Slow shutdown in XP, It is IMON. Help

Discussion in 'NOD32 version 2 Forum' started by Thorz, Jan 18, 2004.

Thread Status:
Not open for further replies.
  1. Thorz

    Thorz Registered Member

    Joined:
    Dec 29, 2003
    Posts:
    124
    Hello

    I have just installed XP pro from scratch. Updated everything using Windows Update (except Media Player 9 stuff, CD writer stuff, wireless fix that I don't need and Jurnal Viewer). I have installed NOD32 2 but my system takes more time than normal in the "Windows is shuting down" message when restarting for example. The system doesn't hang, but it is deffinitly been affected in some way by something. The only resident program that I have is NOD32. I am on the default options. I can see the diskette scanning when closing windows, but this must not produce a slowdown problem no?

    Have you noticed something like this? Any help is apreciated.apreciated
     
  2. Thorz

    Thorz Registered Member

    Joined:
    Dec 29, 2003
    Posts:
    124
    Re:Slow shuttdown in XP, It is IMON. Help

    The problem resides in IMON. I have done several tests and I can confirm that when I disable IMON the problem disapears.
    Have tested with IMON disabled and AMON enabled and the problem doesn't show. It is only when IMON is enabled (with or without AMON)

    I am installing NOD32 V2 XP downloaded directly from www.nod32.com servers, I have downloaded the file yesterday then I asume that this one has all the updates of any previous fix allready.

    When IMON is enabled the "Windows is shutting down" messages takes 15 seconds to disapear and restart the machine. With IMON disabled the same message takes only 2 seconds. We are speaking about big difference here. It is very annoying to me due that I am restarting the machine quite often, specially now that I am installing all the software.

    I am a new customer of NOD32. I have migrated from NAV2004 in search for a good light AV that didn't interfere with the performance of my machine. This is definitly a dark spot that I was not expecting to find. Even NAV 2004 that is a resource eater has never slow down my XP shuttdon process.

    My setup:

    Asus P4C800 Deluxe (Canterwood)
    P4 3Ghx Hypherthreading enabled.
    1GB DDR400 RAM
    ATI 9800PRO with Catalyst 3.10
    Sound Blaster Audigy 2 only with drivers.
    Network card: 3Com Gigabit LOM 3C940 (integrated in the motherboard).
    Other network cards:
    3Com Etherlink 10/100 3C905C-TX (disabled)
    Sun JAVA plugin.
    XP Pro SP1a just installed.
    The only software that is running beside NOD32 is:
    Executive Software Undelete Professional 4.0.096
    ATI Control Center (installed by the official Cat. drivers)
    Nothing else.

    Please give me a hand here. I really apreciate it. Thank you very much.
     
  3. Kentish

    Kentish Registered Member

    Joined:
    Jun 29, 2003
    Posts:
    92
    Location:
    Kent, England, UK
    Re:Slow shuttdown in XP, It is IMON. Help

    My XP home system also takes a while to shut down, and infact has never shut down in 2 secs even before I put Nod on (which is in the last week).

    I have to say I find XP very frustrating like that, but I know its XP as my system runs with very little extra running in the background.
    Nod definately has made no difference to the shutdown speed of my pc even with the Imon and Amon allowed.

    Cheers
     
  4. visitor

    visitor Guest

    Re:Slow shuttdown in XP, It is IMON. Help

    When you shut down Windows XP, the OS tries its best to make sure that all
    services (they help run things like graphics, printers etc) are shut down.
    But there are times when they don't close, thus Windows XP tries to give
    it the chance to shut down itself. This amount of time that windows waits
    for the service to close is stored in the system registry.
    If you modify this setting, then windows will shut down the service earlier. To modify the setting, follow the directions below:
    Start Regedit.
    Navigate to HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control.
    Click on the "Control" Folder.
    Select "WaitToKillServiceTimeout"
    Right click on it and select Modify.
    Set it to a value lower than 2000, say 1000 as a test.
     
  5. ronjor

    ronjor Global Moderator

    Joined:
    Jul 21, 2003
    Posts:
    57,721
    Location:
    Texas
    Re:Slow shuttdown in XP, It is IMON. Help

    Thanks for this tip. The shutdown time on my XP machine was unbearable.
    I don't suppose there is any harm in shutting down faster than the default setting, is there?
    This slow shutdown issue is my only complaint about Nod32.
     
  6. controler

    controler Guest

    Re:Slow shuttdown in XP, It is IMON. Help

    I don't know for sure but was guessing it is part of NOD's shutdown protection. In my case, IMON stopped responding alltogether so shutting it down earlier won't hurt.
    Windows give it X amount of time and if it isn't responding in that amount of time, will shut it down anyway.
    Not sure when this issue will be fixed.

    con
     
  7. PnP

    PnP Registered Member

    Joined:
    Jun 12, 2003
    Posts:
    194
    Location:
    Italy
    Re:Slow shuttdown in XP, It is IMON. Help

    IMON is very horrible.... Now my PC is too slow on shutdown, start and navigated web pages... I hope that the problem is fixed soon... or for me isn't possible to use NOD on my PC...
     
  8. controler

    controler Guest

    Re:Slow shuttdown in XP, It is IMON. Help

    I am using KAv 5.0 Beta till it gets cleared up lol


    con
     
  9. Thorz

    Thorz Registered Member

    Joined:
    Dec 29, 2003
    Posts:
    124
    When I speak about 2 seconds, it is after the message "Windows is shutting down" appears, this is the last stage of the shut down process on XP. Before this you can read other messages in the same screen like "saving your settings", "logging off" and I don't remember if any other. My system can take up to 10 seconds to shut down in normal circumstances when IMON is disabled, counting from the pushing of the "restart" or "shut down" button in the "Turn off Computer" screen. Having IMON enabled adds around 15 seconds to this process.

    @controler:
    Shutting IMON down earlier is not an elegant option. From all the AV programs that I have evaluated before buying NOD32 none of them were needing this kind of trick for having a fast XP shutdown process (KAV and NAV 2004)

    @Guest:
    I have had this kind of tweak before enabled, via "Cacheman" tweaks. I have not enabled this yet (I am just installing all programs again). Maybe this will work, but making windows kill IMON doesn't seem to me like a nice option either. IMON should manage the shut down process OK without you needing to force the service termination with this kind of tweak.

    As there is several people having the same issue, giving a positive confirmation of the problem I think ESET should give us some kind of answer about the situation and helping us with a fix for it. I have already emailed them with the report, and I expect to see an answer tomorrow in this forum. My experience with ESET is that they have always been very responsive about NOD32 problems before. I don't expect that to change.
     
  10. visitor

    visitor Guest

    Re:Slow shuttdown in XP, It is IMON. Help

     
  11. Thorz

    Thorz Registered Member

    Joined:
    Dec 29, 2003
    Posts:
    124
    Re:Slow shuttdown in XP, It is IMON. Help

    Nope, I have a Radeon 9800 PRO with last Catalyst 3.10 (as written in my 2nd. post up), and after all the tests that I have done there is no doubt that IMON is the culprit here.
    I still think that IMON should not produce such delay in shutdown. As I said before, the other AV programs that I tried didn't produce such delays with all their scanners enabled.
     
  12. visitor

    visitor Guest

    Re:Slow shuttdown in XP, It is IMON. Help

    coz in writting areply I only see the 3 last posts.
    so, I'm sorry for not reading closely
    my system iis very close to yours but not HT
    for me shutting down is normal with or without IMON
    I suggeat you post hijack this log here
    http://www.wilderssecurity.com/index.php?board=17
     
  13. Thorz

    Thorz Registered Member

    Joined:
    Dec 29, 2003
    Posts:
    124
    Re:Slow shuttdown in XP, It is IMON. Help

    I will update this thread: Updating to last engine 2.000.9 doesn't solve the problem. I am in the process of finding the cause still. It can be maybe another program that is conflicting with NOD32.
    I will post the hijack logs in the forum, but I have checked them and they look normall to me. No extrange spyware or other things here.
     
  14. Vuejade

    Vuejade Registered Member

    Joined:
    Jan 23, 2004
    Posts:
    15
    Location:
    USA
    Re:Slow shuttdown in XP, It is IMON. Help

    My system (XP) was also running slow until I deleted this "Update". I deleted and did not re-install Q811493 and have not had any problems since and my system is running as fast as ever.


    Hope this helps!
     
  15. Hazeleyze

    Hazeleyze Guest

  16. Vuejade

    Vuejade Registered Member

    Joined:
    Jan 23, 2004
    Posts:
    15
    Location:
    USA
    Re:Slow shuttdown in XP, It is IMON. Help

    This is exactly my point. Microsoft did release a revised Q811493 but if Thorz has the older version it may be slowing down performance.
     
  17. Thorz

    Thorz Registered Member

    Joined:
    Dec 29, 2003
    Posts:
    124
    This is what I have done:

    I have installed Windows XP again and right after installing it I made a Ghost image.

    1. I have installed NOD32 without installing absolutely anything else. NOD32 was the 1st. thing installed in the machine. I rebooted and let NOD32 update itself. Result: The same 15-20 seconds in the "windows is shutting down" message. Turned off IMON: Normal time (3-5 seconds) on "windows is shutting down"

    2. I restored from the Ghost image and having Windows clean I installed all the drivers and all the Windows updates but these that I don't need:
    - Windows Media Player 9 Series (Windows XP)
    - Media Player 9 codecs (KB810243)
    - Microsoft Windows Journal Viewer (Windows XP)
    - Update for Windows XP HighMAT Support in CD Writing Wizard
    - Wi-Fi Protected Access (WPA)

    I have installed everything else (I suppose that Microsoft has all the updates corrected in its database already and there is no need to worry about installing old updates that were flawed (like Q811493).
    After having all this loaded I installed NOD32 again. Same result here.

    3. I installed NOD32 (V.2.0 off course) in my laptop that was reinstalled from scratch some days ago. And the same situation was present there also!

    I don't know m8s, this is very strange. How can the program present the same problem in 2 machines totally different and having tested with Windows totally clean? I have to say that NOD32 DOESN'T make Windows slow at all. All the activity inside Windows is perfectly fine. It is the shut down process I repeat. It has to be a problem with IMON itself. Do you like to know what convinced me about this? I loaded the clean Ghost image one more time and installed NAV 2004 pro that I own too, and surprise yourselves: No delays at all in the shutdown process.

    I don't have an AMD machine for testing. I have seen that there is people that has reported normal shut down times here. I don't know if they are on Intel or AMD machines. This are the configurations of the 2 machines where I have tested and that have presented the problem:

    Desktop:
    Asus P4C800 Deluxe latest BIOS (Canterwood)
    Intel P4 3Ghz not overclocked. HT ON.
    1GB RAM (Corsair DDR400)
    ATI 9800 PRO
    File system: NTFS
    Sound Blaster Audigy 2
    Network card: 3Com Gigabit LOM (integrated)

    Laptop:
    Acer Travelmate 630. SIS Chipset
    Intel P4 1.6Ghz. No HT.
    256MB RAM (SDR 133)
    NVidia Geforce2 GO 100
    File system: NTFS
    Integrated SIS sound card
    Network card: Realtek (integrated)

    I have been in contact all the time with ESET support and I am sending some special IMON logs to them. If you like to help make this small test:

    0. I assume that you are in XP, not 9x, and that you have not placed any tweaks for killing services in shut down (like the one described in this thread, Cacheman tweak or other).
    1. Take a stopwatch
    2. Check that all your NOD32 components are enabled (check IMON)
    3. Restart (or turn off) your machine
    4. Wait until you see the message "Windows is shutting down". (There are other messages before this but to be accurate in the test discard them).
    5. Immediately after you see this message start the watch.
    6. Stop the watch when your machine is totally off or when it restarts.

    Take note of this time.

    7. Go to NOD32 control panel and disable IMON totally (stop it and take out the check mark from "Load IMON at startup).
    8. Reboot (it is needed because IMON is still active.
    9. Let Windows load again and after it is completely loaded with IMON disabled proceed to Restart or Turn off the machine.
    10. Follow the procedure up again and take note of the time. This time it must be much lower than the first time.

    This are my results, verified several times:

    With IMON: 15-20 seconds (consistent)
    Without IMON: 3-5 seconds (consistent)

    Note: For you that are using tweaks for killing slow services on shut down, take a look at your Event Viewer. In my case when i had this tweak ON my event viewer was populated of yellow warnings. One for every shut down after the tweak was in place. I am pretty sure that they were coming from IMON that was been killed before it could finish normally.

    I thank in advance to the ones that like to help running the tests.
     
  18. Vuejade

    Vuejade Registered Member

    Joined:
    Jan 23, 2004
    Posts:
    15
    Location:
    USA
    I don't know if this will work, but why not try unchecking "scan boot sectors on shutdown" in the AMON setup and see if that has any affect?


     
  19. ronjor

    ronjor Global Moderator

    Joined:
    Jul 21, 2003
    Posts:
    57,721
    Location:
    Texas
    I have the same slowdown on shut down on my XP Home machine.
    I tried disabling Imon and Thorz is correct, it eliminates the slow shut down.
    Come on Eset, fix this aggravation! :)
     
  20. Thorz

    Thorz Registered Member

    Joined:
    Dec 29, 2003
    Posts:
    124
    @Vuejade: As I have told before, the problem is IMON. Disabling IMON erases also the problem. The status of AMON is not an issue here. I have tested with IMON enabled and AMON totally disabled and the problem was still present. Thanks for the advice anyway m8.

    @ronjor: Thanks my friend. As I was already suspecting it means that the problem is not from my side and there are other machines experimenting it also. Can you be so kind and post your system information for the thread? It is possible that we can find the common points if there are others that post the info here.
    The problem maybe doesn't sound too bad, but believe me, 10-15 seconds of delay difference every time that you turn off or restart your machine becomes really annoying after many times.

    Thank you.
     
  21. Thorz

    Thorz Registered Member

    Joined:
    Dec 29, 2003
    Posts:
    124
    It looks that we are not the only ones. Here is another thread about the slow down on shut down. This one is very populated:

    http://www.wilderssecurity.com/showthread.php?t=10605;start=0

    I just hope that ESET can give us a solution to this problem. NOD32 is superb IMO, but I feel really sad that it is causing this situation. I have just payed a one year licence and I am going to have to uninstall the program until a fix is in place, that is a shame :(
     
  22. ronjor

    ronjor Global Moderator

    Joined:
    Jul 21, 2003
    Posts:
    57,721
    Location:
    Texas
    Here you go Thorz.

    OS Name   Microsoft Windows XP Home Edition
    Version   5.1.2600 Service Pack 1 Build 2600
    OS Manufacturer   Microsoft Corporation
    System Name   MONEYPIT2003
    System Manufacturer   VIA
    System Model   7VTXE+
    System Type   X86-based PC
    Processor   x86 Family 6 Model 6 Stepping 2 AuthenticAMD ~1673 Mhz
    BIOS Version/Date   American Megatrends Inc. 07.00T, 6/28/2002
    SMBIOS Version   2.3
    Windows Directory   C:\WINDOWS
    System Directory   C:\WINDOWS\System32
    Boot Device   \Device\HarddiskVolume1
    Locale   United States
    Hardware Abstraction Layer   Version = "5.1.2600.1106 (xpsp1.020828-1920)"
    User Name   MONEYPIT2003\Ron
    Time Zone   Central Standard Time
    Total Physical Memory   512.00 MB
    Available Physical Memory   331.66 MB
    Total Virtual Memory   1.72 GB
    Available Virtual Memory   1.43 GB
    Page File Space   1.22 GB
    Page File   C:\pagefile.sys


    I am behind a Linksys router using adsl. I use Proximitron, Kerio Personal Firewall 2.15, a program called HistoryKill, and Cookie Pal. I am using Firebird 0.7. I also use Calypso for an email program.

    All critical Microsoft updates are applied as well as the latest incarnation of Q811493.

    I do not have this problem with any other antivirus programs as far as shutdown. However, no other antivirus program I've used can match Nod32 for sheer speed. It is by far the best running antivirus program available.

    I don't leave my computer on all the time. I also try a lot of shareware. That's when it became evident that my shutdown times had increased.

    Other than the shutdown time, Nod32 is the far and away the best running antivirus out there. I tried them all. Everyone of them.
     
  23. Thorz

    Thorz Registered Member

    Joined:
    Dec 29, 2003
    Posts:
    124
    Thanks for the info ronjor. I agree with you that NOD32 is the best AV engine. I love it also. But the shut down problems sucks man. I am also behind a router here (SMC) but not firewall has been enabled yet. I see that you are on AMD, then this is not hardware related as I have tested it in 2 very different chipsets (Intek, SIS) and you have VIA+AMD.
    I really like to see a comment from ESET about this. This is a real issue here.
     
  24. Thorz

    Thorz Registered Member

    Joined:
    Dec 29, 2003
    Posts:
    124
    I have to report sadly that after several days of have sent the IMON logs that I was asked to ESET I have not received any answer, or even see any comments from support in this thread.
    Well, support was very responsive until now. It appear that they are clueless about this situation.
     
  25. Buster

    Buster Registered Member

    Joined:
    Jun 12, 2003
    Posts:
    65
    Location:
    Oz
    Hi Thorz,

    I agree with your diagnosis of IMON causing the slow shutdown problem as I am having exactly the same problem on my pc, shutdown times comparable to yours.

    As if that isn't enough, I can really put the icing on the cake...after I disable IMON and restart the machine the following message is displayed at the XP logon screen.

    The instruction at "0x78001841" referenced memory at "0x783a4468". The memory could not be "read".

    Click on OK to terminate the program.
    Click on CAncel to debut the program.

    Then for extra fun, after pressing OK...

    The system cannot log you on due to the following error.
    The handle is invalid.

    If on the off chance I do succeed and make it to the desktop, there's more: Check out the error message pics attached.

    PC specs:

    NOD32 Antivirus System information
    Virus signature database version:   1.615 (20040202)
    Dated:   Monday, 2 February 2004
    Virus signature database build:   4196

    Information on other scanner support parts
    Advanced heuristics module version:   1.005 (20031222)
    Advanced heuristics module build:   1047
    Internet filter version:   1.001 (20031104)
    Internet filter build:   1012
    Archive support module version:   1.011 (2004012:cool:
    Archive support module build version:   1083

    Information on installed components
    NOD32 For Windows NT/2000/XP/2003 - Base
    Version:   2.000.9
    NOD32 For Windows NT/2000/XP/2003 - Internet support
    Version:   2.000.8
    NOD32 for Windows NT/2000/XP/2003 - Standard component
    Version:   2.000.9

    Operating system information
    Platform:   Windows XP
    Version:   5.1.2600 Service Pack 1
    Version of common control components:   5.82.2800
    RAM:   512 MB
    Processor:   Intel(R) Pentium(R) 4 CPU 2.80GHz (2800 MHz)

    As if this isn't enough, the NT Authority system then proceeds to shut the pc down...no, it's not a virus because after I disable IMON and restart the pc it runs perfect...no crashes, no error messages, runs for days without a restart. I reenable IMON and all the problems are back after restart, instantly! There is no doubt this is IMON related.

    This is a clean install of XP, with all the latest Windows updates loaded.

    Would any of the Eset mods care to shed some light on this?
    Anyone else with similar errors?

    Just on a side note, I won't be switching AVs, NOD is still the best...for the moment I'll just run it without enabling IMON, but please Eset how about a fix!

    Rgds

    Buster
     

    Attached Files:

Thread Status:
Not open for further replies.