NOD32 takes 99% CPU too long

Discussion in 'NOD32 version 2 Forum' started by masster, Oct 1, 2006.

Thread Status:
Not open for further replies.
  1. masster

    masster Registered Member

    Joined:
    Oct 1, 2006
    Posts:
    22
    I used NOD32 v2.51.26 for 1 week in quite good conditions. Then it began consuming more and more CPU for scanning. So I would like to know what causes NOD32 to use 99% of CPU for as long as it scans the files. My computer freezes waiting AMON to end. The bigger the EXE or RAR or ZIP, the longer my PC freezes. Up to 30-40 seconds!!! So as a last resort before throwing NOD32 in the garbage bin, I ask you: what is going ono_O
     
  2. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    AMON does not scan inside other than SFX archives. Try disabling SFX archives in the AMON setup to see if it makes a difference.
     
  3. masster

    masster Registered Member

    Joined:
    Oct 1, 2006
    Posts:
    22
    AMON scans all. Period.
    And how do you explin NOD32 'eats' more CPU as time goes by?
     
  4. covaro

    covaro Registered Member

    Joined:
    Jul 4, 2006
    Posts:
    149
    Location:
    Abingdon, MD, USA
    I think you can pretty much take Marcos @ what he's saying. Considering he works for Eset I'm pretty sure he's correct on his statement. After all, unless it is during creation in which AMON scans everything it can and uses Advanced Heuristics.

    Do you have any other real-time programs running on your machine? That's a pretty typical culprit of High CPU usage.

    -Cov
     
  5. masster

    masster Registered Member

    Joined:
    Oct 1, 2006
    Posts:
    22
    I think I can pretty much read in Extensions tab: Scan All...

    No, I don't. And I am using Process Explorer (http://www.sysinternals.com/Utilities/ProcessExplorer.html) just in case.

    And to be more specific, I tested also Kaspersky, AVG and ZAP. They all use advanced heuristic method, but none of them freezes my computer when creating/copying/moving/deleting files... I guess this issue is very well known by NOD32 authors and yet they dump it like a skeleton in the closet. "If clients bump on it, we'll blame on something else, if they don't... lucky us"
     
  6. kjempen

    kjempen Registered Member

    Joined:
    May 6, 2004
    Posts:
    379
    If it was all NOD32/AMON's fault, then I assume all users would have same experiences as you? Then how come it is not? It must have something to do with the setup you're using? Or softwares you are using? I'm just guessing... Maybe if you provided more info? Which hardware/PC are you using (how powerful), which OS, service pack, other security softwares, "clean" AV installation or not (are there any left-overs of other antiviruses)? etc.

    EDIT: By the way, I tried putting an infected .exe file that NOD32 detects inside a .zip archive. I have set AMON to scan all files, yet it does not alert me when I put my mouse over the .zip archive (not even when I double-click the archive either). I guess this goes as proof against what you said? This should be normal behavior for a NOD32
     
    Last edited by a moderator: Oct 1, 2006
  7. masster

    masster Registered Member

    Joined:
    Oct 1, 2006
    Posts:
    22
    I will take them one by one. Remember that my PC had same computation 'power' for every anti-virus tested. CPU goes to 99% when checking/creating files ONLY for NOD32.

    SYSTEM INFO
    ==========

    NOD32 antivirus system information
    Virus signature database version: 1.1784 (20060929)
    Dated: Friday, September 29, 2006
    Virus signature database build: 8114

    Information on other scanner support parts
    Advanced heuristics module version: 1.037 (20060926)
    Advanced heuristics module build: 1122
    Internet filter version: 1.002 (2004070:cool:
    Internet filter build: 1013
    Archive support module version: 1.050 (20060926)
    Archive support module build version: 1176

    Information about installed components
    NOD32 for Windows NT/2000/XP/2003/x64 - Base
    Version: 2.51.26
    NOD32 for Windows NT/2000/XP/2003/x64 - Internet support
    Version: 2.51.26
    NOD32 for Windows NT/2000/XP/2003/x64 - Standard component
    Version: 2.51.26

    Operating system information
    Platform: Windows XP
    Version: 5.1.2600 Service Pack 2
    Version of common control components: 5.82.2900
    RAM: 512 MB
    Processor: x86 Family 6 Model 8 Stepping 6 (PIII/933 MHz)

    OTHER SECURITY SOFTWARE
    =====================
    Agnitum Outpost Firewall v4.0

    ABOUT "CLEAN" INSTALL
    ==================
    Format c: and Windows XP reinstall before each antivirus test.
     
  8. pc-support

    pc-support Registered Member

    Joined:
    Mar 10, 2005
    Posts:
    285
    Location:
    Edinburgh, UK
    Is there anything in the event logs?

    Have you tried an uninstall / reboot / reinstall / reboot?
     
  9. masster

    masster Registered Member

    Joined:
    Oct 1, 2006
    Posts:
    22
    Define 'anything'...
    Read above:
    "Format c: and Windows XP reinstall before each antivirus test."
     
  10. pc-support

    pc-support Registered Member

    Joined:
    Mar 10, 2005
    Posts:
    285
    Location:
    Edinburgh, UK
    Is there anything in the event logs regarding NOD or any of its modules?

    And wether or not you've formatted your hdd makes no difference to my questions.
     
  11. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    There is something unique to your system, and with this being the case we need to find out what exactly it is to resolve this situation.

    Please download and run HijackThis from HERE

    Please download and run Autoruns from HERE

    Please download and run Lookinmypc from HERE

    Then forward the logs from all three programs to support @ eset.com with a link to this thread.

    Cheers :D
     
  12. bs259

    bs259 Registered Member

    Joined:
    Feb 3, 2005
    Posts:
    141
    Location:
    Queens, NYC

    i had this same problem when i had nod installed on my machine and i found the problem to be mim.exe, for whatever reason while nod was doing a scan it would go way up (i recently noticed avira does the same thing), when i disabled mim.exe recources went back to normal. I hope this helps
     
  13. NOD32 user

    NOD32 user Registered Member

    Joined:
    Jan 23, 2005
    Posts:
    1,766
    Location:
    Australia
    Doesn't sound like the cause in this case, but mim.exe is a MusicMatch JukeBox component and it is a known issue for them (MusicMatch) who were acquired by Yahoooooo a while back. It used to be even worse.

    OK - now I've got a bit of dejavu

    Cheers :)
     
    Last edited: Oct 3, 2006
  14. masster

    masster Registered Member

    Joined:
    Oct 1, 2006
    Posts:
    22
    Exactly. Never interested in that software and never installed it.
    On the other hand, another forum member had same issues and NOD32 support suggested to uncheck "select all" extensions to scan. Which I did. But no change. The moment NOD32 kernel sees I want to copy/move an .EXE it scans and it scans and it scans and more CPU... very greedy software. Its days are numbered. Here I come Kaspersky AV + firewall or ZoneAlarm Internet Suite.
     
  15. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    So disabling SFX archives nor AH didn't help? It's like with cars, the better the more gas it consumes. If you want an excellent detection you must sometimes sacrifice the speed.

    What about excluding the exe file in the AMON setup if it stays at the same location? Anyway, in such case AMON would scan it only once with the "Optimize scanning" option enabled.
     
  16. masster

    masster Registered Member

    Joined:
    Oct 1, 2006
    Posts:
    22
    Ooooh... finally truth begins to emerge... I translate: NOD32 good detection -> sluggish system. So let's quit "configurations issues" and be more honest towards clients.

    Optimize scanning my ###...
     
  17. kjempen

    kjempen Registered Member

    Joined:
    May 6, 2004
    Posts:
    379
    So actually you didn't post here to get support/help with any issue?
     
  18. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    This is not true and we all know it. I think all has been explained so the thread is now closed to prevent from further trolling.
     
Thread Status:
Not open for further replies.