AH in real-time file system protection

Discussion in 'ESET NOD32 Antivirus v4 Beta Forum' started by Waterfox, Jan 4, 2009.

Thread Status:
Not open for further replies.
  1. Waterfox

    Waterfox Registered Member

    Joined:
    Mar 3, 2008
    Posts:
    118
    Location:
    Sweden
    Experiencing some issues when advanced heuristics(AH) is enabled in real-time file system protection (in threatsense engine parameter setup).
    When opening video files with windows media player 11 there is quite big delay before video starts to play and ekrn.exe is using 99% of cpu. This lasts for about 10 seconds and then everything is back to normal.
    If I open video files with some other media player, like VLC, this issue does not occur.
    When AH is disabled the problem with wmp 11 is gone.
    So, I'm just wondering if somebody else is having this same issue and are there any drawbacks having AH disabled in real-time file system protection because everything is maxed-out in "On-Demand scanner" option, so that should pretty much cover it, right?

    Running xp home edition sp3 and EAV v4 Beta
     
  2. 4L3X

    4L3X Registered Member

    Joined:
    Sep 13, 2006
    Posts:
    40
    Realtime protection is imperative !! , otherwise its pretty pointless in having a AV product installed.

    Realtime protection does not cause any issues for me, are you sure this isn't a problem with codecs you have installed on your system ?

    Try installing media player classic and use that to open videos and see if you still have the issues.
     
  3. Waterfox

    Waterfox Registered Member

    Joined:
    Mar 3, 2008
    Posts:
    118
    Location:
    Sweden
    Hi :)
    yes, I know that real-time protection is imperative, that's why I have it turned on of course, it's just advanced heuristics that's giving me issues with WMP11.
    So you're saying that you don't have any problems opening video files with
    WMP11 while having AH on? No delay of any kind?
    Well then I need to investigate this matter further but I know it can't be any codec problem because once AH is unticked the issue's gone.

    Thanks for reply anyway.
     
  4. ugly

    ugly Registered Member

    Joined:
    Mar 21, 2005
    Posts:
    276
    Location:
    Romania
    As you can see here I also had problems with AH.
    I don't think is about WMP 11 only. My example was wih Advanced Uninstaller PRO 9.1 on XP Pro SP3. So is something connected with launching
    applications and having AH real-time enabled.
    Nobody from ESET confirmed that .
     
  5. ASpace

    ASpace Guest

    Plain and simple :


    plain_and_simple.png




    Use the default settings
     
  6. Waterfox

    Waterfox Registered Member

    Joined:
    Mar 3, 2008
    Posts:
    118
    Location:
    Sweden
    That warning only comes up if you enable advanced heuristics on file execution (which I have not).
    I was referring to advanced heuristics in threatsense engine parameter of real-time file system protection and no warning pops up when you do that.
    It's the exactly same problem as ugly described above in his own thread.
    For now I'm leaving AH off, maybe future builds will adress this issue.

    Thanks on your replies ;)
     
  7. ASpace

    ASpace Guest

    I understood you very well ... the first time .

    No matter the text appears only if one tries to enable advanced heuristics on file execution the text applies to all modules/submodules . As Marcos has written it numeours times , AH (emulation) is time and resourse consuming operation . Forget that there's no warning . By default AH are only enabled to be used on newly created/modified files , not on all files , even the well-known ones such as Windows Media Player . If you enable AH in the Threatsense engine parameters of the real-time file system protection, AH will be used for on-access scans for every file (PE file) you have on your computer and if your hardware configuration can't handle this , you'll notice slow downs . On Vista with Dual-core processor I have enabled AH absolutely everywhere and I notice no slowdown but on old machine with single core processor this could be disasterous!

    Use EAV with its default settings - AH enabled only for newly-created and modified files .

    wnbkjnd.png

    AH is enabled on all other modules (kernel-memory scanner , email , web , on-demand scanners)
     
  8. Waterfox

    Waterfox Registered Member

    Joined:
    Mar 3, 2008
    Posts:
    118
    Location:
    Sweden
    Alrighty then :D
    thanks for clearing that up HiTech boy
    the deafult setting it is!

    Cheers :thumb:
     
  9. ASpace

    ASpace Guest

    Cheers :p
     
  10. ugly

    ugly Registered Member

    Joined:
    Mar 21, 2005
    Posts:
    276
    Location:
    Romania
    That is a very nice theory but it does not explain why I have no problem running v3 with AH enabled in real-time.
     
  11. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    Could you please enable AH on file access again and exclude the WMP executable from scanning to see if it makes a difference? We'd need to make sure that it's actually the WMP executable that is causing the delay when being scanned.
     
  12. Waterfox

    Waterfox Registered Member

    Joined:
    Mar 3, 2008
    Posts:
    118
    Location:
    Sweden
    Hello Marcos

    I did as you asked and issue is still there.
    I even excluded entire windows media player folder and still get 99% of cpu usage with ekrn.exe when opening video files with wmp11.
    No issues with VLC player no matter what video file format.
    I've tried opening several video formats with wmp11 (.avi, .wmv, .mpg) and the only ones that are causing this initial freeze are .avi ones.
    Does this mean that there is actually a codec issue with "file ->wmp11 ->ekrn.exe" and not the player itself?
    Is there anything else that needs to be excluded in order to play these files?
     
  13. MasterTB

    MasterTB Registered Member

    Joined:
    Jun 19, 2007
    Posts:
    547
    Location:
    Paran?, Argentina
    @Waterfox:

    Hi, which codec are you using? Perhaps it is not WMP but the codec... Try excluding that... I know Divx can be heavy some times.
     
  14. Waterfox

    Waterfox Registered Member

    Joined:
    Mar 3, 2008
    Posts:
    118
    Location:
    Sweden
    I have no idea... is there any way to see which codec wmp11 is using... there is no list to find in properties.
     
  15. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    Maybe you could open the real-time protection statistics window and watch the names of files being scanned when opening avi files.
     
  16. Waterfox

    Waterfox Registered Member

    Joined:
    Mar 3, 2008
    Posts:
    118
    Location:
    Sweden
    Hi, Marcos
    I followed your instructions and these are the two files that seems to cause the issue:
    C:\WINDOWS\NeroDigital.ini followed by C:\Program\Shared Files\Ahead\DSFilter\NeVideo.ax.
    I've excluded these two from real-time scanning (actually entire DSFilter folder) and now the problem is gone.
    AVI files work in wmp11 without initial freeze up while AH is enabled.
    I have Nero 6 (6.6.1.15) installed so it looks like some of it codecs were interfering with ekrn.exe while playing .avi files in wmp11.
     
  17. MasterTB

    MasterTB Registered Member

    Joined:
    Jun 19, 2007
    Posts:
    547
    Location:
    Paran?, Argentina
    Well, you could use Mediainfo to see wich codec was used to make the avi file and go from there. You can find Mediainfo here: http://mediainfo.sourceforge.net/es
     
  18. funkydude

    funkydude Registered Member

    Joined:
    Apr 5, 2004
    Posts:
    6,853
    It's possible there was a problem emulating those 2 files. I would submit them to ESET so they can analyze the problem. I'll wait for Marcos to post where to submit them to. :D
     
  19. Waterfox

    Waterfox Registered Member

    Joined:
    Mar 3, 2008
    Posts:
    118
    Location:
    Sweden
    Yes, that's exactly what happened, Marcos contacted me and the issue will be resolved soon with an upcoming signature update. :)


    @MasterTB: thanks for that link to Mediainfo.
     
  20. funkydude

    funkydude Registered Member

    Joined:
    Apr 5, 2004
    Posts:
    6,853
    Take them off the exclusion and tell us when they are fixed. :)
     
  21. MasterTB

    MasterTB Registered Member

    Joined:
    Jun 19, 2007
    Posts:
    547
    Location:
    Paran?, Argentina
    You're welcome Waterfox.

    Nice to see that Eset is working on a fix.
     
  22. Waterfox

    Waterfox Registered Member

    Joined:
    Mar 3, 2008
    Posts:
    118
    Location:
    Sweden

    Well looks like signature update 3743 fixed the problem. :D
    AVI files play without issue on wmp11 and with advanced heuristics enabled in real-time file system protection.
    Kudos to ESET (and Marcos, of course). :thumb:


    Cheers
     
Thread Status:
Not open for further replies.