NOD 32 5.0.93.0 & 5.0.94.0:PC freezes when USB HD is connected

[Wathen]

Originally Posted by Cruachan

Hi Marcos,

You never did get back to me, as promised, regarding the findings in my complete memory dump. I refer you to your PM response on June 21st when you stated:

"As soon as I hear from the devs about the memory dump you've provided, I'll update you."

Currently I'm in conversation with Raxco. They have been able to reproduce the problem, but seem skeptical about 'Perfect Disk' being the cause.

Rather than advising us all to rename files or uninstall valuable software, wouldn't it be more helpful if ESET opened a dialogue between all those 3rd party's who seem to be implicated with this conflict?

Can't help but wonder whether there is more to this than we are being told.

Regards,

Mike

I agree - ESET should be in contact with these 3rd party software mfg's to fix the issue. I find it hard to believe that they are at fault, when we never had an issue with their software before. This also explains why I'm rolling back to version 4. Never had an issue with this version on my XP machine.

[wolliballa]

Have you ever tried to switch to 5.2.9.12 as my problems fully disappeared so far on all 3 affected (different ) systems ?

[Wathen]

Originally Posted by wolliballa

Have you ever tried to switch to 5.2.9.12 as my problems fully disappeared so far on all 3 affected (different ) systems ?

Yes with the same issue, but you're probably not using XP right? Last night I removed version 5 and went back to version 4 which works great.

[wolliballa]

Yes, all my PCs were running XP SP3 ( different flavours Home, Prof, Media ).
One had an old version of InCD, replacing it by the latest version fixed the problem for that machine, all others are running without hangs since 5.2.9.12

[JReese]

Just thought I would throw my few cents in on this topic after about 4 hours of troubleshooting on a system...

Working on a customers system at their shop (graphics design business); a Dell Precision 390 running Windows XP SP3 and was experiencing these same symptoms. Any external USB hard drive or flash drive inserted would lock up Windows Explorer completely. Looking at the Task Manager I would see "services.exe" hitting the processor steady at 50 to 70 percent and I would need to hard boot the system to get back to a usable Windows Explorer.

If I leave the USB hard drive/flash drive plugged in Windows Explorer would show it as available but as soon as you try to open the drive Windows Explorer would lock up again and services.exe would pound the processor again causing another hard boot.

Like others I stumbeld onto this post a few pages into Google and started reading hoping there would be a solution at the end - but the only solution for me was to go back to v4.2.71.2.

I upgraded this system to v5.2.9.1 only a few weeks ago and somehow the issue wasn't seen until now. Malwarebytes was on the system (free version) but uninstalling it didn't help the situation. My next attempt was to disable the removable media check within NOD32 v5 but that didn't help either. Uninstalled NOD32 completely and the USB devices worked like normal. Installed v4.2.71.2 and everything is working fine again.

I'm not sure what the "fix" was in v5.2.9.1 but this issue clearly isn't corrected yet.

[Marcos]

Originally Posted by JReese

I upgraded this system to v5.2.9.1 only a few weeks ago and somehow the issue wasn't seen until now. Malwarebytes was on the system (free version) but uninstalling it didn't help the situation. My next attempt was to disable the removable media check within NOD32 v5 but that didn't help either. Uninstalled NOD32 completely and the USB devices worked like normal. Installed v4.2.71.2 and everything is working fine again.

Please generate a kernel or complete memory dump manually at the point the system locks up, compress it, upload it somewhere and pm me the download link. The dump should help us determine the problematic software / driver responsible for the lockup when installed in conjunction with v5. Also I'd like you bring this thread with a list of known problematic software causing lockups into your attention.

[JRCATES]

Originally Posted by JReese

Just thought I would throw my few cents in on this topic after about 4 hours of troubleshooting on a system...

Working on a customers system at their shop (graphics design business); a Dell Precision 390 running Windows XP SP3 and was experiencing these same symptoms. Any external USB hard drive or flash drive inserted would lock up Windows Explorer completely. Looking at the Task Manager I would see "services.exe" hitting the processor steady at 50 to 70 percent and I would need to hard boot the system to get back to a usable Windows Explorer.

If I leave the USB hard drive/flash drive plugged in Windows Explorer would show it as available but as soon as you try to open the drive Windows Explorer would lock up again and services.exe would pound the processor again causing another hard boot.

Like others I stumbeld onto this post a few pages into Google and started reading hoping there would be a solution at the end - but the only solution for me was to go back to v4.2.71.2.

I upgraded this system to v5.2.9.1 only a few weeks ago and somehow the issue wasn't seen until now. Malwarebytes was on the system (free version) but uninstalling it didn't help the situation. My next attempt was to disable the removable media check within NOD32 v5 but that didn't help either. Uninstalled NOD32 completely and the USB devices worked like normal. Installed v4.2.71.2 and everything is working fine again.

I'm not sure what the "fix" was in v5.2.9.1 but this issue clearly isn't corrected yet.

So it sounds as though this problem with version 5 still exists.....I wonder:


A) how many people are still using version 4 compared to version 5 (and is it because of issues like this one)?

B) when is version 6 expected to be released, and has a resolution for this issue (and other bugs in v. 5) been worked on/fixed in the upcoming v. 6?

[Marcos]

Originally Posted by JRCATES

B) when is version 6 expected to be released, and has a resolution for this issue (and other bugs in v. 5) been worked on/fixed in the upcoming v. 6?

I've clearly stated several times already that a fix must be done on the 3rd party vendor's side. The same problem was with PerfectDisk by Raxco. We as well as some other users contacted their support and they eventually admitted they were going to fix this in the next build of their software (driver).

[JRCATES]

Originally Posted by Marcos

I've clearly stated several times already that a fix must be done on the 3rd party vendor's side. The same problem was with PerfectDisk by Raxco. We as well as some other users contacted their support and they eventually admitted they were going to fix this in the next build of their software (driver).

That sounds good and would be perfectly acceptable, Marcos....except that users aren't reporting encountering this problem when using VERSION 4 of ESET NOD32, but they ARE when using VERSION 5! So that sounds as though it is a problem on ESET's side.

[Marcos]

Originally Posted by JRCATES

That sounds good and would be perfectly acceptable, Marcos....except that users aren't reporting encountering this problem when using VERSION 4 of ESET NOD32, but they ARE when using VERSION 5! So that sounds as though it is a problem on ESET's side.

When an issue occurs only with ESET products installed, it does not necessary mean that ESET is the culprit. There have been many cases when it turned out that ESET worked just as a catalyst for bugs in 3rd party software. It's been confirmed by analyzing memory dumps that this particular issue lies in 3rd party drivers which access Mount Manager functions when they shouldn't. MM on Windows XP is very sensitive to this, hence the issue occurs mainly on this OS.

[armadillo33]

Originally Posted by Marcos

When an issue occurs only with ESET products installed, it does not necessary mean that ESET is the culprit. There have been many cases when it turned out that ESET worked just as a catalyst for bugs in 3rd party software. It's been confirmed by analyzing memory dumps that this particular issue lies in 3rd party drivers which access Mount Manager functions when they shouldn't. MM on Windows XP is very sensitive to this, hence the issue occurs mainly on this OS.

I fully understand that the 3rd party software is buggy. But it would be very useful for a user to be able to "turn off" whatever is acting as a "catalyst" in ESET v5 which was not present in v4. From what you say, perhaps ESET 5 is accessing or monitoring MM functions (correctly) which v4 was not accessing at all. If a user could disable the ESET features which access those functions, it could provide a temporary "fix" in some circumstances.

It might be the case that the 3rd party "buggy" software is essential for the user. The user cannot work at all without that software. Until the 3rd party vendor fixes the bugs, the user therefore has no choice but to uninstall ESET or revert to an earlier version of ESET. And the 3rd party vendor might no longer be supporting their product at all. It would seem preferable to enable the user to switch off additional functionality in ESET as a workaround if this is technically possible. Certainly, this might reduce the protection provided by ESET; but uninstalling ESET would reduce protection considerably more.

I would add that NOD32 5.2.9.1 is working perfectly for me in XP SP3 with external USB drives but I somewhat dread what might happen if I ever choose to try v6. Additional features which require all 3rd party software to be perfect can be more of a trouble than a benefit.

[Marcos]

I think that disabling real-time protection driver from starting automatically would also prevent the issue from occuring but obviously this is not an option due to security reasons. If v5.2 has been working fine for you, v6 should do as well. Of course, after the first release more bugs may be reported as many more people will install it on various system configurations which cannot be simulated in a testing environment before the release, however, such potential issues are addressed quickly in a subsequent service build.

[Nerius]

I've contacted support, but haven't got any answer on this problem.
I tried everything mentioned here in the thread, but still complete freeze at desktop for me. Using ESS v 5.2.9.1 and XP Pro SP3. Same problem with ESS v6 RC. Had to continue use v4 'till this is fixed. v 4.2.71.2 works perfect.

I've tried generate a complete memory dump, but nothing gets created.
(I've tried the reg post posted here too)
I don't have any of the drivers or software installed mentioned in
http://www.wilderssecurity.com/showthread.php?t=319192

Im using USB 3.0 Flashdrives.
Same problem with any USB flashdrive 2.0 or 3.0 drives connected.

Help would be appreciated since i would like to use ESS v5.
(and 6 when it comes)

[armadillo33]

Originally Posted by Nerius

I've tried generate a complete memory dump, but nothing gets created.

I suppose you are using the correct CTRL key on the keyboard? It only works with Right CTRL + scroll lock twice. Left CTRL does not have the same effect.

[Nerius]

Originally Posted by armadillo33

I suppose you are using the correct CTRL key on the keyboard? It only works with Right CTRL + scroll lock twice. Left CTRL does not have the same effect.

I had the pagefile disabled so no dump was created.
I suspect what it is causing my freeze problem, the fix for making USB local drives instead of removable as described here:
http://www.getusb.info/usb-hack-turn...or-local-disk/

Anyone else using this trick, and or having problem with v5 (and v6) with these drivers installed along with ESS 5?
it seems its that Hitachi usb filter driver that is causing the complete freeze with my ESS v5 and v6 rc.

Its working perfect though with ESS v4.

[armadillo33]

Originally Posted by Nerius

I had the pagefile disabled so no dump was created...
it seems its that Hitachi usb filter driver that is causing the complete freeze with my ESS v5 and v6 rc.

Its working perfect though with ESS v4.

ESET will be able to confirm your suspicion once you can get a dump but they will not help you until you can do that.

If it is confirmed, they will be unlikely to alter ESS to work with that driver but they may offer Hitachi advice to alter the Hitachi driver.

In the meantime, you may wish to try uninstalling or renaming the Hitachi driver to see if the freeze problem is caused by it.

v5 interacts with drivers differently from v4. ESET indicate that this provides additional security so it is unlikely that they will ever revert to how v4 operated. v5 is more sensitive to "faulty" 3rd party drivers, of which there seem to be many.

[Marcos]

If the system isn't locked up completely and is only sluggish, it's possible to trigger a crash manually using a special tool.

[jeffw_00]

I had this problem, and went back to 4.2, but somehow I upgraded at some point to 5.0.95, and the problem stayed away, except that it still hangs the very first time it is presented with an external USB drive it has never seen before. I can live with this.

Question - what is the risk that the problem will get worse if I upgrade to the newest engine (5.2.9.1)?

thanks
/j

[wolliballa]

There are good chances that the problems are gone at all. At least with me I did no longer discover any problems once upgraded...........

[Nerius]

Thanks for the replies. I don't think Hitachi will update this pretty old driver.
Since i haven't found any other solution then using this usb driver to make them local/fixed disks,
im forced to use this driver.
So im out of luck then, and guess i have to start looking for another antivirus/firewall vendor solution, or continue to use v4.

Thats too bad not be able to upgrade since i like eset and been using it for many years.
or i just have to stay with v4 all the time.

Is v4 still good/enough protection?

Thanks for the info and replies.

[mouser]

It boggles my mind that Eset really cannot be bothered to come up with a solution to this problem, or at the very least provide some way of identifying the conflicting driver other than to make us set up our computers for full memory dumps on crash and then email these dumps to someone for analysis..

The absolute very least Eset could do is provide some kind of utility to identify what other driver is conflicting with it.

Up until this bug I was a huge fan of Eset.. Now the picture in my mind is of a company that doesn't really give a darn about their users..

[jngreen]

Originally Posted by mouser

It boggles my mind that Eset really cannot be bothered to come up with a solution to this problem, or at the very least provide some way of identifying the conflicting driver other than to make us set up our computers for full memory dumps on crash and then email these dumps to someone for analysis..

The absolute very least Eset could do is provide some kind of utility to identify what other driver is conflicting with it.

Up until this bug I was a huge fan of Eset.. Now the picture in my mind is of a company that doesn't really give a darn about their users..

I couldn't agree more. There are many viable antivirus options out there. E.g. Norton and Avira both have very small footprints and are highly rated. Neither have this very serious bug. I'm done with ESET.

[peramitic]

Originally Posted by Marcos

Ok, I'll send you more information momentarily. The PM system doesn't work for you because of your status "Infrequent Poster" but it will become activated once I PM you.

Hi Marcos, could you send me more information too. I tried to send you a PM, but as a new member I'm still not allowed to
Thanks in advance.

[mouser]

For anyone wondering if Eset has fixed the problem with the new version 6, the answer is no.

This problem still exists, exactly as it did 8 months ago. Plug in external drive, system hangs.

[Marcos]

Originally Posted by mouser

For anyone wondering if Eset has fixed the problem with the new version 6, the answer is no.
This problem still exists, exactly as it did 8 months ago. Plug in external drive, system hangs.

Please check if you have any of the software mentioned in this thread installed. In that case, you must ask its vendor for a fix as the problem is not on ESET's part in that case.