100% CPU Usage

[lepicane]

Could somebody please post a link to the version of ESS before 667 (657, I think).

After upgrading to version 667 and using it for about a week ekrn.exe would go up to 100% when updating the virus definitions (nothing else installed in the meantime). Same thing with upgrade to 669, but from install.

Uninstalled 669, rebooted, deleted all ESET folders from C: and any reference to ESET in the registry, rebooted, clean install of 669 and same problem....cannot update as ekrn.exe is at 100% and update hangs. If I kill ekrn in the task manager, the update aborts and I can use ESS without a problem, well until I or it needs to update...

Thanks,

[lepicane]

UPDATE

For those that are experiencing this update problem AND have a mirror update folder set up, make sure you delete all the files in the mirror update folder before updating ESS 669.

Once I've done this, it updates without a problem and ekrn.exe is 'normal'.

I noticed that the update would never complete and yet the *dat files in the program directory and in the 'C:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\Updfiles' all had today's date, and yet the GUI was showing never updated and defnition dates from 1st July

I use ESS with the maximum (Blackspear's) settings.

[seraph787]

I was getting %100 usage from NOD32 after downloading even small zip files with firefox 3. To fix it just disable firefox 3 automatic file scanning. This is technically already done by NOD32 anyway with scanning and file creation.

When Firefox auto-scans on completion I think it might cause NOD32 to clash with itself and when and when two unstoppable forces collide everything stops.

To disable the auto scanning just go to about:config and toggle
"browser.download.manager.scanWhenDone"
Should solve most issues with scanning files with firefox

[Bakker]

Found another cause for high CPU initialization on a few pcs:

(These PCs are fresh XP installs with all SP's and Updates, nothing else but NOD32)

After installing the SQL 2005 Management Tools (SQL Client), mscorwin.exe causes 100% cpu usage continuesly. I can let it run for an hour and it'll still do it, even after a reboot it causes 100% cpu. The only option is to kill the mscorwin processes and to disable the .NET Runtime Optimization Service v2.0.50727_X86 service.

The funny thing is, that if i install the SQL client before NOD32, this never happens, not even when the mscorwin.exe processes pop up for other reasons. Filemon only shows me that it starts reading a logfile from the same directory that mscorwin.exe is in over and over and over. (Forgot the name)

[halcyon]

Reading all these issues, it sounds like v3 wasn't properly compatibility/stress tested - at least not to the extent v2.X series was.

I wonder if ESET has any ETA or plan on how soon they will have these fixed?

It's not like we are talking some obscure esoteric software here: Firefox, SQL Management tools, Windows Indexing Service, etc.

These are very widely used and common software, for which a 100% cpu hogging incompatibility should be a show-stopping do-not-release-the-code-yet type of bug.

But here we are, with v3 almost eight months later (plus the time used for betas) and these issues are not still fixed?

Eset, oh Eset, what has becomest of thou?

[ram130]

any updates? did they fix dis?

[Roadkil]

when will the 100% cpu usuage be resolved?? It defeats the purpose of heuristics to disable the sole thing that nod32 prides itself on. I just got brought down to my knees by 100% usage and even after a reboot it jumped right back up to 100%. I really love Nod32 but this is starting to get pretty bad. I'm running 3.0.699.0. A non-smart a** response would be appreciated as well as not the usual typical tech support answer of "uninstall, delete directory and reinstall" would be greatly appreciated.

[Marcos]

Originally Posted by Roadkil

when will the 100% cpu usuage be resolved?? It defeats the purpose of heuristics to disable the sole thing that nod32 prides itself on. I just got brought down to my knees by 100% usage and even after a reboot it jumped right back up to 100%. I really love Nod32 but this is starting to get pretty bad. I'm running 3.0.699.0. A non-smart a** response would be appreciated as well as not the usual typical tech support answer of "uninstall, delete directory and reinstall" would be greatly appreciated.

If you enable advanced heuristics / runtime packers on file access, you must be aware of the adverse effect on scanning speed. Code emulation is simply a time consuming operation. In most cases, we limit emulation to several seconds. The slowdown shouldn't occur with normal files, only with files that are somehow protected to prevent emulation (usually malware). It's like complaining that one cannot run calculation intensive programs (e.g. real-time movie rendering, weather simulation, etc) on his home pc - you simply cannot expect this to work and you must expect delays. There's simply no way to remedy this than buying better hardware (e.g. big server clusters for various simulations). Becase code emulation is a time consuming operation, it is used only for newly created / modified files. This provides same protection on a clean computer as if the options were enabled on file access.

[ram130]

Originally Posted by Marcos

If you enable advanced heuristics / runtime packers on file access, you must be aware of the adverse effect on scanning speed. Code emulation is simply a time consuming operation. In most cases, we limit emulation to several seconds. The slowdown shouldn't occur with normal files, only with files that are somehow protected to prevent emulation (usually malware). It's like complaining that one cannot run calculation intensive programs (e.g. real-time movie rendering, weather simulation, etc) on his home pc - you simply cannot expect this to work and you must expect delays. There's simply no way to remedy this than buying better hardware (e.g. big server clusters for various simulations). Becase code emulation is a time consuming operation, it is used only for newly created / modified files. This provides same protection on a clean computer as if the options were enabled on file access.

dude....who di hell cares...its not suppose to be doin dat, thats the point. we need it fix, now. Stop go around the ting and giv us background info like we fool. Yo dem need to fix it, we shouldn't have to be disabling the antivirus most advertise features to get what we want. It defeats the purpose, in other words what will need it for tell me why doesn't 90% of all other anti virus programs do this?for more than 5mins? plzzz ansa

[Marcos]

Using Advanced heuristics / runtime packers on file access is a new feature of version 3 that didn't exist in v2. These are intended only for those who don't mind delay when accessing files. As of the next version, the user will be warned that enabling these options may have adverse effect on computer performance when scanning certain files.

[trjam]

But, here is what I dont understand, when I enable them, my CPU usage is normal. It works fine.

[Marcos]

Originally Posted by trjam

But, here is what I dont understand, when I enable them, my CPU usage is normal. It works fine.

It depends on the files you scan. Especially certain malware can take more time for advanced heuristics to emulate it.

[trjam]

well I use Blackspears settings and see the save as target file doesnt tick Advanced Heuristics and packers, but I tic both and honestly see no slow down. It all works fine. I think a users PC drivers may be a issue and not the software.

[Roadkil]

So pretty much what they are saying is "its not a bug it's a feature" to make a CLEAN system unusable till it decides it's done. Or solve the problem by disabling btheir most advertised feature.

[trjam]

who is the question for, me or Marcos. Nice name.

[Marcos]

Nobody says to disable advanced heuristics or runtime packers on file access. These options were not present in v2 and were added to v3 only for those who don't mind higher impact on system performance. Should these options cause troubles to users who don't realize the impact on the performance, it'd be probably better to remove them and leave it as it was in v2.

[Irasys_net]

I had issues of 100% CPU Usage mainly on:

• Installation of new programs.
• Changes in Windows configuration.

The disable of advanced heuristics trick didn't work, so today I've uninstalled the Spyware Doctor that comes with Google Pack.

Fortunately, all the issues have gone.

The funny thing is that Spyware Doctor was installed BUT DISABLED, so initially I thought that it hadn't nothing to do with the issue.

Ciao.

[John2222]

Originally Posted by Marcos

Nobody says to disable advanced heuristics or runtime packers on file access. These options were not present in v2 and were added to v3 only for those who don't mind higher impact on system performance...

I've been quietly following this thread looking for a hopeful answer.

But, I'm surprised at the wording above that 100% CPU usage is considered just "higher impact"?

100% is merely higher? What would significant impact mean?

[Roadkil]

I guess a complete system crash instead of just being handcuffed and unusable until it decides its done would qualify.

[joby]

NewCoventry,

i actually found your advice to work instantaneously - no reboot required, thank you!

I excluded the thinkpad folder and it worked, cpu utilization is down to 4%!

I took your hypothesis and tested it further, by removing the thinkpad folder exclusion, and excluding "C:\Program Files\ThinkPad\ConnectUtilities" instead. this has the same effect. So it most definitely is one of the program(s) or file(s) in the Access Connections suite causing the conflict.

maybe that will be of use to someone at eset.

-joby

Originally Posted by newcoventry

Here is the situation:
We have 1250 Laptops ...Running the entire ThinkVantage solution package.
...We have experienced massive slowness caused by EKRN.EXE. On many of our systems ekrn.exe is consuming 50% of CPU. Disabling Real Time File System Protection caused ekrn.exe to go down to 0%.

The temporary (I Hope) solution is:
Go to Start> All Programs> ESET> ESET NOD32 Antivirus> ESET NOD32 Antivirus

Select the Setup Menu option on the left.
Select Antivirus and Spyware Protection link in the main portion of the window
Under Real-time file system protection select Edit exclusions...
Select Add... in the main portion of the window
Browse through: My Computer> C:\> Program Files
Select the ThinkPad folder
Click OK

Now ekrn goes down to 0% of processor usage.

I believe the issue is that the ThinkVantage Access Connections services that run on boot are unknown to NOD32 these programs could appear to be suspicious because ThinkVantage Access Connections has a portion of it that will change network settings based on which Access Point or Ethernet Port you connect to. I suppose this could be deemed suspicious.
My hope is that ESET would find a solution that does not require me to visit our 300 most recent users and edit these settings at their desks.

[Marcos]

Originally Posted by joby

I excluded the thinkpad folder and it worked, cpu utilization is down to 4%!

We'd appreciate if you could do the following:
- tell us the exact notebook model you use
- set the real-time protection to scan files with standard extensions instead of all files. Does it make a difference?
- with the folder not excluded from scanning, look at the counter of scanned file and tell us if it's rising up quickly

[Just_me]

Originally Posted by Marcos

Using Advanced heuristics / runtime packers on file access is a new feature of version 3 that didn't exist in v2. These are intended only for those who don't mind delay when accessing files. As of the next version, the user will be warned that enabling these options may have adverse effect on computer performance when scanning certain files.

Hi,

I have been following this thread for a while now. Every 3.xxx version of NOD had this 100% CPU behaviour on my Vista 64 Business, after I updated to 3.067. Going back to 3.065 which worked before the update did not help. Right now I went back to 2.7 and even that has a tendency to use up to 50% of the CPU, causing the machine to run at full force thus making my settings for energy saving worthless and the computer noisy since the fans run at maximum speed. This is not just an "adverse effect on computer performance" this is a major issue.

Could it be a special problem with Vista 64? I never had any trouble with NOD since 2005 as long as it ran on 32 bit Windows (either XP or Vista).

Greetings

[Roadkil]

Originally Posted by Just_me

Hi,

I have been following this thread for a while now. Every 3.xxx version of NOD had this 100% CPU behaviour on my Vista 64 Business, after I updated to 3.067. Going back to 3.065 which worked before the update did not help. Right now I went back to 2.7 and even that has a tendency to use up to 50% of the CPU, causing the machine to run at full force thus making my settings for energy saving worthless and the computer noisy since the fans run at maximum speed. This is not just an "adverse effect on computer performance" this is a major issue.

Could it be a special problem with Vista 64? I never had any trouble with NOD since 2005 as long as it ran on 32 bit Windows (either XP or Vista).

Greetings

Its not an adverse effect its a feature that they are not going to fix .

[ram130]

Its a feature they love so much that it runs 50% of thier customers machince in high cpu. Its not a problem at all marcos, but get your head together please!. LIsten and listen to me good ....having 100% is NOT KOOL!! WHY DONT U TRY RUNING A GAME, MSN, BROWSER and applications WHILE UR ANTIVIRUS IS FIGHTING WITH IT FOR CPU...U NOTICE ANY TING?? ...i dnt kno but the stuttering sound and the glitchy(10fps) graphics does not mean any thing u kno marcos....its still playable i mean i need protection that makes my system run like a 500mhz u kno...so its a good ting none the less. We like the feature, really we do....without more than 40% cpu its really good u kno....really good...so good that i'm upgrading my protection to Avira.....Eset have listen to the people....

[artsky]

sadly I have to reboot my computer several times a day because of this problem