NOD 32 5.0.93.0 & 5.0.94.0:PC freezes when USB HD is connected

Discussion in 'ESET NOD32 Antivirus' started by DD2012, Oct 7, 2011.

Thread Status:
Not open for further replies.
  1. armadillo33

    armadillo33 Registered Member

    Joined:
    Feb 12, 2006
    Posts:
    35
    I too am having the freezing problem with XP SP3 and NOD32 5.0.95. Like cfk41 (reply no 56), I believe the problem started with v4.2.67.1. But 5.0.95 has not solved it.

    Most times, the system does not freeze when one or more external USB drives are connected. Perhaps one time in five or six, the system will freeze.
    To me, this suggests a conflict between NOD32 and another driver which depends on the order in which drivers are loaded as this would vary.

    ESET NOD32 5.0.95.0 was installed by the full uninstall and clean re-install following precisely the procedure described in
    http://kb.eset.com/esetkb/index?page=content&id=SOLN2854&ref=wsf

    The system has no other AV, firewall or anti-malware software.
    It does not have InCD and never has, nor any of the other known incompatible software referred to elsewhere in this thread.

    I generated a memory dump by the CTRL scroll-lock (x2) method when the system had frozen after connecting the external USB drive.

    I have uploaded my memory dump, compressed by zip, to my webspace with a report of my full system configuration and a textfile description of the problem.

    If the forum software allows me to, I am sending my upload link to Marcos by PM. I hope this will enable ESET to investigate.
     
  2. foneil

    foneil Eset Staff Account

    Joined:
    Dec 7, 2010
    Posts:
    255
    Location:
    San Diego
  3. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,432
    I'd add that the latest version will not resolve the issue in case there's a faulty 3rd party application or driver clashing with v5.
     
  4. armadillo33

    armadillo33 Registered Member

    Joined:
    Feb 12, 2006
    Posts:
    35
    Does 5.2.9 have additional changes for this issue that were not present in 5.0.95?

    Is there some known reason why releases before v4.2.67.1 did not clash with 3rd party applications or drivers which later releases do clash with? This is important because many 3rd party applications and drivers cannot be updated or removed without causing further problems.

    I believe the technical team are still investigating my memory dump. I shall, meanwhile, try the new 5.2.9 since I have also been experiencing crashing (freezing) of the GUI and it would be good if 5.2.9 has fixed that problem.

    I also note that http://kb.eset.com/esetkb/index?page=content&id=SOLN2854&ref=wsf
    says it is extremely important not to activate the reinstalled version until after restarting Windows.

    But http://kb.eset.com/esetkb/index?page=content&id=SOLN2788&ref=wsf does not say that.

    Which set of instructions is correct?
     
  5. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,432
    It's because v4 didn't detect insertion of removable media. Version 5.2.9 contains a fix / workaround that should eliminate the number of such issues to the bare minimum (it's been already distributed as a separate dll to some of users at Wilders').
     
  6. armadillo33

    armadillo33 Registered Member

    Joined:
    Feb 12, 2006
    Posts:
    35

    Thank you Marcos. Is it possible to completely stop version 5 from detecting insertion of removable media, for example by having an option? The removable media option at present in the Advanced Set up>Computer>Removable media does not do that.

    On a personal note, am I right in thinking my memory dump is still under investigation? I would assume that, if so, it might result in further changes.

    I shall, meanwhile, try 5.2.9.
     
  7. wolliballa

    wolliballa Registered Member

    Joined:
    Nov 9, 2011
    Posts:
    90
    Location:
    Germany
    Just updated all types of machines available (4) (2x XP SP3, Vista 32, W7 32,)
    with 5.2.9.12. Up to now no problems seen with USB devices, except it might take a while until drive is present on explorer and content is displayed.
     
  8. rif

    rif Registered Member

    Joined:
    Feb 24, 2008
    Posts:
    35
    Location:
    Austria
    No problems after 12 hours either (with 5.0.95 the first HIPS-Error-Window appeared after 1 week, and the freeze came after 2 weeks) so i hope ......
     
  9. pegr

    pegr Registered Member

    Joined:
    Apr 8, 2008
    Posts:
    2,281
    Location:
    UK
    As an example of this, I discovered that NOD32 v5 and v6 beta won't work on Windows XP with Blue Ridge Networks' AppGuard installed. The system freezes when an external USB hard drive is connected. Disabling NOD32's detection of removable drives didn't work, nor did turning off AppGuard protection. The only solution was to uninstall AppGuard then NOD32 worked normally with a USB hard drive connected.

    It appears that NOD32/ESS v5 onwards can't be used with AppGuard and USB hard drives on Windows XP; I don't know about Windows 7 - I didn't try it.
     
  10. armadillo33

    armadillo33 Registered Member

    Joined:
    Feb 12, 2006
    Posts:
    35
    So far, after a week, 5.2.9.1 has not caused any freezes when connecting my external drives. Perhaps it is still too soon to conclude it has solved the problem but it is looking good at this point. It has also cured the problem of ESETGUI crashing in the circumstances in which it always crashed with 5.0.95.
     
  11. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,432
    From the dump supplied the developers have concluded that the fix you received addresses the issue. The fix is incorporated in v. 5.2.9 onwards.
     
  12. armadillo33

    armadillo33 Registered Member

    Joined:
    Feb 12, 2006
    Posts:
    35
    And the developers seem to be right! 5.2.9 still working fine for me. Thank you for the feedback regarding the dump. That is reassuring.
     
  13. beethoven

    beethoven Registered Member

    Joined:
    Dec 27, 2004
    Posts:
    1,245
    after reading through all 9 pages I understand that the new version seems to solve the issue for most users.

    Unfortunately I am not one of them - using 5.2.9.1 and still have the USB freezes on XP. I did notice the references to Mbam and do run this software (Pro) - somewhere in the thread there was a reference to a sticky with "software with some issues" where eset cannot do anything because the problem is with the coding of the other software.

    Could someone direct me to this sticky and the list of software that conflicts with NAV 5 and is there any hope for mbam users that either Eset or Mbam find a happy coexistence?
     
  14. armadillo33

    armadillo33 Registered Member

    Joined:
    Feb 12, 2006
    Posts:
    35
    The sticky is here

    Although mbam is mentioned in the current thread, it is not in the sticky.

    1) I would respectfully suggest that ESET should update the sticky to include all known conflicts not resolved by 5.2.9.1.

    2) Next time you get the freeze, it would be helpful if you could generate and upload a full memory dump and PM Marcos with the links. Instructions are in the same sticky. Then ESET can confirm whether or not your freeze is to do with mbam or some other cause.

    3) I do not accept that the issue of conflict with NOD 32 v5 is due to unresolvable problems with the third party software. Earlier versions of NOD32 (somewhere before a release within 4.x) did not conflict; later versions did, or in your case perhaps, still do. Although third party software may be at fault, conflict arises because current NOD32 does not react in the same way to the faulty software as non-conflicting earlier versions. It should be possible for ESET to alter NOD32 so as to avoid the conflict, even if this means relaxing some security which could be achieved by a user selectable option within the advanced setup.

    Otherwise users are forced to choose between uninstalling conflicting software which may be important to them or uninstalling NOD32 and moving to a vendor another than ESET.

    Fortunately, 5.2.9.1 still seems to have solved the problem for me; it has not (yet?) recurred.
     
  15. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,432
    As programs evolve, new features are added for user's convenience, better usability and efficiency. In this particular case, it was the feature offering a medium scan after a removable medium is inserted that triggered a sort of bug in 3rd party drivers/software. I've already contacted MBAM and offered them assistance in resolving the issue as we had to incorporate the same fix in v. 5.0.95 to prevent Mount Manager from locking up.
     
  16. rcdailey

    rcdailey Registered Member

    Joined:
    Dec 25, 2009
    Posts:
    233
    Wow, I hope MBAM takes you up on your offer. I would like to run MBAM Pro live rather than using it the way I used the free version. I sometimes regret having paid money, though it's right to pay for it just because work was done to make the free version available. It's the old shareware principle.
     
  17. armadillo33

    armadillo33 Registered Member

    Joined:
    Feb 12, 2006
    Posts:
    35
    It is great to see that you work with 3rd party vendors to assist them.

    Whatever fix was introduced into 5.2.9 seems to have solved the problem your developers observed on my dump, though I do not have MBAM on my system. I do not know if they fixed a direct incompatibility with some other driver they saw in the dump or if it was not related to an incompatibility at all. I would be interested to know what they saw in my dump, if it is possible to explain to someone who has no intimate knowledge of drivers (me) and if doing so would help others to understand too. If it would be of interest only to me, then I would not expect you to spend time explaining it.

    Was the actual initiation of a medium scan the thing that triggered the problem? Certainly, I would have been happy to turn off all scanning of removable devices if that would have avoided triggering the problem. The user definable checkboxes for removable devices within advanced setup did not appear to solve the problem for users. Presumably, some sort of scanning or detection took place even if the user set the checkboxes to what appeared to turn off scanning of removable media.

    New features do not add to a user's convenience, usability or efficiency if they crash the system.

    What I am suggesting is that I am sure users would rather have an option within advanced setup to sacrifice some new features than seek a different AV product. I know I was very reluctant to even consider moving away from ESET and I would much rather provide dumps and data to help solve a problem. I am very glad the problem seems to have been solved in my case and I am especially grateful to you, Marcos, for your willingness to stay with us users and provide such close support.
     
  18. davidi

    davidi Registered Member

    Joined:
    Jul 24, 2008
    Posts:
    3
    Marcos,

    I absolutely *must* find a way to stay in the loop about knowing when Malwarebytes Anti-Malware Pro (paid) version and ESET are working well together as you will see below. It is essential for my reputation, my workload and my marriage (as you'll see at the end). I've subscribed to this thread but please let me know either here or via PM if there are other places/methods that I can use to keep up to date with this.

    Why is this is so personally important ... (and what it got to do with my marriage) ...

    I have been personally using as well as recommending and selling ESET products since 2006. Awesome products. One of my top 5-6 recommendations of must have software and #1 for security.

    This means however that I've got my name associated with hundreds of installations of ESET products.

    What's worse for me ... as part of a layered defense system I have found Malwarebytes Anti-Malware PRO (paid) [aka MBAM] to be essential and I don't recommend any AV product without also *strongly* recommending MBAM Pro (set to update hourly and scan at least once per day).

    This means I have hundreds of people that have as part of their security / defense system *both* ESET and MBAM Pro.

    My name and reputation is associated with this (as well as a lot of unexpected potential work and responding to user issues.)

    As it was for me today it wasn't until about 3 PM that I noticed what I expected to be a simple 2 minute 'test and verify' that user data being returned on a simple USB hard drive was not going as expected. I found that my typically good (but not regular use) XP bench computer was strangely locking up upon connection of the USB device (and I ended up trying several types as well as cloning/re-imaging/'ghosting' to a second drive in case it was a hard drive issue.)

    Fortunately I stumbled upon this thread. Unfortunately it's now 1:30 in the AM. A bit longer than 'just a few minutes for a quick test/verification' at 3 PM yesterday! I somehow stumbled upon a link with USB lockups and ESET around 8 or 9 PM which led me to the middle of the posts in this forum. Between dinner, several dozen reboots trying to figure this out and narrow things down myself (including trying a similar second XP computer that also had both ESET and MBAM on it!) and switching to reading this thread to the very end I finally sit here at 1:30 AM verifying that 'yes' - if I disable the mbam service and have my XP system start up without the mbam active protection (the mbam service) that I can *finally* complete my supposedly super simple test/verification that my USB HD that I am to deliver actually does work on a Windows XP computer.

    As I was reading deeper into the thread and in parallel working on testing on other XP computers, using variations of tools like Process Explorer, msconfig, autoruns, etc. (and also playing Spider Solitaire between reboots and KVM switches!) I found myself getting closer (yet several steps behind) what the thread was narrowing down on (and ever hopeful there would be some small rainbow at the end of the thread and or my own research.)

    There *is* some good satisfaction that this long journey (not just for me today but for many others over several months) has some answers.

    However - It is imperative for me given my reputation and name associated with having recommended a 'one-two punch' of security protection of ESET and MBAM Pro that I am able to keep tabs on the current state of ESET and Malwarebytes getting to a common resolution so I can rest assured that using the best and latest version X of one product and version Y of the other results in a fully compatible mix (without loss of features - or as some have mentioned - add a control within ESET to turn on/off the scan/monitoring of external device mounting) so I can continue to recommend both and at the same time not be in the hot seat for all those that I have recommended these products to.

    If people come to me with problems I really like those problem to be due to things I haven't caused or that may come from the result of my own recommendations! Of course I don't have to be the whipping boy on this issue and I can paint a picture of poor programming, poor cooperative software coding between vendors, etc. but as both vendors are the very two top vendors that I recommend this still raises a few eyebrows about: how could this happen, what's being done about it and why would I recommend these two products if they have some incompatibility.

    OK - so I've clicked "subscribe" to this thread.

    PLEASE let me know (here or via PM) about other places or ways I can keep in touch about the progress ESET and Malwarebytes may be making to get beyond this. It is vital for me to know.

    Oh yes ... and tomorrow morning I'll have to apologize to my partner (which happens to be my *wife*) that "OK - yes you probably did actually test this USB hard drive and found it to be OK and I was wrong to be questioning you over those many hours yesterday about 'are you 100% certain you did actually test this because it's failing left and right every time I try and verify that you actually did what you say you did'. In other words - I'm not sure I'm trusting that you did actually test this. [I've got some humble pie to eat and probably a lot of positive attention to give her over the next few days to make up for this!]

    Flowers to my wife would be appropriate. Me - I'd be happy with a geek t-shirt!

    Thanks to you Marcos and the others that stuck around for a long time to help get this narrowed down and I hope my long reply here raises a chuckle or two for a few people.

    - davidi
     
  19. Cruachan

    Cruachan Registered Member

    Joined:
    Jun 7, 2012
    Posts:
    23
    Location:
    United Kingdom
    Message to Marcos (Support Request)

    Hello Marcos,

    I had hoped to keep this away from the public form but over the past few days the PM Service appears to be unavailable so I feel I have been given little choice but to post here for assistance. I hope you will bear with me.

    I am another victim of the NOD32 5.0.95/5.2.9.1 USB Hard Disk detection issue under XP (XP Home 32bit, SP3). I submitted a support request to ESET UK with all the relevant material (which included a Complete Memory Dump taken at the time of the system hang and the SysInspector data file). I was advised to uninstall V5 and install V4.2.71.2 and this has 'fixed' the problem. However, there appears to be a remaining issue in that at first boot everything seems to load quickly, but nothing happens when I click on a Desktop icon and no programs, including Task Manager, will run. Explorer will only open 'My Computer' but right-clicking is inactive. A restart resolves this issue. This was also a problem with V5 and also I noted on many occasions that several system tray icons failed to load. A Shutdown would then take 5-10 minutes.

    Now, I do appreciate that going back to version 4 has provided a solution of sorts, but it doesn't help me work out what 3rd party software/driver has been conflicting with NOD32/ Mount Manager. I asked ESET UK again to examine my crash dump but, instead, they referred me to you, Marcos.

    Below is a copy of my follow-up e-mail to ESET UK:

    "Thank you for responding to my request for support assistance. However, I do have to say that I am feeling disappointed about your apparent reluctance to help troubleshoot this issue for me. Perhaps I should consider posting instead in that thread at Wilders Security Forums as the ESET Moderator, Marcos, seemed very willing to go that extra mile towards finding solutions for all those affected.

    Meantime, I have done as you suggested and, perhaps not surprisingly, the system lockups have gone away. After uninstalling V5 I confirmed that USB HD detection had been restored before installing V4. Once again, it was not possible to uninstall V5 while in normal Windows as I was confronted with the message that ‘another application had exclusive access to .....\Charon\Cache.NDB’ What application? Uninstalling using ESET’s uninstaller while in SAFE MODE was successful.

    This is proving to be very unsatisfactory. Yes, my system is running again as it should, but to achieve this state after many months of troubleshooting frustration (I never considered that NOD32 might be involved), I have had to downgrade NOD32 Antivirus from V5 to V4. Can you assure me that my system protection remains as secure as it was under V5?

    Microsoft will continue to provide support for Windows XP with SP3 until 2014. Can the same be said of ESET for NOD32?

    Significant numbers of users around the globe are still under Windows XP and, like myself, are unable to upgrade to Windows 7 without considerable effort and time spent reinstalling and reconfiguring software. Yes, I have a laptop with Windows 7 64 bit, but why should I be forced to abandon a perfectly capable XP based machine while it continues to satisfy my daily needs?

    I have applications like Acronis True Image Home (fully updated), Acronis Disk Director and PerfectDisk (V. 12.5) all of which need to access my external USB hard drives from time to time and none cause the problems attributed to ESET’s NOD 32.

    You blame 3rd party drivers, but this begs the question as to why other developers appear to have successfully circumvented this issue, unlike ESET who, for a time, seemed unwilling to provide a solution/ workaround for XP users. Surely your developers could incorporate a switch for existing XP users that would disable external USB hard disk detection if problems are being encountered? Effectively, this is the default position in the version 4 build you have had me install.

    The lengthy thread and frustrations expressed at the slow response of the ESET developers to provide a solution speak volumes for the quality of support currently being provided. Consequently many are becoming disillusioned with NOD32 and, myself included, are seriously considering moving to another product.

    This potential issue should have been anticipated during development when the decision was made to introduce this feature. Under these circumstances, blaming 3rd party drivers, while undoubtedly valid, does seem to be a bit of a cop out, to say the least.

    Anyway, back to my problem under Version 5. I would point out that I went to a great deal of effort carrying out all the instructions to enable the provision of all the material needed by your developers to pinpoint the cause on my machine. In particular Marcos, the ESET moderator at Wilders Security Forums stressed the requirement for a complete memory dump taken immediately following the system hang and this I have provided. If I knew which 3rd Party driver was conflicting with NOD32 while XP’s Mount Manager is operating then I would be in a position to do something about it.

    I would respectfully remind you that I have been a loyal user of NOD32 for several years. We have 4 licenced installations in our house. While you continue to advertise Version 5 as being fully compatible with Windows XP, clearly, in certain circumstances, some users who are using external USB hard drives will find that this is not really the case. Moreover, they may spend fruitless months trying to work out what has gone wrong, including repair installs of XP, only to find they are no further forward since it has been shown that XP is not in fact the source of the problem. Again, I would respectfully suggest that ESET should be mailing their customers to advise them of this potential issue under later versions of 4 and now Version 5, if only to spare their customers needless anxiety until a definitive solution can be found.

    I ask you again to refer the memory dump and the other material provided by me to your Developers in the hope that they can spot the source of the problem on my machine. Surely this would be in everyone’s interest, if only to discover whether another, as yet unknown, driver is conflicting with NOD32.

    I await your reply and will hold off posting for help at Wilders Security Forums meantime.
    "

    I have created said dump as per your instructions - adding "CrashOnControlScroll' to the registry - (Right Ctrl + SCrLk x2) immediately following the system hangup and the link below takes you to the file:

    https://backup.filesanywhere.com/fs/v.aspx?v=8c6a67885c6471ab72a2

    Otherwise, my system remains very responsive and stable after a successful boot and nothing amiss is reported in the Event Viewer.

    I can supply the SysInspector zip file for you on request.

    Thank you, in anticipation, for your help with this frustrating matter.

    Kind regards,

    Mike (m.g.c.campbell(AT)btinternet.com)
     
    Last edited: Jun 11, 2012
  20. Calafax

    Calafax Registered Member

    Joined:
    Aug 9, 2011
    Posts:
    5
    Just for the benefit of others affected by this issue:

    My XP system locked up (version 5 + USB HD) in the same way as
    described by others. This was true even though none of the offending
    software identified by Eset was installed, or had ever been installed,
    on my system. However, a clean installation of 5.2.9.1 has corrected
    the problem.
     
  21. Wathen

    Wathen Registered Member

    Joined:
    Dec 21, 2007
    Posts:
    9
    Thanks you sir!!! I changed the service from automatic to manual and rebooted. My external HD's now work. I'm also using the latest version 5.2.9.1, so even with the latest version of NO32, the issue was still there.
    I thought I had a hardware issue at first. I never had an issue with version 4.x, and my issue was not discovered for months since I did not use my external HD after the upgrade to 5. I stumbled upon this thread while searching again for a solution.
    Using XP with SP3 32 bit.
     
  22. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,432
    Re: Message to Marcos (Support Request)

    In this case, the culprit is PDFsFilter.sys which seems to be "PerfectDisk OptiWrite Filter Driver".
     
  23. ljg

    ljg Registered Member

    Joined:
    Nov 16, 2005
    Posts:
    34
    Re: Message to Marcos (Support Request)

    So, if this is the problem, what's the solution?
     
  24. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,432
    Re: Message to Marcos (Support Request)

    Renaming the problematic driver or uninstalling the application completely until they solve the problem.
     
  25. Cruachan

    Cruachan Registered Member

    Joined:
    Jun 7, 2012
    Posts:
    23
    Location:
    United Kingdom
    Hi Marcos,

    You never did get back to me, as promised, regarding the findings in my complete memory dump. I refer you to your PM response on June 21st when you stated:

    "As soon as I hear from the devs about the memory dump you've provided, I'll update you."

    Currently I'm in conversation with Raxco. They have been able to reproduce the problem, but seem skeptical about 'Perfect Disk' being the cause.

    Rather than advising us all to rename files or uninstall valuable software, wouldn't it be more helpful if ESET opened a dialogue between all those 3rd party's who seem to be implicated with this conflict?

    Can't help but wonder whether there is more to this than we are being told.

    Regards,

    Mike
     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.