ekrn.exe loops on some iso files

I am going to attach the process monitor trace. It isn't one after another, but if you search out the offsets you can see they repeat about once per minute. It never finishes this scan.

I created an exception for this file, only to have it hit on another. The two are both .iso disk images and both rather large.

Unfortunately I cannot attach the file to this case as .rar or .zip or .xml files are not allowed. Where should I send this to?

I have been working with support for over 2 weeks now and they are absolutely retarded. When they do respond, it is like they didn't even read what I sent in, and then refer me to another kb article. That is IF they respond. Sometimes it takes days. I don't think I have ever found worse support for a commercial product that I paid for. Oh yes... also when it starts to scan one of these files, it will not close itself. I have to kill the process. Even clicking stop on the scan does nothing. ekrn.exe continues to loop through the file.

Version 4.0.424.0
Vista Ultimate 64-bit SP1
Core i7 920 12GB Ram

 

maybe it simply chokes on the sheer size of the archive which i would exclude regardless

 

Yah... I don't agree with that sentiment. I use Symantec at work, Avast and AVG on the other two computers in my house, and NOD32 is the only one I have any issue with on large archives.

It shouldn't be an issue. This isn't some crappy shareware I downloaded off the internet. It is a paid for commercial antivirus product, that typically has received rave reviews. I figured I would give it a shot. This issue needs to be resolved, and simply not scanning large archives is not an option I as a paying customer am willing to accept.

 

ISO files are usually very large as they contain complete images of CDs/DVDs. When scanned, the whole ISO file is first unpacked to the temp folder on the disk and each file is subsequently scanned. Depending on the number of files in ISO images, exration/scanning may take signifficant amount of time. I'd suggest setting a size limit for scanned objects which is most likely used by other scanners not showing this problem.

 

there is no point in scanning archives and especially not big archives. Anything that might be considered badware is dormant and if it can be detected will be detected by the realtime monitor when it is unpacked/expanded anyway. All the other AV you mention have similar issues or they are not checking thoroughly or checking is optimised as Marcos suggests.