NOD 32 5.0.93.0 & 5.0.94.0:PC freezes when USB HD is connected

[layman]

Originally Posted by Marcos

... ESET cannot fix bugs in flawed software of other vendors.

That's obvious enough. What is less obvious to me is that the flaw has been proven to lie in the other software. I know there is a list of known conflicting products, but is there an explanation somewhere detailing how these other products are flawed?

[vivona]

I have continued to run on 4.2.71.2 with no USB issues on WinXP SP3 because I had the USB lockup issue with 5.x. I don't have any of the software listed in the Known Conflicting Software sticky.

There have been no posts in this thread for three weeks now. Is this issue still unresolved? I don't want to upgrade back to 5.x until it is.

[billegate]

same problem for me. It is a pity that it cant be solved

[Marcos]

PM sent both to vivona and billegate.

[rcdailey]

Originally Posted by rcdailey

With regard to the MBAM service, you can check its status by going to the control panel, administrative tools, services and look for MBAM. If the service isn't there, it was never installed. If it is there, you can check the properties and make sure it isn't set to "automatic." Setting it to either "manual" or "disabled" will keep it from loading when the system starts. You should be able to check this and change it even as a "limited user" in XP.

Adding to this: Recently, Malwarebytes released an update to their software and because I pay for it, I allowed the update. I had the MBAM service disabled because of the conflict with Eset NOD32 v. 5.0.95.0 regarding USB external hard drives. The Malwarebytes update reinstalled the MBAM service and set it to "automatic" for loading at startup. I had to go into the services tab to disable the service again. For those who use Malwarebytes but don't have the paid version, the MBAM service is NOT installed with the free version of Malwarebytes, so you should not see this conflict.

[rif]

Originally Posted by Marcos

PM sent both to vivona and billegate.

Just individually DIY-fixes?
Why is there no solution in a 5.0.96.0 or so?

[wolliballa]

I assume, that up to now it appeared nearly impossible to reproduce the various symptoms in the lab ( and therefor no general solution is available ). But on the other hand, they should have now more than a dozen dumps to look into............

[rif]

...... since half a year, as mine.

[billegate]

I have tried Marcos solution (2 fixes) and I must admit that for the first time for me it works. The only problèm is that I was forced to uninstall Malwarebytes because with it I stll have problèm as mentionned in several post. It is a pity because it is a very useful security tool. Thanks to Markos I will be really satisfied when both nod32 and malwarebytes work together

[rcdailey]

Originally Posted by billegate

I have tried Marcos solution (2 fixes) and I must admit that for the first time for me it works. The only problèm is that I was forced to uninstall Malwarebytes because with it I stll have problèm as mentionned in several post. It is a pity because it is a very useful security tool. Thanks to Markos I will be really satisfied when both nod32 and malwarebytes work together

Yes, it seems to be a conflict between the MBAM service (loaded at boot) and Eset NOD32 v. 5.x. Those who don't pay for MBAM won't have the problem, so far as I know.

[acooldozen]

Originally Posted by rcdailey

Yes, it seems to be a conflict between the MBAM service (loaded at boot) and Eset NOD32 v. 5.x. Those who don't pay for MBAM won't have the problem, so far as I know.

I don't believe there is a conflict there at all. I have both running at boot on 2 machines. I have upgraded each time with no difficulties.Version 5.0.95.0 and MBAM 1.61.0.1400 and am not experiencing any such problems. YET!
Acer Netbook, Windows7 Ultimate and,
Toshiba Notebook Windows7 Home Premium

[pegr]

Originally Posted by rcdailey

Those who don't pay for MBAM won't have the problem, so far as I know.

I only use the free version of MBAM but when I trialled NOD32 5.0.95.0 recently, my Windows XP SP3 system froze the moment I connected my external USB HD and tried to access it. (I uninstalled WSA first before installing NOD32 just to eliminate any possibility of a conflict.)

[wolliballa]

@ acooldozen:
I pretty sure you will not see this problem on YOUR W7-machine as it is reported currently on XP SP3- Systems only.
But thanks for co-reading.

[rcdailey]

Originally Posted by acooldozen

I don't believe there is a conflict there at all. I have both running at boot on 2 machines. I have upgraded each time with no difficulties.Version 5.0.95.0 and MBAM 1.61.0.1400 and am not experiencing any such problems. YET!
Acer Netbook, Windows7 Ultimate and,
Toshiba Notebook Windows7 Home Premium

I should have been more explicit. The conflict seems to exist only in XP. That's where people noticed it. People who have Win 7 and even Vista do not seem to have this issue. However, it definitely happens in XP and it has something to do with the way both Eset and MBAM check drives. This doesn't happen if the MBAM service is not loaded in XP (which is the case with unpaid versions). My guess would be that there is a difference between XP and Vista and Win 7 when it comes to external USB drives. Would that be a big surprise?

[wolliballa]

As this thread has become already a bit lengthy:
Currently it's XPSP3 only and it's not just MBAM but also other installed software like InCD which might result in conflicts and producing the problem.
E.g. for me replacing the InCD application with the newst version fixed the problem..... ( and I never had MBAM installed )

[rcdailey]

Originally Posted by pegr

I only use the free version of MBAM but when I trialled NOD32 5.0.95.0 recently, my Windows XP SP3 system froze the moment I connected my external USB HD and tried to access it. (I uninstalled WSA first before installing NOD32 just to eliminate any possibility of a conflict.)

It does seem to have something to do with NOD32 accessing the USB drive at boot and maybe some other application doing the same thing. On my sytem, it was the MBAM service, but maybe there are other services or applications that could cause the same problem in XP. Good luck finding what it is. The best work-around that I found (before I identified my conflict) was to connect the drive when the system was shut down and then when I wanted to disconnect the drive, I would shut down the system before that. Connecting while the system was up would cause a freeze.

[pegr]

Originally Posted by rcdailey

It does seem to have something to do with NOD32 accessing the USB drive at boot and maybe some other application doing the same thing. On my sytem, it was the MBAM service, but maybe there are other services or applications that could cause the same problem in XP. Good luck finding what it is. The best work-around that I found (before I identified my conflict) was to connect the drive when the system was shut down and then when I wanted to disconnect the drive, I would shut down the system before that. Connecting while the system was up would cause a freeze.

I suspected that it might be a conflict with another application that is causing the problem but as I was only trialling NOD32, I didn't feel inclined to start uninstalling other applications to try to find the cause. The most likely candidate for a conflict would be AppGuard which does have issue with some AVs on Windows XP (but not on Windows 7).

In any case, even if it were a conflict between NOD32 and AppGuard, I wouldn't uninstall AppGuard just to be able to run NOD32. Any AV I install has to coexist with AppGuard or it doesn't stay. I did try shutting down the system before connecting the USB drive but that didn't work in my case.

Thanks anyway for the helpful suggestions.

Regards

[rcdailey]

Originally Posted by pegr

I suspected that it might be a conflict with another application that is causing the problem but as I was only trialling NOD32, I didn't feel inclined to start uninstalling other applications to try to find the cause. The most likely candidate for a conflict would be AppGuard which does have issue with some AVs on Windows XP (but not on Windows 7).

In any case, even if it were a conflict between NOD32 and AppGuard, I wouldn't uninstall AppGuard just to be able to run NOD32. Any AV I install has to coexist with AppGuard or it doesn't stay. I did try shutting down the system before connecting the USB drive but that didn't work in my case.

Thanks anyway for the helpful suggestions.

Regards

I understand. Besides, any work-around is not really a solution, so you are no doubt best off finding an AV that does not conflict with AppGuard.

[RobertS]

I too am experiencing a "freezing" of my XP SP3 system when I plug in a 1TB 2.5" fixed disk.
When I attach the device my PC fails to display the new disk on the My Computer window and all programs and Windows become unresponsive.

I am still able to move the mouse pointer around okay.

I currently have NOD32 v5.0.95.0 and Outpost Firewall Pro ver. 7.5.2 installed on my machine.
After connecting my USB HDD and waiting until the system became unresponsive I generated a full memory crash dump using the PS/2 keyboard driver method described in this thread.

I loaded the crash dump into WinDbg to see what I could learn. WinDbg unsurprisingly points to the PS/2 keyboard
driver i8042prt.sys as the cause of the BSOD. I looked through all the the loaded device drivers to see if I could
identify any potential suspects. The SandBox.sys driver as used by Outpost was the only driver I could identify as I recall it was mentioned here.
I renamed the the driver in safe mode as suggested and rebooted my PC and reattached the external HDD only to observe the same symptoms as before.

I discovered that if I reboot my machine then exit and shutdown the Outpost firewall service I am able to successfully
mount my HDD. I can the restart Outpost and continue use without any further problems.
I also tried disabling the "removable media protection" setting in Outpost to no effect.

I was unable find any reports of this fault on any of the Outpost support forums.

So I am left asking myself where does the fault lie and how do I fix it?

Thank you for any assistance you can give me in resolving this.

Kind regards,
Robert.

[wolliballa]

As stated in the description how to generate a dump willingly, having the keyboard driver on top of the queue would be expected as normal because the keyboard input is triggering taking the dump...
This symtom is to be seen on every dump taken manually following that procedure..............

[RobertS]

Yes, I do realise this wolliballa.

[Marcos]

Agnitum Outpost Firewall is known to cause lockups due to the fact that its driver calls a function that calls MountMgr when ESET is scanning files which results in a lockup. We had to avoid calling such functions for the very same reasons in the past.

[RobertS]

Thank you Marcos, I will contact Agnitum support to raise a ticket on this issue.

[RobertS]

I have now contacted Agnitum support about this and await their reply.

I've just discovered that I can mount the truecrypt, snapshot and Paragon HDM Pro volumes without generating the fault condition. Can anyone offer an explanation why this is the case please?

Thank you,
Robert.

[murtuzabarodawala]

I had found the solution for this problem
For solution kindly contact the respected vendor for eset in your country they will give u one file which has to be replaced.
Thanks...