Crashes with version 4.2.67.10

Discussion in 'ESET NOD32 Antivirus' started by Wallaby, Jan 1, 2011.

Thread Status:
Not open for further replies.
  1. NineRings

    NineRings Registered Member

    Joined:
    Jan 2, 2011
    Posts:
    1
    I am experiencing the same problems as noted above for the past few days.

    Running W7 x64 with 4.2.58, if there is too much http traffic any browser that tries to access the internet will indefinitely hang. It also affects the operating system,causing explorer to hang and the ekrn.exe process to max out. Only a reboot fixes it till the next crash. Other internet traffic functions during these hangs.

    I'm guessing its either a bad virus definition/update (as I have not updated anything else on my system) or related to the date change of the new year.
     
  2. SamuriHL

    SamuriHL Registered Member

    Joined:
    Nov 17, 2010
    Posts:
    14
    I re-enabled http scanning after getting the latest virus defs and *so far* it's been fine and I haven't seen anymore crashes. I'm running pandora right now and have been surfing the web in IE9 beta for a while with no issues. I'll keep monitoring it, though.
     
  3. registered

    registered Registered Member

    Joined:
    Jan 2, 2011
    Posts:
    15
    Location:
    El Cajon, California
    I want to join the crowd in reporting the same problem. It started with me on December 29, explorer (not internet explorer) started hanging. a hard reboot was necessary. On the 30th, while waiting for it to hang again, the service ekrn went up to 50-52% and my windows 7 professional system hung again. I went into msconfig and shut down ekrn, ekrn http, and the ekrn gui, and everything is OK.

    Last but not least, I was going to download the newest version and install it but apparently my username and password has expired. I bought nod32 seven months ago. I also noticed the comment about someone installing a newer version and it didn't help so what's the point of suggesting a bad solution?

    I extend greetings to Siljaline, I am a aumha.net veteran
     
  4. SamuriHL

    SamuriHL Registered Member

    Joined:
    Nov 17, 2010
    Posts:
    14
    Well that didn't last long. IE locked up to the point where I couldn't even kill it and had to hard reboot again. HTTP scanning goes back off and stays off until it's confirmed that this problem is *FIXED*. I'm starting to lose my patience with it now. I don't really want to keep rebooting just to figure out which part of the HTTP scanning engine is broken. And since it just hangs instead of outright crashes, I have no error reports to go on, either. UGH!
     
  5. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,456
    Before creating dumps from an ekrn crash, make sure that you configure Dr Watson to create full dumps after running C:\WINDOWS\system32\drwtsn32.exe.

    For Win Vista and newer OS, instructions for configuring the memory dump type are available at http://msdn.microsoft.com/en-us/library/bb787181(v=vs.85).aspx.

    Note that Self-defense must be disabled and the computer rebooted prior to generating a memory dump of ekrn. This is not necessary when generating complete memory dumps manually.
     
  6. registered

    registered Registered Member

    Joined:
    Jan 2, 2011
    Posts:
    15
    Location:
    El Cajon, California
    i don't think anybody is getting crashes, just system hangs from high cpu useage caused by ekrn
     
  7. Wallaby

    Wallaby Registered Member

    Joined:
    Jan 1, 2011
    Posts:
    201
    A pop-up telling me that "program modules have been updated" has appeared but in About I still find
     
  8. siljaline

    siljaline Registered Member

    Joined:
    Jun 29, 2003
    Posts:
    6,618
    Do you have pre-release updates set or no, Wallaby

    Mine show the following with pre-releases enabled:
    Full System-Wide Hang on ekrn.exe Unable to capture event with system frozen. Unable to reproduce event using Dr. Watson.

    Best guess is the pre-releases are the issue, one of the modules has a bug. This event has been consistently reproducing since prior to signature update 5744
     
    Last edited: Jan 2, 2011
  9. Wallaby

    Wallaby Registered Member

    Joined:
    Jan 1, 2011
    Posts:
    201
    Pre-release cannot be downloaded from trial servers :mad:
     
  10. siljaline

    siljaline Registered Member

    Joined:
    Jun 29, 2003
    Posts:
    6,618
    I was not aware of this, please follow this article in order to attempt to fetch pre-releases, though it would seem the pre-releases are the issue, on my installation, in what I have seen of late.

     
  11. Wallaby

    Wallaby Registered Member

    Joined:
    Jan 1, 2011
    Posts:
    201
    Another crash also for me (in the meantime)

    I had already that option flagged but as already explained, those updates don't come down from trial servers

    This is my situation now

    This whole thing is something that happened in the updates made between december 29th and december 30th, when I had the first crash on my PC. Or some NOT-pre-release module updated for all users in those days, but I don't think new modules were released

    In alternative the Devs should examine these signature updates (taken from here http://www.eset.eu/support/update-xy1?month=12&year=2010&page_id=5846 )

    As for posting the complete dump I have opened it with an Hex editor and saw that it contains personal information (content of the desktop at the moment of the crash, etc.) so I have deleted it
     
  12. Wallaby

    Wallaby Registered Member

    Joined:
    Jan 1, 2011
    Posts:
    201
    Here you are some screenshots taken from Process Explorer while ekrn.exe reached 25% CPU (I have Q6600 quad core)

    The last 3 jpgs refer to the "file" panel below

    Hope this helps

    When I saw this I disables realtime and web access protection, killed ekrn.exe and then re-enabled realtime and web access protection.
    The program hasn't crashed so far and I see an ekrn.ex taking 0% CPU and about 60.000 kB of memory usage.
     

    Attached Files:

  13. SamuriHL

    SamuriHL Registered Member

    Joined:
    Nov 17, 2010
    Posts:
    14
    I was going to ask you if you had a multi-core proc. What appears to be happening is a threading bug where it's not properly using the multiple cores and hangs inside one core. So in my case it'll be 50% as my laptop is a dual core. Yours is 25% due to being a quad core, etc. Those aren't very fun to catch and fix. But they should be able to narrow this down and find it given the information that's been posted here. We know when it started, we know the symptoms, configurations, etc.
     
  14. narciscj

    narciscj Registered Member

    Joined:
    Jan 2, 2011
    Posts:
    2
    I have the same problem with ESET Smart Security 4.0.467.0, Windows XP.
    This problem is since last week (28/29.12.2010). My PC is freezing and i receive error messages about ekrn.exe. Sometimes ekrn.exe is using 50% of CPU.

    Advanced System Information - Error Log:
    30 decembrie 2010 Service Control Manager The ESET Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.

    31 decembrie 2010 Service Control Manager The ESET Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.

    The problem occurs when i logout from internet pages.
    I think is a general problem on all version of ESET generated after a virus signature update (28/29/30/31.12.2010 o_O)
     
  15. petero

    petero Registered Member

    Joined:
    Jan 2, 2011
    Posts:
    2
    I re-enabled NOD32, but without Web & Email protection. While away from the machine, it got an Unhandled Win32 Exception in ekrn.exe again. I didn't have to reboot the machine, but I've disabled NOD32 fully again.
     
  16. registered

    registered Registered Member

    Joined:
    Jan 2, 2011
    Posts:
    15
    Location:
    El Cajon, California
    Before I found this forum, I submitted a case online. I should get a response tomorrow.. Anybody want to place a bet that ESET support suggest I upgrade to their newest version? The million dollar question is if ESET people read these forums or if the moderators have the ear of ESET. We'll find out in the next couple of days............ sad
     
  17. pslva38

    pslva38 Registered Member

    Joined:
    Jan 2, 2011
    Posts:
    2
    It looks like it must be something to do with the definitions - I'm getting the error on 3.X versions as well as 4.X - this happened before back in September :- https://www.wilderssecurity.com/showthread.php?t=281024

    ....albeit it was throwing up an error message, yet the symptoms are the same (hung OS requiring hard reboot).

    I've disabled NOD32 on both my servers now and so far this issue hasn't returned.
     
  18. beek_m

    beek_m Registered Member

    Joined:
    Jan 3, 2011
    Posts:
    5
    Problems also here.. Seems to affect the server with Nod32 3.0.695.0 with update 5754, but not another with update 5755.

    Is someone looking into this issue already??
     
  19. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,456
    We are eagerly waiting for complete memory dumps or complete application dumps of ekrn from anybody experiencing this issue.
     
  20. beek_m

    beek_m Registered Member

    Joined:
    Jan 3, 2011
    Posts:
    5
    I only have an older crash which I believe is related to NOD32. It was on the system that does not have any crashes anymore with update 5755.

    I do not have more dumps because Ekrn does not crash, it just uses more CPU and memory and the NOD icon is red and the GUI states that not all modules are loaded, because of faults.
     

    Attached Files:

  21. Wallaby

    Wallaby Registered Member

    Joined:
    Jan 1, 2011
    Posts:
    201
    Another crash on a fresh installation with regular updates (no pre-release) after 1 hour and 30 minutes I turned on the PC and while I was downloading two big rar files from internet and using IE8 and eMule.
    When I tried to open a new "folder" in IE8 the PC hanged.

    No "do you want to send... to Microsoft" pop-up appeared because after 8 minutes it didn't appear I decided to hard reset the PC, so this is what I found on the C:\%temp% folder booting from another drive of the PC

    Complete dump link on megaupload sent by PM to Marcos (I don't know the procedure)

    Windows XP SP3 32 bit
    Comodo Firewall & Defense 5.0.162636.1135
    EAV4 4.2.67.10
     
  22. dmaasland

    dmaasland Registered Member

    Joined:
    Nov 10, 2010
    Posts:
    468
    I've sent you a PM
     
  23. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,456
    Thank you, I'm downloading it right now. I will send you further instructions in a private message as it's likely we'll also need you to enable page heap before generating a memory dump.
     
  24. thijs031

    thijs031 Registered Member

    Joined:
    Jan 3, 2011
    Posts:
    3
    We have the same problem with ESET Smart Security 4.2.67.10, Windows 2003. This problem is since last week (29/30.12.2010)

    We have 8 W2003 servers with this problem:

    Virus signature database: 5754
    Virus signature database: 5755
    Virus signature database: 5756

    All these signatures gives the same problem, server hangs.
     
  25. Ghosttown

    Ghosttown Registered Member

    Joined:
    Aug 22, 2008
    Posts:
    4
    We also have several problems on XPSP3 clients and also one time on W2K3SP2/Exchange2003.

    ekrn.exe alerts that writing to network cannot be done. Process taking 50% CPU.

    Eset, please fix this quickly, we have a lot of complaining users.

    Gerrit
     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.