100% CPU Usage

Discussion in 'ESET NOD32 Antivirus' started by Daegalus, Apr 25, 2008.

Thread Status:
Not open for further replies.
  1. Chris Childerhose
    Offline

    Chris Childerhose Registered Member

    I am having the same issue but with the latest version 3.0.657 and I just sent a Filemon log to ESET to have them check it out.

    My system just locked up due to the EKRN.EXE file using up most of my CPU power. I have a Thinkpad T61 laptop running Windows XP SP3 with 3GB of RAM and a Core Duo T7250. It uses up most of the CPU and when you kill the ekrn.exe process it frees up for a few seconds then starts scanning again.

    I had to delete some files that ESET itself was creating in the C:\Windows\Temp directory before it finally stopped scanning and allowed me to work on my system.

    This needs to be addressed otherwise I may need to revert back to 2.7 for now.:mad:
  2. cosmon
    Offline

    cosmon Registered Member

    Hi all,

    New update on this issue. After deleting a windows install related folder that was left on c:\, i was able to start eset and the update service without any instability.

    My guess is that ekrn.exe and the "Automatic update service" were in some race condition.

    Best regards,
    Pedro
  3. Bakker
    Offline

    Bakker Registered Member

    Found another issue for ekrn.exe raping my cpu on another computer it was running on. Appearantly every few minutes it scans a log file (.htm file) of an application called Hostmonitor 4.86, its logfile was aproximately 90MB and it took about 2 minutes to scan it while ekrn.exe ran at 99%.

    *This also solved the issues of it hanging for 2 minutes when it started up, logs have been deleted and logging disabled for now.
    Last edited: Jun 3, 2008
  4. cosmon
    Offline

    cosmon Registered Member

    Hi all,

    I have been reading about this kind of issue. "High CPU and Windows Update".

    It looks like the best way to avoid it is to exclude windows update folders. ALso regarding scan on big files, i think the better way is to exclude them. Can NOD exclude files based on it's size?

    Regards

    Pedro
  5. Marcos
    Offline

    Marcos Eset Staff Account


    There will be a quite big improvement in this regard in the new version we're working on.
  6. Marcos
    Offline

    Marcos Eset Staff Account


    There will be an improvement in scanning large files in the new version we're working on.
  7. Bakker
    Offline

    Bakker Registered Member

    Thank you Macros,

    Is there any word on when this new version will be released. Will this new version also contain fixes for (some of) the 100% cpu problems people are having?
  8. Canuck21
    Offline

    Canuck21 Registered Member

    I have the same issue except that the CPU usage is around 50%, but the real effect is similar to 100% because my computer is completely paralyzed for 5 minutes each time. Around one or two minutes after startup, that's when the freezing starts and it is extremely annoying.

    I am surprised that ESET hasn't said much about this problem and I am very disappointed at this attitude--I feel like I'm left to my own devices. If this issue isn't corrected soon, I'll have no choice but to look for another anti-virus program.
  9. piranha
    Offline

    piranha Registered Member

    Just downgrade back to v2.7 and wait for a fix for this v3 bug. v2.7 is almost perfect, that is a good choice ! Marcos announce a big improvment soon so..........be patient. You will be well protect for no more cost.
  10. incubabe
    Offline

    incubabe Registered Member

    im having issues with my pc at home .. (thank god for laptops) anyhow i downloaded the program and now when my computer starts up and the program loads my computer totally slows down and goes to 100 percent usage. only way to keep it down is to beat the program from loading and go to my task manager and end processes. Since im not so computer saavy im wondering if ive downloaded a F'd up version and am wondering if theres somethign i can do or somehwere i can go to fix this problem i got as far as trying to remove it from my control panel but when it was removing it self it froze AGAIN.

    Can any one help or offer suggestionso_O?
  11. zer0l0gic
    Offline

    zer0l0gic Registered Member

    That sounds really exciting Marcos. :thumb:

    Although my NOD32 has been running flawlessly.
  12. Noddy32
    Offline

    Noddy32 Registered Member

    There is really a big problem found today with 3.0.657 that my PC freezes when i do a file search on the disk.. ekrn is eating up everthing then..

    Hope the new version is released soon :)
  13. wrathchild
    Offline

    wrathchild Registered Member

    I have 100% CPU usage too (from time to time)...from the first "final" version.
    I hope the new version will be released when ready and will be bugs free...I don't wish another beta. Until then I've switched to another AV (because I don't wish to downgrade)...btw I've been NOD32 user for years.
    Cheers.
  14. Marcos
    Offline

    Marcos Eset Staff Account

    Just to make sure, do you have these options disabled in the real-time protection setup?

    Attached Files:

    • AMON.jpg
      AMON.jpg
      File size:
      32.2 KB
      Views:
      1,699
  15. Michael Moye
    Offline

    Michael Moye Registered Member

    I'm running an evaluation version (3.0.65.0) in a clean install of Win.XP Service Pack 3 and don't have any high CPU usage.

    Admittedly there's a jump upon copying/moving/deleting some .EXE files but I
    do have all settings (heuristics etc.) enabled.

    In fact it's an improvement over the on-demand scan of version 2.7 in that there isn't any lag of the initial 'memory scan'.

    ekrn.exe is currently at 0% usage!

    Mike.
  16. yan
    Offline

    yan Registered Member

  17. Marcos
    Offline

    Marcos Eset Staff Account

    Yes, this problem is not related to ESS/EAV. If you are having this problem, you'll see ekrn taking 100% of cpu usage because the traffic from svchost.exe is redirected through it. If you uninstall ESS/EAV, you should see svchost.exe taking 100% of cpu usage.
  18. yan
    Offline

    yan Registered Member

    Yes, it is not related per se. But as you told, the traffic is redirected to ekrn.exe. I think that is why fixing Windows Automatic Updates solved the discussed problem on my computers. I had two of 30 machines which I could not update. And both had ekrn.exe consuming 99% of CPU.
  19. Bakker
    Offline

    Bakker Registered Member

    But that doesn't explain why svchost.exe wasn't consuming 99% cpu before NOD32 was installed. NOD32 being installed obviously triggered something. All my machines ran fine with McAfee 8.5.0i installed.
  20. Marcos
    Offline

    Marcos Eset Staff Account

    Could you please set the web access and real-time protection to scan only files with default extensions instead of all files to see if that makes a difference?
  21. Bakker
    Offline

    Bakker Registered Member

    I won't be at work for another 2 weeks, and all the computer's i've come across so far have been 'fixed' or have either had a 2.7 install. If i do come across another system with these errors i'll try to change that.

    But wouldn't disabling scanning for 'non default' extentions mean that i'm less protected?
  22. naknak
    Offline

    naknak Registered Member

    ekrn.exe occupies 100% of the CPU every time I start any CAD programs, thus halting the PC. However, any program would start within a 1sec when the ekrn.exe is shut down. the NOD32V3 settings are all checked. Any ideas? Thanks
  23. Marcos
    Offline

    Marcos Eset Staff Account

    Couldn't it be that you enabled advanced heuristics and (or) runtime packers on access in the real-time protection setup? They are enabled by default only for newly created file because emulation is a time consuming operation and enabling these options might slow down the system performance.
  24. newcoventry
    Offline

    newcoventry Registered Member

    Here is the situation:
    We have 1250 Laptops running Windows XP SP3, ThinkPad R61, Running the entire ThinkVantage solution package.
    We have used NOD for years and have just upgraded to version 3.0.642.0 on our default image. I have installed the latest release on a machine and found no improvement in the below situation.

    We have experienced massive slowness caused by EKRN.EXE. On many of our systems ekrn.exe is consuming 50% of CPU. Disabling Real Time File System Protection caused ekrn.exe to go down to 0%.

    The temporary (I Hope) solution is:
    Go to Start> All Programs> ESET> ESET NOD32 Antivirus> ESET NOD32 Antivirus

    Select the Setup Menu option on the left.
    Select Antivirus and Spyware Protection link in the main portion of the window
    Under Real-time file system protection select Edit exclusions...
    Select Add... in the main portion of the window
    Browse through: My Computer> C:\> Program Files
    Select the ThinkPad folder
    Click OK

    Now ekrn goes down to 0% of processor usage.

    I believe the issue is that the ThinkVantage Access Connections services that run on boot are unknown to NOD32 these programs could appear to be suspicious because ThinkVantage Access Connections has a portion of it that will change network settings based on which Access Point or Ethernet Port you connect to. I suppose this could be deemed suspicious.
    My hope is that ESET would find a solution that does not require me to visit our 300 most recent users and edit these settings at their desks. :D
  25. naknak
    Offline

    naknak Registered Member

    I made sure that the advanced heuristics and runtime packers on access in the real-time protection setup were disabled. As soon as I start my CAD application ekrn.exe takes 100% of CPU and my PC freezes for at least 5-7 minutes until ekrn.exe release some of the CPU resources, and eventually goes down to 0%. Should I open another instance of the same app, everything repeats. I already tested this on two CAD workstations having the NOD32V3 installed and both had the same results. Please help...Thanks
Thread Status:
Not open for further replies.