NOD 32 5.0.93.0 & 5.0.94.0:PC freezes when USB HD is connected

[rcdailey]

Originally Posted by Marcos

Instuctions sent. I as well as many other guys here will be eager to know what your memory dump will show. Will keep you posted about our findings.

I know I'll be interested. I decided to reinstall version 5.0.95.0 on my system with XP SP3. I have been following a particular procedure that works better for me with external USB hard drives in that I always shut down before removing a drive and always reconnect the drive before starting up. That helps with any other issues of drive recognition. So far, after reinstalling version 5, it is working without any issues. I will know more when I have gone through the process of shutting down and then restarting, but I think it will work fine.

Added:

Today, I had to resort to a last known good configuration to get out of a boot loop after starting from cold with the USB hard drive attached. It worked okay after that and after another cold start. It's definitely related to recognition of the drive and a driver loading at the same time, probably the ESET driver. Since 4.xxx doesn't exhibit this issue, it's the difference in the way 5.0.95.0 works, but beyond that I do not know. I'll keep watching it and decide whether to go back to 4.2.71.2 again at some point.

[MaesyB]

Hi Marcos, Thanks for all your help with this issue. I've decided to build a new Win 7 PC so for me at least the problem has been resolved. Incidentally I've been trialling Vipre Internet Security 2012 and I have exactly the same issues with XP! I'm sticking with ESET

I couldn't PM you btw - your mail box is full!

[mouser]

Hi Marcos, I am also interested in hearing the results.

As far as your advice on requesting a refund, here is the official reply I got from ESet -- where I ordered the software from directly, after I explained the problem and pointed them to this thread:

"Thank you for contacting ESET Sales Support. We are sorry to hear that you wish to return our product. We pride ourselves on our liberal 30-day return policy; however, you have requested to return the product after this 30-day trial period. Unfortunately in these cases, we will not be able to provide you with a credit."

[Marcos]

Oswald2 resolved the issue by installing the hotfix already provided to those who requested it here before.

[rcdailey]

Originally Posted by Marcos

Oswald2 resolved the issue by installing the hotfix already provided to those who requested it here before.

I believe that I have isolated and resolved the issue I was having with NOD32 v 5.0.95.0. The conflict that I found and eliminated was with MalwareBytes. I have the paid version of that software and I found that even with real-time protection disabled in MalwareBytes, the MBAM service would still load with Windows. This service was what prevented ESET NOD32 from checking when a drive was initially connected to the system while up and running. When this happened, the system would lock up. By either disabling the MBAM service or setting it to "manual," the conflict went away and the popup to select the action to take with respect to the USB drive would display and the appropriate option could be selected.

In any case, with my system running XP SP3, this is what I found and how I decided to handle it. I also have SUPERAntiSpyware ver 5.0.1144 installed and running in real-time and it does not conflict with NOD32 ver 5.0.95.0. It is a little disappointing to have to disable MalwareBytes, but I can live with it.

I can now connect a USB hard drive while the system is running and it won't lock up. I can remove a USB hard drive while the system is running and it won't lock up. If anyone else using XP SP3 is running MalwareBytes in real-time and is having issues with ESET NOD32 v 5.x, try disabling the MBAM service and see whether that solves the problem. Adding to this, MalwareBytes will run a scan and can be updated manually without the MBAM Service enabled. I have checked that just now and can confirm that. Also, if the MBAM Service is set to "manual" it does not load when MalwareBytes is run. For most people who like to use MalwareBytes, that should be enough and there won't be a conflict with ESET NOD32 ver 5.x. One more note: If you do have the paid version of MalwareBytes and you decide to re-enable protection, then the MBAM Service will be reset to "automatic" and it will load with Windows, so keep that in mind.

[mouser]

I don't have any of the drivers that people have been saying is the cause of their hangups with Eset.

Is there some commonality here -- something to look for or something to narrow down the candidate conflicts?

I don't have any other security/antivirus software installed besides Eset Smart Security.

[rcdailey]

Originally Posted by mouser

I don't have any of the drivers that people have been saying is the cause of their hangups with Eset.

Is there some commonality here -- something to look for or something to narrow down the candidate conflicts?

I don't have any other security/antivirus software installed besides Eset Smart Security.

My thinking, based on some of the testing I did to try to isolate my own issue, is that it has to do with ESET checking whenever a USB drive is attached and somehow conflicting with other software that does the same thing. I noticed, for example, that while I was having the issue, if I tried to change the "policy" of the attached USB hard drive, it would cause the drive to disappear in "My Computer" and the system would lock up when I attempted to start a browser or even the task manager. Since this would not happen in "safe mode," I knew that something was starting with Windows in normal mode that was conflicting. It would not have to be security or anti-virus software, just something that checks whenever a USB drive is attached or removed. If two programs (ESET and whatever else) are both checking the drive at the same time, that could cause a conflict.

[layman]

Originally Posted by rcdailey

My thinking, based on some of the testing I did to try to isolate my own issue, is that it has to do with ESET checking whenever a USB drive is attached and somehow conflicting with other software that does the same thing.

Yes. I have observed that ESET doesn't play well with USB Safely Remove or Zentimo, and the issue exists in v4 as well as v5.

[mouser]

I wonder if anyone can think of a way to search for system drivers that may also be checking for external drive insertion.

I'll note that the same problem occurs when inserting an external eSata drive -- so it's not so much usb as it is the connection of an external hard drive (though the problem doesn't occur with simple thumbdrives).

[kjz]

I've installed MBAM on these machines, but not the MBAM service. Only a manually started scan with the free MBAM version every week.

Another candidate may be UMTS sticks. Normally these sticks have an 'internal drive' and a additional SD memory card can also be inserted (which works like a second USB drive). A lot of these websticks comes with software (drivers) which will recognize these sticks automatically when connected with the PC. So these drivers also must monitor the USB ports.

[rcdailey]

Originally Posted by mouser

I wonder if anyone can think of a way to search for system drivers that may also be checking for external drive insertion.

I'll note that the same problem occurs when inserting an external eSata drive -- so it's not so much usb as it is the connection of an external hard drive (though the problem doesn't occur with simple thumbdrives).

I doubt that system drivers, at least those that come with Windows, itself, would be the problem. I think that only because Eset would have already tested NOD32 and ESS against Windows and its drivers, and would have found any conflicts. Third-party software would be the problem, since Eset would not have samples of all third-party applications for testing.

[mr_leb]

I also have my pc freezing since installing v5.0.95 today.

I'm running XP SP3. I also have Malwarebytes Antimalware, and had alread had some troubles with v4, but disabling the mbamservice and not starting malwarebytes at all didn't solve anything.

The problem is when mounting a bestcrypt drive. As soon as an application tries to access the mounted drive, windows freezes and it's over, have to do a hard reboot. It is bestcrypt Control Panel v8.20.7.4 and Bestcrypt driver v4.24

I didn't read the whole thread, is there a known issue with mounting bestcrypt drives and nod32 v5.0.95? For the new version is currently unusable, as my emails are stored on a bestcrypt drive...

[rcdailey]

Originally Posted by mr_leb

I also have my pc freezing since installing v5.0.95 today.

I'm running XP SP3. I also have Malwarebytes Antimalware, and had alread had some troubles with v4, but disabling the mbamservice and not starting malwarebytes at all didn't solve anything.

The problem is when mounting a bestcrypt drive. As soon as an application tries to access the mounted drive, windows freezes and it's over, have to do a hard reboot. It is bestcrypt Control Panel v8.20.7.4 and Bestcrypt driver v4.24

I didn't read the whole thread, is there a known issue with mounting bestcrypt drives and nod32 v5.0.95? For the new version is currently unusable, as my emails are stored on a bestcrypt drive...

There is a thread about issues with Trucrypt:

http://www.wilderssecurity.com/showt...light=trucrypt

This _may_ be a similar issue, but you'll probably have to go to customer service about it.

[mr_leb]

I don't know, I have another machine (netbook with windows 7 and truecrypt), and I also installed nod32 v5.0.95 on this one, and I have no problem. No BSOD like described on the thread. My problem really is the exact same one as in this thread - as soon as the drive is mounted in windows, everything freezes. I should have tested with an usb drive to see if it was a bestcrypt or simply a "new drive appearing in windows" drive problem, but I de-installed v5 before that. Yet again, *maybe* I didn't deactivate malwarebytes completely (although I'm pretty sure). And I don't have any of the conflicting drivers listed above

It would be cool if nod32 dev were to test it with bestcrypt on XP SP3. Maybe with a bestcrypt trial version or something?

[rcdailey]

Originally Posted by mr_leb

I don't know, I have another machine (netbook with windows 7 and truecrypt), and I also installed nod32 v5.0.95 on this one, and I have no problem. No BSOD like described on the thread. My problem really is the exact same one as in this thread - as soon as the drive is mounted in windows, everything freezes. I should have tested with an usb drive to see if it was a bestcrypt or simply a "new drive appearing in windows" drive problem, but I de-installed v5 before that. Yet again, *maybe* I didn't deactivate malwarebytes completely (although I'm pretty sure). And I don't have any of the conflicting drivers listed above

It would be cool if nod32 dev were to test it with bestcrypt on XP SP3. Maybe with a bestcrypt trial version or something?

With regard to the MBAM service, you can check its status by going to the control panel, administrative tools, services and look for MBAM. If the service isn't there, it was never installed. If it is there, you can check the properties and make sure it isn't set to "automatic." Setting it to either "manual" or "disabled" will keep it from loading when the system starts. You should be able to check this and change it even as a "limited user" in XP.

[mouser]

I was wrong when I said earlier that this system hang caused by eset blocks the creation of a memory dump -- I was able to complete a full memory dump (i think the problem was that i needed to reboot after changing registry setting to choose full memory dump mode)..

[simplicissimus]

Hola:

Originally Posted by layman

Yes. I have observed that ESET doesn't play well with USB Safely Remove or Zentimo, and the issue exists in v4 as well as v5.

No problems with USB Safely Remove and EAV 4 here (Windows XP SP3).

[rcdailey]

Originally Posted by simplicissimus

Hola:



No problems with USB Safely Remove and EAV 4 here (Windows XP SP3).

The only problem I experienced with version 4 and safely remove USB was with regard to settings for system restore. I had external drives set so that there was no system restore for them, but if I removed an external USB hard drive before the system shut down and then reattached it the next time after the system started, the setting for system restore would sometimes revert to default monitoring for that drive. It did not happen all the time. I believe this is unrelated to Eset NOD32, but is a system issue for some computers running XP and not all of them, either. Currently, I'm using NOD32 v. 5.0.95.0 and I simply choose to shut down before removing a drive and reattach the drive before starting the system. I do this just for the purpose of avoiding resetting the system restore on the external drive.

[mouser]

I've given up on Eset and switched to Agnitum Outpost. Now if only i could convince Eset to refund my remaining year of service that I paid for and can't use.

[Marcos]

Agnitum Outpost is one of the known pieces of software that has a bug in the code causing issues when installed in conjunction with v5 and some other software.

[GreenWhite]

Yes, that's true.

I am still using eset despite the bug, painful ... but need to soldier on.

Waiting for a new release, hopefully that will completely solve the problem.

[Marcos]

Originally Posted by GreenWhite

I am still using eset despite the bug, painful ... but need to soldier on. Waiting for a new release, hopefully that will completely solve the problem.

Not sure which of the software listed in the sticky thread in this forum you have but ESET cannot fix bugs in flawed software of other vendors.

[GreenWhite]

Nothing of those on my PC. Its alright.

Thanks. eset 4 was cool, but slower. That's why I stick with v5. Just have to attach ext hd before boot.

[Marcos]

Originally Posted by GreenWhite

Thanks. eset 4 was cool, but slower. That's why I stick with v5. Just have to attach ext hd before boot.

It would be great to identify the problematic software by generating a complete memory dump at the point of a system lockup and supplying it to ESET.

[rif]

Local helpdesk got my syslogs/dumps in Sept 11 .................................................