NOD32 v4.2 and Veritas Backup Exec 10

Hi,
We recently switched AV from corporate CA Antivirus to NOD32 Business Edition. It is working great so far except for on of our servers, this server also happens to hold a 500GB drive which is the company file share.

The actual problem we are having is with our Backup software (Veritas Backup Exec 10) and it only started happening once we switched to Nod32. What is happening is our backups on this one server are taking from 1 to 1.5 hours longer, but only on this server. Our Domain Controller and Exchange server get backed up using the same process just fine. I'm assuming the problem is because we are using VSS/Volume Shadow Copy and Backup Exec (beremote.exe) is writing every file it backs up to some VSS folder and then Nod32 goes and scans every file it puts in there. I've gone into the Nod32 settings and excluded the entire Veritas directory and beremote.exe file that is locally stored on that server as well as told it to only scan for certain extensions but this has not had any change on the problem.

The only way I have gotten the backup to complete in the same time it took before was to completely disable real time protection over night, if this is what we will need to do that is fine but we will need some kind of command line option to enable to disable it, there is no way we can manually do this every night.

The actual drive that is the file share is the F: drive on that server, I stayed up late last night and waited for the backup software to hit that drive and then I took some data using Microsoft Process monitor. I tried to post a small snapshot of some of the events of ekrn.exe and beremote.exe but this forum wanted me to rename the file .txt, so please download the attachment and then change the file extension from .txt to .pml

If anyone can please offer a solution we would be grateful.
Thank you.

 

bcsnick,

Have you applied the following recommended server settings found in this ESET KB article:

http://kb.eset.com/esetkb/index?page=content&id=SOLN2144

Hope this helps.