Nod32 causing downloads to freeze

Discussion in 'ESET NOD32 Antivirus' started by codylucas16, Apr 11, 2010.

Thread Status:
Not open for further replies.
  1. codylucas16

    codylucas16 Registered Member

    Joined:
    Nov 17, 2009
    Posts:
    267
    I just downloaded a trial of Nod32 to try it out on my 64 bit system. It seems to cause downloads to freeze at 99%. By this I mean the downloads, no matter what they are reach 99% and either stop or freeze the browser right up. If I disable nod32 the downloads go through fine without any problems. Is there any reason for this? The only other app I'm running in realtime is PC Tools firewall Plus.
     
  2. Cudni

    Cudni Global Moderator

    Joined:
    May 24, 2009
    Posts:
    6,956
    Location:
    Somethingshire
  3. codylucas16

    codylucas16 Registered Member

    Joined:
    Nov 17, 2009
    Posts:
    267
    I tried that. The problem is, it happens in every web browser, not only firefox. The download gets to 99% then just freezes.
     
  4. doktornotor

    doktornotor Registered Member

    Joined:
    Jul 19, 2008
    Posts:
    2,047
    There's another thread about this, which I cannot find. The outcome basically was disable high heuristics for web plus limit the file size to be checked to <=10MiB.
     
  5. codylucas16

    codylucas16 Registered Member

    Joined:
    Nov 17, 2009
    Posts:
    267
    Tried that, still same problem. :/


    I've tried everything I can think of. Uninstalled it, reinstalled. Uninstalled and installed Smart Security. No matter what with the real time protection enabled at all I cannot download anything without it freezing.
     
    Last edited: Apr 11, 2010
  6. Cudni

    Cudni Global Moderator

    Joined:
    May 24, 2009
    Posts:
    6,956
    Location:
    Somethingshire
    did you try disabling web protection ?
     
  7. codylucas16

    codylucas16 Registered Member

    Joined:
    Nov 17, 2009
    Posts:
    267

    Yea. It's actually the realtime protection, not the web protection causing it. o_O.
     
  8. Cudni

    Cudni Global Moderator

    Joined:
    May 24, 2009
    Posts:
    6,956
    Location:
    Somethingshire
  9. vtol

    vtol Registered Member

    Joined:
    Apr 8, 2010
    Posts:
    774
    Location:
    just around the next corner
    according to my observation it happens with IE8, Firefox 3.7, Opera 10.52. And it is real-time protection issue. Got nothing to do with the opera.dll, which was solved with an updated archive support module.

    NOD is scanning the downloaded files thoroughly uppn download complete (though it seem to hang at 99%), however not in the background but taking the browsers 'hostage' during the scan and thus rendering the browsers unresponsive for the time of the scan. depending on the size of the downloaded file and the machine's configuration this can easily take a while, or on less equipped machines even freeze the browser
     
  10. codylucas16

    codylucas16 Registered Member

    Joined:
    Nov 17, 2009
    Posts:
    267
    Okay so I've solved the problem. The real time protection seemed to be scanning more than just the file downloaded. It would scan the entire download folder which for me was massive ( something like 20gb). By moving files out of the folder downloads are working great. I would really like to see a fix or some sort of explanation for this.
     
  11. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    Couldn't it be that you have advanced heuristics (AH) enabled on file access which is disabled by default? Maybe the browser is accessing all the files in the download folder for some reason and the files are scanned with AH which may be a time consuming operation, depending on the nature of scanned files.
     
  12. codylucas16

    codylucas16 Registered Member

    Joined:
    Nov 17, 2009
    Posts:
    267
    I didn't touch the advanced heuristics settings. In the process of determining the problem I had even disabled normal heuristics. that didn't help either
     
  13. vtol

    vtol Registered Member

    Joined:
    Apr 8, 2010
    Posts:
    774
    Location:
    just around the next corner
    curious diagnosis, but it seems your are right. I kept an an eye on the NOD Statistic monitor, to watch the file activity on scanned files. It seems that NOD is indeed scanning all!!! those files from the download folder, by creating temporary copies in windows\temp.

    this cannot be a design but flaw and should be corrected asap.

    Advanced heuristics are off in real time scanning, system win 7 ultimate 64bit, NOD32 64 bit
     

    Attached Files:

  14. doktornotor

    doktornotor Registered Member

    Joined:
    Jul 19, 2008
    Posts:
    2,047
    As said, that depends on what your download manager is doing. One example: if you choose to display icons from files in Total Commander, then your AV will scan those files on read (because TC opens the files and reads the icons from them). That will be heavy if you enter a huge folder.
     
  15. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    This would happen only if SFX archives are scanned by real-time protection. Navigate to Real-time file system protection -> Advanced setup and in the "Additional TS parameters for newly created / modified files" section disable SFX archive to see if it helps.

    As for scanning with Firefox, the scan should not be run with Document protection not registered in the system or disabled. As of v. 4.2, Document protection is not registered in the system by default so you wouldn't need to alter the advanced FF settings.
     
  16. vtol

    vtol Registered Member

    Joined:
    Apr 8, 2010
    Posts:
    774
    Location:
    just around the next corner
    Marcos, thanks yours noted, however I do not see the viability of a product if there is a need to switch off something here and there. Then I do not need it at all and better use something which is efficient as such but compatible to applications, and browsers are not some fancy stuff either.

    If there is something present in a SFX archive I would like NOD to catch it as early as possible.

    And what the Threat Sense parameters got to do with it in the first place?

    Nonetheless, tried your suggestion, however no avail.

    Just tested download MS Netframework 4 with Oper 10.52 b 3347

    http://download.microsoft.com/downl...BC36-D6EA96C8DAAE/dotNetFx40_Full_x86_x64.exe
    To: E:\Downloads\dotNetFx40_Full_x86_x64.exe
    Size: 48.2 MB (50,449,456 bytes)
    Transferred: 48.2 MB (50,448,856 bytes)

    The download grinded to a halt at 99.9% for 2 minutes, whilst NOD was doing its thing with the temp files, again.
     

    Attached Files:

    Last edited: Apr 13, 2010
  17. Geosoft

    Geosoft Registered Member

    Joined:
    Jan 7, 2009
    Posts:
    270
    Location:
    Toronto, Ontario, Canada
    I can confirm that I have the same problem as vtol has reported with that file download. What is worse about this problem is that I have told "Real-time file system protection" to stop scanning archive files after 30 seconds, and it still scanned the file for 3minutes and 40 seconds.

    Thankfully I'm on a quad so the performance impact to my work is minimal.
     
  18. acooldozen

    acooldozen Registered Member

    Joined:
    Oct 16, 2005
    Posts:
    218
    Location:
    White Rock, BC, Canada
    ..........is happening with Opera 10.51> However only started happening after installing Windows 7 Ultimate, on desktop and laptop. Locks up at 99.9% of download for about 30-50 secs before download completes.
     
  19. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    The above mentioned installer contains a huge number of files (21,371 in particular) so it takes time to unpack and scan them all. It will be excluded in one of the upcoming updates.
     
  20. acooldozen

    acooldozen Registered Member

    Joined:
    Oct 16, 2005
    Posts:
    218
    Location:
    White Rock, BC, Canada
    Thank you Marcos!
     
  21. vtol

    vtol Registered Member

    Joined:
    Apr 8, 2010
    Posts:
    774
    Location:
    just around the next corner
    Though the effort is appreciated, it does not solve the problem. Download an iso image of a linux distro, which accounts for several GB, the download freezes for ever.

    Judging by other threads, e.g. https://www.wilderssecurity.com/showthread.php?t=269282, there seems to be serious issue in need to be addressed by Eset and not just be excluding files and thereby bloating the software unnecessarily.
     
  22. pondlife152

    pondlife152 Registered Member

    Joined:
    Apr 23, 2008
    Posts:
    105
    Location:
    UK
    Just downloaded this file in IE8.

    I have Self-extracting archives scanning disabled in the Threatsense engine setup for Web Access Protection, but it is enabled on my system for the overall settings and for newly created files in the Real-time protection settings.

    In my case the file completes in just a few seconds.

    This is on Vista SP2 32bit.

    I can see you say that web access protection is not the issue on your system, but you don't say if you've tried these specific settings. They do seem to work for me. If I re-enable Self-extracting archives in Web Access Protection the download does hang for quite a while at 99%.
     
  23. vtol

    vtol Registered Member

    Joined:
    Apr 8, 2010
    Posts:
    774
    Location:
    just around the next corner
    as mentioned earlier - what is the use of NOD when I have to switch off certain components just to get basic stuff like a download happening? Now everytime I want to download something I have to do that, or is Eset actually going to fix that instead, which would make sense imho.
     
  24. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    If you don't want to have such large archives scanned, simply set a size limit for archives. One cannot expect large iso files to be unpacked and scanned in a few seconds, even extracting such large archives takes reasonably much time with compression tools.
     
  25. vtol

    vtol Registered Member

    Joined:
    Apr 8, 2010
    Posts:
    774
    Location:
    just around the next corner
    perhaps I am not clear, I want archives scanned and I do not want to switch off modules every now and then. I would prefer Eset to fix this flaw, which it clearly is (freezing downloads). Other AV solutions do not have this issue, they might have others though.

    Question is in the end. Does Eset cares about the customer or not, then it probably better to abandon NOD now, as others pointed out too.

    So, is Eset going to fix it or not, I am not accepting stop this module or limit the size of this or switch off NOD
     
Thread Status:
Not open for further replies.