Still huge memory leak on W7 x64

Discussion in 'Other ESET Home Products Beta' started by tomba4, Jan 20, 2010.

Thread Status:
Not open for further replies.
  1. tomba4

    tomba4 Registered Member

    Joined:
    Jan 20, 2010
    Posts:
    3
    Hi,
    I tried the beta hoping that this issue:

    http://www.sevenforums.com/network-...cking-while-downloading-large-data-files.html

    may be resolved, but I guess I'm out of luck. I have Smart Security installed and when using Internet Download Manager my OS stays up for about 10 GB of download - after that, the system runs out of memory (I have 4 GiB of RAM) and eventually crashes (BSOD).

    Has anyone found a solution for that? I don't want to uninstall ESET, my license is valid up to December :/
     
  2. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    We all are still anticipating a hotfix to the bug from Microsoft.
     
  3. stratoc

    stratoc Guest

    why dont kaspersky, vipre and mse have the problem? i can assure you on this pc it's only on smart?
     
  4. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    Are you sure that the products you've mentioned take advantage of WFP introduced in Windows Vista? Probably not or they would suffer the same problem.
     
  5. stratoc

    stratoc Guest

    ah! i see
     
  6. bubu83

    bubu83 Registered Member

    Joined:
    Jun 11, 2009
    Posts:
    21
    bug exists since win vista and still not fixed: i doubt it will fixed in the future.

    eset will wait forever for nothing, why don't they change the code that generate the leaks ?

    and for other products, i dont see they have this leak, so......
     
  7. stratoc

    stratoc Guest

    it only happens here on ess and not eav? any reason for that?
     
  8. bubu83

    bubu83 Registered Member

    Joined:
    Jun 11, 2009
    Posts:
    21
    it happens with the antivirus scan http module, so also with eav.
     
  9. xxJackxx

    xxJackxx Registered Member

    Joined:
    Oct 23, 2008
    Posts:
    4,050
    Location:
    USA
    Exactly as Marcos stated, this is a Microsoft problem. I have seen it discussed on the TechNet forums and it is a known problem with WFP. They (Microsoft) need to fix it and all of the complaining here isn't going to change that.
     
  10. Hagla007

    Hagla007 Registered Member

    Joined:
    Sep 13, 2009
    Posts:
    49
    Very strange. I use Windows 7 64-bit, and my Eset 4.2 is working just fine :D I haven't experienced memory leak or anything trouble-related during my 2 years as a Eset costumer.

    Best regards,

    Hagla007
     
  11. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    The screenshots in the aforementioned forum don't show a high memory usage for ekrn.exe. If disabling HTTP checking helps, it must be the memory leak caused by a bug in WFP.
     
  12. Searinox

    Searinox Registered Member

    Joined:
    Oct 27, 2007
    Posts:
    21
    Installed the beta at the advice of another thread where I was asking how to stop/restart ekrn.exe every 2 weeks as a way to keep the leak within some limits. The same thing happens, the system has been running for 4 days and ram usage is up from 47MB at startup to 87MB. With a steady climb of some 10MB a day. The farthest I have gotten has been 143MB after 2 weeks. There is possibly, no limit.

    Setting HTTP checking to disabled for the duration of the test did not help.

    I think ESET should actually take this one seriously and check it out on a system to see if they can reproduce it. There are many antivirus programs out there with HTTP checking and none of them exhibit this behaveiour that the "windows bug" is causing, surely ESET can work around it.

    EDIT:

    I have installed the 4.0 again and effectively RIPPED EPFWWFPR OUT OF THE PRODUCT. Thanks to ESET's highly modular design, deleting the proper files, registry keys, and uninstalling epfwwfpr from device manager resulted in a 100% working antivirus that no longer has the network component, it's not even in the advanced options anymore. It is currently using 44MB RAM, I will post later on how it's going.
     
    Last edited: Jan 26, 2010
  13. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    If so, I'd strongly advise that you generate a complete or at least kernel memory dump from that state and convey it to ESET for perusal (or better let me know here). Instructions for generating dumps are available here.
     
  14. tomba4

    tomba4 Registered Member

    Joined:
    Jan 20, 2010
    Posts:
    3
    Would a minidump of OOM BSOD be of any use? I have one. I'll also create a kernel dump next time my OS is close to running out of mem...

    EDIT: all right, I don't know how that happened because I was sure I tried that before, but it seems like disabling HTTP checking indeed helped in my case. That's the kind of workaround I was hoping for, so thank you for the suggestion!
     
    Last edited: Jan 27, 2010
  15. bubu83

    bubu83 Registered Member

    Joined:
    Jun 11, 2009
    Posts:
    21
    We all know that, but why doesn't eset ask Microsoft to fix it?

    Obviously Microsoft listen more a company like ESET and not the eset users that complain.

    And since this bug is known by a long time, why Eset doesn't find a solution , at least, to avoid the leak?

    just asking, i'm not here to create trolling words.
     
  16. agoretsky

    agoretsky Eset Staff Account

    Joined:
    Apr 4, 2006
    Posts:
    4,032
    Location:
    California
    Hello,

    Many of ESET's employees are discussing the issue with many of Microsoft's employees, bubu83. It could be that the solution is particularly complex to implement or has other dependencies or unexpected issues associated with it.


    Regards,

    Aryeh Goretsky
     
  17. xxJackxx

    xxJackxx Registered Member

    Joined:
    Oct 23, 2008
    Posts:
    4,050
    Location:
    USA
    I agree, but Microsoft does things on their own timeline. If it's not a security hole, they may take a good long time about it. Someone would have to make a big embarrassing public stink about to get them to give it priority.
     
  18. tomba4

    tomba4 Registered Member

    Joined:
    Jan 20, 2010
    Posts:
    3
    I think it would be a good idea to somehow inform users about the problem in the Smart Security configuration. Maybe a warning when a user tries to enable HTTP checking on affected OS without a hotfix (when there's one) installed? I think it would be beneficial for ESET, since as you can see when problems appear after SS is installed, people blame ESET, not Microsoft.
     
  19. Searinox

    Searinox Registered Member

    Joined:
    Oct 27, 2007
    Posts:
    21
    I will probably generate one later on. I have 7MB of RAM and a memory dump will take forever not to mention I have no idea how to submit something of that size to ESET. I just want to report that in the last 12 hours ekrn climbed 3.5MB so the behaveior seems to STILL be there. This may be of some help to the ESET developers since the firewall driver is NOWHERE on the machine right now and thus not loaded into ESET yet the activity continues.
     
  20. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    A difference of 3,5 MB in memory consumption is negligible and is normal. If it grows significantly (over 80-100 MB), let me know and I'll PM you a location to upload the dump (perhaps a process dump that can be created from within the task manager would be enough).
     
  21. Searinox

    Searinox Registered Member

    Joined:
    Oct 27, 2007
    Posts:
    21
    Then I'm afraid you will have to wait for a week until ekrn has grown considerably in size and I can provide a meaningful dump.
     
  22. bubu83

    bubu83 Registered Member

    Joined:
    Jun 11, 2009
    Posts:
    21
    i dont understand if you are speaking about the leak created by the faulty bug "eset http scan / microsoft win7/vista ".
    if yes, just enable hhtp and do a huge download and watch in the performance tab of task manager the kernel memory NonPaged raise to the limit!
    to resolve Untick "enable http checking" in the eset configuration. then you will see a orange icon in the protection status window.

    Then just use a good internet browser that prevent you to download viruses and brothers until Eset/Microsoft resolve this annoying bug.
     
  23. Searinox

    Searinox Registered Member

    Joined:
    Oct 27, 2007
    Posts:
    21
    That isn't happening. What's happening is that ekrn keeps climbing about 5 MB a day regardless of what I do and it has no limit, it will go up and up for as long as it's running.
     
  24. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    Re. a fix for the issue with WFP, a guy from MS has recently posted the following in the MSDN forum:

     
  25. Searinox

    Searinox Registered Member

    Joined:
    Oct 27, 2007
    Posts:
    21
    Is that a release on microsoft's site or windows update? Either way I've seen AV installers include KB files, mainly C++ redistributables, ESET could include their update in the antivirus installer right?
     
Thread Status:
Not open for further replies.