ekrn.exe crashing during in-depth scan / WIN 7 64bit

Discussion in 'ESET NOD32 Antivirus' started by vtol, May 1, 2010.

Thread Status:
Not open for further replies.
  1. vtol

    vtol Registered Member

    Joined:
    Apr 8, 2010
    Posts:
    774
    Location:
    just around the next corner
    Source
    ESET Service

    Summary
    Stopped working

    Date
    ‎01/‎05/‎2010 07:08

    Status
    Report sent

    Description
    Faulting Application Path: C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe

    Problem signature
    Problem Event Name: APPCRASH
    Application Name: ekrn.exe
    Application Version: 4.2.40.0
    Application Timestamp: 4baa62a0
    Fault Module Name: ntdll.dll
    Fault Module Version: 6.1.7600.16385
    Fault Module Timestamp: 4a5bdb3b
    Exception Code: c0000005
    Exception Offset: 0002e23e
    OS Version: 6.1.7600.2.0.0.256.1
    Locale ID: 2057
    Additional Information 1: 0a9e
    Additional Information 2: 0a9e372d3b4ad19135b953a78882e789
    Additional Information 3: 0a9e
    Additional Information 4: 0a9e372d3b4ad19135b953a78882e789

    Extra information about the problem
    Bucket ID: 1812500005
     
  2. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,376
    Can you reproduce that crash at any time by running an in-depth scan? If so, could you try narrow it down to the particular folder/file?
     
  3. vtol

    vtol Registered Member

    Joined:
    Apr 8, 2010
    Posts:
    774
    Location:
    just around the next corner
    any time I start an in-depth scan, filetype/folders varies when crashing.

    usually run a daily scan at night, first time issue occurred morning around 0400 hrs (GMT +1) March 30th. Something must have happened in the past 24 hrs then, the scan the day before went ok.

    Pretty sure that the machine hasn't got bitten in between, leaves following changes during that period:

    Esest
    Update module: 1031 (20091029)
    Antivirus and antispyware scanner module: 1273 (20100429)

    software updated/installed during March 29th
    01-05-2010 13-30-29.png
     
    Last edited: May 1, 2010
  4. vtol

    vtol Registered Member

    Joined:
    Apr 8, 2010
    Posts:
    774
    Location:
    just around the next corner
    Got three partitions, c/d/e, the scan is actually crashing when c is complete and advancing to d. leads me to believe there is a bug being introduced in the Antivirus and antispyware scanner module: 1273 (20100429)
     
  5. vtol

    vtol Registered Member

    Joined:
    Apr 8, 2010
    Posts:
    774
    Location:
    just around the next corner
    so you the get info, but it does not get fixed?
     
  6. vtol

    vtol Registered Member

    Joined:
    Apr 8, 2010
    Posts:
    774
    Location:
    just around the next corner
    Is that now Eset playing silent or me not getting an update on the faulty module? the bug, and this is not a minor one considering the reduced functionality of the product was introduced 5 days ago, wondering whether this is heading now the mcafee fashion?
     
  7. rockshox

    rockshox Registered Member

    Joined:
    Oct 23, 2009
    Posts:
    261
    I'm running Windows 7 x64, Antispyware module 1273 and definitions 5083. The in-depth scan finished with no problems whatsoever. I also have multiple partitions which were all scanned with no problems.

    From your attachment, it also looks like you installed/un-installed quite a few pieces of software on the 29th. It also looks like you had Paragon HFS installed which is a file system driver, so who know's what sort of NTFS corruption you might have.

    I'd run a chkdsk on all drives and make sure there's no corruption in the NFTS indexes.
     
  8. vtol

    vtol Registered Member

    Joined:
    Apr 8, 2010
    Posts:
    774
    Location:
    just around the next corner
    thanks for the input, did that earlier already, not trouble with the disk or the ntfs index.

    you got the same settings?

    TS ep setup.png
    TS ep setup options.png
    TS ep setup objects.png
     
    Last edited: May 3, 2010
  9. Cudni

    Cudni Global Moderator

    Joined:
    May 24, 2009
    Posts:
    6,956
    Location:
    Somethingshire
    do you have archive files (rar, zip, iso etc)? are some big or complex with 000 files within? If yes, exclude those (archives in general) and see if it crashes again.
     
  10. vtol

    vtol Registered Member

    Joined:
    Apr 8, 2010
    Posts:
    774
    Location:
    just around the next corner
    thanks for the input. though it does not make sense, I got such files but only on e: not on d: and they were there prior this, still I gave your suggestions a shot but no avail, crashed again. having set the min logging verbosity to diagnostic level the log does not reveal a thing. But I noticed that it happens prior advancing to d:, just in the last bits of c:

    the ekrn.exe is reportedly crashed showing

    stop.png

    clicking ok gets me to

    04-05-2010 02-12-38.png

    and it stays that way until rebooting

    windows log from this crash stating:

    Faulting application name: ekrn.exe, version: 4.2.40.0, time stamp: 0x4baa62a0
    Faulting module name: MSVCR80.dll, version: 8.0.50727.4927, time stamp: 0x4a2752ff
    Exception code: 0xc000000d
    Fault offset: 0x00014ba1
    Faulting process id: 0x954
    Faulting application start time: 0x01caeb0c7bc34435
    Faulting application path: C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
    Faulting module path: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4927_none_d08a205e442db5b5\MSVCR80.dll
    Report Id: 76e6b164-5711-11df-a329-afc13330c153


    May 1st:

    Faulting application name: ekrn.exe, version: 4.2.40.0, time stamp: 0x4baa62a0
    Faulting module name: ntdll.dll, version: 6.1.7600.16385, time stamp: 0x4a5bdb3b
    Exception code: 0xc0000005
    Fault offset: 0x0002e23e
    Faulting process id: 0x594
    Faulting application start time: 0x01cae91779204168
    Faulting application path: C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
    Faulting module path: C:\Windows\SysWOW64\ntdll.dll
    Report Id: 29afc2dd-551a-11df-a3b3-f335e3eed773


    the before that

    Faulting application name: ekrn.exe, version: 4.2.40.0, time stamp: 0x4baa62a0
    Faulting module name: ntdll.dll, version: 6.1.7600.16385, time stamp: 0x4a5bdb3b
    Exception code: 0xc0000005
    Fault offset: 0x0002e23e
    Faulting process id: 0x7bc
    Faulting application start time: 0x01cae81b468065d6
    Faulting application path: C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
    Faulting module path: C:\Windows\SysWOW64\ntdll.dll
    Report Id: 54dac46c-5424-11df-b4f4-a70001456250
     
  11. vtol

    vtol Registered Member

    Joined:
    Apr 8, 2010
    Posts:
    774
    Location:
    just around the next corner
    also just ran a scan excluding the windows folder on c:, just to see whether NOD would hop on to d: and e:, which did without problem, thus deducing ntfs corruption.

    I want either the predecessor module back or an update to this module, fixing the problem
     
  12. vtol

    vtol Registered Member

    Joined:
    Apr 8, 2010
    Posts:
    774
    Location:
    just around the next corner
    for the sake of being thorough took NOD off the machine put Kaspersky on it and afterwards Sophos. Both went through the entire hard disk scan just fine, not stalling or quitting anywhere.

    ESET, please get this fixed!!!
     
  13. Geosoft

    Geosoft Registered Member

    Joined:
    Jan 7, 2009
    Posts:
    270
    Location:
    Toronto, Ontario, Canada
    With issues like these, it's probably best that you get support from their support channel, instead of requesting help through users from the forum:

    http://www.eset.com/support/contact
     
  14. vtol

    vtol Registered Member

    Joined:
    Apr 8, 2010
    Posts:
    774
    Location:
    just around the next corner
    do not concur, the more public an issue is made the better the chances it is not going to be burried, at he beginning of this thread an Eset moderator was present and is aware of the issue. similar thing happened with the Advanced heuristics module a short while ago, and eventually got fixed after being posted here.

    also just contacting them does not make other users aware of problems, just other (recent) posts here in the forum, e.g. https://www.wilderssecurity.com/showthread.php?t=271804
     
  15. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,376
    Could you please create a process dump at the moment of the crash by right-clicking ekrn.exe in the task manager and selecting "Create dump file"? When done, compress it, upload it somewhere and PM me the link to the dump.
     
  16. vtol

    vtol Registered Member

    Joined:
    Apr 8, 2010
    Posts:
    774
    Location:
    just around the next corner
    as much as I would like I do not, simply I am done beta testing for Eset, which I did not sign up for. I have been through couple of reboots just to deduce things and I am simply fed up with it by now, got other things to look after. This bug was introduced with the last Antivirus and antispyware scanner module: 1273 (20100429), obviously NOD killing itself when scanning OS relevant dll files. Your developers should know what regression they coded.

    Either NOD's gets it fixed or loose a couple of licenses due for refresh soon. I just need things paid for to run smooth and not giving me headache, mind you of https://www.wilderssecurity.com/showthread.php?t=269701&highlight=archive module
     
  17. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,376
    Help has been offered and your cooperation is required for pinpointing the issue.

    The fact that the scanner crashes on your computer when scanning a specific file doesn't make the product bad nor means the millions of other users experience it as well.
     
  18. vtol

    vtol Registered Member

    Joined:
    Apr 8, 2010
    Posts:
    774
    Location:
    just around the next corner
    analysis/cooperation/input has been offered from the very beginning. Eset kept quite, instead of asking what they need from the start.

    Never mentioned/implied it makes it bad for millions, it does though for me and that is what concerns me. There are not millions of computers yet out there running WIN 7 64bit with NOD32 64bit either, having a daily full scan with the same NOD settings. Eventually and gradually there will be others, making your developers to code more careful.

    This is just my opinion that things are not going very well with the development of NOD as of lately. And yes, other AV vendors do have significantly more trouble - say McAfee, but that does not mean it should be bar for Eset.
     
    Last edited: May 4, 2010
  19. rockshox

    rockshox Registered Member

    Joined:
    Oct 23, 2009
    Posts:
    261
    I checked my settings on the In Depth scan and I have one setting different.

    On the "Other" tab for the Threat Sense options for In-Depth I do not have checked:

    "Preserve Last Access Timestamp"
     
  20. vtol

    vtol Registered Member

    Joined:
    Apr 8, 2010
    Posts:
    774
    Location:
    just around the next corner
    bummer, still no fix ...
     
  21. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,376
    We are still waiting for a process dump from ekrn from anybody having issues with the scanner crashing.
     
  22. vtol

    vtol Registered Member

    Joined:
    Apr 8, 2010
    Posts:
    774
    Location:
    just around the next corner
    oh, too bad, but it should not take long for now for one of NOD's beta tester to come forward
     
  23. vtol

    vtol Registered Member

    Joined:
    Apr 8, 2010
    Posts:
    774
    Location:
    just around the next corner
    Since there was an update introduced today on the Advanced heuristics module: 1108 (20100519) I felt intrigued to run a full in-depth scan, either to see whether the matter got fixed or to get the dump file for analysis.

    And interestingly the scan went though without a hitch this time. Will turn on nightly scans again and keep an eye on it, certainly reporting back if the issue arises again.
     
  24. vtol

    vtol Registered Member

    Joined:
    Apr 8, 2010
    Posts:
    774
    Location:
    just around the next corner
    well, celebrated too early, ekrn.exe crashed again, again the faulty module ntdll.dll. I am not going to run another in depth scan until there is new version of the Antivirus and antispyware scanner module out, as this is wasting my time. I cannot sit next to the machine during the scan, waiting to create the dump, as the crash can happen any time during the 1 hour scan...

    Again I would appreciate the get back the preceding Antivirus and antispyware scanner module, where this problem did not occur.
     
  25. vtol

    vtol Registered Member

    Joined:
    Apr 8, 2010
    Posts:
    774
    Location:
    just around the next corner
    a thought, would make things much easier - why is NOD not automatically creating a crash dump as most applications would do these days, at least when the developers are interested to catch the snags in their software? this way the user could help without sitting by the machine and watching with an itchy finger to create a dump upon crash? how about that?
     
Thread Status:
Not open for further replies.