100% CPU Usage

We have 50 licenses of Nod32, all running on Vista 32. We were using 3.0.642 for months with no issues. After upgrading to 3.0.672 a few days ago (w/default installer settings), we are now having two problems. One is this 100% CPU usage. It just happened on an IBM T60p laptop while doing some browsing. It occurred this morning after coming out of standby. So I would agree that there appears to be a problem introduced in 3.0.672. If ESET has a solution to this problem, I would be very interested in it as it's looking like I have to push the machines back down to 3.0.342 (something I am not looking forward to).

Side note: the second problem, which I have not had time to investigate, is that after making a VPN connection some Remote Desktop sessions do not connect. This started occurring the day NOD32 3.0.672 was installed. (It previously had no A/V.) I am betting $1 that uninstalling NOD32 will solve the problem.

FOLLOW-UP: I won my own dollar. After uninstalling NOD32 3.0.672, the Remote Desktop over VPN now works on that PC. Problem #2 solved, but now I need to install A/V from another vendor. If ESET doesn't address these problems quickly, our company won't be renewing.

 

Hello,

Try excluding the following directories on the ThinkPad T60p from being scanned:

C:\Program Files\Lenovo\
C:\Program Files\ThinkPad\
C:\Program Files\ThinkVantage\

Does that make any difference?

Regards,

Aryeh Goretsky

 

Thanks for the reply. I disabled the web scanning since it seemed to be HTTP traffic-related and have not seen the problem recur. Would it still be worthwhile for debugging purposes to exclude those directories?

This is not a configuration I am willing to push out to the other 50 clients so I was waiting for ESET to post a fix so I could roll out a new version of the client instead.

Note: The filesystem exclusion also would do nothing to solve the VPN remote desktop issue I had on an HP machine. So perhaps it's not HTTP traffic-related but rather IP traffic as a whole.

 

I just found this thread after having a hot notebook for a few months (since windows didn't show all processes from all users without clicking the box I never even saw ekrn.exe in the process list).

I unchecked "advanced heuristics" from all the options (email, internet, ondemand, etc.) and rebooted and now my pc is quiet and cpu is 0%.

Make sure if you disable it you disable it for everything. you have to uncheck the box around 4 times.

I'm running vista and using nod32 3.0 updated to latest version.

 

im having the exact same behavior from my eset installation, im pretty sure this isnt hardware related right? i mean... its not like "you dont have the right pc for the advance heuristics" or similar... right?

what bothers me is that ive always been an eset/nod user, and it has never failed on me, not in xp nor in vista, im seriously confused about the fact that ive installed like a zillion times in this pc alone, same hardware same old drill, and all of the sudden it decides to start hogging my cpu, i know i might not been using my cpu clocks for something "critical" but cmon! i can barely use mi pc and i really want to finish mirror's edge in "super mega ultra hard"

C2D E8400 3.0Ghz
4Gb DDR2 800Mhz OCz Fatality
500Gb Seagate Barracuda 7200.11
512Mb Sapphire ATi Radeon 4850HD

 

It's only really a system issue if you've got constant high CPU usage or if emulating a file is taking more than ~10seconds. the chances are you have a file that AH is struggling on. The fix is simply locating the file and reporting it to ESET. The easiest method to do this is to use v4 and watch the statistics pane to see what is being scanned when your PC freezes.

 

I am having the same issue, where the ekrn.exe process is eating all available memory for 5 minutes after starting up my PC. I have opened a case with Eset support, only I haven't received a personalized reply after 7 days.

I have decided to downgraded to version 2.7, as a last resort solution. I have been a strong advocate of Eset in the past, although this issue is seriously testing my confidence in the company's products, especially with my support thread being ignored.

 

A long startup is usually due to a conflict in software or startup. For one of my machines defragging the disk followed by the registry fixed it. But in some cases it can be more severe.

 

Sorry, I meant as soon as I get to my desktop after opening my windows session. I know it is ekrn.exe, as I can see it eating all available memory in my ressource monitor.

Any valid suggestion?

 

Yes, follow my sub-previous post. Since it''s your desktop you have it easier, you already know it's a file on your desktop or a shortcut to a file on your desktop that's causing the problem.

I had the same problem as you where I had a shortcut to a game, once i deleted it the problem went away. I sent a copy of the executable and now it's fixed.

You should start by moving files/shortcuts to another folder, then moving them back bit by bit. Move half back, if the problem is back, then it's in that half, and zoom in on it, etc.

 

Thanks for your reply. Although maybe I am being ignorant, although if I clearly see in my performance monitor that ekrn.exe goes to 90%, 95% of CPU usage. How could it be anything else?

 

You didn't read my post correctly. I didn't state it wasn't ekrn.exe I stated how to try and solve the problem and what it was.

 

OMFG its solved now... turns out nod had a crush with a stupid 200+Mb rar file, i was totally sure it had to be something like that, since i only experienced the issue when i opened my downloads folder with the stupid bunch of rars in it...

thx for pointing me in the right direction elapsed

 

Thank you. Where can I download V4?

 

Hello, there's links in the v4 forum, a bit below these forums.

 

If you want to help further, extract what was in the rar (if it wasn't just one big file) and try and see if it does the same to a certain file in the rar. It might not be the rar but the file inside it, then it might be possible to have it fixed.

 

yeah it was a 200+Mb part of a 7-part splited file, so theres nothing really helpful inside it, i see your point there but it was a single avi splited in rar parts.

 

I reported this same (or similar) HTTP scanning problem to ESET and on this forum on 11 January in this thread:
https://www.wilderssecurity.com/showthread.php?t=230375

ESET offered no explanation nor help (other than disable browser/web scanning). Version 4 beta does not solve it either. It works great except if you want HTTP scanning.

I recommended to my IT department not to adopt this product for company wide use (~6000 Windows users). Looks like we are sticking with Symantec for now . . . we will reevaluate again when we move to Windows 7 in the (distant!) future.

 

Did you even test it on one of the company machines? Your PC is a pretty unique case.

 

So I downloaded version 4, and I have an idea of which file is causing the PC to freeze. What is the next step?

 

If you know the file in question, you want to compress it with a password, then contact Marcos via PM and ask him where to send the file, it should then be dealt with.

I myself am having the issue yet again since the latest advanced heuristics update yesterday unfortunately, I'm still looking for the file.

EDIT: nvm, I found it pretty easily this time

 

Thanks for all your help, you were the most helpful ressource I've came across in my unsuccessful request to have a trouble-free antivirus experience. Unfortunately after yet another time where my laptop froze and had to manually reboot, I have decided I have already lost way too much valuable time with this, and will switch to another AV provider.

I don't know what piss me more, the fact I have lost my $ buying this software, or the fact that no one at ESET responded to my support request yet, 3 weeks after opening the case. I will recommend anyone against choosing ESET Antivirus.

 

Didn't you say you located the file, or was it a different file? To test you can add the file(s) to exclusion and see if the problem persists.

I can't speak for support, but I PM'd the 2 files that were causing me trouble today and <12 hours later it's already fixed, new build 1090.