BackupAssist and NOD32 Incompatibility

[BackupAssist]

Hi there,

It’s Stuart here and I work for Cortex IT, who develop backup software called BackupAssist.

We’ve had a few of our resellers (who also sell NOD32) which have been experiencing the Blue Screen of Death during the backup process on some servers.
Upon analysing the crash dump from some customers, it’s stated that the process causing the crash is ekrn.exe – which is a NOD32 process.

We have tried countless times to replicate the issue in house however have not been successful in doing so.
Our resellers have stated that if they uninstall NOD 32 for a few days, the BSOD disappears but then reappears when NOD32 is re-installed.

I’m writing this to hopefully open up a line of communication between ESET and Cortex in the hopes that we can find a resolution.

Please let me know what information you’d require and we’ll try to accommodate you as best we can.

Thanks in advance and awaiting your response.

Stuart

[Marcos]

Hello,
the fact that ekrn is listed as the culprit does not necessarily mean that the problem actually lies in ekrn. First of all, make sure that the isssue occurs with the latest version of EAV 4.2.71 installed. If so, please get a complete memory dump generated during BSOD. When done let me know so that I can provide you with further instructions.

[cgreentx]

The majority of the systems we are experiencing this problem with are running MS Exchange and therefore have the XMON version installed. We can not run 4.2.71 on those servers. The servers are setup with exclusions as directed by ESET tier 3 support due to the lockup issues for Windows 2008+ servers and have operated fine other than random blue screens during backups. Cortex IT is making an effort to reach out for help here and we are stuck in the middle on this one. As a MSP who resells BackupAssist and has NOD32 installed at nearly every client we need a solution.

Chris Green
Director of Technology
Solerant, LLC

[BackupAssist]

Hi,

It's Stuart here again.

As mentioned by Chris, the version which you've indicated isn't able to be installed within that particular environment (running Exchange). Do you have a specific version (with direct download link) which we can relay to our customers using this type of environment to avoid unnecessary hold ups?

Thanks in advance.

[dmaasland]

Have you tried ESET Mail Security for Microsoft Exchange server 4.3.10016.0?

[Marcos]

The latest version of ESET Mail Security for MS Exchange is 4.3. This version features automatic exclusions per the recommendations by Microsoft and also has application protocol filtering disabled by default (equal to renaming the epfwwfpr.sys driver) to prevent a bug in MS Windows Filtering Platform from manifesting.
Should you get a BSOD with EMSX 4.3, we'd need you to provide us with a kernel (or better complete) memory dump to tell if the problem lies in EMSX or another driver / software you use.

[agoretsky]

Hello,

Just to clarify, XMON is (or was) the nickname for NOD32 for Exchange, which was ESET's old product for Microsoft Exchange. NOD32 for Exchange was based on the NOD32 2.7 engine, which is now several years old and no longer being actively developed.

ESET Mail Security for Microsoft Exchange Server ("EMSX") is the replacement for NOD32 for Exchange, and is a free upgrade for licensed users. Customers may need to get a new license key issued, though, because the structure of the license key may have changed. That can be done by using the form here or by contacting the sales department at +1 (866) 343-3738 to have a replacement license issued.

Regards,

Aryeh Goretsky

[thaurron]

Hi,

We also have compatibility issues with NOD32 and BackupAssist on a production serveur causing BSOD.

Here's the dump file http://dl.dropbox.com/u/19815347/050311-125627-01.zip

It happens at the end of almost every backups and it stopped as soon has we uninstalled NOD32 from the server.

Before uninstalling we were running NOD32 Antivirus 4 version 4.0.474.0 on a IBM server with Windows Server 2008 R2 Fundation SP1 x64.

Thanks !

Hugues Lavallee
Progel Inc.

[cgreentx]

Originally Posted by agoretsky

Hello,

Just to clarify, XMON is (or was) the nickname for NOD32 for Exchange, which was ESET's old product for Microsoft Exchange. NOD32 for Exchange was based on the NOD32 2.7 engine, which is now several years old and no longer being actively developed.

ESET Mail Security for Microsoft Exchange Server ("EMSX") is the replacement for NOD32 for Exchange, and is a free upgrade for licensed users. Customers may need to get a new license key issued, though, because the structure of the license key may have changed. That can be done by using the form here or by contacting the sales department at +1 (866) 343-3738 to have a replacement license issued.

Regards,

Aryeh Goretsky

As a LOOOOONG time user of ESET NOD32 at hundreds of my customers I'm very prone to use old names for the modules. We are currently beginning testing of 4.3.x to see if it solves the problems.

Chris Green

[cgreentx]

Originally Posted by Marcos

The latest version of ESET Mail Security for MS Exchange is 4.3. This version features automatic exclusions per the recommendations by Microsoft and also has application protocol filtering disabled by default (equal to renaming the epfwwfpr.sys driver) to prevent a bug in MS Windows Filtering Platform from manifesting.
Should you get a BSOD with EMSX 4.3, we'd need you to provide us with a kernel (or better complete) memory dump to tell if the problem lies in EMSX or another driver / software you use.

We just received notification of this version yesterday and will begin installing it to test immediately. Do the automatic exclusions include ALL required server settings, or is there an updated guide with things that need to be disabled?

As a request, there really should be a customer/reseller notification email when a new release of NOD32 happens. With hundreds of customers on NOD32 its hard enough to keep them current without relying on luck to find that there is an update.

Chris Green

[cgreentx]

Mail Security 4.3.x did not fix the issue. Our techs loaded it on one of our problematic servers yesterday and the server hard-locked again. There is no dump that I can send you as the hard lockup situation does not generate one. What do we need to do in order to get ESET and CortexIT working together? This forum is NOT the right place for this effort.

Chris Green
Director of Technology
Solerant, LLC

**Correction - The server locked up well after backups completed successfully on this server. We will be opening a ticket with ESET on this one and proceed with putting NOD32 back on our BA servers to continue the test.

[cgreentx]

This issue has continued to plague us. NOD32 and BackupAssist do not get along and I don't think either company cares to solve this problem. Why is neither party jumping through hoops to solve this problem?

[dmaasland]

Perhpaps it's better to open a support ticket with ESET about this. Are they by any chance virtual servers?

[cgreentx]

Originally Posted by dmaasland

Perhpaps it's better to open a support ticket with ESET about this. Are they by any chance virtual servers?

We've already gone down the disable this, disable that roue with ESET support and got nowhere. I'm baffled why the two companies won't work together. We have thousands of seats of NOD32 in production and it matters not apparently.

[dmaasland]

If you have the Full memory dump (So not a kernel of minidump) along with a sysinspector log and exported settings, you can give those to support and they should be able to identify the exact source of the problem.

[cgreentx]

Originally Posted by dmaasland

If you have the Full memory dump (So not a kernel of minidump) along with a sysinspector log and exported settings, you can give those to support and they should be able to identify the exact source of the problem.

Ever tried uploading a 24GB memory dump over a T1?

[BackupAssist]

Hi all,

It’s Jason here from Cortex IT, lead developer of BackupAssist.

We're currently in discussions with ESET, and will update this thread as soon as we can.

IMPORTANT: users of BackupAssist experiencing this issue should contact BackupAssist support at support_at_backupassist.com for a workaround that avoids the blue screens.

Hope this helps,
Jason Schultz
Development Team Lead - BackupAssist

[agoretsky]

Hello,

Issue is under investigation. Thank you for your reports.

Regards,

Aryeh Goretsky

[BackupAssist]

Hi everyone,

As mentioned by ESET, they have been investigating this issue and have provided us with a patch.
We are planning to complete our testing this month and will update this thread as soon as we can.

In the meantime, please post your interest on this forum to ensure ESET are aware of your situation.

Thanks,
Stuart
The BackupAssist Team

[thaurron]

Hi There,

Is there a patch beside changing the createFileCatalogue value in the job config file of Mobicontrol ?

Thanks !

Hugues Lavallee
Progel Inc.

[BackupAssist]

Hi again everyone,

Just an update to say we've had some positive results with testing the patch which was provided by the ESET team. We installed the patch a week ago and the system hasn't blue screened at all and all backups have been successful.

As mentioned earlier, if you're interested in applying this to your machine please contact ESET for details on obtaining the patch.

Thank you,

Stuart
The BackupAssist Team

[agoretsky]

Hello,

Thank you for the feedback.

Regards,

Aryeh Goretsky

[ezwep]

Where can I download the patch? I use the Eset Antivirus and the Eset Exchange Antivirus on my servers.

[agoretsky]

Hello,

Private message sent.

Regards,

Aryeh Goretsky

[BSStech]

I'm another looking for this patch for ESET and BackupAssist

thanks