How long does a startup scan take?

[grun93]

Today I had to reboot my pc three times already because something strange is happening. And, although not 100% sure, I think it may have to do with Nod32.

First, that little green icon in the taskbar does not stop turning, like it normally does. The balloon says that a startup scan is in progress. I can't remember that this would normally take more than a minute or so, but today it has been over 100 minutes now, and it is still busy.

However, everything is working as usual. About two hours after startup, I can't surf the net anymore, the browser will stop to respond. Tried it with both Firefox and Opera. I can ping the router (192.168.1.1) but can't access it through the browser. There seems to be nothing wrong with the internet connection because Newsleecher is still downloading files with the same speed it allways does. Outlook does not respond anymore also. When I close Outlook and restart it, a message appears: "Outlook experience a serious problem with the eset outlook plugin add-in. If you have seen this message multiple time, you should disable this add-in and see if an update is available". I didn't open any attachments, however I do have a preview pane in Outlook open. This morning I received a junk mail from a sort of escrow company with which I had some problems in the past (I paid for a software license, didn't receive anything, they didn't respond to emails, and finally PayPal gave me the money back). I do receive spam from this company on a regular basis, delete it, and that was that. Can I be infected without actually opening anything, and with NOD32 monitoring the mail?
The taskmanager shows that the process ekrn.exe*32 is using about 47% of the cpu, the rest is more or less idle. This was with version 4.2.40 of NOD32 (64 bit).

The only thing I recently have changed in NOD32 was adding a weekly scan, but to run on sunday, not wednesday. I couldn't find an option to restore NOD32 to default settings so I decided to uninstall it manually (according to the instructions on the ESET site) and install the latest version 4.2.58.3 (64 bit). This didn't solve the problem, but the process ekrn.exe*32 takes now 25% rather than 47% with the previous version.

I take monthly images from my C-drive, so I'm not in a panic and can allways go back to a previous state. A few files may have been altered or lost, so I like to hear if there are other options which I can try before that. Thanks.

CPU Intel Q9400, 8 Gb RAM, OS=Microsoft Windows 7 Ultimate 64 bit with all the latest updates. Besides NOD32 4.2.58.3, Superantispyware is installed with realtime monitoring enabled.

[Tumi]

I have to join in on this problem. I got the same issue happened recently. Glad to see I'm not the only one and it seems this is a new one for NOD32. I suspect it could be some recent definitions update that is causing this.

I had v4.2.35 when this started happening. First tried an upgrade to v4.2.58.3 and when that didn't work I uninstalled everything and installed clean v4.2.58.3. First startup scan after fresh install went through fine, but after updating to the newest virus definitions, startup scan hangs again showing 25% CPU usage in Task Manager on ekrn.exe.
Currently I have startup scans turned off until this issue is resolved.

[grun93]

Thanks for the fast reply.

The NOD32 icon in the taskbar is still turning, however when I open NOD32 and monitor the 'watch activity' only a flat line is showing? The HDD LED is flashing on a regular basis, but not excessively. Outlook and Firefox are still working, and it has been three hours since the last reboot now. I don't have a clue what is going on but keep my fingers crossed.

[mckeeh3]

I am also seeing the same problem on 2 of 3 PCs setup with the same version of ESET 4.0.437.0 and virus database 5357 (20100811).

Looking at the statistics (task bar right click ESET icon, Open Window, Protection status, Statistics) shows that it is slowly scanning files.

Very little disk activity and ekm.exe process running at 100% CPU utilization.

It appears that this problem just started today 2010-08-11. The problem started prior to installation of Microsoft patches released yesterday on Windows 7 64-bit.

[Leschy]

Same problem here. Start up scan seems to run endless. I recognized the problem since yesterday (Microsoft patch day).

Hope Eset will fix the problem soon.

[Alexei Malinovski]

Same problem here. NOD32 eats up 100% of one core of my dual core processor. It is doing an endless start up scan for half a day already. I registered here to report this because I was quite frustrated

[Nicolus]

Hello,

Same problem here since 11h30 this morning :
ekrn.exe is eating 100% CPU on the 2 processors
Scan icon in turning with "startup scan in progress"
NOD32 V4.2.40.0
Pattern 5357
Windows Server 2003 R2 64 bits

We reboot the server but the problem came again. We have disables startup scan and reboot again, and it seems to be OK for the moment ...

[Marcos]

Definitely we'll need a complete memory dump from the moment the problem occurs. For configuring the oper. system to generate memory dumps, read this KB article. Let me know if you have a dump ready so that I can provide you with further instructions. If you use a production system and cannot afford generating BSOD, disable Anti-Stealth and Self-defense and restart the computer.

[grun93]

Originally Posted by Leschy

Same problem here. Start up scan seems to run endless. I recognized the problem since yesterday (Microsoft patch day). Hope Eset will fix the problem soon.

I have the same problem but do not already have the patch which Microsoft released yesterday. To be on the safe side (it wouldn't be the first time a MS patch messes up things), I let the MS update service run on Mondays rather than on Tuesdays (the default). In this case I have a six-day window in which possible release problems might expose themselves. I don't think this is a extra risk because the bug fixes which MS releases every second Tuesday of the Month are not that dangerous. A real big fault in MS OS'es is fixed and released immediately, on any day, not just on the second Tuesday.

[angrydog]

Hi, Just signed up. I am also experiencing this problem. ekrn.exe *32 is running between 94-97% and I started two scans which cannot be canceled. Their stuck in "Target: Operating Memory" phase.

BTW Running Windows Server 2008 R2 and this happened Before the Microsoft updates. I just applied the updates and will report back with any changes.

[Leschy]

Originally Posted by grun93

I have the same problem but do not already have the patch which Microsoft released yesterday. To be on the safe side (it wouldn't be the first time a MS patch messes up things), I let the MS update service run on Mondays rather than on Tuesdays (the default). In this case I have a six-day window in which possible release problems might expose themselves. I don't think this is a extra risk because the bug fixes which MS releases every second Tuesday of the Month are not that dangerous. A real big fault in MS OS'es is fixed and released immediately, on any day, not just on the second Tuesday.

ok, then it seems not be releated to ms patch day.

[DC187]

Exact same issue here.

Startup scan continuously running, using 50% CPU
If a second user logs on CPU utilization jumps to 100%

ESET Version: 4.0.467.0
Signature: 5357

Windows 2003 R2 x64 Standard

Issue started this morning at 11:30 GMT

[angrydog]

UPDATE: After installing latest MS patches and rebooting, my problem is gone.

I only have' mscorsvw.exe' taking up 50% which is probably re-compiling .NET after latest update. Speaking of the devil, 'mscorsvw.exe' is now idle too.

[drSteve]

Today, after installing latest MS Patch, i have the same problem.
Win 7 - 64 Bit, Dual Core, CPU always 100%.
Ver. Nod32 64, 4.2.58.3, virus signature database 5358.

Steve

[grun93]

Originally Posted by Marcos

Definitely we'll need a complete memory dump from the moment the problem occurs. For configuring the oper. system to generate memory dumps, read this KB article. Let me know if you have a dump ready so that I can provide you with further instructions.

I like to help but the instructions seems to be for Win XP, rather than for Win7? I don't have a My Computer icon in Win7, for example. I've tried creating a dump manually by tweaking the registry according to the instructions, but nothing seems to happen when I press the right CTRL key and the Scroll Lock key twice.

I have also found and installed the Microsoft Debugging Tools for x64 systems, version 6.11.1.404, but don't know how to use this tool. Pls give me further specific instructions.

[jimwillsher]

Start, run, then

sysdm.cpl

and enter. That gets you to the same screne as My Computer.

Oh, and you *do* have a My Computer icon, except it's on your start menu on the right hand side called "Computer". Right-clcik this and go to Properties, then Advanced.


Jim

[mckeeh3]

Originally Posted by drSteve

Today, after installing latest MS Patch, i have the same problem.
Win 7 - 64 Bit, Dual Core, CPU always 100%.
Ver. Nod32 64, 4.2.58.3, virus signature database 5358.

Steve

In my case the problem started before installing the latest MS patches and the problem continued after installing the patches.

[grun93]

Originally Posted by jimwillsher

Start, run, then sysdm.cpl and enter. That gets you to the same screne as My Computer.

Thanks Jim, found it.

What I understand from this setting is that it will create a dump automatically when the pc crashes. However, this is not the case. My pc doesn't crash, I don't get a BSOD, the mouse works, taskmanager works, it is more that some parts are still working as usual but some parts don't. I don't think a dump is created automatically.

[Nicolus]

For me, on the 2 servers that have this problem, none of the yesterday MS updates have been applied. After each pattern update, at scan is launch and ekrn.exe use 50 % of CPU, until I reboot the server ...

I detected that problem occurs after "update program module" occured this morning.
We use NOD32 Antivirus BE 4.2.40

[Leschy]

I think ms patch day yesterday doesn't play a role. My brother doesn't have this problem although he installed the updates. eset version is the same (4.2.40) but his pc is running on vista 32 bit, my pc is running on 7 64 bit.

[oxocube]

Same for me, 'Startup scan in progress' running following a database update.

Version 4.2.58.3 Virus Signature Version 5358 (currently)

Win 7 64bit

Thanks

[haerdalis]

Same issue here.. Neverending startupscan (using 13%, i.e 100% of 1 core)..

Using NOD32 4.2.35 as later versions seems to do things I really don't appreciate (somehow it seems Mass Downloader ends up creating invalid files when a later version is installed, even though that program is in the exclusion list).

Signature database 5358.
Win7 64 Pro.
Intel i7 920 d0.

I've tried unchecking Files,Archives,Self-extracting and runtime packers from the objects list for the threatsense engine for the automatic startup check, but still it keeps doing this,
even after a reboot.
I guess that particular setup screen is doesn't work.
I'm not really about to permanently sacrifice 100% of a full core to NOD32 (and a cpu temp at 57C instead of the normal 31C).

Btw, how do I disable startup scan completly? Except for uninstalling NOD32, it seems to be the only probable solution.

[johnphoton]

Same problem over here.
Windows 7 64bit EN
4.2.58.3 / 5358

I have disabled the startup file scan in the tool/sheduler, so for now i have my CPU back, but would love to see a solution asap!

JP

[paraffin]

I have the same here

Windows 2003 x64
4.2.58.3 / 5358

I have had to disable start up scan also to get around the problem. Why have ESET release a statement about this?

This has caused a lot of problems with 2 production systems that I manage wiping out almost a mornings work..

[haerdalis]

Originally Posted by johnphoton

Same problem over here.
Windows 7 64bit EN
4.2.58.3 / 5358

I have disabled the startup file scan in the tool/sheduler, so for now i have my CPU back, but would love to see a solution asap!

JP

Thanks for the tip.. At least I got my cpu back.. I feel somewhat sorry for those that have a single or dual core cpu in relation to this issue..