XhenEd

EIS Consuming CPU Because of Process Lasso

Recommended Posts

Whenever the GUI of Process Lasso is launched, EIS would consume 2-5% of CPU power all the time. I tried putting PL's processes into Whitelist under File Guard, but it wouldn't really work. EIS would still consume 2-5% CPU power all the time.

 

Of course, if I close the GUI of PL, EIS would calm down.

Also, I tried disabling both Surf Protection and BB. Surprisingly, EIS calms down even if the GUI of PL is on.

 

I already reported this to PL team, and they already took action about this. They put EIS' processes into exclusions, meaning that PL won't "look and touch" into EIS' processes. The team were suspecting that EIS is activating its tampering protection whenever PL "looks" into it. But the exclusion still didn't solve the problem.

 

I suspect that it's because of PL's inherent action. Process Lasso is designed to "look" or read other processes, so that it can act (e.g. Probalance) on them. So, also because of EIS' behavior monitoring of processes, I think that it constantly monitors PL's behavior, thus constantly consuming 2-5% of CPU power all the time.

 

This is PL's website: https://bitsum.com/processlasso/

Share this post


Link to post
Share on other sites

The problem is not that they are looking. The problem is that they are opening a whole bunch of processes with rights that allow them to modify and change the process in rapid succession over and over again. The following whitelist entry should fix the high CPU consumption though:

 

dnhcHbf.png

 

Make sure that the type is set to "Process".

Share this post


Link to post
Share on other sites

The problem is not that they are looking. The problem is that they are opening a whole bunch of processes with rights that allow them to modify and change the process in rapid succession over and over again. The following whitelist entry should fix the high CPU consumption though:

 

dnhcHbf.png

 

Make sure that the type is set to "Process".

Oh, okay...

But, like I said, I already did that "exclusion". The problem is not solved. :(

Share this post


Link to post
Share on other sites

Did you restart ProcessLasso.exe after that? Exclusions are only applied on process start. Adding an exclusion for a process that is already running does nothing.

Share this post


Link to post
Share on other sites

Did you restart ProcessLasso.exe after that? Exclusions are only applied on process start. Adding an exclusion for a process that is already running does nothing.

Okay. Thanks for that info!

Yes, after I close and open ProcessLasso.exe (also even after system restart), all is normal for EIS. But the problem will come back after a few minutes. And after I close PL.exe, EIS goes normal again. It's inconsistent for me. It's a hit and miss situation.

 

 

Edit: I'm testing it again right now. I'll report back if EIS would consume CPU power again even after whitelisting PL.exe (which I already did days ago).

 

Thanks, Fabian!

Share this post


Link to post
Share on other sites

Bump!

I just tried a system restart, and the problem presents itself again. I waited for a few minutes because EIS might just be loading its engine. But when I closed (ended) PL's GUI, EIS consumption of CPU went back to 0%. So, EIS might be really forgetting its whitelists after a system restart.

Share this post


Link to post
Share on other sites

Process Lasso may start before EIS is started, so the exclusions simply aren't in effect yet.

So, this means that EIS must always load first before the excluded processes would load?

Share this post


Link to post
Share on other sites

We do have plans to change this behavior in the future. However, it will take at least one more major release until we are actually able to fix it.

Okay. At least, you'll fix this. What and when is that major release? Is that like EIS 11? Will it be launched next year or next, next year? I hope it's not like that. :D

 

What would you recommend me about the problem? Should I try delaying the launch of ProcessLasso,exe? Is that even possible for a non-service?

Share this post


Link to post
Share on other sites

Major release would be version 11, yes. There is no ETA for version 11 as of yet. You can just disable the auto start of Process Lasso and run it manually after boot.

  • Upvote 1

Share this post


Link to post
Share on other sites

Major release would be version 11, yes. There is no ETA for version 11 as of yet. You can just disable the auto start of Process Lasso and run it manually after boot.

Okay. Thanks, Fabian!

Share this post


Link to post
Share on other sites

Exclusions only applying until after EAM/EIS has started is definitely fixed. Everything beyond that is something that Process Lasso needs to fix, as they are the ones that excessively open processes instead of caching process handles.

Share this post


Link to post
Share on other sites

I already excluded (whitelisted) ProcessLasso.exe. But after system restart, EIS would consume a little amount of CPU power again all the time until I closed PL's GUI.

Whitelisting the process will let the process do whatever it does, right? It's clearly not the case for PL.

 

What about other whitelisted processes? If they start before EIS, then that should be a security concern. Isn't it?

Share this post


Link to post
Share on other sites

Can you check Protection/Behavior Blocker if the Process Lasso is being listed as monitored?

Yes, it is, after system restart. But after closing and then starting ProcessLasso.exe it now would become not monitored.

Share this post


Link to post
Share on other sites

I can't reproduce it on any of my systems. Exclusions work just fine, no matter the start order. Sorry, but since the underlying cause is a ProcessLasso issue, I suggest you ask them to fix their wasteful resource usage, as the exclusion is just a workaround to begin with.

Share this post


Link to post
Share on other sites

I just want to say that this is fixed. I don't know what and which changes. I just installed back EIS from using another AV for more than 2 months. So far, the issue does not persist. :D I don't even need to put PL's processes into exclusion. It's just a vanilla installation, and all is well. :D

Share this post


Link to post
Share on other sites

Actually, the problem still exists. It is just hidden. Unless Process Lasso fixes their wasteful behavior when it comes to allocating resources, this will never change. 

Share this post


Link to post
Share on other sites

Ohhh... okay... But for me it's fixed. I didn't even exclude PL's processes.

I'll let PL dev know about your concern. He might be able to optimize PL more. Thanks!

Share this post


Link to post
Share on other sites

Fabian, I am the author of Process Lasso.

 

Can we start a private dialog so that I can understand the underlying cause of this issue better and address it properly on my end.

 

This would be more optimal than tossing insults around ;). If there is any case of wasteful resource use, I'd like to know about it, as I am not presently aware of such. Of course, there are always things that can be more optimal, but that's true of any software.

 

Can you email me at [email protected] to begin this dialog?

 

I am entering v9 alpha dev, so I can finally break the mold of v8 and make some larger changes; thus, the timing is good.

 

Thank you very much!

Share this post


Link to post
Share on other sites
Guest
This topic is now closed to further replies.

  • Recently Browsing   0 members

    No registered users viewing this page.