NOD32 locking systems.

Discussion in 'ESET NOD32 Antivirus' started by BBUser0, Apr 1, 2011.

Thread Status:
Not open for further replies.
  1. BBUser0

    BBUser0 Registered Member

    Joined:
    Apr 1, 2011
    Posts:
    5
    Hi,

    Any assistance is appreciated.

    Running version: 4.7.71.2 Business Edition (no firewall).
    OS: Windows 7 32-bit

    Since we installed NOD32 all 10 of our systems are locking up.

    This occurs when using a program based on javaws.exe which loads off a local server.

    When the computer locks, it is completely unresponsive (cannot ctrl + alt + del) and must be forcefully restarted.

    I have:
    - Disabled NOD32
    - Added exception for javaws.exe

    When NOD32 is un-installed, the issue doesn't occur.

    NOD32 is installed on a Windows 2003 terminal server as well, running the same javaws.exe application - but doesn't have these errors. It is only the Windows 7 workstations which are locking.

    Is there any thing else we can do?
     
  2. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    Have you tried renaming the driver C:\Windows\System32\drivers\epfwwfp.sys in safe mode to prevent a bug in Windows Filtering Platform manifested by system freezing from occuring ?
     
  3. BBUser0

    BBUser0 Registered Member

    Joined:
    Apr 1, 2011
    Posts:
    5
    Should I just rename that file and then just reboot?

    Will that just resolve the freezing issue but still leave the program locked (so I can at least terminate the process)?
     
  4. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    Yes, rename it in safe mode and then boot normally to Windows.

    Hard to say but the WFP bug can cause system freezing as you mentioned, hence I suggested renaming the driver in the first place. Microsoft didn't support WFP in Windows 2003 or older OS so I suspect the above mentioned bug to cause the issues.
     
  5. BBUser0

    BBUser0 Registered Member

    Joined:
    Apr 1, 2011
    Posts:
    5
    Is this bug set to be fixed in future ESET products?
     
  6. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    No, it's a bug in Microsoft Windows Filtering Platform used since Windows Vista. We expect it to be fixed in the next SP but this has not been confirmed by MS yet to my best knowledge.
     
  7. BBUser0

    BBUser0 Registered Member

    Joined:
    Apr 1, 2011
    Posts:
    5
    Thanks for your assistance.

    I found the file: epfwwfpr.sys and renamed this. Is this the correct file? It's slightly different to the one you specified.

    Either way, restarted the machine and "Maximum Protection is not ensured"; this is because "Web access protection - Non functional"; was this the desired intention?
     
  8. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    You're right. Epfwwfpr.sys is used by ESET NOD32 Antivirus while epfwwfp.sys by ESET Smart Security.

    That's expected behavior. To my best knowledge, the next version should report the status differently when the driver is unloaded.
     
  9. BBUser0

    BBUser0 Registered Member

    Joined:
    Apr 1, 2011
    Posts:
    5
    Thanks for the help, seems to have resolved the issue.
     
Thread Status:
Not open for further replies.