NOD32 AV v5.0.95.0 - ekrn.exe maxes out one core, stops all I/O, freezes system

[webyourbusiness]

restart the computer daily to reset the RAM - this will hold you until the eset development team get a hotfix out to us. As long as the RAM usage is less than 1Gb, I thnik we should be OK! > 1.5Gb there are risks of failure of the operating system it seems.

[ocenter12]

I've also had similar problem like cascara. ekrn.exe has gone from 70mb to 150mb within minutes of rebooting the system. After a 4 hours it was at 780mb!! This system is an htpc and only the boot drive (SSD) is on realtime protection and the other media drives are excluded from all protection. I have used Nod32 for years and this the first time it has done this. I've done uninstall and clean installs and now I'm back to no AV on the system. Any help would be great thanks


My Specs
Win7 x64
Crucial m4 SSD OS
2x 3TB (Media)
HD6850

[Marcos]

Originally Posted by ocenter12

I've also had similar problem like cascara. ekrn.exe has gone from 70mb to 150mb within minutes of rebooting the system. After a 4 hours it was at 780mb!! This system is an htpc and only the boot drive (SSD) is on realtime protection and the other media drives are excluded from all protection. I have used Nod32 for years and this the first time it has done this. I've done uninstall and clean installs and now I'm back to no AV on the system. Any help would be great thanks

What version of the product you use? The issue should affect only v. 5.2 and Endpoint under certain circumstances but not the older v. 5.0 or 4.2.

[ocenter12]

I was using the latest version of v5. I even thought of trying beta 6 to see if maybe that would help, but I'll keep checking this forum and nod32 official site to see if there is an update that fixes this.

[BALTAGY]

Originally Posted by Marcos

What version of the product you use? The issue should affect only v. 5.2 and Endpoint under certain circumstances but not the older v. 5.0 or 4.2.

The issue in all v5.x not only v5.2, but not in v4.x or v3.x

i hope to know when the fix will be release?

[Marcos]

Originally Posted by BALTAGY

The issue in all v5.x not only v5.2, but not in v4.x or v3.x
i hope to know when the fix will be release?

Check the number of active connections. We've seen cases where numerous connections weren't closed due to a bug in Windows Filtering Platform which caused ekrn not to release objects from memory.

[BALTAGY]

Originally Posted by Marcos

Check the number of active connections. We've seen cases where numerous connections weren't closed due to a bug in Windows Filtering Platform which caused ekrn not to release objects from memory.

if this problem from Windows Filtering so why v4.x doesn't cause this problem?!

and if this problem from Windows Filtering what about that fix you told me about in this post:

http://www.wilderssecurity.com/showthread.php?t=324961

Note:
1- i just talking here about memory leak problem
2- i tried all versions of antivirus or smart security from v3.x to v5.x and this problem exist on v5.x only

[Marcos]

Ok, I admit I misread your post. If it concerns v. 5.2 or Endpoint but not v. 5.0 or older versions, this issue will be fixed shortly in a service build of the affected products.

[rcdailey]

Originally Posted by webyourbusiness

restart the computer daily to reset the RAM - this will hold you until the eset development team get a hotfix out to us. As long as the RAM usage is less than 1Gb, I thnik we should be OK! > 1.5Gb there are risks of failure of the operating system it seems.

I've been running 6.0.11.0 beta for a while and I believe I have observed the spike in memory usage during and after a sig update. I have been shutting down each day when I leave and take my backup drive with me. So, when I start up again, memory usage is in the 85-95 MB range. This is with XP SP3. I did not see NOD32 release the memory after a sig update, which I think would be the best of all possible worlds. Restarting, of course, does release the memory. Memory usage did not get out of control when it spiked. It stabilized at about 330MB. I have 2GB RAM, so that is not a problem, so long as it stays at that level.

I have had the system running for a few hours now and it has not gone up from 95MB, yet. However, there has not been a sig update during this session, either. I did a manual check for updates a couple of times with no significant change in the memory footprint.

OK, NOD32 just did a sig update and now the memory usage is at 155MB. The memory hasn't be released, so it seems to remain allocated after the sig update. Since SuperAntiSpyware is running a scan, I'm going to wait to see what happens after that completes. SAS is using about 300MB during its scan.

Well, the footprint for NOD32 is now just under 160MB and doesn't appear to be releasing. This is after the actual sig update, and the completion of the SAS scan. SAS is back down under 2MB usage. Oh, I should state that the memory usage I report for NOD32 is for ekrn.exe. The egui.exe process is under 2MB consistently, so that seems to be negligible. Correction, I see that egui.exe has gone up to 5504K, so maybe that is not negligible after all.

Temporarily disabling protection doesn't release the memory, but that is because the kernel is not unloaded just because protection is disabled temporarily. Memory usage for ekrn.exe is remaining at just under 160MB.

[tajkkj]

I too am seeing ekrn.exe continuously grow without limit. In working with ESET support, and on their advice, I discovered that one of the programs which was always started on login, RoxioBurnLauncher.exe, was the problem. I'm running Win 7, SP1, patches up-to-date, 64 bit, and using Nod32 5.2.9.1.