USB Hard Disk Detection Issue

Hello Marcos,

I had hoped to keep this away from the public form but over the past few days the PM Service appears to be unavailable so I feel I have been given little choice but to post here for assistance. I hope you will bear with me. Also, I did post this in that other thread but it seems to have been overlooked - may just be that the assumption was made that 5.2.9.1 had resolved this issue. Not so, I'm afraid.

I am another victim of the NOD32 5.0.95/5.2.9.1 USB Hard Disk detection issue under XP (XP Home 32bit, SP3). I submitted a support request to ESET UK with all the relevant material (which included a Complete Memory Dump taken at the time of the system hang and the SysInspector data file). I was advised to uninstall V5 and install V4.2.71.2 and this has 'fixed' the problem. However, there appears to be a remaining issue in that at first boot everything seems to load quickly, but nothing happens when I click on a Desktop icon and no programs, including Task Manager, will run. Explorer will only open 'My Computer' but right-clicking is inactive. A restart resolves this issue. This was also a problem with V5 and also I noted on many occasions that several system tray icons failed to load. A Shutdown would then take 5-10 minutes.

Now, I do appreciate that going back to version 4 has provided a solution of sorts, but it doesn't help me work out what 3rd party software/driver has been conflicting with NOD32/ Mount Manager. I asked ESET UK again to examine my crash dump but, instead, they referred me to you, Marcos.

Below is a copy of my follow-up e-mail to ESET UK:

"Thank you for responding to my request for support assistance. However, I do have to say that I am feeling disappointed about your apparent reluctance to help troubleshoot this issue for me. Perhaps I should consider posting instead in that thread at Wilders Security Forums as the ESET Moderator, Marcos, seemed very willing to go that extra mile towards finding solutions for all those affected.

Meantime, I have done as you suggested and, perhaps not surprisingly, the system lockups have gone away. After uninstalling V5 I confirmed that USB HD detection had been restored before installing V4. Once again, it was not possible to uninstall V5 while in normal Windows as I was confronted with the message that ‘another application had exclusive access to .....\Charon\Cache.NDB’ What application? Uninstalling using ESET’s uninstaller while in SAFE MODE was successful.

This is proving to be very unsatisfactory. Yes, my system is running again as it should, but to achieve this state after many months of troubleshooting frustration (I never considered that NOD32 might be involved), I have had to downgrade NOD32 Antivirus from V5 to V4. Can you assure me that my system protection remains as secure as it was under V5?

Microsoft will continue to provide support for Windows XP with SP3 until 2014. Can the same be said of ESET for NOD32?

Significant numbers of users around the globe are still under Windows XP and, like myself, are unable to upgrade to Windows 7 without considerable effort and time spent reinstalling and reconfiguring software. Yes, I have a laptop with Windows 7 64 bit, but why should I be forced to abandon a perfectly capable XP based machine while it continues to satisfy my daily needs?

I have applications like Acronis True Image Home (fully updated), Acronis Disk Director and PerfectDisk (V. 12.5) all of which need to access my external USB hard drives from time to time and none cause the problems attributed to ESET’s NOD 32.

You blame 3rd party drivers, but this begs the question as to why other developers appear to have successfully circumvented this issue, unlike ESET who, for a time, seemed unwilling to provide a solution/ workaround for XP users. Surely your developers could incorporate a switch for existing XP users that would disable external USB hard disk detection if problems are being encountered? Effectively, this is the default position in the version 4 build you have had me install.

The lengthy thread and frustrations expressed at the slow response of the ESET developers to provide a solution speak volumes for the quality of support currently being provided. Consequently many are becoming disillusioned with NOD32 and, myself included, are seriously considering moving to another product.

This potential issue should have been anticipated during development when the decision was made to introduce this feature. Under these circumstances, blaming 3rd party drivers, while undoubtedly valid, does seem to be a bit of a cop out, to say the least.

Anyway, back to my problem under Version 5. I would point out that I went to a great deal of effort carrying out all the instructions to enable the provision of all the material needed by your developers to pinpoint the cause on my machine. In particular Marcos, the ESET moderator at Wilders Security Forums stressed the requirement for a complete memory dump taken immediately following the system hang and this I have provided. If I knew which 3rd Party driver was conflicting with NOD32 while XP’s Mount Manager is operating then I would be in a position to do something about it.

I would respectfully remind you that I have been a loyal user of NOD32 for several years. We have 4 licenced installations in our house. While you continue to advertise Version 5 as being fully compatible with Windows XP, clearly, in certain circumstances, some users who are using external USB hard drives will find that this is not really the case. Moreover, they may spend fruitless months trying to work out what has gone wrong, including repair installs of XP, only to find they are no further forward since it has been shown that XP is not in fact the source of the problem. Again, I would respectfully suggest that ESET should be mailing their customers to advise them of this potential issue under later versions of 4 and now Version 5, if only to spare their customers needless anxiety until a definitive solution can be found.

I ask you again to refer the memory dump and the other material provided by me to your Developers in the hope that they can spot the source of the problem on my machine. Surely this would be in everyone’s interest, if only to discover whether another, as yet unknown, driver is conflicting with NOD32.

I await your reply and will hold off posting for help at Wilders Security Forums meantime."

I have created said dump as per your instructions - adding "CrashOnControlScroll' to the registry - (Right Ctrl + SCrLk x2) immediately following the system hangup and the link below takes you to the file:

https://backup.filesanywhere.com/fs/...885c6471ab72a2

Otherwise, my system remains very responsive and stable after a successful boot and nothing amiss is reported in the Event Viewer.

I can supply the SysInspector zip file for you on request.

Thank you, in anticipation, for your help with this frustrating matter.

Kind regards,

Mike

 

Please read my post in the other thread entitled "ekrn hogging CPU" started by djackino.

https://www.wilderssecurity.com/showthread.php?t=320652

 

Please check the download link as it seems to be truncated and thus non-functional. In the mean time, I've asked the UK support to look up the dump and pass it to me for analysis.
As for Windows XP support, we still support even Windows NT which was discontinued by Microsoft in 2003/2004.

 

Hi Marcos,

Thank you very much for responding. I don't know what happened with the link to the Memory dump. Sorry about that. Here it is again:

https://backup.filesanywhere.com/fs/v.aspx?v=8c6a68875961757c6b9a

I've tested it and it appears to be working.

Regards,

Mike

 

Hi Marcos,

I have received an email from Neil at ESET UK also enquiring about the dump file. Hopefully I've managed to sort out access to the file now and here is a copy of my response:

"Hello Neil,

Thank you for getting in touch. Yes, I have uploaded the memory dump file. In fact the file in question was uploaded prior to my correspondence with Nicholas. Unfortunately something seems to have happened to the file link between that time and when Marcos tried to access it today. I have created a new link and it has been posted in my thread at Wilders Security Forums:

https://backup.filesanywhere.com/fs/v.aspx?v=8c6a68875961757c6b9a

I do hope that together we can resolve this issue as it has proved to be a real headache.

Believing I was being ignored at Wilders Security Forums over the past few days I have tried a few more things in the vain hope of getting 5.2.9.1 to work with my USB hard drives:

1. Disabled Acronis Nonstop Backup Service (I would never use it anyway)
2. Uninstalled Rapport Management Service (only seemed to work with IE and earlier versions of Firefox - I prefer Firefox)
3. Disabled AcronisTrueImage Monitor at Startup as not needed.

I uninstalled 4.2.71.2 which doesn't cause any conflicts/system lockups, disconnected my computer from the Internet and ran without NOD32 for a couple of days and encountered no problems connecting my external USB drives. System performed well without any lockups and, if anything, I felt the speed of GUI operations seemed quicker.

Today I performed a fresh install of 5.2.9.1 using the OFFLine installer file. Installation completed without any hitches and I activated the product following a warm reboot. Reboot completed without any problems and normal operations in Windows were confirmed over a testing period of half an hour or so. Then I decided to connect one of my external USB drives and, sadly, there has been no change in behaviour:

The drive did not appear in the previously opened 'My Computer' window. I then closed the window and immediately tried to reopen it. The empty window opened and the 'scanning' torch appeared and persisted for about 30 seconds before the window contents were displayed. All was present and correct with the exception of the USB drive. This behaviour is repeatable. Non of the desktop icons were responsive to double-clicking and when I tried to shutdown the system froze completely. Another complete memory dump was created using the Right Ctrl + ScrLk (x2) combo. In case this is of any use to you I will upload this additional complete memory dump to filesanywhere.com and a link will be provided. It will take a while as my upload speed is only around 0.6 - 0.7 Mbits/sec (see below **)

Finally, I would like to apologise if I have seemed to be coming on a bit strong and perhaps unreasonably overcritical of ESET Support. It's really just a measure of the frustration felt over the past few months as I have been trying to troubleshoot/cope with this irksome issue.

Thank you for your help. Let's hope we nail this one soon!"

Amen to that and thank you, Marcos, for the registry hack implementing the Ctrl + ScrLk (x2) memory dump as I don't have to do a hardware reset following a lockup, with the risk of drive data corruption, anymore.

Kind regards,

Mike

**Link to second Memory Dump file (June 15):

https://backup.filesanywhere.com/fs/v.aspx?v=8c6a68885e616eb1b068

 

Hi SolidState,

Thanks for your helpful suggestions. However, I think these particular bases have been covered or considered probably irrelevant to my issue:

(1) disable autoplay for the USB drive......
This behaviour occurs whether auto play is active or not. The drive simply does not appear in the open 'My Computer' window when connected and the system lockup occurs either way.

(2) check for other security software that monitors removable drives/USB etc and disable it (Outpost has this as does Sophos firewall)......
See my previous post - can't think of anything else that might be involved and, believe you me, I have looked hard.

(3) use vendor HD utility to adjust it's power management options so it doesn't power down for USB drives......
I don't believe this to be relevant in my case as the lockup occurs as soon as a drive is connected to any of 3 USB 2.0 ports. Certainly the drive could be spinning up to speed when connected but it's not possible, as far as I know, to change this behaviour.

(4) make sure you have your chipset drivers installed properly! (non installed chipset drivers are systemic with many many deployed windows boxes)......
All's well in that area and the system performs flawlessly apart from this issue. Also, I have confirmed that external USB drive detection works fine when NOD32 5.2.9.1 is not installed.

(5) if USB3 make sure you have the latest drivers from the manufacturer......
Don't have USB3.


I build my box of tricks several years ago and it continues to be my faithful daily workhorse. It is used for photographic, video and audio processing, flight and space simulation as well as the multitude of standard applications we all use. I know my way around XP and the installed hardware pretty well and have a good working knowledge of maintaining this O/S. Troubleshooting the occasional issue can, at times, be quite challenging as well as rewarding, but I have to admit that this one has me stumped.

Regards,

Mike

 

Update (1)

For those of you who have been reading this thread you may be interested to know the current state of play.

Marcos and I have been communicating back and forth via PM. I have not yet received any feedback regarding my submitted memory dump, but some of you may have spotted post #222 in the other thread on this topic where the file PDFsFilter.sys (installed by Raxco's PerfectDisk - I am on version 12 (build 290)) has been implicated. I have now verified that this is indeed the case. After renaming the file and rebooting the system, all is well once again with external USB drive detection and the system does not freeze.

Unfortunately, this file is automatically reinstated by PerfectDisk the next time the application is run so unless Raxco do something about it or I am forced to uninstall PerfectDisk or NAV I still do not have a definitive solution for this vexatious issue.

The list of conflicting 3rd party software is growing ever larger, it seems. This may be an unfair observation, but when I think of ESET's current stance regarding other developers coding efforts I can't help but visualize the mother watching her son march past with the rest of his platoon and stating, "Look, everyone is out of step except our Johnny!" Hmm?!

I have written to Raxco Support inviting their impressions. Somehow a solution has to be found to avoid these conflicts and I do believe that ESET should be biting the bullet and step up to the plate. After all, we now know that the problem began following the introduction of this new feature in their software. I am quite sure that ESET's developers are more than capable of coming up with a creative solution which would avoid us having to abandon otherwise hitherto trusted, but now conflicting, software AND I really don't want to have to change to another AV solution. NOD32 running under Windows XP 32bit has served me well over the years and I would like this to continue for a bit longer if it is at all possible.

Mike

 

Update (2)

Those of you who are sharing my experience with PerfectDisk's PDFsFilter.sys conflicting with NOD32 under Windows XP 32bit (SP3) can relax. I have created a simple workaround which at least ensures we can continue to use both products until either RAXCO or ESET sort this one out for us.

Below are a couple of command scripts. Copy and Paste each block of script into Notepad and save (Save As...) each to the desktop with a meaningful name, or just use the name I have given them. Please remember that Notepad will try to save each as a .txt file and you are intending instead to create a batch file which will execute each command line in turn. So, change the .txt file extension to .bat

To rename PDFsFilter.sys to PDFsFilter.sy_ copy the following:

cd\
cd Windows\system32\drivers
ren PDFsFilter.sys PDFsFilter.sy_
cd\

And Save to Desktop as USB Drives (Yes).bat


To rename PDFsFilter.sy_ to PDFsFilter.sys copy the following:

cd\
cd Windows\system32\drivers
ren PDFsFilter.sy_ PDFsFilter.sys
cd\

And Save to Desktop as USB Drives (No).bat


It doesn't matter what state the PDFsFilter.sys file is in when you double-click either of these batch files. No need to worry if you accidentally double-click the wrong file. The only thing you need to remember is whether you want to connect USB drives or not. If you do, then try again by double-clicking the USB Drives (Yes).bat file and THEN connect your USB hard drive/s. The worst than can happen when you connect an external USB hard drive and the file has not been renamed beforehand to PDFsFilter.sy_ is the return of the old behaviour whereby the desktop GUI becomes inactive and the system locks up.

I have confirmed that there is no need to reboot the system after renaming the file. If you need confirmation, try downloading a little program called 'Autoruns':

http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx

Click on the 'Drivers' tab and scroll down to PDFsFilter - if the file is not active it will state 'File not found'

Lastly, should you forget to rename the file back to PDFsFilter.sys then the next time PerfectDisk is started it will automatically reinstate the file for you.

Hope this is helpful.

Mike