PDA

View Full Version : Handle leak in EMON component of Nod32


dro085
August 25th, 2006, 12:54 AM
Recently, I've been having problems where Windows XP seems to run out of handles. In this state, things start to fail in unusual ways. For example, I launched notepad.exe and it came up without the File menu bar.

This prompted me to investigate the cause of the leaked handles. My company has recently rolled out Nod32 as our antivirus solution. In general, it's worked fine. But, while investigating the leaks, I noticed that Outlook 2003 was leaking one handle each time I viewed a different email message. You can see the handles being leaked if you view Outlook's handles using Process Explorer from sysinternals.com. Each time I switch email messages, a handle shows up for the following registry key:

HKLM\SOFTWARE\Eset\Nod\CurrentVersion\Modules\EMON\Settings\Config000\Settings

Can anyone else confirm this leak?

Thanks,
dro

P.S. I'm pretty sure we're up to date with the software, but here's the information from the Nod32 dialog just in case...

==========================
NOD32 antivirus system information
Virus signature database version: 1.1724 (20060824)
Dated: Thursday, August 24, 2006
Virus signature database build: 7901

Information on other scanner support parts
Advanced heuristics module version: 1.035 (20060810)
Advanced heuristics module build: 1120
Internet filter version: 1.002 (20040708)
Internet filter build: 1013
Archive support module version: 1.048 (20060714)
Archive support module build version: 1173

Information about installed components
NOD32 For Windows NT/2000/XP/2003/x64 - Base
Version: 2.51.8
NOD32 For Windows NT/2000/XP/2003/x64 - Internet support
Version: 2.51.8
NOD32 for Windows NT/2000/XP/2003/x64 - Standard component
Version: 2.51.8

Operating system information
Platform: Windows XP
Version: 5.1.2600 Service Pack 2
Version of common control components: 5.82.2900
RAM: 1023 MB
Processor: Intel(R) Pentium(R) 4 CPU 3.80GHz (3790 MHz)

NOD32 user
August 25th, 2006, 01:17 AM
I can confirm just quickly that it appears to be the same for me as far as you have reported.
And also that there seems to be something else unrelated leaking more than one handle at a time in Outlook.

How many emails do you view in a single session that you would run out of handles because of this type of thing?

Cheers :)

dro085
August 25th, 2006, 03:58 PM
Sorry, I should have said that EMON is not the reason I'm exhausting Windows XP of handles. I do view a lot of email, but you're right that it would take a whole lot of email before I exhausted Windows of handles going 1 at a time :) There is another handle leak having to do with the Windows print spooler service and a Lexmark printer driver that is much, much worse. The EMON leak is very small in comparison. I found it in my search for the larger leak.

Thanks for the confirmation.

mrtwolman
August 28th, 2006, 05:36 AM
{QUOTE-> Sorry, I should have said that EMON is not the reason I'm exhausting Windows XP of handles. I do view a lot of email, but you're right that it would take a whole lot of email before I exhausted Windows of handles going 1 at a time :) There is another handle leak having to do with the Windows print spooler service and a Lexmark printer driver that is much, much worse. The EMON leak is very small in comparison. I found it in my search for the larger leak.

Thanks for the confirmation. <-QUOTE}


Leak should be fixed by now. Thanks for the report.