NOD32 AV v5.0.95.0 - ekrn.exe maxes out one core, stops all I/O, freezes system

Discussion in 'ESET NOD32 Antivirus' started by freibooter, Apr 24, 2012.

Thread Status:
Not open for further replies.
  1. webyourbusiness

    webyourbusiness Registered Member

    Joined:
    Nov 16, 2004
    Posts:
    2,662
    Location:
    Throughout the USA and Canada
    restart the computer daily to reset the RAM - this will hold you until the eset development team get a hotfix out to us. As long as the RAM usage is less than 1Gb, I thnik we should be OK! > 1.5Gb there are risks of failure of the operating system it seems.
     
  2. ocenter12

    ocenter12 Registered Member

    Joined:
    Jun 19, 2012
    Posts:
    2
    Location:
    USA
    I've also had similar problem like cascara. ekrn.exe has gone from 70mb to 150mb within minutes of rebooting the system. After a 4 hours it was at 780mb!! This system is an htpc and only the boot drive (SSD) is on realtime protection and the other media drives are excluded from all protection. I have used Nod32 for years and this the first time it has done this. I've done uninstall and clean installs and now I'm back to no AV on the system. Any help would be great thanks


    My Specs
    Win7 x64
    Crucial m4 SSD OS
    2x 3TB (Media)
    HD6850
     
  3. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,423
    What version of the product you use? The issue should affect only v. 5.2 and Endpoint under certain circumstances but not the older v. 5.0 or 4.2.
     
  4. ocenter12

    ocenter12 Registered Member

    Joined:
    Jun 19, 2012
    Posts:
    2
    Location:
    USA
    I was using the latest version of v5. I even thought of trying beta 6 to see if maybe that would help, but I'll keep checking this forum and nod32 official site to see if there is an update that fixes this.
     
  5. BALTAGY

    BALTAGY Registered Member

    Joined:
    Jan 11, 2009
    Posts:
    99
    The issue in all v5.x not only v5.2, but not in v4.x or v3.x

    i hope to know when the fix will be release?
     
  6. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,423
    Check the number of active connections. We've seen cases where numerous connections weren't closed due to a bug in Windows Filtering Platform which caused ekrn not to release objects from memory.
     
  7. BALTAGY

    BALTAGY Registered Member

    Joined:
    Jan 11, 2009
    Posts:
    99
    if this problem from Windows Filtering so why v4.x doesn't cause this problem?!

    and if this problem from Windows Filtering what about that fix you told me about in this post:

    https://www.wilderssecurity.com/showthread.php?t=324961

    Note:
    1- i just talking here about memory leak problem
    2- i tried all versions of antivirus or smart security from v3.x to v5.x and this problem exist on v5.x only
     
  8. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,423
    Ok, I admit I misread your post. If it concerns v. 5.2 or Endpoint but not v. 5.0 or older versions, this issue will be fixed shortly in a service build of the affected products.
     
  9. rcdailey

    rcdailey Registered Member

    Joined:
    Dec 25, 2009
    Posts:
    233
    I've been running 6.0.11.0 beta for a while and I believe I have observed the spike in memory usage during and after a sig update. I have been shutting down each day when I leave and take my backup drive with me. So, when I start up again, memory usage is in the 85-95 MB range. This is with XP SP3. I did not see NOD32 release the memory after a sig update, which I think would be the best of all possible worlds. Restarting, of course, does release the memory. Memory usage did not get out of control when it spiked. It stabilized at about 330MB. I have 2GB RAM, so that is not a problem, so long as it stays at that level.

    I have had the system running for a few hours now and it has not gone up from 95MB, yet. However, there has not been a sig update during this session, either. I did a manual check for updates a couple of times with no significant change in the memory footprint.

    OK, NOD32 just did a sig update and now the memory usage is at 155MB. The memory hasn't be released, so it seems to remain allocated after the sig update. Since SuperAntiSpyware is running a scan, I'm going to wait to see what happens after that completes. SAS is using about 300MB during its scan.

    Well, the footprint for NOD32 is now just under 160MB and doesn't appear to be releasing. This is after the actual sig update, and the completion of the SAS scan. SAS is back down under 2MB usage. Oh, I should state that the memory usage I report for NOD32 is for ekrn.exe. The egui.exe process is under 2MB consistently, so that seems to be negligible. Correction, I see that egui.exe has gone up to 5504K, so maybe that is not negligible after all.

    Temporarily disabling protection doesn't release the memory, but that is because the kernel is not unloaded just because protection is disabled temporarily. Memory usage for ekrn.exe is remaining at just under 160MB.
     
    Last edited: Jun 21, 2012
  10. tajkkj

    tajkkj Registered Member

    Joined:
    Jun 25, 2012
    Posts:
    1
    Location:
    USA
    I too am seeing ekrn.exe continuously grow without limit. In working with ESET support, and on their advice, I discovered that one of the programs which was always started on login, RoxioBurnLauncher.exe, was the problem. I'm running Win 7, SP1, patches up-to-date, 64 bit, and using Nod32 5.2.9.1.
     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.