ekrn.exe excessive CPU use rollcall

I am one of the people affected by the NOD32 bug where ekrn.exe uses up all CPU resources to the extent that the system is unusable.

I am curious how many other forum participants have been affected.

Other than removing and reinstalling (which did not help), I have not received any suggestions from ESET support. I suspect that they are overwhelmed by other users with similar problems as it is taking them unusually long to respond. I had already tried deleting the update cache, etc. that some of the threads here had suggested.

I would also appreciate people's recommendations about other AV software than NOD32. After now 2 weeks of trouble, I have reached the point that I need to think about other products. This is a serious problem and ESET better wake up. It may not affect every individual user, but with bugs like this one, any potential corporate client should think twice before rendering a subset of their workstations useless in this manner.

Thanks in advance.

 

Hello!

I have a few suggestions you can try in that order.

The first one:

1. Download fresh new version of the trial of ESET NOD32 Antivirus 3.0.650 from
http://www.eset.eu/download/trial . Make sure that you choose the correct version.

2. Uninstall your current version from Control Panel
3. Reboot the computer when prompted
4. Delete manually these folders:

for XP:
- C:\Program files\ESET
- C:\Documents and Settings\All users\Application data\Eset
- C:\Documents and Settings\~username~\Local Settings\Application data\Eset

for Vista:
- C:\Program files\ESET
- C:\Program data\Eset
- C:\Users\~username~\AppData\Local\Eset

5. Reinstall your ESET NOD32 software using the file you downloaded in step1 . Use typical install. Note! During the installation process , remove the username/password provided in the trial installer and use place your own .

6. Update the program

7. Configure it as shown here
https://www.wilderssecurity.com/showpost.php?p=1260538&postcount=42

8. Reboot and try again




Second suggestion:

1. Download fresh new version of ESET NOD32 2.70.39 from
http://www.eset.com/download . Make sure that you choose the correct version.

2. Uninstall your current version from Control Panel
3. Reboot the computer when prompted
4. Delete manually these folders:

for XP:
- C:\Program files\ESET
- C:\Documents and Settings\All users\Application data\Eset
- C:\Documents and Settings\~username~\Local Settings\Application data\Eset

for Vista:
- C:\Program files\ESET
- C:\Program data\Eset
- C:\Users\~username~\AppData\Local\Eset

5. Reinstall your ESET software using the file you downloaded in step1 . Use typical install.

6. Perform step 5 from here
https://www.wilderssecurity.com/showpost.php?p=1057044&postcount=16

Hope that helps! Version 2.7 is still supported so you won't have problems using it unless 3.0.650 cannot work well for you - this is temporary , I hope

 

Lol, I find it funny how everytime someone comes to this forum with a problem they get the same response...

Uninstall
Reboot
Delete leftovers
Install
Reboot

Basically, NOD32 "deteriorates" over time and requires fresh installations every couple of months.

 

Thank you for your suggestions. I have already tried these and similar suggestions and exhausted the online help resources that I could find. I already went through the motions of disabling non-essential services and leaving NOD32 on to see if it would help before contacting ESET. Now having wasted hours with this problem, as much as I like NOD32, I need to find another solution. I would have been even more appreciative of recommendations about an alternative, reliable AV product.

 

@guest

With NOD32 , it is relatively easy - once something gets corrupted , you know that with NOD32 you simply reinstall it . Next time it will use default settings and it will work . Other programs may not work that way - they have so many leftovers . "Big names" in the industry are still disaster when it comes to their packs.

You say once have to reinstall it often - no , not necessary . I am sure you see only the problematic cases here in the forum . We have many clients who haven't been reinstalled for whole year - running great and detecting threats .

You are welcome!

I am sorry for the time you have lost . I can't recommend you another antivirus program because I think ESET products are the still the best combination of reliable , fast , light and effective-enough antivirus/anti-malware software (even though they also have some disadvantages - just like everything in this world).

 

I also have the 100% cpu ussage. Called eset and they said to disable scan all files,run time packers and advanced heuristics. doesnt it defeat the purpose of nod32's award winning heuristics if you disable them?? hopefully a new version will fix the cpu usage. **shrug**

 

Even when I disable protection completely, the problem persists. I also noticed that ekrn.exe finally settles down after chomping up anywhere between 2 and 4.5 hours of total CPU time. In other words, my boot time can take over 4 hours before the PC finally starts responding. in the iterim, I also deleted all cached files, removed email clients and their data files, disabled non-essential services, and the problem persists.

 

Well, I think that the only protection NOD32 is currently providing on my affected system is by tying up all resources such that no malware (or any other program) has a chance to run.

ESET's release cycles are months apart and unfortunately, esoteric bugs like this one are often there to stay ...

 

2.0+ didn't. Worked great. I didn't have to do any maintainence. I wouldn't have upgraded if I knew I'd be faced with this C_ _ _

 

Just for testing purposes, could you please try disabling redirection for all programs listed in the Internet browsers list by putting a cross to all boxes?

If there's another program that communicates via http/pop3, you'll see ekrn utilizing cpu as all such traffic is redirected through it. For instance, there is a known bug in Windows Update that causes svchost.exe to extremly utilize the cpu. If svchost.exe is set as a web browser, you'd see ekrn utilizing the cpu instead of svchost.

 

We tried with and without selections and it has no effect. What we see in Task Manager are several minutes of spikes in ekrn.exe every two seconds. These several-minute periods start randomly and don't result in a signature update. They go away by themselves but start again if we open a browser or visit a web site that has video - whether or not the boxes are checked.

When it starts up, it actually makes it impossible to view or listen to YouTube videos - it breaks up and seriously distorts the sound every two seconds.

We have a 5MB fiber connection but for the last two weeks or so we can't even use our Netflix watch-now subscription. Whatever you did around that time, please undo it.

 

Unfortunately thats why I had to change products as well I used to recommend nod like crazy to people. but now I don't just simply becuse of problems like this, I have had 2 cust that I recommend this to have the CPU lockup happen to them. Only thing that fixed it on there was goin to 2.7 and that did fix the issue. but the Customer had a very hard time with the UI of 2.7 /shrug so ended up having to change them out to diff software and them spending a extra 50$ to go to that software instead.

I think personaly Nod needs to learn to send out hotfix or update more often this problem has been around a month now and I can only feel for the guys that cant get to these forums or don't have enough know how to get help other then support which just tells them to simply reinstall. keep in mind we are a wired kind of breed that hangs out on these forums that not everyone knows how to access.

Nod32 otherwise is a Good product just needs more support in the end. Insted of hey Delete reinstall see if it works

Just my 2cents

 

As this forum is confined to Nod32 Support and discussion, feel free to have a look at our other anti-virus software forum. That's where all other AV's can be discussed.

 

i havent had any issues with nod32 in the few times i have tryed nod32 3.0
most issues are normally from remaindents of another av.
no software is completely free from bugs.
im having a few issues with some of the software i use atm but i know in time they wil be fixed.

 

I have over 500 installs of Nod32 I manage;



We have had some utilization issues.

Things to fix our issues;

#1) I've ran a chkdsk /f c: on every PC. Several with corrupt hard drives caused Nod32 3.0 (not 2.7) to appear to loop.
#2) Cleanup junk in %windir%\installer -- There were some old .tmp files that were causing 3.0 to loop. (Just a few PC's had this issue. Be very careful in here.)
#3) Disable advanced heuristics on the realtime. It will still use that on newely created files (if you leave it that way.) Just not older dated files. Of course, the date can be modified by the virus to get past this. I don't like this fix, but it makes a huge difference.
#4) Nero 6 is not compatible with Nod32 3.0. The details are here;
https://www.wilderssecurity.com/showthread.php?t=210298
This will result in folders with videos taking forever to navigate.
#5) We had to remove Windows Explorer Enhancements from Notepad++, Acronis True Image, Ghost, Winzip, and others. This is the additional items you get from right clicking.
#6) We disabled the scan on startup, scan on login, and scan on system component updates. These default settings left Nod32 in perpetual scanning.
#7) While XP SP3 is rolling out, we have excluded %windir%\installer as it conflicts with Nod32. Microsoft recommends disabling your AV when installing XP SP3. We have 500+ machines and this is automatic, so this is how we handle it. To be fair, we had this problem with other large updates Prior to using Nod32 3.0. It's a temporary exlucsion.

It's been a battle, but it's working ok now. Hope one of those solutions help you.

 

I have used NOD for a long time,but this computer will not work with NOD anymore. Ekrn.exe will go to 100% and nothing will work. I have tried what was suggested but to no avail. It has XP Pro.SP3 and an AMD processor.

 

I noticed that ekrn.exe was ok until I opened FireFox 3. I should say tried to open.

 

Thank you very much for sharing the detailed information. Not all apply to me, but I applied everything possible. I also disabled "scan all files" in the Real Time File System Protection/ThreatSense engine parameters setup, which ESET support advised me to do. Unfortunately things are no better at my end ... and it took me a couple of days to make it back here.

It is sad to see this happening to NOD32 and its users. As far as my experience is concerned, this all started after the build 550 -> 557 upgrade. 667 is no better (and maybe even worse).

 

Hi Bubba:

Sorry if I violated any netiquette here. But this really is a question from a current NOD32 user directed to fellow NOD32 users, and not directed to a more general user base. Would you not agree that asking NOD32 users what they would use if not NOD32 is a question that can best be asked here?

 

As I stated above...."this forum is confined to Nod32 Support and discussion, feel free to have a look at our other anti-virus software forum. That's where all other AV's can be discussed."

It's pretty cut and dry that any AV discussion other than Nod is off topic to these forums.

Since We already have an ongoing thread concerning excessive CPU usage, We ask that those with this issue Please participate in that thread.

With that said and since there are a number of members participating in that thread experiencing this issue, We'll let that be the "ekrn.exe excessive CPU use rollcall" and bring this thread to a close. Also, for those that feel the need to discuss other AV alternatives, our forum for that discussion is linked above.

Bubba