copying files to my PC is impossibly slow

I'm using the latest version of ESS and since I installed it, copying files from any source (a USB stick, eSATA disk or over the Lan) is terribly slow.
There is no log entry that shows me why but I know it is a problem with my PC because I can send files to other PC's or devices at normal speeds but they cannot copy to or from mine.
Any suggestions?
Disabling ESS restores all to normal but it is no fun since I then have no security

 

try with web protection/protocol filtering disabled
http://kb.eset.com/esetkb/index?page=content&id=SOLN2132

 

Thanks for your reply, I already saw that but since I'm running Windows 7 x64 the option is not available for me.
I tried excluding Explorer.exe but it does not change much or at least I couldn't see it.

 

Ok, since I could not find a solution, I reverted to Nod32 Antivirus and Windows Firewall.
Copying files through the net was imposible with ESS v.4.2
If anyone knows a way to make it work, I'm open to suggestions. I don't like running without ESS.

 

If reverting to EAV made a difference I assume the problem must have been with the firewall probably blocking some communication. I'd suggest enabling logging of blocked connections, reproduce the problem and then checking the firewall log for details about the communication that was blocked.

 

Hi Marcos:
I did enable logging and all I saw was a lot of packets blocked by IDS (none that made sense to me) but since the problem persisted after disabling the firewall on ESS I still have no clue as to what was causing the problem.

I will run the PC with EAV for a few days just to make sure and post back then.

Thanks.

 

So... going to Nod32 didn't help, transfers improved but not to what is expected on a Lan. I guess it has to be a PC issue.
The strange thing is that the system works fine upon reinstall. (Win7 x64) and things start to slow down as soon as I install ESS or EAV but I don't know why.
Could this be a filtering problem with the 64bits version?

I have a notebook with ESS on Win7 32bits and all seems fine.

 

Could you narrow it down to the particular module by disabling real-time protection and HTTP checking in the main setup (F5), one at a time?

 

It seems to be one of those for sure. But I cannot narrow it down.
One thing I know for sure is that uninstalling ESS fixes the problem.
I am now running with MSE and windows firewall -which I don't like- I miss ESS's firewall.
IS there any fix or update that I might try?

 

Sometimes disabling ESS is not enough !

Sometime you can get away with unchecking the ESET/ESS functions in MSCONFIG then booting to safe mode to allow you to rename the main ESS file " ekrn.exe " (cannot do so while its in use, hence Safe Mode).

Other times you need totally uninstall it to test if its to blame and most times it is.

I find its bad at moving tiny files depending on what these file are.

Example > " hjsplit " is for working with archives and for me to unzip it from a Zip file then move (Cut & Paste) from storage HDD to main DDD to use it takes ages both stages.

The file is only 306 KB in size.

Even with " hjsplit.exe " sitting on desktop, to even right click it and choose Properties has a delay, a delay that's gone with ESS removed.

I know the AV is there to scan files but sometimes it takes very long esp for files so tiny and the delay is very noticable.

 

You will say that I'm crazy but I just realize the following:
My laptop is using the English version of ESS v.4.2 and my PC is using the Spanish version of ESS v.4.2, my PC is having problems accessing the lan and copying/moving files and my notebook is not.

((wtf))

I'm in Argentina so using the Spanish version would make sense. I will be uninstalling it and trying the English Version. If my problems get solved Eset you are playing with us.

Well, it wasn't that (it would have been funny to find such a bug).
The logs from the firewall indicate that Eset is flagging an Incorrect TCP packet checksum and that is causing the connection between the two machines on the lan to be dropped and so the transfer is halted and has to be resumed, at that point windows will only copy at a very slow speed.
No matter what I do, only uninstalling Eset solves the problem.

 

So... Any chance on how to eliminate the crc error?
I would like to mantain my license of ESS. I'm really comfortable with the AV but I want a firewall and ESS is the lightest I have used and since I don't care much about hips or leak tests It's an ideal choice.

Any ideas? I have tried to replicate the issue with other firewalls with no luck. The only one causing me to drop packets over the lan on copy/move operations is ESS.

 

are both pc in Trusted zone?
http://kb.eset.com/esetkb/index?page=content&id=SOLN2141

 

Check in the Zones settings, there should be a zone named 'Addresses excluded from active protection (IDS). Just add your subnet or local (trusted) address range.

 

YES and @stackz I already have.
I've been adding my subnet 192.168.*.* to 192.168.*.* to the Trusted Zone since version 3 (I was a beta tester fun times) and since version 4 excluding it to the IDS.
But my question remains... what's the point of an IDS if you have to start excluding pc's or entire subnets because the firewall won't behave !!

ESS has a BAD TEMPER

 

UPDATE !! Re: copying files to my PC is impossibly slow

I did some reading and found this: http://www.ethereal.com/lists/ethereal-dev/200406/msg00090.html
Another interesting view: http://fixunix.com/tcp-ip/66508-tcp-checksum-errors-when-checksum-calculated-hardware.html

Could it be that ESS is interpreting the checksum readout wrong and thus causing the error that drops the connections and stalls copy/move and or stream operations on a LAN??

I think so

 

MORE ON THIS Re: copying files to my PC is impossibly slow

Found this on Security Focus:
Looking at Articles about Firewalls http://www.securityfocus.com/firewalls

"An Intrusion Prevention System may be an additional feature of a desktop firewall within an enterprise. This would allow the firewall to detect possible attacks by examining the inbound packet and matching data and port usage against a list of known attack signatures. The IPS may be configured to respond by blocking the inbound packet or allowing it and sending an alert. False positives on a firewall supporting IPS could mistakenly block inbound traffic and would need to be analyzed and adjusted on case-by-case basis. Logging the event and allowing the traffic may be the quickest and easiest way to deal with false positives." (http://www.securityfocus.com/infocus/1867)

I think we are dealing with a False Positive from Eset with this Incorrect CRC Packet Checksum that is causing the loss of connections and bad transfer/stream speeds.

 

Re: MORE ON THIS Re: copying files to my PC is impossibly slow

Could you please start Windows in safe mode and rename epfwwfpr.sys in the windows\system32 folder? Let us know if it made a difference or not. As I asked before, also disable real-time protection and check if the problem persists. The CRC error should have no impact on the speed as you said it also happens with EAV installed.

 

Re: MORE ON THIS Re: copying files to my PC is impossibly slow

Will try Marcos. The problem I see is that when the CRC error appears on the Logs (firewall logs) the copy/move operation stops and then you get the slow speeds. All operations start fast as they should (10 to 13 MB on a 100LAN) and then stop and restart at 10% of that speed. Always the same, no mater if you copy to or from one or the other PC.
I have checked both Ethernet cards and they have latest firmware and drivers.

 

This is a txt with some logs.
As soon as I start to copy and the crc error is detected the IDS will block the address of the "attacking" PC.
Ridiculous.

 

You wrote before "going to Nod32 didn't help". If installing ESET NOD32 Antivirus and renaming epfwwfpr.sys in safe mode did not help, there's no chance ESET would have any impact on the network communication. Epfwwfpr.sys is the only network-related driver in ESET NOD32 Antivirus (on Win Vista and newer).

 

May 21st I posted this issue for the first time.
I have now lost almost the last two months of my license and still no answer?

I guess I have to give up on Eset at this moment since this is not an isolated issue, it has been reported since the first versions of ESS 3 and still appears once in a while.

Will there be a fix for this TCP Checksum error or not?

Maybe future users will have more luck.

 

It seems I accidentally clicked on Edit instead of Quote last time and wrote my answer to your post directly.

The question if renaming epfwwfpr.sys helps still remains unanswered. There's nothing in EAV that would affect network communication except this driver which serves for checking HTTP/POP3 communication.

 

same problem here to, ESS 4.2.58 makes wireless network slow

 

Well the AV doesn't seem to cause too much issues but since ESS was installed on my pc and I didn't do a clean reinstall of windows I wouldn't know.
For the moment I'm staying clear of ESS untill a proper fix/response is given from Eset.
I refuse to pay for software when the vendor is causing problems and not taking responsibility.
Uninstalling Eset brings my home LAN to full speed and that is what I need, I'm running wihdows firewall and MSE (all free, and with no conflicts- was using PC Tools but I'm not convinced either, maybe will try the new V7 Beta).

Will see if future versions correct all the filtering problems of the 4.0 and 4.2 family of ESS maybe I can decide to buy a new license.

I TERRIBLY REGRET MAKING THIS DECISION since Eset never let me down as an AV but this days require more than just an AV to stay secure and Eset's suite is not fully trouble free whit this firewall.