networked Office 2010 documents and NOD32 4.2.64.12

Discussion in 'ESET NOD32 Antivirus' started by Balthazor, Aug 19, 2010.

Thread Status:
Not open for further replies.
  1. Balthazor

    Balthazor Registered Member

    Joined:
    Mar 3, 2007
    Posts:
    41
    I noticed this in 4.2.58 as well:

    Office 2010 documents open incredibly slowly over the network using the default configuration, sometimes incurring a delay of twenty seconds or longer per document opened (even very small files.)

    I still haven't nailed down which setting eliminates this delay, but the delay appears to be caused by the AV settings on the machine hosting the particular file. This is repeatable by disabling the AV on the host machine and testing.

    Unchecking 'scan all files' under

    Real-time file system protection -> Threatsense engine parameter Setup -> Extensions

    appears to remove this delay, although this may just disable scanning of Office 2010 documents altogether, as the new 'docx' and other formats are not included in the default list of extensions.

    Has anyone found a good configuration for networked environments where computers are used as both hosts and clients for different file stores, while still allowing for scanning of Office 2010 documents over the network?
     
  2. twichert

    twichert Registered Member

    Joined:
    Feb 2, 2010
    Posts:
    14
    Location:
    Lansing, MI
    Do you happen to have any collaboration features enabled on the documents, like tracking changes? Or is this simply happening with every document?

    I've seen this with other AV products as well and I've never figured out what Office is doing that inspires this behavior in AV software. I've not had the same issue with other office suites like OpenOffice.
     
  3. Balthazor

    Balthazor Registered Member

    Joined:
    Mar 3, 2007
    Posts:
    41
    The documents I've tested don't have tracking changes or other collaboration features enabled.
     
  4. Nick0

    Nick0 Registered Member

    Joined:
    Feb 18, 2010
    Posts:
    32
    You could try disabling "network drive" scanning from within the advanced setup, under "Real-time file system protection".

    Provided you have AV installed on the file server, there is no need to have the client machines scanning the shares as well.
     
  5. Balthazor

    Balthazor Registered Member

    Joined:
    Mar 3, 2007
    Posts:
    41
    I'm not using any dedicated file servers. I have multiple machines networked, and each uses files on the others. When I use the words 'host' and 'client' I'm describing a particular use of a file, that resides on a host, and accessed by a client machine.

    The problem is not with any settings on the client machine. Disabling network scanning, on either the host or client computers, has no impact on the file open delay when accessing networked files. Only modifying the settings on the host computer has any effect on file access times.

    The only option to prevent the file open delay appears to be to remove the affected extensions (docx, pptx, xlsx) from the extensions scanned on the computers HOSTING the files. But since all of my computers host different sets of files, this effectively means no scanning of these files, which is obviously a potential vulnerability.

    This wasn't an issue with 4.2.40, and I'm disappointed that I'm having problems with these newer releases and shared-over-a-network Office documents.

    If anyone has other suggestions I'd welcome them.
     
  6. Balthazor

    Balthazor Registered Member

    Joined:
    Mar 3, 2007
    Posts:
    41
    I think I've identified what might be going on.

    It appears the computer hosting a shared Office file is choking when trying to scan Office files once those files are accessed remotely.

    If I remove the Office extensions from the Real-time file system protection threatsense engine parameters, but leave Document protection integrated and enabled (on all extensions), then Office files still get scanned on the host computer upon file access but the system doesn't choke in the process.

    What is strange is that if I disable document protection, but leave Office files still scanned under real-time file system protection, I'm still getting file open delays when accessing files remotely.
     
  7. ICA

    ICA Registered Member

    Joined:
    Nov 28, 2007
    Posts:
    34
    I have exactly the same problem on my Win2008R2 fileservers.
    When you place some office documents on the netlogon share then even the file replication service is going to crash...
    My temporarly solution is disabling the "Scan on File open" option within the "Real-time file system protection" settings.
    (https://www.wilderssecurity.com/showthread.php?t=280162)

    Regards,
    Rene.
     
  8. Balthazor

    Balthazor Registered Member

    Joined:
    Mar 3, 2007
    Posts:
    41
    The obvious problem is the lack of scanning when opening files using that method, although it does solve the file open delay.

    If you exclude the affected extensions from real time scanning (docx, pptx, etc) but leave document protection enabled on all files, then you still have the benefit of scanning upon 'file open' events, without the delay.
     
  9. MasterAnt

    MasterAnt Registered Member

    Joined:
    Aug 24, 2010
    Posts:
    6
    Having the same problem which brought me to this forum:

    At home I have 1 Laptop which is running Windows 7 Pro 32-bit and has EAV BE 4.2.58.3. I have split my hard drive into two partitions: C and L.
    L is accessible by my main PC also so both computers have the same L: drive.
    The main computer is running Windows 7 Pro 32-bit as well and has EAV 4.0.314.0 installed.

    Note I previously had the same EAV Home Edition 4.0.314.0 installed on my laptop where the .XLS files sit. With this configuration I had NO PROBLEM.
    I only recently installed EAV BE 4.2.58.3 with default settings and since doing so, opening a file which exists on my laptop (the host of L: drive) from my main PC (which has network access to L: drive) takes about 10 seconds to open the XLS file. It takes about 5 seconds to close the file.

    I fiddled with settings, and only disabling real-time protection on the host (the laptop) helped . Turning off document-protection made no difference and is not the problem. Adding .XLS files to the exclusions list also solves the problem. Interestingly, disabling all the scan types (signature, heurists, spyware) doesn't solve the problem. My L: drive is a truecrypt partition BUT I tested opening a file from a shared folder on C drive and had the same delay. I can only say the problem is out of my hands and needs to be addresses in a new update, until then, I guess the only thing to do is to add XLS files to the exclusion list.

    PS I am using Excel 2007.

    One more interesting fact: opening the same file from the laptop does not exhibit the same delay.
    Also: the laptop freezes up as well when the pc accessing the file freezes. CPU load goes right up to 60% on 4 cores.

    Edit: Just upgraded to 4.2.64.12 and have the same problem. (I'm glad it supports Thunderbird 3.1 now)
     
    Last edited: Aug 24, 2010
  10. Balthazor

    Balthazor Registered Member

    Joined:
    Mar 3, 2007
    Posts:
    41
    The only affected files appear to be Office files, and I'm guessing it has something to do with NOD32's attempt to use the Office antivirus scanning API. If you open a PDF document (or any non-office document) you don't experience the delay.

    If you exclude the affected Office file extensions from real-time scanning, but leave Document Protection integrated and enabled, then the Office files are still scanned - if you closely monitor the files scanned using the statistics window, you can confirm this yourself.

    Oddly enough, as you already observed, disabling document protection doesn't fix the file open delay.
     
  11. jimwillsher

    jimwillsher Registered Member

    Joined:
    Mar 4, 2009
    Posts:
    668
    Is this just .xls or is it also .xlsx/.xlsm ? The latter are actually zip files so I'm just wondering if it's something to do with the files getting extracted. Just a thought....
     
  12. MasterAnt

    MasterAnt Registered Member

    Joined:
    Aug 24, 2010
    Posts:
    6
    Delay exists on an .xlsx file as well
    No delay on my openoffice spreadsheet documents .ods
     
  13. Balthazor

    Balthazor Registered Member

    Joined:
    Mar 3, 2007
    Posts:
    41
    It appears to be any Microsoft Office document type (ppt, pptx, doc, docx, etc.)

    Changing various options, like archive extraction options, has no impact on the file open delay. With the exceptions noted above, of course.
     
  14. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    No problems opening Office documents from a Windows 7 share mapped as a network drive on WinXP here. Is there something special about the computers having issues? Do you have some non-standard software installed?
     
  15. MasterAnt

    MasterAnt Registered Member

    Joined:
    Aug 24, 2010
    Posts:
    6
    Did this to generate a report of software installed on the laptop (host). I haven't enabled any of the HP drive encryption. The HP software is preinstalled as this is an HP ProBook 4520S.

    Name / Version
    Microsoft Application Error Reporting 12.0.6012.5000
    Microsoft Office OneNote MUI (English) 2010 14.0.4763.1000
    Microsoft Office Access MUI (English) 2010 14.0.4763.1000
    Microsoft Office Shared Setup Metadata MUI (English) 2010 14.0.4763.1000
    Microsoft Office Excel MUI (English) 2010 14.0.4763.1000
    Microsoft Office Access Setup Metadata MUI (English) 2010 14.0.4763.1000
    Microsoft Office PowerPoint MUI (English) 2010 14.0.4763.1000
    Microsoft Office Publisher MUI (English) 2010 14.0.4763.1000
    Microsoft Office Outlook MUI (English) 2010 14.0.4763.1000
    Microsoft Office Word MUI (English) 2010 14.0.4763.1000
    Microsoft Office Proofing (English) 2010 14.0.4763.1000
    Microsoft Office Single Image 2010 14.0.4763.1000
    Microsoft Office Shared MUI (English) 2010 14.0.4763.1000
    Microsoft Office Proof (English) 2010 14.0.4763.1000
    Microsoft Office Proof (Spanish) 2010 14.0.4763.1000
    Microsoft Office Proof (French) 2010 14.0.4763.1000
    ArcSoft TotalMedia 1.0.33.17
    Device Access Manager for HP ProtectTools 5.0.1.5
    HP Customer Experience Enhancements 6.0.1.3
    Corel Home Office 5.5
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 8.0.50727.4053
    Cerberus FTP Server 3.0.18
    Validity Fingerprint Driver 4.0.10.0
    Corel Home Office - Templates RU 5.4.5
    Corel Home Office - Launcher 5.5
    LightScribe System Software 1.18.6.1
    Corel Home Office - CT Templates 5.4.5
    HP Software Setup 7.0.1.5
    Windows Mobile Device Center 6.1.6965.0
    HP Wireless Assistant 4.0.3.2
    Corel Home Office - CS Templates 5.4.5
    File Sanitizer For HP ProtectTools 5.0.1.2
    HP HotKey Support 3.5.13.1
    ArcSoft Webcam Sharing Manager 1.0.0.26
    HP ESU for Microsoft Windows 7 1.0.5.1
    HP Wallpaper 1.0.1.3
    Face Recognition for HP ProtectTools 2.01.651
    Corel Home Office 5.5
    BDE 1.00.0000
    HP Integrated Module with Bluetooth wireless technology 6.2.1.500
    OpenOffice.org 3.1 3.1.9420
    Java(TM) 6 Update 16 6.0.160
    HP Support Assistant 4.4.6.3
    Windows Mobile Device Center Driver Update 6.1.6965.0
    HPAsset component for HP Active Support Library 3.0.0.3
    HP Power Assistant 1.0.3.2
    Cisco PEAP Module 1.1.6
    Adobe Reader 9.3.3 9.3.3
    HP 3D DriveGuard 4.0.4.1
    HP Software Framework 3.5.13.1
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 9.0.21022
    Windows Live Sign-in Assistant 5.000.818.5
    Cisco LEAP Module 1.0.19
    Drive Encryption for HP ProtectTools 5.0.4.0
    Cisco EAP-FAST Module 2.2.14
    Microsoft Sync Framework Runtime Native v1.0 (x86) 1.0.1215.0
    HP SoftPaq Download Manager 3.0.5.0
    MSVCRT 14.0.1468.721
    ESET NOD32 Antivirus 4.2.64.12
    HP Power Data 1.0.7.77
    HP 3.00.0000
    Windows Live Essentials 14.0.8089.726
    Microsoft Office PowerPoint Viewer 2003 11.0.6458.0
    Windows 7 Default Setting 1.0.1.4
    HP User Guides 0189 1.01.0000
    Corel Home Office - KR Templates 5.4.5
    HP Connection Manager 3.1.1
    Microsoft Sync Framework Services Native v1.0 (x86) 1.0.1215.0
    Windows Live Communications Platform 14.0.8098.930
    ActiveCheck component for HP Active Support Library 3.0.0.3
    Skype™ 4.2 4.2.169
    Microsoft Choice Guard 2.0.48.0
    Privacy Manager for HP ProtectTools 5.01.734
    Microsoft Visual C++ 2005 Redistributable 8.0.56336
    Theft Recovery 5.1.0.18
    Windows Live Messenger 14.0.8089.0726
    SimpLite-MSN 2.2 02.02.0027
    Pre-Boot Security for HP ProtectTools 5.0.7.1
    Windows Live Call 14.0.8064.0206
    Qualcomm Gobi 2000 Package for HP 1.1.18
    HP Advisor 3.3.9512.3162
    Seagate*DiscWizard 11.0.8326
    Corel Home Office - Templates1 5.4.5
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 9.0.30729
    Microsoft Silverlight 4.0.50524.0
    32 Bit HP CIO Components Installer 4.1.1
    Microsoft Search Enhancement Pack 1.2.123.0
    Windows Live Upload Tool 14.0.8014.1029
    Windows Live Toolbar 14.0.8064.206
    Corel Home Office - IPM 5.5
    Corel Home Office - JP Templates 5.4.5
    HP ProtectTools Security Manager 5.03.637
     
  16. Balthazor

    Balthazor Registered Member

    Joined:
    Mar 3, 2007
    Posts:
    41
    I'm using Windows 7 64-bit to Windows 7 64-bit, and networked through Homegroup.

    I'm not using networked drives.

    I'm not aware of any software that my computers have in common that could account for the file open delay with regard to Microsoft Office files, other than the Office 2010 suite itself.

    Like MasterAnt, 4.2.40 did not have this issue for me; only 4.2.58 and 4.2.64.12.

    I also experience a file open delay when using a Win 7 64-bit Office 2010 computer without ESET installed to access files on a host computer using Eset.

    The only way to prevent the delay appears to be to exclude the affected files from real-time scanning on computers hosting such files, although as noted above the 'document protection' feature appears to still scan Office documents on both host and client computers involved.

    All computers experiencing this problem have the latest Windows updates, run Windows 7 64-bit, are networked using Homegroup and non-mapped shared folders, and have Office 2010 32-bit installed.
     
  17. Balthazor

    Balthazor Registered Member

    Joined:
    Mar 3, 2007
    Posts:
    41
    I'm also experiencing the same delay when accessing Office files on a Windows 7 64-bit host with NOD32 from a Vista 32-bit client with Office 2007 and NOD32 installed.

    The files were in a shared folder, but the folder wasn't mapped as a network drive.
     
  18. geoffrose

    geoffrose Registered Member

    Joined:
    May 12, 2010
    Posts:
    2
    I am seeing the same problem - Win2008R2 64bit - on the file server (host) I have temporarily disabled scanning on open file and that seems to have solved it for now
     
  19. MasterAnt

    MasterAnt Registered Member

    Joined:
    Aug 24, 2010
    Posts:
    6
    My problem seems to have progressed in severity today. During a skype text conversation (on my laptop where NOD32 is causing the delays with the Office files), I experienced freezes every few seconds. First I system restored, thinking it was a new quicktime I just installed. That didn't help. I removed Skype, wiped all the appdata folders, reinstalled and it was still a problem. Then I thought my laptop hard drive was faulty, so I started copying files off my hard drive. And oddly, during file copy, I had the same pauses on other files every now and then - not office docs, and not just at the beginning of access to the file. A random thought popped into my head to disable NOD32 realtime scanning on files, and guess what, everything is working perfectly!! Actually, more specifically, I disabled signature scanning only and it solved it too. I'm going to try do a Nod32 cleanup and reinstall later, will post if it solves anything. First, completing my backup...
     
  20. Balthazor

    Balthazor Registered Member

    Joined:
    Mar 3, 2007
    Posts:
    41
    I've tried a complete cleanout of NOD32 and reinstall, but no change in the behavior we're experiencing.
     
  21. MasterAnt

    MasterAnt Registered Member

    Joined:
    Aug 24, 2010
    Posts:
    6
    Thanks to Marcos, my Office docs problem seems to be resolved.
    Not just using the new version 4.2.65, but also by using the clean wipe uninstaller from safe mode. First I upgraded to this version and it still jammed up. I tried wiping the program and obvious folders in appdata myself from normal mode before and it didn't help. Do the safe mode uninstall first as per the knowledgebase article (search for it).

    The only thing I'm noticing now is when I backup my laptop, scanning seems to bottleneck when copying thousands of files to another drive (actually I was zipping them, so perhaps it was because CPU was overutilised?) But, that's subject for another forum topic if it becomes a bigger problem. Anyone with a quick solution, plz pm me.
     
  22. Mister Natural

    Mister Natural Registered Member

    Joined:
    May 10, 2007
    Posts:
    225
    Location:
    3rd density St. Louis
    Something I've run across on Win7 machines is slow saving MS office files on network drives. Mainly on shares with offline settings enabled. There is an option in Windows 7 to disable indexing of offline files. When I did this the problem went away.
     
  23. Balthazor

    Balthazor Registered Member

    Joined:
    Mar 3, 2007
    Posts:
    41
    4.2.65 solved my problems as well. Thanks for the work on this, Eset.
     
  24. Balthazor

    Balthazor Registered Member

    Joined:
    Mar 3, 2007
    Posts:
    41
    The problems described in this thread aren't related to slow saving of MS files, but the slow opening of them. I haven't experienced a slowdown in saving.
     
  25. rpremuz

    rpremuz Registered Member

    Joined:
    Jan 18, 2005
    Posts:
    100
    Location:
    Croatia
    Where did you get NOD32 ver. 4.2.65 from?

    At http://www.eset.com/download I can see only ver. 4.2.64.12.

    -- rpr.
     
    Last edited: Sep 1, 2010
Thread Status:
Not open for further replies.