Good afternoon. I've found an annoying problem with Eset Smart Security (version 9.0.349.14): ever time that I start my pc and my nas is powered on, I have to wait some minutes before having the os ready to work. If I start it with the nas powered off, the os is immediately available. After a lot of test and analysis, I've found that the problem is located in the files added to the exclusion list: in the paths that I've excluded from scan there is a file located in a network folder in my nas (see attached file Exclusion_list.PNG) an this is causing the delay in the startup. I don't know why, but the ESET Service (ekrn.exe) try to access all the files and folders in the exclusion list to get some information, regardless to the fact that they should be excluded from analysis. The problem with network folders or files is related to the account used by Eset Service: Local Sytem account doesn't have any kind of permission to connect to the network. The only connection to the nas that it tries is the anonymous one, and obviously and, for security reasons, this is refused by the most of nas' configurations.
When the nas is powered off, all the network connections are immediatelly closed by the os and you need only few seconds to complete the startup of the service. When the nas is powered on the situation is totatlly different: every connection is opened by the os and you have to wait for a time out because it's refused by the nas. This cause a pause of some minutes before getting the os ready to be used, and the time depends on the number of files and on the structure of the excluded folder.
In fact the process ekrn.exe try to open every single component of the path a recursive way. In my example, the excluded path is \\nas1\SOFTWARE\Folder1\Folder2\Folder3\Folder4\file.txt and the process ekrn.exe try to connect to (in order):
\\nas1\SOFTWARE\Folder1\Folder2\Folder3\Folder4\file.txt \\nas1\SOFTWARE\Folder1\Folder2\Folder3\Folder4 \\nas1\SOFTWARE\Folder1\Folder2\Folder3 \\nas1\SOFTWARE\Folder1\Folder2 \\nas1\SOFTWARE\Folder1 \\nas1\SOFTWARE \\nas1
Obviously the system has to wait for a time out for each of the subfolders in the path: the deeper is your path, the longer you have to wait! You can find the examples of what's happening during a startup of my pc in both the situations (nas powered off and on) in the attached print screen of a procmon boot capture, together with the elapsed time. To complete the information, this behavior is not limited to network files or folder. During my tests with procmon , I've seen the same behavior with all the files or folders in the exclusion list. It's only with network related files or folder that the problem becomes visible. I've also tried to change the account of Eset Service from Local System to my account (that has connection rights on the nas) and it works. The problem with this configuration is the GUI (egui.exe) that refuses to start making the software impossible to be used. Is there any way to fix this problem? I really don't understand the reason why an excluded file should be accessed during startup. Is there any plan to modify this behavior? Thanks for your support. Alessandro
