***SHOW OF HANDS *** XP Users and Application popups.

I just got another response from ESET Customer Care. Here's what they had to say about the Application popups, that ESET seems to think that I'm the only one getting them:

Isolated incident? In otherwords, this is only happening on my machine...right?

Come on.

I just installed ESS 4.0 on a third system ( that makes 2 completely different machines than mine) running XP SP3 and they're getting the popups too.

 

What exactly do you mean by application popups? Can you provide a screenshot please?

 

I suppose I could. Usually it happens too quickly to be seen since Windows is being shutdown. I have captured it on a screen capture movie clip using Windows Media Encoder.

However, I can hear it plainly since I have my Windows Critical Stop to play the Windows Battery Critical sound ( 2 BOOMS instead of the one for the default Windows Critical Stop sound).

 

Okay, here is a snapshot of the Application popup entry in the Event/System log:




And here is a link to the screen capture movie clip of the actual Application Popup itself:

http://webpages.charter.net/darrendavisleesomething/ApplicationPopUp.wmv

 

Its not just you! I get a popup confirmation box that displays that message often when I turn off the computer or restart it. It pops up only very briefly so its impossible to read it all at once, and dissapears with a sound. It's been driving me crazy!! I notice it happens when I've opened the ESS application and and configure rules in my firewall in that session, although it may just be launching the apllication that does it. I know it's ESS because it only starts to happen once I've installed it, and I've been reinstalling Windows alot recently beacuse of new hardware and issues I've been having.
I'm on Windws XP SP3 as well, mines the 32 bit edition. I installed Widnows via a CD with SP3 included.

Edit: I can also confirm that I have dllhost.exe left running like you posted in another thread.

I'm using the "Interactive" firewall mode if it matters. Also when ESS detects an application trying to communicate through the internet and asks me if I want to allow/deny it, and I tell it to remember the communication as allowed as a rule, should it make the rule apply only to the ports it's communicating through? I'm sure it did this in the ESS Beta I tried, but it just makes it open to all local/remote ports on this version for each rule.

I've also been having probelms with my Linksys wireless adapter.. but I'm not sure if thats ESS or the Linksys software. When I install the adapter it comes up with a confirmation box to install an ESET firewall miniport but says it isn't Micorosoft/Windows Logo approved but I install it anyway.. It does this when I install WinPcap as well.
My wireless connection looks like it disconnects and connects 2 times at startup(3 times connecting) in the system tray, and discconects and reconnects when I use a browser, at lest IE 8 or when I visit certain pages. I also does this when I connect a USB device.

 

Hmmm it seems like a confliction between ESET and another running process. The screenshot doesn't give any specific info although it does mention dwwin.exe which is the Windows error reporting/diagnostic tool.

Is ESET set to scan on shutdown?

Does it happen if certain ESET modules are disabled at the time of shutdown? Perhaps try disabling the anti-virus then shutting down...if it still happens, try disabling the firewall next time.

Also, you could try starting your system with only ESET enabled. Then you will be able to see if the problem is between ESET and another program you have set to autostart with Windows. You mentioned the same happens on a couple of PCs you have installed ESET on...so are the any other versions of the same programs installed on the other PCs too?

Do you a run modified system...things like skinning apps (WindowBlinds etc) and custom icons programs as they may be causing a problem?

Or..you could just disable the Dr Watson debugger completely.

Try the above...you may just need to update a program or plug-in for a non-ESET program.

 

The DllHost.exe is used by the ESS 4.0 System Updates feature which starts up Windows Automatic Updates. It is particularly useful if you've got the Automatic Updates set on Manual instead of the default Automatic. It's almost still too redundant. Microsoft usually issues updates (Security and/or Windows hotfixes) around the 1st or 2nd Tuesday of every month (hence the term "Patch Tuesday") so it's quite unecessary to have Automatic Update set up to run every time you log into Windows. You could configure Automatic Updates to run at certain scheduled intervals via Local Computer Policy/Computer Config though and that is just about what ESS 4.0 System Updates does in it's own way depending on how one has ESS 4.0's Scheduled Automatic updates configured.

At first I thought the ESS 4.0 System Updates feature was causing the Application popup during log-off/shutdown/reboot, etc..., but later found out that it indeed WAS NOT like some people may think. I still got the popups even after I set the System Updates to "No Updates".

I might be on the verge of making another little discovery. I'll have to wait and see what goes on before I write about it.

 

No. I got the scanning setup to run at startup (once per 1 hour max.) and I've got the In-depth Computer Scan to run once a day.

Everything is running for ESS. I've already tried disabling the Firewall before shutting down...no difference.

Tried that already too. I only have 2 additional process running other than the necessary stuff for XP and the ESS processes: ITYPE.exe and IPOINT.exe which is for Microsoft's Wireless Mouse and Keyboard, and yes, I even had them disabled as well. For example, right now at this very moment I only have 22 processes running:

csrss.exe
dllhost.exe
egui.exe
ekrn.exe
explorer.exe
iexplore.exe
ipoint.exe
itype.exe
lsass.exe
mups.exe
services.exe
smss.exe
spoolsv.exe
svchost.exe
svchost.exe
svchost.exe
svchost.exe
system
system idle process
upsd.exe
winlogon.exe
wmiprvse.exe

Nope.

It's got nothing to do with Dr. Watson per se, more like Windows Error Reporting which is what dwwin.exe is all about. Have to fully disable WER. If the box is checked for "But notify me when critical errors occur" then the popups still occur.

Wrong. Like I talked about above, I have very little going on during shutdown. As far as I am concerned it's a ESS 4.0 vs Windows XP thing. Never got the popup with ESS 3.0 (build 672 or 68x).

 

Hey man I got that too - I was looking where that comes from. I have two machines xphome - one with ess, the other with eav

If you find a solution - let me know

Ruben
PS: How do you disable dwwin completely?

 

Deepest apologies for being "wrong".

Previous to me rolling back to 3.0.368, I ran two builds of v4 on XP and Vista and had no such problems...although I did experience some other drawbacks.

Well good luck....perhaps you could have a look in your Dr Watson log for more details.

 

Open regedit and navigate to the following key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AeDebug

Export the key so that you can re-enable the feature at a later date if need be without having to search online for the registry values then delete the key.

Reboot and that's it.

Hope that helps...

If you're unsure on editing the registry, please take care. The instructions above will not harm your computer in any way but deleting the wrong key may do.

 

About that "discovery" I mentioned earlier.....

Before I talk about that discovery I was working on, I want nickster_uk to know that no appologies are necessary. In fact, I thank you very much for your response and interest. Furthermore, there are no Dr. Watson logs per se of the popup. Like I mentioned in my last post the Application popup is refering more to Windows Error Reporting than anything else. There is a xxx_appcompat.txt file being generated when the popup occurs though and it's being placed in the C:\Documents and Settings/Local settings/Temp folder. More than likely it's the same info that Windows Error Reporting would send to Microsoft if it were not killed by the shutting down of Windows.

Okay. On to about that discovery. I set up ESS's Scheduler to run Regular automatic updates ever 15 minutes. It's been doing that for well over 4 hours now. Something very interesting: I've shut down Windows probably at least 3 times since making the changes in the Scheduler. And guess what?? NO POPUPS!!!

However, I ran the updates MANUALLY 2~3 times within the 4 hours (either directly with the EGUI or with the right-click on the Toolbar Eyeball/Update )and I DID GET THE POPUP!!!

I've got a basketball game to watch (on my computer). I'm gonna keep connected to the internet. Gonna let ESS run all the regular updates (even the System Updates) for the duration of the game. I won't run the updater manually at all.

I'll be back...in about 3 hours.

P.S. To fully disable Windows Error Reporting: Right-click on My Computer/Properties/Advanced Tab/Error Reporting. Click on the Disable Error Reporting radio button and uncheck "But notify me when critical errors occur". I wouldn't go through all the trouble of trying to disable Dr. Watson in the Registry if I were you. It won't keep the popups from occuring.

IT'S WINDOWS ERROR REPORTING

 

Re: About that "discovery" I mentioned earlier.....

I think you will find it will stop the popups...give it a try

 

Re: About that "discovery" I mentioned earlier.....

I already have. It doesn't keep the popup from occuring.

 

Re: About that "discovery" I mentioned earlier.....

That's interesting as Dr Watson is dependant on that key

 

Re: About that "discovery" I mentioned earlier.....

Keep trying to to tell ya...

dwwin.exe is NOT Dr. Watson. It's Windows Error Reporting. Go to dwwin.exe file in Window/system32 folder and you'll see what I'm talking about int the File Description.

 

Re: About that "discovery" I mentioned earlier.....

dwwin is part of Dr Watson

 

Re: About that "discovery" I mentioned earlier.....

Dwwin.exe is associated with Dr. Watson but it is NOT the Dr. Watson executeable. drwtsn32.exe is the Dr. Watson executeable. Dwwin.exe is the executeable for Windows Error Reporting.

 

Re: About that "discovery" I mentioned earlier.....

Yep....as I mentioned earlier, dwwin or Microsoft Application Error Reporting is part of Dr W and is reliant on the registry key a few posts above.

 

Re: About that "discovery" I mentioned earlier.....

No.

Dwwin.exe is NOT reliant on the Aedebug key. drwtsn32.exe is. There is no key that dwwin.exe is reliant on.

 

Re: About that "discovery" I mentioned earlier.....

I'm not gonna bicker back and forth with you nickster. If you feel like disabling Dr. Watson , knock yourself out. If it keeps you from getting the popup, great. If not....

It's quicker and easier just to go to Control Panel/System/Advanced/Error Reporting.

The Basketball game is almost over. I'll be back on to talk about that probable discovery in about 30 minutes.

 

Re: About that "discovery" I mentioned earlier.....

Wow........

Good stuff Darren

 

Re: About that "discovery" I mentioned earlier.....

I hadn't been able to find the messages in Event Viewer. Where was that log you posted viewed from?

And although I still have ESS on the default updating schedule of once an hour(soon to be changed to daily), I do often click on manual update(sometimes before I do a scan). I'm not sure if I've done this everytime it happens though.. But it doesn't happen to me on every shutdown/restart, but I notice it has after using the ESS interface.

 

Basketball game almost went into Overtime.

Okay. On with what I was going to write about.

I reckon that is what my discovery is as well. I had ESS Scheduler running updates every 15 minutes for the last 7 hours or so. I made several reboots during that time. I didn't get any popups during reboots IF I DID NOT run the updates manually with EGUI up or the right-clicking on the Toolbar Eyeball icon/Updates. However, IF I DID do manual the updates manually with the EGUI or Toolbar icon I did get a popup during the reboot.

So, that leads me to believe that there is something amiss with the ESS interface and the manual updating.

 

Darren,

I have Vista Ultimate 32 bit with ESS 4.0.417 and also notice the popup flash onto the screen when shutting down. Happens too fast to read what it is about, BUT it is nothing to do with ESS. I run a program called MailWasher Pro at startup to handle spam on my email account. When I shutdown Vista, MailWasher basically is too slow to shutdown and Windows displays the popup. The following quote from MailWasher support might help :

"MW has had trouble with PC shut downs for a while, I'd recommend you exit MW first before shutting down.

When your PC shuts down it sends close commands to running programs and gives them a certain amount of time to close, if they don't then Windows just closes them and this can cause problems especially with programs (like MailWasher) that has a lot of tasks to perform when it closes. It's not very smart design on our part, we'll be trying to make the tasks MW needs to perform when closing fewer and quicker in future."

Regards