[Help]Analysis of application protocols will not function

Quote: " Have you already contacted customer care and provided them with a log from ESET SysInspector? Most likely there's another tdi driver installed that interferes with the epfw driver. "

You cannot change that, windows controls the TAG when it drops the driver into a load order group, if one is specified and windows does not assign the same tag as any other driver in the group allready, so no conflict there..The only thing you can do is manually change the TAG to a lower number so it gets an earlier priority than the other driver in the same group, or alternatively just ensure that EPFWTDIR starts before EASDRV, by changing EASDRV to auto instead of system start.then they load in this order, which is confirmed by a bootlog:

** GOOD **
epfwtdir
easdrv
eamon

********

** BAD **
easdrv
epfwtdir
eamon

so most of these problem come to the conclusion that epfwtdir want to start first, then there are no issues, simply change the INF's that install these services, easdrv should also NOT be in the " base " group.

epfwtdir should be considered a high level filter driver / FILE_SYSTEM_DRIVER and not a kernel driver.though they can be the same, but it does not belong in the PNP_TDI group, it should go wayyyyyy before that near the filters, but also not the base, else it will fail to start.

 

I messed around with easdrv and epfwtdir and put them both in PNP_TDI and gave epfwtdir a tag of 38 and easdrv a tag of 39 so it starts just before it, and it was still fine, zero problems.

 

I'm going to check into this, but your research sounds good. With such a bad job market here in the US, Eset should have guys like yourself on staff because I haven't seen anyone from Eset here at the forum analyzing the product and issues as deeply as you did here.

 

Thank you, I appreciate the compliment, yes I have always been very analytical and an awesome troubleshooter. I have gotten a bit rusty, but I can still kick some butt though. Just imagine how good I was 5 or 10 years ago, I am 35 now and battered with depression. Shame, depression has a huge effect on pc repair’s notice it takes me alot longer than before to fix things, yet I still eventually always do, also very hard to focus with depression, it the worst illness i tell ya, I’m taking a beating here and am actually still looking for a job, but figure I might try to get the depression cured first.


I would also need a spelling and grammar checker on my workstation, as you can tell that has gone to the dogs as well on me, probably another side effect of serious untreated depression = poor spelling and grammar.

 

ccomputertek would you please be a bit more specific on how you changed the tags / start order.


Thank you!

 

What OS do you have ? What version of NOD32 are you running?Go find NTBTLOG.txt and delete it, thats the boot log, then restart your computer and press F8 and select enable boot logging and post your new boot log here so I can see, then mabe I can help you.What problem are you having with NOD32, What is the specific error your getting ?

NTBTLOG.txt should be in your windows folder.

 

I have made some mistakes while solving this, so I retract this statement.Epfwtdir depends on tcpip, so if it loaded before the Pnp_tdi group it would fail every time, since that is the same group where tcpip loads from.If epfwtdir does not see tcpip loaded in memory, it will fall on it's face, it clearly depends on it.Vista / windows 7 are a whole nother ball game with this new epfwwfper or whatever driver, vista / 7 do this way differently, tcpip even loads at boot instead of system start on those operating systems.I know these EPF drivers depend on tcpip, but I don't know what else it depends on in vista /7 as I moved them around a bit, and it fails to load everywhere unless their loaded a certain way, in a certain order.

Also, I was wrong about the load order groups and the order in which they load, I was looking at the list listed alphabetically and found the section with the actual load order, this is the right load order of the groups for drivers:

System Reserved
Boot Bus Extender
System Bus Extender
SCSI miniport
Port
Primary Disk
SCSI Class
SCSI CDROM Class
FSFilter Infrastructure
FSFilter System
FSFilter Bottom
FSFilter Copy Protection
FSFilter Security Enhancer
FSFilter Open File
FSFilter Physical Quota Management
FSFilter Encryption
FSFilter Compression
FSFilter HSM
FSFilter Cluster File System
FSFilter System Recovery
FSFilter Quota Management
FSFilter Content Screener
FSFilter Continuous Backup
FSFilter Replication
FSFilter Anti-Virus
FSFilter Undelete
FSFilter Activity Monitor
FSFilter Top
Filter
Boot File System
Base
Pointer Port
Keyboard Port
Pointer Class
Keyboard Class
Video Init
Video
Video Save
File System
Event Log
Streams Drivers
NDIS Wrapper
COM Infrastructure
UIGroup
LocalValidation
PlugPlay
PNP_TDI
NDIS
TDI
NetBIOSGroup
ShellSvcGroup
SchedulerGroup
SpoolerGroup
AudioGroup
SmartCardGroup
NetworkProvider
RemoteValidation
NetDDEGroup
Parallel arbitrator
Extended Base
PCI Configuration
MS Transactions

 

I am getting this error:
An error occurred while starting services,Analysis of application protocols (POP3,HTTP)will not function

Opperating system is Vista and the ESET NOD 32 version is 4.0.437.0

I get the error more often when I use a password login to user. It seems less frequent when I boot directly to single user with no login.

Will get back to you on the boot log. This is on a Samsung Q1 ultra UMPC and I will have to figure out a keyboard so I can get function keys.

Since this is Vista it looks like you may not be able to help me.

Thanks

 

go to your device manager, click view at the top and show hidden devices.find your ehdrv which is the eset helper driver and change it from system startup to demand startup, reboot and post back the results.

Also said you used comodo firewall ? the free version ?

 

Just to make sure, do you have Vista SP2 or at least SP1 installed?

 

Yes, some more questions.what comodo do you have, there are a few installs.
the firewall only CFP_Setup_3.0.25.378_XP_Vista_x32 free, the free suite CIS_Setup_3.11.108364.552_XP_Vista_x32 or the paid for suite.Did you install NOD32 before or after comodo firewall, if you uninstall comodo from safemode does the problem go away ?

epfwwfper does not go into a load order group, it's nulled out if you look at the install INF in the drivers folder.Not much you can do to move that around, don't think it will start if set to demand.since it doesn't go into a load order group it also has no tag.

and if your getting that error and in your event log it says boot start or system start driver epfwwfper failed to load, then it won't show up in the boot log, so I can't even see where it tried to load.But I can see where the firewall drivers are loading and might be able to move something around so there's no conflict.I have tried zone alarm togeather with NOD32 and I see no problems, they also have a free version firewall you can use.

If you direct me to the install file you used to install comodo, I can install and try to reproduce the problem and a workaround, if you insist on using comodo.

 

I did a clean install of windows 7 RTM build 7600 on another partition, installed comodo firewall pro free version 3.0.25.378 and rebooted and installed NOD32 4.0.437 and did not encounter any issues.I consider windows 7 close enough to vista, so this is what I used to test them togeather.

I see potential for problems such as the built in antivirus of this firewall that all the versions including the free ones come with.

I see cmdguard.sys loads in the fsfilter antivirus section, same as Eamon.sys of NOD32, but NOD32 does not load with that group because it's not set to system start, so not an issue.I also see a couple comodo files go into pnp_tdi, but epfwwfpr.sys does not load with a group, loads after them so not an issue.Basically all the comodo files have loaded into memory before NOD32 and NOD32 does not have a problem with them that I can see.Mabe if I would have installed NOD32 first then comodo it would have changed things a bit.

Anyway, here is my boot log with the comodo and NOD32 drivers highlighted in bold, does the order your drivers are loading look similiar ?

Microsoft (R) Windows (R) Version 6.1 (Build 7600)
9 9 2009 06:22:00.500
Loaded driver \SystemRoot\system32\ntoskrnl.exe
Loaded driver \SystemRoot\system32\halmacpi.dll
Loaded driver \SystemRoot\system32\kdcom.dll
Loaded driver \SystemRoot\system32\mcupdate_AuthenticAMD.dll
Loaded driver \SystemRoot\system32\PSHED.dll
Loaded driver \SystemRoot\system32\BOOTVID.dll
Loaded driver \SystemRoot\system32\CLFS.SYS
Loaded driver \SystemRoot\system32\CI.dll
Loaded driver \SystemRoot\system32\drivers\Wdf01000.sys
Loaded driver \SystemRoot\system32\drivers\WDFLDR.SYS
Loaded driver \SystemRoot\system32\DRIVERS\ACPI.sys
Loaded driver \SystemRoot\system32\DRIVERS\WMILIB.SYS
Loaded driver \SystemRoot\system32\DRIVERS\msisadrv.sys
Loaded driver \SystemRoot\system32\DRIVERS\pci.sys
Loaded driver \SystemRoot\system32\DRIVERS\vdrvroot.sys
Loaded driver \SystemRoot\System32\drivers\partmgr.sys
Loaded driver \SystemRoot\system32\DRIVERS\volmgr.sys
Loaded driver \SystemRoot\System32\drivers\volmgrx.sys
Loaded driver \SystemRoot\system32\DRIVERS\viaide.sys
Loaded driver \SystemRoot\system32\DRIVERS\PCIIDEX.SYS
Loaded driver \SystemRoot\System32\drivers\mountmgr.sys
Loaded driver \SystemRoot\system32\DRIVERS\atapi.sys
Loaded driver \SystemRoot\system32\DRIVERS\ataport.SYS
Loaded driver \SystemRoot\system32\DRIVERS\amdxata.sys
Loaded driver \SystemRoot\system32\drivers\fltmgr.sys
Loaded driver \SystemRoot\system32\drivers\fileinfo.sys
Loaded driver \SystemRoot\System32\Drivers\Ntfs.sys
Loaded driver \SystemRoot\System32\Drivers\msrpc.sys
Loaded driver \SystemRoot\System32\Drivers\ksecdd.sys
Loaded driver \SystemRoot\System32\Drivers\cng.sys
Loaded driver \SystemRoot\System32\drivers\pcw.sys
Loaded driver \SystemRoot\System32\Drivers\Fs_Rec.sys
Loaded driver \SystemRoot\system32\drivers\ndis.sys
Loaded driver \SystemRoot\system32\drivers\NETIO.SYS
Loaded driver \SystemRoot\System32\Drivers\ksecpkg.sys
Loaded driver \SystemRoot\System32\drivers\tcpip.sys
Loaded driver \SystemRoot\System32\drivers\fwpkclnt.sys
Loaded driver \SystemRoot\system32\DRIVERS\vmstorfl.sys
Loaded driver \SystemRoot\system32\DRIVERS\volsnap.sys
Loaded driver \SystemRoot\system32\DRIVERS\viaagp.sys
Loaded driver \SystemRoot\System32\Drivers\spldr.sys
Loaded driver \SystemRoot\system32\DRIVERS\RecAgent.sys
Loaded driver \SystemRoot\System32\drivers\rdyboost.sys
Loaded driver \SystemRoot\System32\Drivers\mup.sys
Loaded driver \SystemRoot\System32\drivers\hwpolicy.sys
Loaded driver \SystemRoot\System32\DRIVERS\fvevol.sys
Loaded driver \SystemRoot\system32\DRIVERS\disk.sys
Loaded driver \SystemRoot\system32\DRIVERS\CLASSPNP.SYS
Loaded driver \SystemRoot\system32\DRIVERS\cdrom.sys
Loaded driver \SystemRoot\System32\DRIVERS\cmdguard.sys
Loaded driver \SystemRoot\System32\Drivers\Null.SYS
Loaded driver \SystemRoot\System32\Drivers\Beep.SYS
Loaded driver \SystemRoot\system32\DRIVERS\ehdrv.sys
Loaded driver \SystemRoot\System32\drivers\vga.sys
Loaded driver \SystemRoot\System32\DRIVERS\RDPCDD.sys
Loaded driver \SystemRoot\system32\drivers\rdpencdd.sys
Loaded driver \SystemRoot\system32\drivers\rdprefmp.sys
Loaded driver \SystemRoot\System32\Drivers\Msfs.SYS
Loaded driver \SystemRoot\System32\Drivers\Npfs.SYS
Loaded driver \SystemRoot\system32\DRIVERS\tdx.sys
Loaded driver \SystemRoot\System32\DRIVERS\cmdhlp.sys
Loaded driver \SystemRoot\system32\drivers\afd.sys
Loaded driver \SystemRoot\System32\DRIVERS\netbt.sys
Loaded driver \SystemRoot\system32\DRIVERS\wfplwf.sys
Loaded driver \SystemRoot\system32\DRIVERS\pacer.sys
Loaded driver \SystemRoot\system32\DRIVERS\netbios.sys
Loaded driver \SystemRoot\system32\DRIVERS\serial.sys
Loaded driver \SystemRoot\system32\DRIVERS\wanarp.sys
Loaded driver \SystemRoot\system32\DRIVERS\termdd.sys
Loaded driver \SystemRoot\system32\DRIVERS\rdbss.sys
Loaded driver \SystemRoot\system32\drivers\nsiproxy.sys
Loaded driver \SystemRoot\system32\DRIVERS\mssmbios.sys
Loaded driver \SystemRoot\System32\drivers\discache.sys
Loaded driver \SystemRoot\system32\drivers\csc.sys
Loaded driver \SystemRoot\System32\Drivers\dfsc.sys
Loaded driver \SystemRoot\system32\DRIVERS\blbdrive.sys
Loaded driver \SystemRoot\system32\DRIVERS\tunnel.sys
Loaded driver \SystemRoot\system32\DRIVERS\amdppm.sys
Loaded driver \SystemRoot\System32\drivers\dxgkrnl.sys
Loaded driver \SystemRoot\system32\DRIVERS\nvlddmkm.sys
Loaded driver \SystemRoot\system32\DRIVERS\SlWdmSup.sys
Loaded driver \SystemRoot\system32\DRIVERS\slntamr.sys
Loaded driver \SystemRoot\system32\DRIVERS\Mtlmnt5.sys
Loaded driver \SystemRoot\system32\drivers\modem.sys
Loaded driver \SystemRoot\system32\DRIVERS\Rtnicxp.sys
Loaded driver \SystemRoot\system32\DRIVERS\usbuhci.sys
Loaded driver \SystemRoot\system32\DRIVERS\usbehci.sys
Loaded driver \SystemRoot\system32\drivers\RTKVAC.SYS
Loaded driver \SystemRoot\system32\DRIVERS\fdc.sys
Loaded driver \SystemRoot\system32\DRIVERS\serenum.sys
Loaded driver \SystemRoot\system32\DRIVERS\parport.sys
Loaded driver \SystemRoot\system32\DRIVERS\i8042prt.sys
Loaded driver \SystemRoot\system32\DRIVERS\mouclass.sys
Loaded driver \SystemRoot\system32\DRIVERS\kbdclass.sys
Loaded driver \SystemRoot\system32\DRIVERS\CompositeBus.sys
Loaded driver \SystemRoot\system32\DRIVERS\AgileVpn.sys
Loaded driver \SystemRoot\system32\DRIVERS\rasl2tp.sys
Loaded driver \SystemRoot\system32\DRIVERS\ndistapi.sys
Loaded driver \SystemRoot\system32\DRIVERS\ndiswan.sys
Loaded driver \SystemRoot\system32\DRIVERS\raspppoe.sys
Loaded driver \SystemRoot\system32\DRIVERS\raspptp.sys
Loaded driver \SystemRoot\system32\DRIVERS\rassstp.sys
Loaded driver \SystemRoot\system32\DRIVERS\inspect.sys
Loaded driver \SystemRoot\system32\DRIVERS\rdpbus.sys
Loaded driver \SystemRoot\system32\DRIVERS\swenum.sys
Loaded driver \SystemRoot\system32\DRIVERS\umbus.sys
Did not load driver \SystemRoot\System32\drivers\vga.sys
Loaded driver \SystemRoot\system32\drivers\MODEMCSA.sys
Loaded driver \SystemRoot\System32\Drivers\fastfat.SYS
Loaded driver \SystemRoot\system32\DRIVERS\usbhub.sys
Loaded driver \SystemRoot\system32\DRIVERS\flpydisk.sys
Loaded driver \SystemRoot\System32\Drivers\NDProxy.SYS
Did not load driver \SystemRoot\System32\Drivers\NDProxy.SYS
Did not load driver \SystemRoot\System32\Drivers\NDProxy.SYS
Did not load driver \SystemRoot\System32\Drivers\NDProxy.SYS
Did not load driver \SystemRoot\System32\Drivers\NDProxy.SYS
Loaded driver \SystemRoot\system32\DRIVERS\monitor.sys
Loaded driver \SystemRoot\system32\drivers\luafv.sys
Loaded driver \SystemRoot\system32\DRIVERS\eamon.sys
Loaded driver \SystemRoot\system32\DRIVERS\lltdio.sys
Loaded driver \SystemRoot\system32\DRIVERS\rspndr.sys
Loaded driver \SystemRoot\system32\drivers\HTTP.sys
Loaded driver \SystemRoot\system32\DRIVERS\bowser.sys
Loaded driver \SystemRoot\System32\drivers\mpsdrv.sys
Loaded driver \SystemRoot\system32\DRIVERS\mrxsmb.sys
Loaded driver \SystemRoot\system32\DRIVERS\mrxsmb10.sys
Loaded driver \SystemRoot\system32\DRIVERS\mrxsmb20.sys
Loaded driver \SystemRoot\system32\DRIVERS\parvdm.sys
Loaded driver \SystemRoot\system32\DRIVERS\epfwwfpr.sys
Loaded driver \SystemRoot\system32\drivers\peauth.sys
Loaded driver \SystemRoot\System32\Drivers\secdrv.SYS
Loaded driver \SystemRoot\System32\DRIVERS\srvnet.sys
Loaded driver \SystemRoot\System32\drivers\tcpipreg.sys
Loaded driver \SystemRoot\System32\DRIVERS\srv2.sys
Loaded driver \SystemRoot\System32\DRIVERS\srv.sys
Did not load driver \SystemRoot\System32\DRIVERS\srv.sys

 

I am using ESET Anitvirus only. My Vista is running on SP2. Comodo firewall is free version CIS_Setup_3.11.108364.552_XP_Vista_x32.

Unfortunately I have a business trip today and can not continue trouble shooting this problem. I uninstalled ESET and installed Comodo antivirus for now until I can get back to this.

What was most interesting about this problem was that is was intermittent and occurred more often when I used a windows log in as opposed to using no log in screen and booting directly to user.

I did remove both Comodo and ESET from the start up menu and played around with manually starting them, however I still got the error. I guess there are some drivers that load no matter if the programs are in the start up or not.

Thanks for all your quick replies. Too bad they do not have you on their staff ccomputertek. This problem would probably be fixed by now if they did.

 

I appreciate the positive feedback, however I did not write the program, so there are a few things I still don't understand about it with this new version.

I uninstalled comodo firewall pro that I had downloaded and then installed over top of NOD32 4.0 the version you have, does not matter which you install first.I set the firewall to either firewall security or proactive security and have encountered no issues with conflicts.Of course I unchecked the option to install the antivirus module for comodo and just selected firewall.Since I could not reproduce the problem on windows 7, I will go ahead and install windows vista home premium on another partition and test it again and will report back any issues.

Like superman, I allways try to help people when I can.And for the love of NOD32 and all the good I heard about it before trying it, I see it as a shame people are turning to other products because of some issues that I have found can be easily fixed with some minor changes.

I changed around the INF's for the drivers of NOD32 3.0, because Thats what I want to stick with, and never have any kind of problem with it now.It's weird how prefetch in windows xp was causing a problem with NOD32, But I fixed that very easily, just took awile and some trial and error to see what was causing it.

 

Installed both on fresh windows vista home premium SP2, no issues.The only way I can help is if you post up a clean boot log.Windows creats a bootlog when you go into safe mode and it can get quite long, thats why to delete one if it's there and let it create a new one with just the one boot, the only way i'll be able to help you further.This is also no password at the welcome screen, no welcome screen just goes str8 to the desktop and no problems here, has to be something else on yours, but I can't do anything else without the boot log.

 

Just came across and fixed this problem, though there are a couple different reasons it can happen.If you see this error go into device manager show hidden devices and depending on which OS and version of NOD32 your using see if there is an exclamation point by either epfwtdir or epfwwfpr, if there is, and you go to the driver tab, try to start the service manually.If you get the message " error while starting service, the file could not be found.Go to hkey local machine current control set, services and find the driver name and delete the key, not the value or the data, the actual key.Reboot and go to your program files folder where NOD32 is and go into the drivers folder, right click and " install " the INF again <---- before that go to system32\drivers and delete the driver from there also.

Should fix it.

Try that Glasairmell, that will narrow it down alot.

 

I'm using Windows Vista on my Laptop, and yesterday I've tried reinstalling older version into a newer Nod32 4.0.314. But the result was unexpected. Not only that the Maximum prtection is not ensured, but also I can't delete the programme from the system, as I get folllowing message: "Another application has exclusive to the file 'C:\ProgramData\ESET\ESET NOD32 Antivirus\Logs\virlog.dat'. Please shut down all other applications, the click Retry."

I really need your advice on this.

 

Reliah,

Here are a few things to try that ought to (theoretically) fix the problem.

1) Disable Self-Defense in the ESET Advanced Options; reboot.

2) Enter Control Panel > Administrative Tools > Services > ESET Service; change Recovery > First Failure to "Take No Action".

3) Kill task ekrn.exe (ESET service) from within Task Manager. Also kill egui.exe.

4) Download Unlocker; install.

5) Navigate to C:\ProgramData\ESET\ESET NOD32 Antivirus\Logs\, right-click virlog.dat, choose Unlocker. Click Unlock All if any handles are listed.

6) Delete virlog.dat.

7) Attempt to uninstall ESET NOD32 again.

If you still have problems, let me know and we'll perform a full permissions reset.

-Steve

 

I get this issue in about 5% of my installations. There seems to be no reliable fix, apart from installing v2.7.

 

Biscuit,

Same here. I have tried everything from resetting the LSP stack/Winsock registry keys to performing a full permissions reset with subinacl, and yet nothing seems to work. It's truly bizarre.

There has probably been at least ten computers I've simply given up trying to install ESET on and reverted to AVG with SpywareBlaster and Windows Defender.

-Steve

 

I don't see how this post references the HTTP / POP3 error, besides, I explaind this in strict detail the 2 causes of the HTTP / POP3 error and how to fix with success, mabe search the error by name on here and see some of my older posts.

 

Hey there ccomputertek,

In case it's of any interest, while I'm certain your solution (manually reinstalling the epfwtdir/epfwwfpr drivers) applies in many situations, I have attempted it on a few PCs with no success. I think perhaps other causes can lead to this as well... it's certainly puzzling, I'll say that.

I just wanted to make this known, as it's been a source of frustration for me, as well, and I'm a tech also!

-Steve

 

Encountered this problem. Determined that epfww.... was being blocked by online armor. Allowing worked, at least so far.

 

Which error do you see most of Steve ?

this one:
Personal firewall An error occurred while starting services. Analysis of application protocols (POP3, HTTP) will not function.

or this one:
Personal firewall An error occurred while starting proxy server. Checking of application protocols (POP3, HTTP) will not work.


Or allways both at the same time ?

what operating systems on these machines ? Allways NOD32 V4.0 and windows vista / Win7 ?

 

Hey ccomputertek,

Typically the first one, though it most often occurs on XP machines in my experience. However, I have seen it on Vista machines before as well. A couple of times I was able to correct the issue by forcing a pfw driver reinstall, but other times it was unsuccessful.

I have done a little bit of troubleshooting on my end with the help of Process Explorer and company, but it's been very strange indeed. As with the installation errors, I also have tried resetting the LSP stack/Winsock registry keys and even performing the customary full permissions reset via subinacl (which I saw you had suggested previously as well for something else), but nothing seems to have worked. Eventually I gave up and temporarily reverted to AVG/SpywareBlaster (and the Windows Firewall, of course). Occasionally, depending on my mood, I will enable Windows Defender also along with ESET, though I usually disable the real-time scanning component and simply schedule a nightly scan. I don't do this on laptops however.

-Steve