Problem Downloading Large Files

Hi,
I been using NOD for many years with great satisfaction, yesterday I encountered a problem which I can not solve. I hope someone here can help me sort it out.

OS = WinXP PRO (SP2) Fully Updated.
AV = NOD32 2.7
FW = Outpost Firewall PRO 4.09
Browsers = Opera / IE 7

Firstly let me say I confirmed this problem is related to NOD because when I uninstall NOD the problem goes away.

The Problem:
When I download large files usually 70+(megs) my browser hangs/crashes when the file is around 99.8% completed. When I check task manager it shows NOD kernal is using up 40-80% CPU power.

What I Did:
Like I said NOD has been running flawlessly for years on my system. Yesterday I used a program called (TCP OPTIMIZER) it does what it says on the tin. It improved my connection from 4.5 to 6.5mbits very nice indeed.

What I Tried:
I have tried un/re-installing Opera.
I have tried un installing NOD/deleting folder/running reg cleaner/re-installing.
I have tried restoring reg settings to what they where before TCP was run.
I have tried turning off passive scanning in IMON.

I got a hunch this has something to do with the file being scanned when its moved from the temp download folder to the destination folder, but other than that I'm stuck.

Regards Set.

 

hello, Set!
Welcome to Wilders!
You may try to switch at client compatibility to "Higher compatibility" rather than "Higher efficiency".

 

Hi pykko,

Thanks for the welcome, is this a confirmed fix for my problem? I'm at work at the moment and can't check, I'm not 100% sure but I think I might have tried what you suggested already.

Set.

 

Well, it's not 100% sure it will work but you may try it. It could be the proper solution.

 

Well this is driving me mad, so ok, I tried what pykko suggested, and it didn't work. I then disabled IMON alltogether and the file downloaded, but the browser still crashed and nod32krn opened another instance of itself and is again using 60-90% of CPU power.

This is so wierd because I have never had a problem with NOD before and this seems to have come out of nowhere. I have always installed NOD with default settings and it has always worked prefectly until yesterday.

P.S. Thanks for trying pykko.

 

So after you ran that TCP application, did you try to hit repair in IMON & restart?
IMON > Setup > Misc > Repair now button

If that doesn't work then take a look here: https://www.wilderssecurity.com/showthread.php?p=907638#post907638

 

Brain just as you were posting, I was re booting after repairing network connections in IMON. Thought maybe that was it, but it failed too. In your post you suggest reading a post by blackspear, I presume you mean the part to do with repairing winsock. Well as far as I know my internet is working fine, as I dont have this problem with other AV's just with NOD and just since yesterday.

Is it possible something in Winsock is causing NOD not to function but not effecting other anti virus scanners?

 

That's usually the case, yes. I suggest you try it out since you used a TCP application so it could have messed up IMON's "entry" to the winsock.

 

Well, that didnt work either exactly the samething keeps happening. File almost downloads then nod32krn goes from virtually no CPU usage to 60-90% usage. Browser crashes and I got to terminate NOD using task manager to get system back to normal.

Any other ideas, suggestions?

P.S thanks Brian for trying.

 

Is the file a self-extractor, for example an installer? If this is the case NOD32 will unpack and scan it before IE moves it out of the temp folder. This will cause IE to freeze whilst the scanning is going on.

When you say it hangs, how long have you left it for? I have just tried downloading the OpenOffice.org 2.1 installer which is 90MB or so, and NOD32 has been scanning it for the past few minutes and is still going.

Maybe what is needed is a progress meter for background scanning - if it takes longer than 15 seconds say. I would suggest just leaving NOD32 scanning and see if it finally finishes.

 

Proactive, I mostly download installers/zipped files, and yes sometimes NOD used to take maybe a minute to scan large files, but I have left the computer alone for 20 minutes scanning a file of 70 megs and still nothing. It seems to be getting caught in a loop if I terminate nod32krn using task manager the download process completes. Ok so this is what I've tried any other suggestions greatly appreciated.

un/re-installing Opera.
un installing NOD/deleting folder/running reg cleaner/re-installing.
restoring reg settings to what they where before TCP OPTIMIZER was run.
turning off passive scanning in IMON.
setting client compatability to efficent, then all to higher compatability.
repairing Winsock and repairing IMON
searching through services for conflicts

This is a new problem no one has had this before?

Thanks

 

I'd say this isn't IMON, it's AMON scanning the file as it's being saved to disk.

I don't have NOD32's AMON scanning self-extracting files, partly due to this. Of course, I scan the file manually once it's downloaded, and even if I didn't AMON would catch anything malicious that tried to execute.

Try downloading Filemon, set the filter to only include nod32krn.exe and see if it makes progress through the file or if it is indeed getting stuck in a loop.

 

Proactive,
I tried downloading the file with AMON(self-extracting files) excluded, hangs. I tried downloading the file with IMON(disabled) and AMON(self-extracting files) included. File downloads completely, but hangs when copying to destination directory.

I also tried downloading the file IMON(disabled) and AMON(self-extracting files) excluded, same result as step 2. Looks like there is a problem with both AMON and IMON LOL.

Here are the results of Filemon I dont know if you can make any sense out of it, but to me there does appear to be a loop involved. http://img214.imageshack.us/img214/3851/loopll6.jpg

Thanks

*off to look for my sledgehammer see if it can fix it.

 

Have you tried disabling AMON* and seeing if that helps?

Looking at the picture I would say that NOD32 is extracting each file and saving it to temp. Is there any chance you could save a couple of minutes of filemon logs and pm them to me? (to save cluttering the thread)

*There are two parts to AMON that can be disabled, you can untick "AMON enabled" in it's page and also, to go further, go into Setup->Security->Allow manual stopping, then OK and "Stop" AMON.

 

A snippet of the filemon log:

As you can see the "Offset" is increasing, which is NOD32 reading through a file, rather than getting stuck.

 

Well,
It seems it was just a matter of letting NOD work through it. It took 50minutes to scan this one particular file, I dunno what happened really, but now when I download a file its back to between 1-3 minutes depending on file size. So I'm happy!

@Proactive:
Professional, friendly computer support based in Hampshire, UK.
Sure is! Thanks.

@Others:
Thanks to you.

Well I wish I could contribute to this site but there are many people on here with computer skills far in advance of mine, however if you require a recipe or advice on a cooking technique, I'm your man! LOL.

Mod you can close this one down, thanks!

Regards Set.