"This device is currently in use" message after NOD32 6.0 upgrade

[segalsegal]

I upgraded 4 computers from NOD32 version 5 to version 6 and now whenever I try to eject a flash drive I get on the first try the message "This device is currently in use. Close any programs or windows that might be using the device, and then try again", even if no programs or windows are using the flash drive. On the second try, it works and I get the "Safe to remove hardware" message. I have all the settings in "Advanced Setup | Computer | Removable media" unchecked.

Is this a known bug? Is there a workaround?

[Janus]

Hey segalsegal

For what it's worth, no I have not experience any issue regarding that you describe in your post, with version 6x. (but then again I always have the habit to disconnect external drives after some time 15-20 s, to give the system some time to release the usb ). It can sometimes be hard to figure out what or which process is holding a handle on the device/usb. Maby Process Explorer can show what is holding on to your usb drive(s).

Regards, Janus :-)

[segalsegal]

I have noted many instances in which waiting several minutes does not result in avoiding the "device is currently in use" message. However, the second time I try to eject it always works, even if done seconds after the "device is currently in use" message.

I don't see anything obvious as causing the problem using Process Explorer, but I may not be noticing something non-obvious.

[Marcos]

Does the issue occur with any flash drive or with a specific one only? Does it occur always or intermittently? If you have more computers, is it happening on all of them?

[segalsegal]

It occurs with all flash drives, and all the 4 computers upgraded to NOD32 version 6. There are times when I'm testing and I put in a flash drive and try to eject it without file writing and I don't get the "currently in use" message, but when I've done file writing I get the message, even if I closed all Windows Explorer windows many minutes before trying to eject.

[tomazyk]

I have the same problem. I never thought it was related to Nod32, but now that you mentioned it, I think it started to happen after I installed v. 6.
I have the same symptoms and I also have USB scanning disabled. I always have to perform "safely remove device" twice. First time is "in use", second time (a second later) it can be removed normally. It happens on different USB drives attached.
My System is Win7 x64 and I use Nod32 6.0.306.

[layman]

Originally Posted by Marcos

Does the issue occur with any flash drive or with a specific one only? Does it occur always or intermittently? If you have more computers, is it happening on all of them?

I'm seeing the same issue on Windows 7, but it doesn't seem to occur on XP.

[rockshox]

FYI - I have this issue also on my Windows 8 x64 computer. I had seen it a couple times and just assumed it was a Windows issue as things are quite often still "open" in Explorer long after they are finished. As other's have mentioned though, if you immediately eject the USB disk a second time it ejects correctly with no messages.

[threepwood]

I can also reproduce this same behavior in all 3 of my PC's that I've got NOD32 v6 AV on. All of these are running Win 7 x64.

This even happens after inserting an empty USB flash drive and doing nothing with it and trying to eject it a few seconds later. Trying to eject it a second time seems to work in my case too.

[Niels]

Did you also went to advanced setup,computer,realtime file protection uncheck removable media access press on ok to save? You should also go to the removable media subsection of the computer section and uncheck action to take when inserting a removable media. By default a scan is being performed when inserting a removable disk.

[segalsegal]

In the regular part of setup (nonadvanced), under Computer, "Real-time file system protection" is enabled on my computers. The other choices are to disable it for various periods of time. I disable for particular times such as iOS updates or hard drive backups, but my impression is that this protection is supposed to be on. And if this setting does look at removable media despite all the settings in "Advanced Setup | Computer | Removable media" being unchecked, it is not the expected behavior to give you a "currently in use" message the first time you try to eject the drive but give you a "Safe to remove hardware" message the second time.

[segalsegal]

Marcos (or other ESET folks): have people at ESET been able to reproduce this problem? It sounds like it is affecting many people if we have collected several reports here "in the wild". However, the behavior may depend on other settings such as "Real-time file system protection" mentioned above so we could do some comparing and experimenting if ESET folks have been unable to reproduce the problem. If ESET has succeeded in reproducing the problem, it would be good to know when an update is available with a fix.

[Marcos]

I'm currently waiting for a response from the engineers. As soon as I have some news, I'll let you know.

[Phil_S]

Just to add a "me too". Only started after upgrade to v6. Win 8 x64 system.

[Marcos]

Please post more information about the flash drives you use. Maybe they're from the same vendor which is why the issue doesn't occur with other types / brands. Another possibility could be that you have something hardware-related in common, maybe the chipset or the computer vendor so more information about it might help us narrow it down to the common pattern as well.

[threepwood]

I can reproduce the same behavior on 4 different PC's : my home PC ,2 desktop PC's at work and 1 laptop from work too.

They contain different Intel chipsets: GM965, P55, P965

USB flash drives that are used have various brands and all are affected. All PC's running Windows 7 x64 and all of them have latest chipset drivers from Intel website installed.


For testing purposes, I've tried and succeeded to reproduce this on the following scenario: Fresh Windows boot -> Insert USB flash Drive and wait for about 30 seconds to 1 minute -> Try to eject flash drive and fail -> Try again to eject flash drive and succeed.

[Marcos]

You wrote:

Fresh Windows boot -> Insert USB flash Drive and wait for about 30 seconds to 1 minute -> Try to eject flash drive and fail -> Try again to eject flash drive and succeed.

Does the issue occur even if you leave the flash card connected for about 10 minutes?

[threepwood]

I've tried it now on a desktop with an USB that was connected about 2 hours ago and the first try it didn't eject, second try it ejected successfully. I did access the flash drive previously but had the caution to close all programs before trying to eject.

[segalsegal]

I've seen the problem with three different flash drives, one ancient one from MicroCenter, one ancient one from HP that they no longer make even though it was the most compact and sturdy flash drive I've ever found, and a more recent one from Staples.

Waiting 10 minutes doesn't prevent the problem, but I have found instances in which I don't get the "currently in use" problem. I haven't tried enough of the permutations to get it down to a 100% reliable protocol for no-problem instances since the problem occurs for me > 90% of the time and every time I've tried to find a no-problem case I've failed to find one. But I'd wonder about whether recent reading, writing, or presence of files on the drive makes a difference.

I know that the problem always occurs when the drive's Windows Explorer window is open, but that is the expected behavior. When I've done testing, I've made sure that all Windows Explorer windows are closed and Explorer.exe activity has quieted down in Process Explorer.

I haven't tried things like uninstalling or quitting Process Explorer.

There are lots of variables, but I see this very often on 4 different computers with 3 different flash drives, so unless there is something unusual about my configuration (e.g., using Process Explorer, Spybot or some other software) I'd have imagined it would be easy to reproduce this problem.

[Marcos]

I can't reproduce it on my home computer (Win7 x64, Asus P8Z77-V) with 2 different flash cards. Tried pluging them in both USB 2.0 and USB 3.0 ports and also tried different settings for scanning removable media.

[winchester73]

Have same issue with two SanDisk, one 4 gig, other 8 gig. Started once I upgraded to v6. "Safely remove" appears on second try to stop. Vista HP.

[PnP]

Me to have the same issue.. Windows 8 x64 with intel i7 chipset z68.. thanks

[segalsegal]

Originally Posted by Marcos

I can't reproduce it on my home computer (Win7 x64, Asus P8Z77-V) with 2 different flash cards. Tried pluging them in both USB 2.0 and USB 3.0 ports and also tried different settings for scanning removable media.

From the various reports it is clear that the problem is reproducible, but since the problem doesn't occur in some configurations, this becomes a matter of figuring out what the relevant configuration differences are.

If no one is experiencing the problem only on some flash drives and not others, it doesn't sound likely to be an issue of particular flash drive types.

If no one is experiencing the problem only on one version of Windows and not on another, it seems unlikely to be a Windows version issue.

There are of course other differences that could be relevant, such as other software installed, something that could be uniform for a particular individual. One could imagine that other software such as Spybot or Process Explorer could matter, but not that many people are likely to go around uninstalling such programs to gather data. If the engineers have some hypotheses we could ask people to report which software they use to look for a shared program.

Has anyone found the problem on one computer but not on another? Or with one flash drive and not another?

[segalsegal]

I forgot a flash drive overnight in a computer after using it to transfer a file to the computer and got the "currently in use" message when first trying to remove it, but it worked the second time. So it is not just a matter of letting the system have the time it needs.

On the other hand, I backed up 3 computers to external hard drives, and didn't get the "currently in use" message for any of them.

There are lots of potential variables here, such as whether it matters if you write to or from the drive, the exact type of drive, and so forth.

[gostan]

I'm encountering the same issue here on two different setups

1) A fresh installation of windows 7 ultimate x64 + eset smart security 6
2) A fresh installation of windows 8 pro x64 + eset smart security 6.

I didn't have this issue prior to the installation of the security suite.

I'm using a 8GB and a 16GB Sandisk USB drives here. after the installation of the smart security 6 suite, I would have to eject these drives twice (would get the "currently in use" message at the first attempt) before I could safely remove them.