networked Office 2010 documents and NOD32 4.2.64.12

I noticed this in 4.2.58 as well:

Office 2010 documents open incredibly slowly over the network using the default configuration, sometimes incurring a delay of twenty seconds or longer per document opened (even very small files.)

I still haven't nailed down which setting eliminates this delay, but the delay appears to be caused by the AV settings on the machine hosting the particular file. This is repeatable by disabling the AV on the host machine and testing.

Unchecking 'scan all files' under

Real-time file system protection -> Threatsense engine parameter Setup -> Extensions

appears to remove this delay, although this may just disable scanning of Office 2010 documents altogether, as the new 'docx' and other formats are not included in the default list of extensions.

Has anyone found a good configuration for networked environments where computers are used as both hosts and clients for different file stores, while still allowing for scanning of Office 2010 documents over the network?

 

Do you happen to have any collaboration features enabled on the documents, like tracking changes? Or is this simply happening with every document?

I've seen this with other AV products as well and I've never figured out what Office is doing that inspires this behavior in AV software. I've not had the same issue with other office suites like OpenOffice.

 

The documents I've tested don't have tracking changes or other collaboration features enabled.

 

You could try disabling "network drive" scanning from within the advanced setup, under "Real-time file system protection".

Provided you have AV installed on the file server, there is no need to have the client machines scanning the shares as well.

 

I'm not using any dedicated file servers. I have multiple machines networked, and each uses files on the others. When I use the words 'host' and 'client' I'm describing a particular use of a file, that resides on a host, and accessed by a client machine.

The problem is not with any settings on the client machine. Disabling network scanning, on either the host or client computers, has no impact on the file open delay when accessing networked files. Only modifying the settings on the host computer has any effect on file access times.

The only option to prevent the file open delay appears to be to remove the affected extensions (docx, pptx, xlsx) from the extensions scanned on the computers HOSTING the files. But since all of my computers host different sets of files, this effectively means no scanning of these files, which is obviously a potential vulnerability.

This wasn't an issue with 4.2.40, and I'm disappointed that I'm having problems with these newer releases and shared-over-a-network Office documents.

If anyone has other suggestions I'd welcome them.

 

I think I've identified what might be going on.

It appears the computer hosting a shared Office file is choking when trying to scan Office files once those files are accessed remotely.

If I remove the Office extensions from the Real-time file system protection threatsense engine parameters, but leave Document protection integrated and enabled (on all extensions), then Office files still get scanned on the host computer upon file access but the system doesn't choke in the process.

What is strange is that if I disable document protection, but leave Office files still scanned under real-time file system protection, I'm still getting file open delays when accessing files remotely.

 

I have exactly the same problem on my Win2008R2 fileservers.
When you place some office documents on the netlogon share then even the file replication service is going to crash...
My temporarly solution is disabling the "Scan on File open" option within the "Real-time file system protection" settings.
(https://www.wilderssecurity.com/showthread.php?t=280162)

Regards,
Rene.

 

The obvious problem is the lack of scanning when opening files using that method, although it does solve the file open delay.

If you exclude the affected extensions from real time scanning (docx, pptx, etc) but leave document protection enabled on all files, then you still have the benefit of scanning upon 'file open' events, without the delay.

 

Having the same problem which brought me to this forum:

At home I have 1 Laptop which is running Windows 7 Pro 32-bit and has EAV BE 4.2.58.3. I have split my hard drive into two partitions: C and L.
L is accessible by my main PC also so both computers have the same L: drive.
The main computer is running Windows 7 Pro 32-bit as well and has EAV 4.0.314.0 installed.

Note I previously had the same EAV Home Edition 4.0.314.0 installed on my laptop where the .XLS files sit. With this configuration I had NO PROBLEM.
I only recently installed EAV BE 4.2.58.3 with default settings and since doing so, opening a file which exists on my laptop (the host of L: drive) from my main PC (which has network access to L: drive) takes about 10 seconds to open the XLS file. It takes about 5 seconds to close the file.

I fiddled with settings, and only disabling real-time protection on the host (the laptop) helped . Turning off document-protection made no difference and is not the problem. Adding .XLS files to the exclusions list also solves the problem. Interestingly, disabling all the scan types (signature, heurists, spyware) doesn't solve the problem. My L: drive is a truecrypt partition BUT I tested opening a file from a shared folder on C drive and had the same delay. I can only say the problem is out of my hands and needs to be addresses in a new update, until then, I guess the only thing to do is to add XLS files to the exclusion list.

PS I am using Excel 2007.

One more interesting fact: opening the same file from the laptop does not exhibit the same delay.
Also: the laptop freezes up as well when the pc accessing the file freezes. CPU load goes right up to 60% on 4 cores.

Edit: Just upgraded to 4.2.64.12 and have the same problem. (I'm glad it supports Thunderbird 3.1 now)

 

The only affected files appear to be Office files, and I'm guessing it has something to do with NOD32's attempt to use the Office antivirus scanning API. If you open a PDF document (or any non-office document) you don't experience the delay.

If you exclude the affected Office file extensions from real-time scanning, but leave Document Protection integrated and enabled, then the Office files are still scanned - if you closely monitor the files scanned using the statistics window, you can confirm this yourself.

Oddly enough, as you already observed, disabling document protection doesn't fix the file open delay.

 

Is this just .xls or is it also .xlsx/.xlsm ? The latter are actually zip files so I'm just wondering if it's something to do with the files getting extracted. Just a thought....

 

Delay exists on an .xlsx file as well
No delay on my openoffice spreadsheet documents .ods

 

It appears to be any Microsoft Office document type (ppt, pptx, doc, docx, etc.)

Changing various options, like archive extraction options, has no impact on the file open delay. With the exceptions noted above, of course.

 

No problems opening Office documents from a Windows 7 share mapped as a network drive on WinXP here. Is there something special about the computers having issues? Do you have some non-standard software installed?

 

Did this to generate a report of software installed on the laptop (host). I haven't enabled any of the HP drive encryption. The HP software is preinstalled as this is an HP ProBook 4520S.

Name / Version
Microsoft Application Error Reporting 12.0.6012.5000
Microsoft Office OneNote MUI (English) 2010 14.0.4763.1000
Microsoft Office Access MUI (English) 2010 14.0.4763.1000
Microsoft Office Shared Setup Metadata MUI (English) 2010 14.0.4763.1000
Microsoft Office Excel MUI (English) 2010 14.0.4763.1000
Microsoft Office Access Setup Metadata MUI (English) 2010 14.0.4763.1000
Microsoft Office PowerPoint MUI (English) 2010 14.0.4763.1000
Microsoft Office Publisher MUI (English) 2010 14.0.4763.1000
Microsoft Office Outlook MUI (English) 2010 14.0.4763.1000
Microsoft Office Word MUI (English) 2010 14.0.4763.1000
Microsoft Office Proofing (English) 2010 14.0.4763.1000
Microsoft Office Single Image 2010 14.0.4763.1000
Microsoft Office Shared MUI (English) 2010 14.0.4763.1000
Microsoft Office Proof (English) 2010 14.0.4763.1000
Microsoft Office Proof (Spanish) 2010 14.0.4763.1000
Microsoft Office Proof (French) 2010 14.0.4763.1000
ArcSoft TotalMedia 1.0.33.17
Device Access Manager for HP ProtectTools 5.0.1.5
HP Customer Experience Enhancements 6.0.1.3
Corel Home Office 5.5
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 8.0.50727.4053
Cerberus FTP Server 3.0.18
Validity Fingerprint Driver 4.0.10.0
Corel Home Office - Templates RU 5.4.5
Corel Home Office - Launcher 5.5
LightScribe System Software 1.18.6.1
Corel Home Office - CT Templates 5.4.5
HP Software Setup 7.0.1.5
Windows Mobile Device Center 6.1.6965.0
HP Wireless Assistant 4.0.3.2
Corel Home Office - CS Templates 5.4.5
File Sanitizer For HP ProtectTools 5.0.1.2
HP HotKey Support 3.5.13.1
ArcSoft Webcam Sharing Manager 1.0.0.26
HP ESU for Microsoft Windows 7 1.0.5.1
HP Wallpaper 1.0.1.3
Face Recognition for HP ProtectTools 2.01.651
Corel Home Office 5.5
BDE 1.00.0000
HP Integrated Module with Bluetooth wireless technology 6.2.1.500
OpenOffice.org 3.1 3.1.9420
Java(TM) 6 Update 16 6.0.160
HP Support Assistant 4.4.6.3
Windows Mobile Device Center Driver Update 6.1.6965.0
HPAsset component for HP Active Support Library 3.0.0.3
HP Power Assistant 1.0.3.2
Cisco PEAP Module 1.1.6
Adobe Reader 9.3.3 9.3.3
HP 3D DriveGuard 4.0.4.1
HP Software Framework 3.5.13.1
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 9.0.21022
Windows Live Sign-in Assistant 5.000.818.5
Cisco LEAP Module 1.0.19
Drive Encryption for HP ProtectTools 5.0.4.0
Cisco EAP-FAST Module 2.2.14
Microsoft Sync Framework Runtime Native v1.0 (x86) 1.0.1215.0
HP SoftPaq Download Manager 3.0.5.0
MSVCRT 14.0.1468.721
ESET NOD32 Antivirus 4.2.64.12
HP Power Data 1.0.7.77
HP 3.00.0000
Windows Live Essentials 14.0.8089.726
Microsoft Office PowerPoint Viewer 2003 11.0.6458.0
Windows 7 Default Setting 1.0.1.4
HP User Guides 0189 1.01.0000
Corel Home Office - KR Templates 5.4.5
HP Connection Manager 3.1.1
Microsoft Sync Framework Services Native v1.0 (x86) 1.0.1215.0
Windows Live Communications Platform 14.0.8098.930
ActiveCheck component for HP Active Support Library 3.0.0.3
Skype™ 4.2 4.2.169
Microsoft Choice Guard 2.0.48.0
Privacy Manager for HP ProtectTools 5.01.734
Microsoft Visual C++ 2005 Redistributable 8.0.56336
Theft Recovery 5.1.0.18
Windows Live Messenger 14.0.8089.0726
SimpLite-MSN 2.2 02.02.0027
Pre-Boot Security for HP ProtectTools 5.0.7.1
Windows Live Call 14.0.8064.0206
Qualcomm Gobi 2000 Package for HP 1.1.18
HP Advisor 3.3.9512.3162
Seagate*DiscWizard 11.0.8326
Corel Home Office - Templates1 5.4.5
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 9.0.30729
Microsoft Silverlight 4.0.50524.0
32 Bit HP CIO Components Installer 4.1.1
Microsoft Search Enhancement Pack 1.2.123.0
Windows Live Upload Tool 14.0.8014.1029
Windows Live Toolbar 14.0.8064.206
Corel Home Office - IPM 5.5
Corel Home Office - JP Templates 5.4.5
HP ProtectTools Security Manager 5.03.637

 

I'm using Windows 7 64-bit to Windows 7 64-bit, and networked through Homegroup.

I'm not using networked drives.

I'm not aware of any software that my computers have in common that could account for the file open delay with regard to Microsoft Office files, other than the Office 2010 suite itself.

Like MasterAnt, 4.2.40 did not have this issue for me; only 4.2.58 and 4.2.64.12.

I also experience a file open delay when using a Win 7 64-bit Office 2010 computer without ESET installed to access files on a host computer using Eset.

The only way to prevent the delay appears to be to exclude the affected files from real-time scanning on computers hosting such files, although as noted above the 'document protection' feature appears to still scan Office documents on both host and client computers involved.

All computers experiencing this problem have the latest Windows updates, run Windows 7 64-bit, are networked using Homegroup and non-mapped shared folders, and have Office 2010 32-bit installed.

 

I'm also experiencing the same delay when accessing Office files on a Windows 7 64-bit host with NOD32 from a Vista 32-bit client with Office 2007 and NOD32 installed.

The files were in a shared folder, but the folder wasn't mapped as a network drive.

 

I am seeing the same problem - Win2008R2 64bit - on the file server (host) I have temporarily disabled scanning on open file and that seems to have solved it for now

 

My problem seems to have progressed in severity today. During a skype text conversation (on my laptop where NOD32 is causing the delays with the Office files), I experienced freezes every few seconds. First I system restored, thinking it was a new quicktime I just installed. That didn't help. I removed Skype, wiped all the appdata folders, reinstalled and it was still a problem. Then I thought my laptop hard drive was faulty, so I started copying files off my hard drive. And oddly, during file copy, I had the same pauses on other files every now and then - not office docs, and not just at the beginning of access to the file. A random thought popped into my head to disable NOD32 realtime scanning on files, and guess what, everything is working perfectly!! Actually, more specifically, I disabled signature scanning only and it solved it too. I'm going to try do a Nod32 cleanup and reinstall later, will post if it solves anything. First, completing my backup...

 

I've tried a complete cleanout of NOD32 and reinstall, but no change in the behavior we're experiencing.

 

Thanks to Marcos, my Office docs problem seems to be resolved.
Not just using the new version 4.2.65, but also by using the clean wipe uninstaller from safe mode. First I upgraded to this version and it still jammed up. I tried wiping the program and obvious folders in appdata myself from normal mode before and it didn't help. Do the safe mode uninstall first as per the knowledgebase article (search for it).

The only thing I'm noticing now is when I backup my laptop, scanning seems to bottleneck when copying thousands of files to another drive (actually I was zipping them, so perhaps it was because CPU was overutilised?) But, that's subject for another forum topic if it becomes a bigger problem. Anyone with a quick solution, plz pm me.

 

Something I've run across on Win7 machines is slow saving MS office files on network drives. Mainly on shares with offline settings enabled. There is an option in Windows 7 to disable indexing of offline files. When I did this the problem went away.

 

4.2.65 solved my problems as well. Thanks for the work on this, Eset.

 

The problems described in this thread aren't related to slow saving of MS files, but the slow opening of them. I haven't experienced a slowdown in saving.

 

Where did you get NOD32 ver. 4.2.65 from?

At http://www.eset.com/download I can see only ver. 4.2.64.12.

-- rpr.