Problems with NOD32 v4.0.417.0 AntiVirus

Discussion in 'ESET NOD32 Antivirus' started by e36, Apr 15, 2009.

Thread Status:
Not open for further replies.
  1. e36

    e36 Registered Member

    Joined:
    Apr 13, 2004
    Posts:
    80
    Ever since installing v4.0.417.0 AV 10 days ago (updated from V3), I’ve been experiencing a problem. After the PC is idle for about 30 minutes or more, and I then click on something, I get the Vista busy wheel, and whatever I clicked on, I get no response except the Vista busy wheel.

    At this point the PC is completely locked-up, no response from Ctrl-Alt-Del, and the only way out is pressing and holding the Power button until the PC shuts down. I’m not sure if it matters, but I almost always have Microsoft Outlook running.

    First off, the PC has never had any other AV installed. The PC has run NOD32 v2.7, V3 and now v4. I uninstalled V3 from the Windows Control Panel) before installing V4. No other security software is installed other than Windows Defender. V4 was installed using all the default settings, and using the ‘detect possible malicious software’ (can’t remember the actual name here) option. No other new software has been added.

    Here are the specs:

    Dell E520, Core 2 Duo 2.13GHz, 2Mb RAM
    ATI X1300 256Mb Video
    Vista Home Premium SP1 (all updates)
    Logitech MX3200 Wireless keyboard and mouse
    MS Office 2007 (all updates)
    NOD32 v4.0.417.0 AV (English) with latest virus defs.
     
  2. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    Do you use default settings? Could you please create a complete or kernel memory dump per the instructions here and convey it to ESET for perusal along with a log from SysInspector?
     
  3. e36

    e36 Registered Member

    Joined:
    Apr 13, 2004
    Posts:
    80
    V4 was installed using all the default settings (and yes I use all the default settings), and using the ‘detect possible malicious software’ (can’t remember the actual name here) option.

    I will follow your instructions for the kernal memory dump when I get home from work later today.

    Thanks!
     
    Last edited: Apr 15, 2009
  4. Nerimash

    Nerimash Registered Member

    Joined:
    Apr 14, 2009
    Posts:
    86
    Location:
    Ukraine
    "Unwanted sowftware detection" as far as i know.
     
  5. Mister Natural

    Mister Natural Registered Member

    Joined:
    May 10, 2007
    Posts:
    225
    Location:
    3rd density St. Louis
    How big is your outlook.pst file? Do you have auto archive enabled?

    The two options are "potentially unsafe" and "potentially unwanted".
     
  6. e36

    e36 Registered Member

    Joined:
    Apr 13, 2004
    Posts:
    80
    Yes I have Outlook Auto Archive enabled and use it quite extensively (on multiple folders).

    I'm not at the PC right now so I can't look at the file size.


    Can you provide more info or a workaround?
     
  7. Mister Natural

    Mister Natural Registered Member

    Joined:
    May 10, 2007
    Posts:
    225
    Location:
    3rd density St. Louis
    I was just clarifying the two options available for detection. I don't believe enabling/disabling either would have any affect on the outlook issue.

    All I can suggest is playing with the email/outlook settings and maybe even disabling integration in outlook which basically creates a button on the toolbar in outlook.
     
  8. e36

    e36 Registered Member

    Joined:
    Apr 13, 2004
    Posts:
    80
    Exactly what are these "two options" you keep referring to?
     
  9. Mister Natural

    Mister Natural Registered Member

    Joined:
    May 10, 2007
    Posts:
    225
    Location:
    3rd density St. Louis
    If you go into the advanced options on each of the following options: Antivirus and antispyware, realtime file system protection, email protection, web access protection. You will see a button labeled "setup" on each of those options.

    After clicking setup click on the "options" tree and you see where you can enable/disable detection on potentially unsafe and potentially unwanted applications.
     
  10. e36

    e36 Registered Member

    Joined:
    Apr 13, 2004
    Posts:
    80
    Got-it.

    I'm still going to follow up with Marcos and a kernal memory dump with a SysInspector log later today.
     
  11. Mister Natural

    Mister Natural Registered Member

    Joined:
    May 10, 2007
    Posts:
    225
    Location:
    3rd density St. Louis
    Definitely do that and if you determine the size of the file let us know.
     
  12. e36

    e36 Registered Member

    Joined:
    Apr 13, 2004
    Posts:
    80
    Need some help.

    1) Can't upload XML SysInspector file. Upload tool here says it's an illegal format (gif, jpg, log, png, txt). The same will apply to the MEMORY.DMP file when I find it.

    2) Can't locate the %SystemRoot%\MEMORY.DMP kernel mem dump file in c:\windows. Is it a hidden file? According to my settings, it should have been created automatically when the system last crashed.

    3) Can't locate the .pst file either.
     
  13. e36

    e36 Registered Member

    Joined:
    Apr 13, 2004
    Posts:
    80
    Ant help?
     
  14. Mister Natural

    Mister Natural Registered Member

    Joined:
    May 10, 2007
    Posts:
    225
    Location:
    3rd density St. Louis
    When searching for the files choose the advanced option and enable search on hidden and system files.

    Search for *.dmp and *.pst

    Not sure about the upload problem. What program are you using to upload?
     
  15. e36

    e36 Registered Member

    Joined:
    Apr 13, 2004
    Posts:
    80

    I know how to do this in XP, but I have Vista. How is that done in Vista?



    The Wilders upload tool here, for uploading attachments.
     
  16. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    1, do you use a PS2 keyboard? Manual dumps cannot be created using a USB keyboard.

    2, do not upload your configuration here as it may contain sensitive information. I'd recommend attaching it to the dump when you manage to create one.
     
  17. e36

    e36 Registered Member

    Joined:
    Apr 13, 2004
    Posts:
    80
    1)Keyboard is USB. I was assuming (from my CP settings) a dump would be created automatically when the system crashes.

    2)I'm confused. Attach it to the dump? And then what? How do I get the file(s) to you?

    BTW, I've determined than when MS Outlook is closed, the lock-up problem does not occur.
     
    Last edited: Apr 16, 2009
  18. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    You wrote that the system locked up, not that BSOD occured. Right? In such case, your system didn't actually crash so a dump was not created. However, you should be able to generate a dump manually by following the instructions in the KB article I refered to (note that it can be done only using a PS2 keyboard).

    When a dump is created, compress it with WinRAR/ZIP and you can also add the ESI log to the archive. If you don't have an ftp account at your disposal, let me know and I'll provide you access to our ftp.
     
  19. e36

    e36 Registered Member

    Joined:
    Apr 13, 2004
    Posts:
    80
    Hey Marcos, thanks, but in-order for me to accomplish this task I would have to give-up my real life and become an ESET tester.

    I also hope you noticed I found the lock-up only occurs when MS Outlook (2007) is open.

    Here's what I'm going to do. I'm submitting my problem to ESET Support and hope they can resolve it.

    If not, I will downgrade to NOD32 AV version 3 and live with the fact that v4 needs more time in development before I will be using it again.

    Thanks again all,
    Steve
     
  20. e36

    e36 Registered Member

    Joined:
    Apr 13, 2004
    Posts:
    80
    Just a follow-up for informational purposes. I downgraded to NOD32 AV version 3 after finding out my lock-ups (after some idle time) were occurring even with Outlook closed.
     
  21. nzmc56

    nzmc56 Registered Member

    Joined:
    Nov 30, 2008
    Posts:
    2
    Anyone know if 4.0.424 fixed this? I was having the similar issues getting the "ring of death" and nothing opening when clicked. Note that I use thunderbird, not outlook. 4.0.417 seemed to start the problems.
     
  22. Isurus

    Isurus Registered Member

    Joined:
    Apr 9, 2008
    Posts:
    3
    I had the same problem on my laptop with both 4.0.314 and 4.0.417, until I unchecked "computer shutdown" and "network drives" under "Advanced Setup - Real-time file system protection". This seems to have worked for me.
     
Thread Status:
Not open for further replies.