NOD32 control center crashing Also cannot complete a full scan

I am experiencing the same problem with this public beta that I have had for a long time with the release version on my XP box. I cannot copy the log files without having my RAM usage shoot to 100% and NOD32 control Center freezes and I have to resort to killing the nod32kui.exe in task manager. After trying to copy the logs, I then cannot even VIEW the logs without NOD32 control center SILENTLY crashing a few minutes after I view the logs.

This problem occurs on the release version and it was because of this problem that support gave me an early beta to try. That early beta seemed to fix the problem. Now though it is back in the public beta.

I also am unable to complete a full scan of the C drive with this public beta on the XP box. The scan hangs on a particular file ...same file each time and the logs show that NOD32 scanner is running when it it has actually stopped on this file and then silently crashed. The file in question is an ordinary file in my downloaded programs folder on my desktop. The release version has no problem with the file and scans the entire C drive as it should. (The release version does have the problem with NOD32 crashing silently and not allowing copying of the log files).

When I originally experienced the almost constant crashing of NOD32 Control Center and Mark sent me the early beta, he thought I might have some application running that is severely conflicting with NOD32 but I sent a Hijackthis to him and did not hear anything back so I think he didn't see any application that might be causing this conflict.

It appears that NOD32 release and beta do not like my XP Pro box. NOD32 beta runs fine on my W98SE box as did the release version one and two. These constant problems with NOD32 on my XP box are one of the reasons that I will not be renewing my license as I mentioned in another thread.

I also have a false positive that I submitted to Eset back in May. It is still not fixed two months later. I don't see any way to exclude the folder when I run a full on demand scan. I have excluded it for AMON. (Of course, I cannot run a full scan so it doesn't really matter).

 

Hi mele20

You say:
"I am experiencing the same problem with this public beta that I have had for a long time with the release version on my XP box."

Have you updated that "release version" at all ? Chances are XP SP1 ++updates beyond that are causing the compatability issues on your machine. SP1 to XP changed several core system files dramatically from the "released version" and SP2 "beta" goes one step more and turns the NX flag on for CPU's that support NX=no data execution.....

Hope this helps steer you in trouble-shooting


Saphire

 

That's weird, I used to have the same "crashing" problem with the release version when I tried copying from the log, but it works fine now on this beta release (PS! I also have Win XP). Also, about your false positive, have you tried sending it to samples@eset.com instead of samples@nod32.com? (I get quicker replies from eset.com than when I send to nod32.com - sometimes I don't even get a reply from nod32.com.)

 

SaphireX, NOD32 tech support gave me an early beta because of the problem with crashing when copying or even just looking at the logs so I don't understand what you mean by "have you updated the release version"?

kjempen, I found that I can copy the log if I am willing to wait about 15 minutes on a 3GHz PentiumIV with 1024RAM. I cannot do anything else during this time as the CPU is 100% occupied trying to copy the log. That doesn't seem right to me. Plus, during this inordinate amount of time it takes this powerful box to copy just one log of a full scan, the NOD32 control center becomes blank and after the copying is finally finished, I have to use c/a/d to kill the process because there are no buttons no nothing but a shell left of the NOD32 control center. If I only copy one line of the file that works ok but the CPU usage shoots to 100% even just with that and doesn't go down until I hide the Control Center.

I have no idea how anyone with a slower computer would ever be able to copy the log. When I tried exporting the log to a text file that works fine. The thing is that Help explicitly says to COPY the log for tech support. Help has a whole bunch of incorrect/irrelevant information and it seems to me that by the time a PUBLIC beta is released that Help should be revised to reflect the changes and new things in the PUBLIC beta. The Help file also tells me to use the button in the left hand lower corner to copy. There isn't any button.

As for the best address to submit samples, I have had no problem with the nod32 address. My problem is that after two months of waiting Eset still has not addressed my false positive. Marcos said here about a month ago that it had proven more difficult than thought to fix this. But over two months now to fix a false positive? That seems excessively long.

I have been able to complete a full scan by unchecking everything except "scan all files".

 

Are you having these problems with the released beta or just the early beta
you received and never installed the released beta?

 

I'm having the problems on the PUBLIC beta on XP Pro Sp1a. The earlier beta that tech support sent worked better than the public beta.

 

Hi Mele20
I am taking a shot in the dark here (troubleshooting?)
Is the XP PRO on a Dell PC with the Dell OEM version of Windows XP ?
I inherited a few clients with the OEM version on their Dell machines and they were having problems (with other applications acting strangely). We reformatted (not suggesting that you do any reformat) and installed a legal copy of the retail version and their problems never occured again.
IMHO it seems that the Dell OEM version of XP is altered in some way to be Dell specific and some .dlls are not the same as the retail version. As a side note...you can't install a Dell OEM Xp on any other PC as it gives nothing but errors.
I am not suggesting that the problem is NOT with the NOD versions (it works fine on your 98 machine and on my W2K machine) so it has to do with the NOD/XP combination, hence my question above.
Cheers

 

Damn, you may be on to something here, Mele20's XP machine is a Dell:

https://www.wilderssecurity.com/showthread.php?t=42376&page=3&pp=25&highlight=dell

I have install over 500+ copies of Nod32, though not a single one has ever gone onto a Dell running their OEM XP software.

Very interesting to see what happens from here.

Cheers

 

Hi Blackspear
I was just trying to help...... not sure, so many variables.
This is not off topic.....and I am NOT trying to hijack the original topic as I think it is relevant and important to all of us using/trying NOD......it is just clarification of my previous response.
If you have a Dell with an OEM Windows ME and you want to go to XP, the Dell support tells you not to use XP retail upgrade, and suggests strongly that you reformat and use the full retail install.
That in itself tells me something as I have upgraded many PC's from ME to XP using the retail upgrade package..why would they (Dell) tell the customer NOT to use the upgrade route?
Just my .000000000002 cents.
Cheers

 

Hmmm. Yes, as Blackspear has noted this is a Dell 8300 Dimension. But my W98SE box is also a Dell and the beta runs well on it although I don't use that box very much as it is currently in the bedroom on a cart that is not for computers and I have to rest the keyboard on my lap and there is not a good place ergonomically speaking for the mouse. So, I might have problems on that Dell box if I used it more but then again I might not.

I am not convinced that Dell alters XP or W98SE. Dell, unlike other OEMs, sends a real XP Pro REINSTALLATION NOT RECOVERY disk which is the very same as the XP Pro disk you buy at retail. It does say use only on a Dell computer but you shouldn't be able to install ANY OEM XP Pro on a machine that is not the same brand as the one the XP Pro came on. I had been told before I bought this Dell that I would not get a full reinstallation disk with all hidden files as no other OEM provides this. (They all provide those awful restore disks instead). But that was not true. The disk I have has hidden files such as Netbeui on it so I think the only thing that makes it not installable on other non Dell computers is that is required by Microsoft because an OEM copy of XP is much cheaper than that bought at retail so there needs to be this limitation. And of course, all tech support for XP is through Dell not MS. I did not have to activate XP and will not need to activate it if I were to format and reinstall. So, I think that is why it won't work on other computers and not because dll's have been changed. Having said this though, Dell has always said that they test a new OS and tweak it to be compatible with Dells. I know I was supposed to get my old computer with W98SE installed but MS was late in releasing 98 second edition and so my Dell came with only W98. I was given a free coupon for the 98SE disk once Dell had tweaked it for Dell computers. I had to wait until the end of Oct 1999 before Dell had them ready. So, if Dell is doing some sort of significant tweaking then seems I would have trouble with the W98SE box too. That box has loved earlier versions of NOD32 and seems ok with this beta.

If Dell has significantly tweaked this XP Pro then you think I would have run into problems when I have had to replace dlls where I have just gone on the internet and gotten them. I would be interested in hearing from others with Dell XP Pro OEM edition and NOD32 beta.

I did figure out one thing. Does the beta come with under my profile when setting up the NOD32 on demand scanner with the boxes under system "list all files, sound alert, use MAPI interface" checked? To my utter surprise, earlier today, I noticed that those were checked! I never have had any of those checked when using the current version. The list all files one being checked was, of course, making my log be very lengthy which was part of why it took so long to try and copy it. I wondered why I was seeing all those files listed in the log and thought that it was just the way the beta did it until I checked on my 98Se box and I didn't see all those files listed and then I noticed that on the XP box that checkbox was checked. It is possible that I checked it and have forgotten but I know I never checked the sound alert box as I keep my speakers off most of the time and hate sounds popping up. Plus, I also know I never checked use MAPI interface! Anyhow, when the only files that are listed after a full scan are the ones that are locked and can't be scanned, viruses, damaged files, etc. then the log is a reasonable size and I should be able to copy it more quickly.

This is really frustrating. I just tried to scan with all boxes unchecked under objects to diagnose except for "files". One time after support told me to try this, I got it to perform a full scan. Now, it scans just about one minute and abruptly stops and the scanning screen disappears off my screen. There is no error message and the log says it is still scanning but it isn't. That is what it was doing earlier with all the boxes under objects to scan checked except email (which I never scan). While it was scanning it was using between 50 to 90% CPU. It doesn't hang on the same file each time. If that was the case, I would try excluding that folder or individual file and see if it could complete a scan but it hangs on different files.

I don't understand the silence from tech support. Perhaps Mark is ill or went on vacation? Or my reply didn't reach him for some reason?

 

My W98SE box was not upgradable to XP but it was/is fully upgradable to W2000 and Dell recommended I use the upgrade route at the Dell site which would mean an OEM upgrade not retail. That option is no longer available at the Dell site though but it was for a long time. (There were hardware problems such as my modem that made it non-upgradable to XP unless I replaced a lot of hardware).

Why wouldn't Dell tell their WME users to use Dell upgrade to XP? or Dell full XP installation? Why would Dell mention retail at all? That doesn't make any sense.

 

Hi Mele20,

My son has a new Dell 4600 2.8. It is running the NOD32 beta without any problems. I used to build all my own machines for years but I got tried of that.

I noticed that an NOD32 scan, selecting "In depth analysis" used around 8% -10% CPU with just occasional jumps to 50-60%. I assume those jumps may be due in part to unpacking a file?

To maybe help rule out a third party driver issue how does a scan run in the "Safe" mode?

 

I didn't even think of trying in safe mode...dumb. I'll have to do that but I'll have to reinstall the beta.

Before I went to sleep in the wee hours this morning, I uninstalled the beta and installed the beta that tech support had sent me before the release of the public beta. That beta had been able to complete full scans. Well, that beta cannot complete a full scan either. It hangs very early in the process. I tried with all the boxes under objects to diagnose checked (except email) and then I tried with only files checked. It hangs either way and uses way too much CPU ...not just occasional spikes which are expected.

So, I uninstalled it and installed the current version and then my ISP turned off internet access ( for maintenence purposes) for two hours so I couldn't update the definitions. So, just now with updated definitions, I ran a full scan (of course not in depth as that is not available). In depth is what I have been trying to run with the beta and in depth runs fine on the W98SE box. This current version did just fine. I had everything under Objects to Diagnose checked (except email). It showed only occasional spiking of the CPU to 70% but mostly around 10-20% which still seems a bit high. Trying to open Firefox while the scan was running gave me a noticable delay.

The current version was able to correctly scan those 595 renamed viruses that some of us have used as diagnostic tests. I have kept this file and have purposely not excluded it because I wanted to see how the beta would perform. The current version of NOD32 scans all those files and correctly catches 535 of the 595 viruses. The beta has been hanging recently when checking those files.

I also see from this scan with the current NOD32 that it is finding a file that it says is a damaged archive. The beta has sometimes hung on this very file. So, perhaps the beta has trouble with damaged archives? So when tech support told me to try scanning with only "files" checked under Objects to Diagnose then the scanner no long hung on this damaged archive file. Instead, it found another file to hang on.

Something else: Why does the beta NOD32 on demand scanner start running as soon as I open it from the control center? It never shows me a Scanning Targets screen. It just starts running. I have to let it run while I go into profiles to see what profile it is using and to change such things as what objects to diagnose. That is screwy and certainly not the way it should be. There is no way for me to choose to scan my CD rom or DVD drives with the beta. It will try to scan the C drive only and then hangs.

 

Hi Mele20,

I am not sure what is happening at your end?

Using the beta with WinXP when I click on "Run NOD32" it scan the memory then the "Scanning Targets" screen opens so I can select the drives.

 

Same thing on my W2K box.
I have been trying to decipher what would be happening with Mele20's xp strange behavour with NOD32.
I wonder if "BLACKSPEAR" or another knowledgeable person would be able to shed some light on why NOD starts the scan automatically, and not like "Stan999" setup or mine.
Maybe, if we can find a fix for that problem it may alleviate others......just a thought.
Cheers

 

When I use the current version on XP, I don't see it scanning the memory. Maybe it does, but all I see after I click on the "run NOD32" button is the "Scannning Targets" screen. I just tried on the 98SE box (with the beta) and if I click Run NOD32 it scans the memory and then stops and presents the Scanning targets screen. However, if I click on "In depth analysis" it begins immediately running and doesn't stop after the memory check. It just keeps running and it appears to use whatever profile was last used. I have to click "stop" and then click "Scanning targets". Maybe "In Depth" analysis is supposed to not present the Scanning Targets screen since it doesn't present it on either of my computers running different OSes?

Edited to add that I see fredra's post after I posted. I'm talking about the "In Depth" analysis not the regular scan. (Why do a regular scan now that we have In Depth available)?

 

Hi Mele20,

I didn't realize from your other post you were referring to the "In depth analysis". Looks like that is set to check all the HDDs with all Options set on.
https://www.wilderssecurity.com/showthread.php?p=224995#post224995

 

Hi Mele20
I apologize...I misunderstood...didn't realize you were reffering to "In Depth Analysis"
I will take a more detailed look on my W2k box to see how it functions and the CPU usage.
Not sure I will be able to shed any more light on it, but I wll try.
Cheers

 

That In Depth Analysis is all messed up. I just downloaded that zip file that has the 595 viruses renamed for testing to my 98Se box. Then I ran an In Depth Analysis. I am still laughing at the ludicrous results I got. It says I have 1096 viruses!!! It should read 535 plus some eicar and a couple of others. So, I looked through the scan and the scanner identified the 535 viruses from the zip file that NOD32 sees (it doesn't detect the rest of them) and then when the scanner got to C:\WINDOWS\Application Data\Phoenix\Profiles\default\35uoewpj.slt\Cache\6879E7C8d01 »ZIP »ovde ima 593 virusa/100yearb.exf - Frodo.B virus
it began to see each one of those zipped renamed 535 viruses again one after another! Of course those viruses aren't in my phoenix folder! They are zipped and renamed and harmless. It is hilarious! I can't stop laughing. I think Eset should never have issued such a buggy Public beta!!!

 

I have no problems copying the log on the 98SE box. I just tried to submit a post with the log which shows only the errors such as locked files and viruses found. But Wilders won't let me:

The following errors occurred when this message was submitted:

1. The text that you have entered is too long (145191 characters). Please shorten it to 50000 characters long.

 

Stan999 and fredra,

I'm sorry if I wasn't clear about the fact that I am using the In Depth Scan instead of the regular NOD32 scan. Like I said in the thread about the In Dept Scan, who would not use this instead of the regular scan? I was already, before the beta, using a profile to do a full in depth scan so the addition of this button just makes what I was already doing easier.

 

Now that I have had more time to look at it, I see why the scanner claims 1096 viruses. I downloaded that file of 596 viruses using Firefox and I did not clear the Firefox cache. I have 0 Firefox cache on my XP box and usually have the same on the 98SE box. However, I had reinstalled FF on that box recently and I guess I forgot to set the cache to 0. So the scanner was finding the viruses again in that one cached file. So, I have to now say that is impressive and the scanner is working correctly on my 98SE box.

I wish the scanner would scan fully like that on my XP box.

 

I just reinstalled the beta on XP. Configured it and then restarted in Safe Mode. In Depth Scan is not available in Safe Mode. So, I used My Profile which is set exactly the same. It scanned for about one minute and then suddenly the screen disappeared. I clicked on the NOD32 icon and all I could see in the log was something about an error when scanning the memory. So, I rebooted normally and looked at the log and there was nothing in the log except the two times that the scanner started when I was configuring it and those two logs showed the memory was scanned and was ok. There was nothing about any scan in Safe Mode.

Something is sure wrong with this beta on XP Pro. I am really surprised it could not do a scan in safe mode!

I have written tech support again. No response. That is inexcusable. If Mark is sick someone at Eset should be checking his mail. I have not heard from tech support in 66 hours now and tech support knows I can't complete a scan. What if I had a really serious problem and needed immediate support? This is exactly why I don't believe that I want to renew my license. I want a vendor that has free phone support. I have always been apprehensive about the lack of free phone support but then only Trend Micro had it until recently and when I had their av the phone support was excellent. Now the vendor that is considered by many to be the best has free 24 hour phone support world wide 365 days a year and guarantees resolution within 24 hours. Their av is slightly more expensive than NOD32 but worth it for the free phone support. I think Eset, and every other vendor except Trend Micro, is going to really have to beef up their support in order to compete. And that is GOOD because customers should be able to get free phone support, I believe, from all major av vendors (and not just from Eset in Australia).

 

Well, it looks like I am talking to myself here. Guess no one can stand to know NOD32 is not perfect.

For the record, the beta on my XP Pro box has been using 80-90% CPU even during idle times. I didn't have the task manager in the systray earlier and I thought something awful was wrong with dslr as it was so sluggish I could barely use it and I even posted about the slowness there. I was puzzled though because my speed is better than it has been in several months due to my ISP doing emergency maintenence for three nights straight and pings to dslr were fine. It was extremely slow here also so then I looked at "performance" in the task manager and something was using 80-90% of the CPU. NOD 's memory usage was much higher than normal. I shut down everything except my browser and still something was using almost all the CPU. So, I tried then to shut down NOD32 kernal and of course I could not. I hate that about the beta. I had to actually uninstall it to stop it from using all the CPU. Sure enough, as soon as it was off my box, my CPU usage dropped very low with just the occasional normal spiking.

I still have not heard from tech support and it has been 72 hours since I sent in the report that was asked for.

 

Hi Mele20,

Again, I am not having those problems on my XP Pro machine. A lot of what you are reporting seems to be more of a problem with your specific XP Pro machine then the NOD32 beta.