100% CPU Usage

[Chris Childerhose]

I am having the same issue but with the latest version 3.0.657 and I just sent a Filemon log to ESET to have them check it out.

My system just locked up due to the EKRN.EXE file using up most of my CPU power. I have a Thinkpad T61 laptop running Windows XP SP3 with 3GB of RAM and a Core Duo T7250. It uses up most of the CPU and when you kill the ekrn.exe process it frees up for a few seconds then starts scanning again.

I had to delete some files that ESET itself was creating in the C:\Windows\Temp directory before it finally stopped scanning and allowed me to work on my system.

This needs to be addressed otherwise I may need to revert back to 2.7 for now.

[cosmon]

Hi all,

New update on this issue. After deleting a windows install related folder that was left on c:\, i was able to start eset and the update service without any instability.

My guess is that ekrn.exe and the "Automatic update service" were in some race condition.

Best regards,
Pedro

[Bakker]

Found another issue for ekrn.exe raping my cpu on another computer it was running on. Appearantly every few minutes it scans a log file (.htm file) of an application called Hostmonitor 4.86, its logfile was aproximately 90MB and it took about 2 minutes to scan it while ekrn.exe ran at 99%.

*This also solved the issues of it hanging for 2 minutes when it started up, logs have been deleted and logging disabled for now.

[cosmon]

Hi all,

I have been reading about this kind of issue. "High CPU and Windows Update".

It looks like the best way to avoid it is to exclude windows update folders. ALso regarding scan on big files, i think the better way is to exclude them. Can NOD exclude files based on it's size?

Regards

Pedro

[Marcos]

Originally Posted by Bakker

Found another issue for ekrn.exe raping my cpu on another computer it was running on. Appearantly every few minutes it scans a log file (.htm file) of an application called Hostmonitor 4.86, its logfile was aproximately 90MB and it took about 2 minutes to scan it while ekrn.exe ran at 99%.

*This also solved the issues of it hanging for 2 minutes when it started up, logs have been deleted and logging disabled for now.

There will be a quite big improvement in this regard in the new version we're working on.

[Marcos]

Originally Posted by Bakker

Found another issue for ekrn.exe raping my cpu on another computer it was running on. Appearantly every few minutes it scans a log file (.htm file) of an application called Hostmonitor 4.86, its logfile was aproximately 90MB and it took about 2 minutes to scan it while ekrn.exe ran at 99%.

*This also solved the issues of it hanging for 2 minutes when it started up, logs have been deleted and logging disabled for now.

There will be an improvement in scanning large files in the new version we're working on.

[Bakker]

Thank you Macros,

Is there any word on when this new version will be released. Will this new version also contain fixes for (some of) the 100% cpu problems people are having?

[Canuck21]

I have the same issue except that the CPU usage is around 50%, but the real effect is similar to 100% because my computer is completely paralyzed for 5 minutes each time. Around one or two minutes after startup, that's when the freezing starts and it is extremely annoying.

I am surprised that ESET hasn't said much about this problem and I am very disappointed at this attitude--I feel like I'm left to my own devices. If this issue isn't corrected soon, I'll have no choice but to look for another anti-virus program.

[piranha]

Originally Posted by Canuck21

I have the same issue except that the CPU usage is around 50%, but the real effect is similar to 100% because my computer is completely paralyzed for 5 minutes each time. Around one or two minutes after startup, that's when the freezing starts and it is extremely annoying.

I am surprised that ESET hasn't said much about this problem and I am very disappointed at this attitude--I feel like I'm left to my own devices. If this issue isn't corrected soon, I'll have no choice but to look for another anti-virus program.

Just downgrade back to v2.7 and wait for a fix for this v3 bug. v2.7 is almost perfect, that is a good choice ! Marcos announce a big improvment soon so..........be patient. You will be well protect for no more cost.

[incubabe]

im having issues with my pc at home .. (thank god for laptops) anyhow i downloaded the program and now when my computer starts up and the program loads my computer totally slows down and goes to 100 percent usage. only way to keep it down is to beat the program from loading and go to my task manager and end processes. Since im not so computer saavy im wondering if ive downloaded a F'd up version and am wondering if theres somethign i can do or somehwere i can go to fix this problem i got as far as trying to remove it from my control panel but when it was removing it self it froze AGAIN.

Can any one help or offer suggestions?

[zer0l0gic]

Originally Posted by Marcos

There will be an improvement in scanning large files in the new version we're working on.

That sounds really exciting Marcos.

Although my NOD32 has been running flawlessly.

[Noddy32]

There is really a big problem found today with 3.0.657 that my PC freezes when i do a file search on the disk.. ekrn is eating up everthing then..

Hope the new version is released soon :-)

[wrathchild]

I have 100% CPU usage too (from time to time)...from the first "final" version.

Originally Posted by Noddy32

Hope the new version is released soon :-)

I hope the new version will be released when ready and will be bugs free...I don't wish another beta. Until then I've switched to another AV (because I don't wish to downgrade)...btw I've been NOD32 user for years.
Cheers.

[Marcos]

Originally Posted by Noddy32

There is really a big problem found today with 3.0.657 that my PC freezes when i do a file search on the disk.. ekrn is eating up everthing then..

Hope the new version is released soon :-)

Just to make sure, do you have these options disabled in the real-time protection setup?

[Michael Moye]

I'm running an evaluation version (3.0.65.0) in a clean install of Win.XP Service Pack 3 and don't have any high CPU usage.

Admittedly there's a jump upon copying/moving/deleting some .EXE files but I
do have all settings (heuristics etc.) enabled.

In fact it's an improvement over the on-demand scan of version 2.7 in that there isn't any lag of the initial 'memory scan'.

ekrn.exe is currently at 0% usage!

Mike.

[yan]

Same problem. See a possible solution: http://ask-leo.com/how_do_i_fix_this...ver_it_is.html
At least this batch file works for me:

net stop "Automatic Updates"
del /f /s /q %windir%\SoftwareDistribution\*.*
net start "Automatic Updates"
wuauclt.exe /detectnow

[Marcos]

Originally Posted by yan

Same problem. See a possible solution: http://ask-leo.com/how_do_i_fix_this...ver_it_is.html
At least this batch file works for me:

net stop "Automatic Updates"
del /f /s /q %windir%\SoftwareDistribution\*.*
net start "Automatic Updates"
wuauclt.exe /detectnow

Yes, this problem is not related to ESS/EAV. If you are having this problem, you'll see ekrn taking 100% of cpu usage because the traffic from svchost.exe is redirected through it. If you uninstall ESS/EAV, you should see svchost.exe taking 100% of cpu usage.

[yan]

Originally Posted by Marcos

Yes, this problem is not related to ESS/EAV. If you are having this problem, you'll see ekrn taking 100% of cpu usage because the traffic from svchost.exe is redirected through it. If you uninstall ESS/EAV, you should see svchost.exe taking 100% of cpu usage.

Yes, it is not related per se. But as you told, the traffic is redirected to ekrn.exe. I think that is why fixing Windows Automatic Updates solved the discussed problem on my computers. I had two of 30 machines which I could not update. And both had ekrn.exe consuming 99% of CPU.

[Bakker]

Originally Posted by yan

Yes, it is not related per se. But as you told, the traffic is redirected to ekrn.exe. I think that is why fixing Windows Automatic Updates solved the discussed problem on my computers. I had two of 30 machines which I could not update. And both had ekrn.exe consuming 99% of CPU.

But that doesn't explain why svchost.exe wasn't consuming 99% cpu before NOD32 was installed. NOD32 being installed obviously triggered something. All my machines ran fine with McAfee 8.5.0i installed.

[Marcos]

Originally Posted by Bakker

But that doesn't explain why svchost.exe wasn't consuming 99% cpu before NOD32 was installed. NOD32 being installed obviously triggered something. All my machines ran fine with McAfee 8.5.0i installed.

Could you please set the web access and real-time protection to scan only files with default extensions instead of all files to see if that makes a difference?

[Bakker]

I won't be at work for another 2 weeks, and all the computer's i've come across so far have been 'fixed' or have either had a 2.7 install. If i do come across another system with these errors i'll try to change that.

But wouldn't disabling scanning for 'non default' extentions mean that i'm less protected?

[naknak]

ekrn.exe occupies 100% of the CPU every time I start any CAD programs, thus halting the PC. However, any program would start within a 1sec when the ekrn.exe is shut down. the NOD32V3 settings are all checked. Any ideas? Thanks

[Marcos]

Originally Posted by naknak

ekrn.exe occupies 100% of the CPU every time I start any CAD programs, thus halting the PC. However, any program would start within a 1sec when the ekrn.exe is shut down. the NOD32V3 settings are all checked. Any ideas? Thanks

Couldn't it be that you enabled advanced heuristics and (or) runtime packers on access in the real-time protection setup? They are enabled by default only for newly created file because emulation is a time consuming operation and enabling these options might slow down the system performance.

[newcoventry]

Here is the situation:
We have 1250 Laptops running Windows XP SP3, ThinkPad R61, Running the entire ThinkVantage solution package.
We have used NOD for years and have just upgraded to version 3.0.642.0 on our default image. I have installed the latest release on a machine and found no improvement in the below situation.

We have experienced massive slowness caused by EKRN.EXE. On many of our systems ekrn.exe is consuming 50% of CPU. Disabling Real Time File System Protection caused ekrn.exe to go down to 0%.

The temporary (I Hope) solution is:
Go to Start> All Programs> ESET> ESET NOD32 Antivirus> ESET NOD32 Antivirus

Select the Setup Menu option on the left.
Select Antivirus and Spyware Protection link in the main portion of the window
Under Real-time file system protection select Edit exclusions...
Select Add... in the main portion of the window
Browse through: My Computer> C:\> Program Files
Select the ThinkPad folder
Click OK

Now ekrn goes down to 0% of processor usage.

I believe the issue is that the ThinkVantage Access Connections services that run on boot are unknown to NOD32 these programs could appear to be suspicious because ThinkVantage Access Connections has a portion of it that will change network settings based on which Access Point or Ethernet Port you connect to. I suppose this could be deemed suspicious.
My hope is that ESET would find a solution that does not require me to visit our 300 most recent users and edit these settings at their desks.

[naknak]

Originally Posted by Marco
Couldn't it be that you enabled advanced heuristics and (or) runtime packers on access in the real-time protection setup? They are enabled by default only for newly created file because emulation is a time consuming operation and enabling these options might slow down the system performance.

I made sure that the advanced heuristics and runtime packers on access in the real-time protection setup were disabled. As soon as I start my CAD application ekrn.exe takes 100% of CPU and my PC freezes for at least 5-7 minutes until ekrn.exe release some of the CPU resources, and eventually goes down to 0%. Should I open another instance of the same app, everything repeats. I already tested this on two CAD workstations having the NOD32V3 installed and both had the same results. Please help...Thanks