Volume2.exe very slow with NOD32 V11

[coch 5]

Hi, I initially wrote about my issue in this thread here https://forum.eset.com/topic/13311-eset-1012311-and-new-v11-startup-behaviour/ but I now believe it's a different problem, specific to me, so here goes:

My issue is that my computer becomes extremely show, mouse very choppy (cursor stalls for several seconds, then allows me to move for about a second, then stalls for several seconds again, etc...) and this continues for about 30 seconds until NOD32 loads. This behavior stops a few seconds into the NOD32 splash screen, at which point I get normal control back of my computer, which is a very fast AMD Threadripper CPU, M.2 PCIe drive, 32 GB RAM, etc...

I found the issue to be caused by the Volume2 software utility that I use. I have it to start with Windows, and it appears to load concurrently with NOD32, and this is what makes my computer slow to a crawl for 30 seconds or so after login. Now:

• It is not due to loading concurrently: If I disable Volume2 from loading at startup, NOD32 loads very quickly and no slow down is experienced. If I manually launch Volume2 afterward, the computer becomes very slow for some time, just like if volume2 was starting with Windows.
• This did not occur with NOD32 v10, with the exact same version of Volume2, and no Volume2 configuration changes.
• This also does not occur on my Laptop (Dell 7779 2-in-1) which also have both NOV32 v11.0.144 and Volume2 (same version, same configuration) also set to Autostart with Windows. This suggests a hardware and/or driver component too in addition to a weird interaction between NOD32 and Volume2.
• Volume2 is not detected by NOD32, and a manual in depth scan finds nothing either.  I've been using volume2 for many years and have high confidence that it is not a malware or virus anyways.
• No issues after Volume2 is loaded, it is just loading it which is a big problem. Before V11 (and as stated above, even with V11 on my laptop) it loads almost instantly, being a small utility.

 

ESET, can you please download Volume2 and investigate, check why computer could become so slow when Volume2 is loading?

I'm not posting the link as I think this may be frowned upon in case I am wrong and there is some malicious code in Volume2, but you can easily find it. Google 'Volume2 irzyxa' there are links to it on Wordpress and Deviantart which appear to be the developer's (irzyxa) main homepages. Volume2 is a small utility, not widely known, that I use as a volume OSD, and also allows me to set hotkeys to quickly switch between audio output devices.

 

Thanks!

[peteyt 395]

6 hours ago, coch said:

Hi, I initially wrote about my issue in this thread here https://forum.eset.com/topic/13311-eset-1012311-and-new-v11-startup-behaviour/ but I now believe it's a different problem, specific to me, so here goes:

My issue is that my computer becomes extremely show, mouse very choppy (cursor stalls for several seconds, then allows me to move for about a second, then stalls for several seconds again, etc...) and this continues for about 30 seconds until NOD32 loads. This behavior stops a few seconds into the NOD32 splash screen, at which point I get normal control back of my computer, which is a very fast AMD Threadripper CPU, M.2 PCIe drive, 32 GB RAM, etc...

I found the issue to be caused by the Volume2 software utility that I use. I have it to start with Windows, and it appears to load concurrently with NOD32, and this is what makes my computer slow to a crawl for 30 seconds or so after login. Now:

• It is not due to loading concurrently: If I disable Volume2 from loading at startup, NOD32 loads very quickly and no slow down is experienced. If I manually launch Volume2 afterward, the computer becomes very slow for some time, just like if volume2 was starting with Windows.
• This did not occur with NOD32 v10, with the exact same version of Volume2, and no Volume2 configuration changes.
• This also does not occur on my Laptop (Dell 7779 2-in-1) which also have both NOV32 v11.0.144 and Volume2 (same version, same configuration) also set to Autostart with Windows. This suggests a hardware and/or driver component too in addition to a weird interaction between NOD32 and Volume2.
• Volume2 is not detected by NOD32, and a manual in depth scan finds nothing either.  I've been using volume2 for many years and have high confidence that it is not a malware or virus anyways.
• No issues after Volume2 is loaded, it is just loading it which is a big problem. Before V11 (and as stated above, even with V11 on my laptop) it loads almost instantly, being a small utility.

 

ESET, can you please download Volume2 and investigate, check why computer could become so slow when Volume2 is loading?

I'm not posting the link as I think this may be frowned upon in case I am wrong and there is some malicious code in Volume2, but you can easily find it. Google 'Volume2 irzyxa' there are links to it on Wordpress and Deviantart which appear to be the developer's (irzyxa) main homepages. Volume2 is a small utility, not widely known, that I use as a volume OSD, and also allows me to set hotkeys to quickly switch between audio output devices.

 

Thanks!

Hi it may also help to email eset and create a support ticket and possibly even contacting volume2

[Marcos 5,189]

I'd recommend narrowing down the issue to a particular protection feature and then contacting Customer care to assist you with further troubleshooting.

[itman 1,728]

On ‎11‎/‎1‎/‎2017 at 11:37 PM, coch said:

I found the issue to be caused by the Volume2 software utility that I use. I have it to start with Windows, and it appears to load concurrently with NOD32, and this is what makes my computer slow to a crawl for 30 seconds or so after login.

Have you tried setting this utility software to "delayed startup?" I assume it uses a service i.e. driver and can be configured as such using Windows Admin Tool.

Edited November 3, 2017 by itman

[coch 5]

@Marcos: Thanks for the feedback, I'll run more tests tonight ('m at work now). I already tried "Pause Protection" but it didn't help, so I suspect it may be HIPS perhaps; didn't test disabling HIPS yet because this requires a reboot and I didnÈ'T want to reboot at the time . I enabled the HIPS log and didn't see anything unusual though. But I'll check disabling HIPS later.

@itman: That's on my list. Will try tonight. It is currently auto-starting via the registry, HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

Putting it in HKEY_LOCAL_MACHINE instead doesn't change anything either.

I'll try to start it as a service instead, and set it to "Delayed Start" as you suggested. Not sure it will help though, because even if I completely disable auto-start, and run it myself manually even 5 minutes after login, the issue is still there.

It doesn't seem to be a driver, it is just a small executable with a few resources files. It does interact with the sound driver to some extent though, but as far as I can tell, it doesn't require it's own driver, as I can copy the folder where it is installed to a USB drive and the utility runs as expected this way on other computers (portable mode).

 

 

Anyway, I will investigate further tonight.

That

[coch 5]

Ok well nothing I tried helped. Even disabled all NOD32 components (Real-time protection, Web and email, HIPS, Anti-stealth, PUP, PUA, Suspicious apps, and AMSI) and the slow down/freeze still occurs.

Disabling autostart for volume2 and launching it manually later doesn't fix it either, it is very slow and the whole PC unusable for 30 seconds until the app loads fully, even if I launch Volume2 like 10 or 20 minutes after logon.

Interestingly if I exit Volume2 and launch it again, it loads instantly like it should, it's only the first launch after booting/login that is very slow.

[itman 1,728]

FYI - there are numerous issues with Win 10 CFU. Since you disabled all of NOD32's components and the issue persists, I would say your issue is with Win 10 CFU.

[coch 5]

1 hour ago, itman said:

FYI - there are numerous issues with Win 10 CFU. Since you disabled all of NOD32's components and the issue persists, I would say your issue is with Win 10 CFU.

Unfortunately, this isn't the explanation for me.

I have indeed experienced many issues with FCU (the worst being a ~ 1 minute lag opening any hyperlink) and I have returned to the previous Windows 10 build, waiting for FCU to mature before switching. I stopped using FCU about a week ago.

Plus, both my Desktop PC and my laptop are using the same version of Windows, same version of NOD32 and same version of Volume2, and I got no problem at all on my laptop. Thanks for your help, this is a difficult one to figure out. I don't see anything related to the problem in NOD32's logs or in the Windows Event log.

I'll investigate further, maybe process explorer or something similar would yield additional clues.

[itman 1,728]

26 minutes ago, coch said:

Plus, both my Desktop PC and my laptop are using the same version of Windows, same version of NOD32 and same version of Volume2, and I got no problem at all on my laptop.

I would uninstall Volume2 on the desktop. Reboot. Then reinstall it and see if fixes the issue.

[coch 5]

Hi, as an update, I no longer believe this has to do with NOD32 per se.

I think it is at most, a problematic interaction between NOD32 and Volume2, but it is also likely to be just Volume2 being the culprit.

There seems to be a lot of noise around Volume2 and BSOD/stability issues, especially with Windows 10 1709 "FCU" according to these posts https://answers.microsoft.com/en-us/windows/forum/windows_10-hardware/systemserviceexception-win32kfullsys/a84467d3-b7a7-44c7-98ea-c6f14271f17c?auth=1

(first mention of Volume2 issues on page 2, 13 November 2017, and it continues for the next several pages).

My issue is not with Windows 10 1709, I am on Win10 1703, and I'm positive I do not have this issue with NOD32 v10, with the same hardware, same drivers versions, same Windows version and same Volume2 version, but there is enough noise around Volume2 issues for me to make it the prime suspect now.

 

Thanks everyone for your feedback.