ekern.exe @ 100%, uTorrent

Discussion in 'ESET NOD32 Antivirus' started by HornedLord, Dec 4, 2010.

Thread Status:
Not open for further replies.
  1. HornedLord

    HornedLord Registered Member

    Joined:
    Dec 4, 2010
    Posts:
    3
    uTorrent (have tested versions 2.0.4 and 1.8.3) seems to cause ekern.exe to get stuck at 100% CPU usage. It doesn't happen instantly after starting uTorrent - at the beginning NOD32 uses minimal CPU time. But when uTorrent has run about 30 minutes ekern.exe hugs up one core (task manager shows 25% as my system is quad-core). Then after about another 15-30 minutes next core is also used by NOD32 (50% shown in task manager). When it's at 50% I can't even browse websites anymore (Firefox shows "Waiting for ..." on status bar). I haven't waited longer to see if it will also eat last two cores. It doesn't even help if I exit uTorrent or disable NOD32 after ekern.exe has gone up to 25% or 50%. Only rebooting or uninstalling NOD32 helps.

    I have tried excluding uTorrent from NOD32 (Setup->Antivirus and Antispyware->Exclusions and Setup->Antivirus and Antispyware->Protocol filtering->Excluded applications). I even tried disabling Web access protection altogether.

    OS: Windows 7 64bit (with latest patches)
    Eset NOD32 Antivirus 4.2.67.10

    EDIT: It seems that the problem doesn't occur when I have "Real-time file system protection" disabled (others modules, including Web access protection, are enabled). Had uTorrent running without problems for several hours while NOD32's "Real-time file system protection" was disabled. 'bout 20 minutes ago re-enabled it and now ekern.exe is already at 25%.

    Any ideas? Disabling "Real-time file system protection" permanently doesn't seem like good idea ;)
     
    Last edited: Dec 5, 2010
  2. siljaline

    siljaline Former Poster

    Joined:
    Jun 29, 2003
    Posts:
    6,619
    Please post back your system information, do not exclude any applications from real-time scanning not a good idea to the end that it precludes the effectiveness of your security product.

    If your P2P app is pegging your CPU, check the settings or re-install and seek help from uTorrent
     
  3. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    If you didn't contact customer care, create a log from Process Monitor shortly before and while the problem occurs, upload it somewhere and post a link to it here.
     
  4. HornedLord

    HornedLord Registered Member

    Joined:
    Dec 4, 2010
    Posts:
    3
    Thank you for the replies.
    Code:
    Virus signature database: 5676 (20101205)
    Update module: 1031 (20091029)
    Antivirus and antispyware scanner module: 1293 (20101110)
    Advanced heuristics module: 1115 (20101116)
    Archive support module: 1123 (20101108)
    Cleaner module: 1048 (20091123)
    Anti-Stealth support module: 1021 (20100811)
    SysInspector module: 1217 (20100907)
    Self-defense support module : 1016 (20100404)
    Real-time file system protection module: 1004 (20100727)
    Ekrn.exe (I'm afraid I mistyped it before) is eating the processor. Though I tried reinstalling (and also an older version of uTorrent), but it didn't help.
    Nay, I didn't. Should I?
    I'll try to reproduce the problem and log it with Process Monitor, but is it wise to link such logs publicly here?

    I also noted (by using LockHunter) that ekrn.exe had several files locked (in use) in the uTorrent's download folder after ekrn.exe started consuming processor exceedingly. I suppose it got stuck with them as several minutes later those files were still in use by NOD32. Manually scanning those file didn't seem to cause any trouble (no getting stuck nor any alerts) and they weren't particularly large files (PDF files, 'bout 1MB or less).
     
    Last edited: Dec 6, 2010
  5. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    You can just pm me the link. The log will show what file operations are being performed and thus shed more light into the issue.
     
  6. HornedLord

    HornedLord Registered Member

    Joined:
    Dec 4, 2010
    Posts:
    3
    "The private messaging system is currently unavailable."
    Hmm... I hope it's temporary.
     
Thread Status:
Not open for further replies.