Problems with NOD32 v4.0.417.0 AntiVirus

Ever since installing v4.0.417.0 AV 10 days ago (updated from V3), I’ve been experiencing a problem. After the PC is idle for about 30 minutes or more, and I then click on something, I get the Vista busy wheel, and whatever I clicked on, I get no response except the Vista busy wheel.

At this point the PC is completely locked-up, no response from Ctrl-Alt-Del, and the only way out is pressing and holding the Power button until the PC shuts down. I’m not sure if it matters, but I almost always have Microsoft Outlook running.

First off, the PC has never had any other AV installed. The PC has run NOD32 v2.7, V3 and now v4. I uninstalled V3 from the Windows Control Panel) before installing V4. No other security software is installed other than Windows Defender. V4 was installed using all the default settings, and using the ‘detect possible malicious software’ (can’t remember the actual name here) option. No other new software has been added.

Here are the specs:

Dell E520, Core 2 Duo 2.13GHz, 2Mb RAM
ATI X1300 256Mb Video
Vista Home Premium SP1 (all updates)
Logitech MX3200 Wireless keyboard and mouse
MS Office 2007 (all updates)
NOD32 v4.0.417.0 AV (English) with latest virus defs.

 

Do you use default settings? Could you please create a complete or kernel memory dump per the instructions here and convey it to ESET for perusal along with a log from SysInspector?

 

V4 was installed using all the default settings (and yes I use all the default settings), and using the ‘detect possible malicious software’ (can’t remember the actual name here) option.

I will follow your instructions for the kernal memory dump when I get home from work later today.

Thanks!

 

"Unwanted sowftware detection" as far as i know.

 

How big is your outlook.pst file? Do you have auto archive enabled?

The two options are "potentially unsafe" and "potentially unwanted".

 

Yes I have Outlook Auto Archive enabled and use it quite extensively (on multiple folders).

I'm not at the PC right now so I can't look at the file size.

Can you provide more info or a workaround?

 

I was just clarifying the two options available for detection. I don't believe enabling/disabling either would have any affect on the outlook issue.

All I can suggest is playing with the email/outlook settings and maybe even disabling integration in outlook which basically creates a button on the toolbar in outlook.

 

Exactly what are these "two options" you keep referring to?

 

If you go into the advanced options on each of the following options: Antivirus and antispyware, realtime file system protection, email protection, web access protection. You will see a button labeled "setup" on each of those options.

After clicking setup click on the "options" tree and you see where you can enable/disable detection on potentially unsafe and potentially unwanted applications.

 

Got-it.

I'm still going to follow up with Marcos and a kernal memory dump with a SysInspector log later today.

 

Definitely do that and if you determine the size of the file let us know.

 

Need some help.

1) Can't upload XML SysInspector file. Upload tool here says it's an illegal format (gif, jpg, log, png, txt). The same will apply to the MEMORY.DMP file when I find it.

2) Can't locate the %SystemRoot%\MEMORY.DMP kernel mem dump file in c:\windows. Is it a hidden file? According to my settings, it should have been created automatically when the system last crashed.

3) Can't locate the .pst file either.

 

Ant help?

 

When searching for the files choose the advanced option and enable search on hidden and system files.

Search for *.dmp and *.pst

Not sure about the upload problem. What program are you using to upload?

 

I know how to do this in XP, but I have Vista. How is that done in Vista?

The Wilders upload tool here, for uploading attachments.

 

1, do you use a PS2 keyboard? Manual dumps cannot be created using a USB keyboard.

2, do not upload your configuration here as it may contain sensitive information. I'd recommend attaching it to the dump when you manage to create one.

 

1)Keyboard is USB. I was assuming (from my CP settings) a dump would be created automatically when the system crashes.

2)I'm confused. Attach it to the dump? And then what? How do I get the file(s) to you?

BTW, I've determined than when MS Outlook is closed, the lock-up problem does not occur.

 

You wrote that the system locked up, not that BSOD occured. Right? In such case, your system didn't actually crash so a dump was not created. However, you should be able to generate a dump manually by following the instructions in the KB article I refered to (note that it can be done only using a PS2 keyboard).

When a dump is created, compress it with WinRAR/ZIP and you can also add the ESI log to the archive. If you don't have an ftp account at your disposal, let me know and I'll provide you access to our ftp.

 

Hey Marcos, thanks, but in-order for me to accomplish this task I would have to give-up my real life and become an ESET tester.

I also hope you noticed I found the lock-up only occurs when MS Outlook (2007) is open.

Here's what I'm going to do. I'm submitting my problem to ESET Support and hope they can resolve it.

If not, I will downgrade to NOD32 AV version 3 and live with the fact that v4 needs more time in development before I will be using it again.

Thanks again all,
Steve

 

Just a follow-up for informational purposes. I downgraded to NOD32 AV version 3 after finding out my lock-ups (after some idle time) were occurring even with Outlook closed.

 

Anyone know if 4.0.424 fixed this? I was having the similar issues getting the "ring of death" and nothing opening when clicked. Note that I use thunderbird, not outlook. 4.0.417 seemed to start the problems.

 

I had the same problem on my laptop with both 4.0.314 and 4.0.417, until I unchecked "computer shutdown" and "network drives" under "Advanced Setup - Real-time file system protection". This seems to have worked for me.