BackupAssist and NOD32 Incompatibility

Discussion in 'ESET NOD32 Antivirus' started by BackupAssist, Apr 28, 2011.

Thread Status:
Not open for further replies.
  1. BackupAssist
    Offline

    BackupAssist Registered Member

    Hi there,

    It’s Stuart here and I work for Cortex IT, who develop backup software called BackupAssist.

    We’ve had a few of our resellers (who also sell NOD32) which have been experiencing the Blue Screen of Death during the backup process on some servers.
    Upon analysing the crash dump from some customers, it’s stated that the process causing the crash is ekrn.exe – which is a NOD32 process.

    We have tried countless times to replicate the issue in house however have not been successful in doing so.
    Our resellers have stated that if they uninstall NOD 32 for a few days, the BSOD disappears but then reappears when NOD32 is re-installed.

    I’m writing this to hopefully open up a line of communication between ESET and Cortex in the hopes that we can find a resolution.

    Please let me know what information you’d require and we’ll try to accommodate you as best we can.

    Thanks in advance and awaiting your response.

    Stuart
  2. Marcos
    Online

    Marcos Eset Staff Account

    Hello,
    the fact that ekrn is listed as the culprit does not necessarily mean that the problem actually lies in ekrn. First of all, make sure that the isssue occurs with the latest version of EAV 4.2.71 installed. If so, please get a complete memory dump generated during BSOD. When done let me know so that I can provide you with further instructions.
  3. cgreentx
    Offline

    cgreentx Registered Member

    The majority of the systems we are experiencing this problem with are running MS Exchange and therefore have the XMON version installed. We can not run 4.2.71 on those servers. The servers are setup with exclusions as directed by ESET tier 3 support due to the lockup issues for Windows 2008+ servers and have operated fine other than random blue screens during backups. Cortex IT is making an effort to reach out for help here and we are stuck in the middle on this one. As a MSP who resells BackupAssist and has NOD32 installed at nearly every client we need a solution.

    Chris Green
    Director of Technology
    Solerant, LLC
  4. BackupAssist
    Offline

    BackupAssist Registered Member

    Hi,

    It's Stuart here again.

    As mentioned by Chris, the version which you've indicated isn't able to be installed within that particular environment (running Exchange). Do you have a specific version (with direct download link) which we can relay to our customers using this type of environment to avoid unnecessary hold ups?

    Thanks in advance.
  5. dmaasland
    Offline

    dmaasland Registered Member

    Have you tried ESET Mail Security for Microsoft Exchange server 4.3.10016.0?
  6. Marcos
    Online

    Marcos Eset Staff Account

    The latest version of ESET Mail Security for MS Exchange is 4.3. This version features automatic exclusions per the recommendations by Microsoft and also has application protocol filtering disabled by default (equal to renaming the epfwwfpr.sys driver) to prevent a bug in MS Windows Filtering Platform from manifesting.
    Should you get a BSOD with EMSX 4.3, we'd need you to provide us with a kernel (or better complete) memory dump to tell if the problem lies in EMSX or another driver / software you use.
  7. agoretsky
    Offline

    agoretsky Eset Staff Account

    Hello,

    Just to clarify, XMON is (or was) the nickname for NOD32 for Exchange, which was ESET's old product for Microsoft Exchange. NOD32 for Exchange was based on the NOD32 2.7 engine, which is now several years old and no longer being actively developed.

    ESET Mail Security for Microsoft Exchange Server ("EMSX") is the replacement for NOD32 for Exchange, and is a free upgrade for licensed users. Customers may need to get a new license key issued, though, because the structure of the license key may have changed. That can be done by using the form here or by contacting the sales department at +1 (866) 343-3738 to have a replacement license issued.

    Regards,

    Aryeh Goretsky
  8. thaurron
    Offline

    thaurron Registered Member

    Hi,

    We also have compatibility issues with NOD32 and BackupAssist on a production serveur causing BSOD.

    Here's the dump file http://dl.dropbox.com/u/19815347/050311-125627-01.zip

    It happens at the end of almost every backups and it stopped as soon has we uninstalled NOD32 from the server.

    Before uninstalling we were running NOD32 Antivirus 4 version 4.0.474.0 on a IBM server with Windows Server 2008 R2 Fundation SP1 x64.

    Thanks !

    Hugues Lavallee
    Progel Inc.
  9. cgreentx
    Offline

    cgreentx Registered Member


    As a LOOOOONG time user of ESET NOD32 at hundreds of my customers I'm very prone to use old names for the modules. We are currently beginning testing of 4.3.x to see if it solves the problems.

    Chris Green
  10. cgreentx
    Offline

    cgreentx Registered Member

    We just received notification of this version yesterday and will begin installing it to test immediately. Do the automatic exclusions include ALL required server settings, or is there an updated guide with things that need to be disabled?

    As a request, there really should be a customer/reseller notification email when a new release of NOD32 happens. With hundreds of customers on NOD32 its hard enough to keep them current without relying on luck to find that there is an update.

    Chris Green
  11. cgreentx
    Offline

    cgreentx Registered Member

    Mail Security 4.3.x did not fix the issue. Our techs loaded it on one of our problematic servers yesterday and the server hard-locked again. There is no dump that I can send you as the hard lockup situation does not generate one. What do we need to do in order to get ESET and CortexIT working together? This forum is NOT the right place for this effort.

    Chris Green
    Director of Technology
    Solerant, LLC

    **Correction - The server locked up well after backups completed successfully on this server. We will be opening a ticket with ESET on this one and proceed with putting NOD32 back on our BA servers to continue the test.
    Last edited: May 25, 2011
  12. cgreentx
    Offline

    cgreentx Registered Member

    This issue has continued to plague us. NOD32 and BackupAssist do not get along and I don't think either company cares to solve this problem. Why is neither party jumping through hoops to solve this problem?
  13. dmaasland
    Offline

    dmaasland Registered Member

    Perhpaps it's better to open a support ticket with ESET about this. Are they by any chance virtual servers?
  14. cgreentx
    Offline

    cgreentx Registered Member

    We've already gone down the disable this, disable that roue with ESET support and got nowhere. I'm baffled why the two companies won't work together. We have thousands of seats of NOD32 in production and it matters not apparently.
  15. dmaasland
    Offline

    dmaasland Registered Member

    If you have the Full memory dump (So not a kernel of minidump) along with a sysinspector log and exported settings, you can give those to support and they should be able to identify the exact source of the problem.
  16. cgreentx
    Offline

    cgreentx Registered Member

    Ever tried uploading a 24GB memory dump over a T1? :)
  17. BackupAssist
    Offline

    BackupAssist Registered Member

    Hi all,

    It’s Jason here from Cortex IT, lead developer of BackupAssist.

    We're currently in discussions with ESET, and will update this thread as soon as we can.

    IMPORTANT: users of BackupAssist experiencing this issue should contact BackupAssist support at support_at_backupassist.com for a workaround that avoids the blue screens.

    Hope this helps,
    Jason Schultz
    Development Team Lead - BackupAssist
  18. agoretsky
    Offline

    agoretsky Eset Staff Account

    Hello,

    Issue is under investigation. Thank you for your reports.

    Regards,

    Aryeh Goretsky
  19. BackupAssist
    Offline

    BackupAssist Registered Member

    Hi everyone,

    As mentioned by ESET, they have been investigating this issue and have provided us with a patch.
    We are planning to complete our testing this month and will update this thread as soon as we can.

    In the meantime, please post your interest on this forum to ensure ESET are aware of your situation.

    Thanks,
    Stuart
    The BackupAssist Team
    Last edited: Sep 12, 2011
  20. thaurron
    Offline

    thaurron Registered Member

    Hi There,

    Is there a patch beside changing the createFileCatalogue value in the job config file of Mobicontrol ?

    Thanks !

    Hugues Lavallee
    Progel Inc.
  21. BackupAssist
    Offline

    BackupAssist Registered Member

    Hi again everyone,

    Just an update to say we've had some positive results with testing the patch which was provided by the ESET team. We installed the patch a week ago and the system hasn't blue screened at all and all backups have been successful.

    As mentioned earlier, if you're interested in applying this to your machine please contact ESET for details on obtaining the patch.

    Thank you,

    Stuart
    The BackupAssist Team
  22. agoretsky
    Offline

    agoretsky Eset Staff Account

    Hello,

    Thank you for the feedback.

    Regards,

    Aryeh Goretsky
  23. ezwep
    Offline

    ezwep Registered Member

    Where can I download the patch? I use the Eset Antivirus and the Eset Exchange Antivirus on my servers.
  24. agoretsky
    Offline

    agoretsky Eset Staff Account

    Hello,

    Private message sent.

    Regards,

    Aryeh Goretsky
  25. BSStech
    Offline

    BSStech Registered Member

    I'm another looking for this patch for ESET and BackupAssist

    thanks
Thread Status:
Not open for further replies.