inspect.sys takes too much cpu; how to disable pfw temporarily [Resolved]

Help for v3
1

Hello,
my “system” process takes around 20% of cpu when using p2p clients; after a closer look, the cpu is used by inspect.sys.
I disabled the firewall but that does not change anything. Is there a way to stop inspect.sys from checking the network pakets (if the driver is for this) and just bypassing them, not using that much cpu?

Thank you

XP SP3
Comodo 3.0.25.378

2

AFAIK it is not possible but I guess you could try to disable all the checkboxes in Firewall Tasks > Advanced >Attack Detection Settings.

Are you using a pateched TCP/IP driver that remove the limit on half-opened connections?
What are your CPU specs?

Did yo check if uninstalling CFP the system CPU load decrease when there is the same traffic load?

3

no did not help

Are you using a pateched TCP/IP driver that remove the limit on half-opened connections? What are your CPU specs?

I did with sp2, but I think sp3 installed a new tcpip.sys because the event monitor shows that there are sometimes too many connections; so no.

Did yo check if uninstalling CFP the system CPU load decrease when there is the same traffic load?

no, because I saw in processexplorer that the pfw driver causes the cpu load.

4

After disabling all the advanced attack detection settings, did you reboot already? Just seeing if that makes any difference.

5

Can you post a screenshot of system thread properties and of processexplorer Interrupts and DPCs?

It may be a compatibility issue here the impact on system is negligible.
Do you have any other security or utility software?

[attachment deleted by admin]

6

Ok, I just rebooted and everything now works as intended.
The problems began, when I installed SP3 a few days ago I think. But I don’t know whether the problem is now gone because of the reboot or perhaps because of the tcpip.sys patch, for more than 10 opening connections, I applied before the reboot.

7

SP3 overwrote the old tcpip.sys so you got an official and unpatced tcpip.sys

8

heh sometimes the simplest solution is the correct one (:WIN)

rocked and rolled

resolved and closed

if it returns and need unlock, PM gibran ;D