Beta - Lsass.exe is back

[Blackspear]

The mongrel is back, Lsass.exe just reappeared, it hasn't been around for about a month.

Click cancel and you have 60 seconds to abort shutdown by going to:

Start
Run
type in "Shutdown -a" without the quotation marks...

Cheers ;D

[rumpstah]

Have you tried uninstalling 835732 and reinstalling?

http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx

[Blackspear]

{QUOTE-> Have you tried uninstalling 835732 and reinstalling?

http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx <-QUOTE}

I haven't tried that, everything was running nicely with the version prior to last night.

I now get other error messages, such as the following:

Cheers ;D

[ronjor]

Blackspear

Have you done a scandisk lately?

[Blackspear]

No, but I shall, don't think this will be it though. I am getting similar error messages with IEXPLORE.exe, only since last night after installing the new Beta.

Cheers ;D

[ronjor]

You may be right. Doesn't hurt to try the simple things first. ;D 8)

[Blackspear]

{QUOTE-> You may be right. Doesn't hurt to try the simple things first. ;D 8) <-QUOTE}

Exactly ;D

Cheers ;D

[ronjor]

Does the event viewer show anything unusual? XP event viewer that is.

[VikingStorm]

What other programs do you have running? There was something similar to those memory errors you keep getting on some other program that was suppose to prevent buffer overflows.

[Blackspear]

{QUOTE-> Does the event viewer show anything unusual? XP event viewer that is. <-QUOTE}

Scandisk (Checkdisk) came up all ok.

Event log shows the following:

Event Type: Error
Event Source: Winlogon
Event Category: None
Event ID: 1015
Date: 23/07/2004
Time: 1:06:16 PM
User: N/A
Computer: XXXXX
Description: A critical system process, C:\WINDOWS\system32\lsass.exe, failed with status code c0000005. The machine must now be restarted.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

And that's all there is...

Cheers ;D

[Blackspear]

Belarc Information


Computer Profile Summary
Computer Name: XXXXX (in WORKGROUP)
Profile Date: Saturday, 24 July 2004 1:52:17 AM
Advisor Version: 6.1f
Windows Logon: PC User

Click here for Belarc's PC Management products, for large and small companies.

Operating System System Model
Windows XP Professional Service Pack 1 (build 2600) No details available
Processor a Main Circuit Board b
2.80 gigahertz Intel Pentium 4
8 kilobyte primary memory cache
512 kilobyte secondary memory cache Board: Gigabyte Technology Co., Ltd. 8IG1000-G x.x
Bus Clock: 200 megahertz
BIOS: Award Software International, Inc. F3 03/04/2004
Drives Memory Modules c,d
200.05 Gigabytes Usable Hard Drive Capacity
119.94 Gigabytes Hard Drive Free Space

ASUS CRW-5224A [CD-ROM drive]
HL-DT-ST CD-ROM GCR-8521B
3.5" format removeable media [Floppy drive]

ST3200822A [Hard drive] (200.05 GB) -- drive 0, s/n 3LJ0R916, rev 3.01, SMART Status: Healthy 496 Megabytes Installed Memory

Slot 'A0' has 256 MB
Slot 'A1' is Empty
Slot 'A2' has 256 MB
Slot 'A3' is Empty
Local Drive Volumes


c: (on drive 0) 200.05 GB 119.94 GB free
Network Drives
None detected
Users Printers
local user accounts last logon
PC User 24/07/2004 1:37:46 AM (admin)
local system accounts
Administrator never (admin)
Guest never
HelpAssistant never
SUPPORT_388945a0 never

DISABLED Marks a disabled account; LOCKED OUT Marks a locked account

Hewlett-Packard HP-GL/2 Plotter on \\FULLBACK\d1plt1
Microsoft Office Document Image Writer Driver on Microsoft Document Imaging Writer Port:
Controllers Display
Standard floppy disk controller
Intel(R) 82801EB Ultra ATA Storage Controllers
Primary IDE Channel [Controller]
Secondary IDE Channel [Controller] Intel(R) 82865G Graphics Controller [Display adapter]
Hitachi CML174SX [Monitor] (17.1"vis, s/n H3B004394, February 2003)
Bus Adapters Multimedia
Intel(R) 82801EB USB Universal Host Controller - 24D2
Intel(R) 82801EB USB Universal Host Controller - 24D4
Intel(R) 82801EB USB Universal Host Controller - 24D7
Intel(R) 82801EB USB Universal Host Controller - 24DE
Intel(R) 82801EB USB2 Enhanced Host Controller - 24DD MPU-401 Compatible MIDI Device
Realtek AC'97 Audio
Standard Game Port
Communications Other Devices
Realtek RTL8139/810x Family Fast Ethernet NIC #2
Network Card MAC Address: 00:00:1C:D8:62:22
Network IP Address: 144.133.221.206 / 22 HID-compliant consumer control device
HID-compliant consumer control device
HID-compliant device
USB Human Interface Device
USB Human Interface Device
Built-in Infrared Device
HID Keyboard Device
HID-compliant mouse
USB Composite Device
USB Root Hub
USB Root Hub
USB Root Hub
USB Root Hub
USB Root Hub
Virus Protection
No details available
Installed Microsoft Hotfixes [Back to Top]
DataAccess
no verification data Q832483 on 24/03/2004 (details...)
no verification data KB870669 (details...)
DirectX
DX9
SP1:
passed verification KB839643-DIRECTX9 on 8/06/2004 (details...)
Internet Explorer
no verification data SP1 (SP1)
no verification data Q330994 (details...)
no verification data Q823353 (details...)
no verification data Q831167 (details...)
no verification data Q832894 (details...)
no verification data Q837009 (details...)
Windows Media Player
passed verification Q828026 (details...)
passed verification KB837272 (details...)
SP0
passed verification Q828026 on 24/03/2004 (details...)
Windows XP
SP0
passed verification KB837272 on 2/05/2004 (details...)
SP2
passed verification Q322011 on 24/03/2004 (details...)
no verification data Q327979 on 24/03/2004 (details...)
passed verification KB810243 on 24/03/2004 (details...)

Windows XP
SP2 (continued)
passed verification Q814995 on 24/03/2004 (details...)
passed verification KB817778 on 24/03/2004 (details...)
passed verification KB820291 on 24/03/2004 (details...)
passed verification KB821253 on 24/03/2004 (details...)
passed verification KB822603 on 24/03/2004 (details...)
passed verification KB823182 on 24/03/2004 (details...)
passed verification KB824105 on 24/03/2004 (details...)
passed verification KB824141 on 24/03/2004 (details...)
passed verification KB824146 on 24/03/2004 (details...)
passed verification KB825119 on 24/03/2004 (details...)
passed verification KB826939 on 24/03/2004 (details...)
passed verification KB826942 on 24/03/2004 (details...)
passed verification KB828028 on 24/03/2004 (details...)
passed verification KB828035 on 24/03/2004 (details...)
passed verification KB828741 on 2/05/2004 (details...)
passed verification KB833407 on 6/05/2004 (details...)
passed verification KB833998 on 2/05/2004 (details...)
passed verification KB835732 on 2/05/2004 (details...)
passed verification KB837001 on 2/05/2004 (details...)
passed verification KB839645 on 14/07/2004 (details...)
passed verification KB840315 on 14/07/2004 (details...)
passed verification KB840374 on 11/05/2004 (details...)
passed verification KB841873 on 14/07/2004 (details...)
passed verification KB842773 on 14/07/2004 (details...)

Click here to see all available Microsoft security hotfixes for this computer.

verifies OK Marks a HotFix that verifies correctly
fails verification Marks a HotFix that fails verification
(note that failing hotfixes need to be reinstalled)
Unmarked HotFixes lack the data to allow verification
Software Licenses [Back to Top]

Belarc - Advisor d8e2896b
Microsoft - Internet Explorer 55274-645-1896202-23835 (Key: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX)
Microsoft - MediaPlayer 69808-351-1370217-04420
Microsoft - Office Professional Edition 2003 73931-640-0000106-57834 (Key: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX)
Microsoft - WebFldrs XP 12345-111-1111111-09388
Microsoft - Windows XP Professional 55274-645-1896202-23835 (Key: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX)
Software Versions [Back to Top]
Adobe Reader Version 6.0.0.2003051900 *
Advanced Process Manipulation *
Ahead Software AG - Cover Designer Version 2, 3, 0, 6 *
Ahead Software AG - InfoTool Application Version 2, 2, 1, 0 *
Ahead Software AG - Nero BackItUp Version 1, 2, 0, 15 *
Ahead Software AG - Nero Burning ROM Version 6, 3, 1, 15 *
Ahead Software AG - Nero CD - DVD Speed Version 3, 0, 1, 0 *
Ahead Software AG - Nero DriveSpeed Version 2, 0, 2, 0 *
Ahead Software AG - Nero ImageDrive Version 2, 27, 0, 4 *
Ahead Software AG - Nero SoundTrax Version 1, 0, 0, 28 *
Ahead Software AG - Nero StartSmart Version 1, 0, 1, 18 *
Ahead Software AG - Nero Wave Editor DLL Version 2, 0, 0, 32 *
Apple Computer, Inc. - QuickTime QuickTime 6.1c *
Belarc, Inc. - BelManage Client Version 6.1f *
BigPond Broadband Cable Login *
BST - BSPlayer v1.0 Version 1.0.0.0 *
Cinematronics - 3D Pinball Version 5.1.2600.0 *
CoffeeCup Free Viewer Plus Version 2.6.0.0 *
CoffeeCup Software - Quick Viewer Version 2.5.0.0 *
Cottonwood Software - File-Ex Version 3.0.0.24 *
Created by javacool. - FileChecker v1.7 Version 1.07.0001 *
Eraser Version 5.7 *
ewido security suite Version 0, 1, 0, 101 *
FaberBox - Faber Toys Version 2.05.0240 *
filecheckertutorial Version 1.00 *
Free Spider *
Groom-A-Zebu (tm) - Proxomitron Naoko-4.5 2003-6-1 *
home - Ostat Version 0.32.0265 *
Inno Setup Version 51.13.0.0 *
InstallDriver Module Version 7.07 *
Intel(R) Common User Interface Version 7.0.0.3762 *
IrfanView Version 3.80 *
Java Web Start *
javaw.exe *
Jordan Russell - Inno Setup Uninstaller Version 51.7.0.0 *
Karen's Power Tools Version 2.02.0003 *
Lavasoft Ad-aware Plus Version 6.0.0.0 *
M&R Technologies, Inc. - PCStitch version 6 Version 6.02 *
M&R Technologies, Inc. - The DMC Floss Editor Version 6.02 *
Macromedia, Inc. - Flash 4.0 Version 4,0,7,0 *
Microsoft (R) .NET Framework Version 1.1.4322.573 *
Microsoft (r) Windows Script Host Version 5.6.0.8515 *
Microsoft Application Error Reporting Version 11.0.5515 *
Microsoft Clip Organizer Version 11.0.5510 *
Microsoft Corporation - Internet Explorer Version 6.00.2800.1106 *
Microsoft Corporation - Messenger Version 4.7 *
Microsoft Corporation - Office Source Engine Version 11.0.5525 *
Microsoft Corporation - SelfCert Version 11.0.5510 *
Microsoft Corporation - Windows Installer - Unicode Version 2.0.2600.1106 *
Microsoft Corporation - Windows Journal Viewer Version 1.5.2315.3 *
Microsoft Corporation - Windows Movie Maker Version 2.0.3312.0 *
Microsoft Corporation - Windows® NetMeeting® Version 3.01 *
Microsoft Corporation - Zone.com Version 1.2.626.1 *
Microsoft Office 2003 Version 11.0.6113 * Microsoft Office Document Imaging Version 11.0.1897.0 *
Microsoft Office InfoPath Version 11.0.5531 *
Microsoft Office Outlook Version 11.0.5510 *
Microsoft Office Picture Manager Version 11.0.5510 *
Microsoft Office Save My Settings/Profile Wizard Version 11.0.5510 *
Microsoft Open Database Connectivity Version 3.520.9030.0 *
Microsoft Windows Media Player Version 6.4.09.1125 *
Microsoft(R) MSN (R) Communications System Version 7.02.0005.2202 *
Microsoft(R) Windows Media Player Version 9.00.00.2980 *
Microsoft® Schedule+ for Windows 95(TM) Version 7.5 *
Microsoft® Visual Studio .NET Version 7.00.9466 *
Microsoft® Windows(TM) Shell PowerToys Version 96.02.06 *
MindVision - Installer VISE 2.8.3 Version 2.8.3 *
MindVision Software - Installer VISE Version 3.1.1 *
Mozilla - Firefox Version 1.7: 2004070723 *
NetBeans IDE 3.5.1 *
NOD32 *
NOD32 Control Center *
NOD32 Kernel Service *
none - burnatonce Version 0.99.0005 *
OpenOffice.org 1.1.1 *
OpenOffice.org 1.1.1 Version 6.00.8753 *
Overnet Application Version 0.53.0.0 *
PepiMK Software - Spybot - Search & Destroy Version 1, 3, 0, 12 *
PGP Version 8.0.2 *
PGPsdk Version 3.0.2 *
Prismatic Software - DupDetector Application Version 3.101 *
RealNetworks, Inc. - RealPlayer (32-bit) Version 0.1.0.3018 *
RealNetworks, Inc. - RealPlayer (32-bit) Version 6.0.12.857 *
RealNetworks, Inc. - RealPlayer (32-bit) Version 7.0.0.2400 *
Realtek Sound Manager Version 5.1.0.24 *
RegCleaner The same as the FileVersion *
Safer Networking Limited - SpyBot-S&D Version 1, 3, 0, 12 *
Script Defender *
Script Defender Updates *
Sierra Entertainment, Inc. - Hoyle Casino Version 1, 0, 0, 0 *
SmartLine, Inc. - Active Ports Version 1, 4, 0, 0 *
SpywareBlaster AutoUpdate Version 3.02 *
SpywareBlaster Version 3.02 *
SpywareGuard LiveUpdate Version 2.02.0001 *
SpywareGuard Version 2.02.0001 *
Strip'n Score *
SunJavaUpdateSched *
SWE von Schleusen - UltimateZip Quick Start Version 1.1 *
SWE von Schleusen - UltimateZip Self-Extractor Version 2.7 *
SWE von Schleusen - UltimateZip Version 2.7 *
Telstra - BigPond Broadband Cable Login Version 1.00 *
WinImage Self Extractor file Version 6.10.6100 *
WinZip Version 8.0 (3105) *
Wizards to adjust .NET Framework security, assign trust to assemblies, and fix broken .NET applications. Version 1.0.5000.0 *
Zone Labs Client Version 5.0.590.043 *
Zone Labs Inc. - Internet Access Monitor Version 5.0.590.043 *
Zone Labs Inc. - TrueVector Service Version 5.0.590.043 *
Zone Labs Uninstaller Version 5.0.590.43 *
* Click to see where software is installed.
a. Megahertz measurement may be inaccurate if other programs were busy during last analysis.
b. Data may be transferred on the bus at one, two, or four times the Bus Clock rate.
c. Memory slot contents may not add up to Installed Memory if some memory is not recognized by Windows.
d. Memory slot contents is reported by the motherboard BIOS. Contact system vendor if slot contents are wrong.
e. This may be the manufacturer's factory installed product key rather than yours.
Copyright 2000-4, Belarc, Inc. All rights reserved.
Legal notice. U.S. Patents 6085229, 5665951 and Patents pending.


Cheers ;D

[AgentX]

Lsass.exe problem is very annoying indeed. To get rid of it, install the fix mentioned by
rumpstah ...it should fix the problem. I've noticed that even after installing it, the error
returns back after a few days of clean operation. In such a case, reinstall the same fix.

Regards,
AgentX

[Blackspear]

{QUOTE-> Lsass.exe problem is very annoying indeed. To get rid of it, install the fix mentioned by rumpstah ...it should fix the problem. I've noticed that even after installing it, the error returns back after a few days of clean operation. In such a case, reinstall the same fix... <-QUOTE}

I will wait for another Beta to come out first. No one should have to do this, the problem appeared, then they brought out a pre-release Beta, that sorted it out, several pre-release Beta's later and everything was still ok. Then when the actual Beta is released to the public the problem returns... This appears to come down to the Eset and their programmers...

Cheers ;D

[ronjor]

Have you tried running your computer without NOD to see if the error occurs?

It seems to affect certain configurations. I don't get this error.

[Blackspear]

{QUOTE-> Have you tried running your computer without NOD to see if the error occurs?... <-QUOTE}

The trouble is, it is VERY intermitant, it has only appeared twice in the last 48hrs, As well I have had 2 other error messages as posted elsewhere; IEXPLORE.exe and AcroRd32.exe as posted in another thread...

ALL error messages are in the same format, and have ONLY appeared since installing the NEW Beta, they had dissapeared with pre-release Beta.

Cheers ;D

[PeterVO]

Hello,

I've the same error messages as Blackspear but haven't the beta of NOD installed. It appears as a non responding pc when for example starting a new application.
I noticed at one occasion two icons of LookNStop in the system tray.
What's the solution for this problem and what the cause of it? I truly hope not a complete re-install of WinXP.

Kind regards,

PeterVO

[rumpstah]

Blackspear: What is your distribution version for lsasrv.dll?

Mine is 5.1.2600.1361

[Blackspear]

{QUOTE-> Blackspear: What is your distribution version for lsasrv.dll?

Mine is 5.1.2600.1361 <-QUOTE}

Same here: 5.1.2600.1361

Cheers ;D

[Blackspear]

{QUOTE-> Hello,

I've the same error messages as Blackspear but haven't the beta of NOD installed. It appears as a non responding pc when for example starting a new application.
I noticed at one occasion two icons of LookNStop in the system tray.
What's the solution for this problem and what the cause of it? I truly hope not a complete re-install of WinXP.

Kind regards,

PeterVO <-QUOTE}

This problem with Lsass.exe goes back prior to the Beta, see the following thread:

http://www.wilderssecurity.com/showthread.php?t=35206

It appears to be a work in process...

Cheers ;D

[DonKid]

Blackspear,

It stranges.In my last email I told you that I had the lsass.exe problem when I closed or opened my internet connection and with this beta version this problem is over. ;D

Best Regards,

DonKid.

[Blackspear]

{QUOTE-> ...It stranges. In my last email I told you that I had the lsass.exe problem when I closed or opened my internet connection and with this beta version this problem is over... <-QUOTE}

It is a very strange problem indeed, tell me about it ;D

I have run Nod32 for 2 years now without ever coming across the Lsass.exe error message. My first encounter was through a customer trying to VPN. I then had the problem appear a few days later on my home PC. I was given a pre-release Beta to try, it didn't solve the problem. The next pre-release did resolve it, and every pre-release thereafter has been fine.

Then along comes the actual Beta and the problem returns with a few friends, as in; IXPLORE.exe and AcroRd32.exe, I can no longer open a ".pdf" file. So now I am waiting for a further release of the Beta.

I can not replicate the error through anything, it just reappears every now and then. I have not changed any of my settings or programs, I have not installed any new programs.

I can replicate the AcroRd32.exe error message by trying to open a ".pdf" file.

The error has not occurred for 24 hours, but this can be the case, it is very intermittent >:(

Cheers ;D

[tazdevl]

I'm getting a series or application and service errors as well. lsass, iexplore, svchost and a couple others...

[ronjor]

{QUOTE-> It is a very strange problem indeed, tell me about it ;D

I have run Nod32 for 2 years now without ever coming across the Lsass.exe error message. My first encounter was through a customer trying to VPN. I then had the problem appear a few days later on my home PC. I was given a pre-release Beta to try, it didn't solve the problem. The next pre-release did resolve it, and every pre-release thereafter has been fine.

Then along comes the actual Beta and the problem returns with a few friends, as in; IXPLORE.exe and AcroRd32.exe, I can no longer open a ".pdf" file. So now I am waiting for a further release of the Beta.

I can not replicate the error through anything, it just reappears every now and then. I have not changed any of my settings or programs, I have not installed any new programs.

I can replicate the AcroRd32.exe error message by trying to open a ".pdf" file.

The error has not occurred for 24 hours, but this can be the case, it is very intermittent >:(

Cheers ;D <-QUOTE}


Do a search for lsass.exe. Do you have two versions, one in windows\system32 and one in windows\servicepackfiles?

Those are on my xp machine. I have no problems here.

[DonKid]

Well I checked my PC and I have 2 lsass.exe. 1 in system32 and the other in c:\windows\servicepackfiles\i386.
I never saw a thing like that.I tried to open pdf files and it's ok too. So far so good.Have you tried to format your PC ?

Best Regards,

DonKid.

[Blackspear]

{QUOTE-> ...Have you tried to format your PC?... <-QUOTE}

This won't be necessary, like I said before, after a pre-release the problem was fixed, so I'll just hang tight for another release to come along...

Cheers ;D

[Blackspear]

{QUOTE-> I'm getting a series or application and service errors as well. lsass, iexplore, svchost and a couple others... <-QUOTE}

Welcome to the Club Taz, nice to see new members ;)

Cheers ;D

[PeterVO]

Oh My God,

the same error on my laptop now when trying to update Ewido:

"The instruction at 0x77f58dc5 referenced memory at 0xffffff8. The memory could not be read. Click OK to terminate the program".

But the update seems ok.

I remember that Ewido to was the first program to give that error on my desktop pc.

[Blackspear]

{QUOTE-> ...the same error on my laptop now when trying to update Ewido: "The instruction at 0x77f58dc5 referenced memory at 0xffffff8. The memory could not be read. Click OK to terminate the program" <-QUOTE}

Welcome, and congratulations, you are the latest member of the ever growing Lsass Club.

Membership is free upon installing either Nod32 or Nod32 Beta.

Membership is fairly exclusive, only a rare but growing handful are able to apply to an unknown lottery. Once drawn, you are unable to transfer the prize, and it may not be given back.

Membership allows you to learn quickly to type "shutdown -a" after frantically trying to click on start>run. Though as time goes by you do become blazen as to how close you can come to actual shutdown… tick tock, tick tock, tick tock...

And the above are but few of the benefits ;)

Come ye come ye, whom else will step up and take the challenge... ;D

;D 8) ;D 8) ;D

[martindijk]

Hi Blackspear,

News is travelling fast, so i have heard about this new and dedicated Lsass club.

I was wondering how to register for ik heard that it is difficult club to join ;D

Do you just have to wait till your pc is rebooting spontanioulsly ;D ;D

rgds,
Martin ( waiting patiancely to become a member )

[Blackspear]

{QUOTE-> Hi Blackspear,

News is travelling fast, so i have heard about this new and dedicated Lsass club.

I was wondering how to register for ik heard that it is difficult club to join ;D

Do you just have to wait till your pc is rebooting spontanioulsly ;D ;D

rgds,
Martin ( waiting patiancely to become a member ) <-QUOTE}

LMAO, membership is pretty exclusive, I am yet to determine how membership is obtained, though I am a member... doh! ::)

;D 8) ;D 8) ;D

[martindijk]

So i have heard ;D ;D

[fredra]

Hi everyone
I am NEW to this forum and just began testing NOD32 Beta.
Although I have not had the dreaded "lsass" error (yet).....if you go here and scroll down you will find links to the patches from Microsoft to address the Buffer Overrum lsass anomally for various systems.
here (http://securityresponse.symantec.com/avcenter/security/Content/10108.html)
I hope this helps.
Cheers :)

[Blackspear]

{QUOTE-> ...if you go here and scroll down you will find links to the patches from Microsoft to address the Buffer Overrum lsass anomally for various systems.
here (http://securityresponse.symantec.com/avcenter/security/Content/10108.html)
... <-QUOTE}

Hi Fredra, thanks for your reply, however, further up I addressed this, the problem comes down to Eset, as in the problem appeared, then a further pre-release fixed it, and each pre-release thereafter was fine, then came along the public Beta, and the problem returned with a few friends ::)

I've gone back to the standard version for a few days, so far the Lsass.exe error has not reappeared, as expected...

Cheers ;D

[Blackspear]

No Lsass.exe error message so far. I uninstalled Nod32, removed the Eset folder, cleaned 1 entry from the registry and reinstalled a standard version without a hitch.

Using the repair function available through Add and Remove Programs in Control Panel with Adobe Acrobat, fixed the AcroRd32.exe error message (I'm using standard version at the moment), and it's back up and running as per normal, opening PDF files to its hearts content.

Cheers ;D

[tazdevl]

I'm still getting the error after uninstalling. Never saw it before I installed this beta. However, once I cleaned out the registry... boom, no more issues.

This beta seems to bork things up quite well.

[ronjor]

Not one (1) single problem with anything on my xp sp1 machine. And I am running a beta browser, and a beta firewall also. Betas everywhere! No problems!

[Blackspear]

{QUOTE-> I'm still getting the error after uninstalling. Never saw it before I installed this beta. However, once I cleaned out the registry... boom, no more issues.

This beta seems to bork things up quite well. <-QUOTE}

I'm going to uninstall the standard version tonight/tomorrow, reboot, remove the Eset folder, Clean the registry and then reinstall a fresh copy of the new Beta and see how it goes.

Still no Lsass.exe error messages...

Cheers ;D

[Blackspear]

{QUOTE-> Not one (1) single problem with anything on my xp sp1 machine. And I am running a beta browser, and a beta firewall also. Betas everywhere! No problems! <-QUOTE}

It's a bit like the 2.009 program component update, but to a less degree, only something like 1 to 30 in 1000 computers were affected, it was extremely difficult to diagnose. Initially Eset couldn't find a problem, it was pointed out that there definitely was a problem and it was hard to replicate...

Cheers ;D

[Blackspear]

I spoke too soon, the error just arrived back while trying to copy a pic as a jpeg from the internet...

Cheers ;D

[ronjor]

Do you suppose you have winsock problems?

http://support.microsoft.com/?kbid=321024

[Blackspear]

{QUOTE-> Do you suppose you have winsock problems?

http://support.microsoft.com/?kbid=321024 <-QUOTE}

The problem appears and disappears according to different versions of Nod32 installed.

I have removed Winsock and replaced it accordingly on other PC's, I have now done the same on this system.

Now I have removed the standard version of Nod32, removed the Eset folder and cleaned the registry. Downloaded a fresh copy of the Beta and installed it, and time will tell as to my membership of this club...

Cheers ;D

[Blackspear]

Well having replaced Winsock and Winsock2, fresh install etc, it is back grrrrrr

Just started with a new error message in the same format as the others...

Cheers ;D

[ronjor]

That is a Firefox error, right? That is not lsass.exe.

[Blackspear]

{QUOTE-> That is a Firefox error, right? That is not lsass.exe. <-QUOTE}

All the errors are in the same format as the lsass.exe error message, and appear and disappear according to the version (pre-release Beta) of Nod32 installed.

It had completly gone with the last pre-release...

Cheers ;D

BTW nice avatar Ron, looks great ;D

[ronjor]

{QUOTE-> All the errors are in the same format as the lsass.exe error message, and appear and disappear according to the version (pre-release Beta) of Nod32 installed.

It had completly gone with the last pre-release...

Cheers ;D

BTW nice avatar Ron, looks great ;D <-QUOTE}


Thanks.

Very strange error. There will be an answer though, along the line.

[SaphireX]

Having experienced this same error message before when I was using NAV2004 and not being able to determine the cause ...after doing a fresh install of XP + updates + applications/data---and this time not installing NAV2004. Instead buying NOD32 installing the beta version all went well until I installed the A/V pluggin for NERO. On the very next reboot the error message popped up ! After some examination it would appear that the A/V pluggin for NERO was the culprit but there was no easy way to rectify the issue since there is no way to uninstall the NERO A/V pluggin...Perhaps uninstalling NERO may have solved it --not sure--So instead I just deleted my RAID-0 array and created another which of course results in a format and fresh install of XP + updates and re-install apps + data . And this time I decided to SKIP installing the A/V pluggin for NERO and I have not had any conflicts like this to happen at all. So unless I am completely out to lunch here DrWeb32 the A/V pluggin for NERO should be avoided if you have an A/V application installed on your PC

Cheers

Saphire

[Blackspear]

{QUOTE-> Have you tried uninstalling 835732 and reinstalling?

http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx <-QUOTE}

After reading post #18 from Marcos here:

http://www.wilderssecurity.com/showthread.php?t=43300

I have just tried your suggestion and uninstalled 835732 and reinstalled 835732

I am not over confident that this will fix the problem, as stated above, that dependant upon the version of the pre-release Beta installed, so appeared and disappeared the Lsass error.

Time will tell...

Cheers ;D

[nlangmaid]

Hi Blackspear,

I used to be a member of the LSASS club, but I missed a few meetings and my membership seems to have lapsed.

Jokes aside, the incidence of bugs last time around seemed to have a very close relationship to whether IMON was active. As you well know. Is that a factor now?

Last time around, I reformatted my hard drive and did a complete reinstall of trusted software from trusted media. I had just about concluded that the problem must be in my hardware when I discovered that NOD32 wasn't quite so trustworthy after all.

However anyone developing and testing low level code in the infinitely-variable hardware and software environment of a PC has my sympathy ...

Nick.

[Blackspear]

Lsass error message reappeared last night while using messenger. So no the problem has not gone away, it is still very VERY intermittent.

Cheers ;D

[Anon]

Has anyone thought about the fact that this might be a 0 day on LSASS.exe that even NOD32 don't know about???...

I know for a fact they were slow on the first DCOM sploit.

[ANON]

just for your info.....

I run XP Pro with SP2 v.2096 and haven't had a single problem with the beta v of NOD32....all good infact......


Try turning off DCOM if your still on XP SP1....

I never leave it on as i just don't trust MS patches....if you don't need it why in the hell leave it running when its such a risk..

60 second shutdowns get my alarm bells ringing.....an exploit is not a virus....at first...

Maybe I'm paraniod?.

[webster]

The error reports appears all over the internet. They always appears after a windowsupdate. I am quite shure that the new hotfixes are designed to work in SP2, and creates errors in SP1. They dont seem to appear in SP2, so i am quite shure about this.

[tazdevl]

{QUOTE-> The error reports appears all over the internet. They always appears after a windowsupdate. I am quite shure that the new hotfixes are designed to work in SP2, and creates errors in SP1. They dont seem to appear in SP2, so i am quite shure about this. <-QUOTE}

Want to bet they don't appear in SP2?

[webster]

Ehh.. NO ! But i am quite shure it is a M$ "thing". Btw, take a look at this http://support.microsoft.com/default.aspx?scid=kb;en-us;828133 . They say it will be solved in the next service pack. It is not identical, but the resemblance is quite clear (to me)

[Blackspear]

Well I'm on the new SP2, Lsass error messages had disappeared, though I was still receiving some of the other error messages every now and then.

Installed the new Beta 2.12 and Lsass.exe error messages are back with force, at least 2 a day, even my partner now knows how to stop the system from shutting down, and she's getting pretty quick at it as well ;)

I might end up having to format this system, though I don’t really see why I should have to. The Lsass.exe error messages have appeared on a FRESH install of XP Pro. I do have another machine alongside this one with all the exact same software and no error messages, so it remains a mystery, other than it comes and goes according to various Beta’s installed…

Cheers ;D

[tazdevl]

Did a fresh install w/SP2 slipstreamed... same problems. Granted I don't have 2.12, but it happens with 2.11.

{QUOTE-> Ehh.. NO ! But i am quite shure it is a M$ "thing". Btw, take a look at this http://support.microsoft.com/default.aspx?scid=kb;en-us;828133 . They say it will be solved in the next service pack. It is not identical, but the resemblance is quite clear (to me) <-QUOTE}

Different issue. This is a NOD32 issue.

[Blackspear]

Thanks Taz, good to see you have kept your club membership ;)

I had fairly well lost the error messages until the new Beta 2.12.

Cheers ;D

[ronjor]

Time to call Ghostbusters!! ;D 8)

[Blackspear]

{QUOTE-> Time to call Ghostbusters!! ;D 8) <-QUOTE}
ROFLMAO it is very elusive ::) I know you are just itching to try and become a member, however we are a elite bunch ;) ;D

;D 8) ;D 8) ;D

[tosbsas]

One again - where do I get this version 2.12

Ruben

[Marcos]

Hi Tosbsas,
a newer component update will be issued shortly (within a couple of days).

[tosbsas]

OK - has been talked about so much here (:-)

Ruben

[Blackspear]

{QUOTE-> OK - has been talked about so much here... <-QUOTE}
It is just being issued to those having specific problems, of which it appears a lot are fixed...

If you build it, they will come - problems and solutions ;)

Cheers ;D

[Blackspear]

These Lsass shutdown error messages have increased dramatically with this new Beta, now getting 3 to 4+ in an hour or two, several times I've seen them just after bootup, it appears and then locks the machine solid, I've never seen so many of them until this version :(

Cheers ;D

[ronjor]

{QUOTE-> These Lsass shutdown error messages have increased dramatically with this new Beta, now getting 3 to 4+ in an hour or two, several times I've seen them just after bootup, it appears and then locks the machine solid, I've never seen so many of them until this version :(

Cheers ;D <-QUOTE}

On all your machines??

[Blackspear]

{QUOTE-> On all your machines?? <-QUOTE}
No, only the one...

I've just downloaded a newer version of the Beta, hopefully this will be better, don't think it could be any worse ;) ;D

Cheers ;D

[ronjor]

Maybe you could rummage around the shop and redo that box. ;D

[Blackspear]

{QUOTE-> Maybe you could rummage around the shop and redo that box. ;D <-QUOTE}
I could do, not a problem at all, this however will not fix the issue, the problem is a Eset one, though very intermittent, they are able to stop / slow down / and increase the errors according to each Beta released, as has been found by others:

{QUOTE-> Did a fresh install w/SP2 slipstreamed... same problems. Granted I don't have 2.12, but it happens with 2.11. ...This is a NOD32 issue. <-QUOTE}
I have seen this on several FRESH installs now, comes back to Eset...

Cheers ;D

[Blackspear]

Latest Beta 2.12 released 16th Aug, 14 hours on and the Lsass.exe error has gone walkabout, neither sight nor sound has been heard ;D So far so good ;)

Cheers ;D ;D ;D

[martindijk]

Hi Blackspear, any idea where one can dowload the 2.12 version??

thanks,
Martin

[Blackspear]

{QUOTE-> Hi Blackspear, any idea where one can dowload the 2.12 version??... <-QUOTE}
It has been given out to those still having specific problems...

Marcos has replied that it should be released to the public in about a week...

http://www.wilderssecurity.com/showthread.php?t=44113&page=2

Cheers ;D

[tazdevl]

{QUOTE-> It has been given out to those still having specific problems...

Marcos has replied that it should be released to the public in about a week...

http://www.wilderssecurity.com/showthread.php?t=44113&page=2

Cheers ;D <-QUOTE}

Actually he mentioned in the next 24-48 hours.

[Blackspear]

{QUOTE-> Actually he mentioned in the next 24-48 hours. <-QUOTE}
New post here: See number 33

http://www.wilderssecurity.com/showthread.php?t=44113&page=2

Cheers ;D

[Blackspear]

24hrs on and still no sign of the elusive error, they may have fixed it ;)

;D ;D ;D

[Defenestration]

This post may be a bit off-topic because I don't have NOD32 installed. However, I've experienced the same problems with lsass.exe and other processes terminating with a read/write of un-readable/un-writeable memory.

I noticed this problem when trying to slipstream the XP SP2. More specifically, executing the command "WindowsXP-KB835935-SP2-ENU.exe -x" (I also get the same problems when running it without the "-x" switch) will extract the files, but also causes system instability. with several Application Failures. A reboot (by using the off switch) is then required:

1) svchost.exe - "The instruction at "0x77f44fff" referenced memory at "0x77f45000". The memory could not be "read".

2) lsass.exe - "The instruction at "0x77f44f5f" referenced memory at "0xffffffff". The memory could not be "written".

3) explorer.exe - "The instruction at "0x77f44fff" referenced memory at "0x77f45000". The memory could not be "read".

About halfway through the extraction process the mem usage for each active process is reduced to a minimum (ie. I can see this from Task Manager when the command is executed). I assume any other resources they are using (eg. DLL's etc) are also flushed out of memory. It seems that the above processes have trouble and crash when this happens.

I am running XP Home and have 256MB of RAM, with a 512MB paging file.

While obviously not a problem with NOD in my case, the symptoms seem to be the same hence my post. Might also help to fix any NOD problems that might be having with lsass.exe too.

Has anyone else experienced this when executing the XP Service Pack 2 network install file (ie. WindowsXP-KB835935-SP2-ENU.exe) ?

[tazdevl]

Only happened with the NOD32 beta installed on SP2. Uninstalled and it went away, never saw it again.

[Blackspear]

{QUOTE-> Only happened with the NOD32 beta installed on SP2. Uninstalled and it went away, never saw it again. <-QUOTE}
Have you tried reinstalling the Beta again?

Cheers ;D

[tazdevl]

{QUOTE-> Have you tried reinstalling the Beta again?

Cheers ;D <-QUOTE}


Yup, after fresh XP SP2 install. Same errors. Uninstalled, they went away. I'll give 2.12 a try when its released, hopefully that will take care of the problemo.

[Blackspear]

This new Beta is far better than most, though the Lsass.exe error is still here, but this is the 1st one in 36hrs, it happen while downloading a 12Mb file, about 1/2 way through I decided to open My Documents, up popped the Lsass.exe Application Error window, clicked cancel and then had 60sec to abort shutdown. I have noticed this sort of combination before, it can be saving a JPEG and while waiting for the 'Save As" dialogue box to appear I have tried to check Outlook Express, it seems to appear mainly in this sort of multi-combination situation.

The errors in the previous Beta downloaded 13th Aug just appeared randomly and constantly without any cause, such as upon boot up after windows had finished loading, it would completely lock the system, and only a hard power off was available.

Cheers ;D

[Blackspear]

Is there ANY PROGRESS at all in fixing the LSASS.EXE error? ? ? ? ?

Eset have remained VERY SILENT in regards to this issue, there is NO public comment whatsoever relating to this problem, there are numerous people that have posted in various threads, and yet THE SILENCE from ESET is DEAFENING.

When will we have some open discussion regarding this irritating error? as in Eset are actually working on the problem.

The error has started occurring consistently now on my system with the latest Beta 2.12 downloaded 20th Aug. From what I have noticed, it occurs when multiple tasks are present, as in upon windows boot up after the desktop has loaded (multiple programs loading at start up). When a multiple task is actioned, as in downloading a file and at the same time opening another application or more…

This error has gone on for months on end, and yet we still have absolutely nothing from Eset...

Cheers ;D

[DonKid]

Blackspear,

I think you are so lucky..... ;D
You know that after installed the beta, my problem has gone.Maybe Eset only sends you a Blackspear Special Edition ;D ;D ;D .
Just kidding.
I think Eset could have a page for us (from forum) to check what is have been done (like a changelog), and what should be done.

Best Regards,

DonKid.

[tazdevl]

BS, I haven't gotten a lsass error but have seen a few application errors in addition to the whole no windows save dialog bug I seem to be experiencing. I think I'm going to start a new club. ;D

If I remember correctly, my problems also out of a multitasking situation as well. So maybe you're onto something.

My guess is that the gang @ Eset is coding away frantically. Things seem to be working inconsistently consistent, my bet is that they're digging away trying to figure out how to solve the issues we all have come across.

[fredra]

{QUOTE->
My guess is that the gang @ Eset is coding away frantically. Things seem to be working inconsistently consistent, my bet is that they're digging away trying to figure out how to solve the issues we all have come across. <-QUOTE}

Hey TAZ
I hope you are right as these types of errors do not look good.
Cheers :)
"In order to be walked on, you have to be lying down."

[tosbsas]

Folks - anyway knows anything about the new 2.12 version, or would be willing to send it to me ??

Ruben

[Blackspear]

{QUOTE-> …I think you are so lucky..... ;D
You know that after installed the beta, my problem has gone. Maybe Eset only sends you a Blackspear Special Edition ;D ;D ;D
Just kidding. <-QUOTE}
LOL, nasty piece of work ;) ;D

{QUOTE-> …I think Eset could have a page for us (from forum) to check what is have been done (like a changelog), and what should be done… <-QUOTE}
That would be nice, to actually have a running conversation, acknowledgement of the problem anf that it is being worked on, would be good…

{QUOTE-> …I haven't gotten a lsass error but have seen a few application errors in addition to the whole no windows save dialog bug I seem to be experiencing. I think I'm going to start a new club. ;D

If I remember correctly, my problems also out of a multitasking situation as well. So maybe you're onto something… <-QUOTE}
This is the only consistent thing with the error, multitasking, seems as though too much activity and there is confusion as to who is actually chief…

{QUOTE-> …My guess is that the gang @ Eset is coding away frantically. Things seem to be working inconsistently consistent, my bet is that they're digging away trying to figure out how to solve the issues we all have come across. <-QUOTE}
It would be nice to know if this is the case, that they just haven’t placed it in the too hard basket, as it only concerns a minority…

{QUOTE-> Folks - anyway knows anything about the new 2.12 version, or would be willing to send it to me ??.. <-QUOTE}
The new Beta 2.12 has only been given out to a few selected people having specific problems… It will be release shortly, according to Marcos from Eset…

Hope this helps…

Cheers ;D

[DonKid]

I hope so, because I´ve never saw the term shortly, meaning too long. ;D

Best Regards,

DonKid.

[DonKid]

Hi Blackspear.

Just to keep you informed, that I have installed the new version today(2.12.1) and until now, so far so good.

Best Regards,

DonKid.

[ronjor]

Blackspear,

It is my fervent hope that we never have to see lsass is back again! ;D

[Blackspear]

{QUOTE-> ...It is my fervent hope that we never have to see lsass is back again! ;D <-QUOTE}
ROFLMAO, well unfortunately one of the developers almost choked on his soup when he found out I and others were still having the problem and with the latest Beta, poor guy, thought they were going to have to hospitalise him...

They have a copy of my Dr Watson and Error Dump logs now, and I hear a whole truck load of valium has been ordered...

Will keep posting when things develop...

Cheers ;D

[Blackspear]

Just installed the new 2.12.1 and now I'm getting svchost errors galore, every time the machine is started, as well as trying to start various applications.

Privx picked it up as:

Prevx prevented process TLNTSVR.EXE causing a bufferoverflow alert

The following information have been obtained:
Process: TLNTSVR.EXE
Path: C:\WINDOWS\SYSTEM32\TLNTSVR.EXE
Pid: 1872
Parentprocess: SERVICES.EXE
Parentpath: C:\WINDOWS\SYSTEM32\SERVICES.EXE
Pid: 792


and


Prevx prevented process ALG.EXE causing a bufferoverflow alert

The following information have been obtained:
Process: ALG.EXE
Path: C:\WINDOWS\SYSTEM32\ALG.EXE
Pid: 3100
Parentprocess: SERVICES.EXE
Parentpath: C:\WINDOWS\SYSTEM32\SERVICES.EXE
Pid: 792

Cheers ;D

[ronjor]

Blackspear,

Have you considered trimming so of the other programs you use for protection to see if they might be causing the conflicts.

Just thought I would ask. 8)

[Blackspear]

{QUOTE-> Blackspear,

Have you considered trimming so of the other programs you use for protection to see if they might be causing the conflicts.

Just thought I would ask. 8) <-QUOTE}
I have the EXACT same software set up on a PC sitting next to me, and it runs beautifully ;D I set this 2nd system up for this purpose ;D

Eset are working on it, so I've been told ;)

I have just sent the above full logs to them.

Thanks for the suggestion Ron.

Cheers ;D

[Stan999]

{QUOTE-> I have the EXACT same software set up on a PC sitting next to me, and it runs beautifully ;D I set this 2nd system up for this purpose ;D

Eset are working on it, so I've been told ;)

I have just sent the above full logs to them.

Thanks for the suggestion Ron.

Cheers ;D <-QUOTE}

Are the two PCs the exact same hardware configuation?

[Blackspear]

{QUOTE-> Are the two PCs the exact same hardware configuation? <-QUOTE}
Not quite, both Gigabyte Intel Chipset Motherboards, different models. Both 512MB Kingmax RAM. Mine P4 HT 2.8GHz, other Celeron 2.0GHz. Mine 2 x 200GB Seagate's, other 30GB Maxtor. Both XP Pro.

It may come down to a multi-task problem, this is the only consistant thing that I can find with it.

I'm waiting to see what the developers say, ;D

Cheers ;D

[Stan999]

{QUOTE-> Not quite, both Gigabyte Intel Chipset Motherboards, different models. Both 512MB Kingmax RAM. Mine P4 HT 2.8GHz, other Celeron 2.0GHz. Mine 2 x 200GB Seagate's, other 30GB Maxtor. Both XP Pro.

It may come down to a multi-task problem, this is the only consistant thing that I can find with it.

I'm waiting to see what the developers say, ;D

Cheers ;D <-QUOTE}

Is it the P4 HT that is having the problems? If so and you disable the HT does that resolve the issues?

[Marcos]

Hi Blackspear,

is there any reason you suspect NOD32 is the culprit? On my home machine, I completely uninstalled NOD32 and still getting this error upon closing a memory consuming application. I'm yet to try disabling HT to see if it goes away then...

[Blackspear]

{QUOTE-> Hi Blackspear,

is there any reason you suspect NOD32 is the culprit? On my home machine, I completely uninstalled NOD32 and still getting this error upon closing a memory consuming application. I'm yet to try disabling HT to see if it goes away then... <-QUOTE}
I bet if you make a fresh install of windows and don't install Nod32 you will find there is no error to be seen...

Being that the problem appeared on a FRESH install of Windows XP Pro straight after installing Nod32, that the error appears and disappears according to which version of the Beta I have installed, that installing the new release caused errors galore upon boot-up and the desktop loading, that these errors are now EVERY single time I reboot the machine after installing the new release, this ALL points to Nod32, wouldn't you say...

That Taz also had a FRESH install of Windows, then installs Nod32 and same format errors, this is a Nod32 issue...

Cheers ;D

[DonKid]

Well, it´s strange...Here everything is running fine.I have an AMD Barton 2500+.
Maybe Blackspear can give some numbers to me.
I think I´ll bet the numbers in a lottery game.
;D
Have you tried to install just windows XP, them after that NOD32, and the others aplications ? I can´t tell if it´s a SP2 problem, because it isn´t available here yet.

Keep us informed.

Best Regards,

DonKid.

[tazdevl]

{QUOTE-> I bet if you make a fresh install of windows and don't install Nod32 you will find there is no error to be seen...

Being that the problem appeared on a FRESH install of Windows XP Pro straight after installing Nod32, that the error appears and disappears according to which version of the Beta I have installed, that installing the new release caused errors galore upon boot-up and the desktop loading, that these errors are now EVERY single time I reboot the machine after installing the new release, this ALL points to Nod32, wouldn't you say...

That Taz also had a FRESH install of Windows, then installs Nod32 and same format errors, this is a Nod32 issue...

Cheers ;D <-QUOTE}

What he said. ;D

[Blackspear]

I have just had the following reply to the logs (mentioned above) sent to Eset:

"Thanks for sending us the logs. It appears that IMON is causing the problem but it doesn't seem like a regular pattern. Did this occur only after you installed 2.12.0 or did it happen while running 2.000.11b also?

XXXXXXX.

Eset Software Technical Support

So it seems as though we are finally heading down the right path with at least acknowledgement that IMON is the culprit...

Cheers ;D

[ronjor]

Arrrggghh! ;D ;D 8)

[Blackspear]

{QUOTE-> Arrrggghh! ;D ;D 8) <-QUOTE}
ROFLMAO tell me about it, with every new Beta it was Arrrggghh! or Hmmmm they may have fixed it, with the new release it was purely Arrrggghh!!!!!!

Cheers ;D

[ronjor]

I'msuretheywillfixitsoonihope.

[fredra]

OK...I maybe way off base here, but I found this at "blackviper's" web site. I hope that I am "on topic". I am not sure if this particular patch has been applied.
If I am incorrect, I apologize.
http://www.microsoft.com/technet/security/bulletin/ms04-011.mspx
Cheers :)

[Blackspear]

{QUOTE-> OK...I maybe way off base here, but I found this at "blackviper's" web site. I hope that I am "on topic". I am not sure if this particular patch has been applied.
If I am incorrect, I apologize.
http://www.microsoft.com/technet/security/bulletin/ms04-011.mspx
Cheers :) <-QUOTE}
Hi Fredra, thanks for the suggestion, all patches had/have been applied.

Eset have ackowledged this is a IMON problem, and are working on a fix at the moment...

Cheers ;D

[Blackspear]

A further update:

After the latest Nod32 caused my system to throw error messages galore up. I have finally decided to format and do a FRESH install of Windows XP Pro.

After installing I rebooted 5 times and every time it ran perfect, NOT a single error message...

Next I installed Acronis True Image and made a system backup restore point on DVD and a 2nd Hard Drive.

I then rebooted 5 times and every time it ran perfect, NOT a single error message...

Next I installed all my standard security apps and MS Office XP Pro.

I then rebooted 5 times and every time it ran perfect, NOT a single error message...

Next I made an incremental system backup restore point on the 2nd Hard Drive using Acronis True Image.

I then rebooted 5 times and EVERY time it ran perfect, NOT a single error message... Bet you can guess what's coming...

Next I downloaded a FRESH copy of Nod32 from the Eset website and you guessed it, now EVERY single time I have ERROR messages upon EVERY boot, these are BufferOverflow error messages and they are being captured by Prevx as well.

I Rebooted multiple times, ERROR messages appear EVERY single time.

Next I restored the incremental system backup restore point on the 2nd Drive using Acronis, and you guessed it back to normal, which is expected, as this restore point does not have Nod32 in it.

So there is no doubt whatsoever that Nod32 is causing this problem, as to why, I'll have to leave that up to the developers...

Cheers ;D

[Stan999]

{QUOTE-> A further update:

After the latest Nod32 caused my system to throw error messages galore up. I have finally decided to format and do a FRESH install of Windows XP Pro.

After installing I rebooted 5 times and every time it ran perfect, NOT a single error message...

Next I installed Acronis True Image and made a system backup restore point on DVD and a 2nd Hard Drive.

I then rebooted 5 times and every time it ran perfect, NOT a single error message...

Next I installed all my standard security apps and MS Office XP Pro.


Cheers ;D <-QUOTE}

In order to remove some other variables, if you do a FRESH install of Windows XP Pro and then install NOD before installing your "standard security apps" and reboot do you have the problem?

If not then it may be an odd conflict on that specific machine with another app. That might help troubleshoot the problem for a quicker resolution.

[Blackspear]

{QUOTE-> In order to remove some other variables, if you do a FRESH install of Windows XP Pro and then install NOD before installing your "standard security apps" and reboot do you have the problem?

If not then it may be an odd conflict on that specific machine with another app. That might help troubleshoot the problem for a quicker resolution. <-QUOTE}
The trouble is I have this exact same setup on 2 other machines (though they are Celeron CPU's) and it works perfectly with the EXACT same software. My client who has the same problem had only XP Pro installed when the error appeared, we had just formatted his PC.

I do have an image with only XP Pro on it, I'll try to find time to test some other install configs in the next few days, have guests arriving from overseas tomorrow so that will delay things a bit.

I have emailed a contact in Eset and they are looking at the problem still...

Cheers ;D

[Stan999]

{QUOTE-> The trouble is I have this exact same setup on 2 other machines (though they are Celeron CPU's) and it works perfectly with the EXACT same software. My client who has the same problem had only XP Pro installed when the error appeared, we had just formatted his PC.

I do have an image with only XP Pro on it, I'll try to find time to test some other install configs in the next few days, have guests arriving from overseas tomorrow so that will delay things a bit.

I have emailed a contact in Eset and they are looking at the problem still...

Cheers ;D <-QUOTE}

This seems like a rare problem which may or may not be specific to a platform type. Is your client's machine similar to yours as far as the MB, CPU, etc.?

It would be of interest if you just did an install of WinXP Pro and then NOD prior to anything else to see if the issue occures or not?

[Blackspear]

{QUOTE-> This seems like a rare problem which may or may not be specific to a platform type. Is your client's machine similar to yours as far as the MB, CPU, etc.?

It would be of interest if you just did an install of WinXP Pro and then NOD prior to anything else to see if the issue occures or not? <-QUOTE}
Yes, clients PC is also Intel Chipset Motherboard, though from memory it would be a Soltek. I can't remember, but are pretty sure it is a P4 and not a Celeron, as he prefers each of his machines to have a little more grunt.

I'll try to find some time to test more tomorrow with the image and just Nod32 installed...

Cheers ;D

[Blackspear]

Well I have spent over 8 hours trying to find the conflict with Nod32 and a piece of software on my system.

If I install all the security software I have been using for months, EXCEPT the latest version of Nod32, everything runs perfect, no error to be seen, add Nod32 into the equation and the errors spring up straight away or within 3 to 5 reboots.

So now I have reversed the situation and gone back to a image of Windows only. Next I installed a FRESH copy of Nod32 and reimaged. Then added Prevx (as this will often advise of the error message before a window pops up), rebooted 5 times, as the error is also VERY intermittent, no problem seen with Prevx, so a further reimaged was taken.

Step by step I installed one piece of software at a time, rebooted 5 times, reimaged and went onto the next piece of software, rebooted 5 times and then reimaged again, a very slow and laborious task...

The result, there is a conflict between the latest version of Nod32 and System Safety Monitor...

So far not a single error message has shown up... thus SSM and Nod32 used to play well together, now they don’t, SSM has been left in its box until I hear further from Eset…

So, as to my clients PC, there is obviously a piece of software he is installing that conflicts with Nod32. He is going to purchase imaging software, and we’ll go through the above process to find what conflicts on his PC…

Cheers ;D

[Stan999]

{QUOTE->
The result, there is a conflict between the latest version of Nod32 and System Safety Monitor...

Cheers ;D <-QUOTE}

Good to see you located the conflict on your machine! That should help Eset correct the issue.

Do you run System Safety Monitor on your other machine that wasn't having the problem?

[Blackspear]

{QUOTE-> Good to see you located the conflict on your machine! That should help Eset correct the issue… <-QUOTE}
I’ve sent the results back through to Eset, and will see what they can come up with now…

{QUOTE-> …Do you run System Safety Monitor on your other machine that wasn't having the problem? <-QUOTE}
Unfortunately, yes, but at least this is a start, other than knowing it happened according to what Eset was changing with IMON, there was no other consistent factor…

I’ll keep posting when further results are found…

Cheers ;D

[ronjor]

By all means, keep us informed!! ;D ;D 8)

[Stan999]

{QUOTE-> I’ve sent the results back through to Eset, and will see what they can come up with now…


Unfortunately, yes, but at least this is a start, other than knowing it happened according to what Eset was changing with IMON, there was no other consistent factor…

I’ll keep posting when further results are found…

Cheers ;D <-QUOTE}

Does this happening only on your machine that has HT? If so and you turn off HT in the BIOS, just for a test, does that help with the NOD and System Safety Monitor problem?

BTW, does your client, that has the same problem, also run System Safety Monitor?

[Blackspear]

{QUOTE-> Does this happening only on your machine that has HT? If so and you turn off HT in the BIOS, just for a test, does that help with the NOD and System Safety Monitor problem? <-QUOTE}
Will try to find time over the coming weekend to test this, as now having imaging software to play with on a fresh install allows me to play with various installs…

{QUOTE-> …does your client, that has the same problem, also run System Safety Monitor? <-QUOTE}
No, he isn’t running SSM, he uses various insurance software and remote access software…

Cheers ;D

[matt]

Any update on this problem?

I was getting the same memory read problems and shutdown when using a cisco VPN client.

There is a similar post here http://www.wilderssecurity.com/showthread.php?p=315960&posted=1#post315960 but not sure whether this has been resolved.

I would like to use this again but really with all the problems experienced I just can't afford it.

I was able to track the problem down to IMON causing the problem and only when connecting to the VPN.

Appreciate if anyone can bring me up-to-date on the latest and whether build 2.12.3 has resolved this issue.

[Blackspear]

{QUOTE-> Any update on this problem?

I was getting the same memory read problems and shutdown when using a cisco VPN client.

There is a similar post here http://www.wilderssecurity.com/showthread.php?p=315960&posted=1#post315960 but not sure whether this has been resolved.

I would like to use this again but really with all the problems experienced I just can't afford it.

I was able to track the problem down to IMON causing the problem and only when connecting to the VPN.

Appreciate if anyone can bring me up-to-date on the latest and whether build 2.12.3 has resolved this issue. <-QUOTE}
I have posted an answer in the link within your post. As this is not a Beta issue any longer.

Cheers ;D

[Blackspear]

Defenestration - Your post has been removed as it was off-topic to this thread and did not relate to a support issue of Nod32. If you wish to discuss other anti-virus software, please feel free to start a new topic in our "Other Anti-virus Program Forum" found here: http://www.wilderssecurity.com/forumdisplay.php?f=32

Cheers

Blackspear.