ESET service fails to start. Computers hang on "Applying Computer Settings"

We've had workstations sit on "Applying Computer Settings" for 10 minutes or more seemingly at random. It's not always the same computers but when it happens I can see in the workstation event log the following error:

Code:

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7022
Date:		3/16/2010
Time:		11:58:23 AM
User:		N/A
Computer:	
Description:
The ESET Service service hung on starting.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

The service will eventually start, but not before causing a massive delay. The ESET service has no dependencies that I can see. Where are the startup logs kept - is there a log of why it failed to start?

ERAC shows no errors or anything out of the ordinary.

 

Re: ESET servive fails to start. Computers hang on "Applying Computer Settings"

Please be more specific about the installed OS and EAV. If you're not running the latest version 4.2.35, could you try installing it to see if it makes a difference?

 

Re: ESET servive fails to start. Computers hang on "Applying Computer Settings"

All are XP SP3 with latest MS patches via WSUS and running NOD32 4.0.474. Currently at definition version 4933.

As this happens randomly I'd rather not install beta software across the whole network, so still on 4.0.474 unfortunately.

 

Re: ESET servive fails to start. Computers hang on "Applying Computer Settings"

I take it nothing more has been discovered about this? There's zero information about this issue on the net, this was the only post I could find. I'd be interested to know if you managed to overcome the issue, gmiest.

I have a similar problem but it's a bit more consistent. We're running XP SP3 with latest patches, and each has "Applying computer settings" for about 4½ minutes before winlogon gets on with logging the user in. In the event viewer I've got the same "The ESET Service service hung on starting" error.

Strangely this wasn't always the case, but it started happening early March (after running it without issue for over a month).

We've tried NOD32 AV v3.0.695, 4.0.474, 4.2.35 when it was released, and now 4.2.40 which is available from eset.com (not .co.uk or .eu for some reason). The issue is still present, affecting all 70 of my PCs and I'm close to asking for my money back.

There were some MS updates installed on some of the machines the day before it started happening, but not on all the machines (which still presented the problem), so I think that was a red herring. Also, I have uninstalled those updates to see if it made any difference, but it didn't.

I'm reluctant to go to ESET support because last time they investigated a problem for me they just done what I had already done - clicked around in the configs for an hour and came up with "turn off network drive scanning" as a solution.

Hopefully someone has made progress - I'm going to click around some more...

 

what is wrong with turn off network drive scanning, it should be off. What about the group policies could they be causing the slowdown?

 

Why should network drive scanning be off? I don't have antivirus running on my file servers so I rely on the Antivirus software to scan networked files in real time, which won't happen if "Network drives" is unchecked in Real-time file system protection.

I'm looking at testing a non-domain machine now to rule out any group policies...

 

there are 70 machines, you mentioned, all scanning the file server, all using the same av engine and same definitions. The overhead that causes is tremendous, i think

 

I'm not talking about scheduled scans scanning the entire share - that would be serious i/o overhead, I agree. I don't see that on-read scanning will create massive overhead under normal circumstances. But hey, you might be right about it - I haven't tested the theory and I'll think about that at a later stage. I still don't think turning off network scanning is an acceptable solution to an issue with the AV software causing application hangs and crashes for no apparent reason, which is what my beef was with the support solution they offered. It just so happened that it seemed to fix my issue, for reasons unknown.

We've digressed, but I've sinced found a solution to this problem: a more thorough uninstall.

Previously we were uninstalling the software, rebooting, and either letting the group policy re-install the software (same version or different version), or doing a push install from the remote admin console. I've just performed the following steps on 4 different machines and they are all cured:

1) Uninstall ESET NOD32 Antivirus (don't reboot after)
2) Delete the "%programfiles%\ESET" directory (may not be present)
3) Delete "%programfiles%\Common Files\ESET" directory (may not be present)
4) Delete the "C:\Documents and Settings\All Users\Application Data\ESET" directory (may not be present)
5) Delete the "HKLM\Software\ESET" registry key
6) Delete the "HKCU\Software\ESET" registry key (I doubt this is necessary since the issue occurs before logon, but I did it, and this could be annoying for machines with multiple user profiles)
7) Reboot
8 ) Install ESET NOD32 Antivirus v4.2.40 (I done it via GP startup script, Remote Admin Console, and manually - same result with each method)

Now the machines do not have the 4½ minute delay, and they do not report that the ESET service hung on starting. I suspect it is that process that has helped, not the new version, but I can't be bothered to test another version to find out - I'm just going to stick with 4.2.40.

 

Almost 100% of our machines are now pausing on "Applying Computer Settings" for between 5 and 15 minutes on each bootup.

Uninstalling ESET NOD32 fixes the problem in 100% of cases. Reinstalling causes the problem to reappear in 100% of cases.

I took a test machine here, manually uninstalled the 4.0.474.0 client as detailed above, rebooted, pushed out the new 4.2.40.0 client, gave it an hour to connect and update its definitions and rebooted. That was almost 10 minutes ago. It is still at "Applying Computer Settings".

Has there been any update on this topic?

 

I just had this problem start happening on my XP test machine. NOD32 v4.2.40.0 on Windows XP SP3. I thought this could be an issue of pushing v4.2.40.0 over v4.0.474.0 so I completely uninstalled and did a clean install (via ERAC) and received the hang on Applying Settings. Uninstalled v4.2.40.0 and pushed v4.0.474.0 and it boots up and logs in perfect. Uninstalled and pushed v4.2.40.0 back to the machine and it hangs at Applying Computer Settings...

I'm going to try the steps theleeski recommended.

 

Sorry it didn't work for you, gmiest - I've applied those steps to all the affected machines on the network and they're absolutely fine now.

Must be a separate issue you have, but it's curious that it started around the same time (judging by your first post date). It started for me on 09/03/10 so I figured it was an ESET update from that day, and the PCs that were not switched on that day got away with it and were unaffected... Maybe not though - just speculation.

Hope you find a solution.

 

If the system seems to stall, please create a kernel memory dump per the instructions here and convey it to ESET Customer care (or better PM me and I'll take care of analyzing the dump). If there's actually a problem with some of the ESET's modules (realt-time protection / startup scanner / anti-stealth / self-defense), we should be able to pinpoint it and fix it quickly using the information in the dump.

 

FYI - I was able to resolve the error on my test machine by following the steps outlined by theleeski. On my test machine, I did not do step 6 for the Current User registry hive.

 

According to Microsoft and my own testing that process only works on Vista and higher. All the machines here are XP SP3.

edit: digging a little deeper it seems that the Microsoft page is incorrect. Forcing the BSOD with a USB keyboard needs Vista and higher. I dug out an old PS2 keyboard and got the dump info.

 

I'm not sure if it works on Windows 2000, but certainly on Windows XP it does.

 

Also seeing this issue on XP SP3 machines with delays far in excess of 15 mins at 'Applying Computer Settings'.

*argh just lost a huge block of text from this post, here we go again*

I'm a little annoyed that after years of flawless performance and low resource usage with NOD32, I suggested my employer try a number of ESET installations over our current provider (McAffee).
Since this point, I have experienced nothing but problems with EAV 4 products, from literally unusable outlook/document performance without having to strip the security down in advanced setting (or disable items like document protection altogether).... and now hanging on startup.

I feel a little dissapointed with ESET, I mean seriously what happened? Were all the developers sacked and new ones hired before EAV4 was written?

Having said that, I don't want to beleive that 'that is it' from ESET, so if the above people did not deliver on their crash dumps/other information, please let me know and I will supply as much as I can so that this community/ESET can hopefully shine some light on my/other posters issues.

Thanks,
Matt

 

The problem with document protection slowing down opening documents has been proven and verified that it is a bug in MS Office. MS Office behaves so even with a dummy entry in the registry simulating AV scanner installation.