How long does a startup scan take?

Discussion in 'ESET NOD32 Antivirus' started by grun93, Aug 11, 2010.

Thread Status:
Not open for further replies.
  1. grun93

    grun93 Registered Member

    Joined:
    May 11, 2009
    Posts:
    24
    Today I had to reboot my pc three times already because something strange is happening. And, although not 100% sure, I think it may have to do with Nod32.

    First, that little green icon in the taskbar does not stop turning, like it normally does. The balloon says that a startup scan is in progress. I can't remember that this would normally take more than a minute or so, but today it has been over 100 minutes now, and it is still busy.

    However, everything is working as usual. About two hours after startup, I can't surf the net anymore, the browser will stop to respond. Tried it with both Firefox and Opera. I can ping the router (192.168.1.1) but can't access it through the browser. There seems to be nothing wrong with the internet connection because Newsleecher is still downloading files with the same speed it allways does. Outlook does not respond anymore also. When I close Outlook and restart it, a message appears: "Outlook experience a serious problem with the eset outlook plugin add-in. If you have seen this message multiple time, you should disable this add-in and see if an update is available". I didn't open any attachments, however I do have a preview pane in Outlook open. This morning I received a junk mail from a sort of escrow company with which I had some problems in the past (I paid for a software license, didn't receive anything, they didn't respond to emails, and finally PayPal gave me the money back). I do receive spam from this company on a regular basis, delete it, and that was that. Can I be infected without actually opening anything, and with NOD32 monitoring the mail?
    The taskmanager shows that the process ekrn.exe*32 is using about 47% of the cpu, the rest is more or less idle. This was with version 4.2.40 of NOD32 (64 bit).

    The only thing I recently have changed in NOD32 was adding a weekly scan, but to run on sunday, not wednesday. I couldn't find an option to restore NOD32 to default settings so I decided to uninstall it manually (according to the instructions on the ESET site) and install the latest version 4.2.58.3 (64 bit). This didn't solve the problem, but the process ekrn.exe*32 takes now 25% rather than 47% with the previous version.

    I take monthly images from my C-drive, so I'm not in a panic and can allways go back to a previous state. A few files may have been altered or lost, so I like to hear if there are other options which I can try before that. Thanks.

    CPU Intel Q9400, 8 Gb RAM, OS=Microsoft Windows 7 Ultimate 64 bit with all the latest updates. Besides NOD32 4.2.58.3, Superantispyware is installed with realtime monitoring enabled.
     
    Last edited: Aug 11, 2010
  2. Tumi

    Tumi Registered Member

    Joined:
    Aug 11, 2010
    Posts:
    6
    I have to join in on this problem. I got the same issue happened recently. Glad to see I'm not the only one and it seems this is a new one for NOD32. I suspect it could be some recent definitions update that is causing this.

    I had v4.2.35 when this started happening. First tried an upgrade to v4.2.58.3 and when that didn't work I uninstalled everything and installed clean v4.2.58.3. First startup scan after fresh install went through fine, but after updating to the newest virus definitions, startup scan hangs again showing 25% CPU usage in Task Manager on ekrn.exe.
    Currently I have startup scans turned off until this issue is resolved.
     
  3. grun93

    grun93 Registered Member

    Joined:
    May 11, 2009
    Posts:
    24
    Thanks for the fast reply.

    The NOD32 icon in the taskbar is still turning, however when I open NOD32 and monitor the 'watch activity' only a flat line is showing? The HDD LED is flashing on a regular basis, but not excessively. Outlook and Firefox are still working, and it has been three hours since the last reboot now. I don't have a clue what is going on but keep my fingers crossed. ;)
     
  4. mckeeh3

    mckeeh3 Registered Member

    Joined:
    Aug 11, 2010
    Posts:
    2
    I am also seeing the same problem on 2 of 3 PCs setup with the same version of ESET 4.0.437.0 and virus database 5357 (20100811).

    Looking at the statistics (task bar right click ESET icon, Open Window, Protection status, Statistics) shows that it is slowly scanning files.

    Very little disk activity and ekm.exe process running at 100% CPU utilization.

    It appears that this problem just started today 2010-08-11. The problem started prior to installation of Microsoft patches released yesterday on Windows 7 64-bit.
     
    Last edited: Aug 11, 2010
  5. Leschy

    Leschy Registered Member

    Joined:
    Sep 23, 2007
    Posts:
    55
    Location:
    Munich
    Same problem here. Start up scan seems to run endless. I recognized the problem since yesterday (Microsoft patch day).

    Hope Eset will fix the problem soon.
     
  6. Alexei Malinovski

    Alexei Malinovski Registered Member

    Joined:
    Aug 11, 2010
    Posts:
    3
    Same problem here. NOD32 eats up 100% of one core of my dual core processor. It is doing an endless start up scan for half a day already. I registered here to report this because I was quite frustrated :)
     
  7. Nicolus

    Nicolus Registered Member

    Joined:
    Apr 26, 2010
    Posts:
    8
    Hello,

    Same problem here since 11h30 this morning :
    ekrn.exe is eating 100% CPU on the 2 processors
    Scan icon in turning with "startup scan in progress"
    NOD32 V4.2.40.0
    Pattern 5357
    Windows Server 2003 R2 64 bits

    We reboot the server but the problem came again. We have disables startup scan and reboot again, and it seems to be OK for the moment ...o_O
     
  8. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    Definitely we'll need a complete memory dump from the moment the problem occurs. For configuring the oper. system to generate memory dumps, read this KB article. Let me know if you have a dump ready so that I can provide you with further instructions. If you use a production system and cannot afford generating BSOD, disable Anti-Stealth and Self-defense and restart the computer.
     
  9. grun93

    grun93 Registered Member

    Joined:
    May 11, 2009
    Posts:
    24
    I have the same problem but do not already have the patch which Microsoft released yesterday. To be on the safe side (it wouldn't be the first time a MS patch messes up things), I let the MS update service run on Mondays rather than on Tuesdays (the default). In this case I have a six-day window in which possible release problems might expose themselves. I don't think this is a extra risk because the bug fixes which MS releases every second Tuesday of the Month are not that dangerous. A real big fault in MS OS'es is fixed and released immediately, on any day, not just on the second Tuesday.
     
  10. angrydog

    angrydog Registered Member

    Joined:
    Aug 11, 2010
    Posts:
    3
    Hi, Just signed up. I am also experiencing this problem. ekrn.exe *32 is running between 94-97% and I started two scans which cannot be canceled. Their stuck in "Target: Operating Memory" phase.

    BTW Running Windows Server 2008 R2 and this happened Before the Microsoft updates. I just applied the updates and will report back with any changes.
     
  11. Leschy

    Leschy Registered Member

    Joined:
    Sep 23, 2007
    Posts:
    55
    Location:
    Munich
    ok, then it seems not be releated to ms patch day.
     
  12. DC187

    DC187 Registered Member

    Joined:
    Aug 11, 2010
    Posts:
    2
    Exact same issue here.

    Startup scan continuously running, using 50% CPU
    If a second user logs on CPU utilization jumps to 100%

    ESET Version: 4.0.467.0
    Signature: 5357

    Windows 2003 R2 x64 Standard

    Issue started this morning at 11:30 GMT
     
  13. angrydog

    angrydog Registered Member

    Joined:
    Aug 11, 2010
    Posts:
    3
    UPDATE: After installing latest MS patches and rebooting, my problem is gone.

    I only have' mscorsvw.exe' taking up 50% which is probably re-compiling .NET after latest update. Speaking of the devil, 'mscorsvw.exe' is now idle too.
     
  14. drSteve

    drSteve Registered Member

    Joined:
    Aug 11, 2010
    Posts:
    1
    Today, after installing latest MS Patch, i have the same problem.
    Win 7 - 64 Bit, Dual Core, CPU always 100%.
    Ver. Nod32 64, 4.2.58.3, virus signature database 5358.

    Steve
     
  15. grun93

    grun93 Registered Member

    Joined:
    May 11, 2009
    Posts:
    24
    I like to help but the instructions seems to be for Win XP, rather than for Win7? I don't have a My Computer icon in Win7, for example. I've tried creating a dump manually by tweaking the registry according to the instructions, but nothing seems to happen when I press the right CTRL key and the Scroll Lock key twice.

    I have also found and installed the Microsoft Debugging Tools for x64 systems, version 6.11.1.404, but don't know how to use this tool. Pls give me further specific instructions.
     
  16. jimwillsher

    jimwillsher Registered Member

    Joined:
    Mar 4, 2009
    Posts:
    668
    Start, run, then

    sysdm.cpl

    and enter. That gets you to the same screne as My Computer.

    Oh, and you *do* have a My Computer icon, except it's on your start menu on the right hand side called "Computer". Right-clcik this and go to Properties, then Advanced.


    Jim
     
  17. mckeeh3

    mckeeh3 Registered Member

    Joined:
    Aug 11, 2010
    Posts:
    2
    In my case the problem started before installing the latest MS patches and the problem continued after installing the patches.
     
  18. grun93

    grun93 Registered Member

    Joined:
    May 11, 2009
    Posts:
    24
    Thanks Jim, found it.

    What I understand from this setting is that it will create a dump automatically when the pc crashes. However, this is not the case. My pc doesn't crash, I don't get a BSOD, the mouse works, taskmanager works, it is more that some parts are still working as usual but some parts don't. I don't think a dump is created automatically.
     
  19. Nicolus

    Nicolus Registered Member

    Joined:
    Apr 26, 2010
    Posts:
    8
    For me, on the 2 servers that have this problem, none of the yesterday MS updates have been applied. After each pattern update, at scan is launch and ekrn.exe use 50 % of CPU, until I reboot the server ...

    I detected that problem occurs after "update program module" occured this morning.
    We use NOD32 Antivirus BE 4.2.40
     
  20. Leschy

    Leschy Registered Member

    Joined:
    Sep 23, 2007
    Posts:
    55
    Location:
    Munich
    I think ms patch day yesterday doesn't play a role. My brother doesn't have this problem although he installed the updates. eset version is the same (4.2.40) but his pc is running on vista 32 bit, my pc is running on 7 64 bit.
     
  21. oxocube

    oxocube Registered Member

    Joined:
    Aug 11, 2010
    Posts:
    2
    Same for me, 'Startup scan in progress' running following a database update.

    Version 4.2.58.3 Virus Signature Version 5358 (currently)

    Win 7 64bit

    Thanks
     
  22. haerdalis

    haerdalis Registered Member

    Joined:
    Sep 6, 2006
    Posts:
    74
    Same issue here.. Neverending startupscan (using 13%, i.e 100% of 1 core)..

    Using NOD32 4.2.35 as later versions seems to do things I really don't appreciate (somehow it seems Mass Downloader ends up creating invalid files when a later version is installed, even though that program is in the exclusion list).

    Signature database 5358.
    Win7 64 Pro.
    Intel i7 920 d0.

    I've tried unchecking Files,Archives,Self-extracting and runtime packers from the objects list for the threatsense engine for the automatic startup check, but still it keeps doing this,
    even after a reboot.
    I guess that particular setup screen is doesn't work.
    I'm not really about to permanently sacrifice 100% of a full core to NOD32 (and a cpu temp at 57C instead of the normal 31C).

    Btw, how do I disable startup scan completly? Except for uninstalling NOD32, it seems to be the only probable solution.
     
    Last edited: Aug 11, 2010
  23. johnphoton

    johnphoton Registered Member

    Joined:
    Aug 11, 2010
    Posts:
    1
    Same problem over here.
    Windows 7 64bit EN
    4.2.58.3 / 5358

    I have disabled the startup file scan in the tool/sheduler, so for now i have my CPU back, but would love to see a solution asap!

    JP
     
  24. paraffin

    paraffin Registered Member

    Joined:
    Aug 11, 2010
    Posts:
    1
    I have the same here

    Windows 2003 x64
    4.2.58.3 / 5358

    I have had to disable start up scan also to get around the problem. Why have ESET release a statement about this?

    This has caused a lot of problems with 2 production systems that I manage wiping out almost a mornings work..
     
    Last edited: Aug 11, 2010
  25. haerdalis

    haerdalis Registered Member

    Joined:
    Sep 6, 2006
    Posts:
    74
    Thanks for the tip.. At least I got my cpu back.. I feel somewhat sorry for those that have a single or dual core cpu in relation to this issue..
     
Thread Status:
Not open for further replies.