BackupAssist and NOD32 Incompatibility

Discussion in 'ESET NOD32 Antivirus' started by BackupAssist, Apr 28, 2011.

Thread Status:
Not open for further replies.
  1. BackupAssist

    BackupAssist Registered Member

    Joined:
    Apr 28, 2011
    Posts:
    5
    Hi there,

    It’s Stuart here and I work for Cortex IT, who develop backup software called BackupAssist.

    We’ve had a few of our resellers (who also sell NOD32) which have been experiencing the Blue Screen of Death during the backup process on some servers.
    Upon analysing the crash dump from some customers, it’s stated that the process causing the crash is ekrn.exe – which is a NOD32 process.

    We have tried countless times to replicate the issue in house however have not been successful in doing so.
    Our resellers have stated that if they uninstall NOD 32 for a few days, the BSOD disappears but then reappears when NOD32 is re-installed.

    I’m writing this to hopefully open up a line of communication between ESET and Cortex in the hopes that we can find a resolution.

    Please let me know what information you’d require and we’ll try to accommodate you as best we can.

    Thanks in advance and awaiting your response.

    Stuart
     
  2. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,332
    Hello,
    the fact that ekrn is listed as the culprit does not necessarily mean that the problem actually lies in ekrn. First of all, make sure that the isssue occurs with the latest version of EAV 4.2.71 installed. If so, please get a complete memory dump generated during BSOD. When done let me know so that I can provide you with further instructions.
     
  3. cgreentx

    cgreentx Registered Member

    Joined:
    Oct 3, 2008
    Posts:
    8
    The majority of the systems we are experiencing this problem with are running MS Exchange and therefore have the XMON version installed. We can not run 4.2.71 on those servers. The servers are setup with exclusions as directed by ESET tier 3 support due to the lockup issues for Windows 2008+ servers and have operated fine other than random blue screens during backups. Cortex IT is making an effort to reach out for help here and we are stuck in the middle on this one. As a MSP who resells BackupAssist and has NOD32 installed at nearly every client we need a solution.

    Chris Green
    Director of Technology
    Solerant, LLC
     
  4. BackupAssist

    BackupAssist Registered Member

    Joined:
    Apr 28, 2011
    Posts:
    5
    Hi,

    It's Stuart here again.

    As mentioned by Chris, the version which you've indicated isn't able to be installed within that particular environment (running Exchange). Do you have a specific version (with direct download link) which we can relay to our customers using this type of environment to avoid unnecessary hold ups?

    Thanks in advance.
     
  5. dmaasland

    dmaasland Registered Member

    Joined:
    Nov 10, 2010
    Posts:
    468
    Have you tried ESET Mail Security for Microsoft Exchange server 4.3.10016.0?
     
  6. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,332
    The latest version of ESET Mail Security for MS Exchange is 4.3. This version features automatic exclusions per the recommendations by Microsoft and also has application protocol filtering disabled by default (equal to renaming the epfwwfpr.sys driver) to prevent a bug in MS Windows Filtering Platform from manifesting.
    Should you get a BSOD with EMSX 4.3, we'd need you to provide us with a kernel (or better complete) memory dump to tell if the problem lies in EMSX or another driver / software you use.
     
  7. agoretsky

    agoretsky Eset Staff Account

    Joined:
    Apr 4, 2006
    Posts:
    4,030
    Location:
    California
    Hello,

    Just to clarify, XMON is (or was) the nickname for NOD32 for Exchange, which was ESET's old product for Microsoft Exchange. NOD32 for Exchange was based on the NOD32 2.7 engine, which is now several years old and no longer being actively developed.

    ESET Mail Security for Microsoft Exchange Server ("EMSX") is the replacement for NOD32 for Exchange, and is a free upgrade for licensed users. Customers may need to get a new license key issued, though, because the structure of the license key may have changed. That can be done by using the form here or by contacting the sales department at +1 (866) 343-3738 to have a replacement license issued.

    Regards,

    Aryeh Goretsky
     
  8. thaurron

    thaurron Registered Member

    Joined:
    May 20, 2011
    Posts:
    2
    Hi,

    We also have compatibility issues with NOD32 and BackupAssist on a production serveur causing BSOD.

    Here's the dump file http://dl.dropbox.com/u/19815347/050311-125627-01.zip

    It happens at the end of almost every backups and it stopped as soon has we uninstalled NOD32 from the server.

    Before uninstalling we were running NOD32 Antivirus 4 version 4.0.474.0 on a IBM server with Windows Server 2008 R2 Fundation SP1 x64.

    Thanks !

    Hugues Lavallee
    Progel Inc.
     
  9. cgreentx

    cgreentx Registered Member

    Joined:
    Oct 3, 2008
    Posts:
    8

    As a LOOOOONG time user of ESET NOD32 at hundreds of my customers I'm very prone to use old names for the modules. We are currently beginning testing of 4.3.x to see if it solves the problems.

    Chris Green
     
  10. cgreentx

    cgreentx Registered Member

    Joined:
    Oct 3, 2008
    Posts:
    8
    We just received notification of this version yesterday and will begin installing it to test immediately. Do the automatic exclusions include ALL required server settings, or is there an updated guide with things that need to be disabled?

    As a request, there really should be a customer/reseller notification email when a new release of NOD32 happens. With hundreds of customers on NOD32 its hard enough to keep them current without relying on luck to find that there is an update.

    Chris Green
     
  11. cgreentx

    cgreentx Registered Member

    Joined:
    Oct 3, 2008
    Posts:
    8
    Mail Security 4.3.x did not fix the issue. Our techs loaded it on one of our problematic servers yesterday and the server hard-locked again. There is no dump that I can send you as the hard lockup situation does not generate one. What do we need to do in order to get ESET and CortexIT working together? This forum is NOT the right place for this effort.

    Chris Green
    Director of Technology
    Solerant, LLC

    **Correction - The server locked up well after backups completed successfully on this server. We will be opening a ticket with ESET on this one and proceed with putting NOD32 back on our BA servers to continue the test.
     
    Last edited: May 25, 2011
  12. cgreentx

    cgreentx Registered Member

    Joined:
    Oct 3, 2008
    Posts:
    8
    This issue has continued to plague us. NOD32 and BackupAssist do not get along and I don't think either company cares to solve this problem. Why is neither party jumping through hoops to solve this problem?
     
  13. dmaasland

    dmaasland Registered Member

    Joined:
    Nov 10, 2010
    Posts:
    468
    Perhpaps it's better to open a support ticket with ESET about this. Are they by any chance virtual servers?
     
  14. cgreentx

    cgreentx Registered Member

    Joined:
    Oct 3, 2008
    Posts:
    8
    We've already gone down the disable this, disable that roue with ESET support and got nowhere. I'm baffled why the two companies won't work together. We have thousands of seats of NOD32 in production and it matters not apparently.
     
  15. dmaasland

    dmaasland Registered Member

    Joined:
    Nov 10, 2010
    Posts:
    468
    If you have the Full memory dump (So not a kernel of minidump) along with a sysinspector log and exported settings, you can give those to support and they should be able to identify the exact source of the problem.
     
  16. cgreentx

    cgreentx Registered Member

    Joined:
    Oct 3, 2008
    Posts:
    8
    Ever tried uploading a 24GB memory dump over a T1? :)
     
  17. BackupAssist

    BackupAssist Registered Member

    Joined:
    Apr 28, 2011
    Posts:
    5
    Hi all,

    It’s Jason here from Cortex IT, lead developer of BackupAssist.

    We're currently in discussions with ESET, and will update this thread as soon as we can.

    IMPORTANT: users of BackupAssist experiencing this issue should contact BackupAssist support at support_at_backupassist.com for a workaround that avoids the blue screens.

    Hope this helps,
    Jason Schultz
    Development Team Lead - BackupAssist
     
  18. agoretsky

    agoretsky Eset Staff Account

    Joined:
    Apr 4, 2006
    Posts:
    4,030
    Location:
    California
    Hello,

    Issue is under investigation. Thank you for your reports.

    Regards,

    Aryeh Goretsky
     
  19. BackupAssist

    BackupAssist Registered Member

    Joined:
    Apr 28, 2011
    Posts:
    5
    Hi everyone,

    As mentioned by ESET, they have been investigating this issue and have provided us with a patch.
    We are planning to complete our testing this month and will update this thread as soon as we can.

    In the meantime, please post your interest on this forum to ensure ESET are aware of your situation.

    Thanks,
    Stuart
    The BackupAssist Team
     
    Last edited: Sep 12, 2011
  20. thaurron

    thaurron Registered Member

    Joined:
    May 20, 2011
    Posts:
    2
    Hi There,

    Is there a patch beside changing the createFileCatalogue value in the job config file of Mobicontrol ?

    Thanks !

    Hugues Lavallee
    Progel Inc.
     
  21. BackupAssist

    BackupAssist Registered Member

    Joined:
    Apr 28, 2011
    Posts:
    5
    Hi again everyone,

    Just an update to say we've had some positive results with testing the patch which was provided by the ESET team. We installed the patch a week ago and the system hasn't blue screened at all and all backups have been successful.

    As mentioned earlier, if you're interested in applying this to your machine please contact ESET for details on obtaining the patch.

    Thank you,

    Stuart
    The BackupAssist Team
     
  22. agoretsky

    agoretsky Eset Staff Account

    Joined:
    Apr 4, 2006
    Posts:
    4,030
    Location:
    California
    Hello,

    Thank you for the feedback.

    Regards,

    Aryeh Goretsky
     
  23. ezwep

    ezwep Registered Member

    Joined:
    Apr 29, 2011
    Posts:
    1
    Where can I download the patch? I use the Eset Antivirus and the Eset Exchange Antivirus on my servers.
     
  24. agoretsky

    agoretsky Eset Staff Account

    Joined:
    Apr 4, 2006
    Posts:
    4,030
    Location:
    California
    Hello,

    Private message sent.

    Regards,

    Aryeh Goretsky
     
  25. BSStech

    BSStech Registered Member

    Joined:
    Dec 10, 2008
    Posts:
    1
    I'm another looking for this patch for ESET and BackupAssist

    thanks
     
Thread Status:
Not open for further replies.