Crashes with version 4.2.67.10

Discussion in 'ESET NOD32 Antivirus' started by Wallaby, Jan 1, 2011.

Thread Status:
Not open for further replies.
  1. Wallaby

    Wallaby Registered Member

    Joined:
    Jan 1, 2011
    Posts:
    156
    Hi guys
    Just installed the trial version

    I had this crash repeating everyday since three days so far
    http://img262.imageshack.us/img262/5246/clipboard01ts.jpg

    Attached the three files I found in the Temp folder (I had to change suffix to minidump to attach here)

    I am on a Q6600 XP Home 32 bit SP3

    My firewall is COMODO 5.0

    I am wondering if some module update has been in the last few days that could produce this.
    Everything worked fine until some days ago

    I had to recover a backup but nothing has changed

    I hope to resolve this.
     
    Last edited: Jan 5, 2011
  2. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    Are you able to reproduce the crash? When exactly did it occur? (on system startup, when running a scan, during an update, etc.)
    If you are able to reproduce it, does enabling pre-release updates in the advanced update setup make a difference?
     
  3. Wallaby

    Wallaby Registered Member

    Joined:
    Jan 1, 2011
    Posts:
    156
    Another crash (while trying to edit the first post to make the image appear).... I have just restored a working backup of some weeks ago (I mean until that time this is the configuration that worked)

    The time before it happened during Web navigation with "Internet Explorer 8".
    I closed an IE8 "label" (I don't know the translation in english... I mean with IE8 you can open in the same window a lot of "labels" (?) ) at that point IE8 gave the impression to crash... it went unresponsive... i click to close, I re-clicked I reclicked (at this point normally appears the dumprep.exe crash report ) but instead of the one relative to IE8 appeared the one relative to ekrn.exe.

    Anyway this is what happened this last time, while the other times I can't say if I was on an Internet page with IE8 or not

    Do you mean that enabling "pre-release updates" I could see a solution?
    I always understood it is something "dangerous" and not recommended by default

    Give me some days to see if it reappears and, if so, I will enable pre-release

    Thanks by now :thumb:
     
  4. Wallaby

    Wallaby Registered Member

    Joined:
    Jan 1, 2011
    Posts:
    156
    Enabled the pre-release updates
    I will let you know :thumb:
     
  5. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    Should the crash recur, post the information about installed modules (Help->About) here, just to make sure you're using the latest.
     
  6. Wallaby

    Wallaby Registered Member

    Joined:
    Jan 1, 2011
    Posts:
    156
    Now I am using these ones
    I don't know why they are the same as before even if "01/01/2011 **** Kernel The program modules have been updated. " popped out

    Which update server should I set?

    PS
    This is still a trial version
     
    Last edited: Jan 1, 2011
  7. Wallaby

    Wallaby Registered Member

    Joined:
    Jan 1, 2011
    Posts:
    156
    I forgot to tell that I have also "HTTP checking" enabled.

    So next time I'll try to disable this first.

    About pre-release updates, I have tried and retried but they don't come down from trial servers :oops:

    PS
    The other setting are those posted by Blackspear here
    https://www.wilderssecurity.com/showthread.php?t=197509
     
  8. SamuriHL

    SamuriHL Registered Member

    Joined:
    Nov 17, 2010
    Posts:
    14
    I'm getting extremely similar behavior. I've got 4.2.67.10 running on 64 bit W7, virus sigs of 5752. I'm running IE9 beta. For me it just locks up my machine. 50% cpu on the ekrn.exe process and IE just hangs. Eventually my laptop comes to a complete stop and I have to power it down to get it back. I've had to disable NOD32 at this point just to be able to do anything with the internet. This seems very bad.

    EDIT: Turning off HTTP scanning seems to allow me to avoid this problem. This is still not so good, however.
     
  9. siljaline

    siljaline Former Poster

    Joined:
    Jun 29, 2003
    Posts:
    6,619
    Windows XP Pro SP3

    Pre-releases enabled, Start-up scan disabled, as discussed in numerous threads, possible cause, loss of connectivity while task completes.

    Application hang of Internet Explorer 8. Requires reboot as task manager is unavailable as system freezes.

     
  10. SamuriHL

    SamuriHL Registered Member

    Joined:
    Nov 17, 2010
    Posts:
    14
    Is the ekrn.exe process taking up a lot of CPU when IE hangs? It was for me. And I also have startup scan disabled. I do not have the pre-releases enabled.
     
  11. siljaline

    siljaline Former Poster

    Joined:
    Jun 29, 2003
    Posts:
    6,619
    Yes, ekrn.exe does peg my CPU while IE and system hangs, I did not mention that.

     
  12. SamuriHL

    SamuriHL Registered Member

    Joined:
    Nov 17, 2010
    Posts:
    14
    I only ask cause it's the same thing that's happening to me. If you disable HTTP scanning, does the problem go away? It helped my system, but, I still had some screwy issues after that, so, I've disabled NOD32 completely until I can find out why this is happening and maybe a fix for it.
     
  13. siljaline

    siljaline Former Poster

    Joined:
    Jun 29, 2003
    Posts:
    6,619
    It would strongly discourage fully disabling any of the main modules until this is cleared as being an issue or not. In the meantime, adjust your HTTP Scanning to via this ESET KB Article

    Assuming you run Win XP. This feature cannot be adjusted under Win Vista, Win 7.
     
  14. SamuriHL

    SamuriHL Registered Member

    Joined:
    Nov 17, 2010
    Posts:
    14
    I'm W7 64 bit, so, there's not a lot I can do right now. And without disabling it, my system is *COMPLETELY* unusable. IOW, I don't have a choice. It's better than uninstalling NOD32 and replacing it with something else. That's something I very much want to avoid. However, I absolutely need a usable system. :doubt:
     
  15. siljaline

    siljaline Former Poster

    Joined:
    Jun 29, 2003
    Posts:
    6,619
  16. SamuriHL

    SamuriHL Registered Member

    Joined:
    Nov 17, 2010
    Posts:
    14
    No problem. I reenabled it carefully and so far it's working ok with http scanning disabled. That's better than nothing. I'm a very security conscious user so it's not the end of the world when I disable security software on my machine. I work for a competing company. Shhhh. :D
     
  17. petero

    petero Registered Member

    Joined:
    Jan 2, 2011
    Posts:
    2
    I have the same problem. Yesterday (Jan 1), I started getting crash messages from ekrn.exe, and the computer was locked up. Several times during the day, at random, also today. Even when not sitting at the machine. Each time I had to power the machine off at the switch - could not use the shut down menu.

    I'm on XP SP2. I was using Nod v3, so I upgraded to NOD v4. Problem still persists, even after turning off http monitoring. I've now had to totally disable NOD, and there have been no freezes. I've been using NOD for a few years without this problem.

    Virus signature database: 5752 (20110101)
    Update module: 1031 (20091029)
    Antivirus and antispyware scanner module: 1293 (20101110)
    Advanced heuristics module: 1115 (20101116)
    Archive support module: 1123 (2010110:cool:
    Cleaner module: 1050 (20101207)
    Anti-Stealth support module: 1023 (20101125)
    SysInspector module: 1217 (20100907)
    Self-defense support module : 1018 (20100812)
    Real-time file system protection module: 1004 (20100727)
     
  18. Wallaby

    Wallaby Registered Member

    Joined:
    Jan 1, 2011
    Posts:
    156
    At this point the question (in my case, since this problem appeared in my PC on 29 or 30 december... I can't remember well) is "Why did it happen in the last few days? What changes were made in the last few days? or in the last week"

    All the problems reported by the other guys are the same problems that I had because my PC crashed during navigation (like SamuriHL and siljaline), but also randomly and doing nothing particular (like petero) and everytime I had to do a hard reset since the PC slowly became unresponsive
     
  19. Wallaby

    Wallaby Registered Member

    Joined:
    Jan 1, 2011
    Posts:
    156
    A fresh crash
    http://img5.imageshack.us/i/clipboard02vn.jpg/

    Now the module is "Unknown"

    I had "HTTP checking enabled"

    Now I have disabled it and the PC didn't crash (it is still working... I hope)

    Unfortunately no "modules pre-release updates" because they are not available on trial servers

    I was using IE8 and ChessBase Fritz 11
     
    Last edited: Jan 5, 2011
  20. Wallaby

    Wallaby Registered Member

    Joined:
    Jan 1, 2011
    Posts:
    156
    It crashed.

    The only solution then, once that eror has appeared, is to restart the PC
     
  21. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    When did you encounter a crash of ekrn for the first time? Was it before Thursday this week (ie. before the update 5746) or later? If it's related to web protection and you are able to reproduce it, could you try disabling each of the options in the web protection setup and thus narrow it down to the option that triggers the crash? Also please do the following:
    - enable pre-release updates in the advances update setup and run a manual update
    - confirm or deny that the problem still persists
    - disable pre-release updates and run a manual update
    - confirm or deny that the problem persists

    We will appreciate if you could generate a complete memory dump as per the instructions here at the moment the crash warning is displayed on the screen.
     
    Last edited: Jan 2, 2011
  22. c2d

    c2d Registered Member

    Joined:
    Sep 26, 2007
    Posts:
    570
    Location:
    Bosnia
    Sadly I can confirm that I'm getting exactly the same problem on my computer.
    It started yesterday (Jan 1st).
    It happened during web browsing with Opera.
    My PC was locked up about 5 times.CPU was on 50% (ekrn.exe).I could not do anything about it.
    The only solution was to restart my PC.

    I did not have any problems using this AV for the past 3 years.
    I m using Windows 7 32 bit and latest NOD32 AV Version 4.2.67.10.


    Pre-release updates were enabled.I reinstalled NOD32 but the problem still exist.
    Something is wrong here.Don't know what this could be related to?To pre-release updates,web protection or something else? :oops:

    Ok I'll try to disable pre-release updates and do what Marcos suggested.
     
    Last edited: Jan 2, 2011
  23. Wallaby

    Wallaby Registered Member

    Joined:
    Jan 1, 2011
    Posts:
    156
    My first crash was on 30 december 2010
    I update regularly every hour and the PC was on since 24 december (holidays) so the update was probably as I see here
    http://www.eset.eu/support/update-xy1?month=12&year=2010&page_id=5846
    5746 or 5747

    PS
    As I already said I cannot download pre-release updates (but from the other posts I undestand that it makes no difference)
     
    Last edited: Jan 2, 2011
  24. pslva38

    pslva38 Registered Member

    Joined:
    Jan 2, 2011
    Posts:
    2
    I have two servers (Win Server 2003) running NOD32 and having the very same issues with both servers since 31st December 2010. Not had any trouble prior to this (3 years of using NOD32). I have 3.X version on one server and 4.X on the other.

    ekrn.exe hits 50% CPU (2 CPUs available) and it completely crashes the system - requiring hard reboot. Happened about once per day on both servers - I've now disabled NOD32 on both servers to prevent the issue recurring.
     
  25. SamuriHL

    SamuriHL Registered Member

    Joined:
    Nov 17, 2010
    Posts:
    14
    I'll try to see if I can narrow it down on my laptop today. It's been running since I reenabled NOD32 with HTTP scanning off with no more issues. I've not had any actual crash on my machine. It simply takes the ekrn process to 50% CPU (I'm on a dual core laptop) and hangs. But, again, that's not happened since I turned off HTTP scanning. One would think if there were any changes made to that area of code in the last few days that it'd be fairly easy to track it down, no? I have not tried pre-release updates. I'm a bit hesitant to do so as I don't like to mess with my security products too much and pre-release code is often not fully vetted IMO. And as has been mentioned, it didn't seem to make any difference anyway.

    EDIT: Well, in my case being on W7, there isn't a lot I can really troubleshoot. Web scanning is either on or off. I know in my case hitting slashdot triggered the issue every single time. I guess I'll turn it back on and see if I can trigger it again. I just got the latest 5753 definitions.
     
    Last edited: Jan 2, 2011
Thread Status:
Not open for further replies.