Problem Downloading Large Files

Discussion in 'NOD32 version 2 Forum' started by Set, Feb 14, 2007.

Thread Status:
Not open for further replies.
  1. Set

    Set Registered Member

    Joined:
    Feb 14, 2007
    Posts:
    11
    Hi,
    I been using NOD for many years with great satisfaction, yesterday I encountered a problem which I can not solve. I hope someone here can help me sort it out.

    OS = WinXP PRO (SP2) Fully Updated.
    AV = NOD32 2.7
    FW = Outpost Firewall PRO 4.09
    Browsers = Opera / IE 7

    Firstly let me say I confirmed this problem is related to NOD because when I uninstall NOD the problem goes away.

    The Problem:
    When I download large files usually 70+(megs) my browser hangs/crashes when the file is around 99.8% completed. When I check task manager it shows NOD kernal is using up 40-80% CPU power.

    What I Did:
    Like I said NOD has been running flawlessly for years on my system. Yesterday I used a program called (TCP OPTIMIZER) it does what it says on the tin. It improved my connection from 4.5 to 6.5mbits very nice indeed.

    What I Tried:
    I have tried un/re-installing Opera.
    I have tried un installing NOD/deleting folder/running reg cleaner/re-installing.
    I have tried restoring reg settings to what they where before TCP was run.
    I have tried turning off passive scanning in IMON.

    I got a hunch this has something to do with the file being scanned when its moved from the temp download folder to the destination folder, but other than that I'm stuck.

    Regards Set.
     
  2. pykko

    pykko Registered Member

    Joined:
    Apr 27, 2005
    Posts:
    2,236
    Location:
    Romania...and walking to heaven
    hello, Set!
    Welcome to Wilders!
    You may try to switch at client compatibility to "Higher compatibility" rather than "Higher efficiency". :)
     
  3. Set

    Set Registered Member

    Joined:
    Feb 14, 2007
    Posts:
    11
    Hi pykko,

    Thanks for the welcome, is this a confirmed fix for my problem? I'm at work at the moment and can't check, I'm not 100% sure but I think I might have tried what you suggested already.

    Set.
     
  4. pykko

    pykko Registered Member

    Joined:
    Apr 27, 2005
    Posts:
    2,236
    Location:
    Romania...and walking to heaven
    Well, it's not 100% sure it will work but you may try it. It could be the proper solution. :)
     
  5. Set

    Set Registered Member

    Joined:
    Feb 14, 2007
    Posts:
    11
    Well this is driving me mad, so ok, I tried what pykko suggested, and it didn't work. I then disabled IMON alltogether and the file downloaded, but the browser still crashed and nod32krn opened another instance of itself and is again using 60-90% of CPU power.

    This is so wierd because I have never had a problem with NOD before and this seems to have come out of nowhere. I have always installed NOD with default settings and it has always worked prefectly until yesterday.

    P.S. Thanks for trying pykko.
     
  6. Brian N

    Brian N Registered Member

    Joined:
    Jul 7, 2005
    Posts:
    2,148
    Location:
    Denmark
  7. Set

    Set Registered Member

    Joined:
    Feb 14, 2007
    Posts:
    11
    Brain just as you were posting, I was re booting after repairing network connections in IMON. Thought maybe that was it, but it failed too. In your post you suggest reading a post by blackspear, I presume you mean the part to do with repairing winsock. Well as far as I know my internet is working fine, as I dont have this problem with other AV's just with NOD and just since yesterday.

    Is it possible something in Winsock is causing NOD not to function but not effecting other anti virus scanners?
     
  8. Brian N

    Brian N Registered Member

    Joined:
    Jul 7, 2005
    Posts:
    2,148
    Location:
    Denmark
    That's usually the case, yes. I suggest you try it out since you used a TCP application so it could have messed up IMON's "entry" to the winsock.
     
  9. Set

    Set Registered Member

    Joined:
    Feb 14, 2007
    Posts:
    11
    Well, that didnt work either exactly the samething keeps happening. File almost downloads then nod32krn goes from virtually no CPU usage to 60-90% usage. Browser crashes and I got to terminate NOD using task manager to get system back to normal.

    Any other ideas, suggestions?

    P.S thanks Brian for trying.
     
  10. Proactive Services

    Proactive Services Registered Member

    Joined:
    Jan 10, 2006
    Posts:
    153
    Location:
    Petersfield, Hampshire, UK
    Is the file a self-extractor, for example an installer? If this is the case NOD32 will unpack and scan it before IE moves it out of the temp folder. This will cause IE to freeze whilst the scanning is going on.

    When you say it hangs, how long have you left it for? I have just tried downloading the OpenOffice.org 2.1 installer which is 90MB or so, and NOD32 has been scanning it for the past few minutes and is still going.

    Maybe what is needed is a progress meter for background scanning - if it takes longer than 15 seconds say. I would suggest just leaving NOD32 scanning and see if it finally finishes.
     
  11. Set

    Set Registered Member

    Joined:
    Feb 14, 2007
    Posts:
    11
    Proactive, I mostly download installers/zipped files, and yes sometimes NOD used to take maybe a minute to scan large files, but I have left the computer alone for 20 minutes scanning a file of 70 megs and still nothing. It seems to be getting caught in a loop if I terminate nod32krn using task manager the download process completes. Ok so this is what I've tried any other suggestions greatly appreciated.

    un/re-installing Opera.
    un installing NOD/deleting folder/running reg cleaner/re-installing.
    restoring reg settings to what they where before TCP OPTIMIZER was run.
    turning off passive scanning in IMON.
    setting client compatability to efficent, then all to higher compatability.
    repairing Winsock and repairing IMON
    searching through services for conflicts

    This is a new problem no one has had this before?

    Thanks
     
  12. Proactive Services

    Proactive Services Registered Member

    Joined:
    Jan 10, 2006
    Posts:
    153
    Location:
    Petersfield, Hampshire, UK
    I'd say this isn't IMON, it's AMON scanning the file as it's being saved to disk.

    I don't have NOD32's AMON scanning self-extracting files, partly due to this. Of course, I scan the file manually once it's downloaded, and even if I didn't AMON would catch anything malicious that tried to execute.

    Try downloading Filemon, set the filter to only include nod32krn.exe and see if it makes progress through the file or if it is indeed getting stuck in a loop.
     
  13. Set

    Set Registered Member

    Joined:
    Feb 14, 2007
    Posts:
    11
    Proactive,
    I tried downloading the file with AMON(self-extracting files) excluded, hangs. I tried downloading the file with IMON(disabled) and AMON(self-extracting files) included. File downloads completely, but hangs when copying to destination directory.

    I also tried downloading the file IMON(disabled) and AMON(self-extracting files) excluded, same result as step 2. Looks like there is a problem with both AMON and IMON LOL.

    Here are the results of Filemon I dont know if you can make any sense out of it, but to me there does appear to be a loop involved. http://img214.imageshack.us/img214/3851/loopll6.jpg

    Thanks

    *off to look for my sledgehammer see if it can fix it.
     
  14. Proactive Services

    Proactive Services Registered Member

    Joined:
    Jan 10, 2006
    Posts:
    153
    Location:
    Petersfield, Hampshire, UK
    Have you tried disabling AMON* and seeing if that helps?

    Looking at the picture I would say that NOD32 is extracting each file and saving it to temp. Is there any chance you could save a couple of minutes of filemon logs and pm them to me? (to save cluttering the thread)

    *There are two parts to AMON that can be disabled, you can untick "AMON enabled" in it's page and also, to go further, go into Setup->Security->Allow manual stopping, then OK and "Stop" AMON.
     
  15. Proactive Services

    Proactive Services Registered Member

    Joined:
    Jan 10, 2006
    Posts:
    153
    Location:
    Petersfield, Hampshire, UK
    A snippet of the filemon log:
    As you can see the "Offset" is increasing, which is NOD32 reading through a file, rather than getting stuck.
     
  16. Set

    Set Registered Member

    Joined:
    Feb 14, 2007
    Posts:
    11
    Well,
    It seems it was just a matter of letting NOD work through it. It took 50minutes to scan this one particular file, I dunno what happened really, but now when I download a file its back to between 1-3 minutes depending on file size. So I'm happy!

    @Proactive:
    Professional, friendly computer support based in Hampshire, UK.
    Sure is! Thanks.

    @Others:
    Thanks to you.

    Well I wish I could contribute to this site but there are many people on here with computer skills far in advance of mine, however if you require a recipe or advice on a cooking technique, I'm your man! LOL.

    Mod you can close this one down, thanks!

    Regards Set.
     
Thread Status:
Not open for further replies.