Service and shows windows. Is it possible to find the thread eating CPU and show its callstack (both Process Hacker and Process Explorer can do that)? Along with that either upload DLLs from callstack or use symbols so it'd show correct function names instead of plain addresses. Maybe it'll give some hint of what's going on.
is this callstack?
each stacks is separate by empty lines
first stack appears mostly
other if I do several refresh
Yup, it's a thread callstack.
There is 1 thread in svchost process, that eats cpu. And these are callstacks for this thread in different periods of time. Am I correct?
Quote from: fixer on January 08, 2017, 03:36:37 PM
Yup, it's a thread callstack.
There is 1 thread in svchost process, that eats cpu. And these are callstacks for this thread in different periods of time. Am I correct?
yes
but there are more threads, they have same callstack
after some testing I've found out that it's caused by rehips antispy module (only microphone, no problem with camera)
I have uninstalled 2 sound devices (realtek + intel) via device manager, and it fix the problem with svchost cpu usage, but than no sound
also it seems that it's not problem with drivers as I tried different versions (realtek) and generic one from MS
Thanks for your testing, we really appreciate it. We've got it in our TODO list, we'll look into this issue.
good
btw
if I disable one sound device rehips will show that microphone is disabled, but it's not, because 2nd sound device it's still enabled
CPU usage should be fixed now.
Quote from: Ozone on January 14, 2017, 11:55:29 PM
if I disable one sound device rehips will show that microphone is disabled, but it's not, because 2nd sound device it's still enabled
Is it reproducable on the latest prosperity build?
I am using prosperity and I still have problem with CPU usage.
Rehips will now show square in check box so it's better, but now if I don't disable microphone manually via tray sound icon, rehips will fail to disable sound device with microphone, other sound device will be disabled
CPU usage was fixed after prosperity, so it's OK.
Does ReHIPS complain that it can't change state of sound device and that the device may probably be in use?
yeah
have to disable all recording devices (microphone and stereo mix), and in device manager it will show that I have to restart pc to apply changes
Some audio devices are indeed can't change their state, if they're in use. As sound card is disabled completely, sometimes even playing music prevents the device from being disabled. Maybe it's the case you have. If not, like you can't disable it even right after reboot without any other programs running, then could you give a detailed step-by-step description of what you do and what you see.
yeah it says it's in use
after reboot I can disable it but only if I am really fast
also I think it's driver related because with generic driver I don't have problem with it
So you just boot and do nothing. If you're fast, ReHIPS disables all sound devices without any problems. But if you wait for a couple of minutes, some sound devices become in use and ReHIPS doesn't disable them and complains. Correct?
If you rollback to default sound drivers, it always works OK. Correct?
If you boot and wait for a couple of minutes disabling of the same sound devices from device manager also fails and asks for reboot to apply settings. Correct?
correct
but I need to be really fast, sometimes it works sometimes not
Then I guess it's not ReHIPS fault. Something does indeed start to use audio device and doesn't let it go. Do you have any software that comes with the drivers? I don't think that driver itself is responsible for this. Most likely it's some software that doesn't do it if it doesn't see its specific driver when you roll back to default driver.
I am sorry but currently I can't test it, my HDD is failing and I am on other system
but IIRC I've installed Realtek High Definition Audio Codecs driver from Microsoft Update Catalog and the only software it comes with is Realtek audio manager,
I have disabled all realtek services and still I couldn't disable sound card, unless I disable all recording devices
Does anyone else have the same or similar issue with realtek? As I have realtek on one of my old PCs, but don't have the issue.
Quote from: fixer on May 14, 2017, 02:58:24 PM
Does anyone else have the same or similar issue with realtek? As I have realtek on one of my old PCs, but don't have the issue.
Also have realtek but it doesn't affect me. It sure takes a while to disable it but it does it at the end(30sec). What version of the driver do you guys have? Mine is the one shown below.
http://i.imgur.com/9ALuMGR.png (http://i.imgur.com/9ALuMGR.png)
I think I have found out culprit, driver I have installed has corrupted/missing files (HDD is failing), I can't test it now but after I get new HDD I will tell,
also found out that if I have window with sound devices (rundl32.exe) open, device manager and ReHIPS won't disable sound card if recording devices are enabled
I have installed latest driver and no errors appear
As I suspected, it wasn't ReHIPS fault. Good, it's solved then.
The lightest security software I ever had is Rehips. :)
25 mg of ram is the max usage for rehips.so smooth and fast not even one problem with any driver or other security software ;)