svchost cpu usage

[aDVll]

cpu usage is 0.01
but as I said if HIPSGui64.exe is not running cpu usage is 0.01

When you enable lockdown mode rehips still follows the rules and it's isolating. So there is a difference.
Assuming you enabled lockdown mode it's pretty clear the application launching dll again and again must be  the problem. Only way to figure which on is it is to uninstall them one by one until you figure which one is it so you can report the issue. If i was you i would start with sandboxie.

[Ozone]

ok thanks for help
I will try it later now I have to work, I will write if I find something

[aDVll]

ok thanks for help
I will try it later now I have to work, I will write if I find something

Good luck mate.

[fixer]

It's strange, HIPSGui acts as a thin client and does practically nothing but communicates with Service and shows windows. Is it possible to find the thread eating CPU and show its callstack (both Process Hacker and Process Explorer can do that)? Along with that either upload DLLs from callstack or use symbols so it'd show correct function names instead of plain addresses. Maybe it'll give some hint of what's going on.

[aDVll]

Hmm the only thing i had once was rehips gui cpu usage going up not svchost. Basically when something gets called again and again and you have it to inspect children(i think it was inspect maybe it was even allow) cpu usage goes up by a lot.

EDIT: Can't find the image. Will try and remember what app it was.

[Ozone]

I did some testing:
I have multiboot, win 7 and win 10 (insider) installed on different HDD –> same hardwares except HDD
I have installed rehips in win 10 with same programs as in win 7 (except MS office, 2007 in win 7 , 2013 in win 10) and with same security settings for security program
in win 10 no problem at all
I have reinstalled OS (win 7), installed updates and drivers and then rehips, and after launching rehips gui there was same problem with svchost so I think it's caused by driver or updates

[aDVll]

I did some testing:
I have multiboot, win 7 and win 10 (insider) installed on different HDD –> same hardwares except HDD
I have installed rehips in win 10 with same programs as in win 7 (except MS office, 2007 in win 7 , 2013 in win 10) and with same security settings for security program
in win 10 no problem at all
I have reinstalled OS (win 7), installed updates and drivers and then rehips, and after launching rehips gui there was same problem with svchost so I think it's caused by driver or updates

Good info then. Fixer will need to check it on win 7 then.

Did you try removing the security software one by one and see if it makes a difference?

[Ozone]

Good info then. Fixer will need to check it on win 7 then.
Did you try removing the security software one by one and see if it makes a difference?

no I've reinstalled win 7
I've installed all windows updates, update nvidia, intel and realtek drivers, installed ms office 2007 and updates
than rehips

[aDVll]

Good info then. Fixer will need to check it on win 7 then.
Did you try removing the security software one by one and see if it makes a difference?

no I've reinstalled win 7
I've installed all windows updates, update nvidia, intel and realtek drivers, installed ms office 2007 and updates
than rehips

Oh ok. Must admit never tried windows 7. Might be an issue like you are saying. I am sure the devs will check it out.

[Ozone]

It's strange, HIPSGui acts as a thin client and does practically nothing but communicates with Service and shows windows. Is it possible to find the thread eating CPU and show its callstack (both Process Hacker and Process Explorer can do that)? Along with that either upload DLLs from callstack or use symbols so it'd show correct function names instead of plain addresses. Maybe it'll give some hint of what's going on.

is this callstack?
each stacks is separate by empty lines
first stack appears mostly
other if I do several refresh

[fixer]

Yup, it's a thread callstack.
There is 1 thread in svchost process, that eats cpu. And these are callstacks for this thread in different periods of time. Am I correct?

[Ozone]

Yup, it's a thread callstack.
There is 1 thread in svchost process, that eats cpu. And these are callstacks for this thread in different periods of time. Am I correct?

yes
but there are more threads, they have same callstack

[Ozone]

after some testing I've found out that it's caused by rehips antispy module (only microphone, no problem with camera)

I have uninstalled 2 sound devices (realtek + intel) via device manager, and it fix the problem with svchost cpu usage, but than no sound
also it seems that  it's not problem with drivers as I tried different versions (realtek) and generic one from MS

[fixer]

Thanks for your testing, we really appreciate it. We've got it in our TODO list, we'll look into this issue.

[Ozone]

good

btw
if I disable one sound device rehips will show that microphone is disabled, but it's not, because 2nd sound device it's still enabled