NOD32 locking systems.

Hi,

Any assistance is appreciated.

Running version: 4.7.71.2 Business Edition (no firewall).
OS: Windows 7 32-bit

Since we installed NOD32 all 10 of our systems are locking up.

This occurs when using a program based on javaws.exe which loads off a local server.

When the computer locks, it is completely unresponsive (cannot ctrl + alt + del) and must be forcefully restarted.

I have:
- Disabled NOD32
- Added exception for javaws.exe

When NOD32 is un-installed, the issue doesn't occur.

NOD32 is installed on a Windows 2003 terminal server as well, running the same javaws.exe application - but doesn't have these errors. It is only the Windows 7 workstations which are locking.

Is there any thing else we can do?

 

Have you tried renaming the driver C:\Windows\System32\drivers\epfwwfp.sys in safe mode to prevent a bug in Windows Filtering Platform manifested by system freezing from occuring ?

 

Should I just rename that file and then just reboot?

Will that just resolve the freezing issue but still leave the program locked (so I can at least terminate the process)?

 

Yes, rename it in safe mode and then boot normally to Windows.

Hard to say but the WFP bug can cause system freezing as you mentioned, hence I suggested renaming the driver in the first place. Microsoft didn't support WFP in Windows 2003 or older OS so I suspect the above mentioned bug to cause the issues.

 

Is this bug set to be fixed in future ESET products?

 

No, it's a bug in Microsoft Windows Filtering Platform used since Windows Vista. We expect it to be fixed in the next SP but this has not been confirmed by MS yet to my best knowledge.

 

Thanks for your assistance.

I found the file: epfwwfpr.sys and renamed this. Is this the correct file? It's slightly different to the one you specified.

Either way, restarted the machine and "Maximum Protection is not ensured"; this is because "Web access protection - Non functional"; was this the desired intention?

 

You're right. Epfwwfpr.sys is used by ESET NOD32 Antivirus while epfwwfp.sys by ESET Smart Security.

That's expected behavior. To my best knowledge, the next version should report the status differently when the driver is unloaded.

 

Thanks for the help, seems to have resolved the issue.