High CPU Usage, strange memory usage

[Chubb]

Copied from my previous post, Memory Usage in Windows XP:
http://www.wilderssecurity.com/showthread.php?t=128988

Memory usage:

Ewido 4.0.0.147 Beta
guard.exe 21,704K
Ewido.exe 12,784K

CounterSpy 1.5.82
SunThreatEngine.exe 59,336K
SunProtectionServer.exe 13,532K
SunServer.exe 9,624K

KAV 6.0.0.299
avp.exe 5,900K
avp.exe 2,664K

Ewido.exe jumped between 20-56% of the CPU time, while CounterSpy and KAV didn't have such big CPU consumption.


Memory usage in my Windows 2000 (which was dual boot with Windows XP with the same hardware)

Ewido 4.0.0.147 Beta
guard.exe 22,204K
Ewido.exe 23,236K

Memory usage of Ewido.exe in Win2K nearly doubles that in Windows XP. However, half an hour later, memory usage of Ewido.exe dropped to 5,320K. Strange!!!

Peak memory usage:
guard.exe 67,704K
Ewido.exe 68,808K


NOD32 2.51.26
nod32krn.exe 17,648K
nod32kui.exe 2,892K

SpySweeper 4.5.9.709
spysweeper.exe 14,784K
wrsssdk.exe 14,008K

CPU Usage: from 1% to 88%. The fluctuation and peak is much higher than in Windows XP.

Is this normal?

[peter.ewido]

Can please check the mem usage with the current build again?
And also, what is the cpu usage when the main window is closed and only the guard is still active?

[gerardwil]

When I start pc (ewido 4 loads in systray) ewido uses already a lot cpu. What I do: I open the main window of ewido and close it again. Then the cpu usage is gone. (less then 1 %)
mem:
ewido.exe 1,5 K
guard.exe 5K

Gerard

[siliconman01]

Windows XP-SP2 HE, Ewido 4.0 Beta Build 150.

Having the GUI Ewido open and "just sitting there" results in a continuous cpu usage ranging from 14% to 55%. In watching SysInternal's FileMon and DiskMon during this period shows Ewido doing a tremendous and consistent amount of file/disk activity.

{QUOTE-> When I start pc (ewido 4 loads in systray) ewido uses already a lot cpu. What I do: I open the main window of ewido and close it again. Then the cpu usage is gone. (less then 1 %)
<-QUOTE}

I see the same thing on reboot.

[Chubb]

{QUOTE-> Can please check the mem usage with the current build again?
And also, what is the cpu usage when the main window is closed and only the guard is still active? <-QUOTE}

Cannot check mem usage with Build 150 and 151 because it crashed after updating to the most current buid. :'( error.err attached in my thread.

[chaos]

{QUOTE-> When I start pc (ewido 4 loads in systray) ewido uses already a lot cpu. What I do: I open the main window of ewido and close it again. Then the cpu usage is gone. (less then 1 %)
mem:
ewido.exe 1,5 K
guard.exe 5K

Gerard <-QUOTE}
none problem like that here.Nothing happens in my system...

[Brandon]

Windows XP SP2 - Ewido 4.0 build 151.

It ranges 3% to 47% for me when I open the gui. Then once I close it to the system tray it stops.

[siliconman01]

Even with the GUI closed, Ewido.exe rapidly cycles between 0-14% CPU utilization....every 2-3 seconds it will spike. Not nice at all. :(

[Brandon]

{QUOTE-> Even with the GUI closed, Ewido.exe rapidly cycles between 0-14% CPU utilization....every 2-3 seconds it will spike. Not nice at all. :( <-QUOTE}

For me its 0% to 6%..when the gui is closed..

[gkweb]

CPU Athlon 64 3800+

Ewido.exe always between 1%-3% while GUI closed and no action.
Guard.exe always 0% while no action.

[chaos]

Same here Athlon 3800+
cpu ~1-3%

[siliconman01]

Hmmm... I running a P4 2.6 ghertz, 1.5 gbyte DRAM, on a Dell Dimension 8200.

[chaos]

{QUOTE-> Hmmm... I running a P4 2.6 ghertz, 1.5 gbyte DRAM, on a Dell Dimension 8200. <-QUOTE}
Are you sure its because of ewido.What other software is running concurrently with the ewido realtime monitor.

[siliconman01]

I closed down all programs, disabled my AV, turned off all shields in Ewido and it still spikes up every 2-3 seconds, up as high as 17%.

[OldRebel]

I fell asleep in the early morning hours while doing a long download on dialup. When I woke up, Ewido had updated and there was a message that the program needed to shut down and restart. When I clicked OK, it did restart,but there was a momentary (somewhat startling) "blinK" or "flash" of my desktop when it did. I have also noticed a similar "flash" when logging in to Windows as Ewido appears in the system tray. I did not see this happening when I had version 3.5. Is anyone else experiencing this? I will attach a screen shot of my taskmanager taken several hours after the update. This is with the guard enabled and Spysweeper and McAfee AV both running RTP.

[chaos]

no cpu spike problems but
heavy use of virtual memory now that I notice it ...

[sosaiso]

I'm running it on a Celeron, and it has spiked up to 30% sometimes.

[Brandon]

{QUOTE-> I closed down all programs, disabled my AV, turned off all shields in Ewido and it still spikes up every 2-3 seconds, up as high as 17%. <-QUOTE}

Did what you did and mine reaches 13% for the highest and spikes every 2-3 seconds like you.

[OldRebel]

I just uninstalled the beta. Whenever it updated, it made my desk top "blink" or "convulse" for a moment. It did the same thing when loading in the system tray at start up of Windows. It was becoming hard to send emails through my AOL software and it was taking longer than normal to open my Windows control panel and various folders. Somehow, I think the beta is not "playing well" with the Windows shell, but I don't know enough about that to explain. I noticed that much more K was used overall with the beta. After I uninstalleld, I tried to download/install Ewido 3.5, but I kept getting a Windows message that the installer package was corrupt or that there was an error with my disc. I download and tried 3 times. Then I decided to thoroughly clean up. I went to delete some temp files, and Windows said it could not do it because there was a problem reading the disc. I ran sfc /scannow, chkdsk /R, and defragged. Then I downloaded 3.5 again, and it installed normally. I don't understand what was going on, but it reminds me a little or the problems I had when I was using Windows Defender. For example, sometimes sending a email with an attachment or screenshot, I would have to wait 15 minutes or more for it to upload. Normally it takes about a minute. Maybe someone with more knowlege can explain this. I am going to run Ewido 3.5 for a few days to see if any of the problems happen again while I am using it instead of version 4.0. Right now, I'm very frustrated.

[Brandon]

It seems the cpu usage for me its 3% to 16% and it uses 4K - 9K mem usage when doing a scan when the gui is closed. Anyone else experience this?

[peter.ewido]

That's absolutely normal... The cpu usage depends on what type of file is currently being scanned etc.

[Brandon]

It seemed to do that for me throughout the whole scan ??? ..or is that also normal?

[siliconman01]

{QUOTE-> That's absolutely normal... The cpu usage depends on what type of file is currently being scanned etc. <-QUOTE}

What I experience is that if I do a scan with the GUI open, the overall CPU utilization is approximately double of doing a scan with the GUI closed. That doesn't seem to be kosher.

[Brandon]

{QUOTE-> What I experience is that if I do a scan with the GUI open, the overall CPU utilization is approximately double of doing a scan with the GUI closed. That doesn't seem to be kosher. <-QUOTE}

Thats about the same problem I was observing when doing a scan..

[vinzenz.ewido]

ewido anti-malware 4.0 suspends a lot of work while it is in tray since it is only needed if the user is watching at the GUI.

This is the reason why memory and cpu usage are going down if it is minimized to tray.

Now guys I'll say it once more. We need to fix all the bugs first before we're going to improve such things as memory and cpu usage.

I know that there are things which can be improved but this will maybe cause other bugs so before making more bugs we need to fix the bugs already there.

I hope you can understand this.


BR

Edit: @siliconman01

This is really strange I'll take a look at this issue.
BR

[siliconman01]

Fully recognizing that this is BETA testing and that bugs, etc., are to be expected-

I just hope ewido understands that the CPU usage by ewido.exe as it stands now makes ewido 4.0 an undesireable security program when-

1. Ewido.exe consumes 20-30% CPU utilization for 7-9 minutes following boot up when the system is restarted.

2. Ewido.exe spikes memory 7-20% every 2-3 seconds when it is minimized to the systray. In addition, I've seen it start using 15-20% CPU continuously for no apparent reason and the only way to get it to stop is to close down ewido.exe and restart it (not a frequent occurrence; however, I had this happen at least 4 times since beta testing started).

3. Ewido.exe consumes 20-30% CPU as long as the GUI is open...just sitting there...user doing nothing.

4. Ewido.exe's GUI being open causes a scan to consume 50%+ more CPU utilization as compared to the scan being done when the GUI is closed.

5. Plus 1-4 occurs whether all shields are turned on or off which adds to the "mysterious" behavior concern.

Whether this behavior is called a "bug" or "non-optimized" is a matter of word definitions. I (and I suspect many other users) will be very disappointed if a public release of 4.0 exhibits this negative impact on a user system. And this is on a fairly fast Dell with lots of memory, etc., under XP-SP2 HE.

JMO ;)

[chaos]

Optimization is a completely different programming task than debugging.
Its not a matter of definition.
Its a different thing when the code of the program does redundant things wasting system resources than when the code is buggy.An extremely simple example is the following.
Unoptimized C code
i=i+1;
a=a+i;
Optimized C code
a+=(++i);
Both do the same but the second is much more efficient.
Optimization is the process of substituting a suboptimal algorithm with one other that does the same thing using less resources,which means doing the same thing more efficiently in very general terms.

Buggy code on the other hand is something totally different.In general and simple terms we can say that the code is doing something different than what the programmer wants.
It could be a design error.It could be a mistyping error.It could be many things!
From your description of the problems I think that what is causing them is probably buggy code(Dont forget that its a beta).
Additionally modern programming focuses on the reusability of the code,easy understanding of what the code does(even from people that didnt participate in writing the original program) and easy maintenance of the program(for example adding new features).Optimizing is not among the priorities any more as it once was because computers had *very* limited resources.

[OldRebel]

Any idea yet when the next build will be released with these bugs fixed? I want to reinstall the beta, but I am waiting for the newer build.

[vinzenz.ewido]

"These bugs" Are many :| We need some time.

But the next build should be available soon. I can't tell you exactly when 4.0.0.151 will be available.

BR

[OldRebel]

I will wait patiently. I have faith in you guys at Ewido. These things do take time to perfect.

[honeybunny]

{QUOTE-> "These bugs" Are many :| We need some time.

But the next build should be available soon. I can't tell you exactly when 4.0.0.151 will be available.

BR <-QUOTE}
I ´think you mean 4.0.0.152 ::)

[siliconman01]

{QUOTE-> "These bugs" Are many :| We need some time.

But the next build should be available soon. I can't tell you exactly when 4.0.0.151 will be available.

BR <-QUOTE}

Fully understand and accept this. That's what Beta testing is all about. ;)

[vinzenz.ewido]

{QUOTE-> I ´think you mean 4.0.0.152 ::) <-QUOTE}

Yeah right.

[greenhatch]

I, for one, accept your point Vinzenz. However I was intrigued by all of this, so I observed my Task Manager for an hour after reboot; I noticed quite heavy CPU usage by Ewido going up and down between 5% and 25% initially, but then it quietened down to barely noticeable, like 1% to 3% after 45 minutes. Almost as if 4.0 needs to warm up, heh.

[lu_chin]

I also saw the Ewido 4.0 CPU usage spikes happening every few seconds. I think it may have something to do with running other antispyware, antivirus, HIPS programs at the same time. How many have seen heavy periodical CPU usage by Ewido 4.0 when not running other security applicatons?

Regards,
Lu Chin

[khazars]

I've just downloaded this and its footprint is only 6-7 MB and no problems what so ever.

I am running Jetico, ghost security suite beta 1.110, proxomitron, arovax shield, pgfree, socketshield beta and anti vir free.

[lhbump]

I put the file lsass.exe and my antivirus's program folder (nod32 av) on the exceptions list and the spikes disappeared.

[Clubace]

{QUOTE-> I put the file lsass.exe and my antivirus's program folder (nod32 av) on the exceptions list and the spikes disappeared. <-QUOTE}


After putting my AV, AS into the exception list, i noticed it consumed only abt 2k of memory.