CPU Usage ekrn.exe spikes and stays there

[sabreene 0]

I've just installed eset again after using a different antivirus for a few years. I remembered it as being very unobtrusive, but I'm having some issues with the CPU usage of the ekrn.exe. 

For some reason the ekrn.exe will sometimes use a high amount of CPU (from 25%-55%). I haven't determined exactly what will cause the spikes, but it seems to do it most often when I play any sort of MMO game. Once the CPU goes high, it will only go higher, and will never come back down -- not even if I pause all antivirus activity for 10 minutes/next reboot.

The only thing the sets it back is actually restarting the computer. But once it goes high for something again, it takes another reboot to send it back to normal.

I've tried running it on game mode, and it helped a little, but still if it gets to 25%, then it's going to stay there whether or not the game is running, the antivirus is running, or what I do with the computer.

I'm running Windows 7 64 bit, and have it on an SSD drive. However, most the games are installed on a different drive (regular hard drive, not SSD). 

Thanks for any help solving this.

[Marcos 5,070]

Does it make a difference if you play the game with protection temporarily paused?

[sabreene 0]

No, nothing makes a difference in pausing it or in turning any aspect of it off. Once the CPU usage is high it stays there until the computer is restarted no matter what I turn off.  It got stuck at 95% three times (once while using a 3d program for my work), so it's not just the game, sigh. It seems that If some other program makes it spike up, it stays there also.

I uninstalled for a few days because I needed people to be able to use my computer during the Christmas holiday. I'm going to try reinstalling, and see if a fresh install makes any difference.

 

[Gozzy 0]

Hello

I have the same issue as Sabreene ,  

I did a full scan with malwarebytes.

Uninstalled Eset Antivirus with Eset uninstaller , rebooted te computer an reinstalled Eset Antivirus.

I thought this solved the problem and was ok but its seems that randomly after 15-20 min the high cpu usage comes back .

As you can see on the screenshot , ekrn.exe is using 25% cpu usage, this will increase as time pass.

Disabling Computer / Internet security does not help, only restarting my computer will solve the problem

untill 15-20 min pass, then again high cpu usage.

This problem started with the last update 12.0.31.0 , never had this issue before

 

Any sugestions?

TO ADMIN / MODERATOR:

Sorry i try to delete the screenshot but messed it up , can you remove this please?

Thanks and sorry for the mess

 

Thanks in advance,

Gozzy

 

 

 

Edited January 1, 2019 by Gozzy

[Marcos 5,070]

Please contact customer care and provide them with a complete dump of ekrn generated via the advanced setup -> tools -> diagnostics -> create (dump) when ekrn spikes up the cpu.

[whfish 0]

I just tried to contact customer service seeking help with the same issue, on my pc ekrn will spike to 99% of CPU usage and the only way to get it back is forcibly restart the machine

The webpage for support is a troublesome adventure, the page would not accept my customer info, the puzzles you have to put together and captchas etc are a pain and I still could not get it to work

Trying to perform the dump referred to above is next to impossible when the cpu is 99% used up by the service

If I sound frustrated it is because I AM

Is there a log generated that tells me what was going on at the time? Is it hung on a particular file? This does seem to happen at roughly the same time of the day ... any way to chase it back based on a timed event running in the background??

 

[Marcos 5,070]

On systems with multi-core CPUs ekrn should not spike the CPU too much unless several scanning threads are busy for some reason.

You can temporarily disable self-defense, reboot the machine and then run Procdump as follows so that it generates a dump when ekrn spikes up the CPU:
procdump -ma -c 60 ekrn

[Ugtopian 0]

Hi,

I have about 6 months left on a Nod32 2 year subscription, and suddenly, within the last week, this started happening to me too.  ekrn.exe was hogging up the CPU, fluctuating between 97 & 98%.  Pausing/disabling protection had no effect.  It still pegged at 98.##.   After some investigating, I determined that there was conflict with Malwarebytes (which has also been installed for a very log time).  If I turn off the 'Web Protection', in the Malwarebytes Dashboard, Real-Time Protection Layers, the ekrn usage drops to under 1 percent of the CPU.  I can turn 'Web Protection' back on, right away, and it's still below the 1%.  

I saw your post, and thought I'd share my experience.

Thanks,
Gary

- Running Windows 7 Home Premium (64bit) on an i5-2320 (yes, old) with 16G of ram.

[Marcos 5,070]

Malwarebytes or any other security software should be installed only as a second-opinion on-demand scanner in tandem with ESET, ie. no 3rd party security software drivers should be running.

[mippster 0]

Marcos, I too have been having the same issue with ekrn.exe sucking up 97-99% of the CPU which started about a week or two ago.  Ugtopian hit the nail on the head about Malwarebytes so thank you sir for your wisdom!!  I also am running Windows 7 Pro (64bit) on a i5-6500 with 16 gigs of RAM.  I am running Malwarebytes v3.6.1.2711 (component package v1.0.508) and as soon as I do what Ugtopian said to do my ekrn.exe process immediately drops to 0-1% CPU usage.  I've been running Malwarebytes alongside ESET (I have the ESET Internet Security (as of now running v12.0.3.1) for a few years now and have NEVER, EVER had any issues like this before.  ESET, please fix this as I think your software suites are the best on the market!!!

[Nightowl 202]

13 hours ago, mippster said:

Marcos, I too have been having the same issue with ekrn.exe sucking up 97-99% of the CPU which started about a week or two ago.  Ugtopian hit the nail on the head about Malwarebytes so thank you sir for your wisdom!!  I also am running Windows 7 Pro (64bit) on a i5-6500 with 16 gigs of RAM.  I am running Malwarebytes v3.6.1.2711 (component package v1.0.508) and as soon as I do what Ugtopian said to do my ekrn.exe process immediately drops to 0-1% CPU usage.  I've been running Malwarebytes alongside ESET (I have the ESET Internet Security (as of now running v12.0.3.1) for a few years now and have NEVER, EVER had any issues like this before.  ESET, please fix this as I think your software suites are the best on the market!!!

If you are looking to use Malwarebytes you should consider disabling real-time scanning because ESET is already doing that , if both of them are running as real-time protection they will make conflicts with eachother or do any other bugs

If you would like to keep using Malwarebytes , you should consider running it as on-demand scanner and not as real-time.

[mippster 0]

Thanks for your input Rami.  If nothing changes soon (I'm currently still running Malwarebytes real-time with "Web protection" disabled) then I might have to think about doing that.  I've had Malwarebytes block certain websites (maybe they were unsafe, maybe they weren't) when ESET did nothing which is why I kept both running.  Again, this just started happening a few weeks ago and Malwarebytes is just fine to run with ESET ( https://forums.malwarebytes.com/topic/224390-is-eset-and-malwarebtyes-good-together/ ).

[Wolfwalker 0]

I have been an Eset user since 2003.  I just renewed my 10 licenses and am thinking I shouldn't have....My computer sports 2 SSD samsung 850 pro 512 (main) and 1tb (backup) drives, 32 gig memory and dedicated graphics, win 7pro 64 on my laptop.  Recently with in the last 12 days my computer just crawls (never happened before) and using procexp 64 I found that eset maxes at 95-99% and no idea why; its not updating or running scans and takes me awhile to shut thing down to restart.  Any idea why?  Can anyone help? 

[Wolfwalker 0]

I to have Malwarebytes installed and have NEVER had this problem before...Any help would be greatly appreciated....this has only happened 2 times in the last 12 twelve days. I don't play games and only use for personal and work.

[Marcos 5,070]

Unfortunately there's no trial version of MBAM with all features so I'm unable to troubleshoot it myself. If temporarily pausing real-time protection makes a difference, please provide a Procmon log generated as per the instructions at https://support.eset.com/kb6308/.

[Nightowl 202]

On 1/6/2019 at 10:01 PM, mippster said:

Thanks for your input Rami.  If nothing changes soon (I'm currently still running Malwarebytes real-time with "Web protection" disabled) then I might have to think about doing that.  I've had Malwarebytes block certain websites (maybe they were unsafe, maybe they weren't) when ESET did nothing which is why I kept both running.  Again, this just started happening a few weeks ago and Malwarebytes is just fine to run with ESET ( https://forums.malwarebytes.com/topic/224390-is-eset-and-malwarebtyes-good-together/ ).

I do believe that Firefox with uBlock origin and https everywhere  with ESET Web Blocking is enough for blocking crazy pages

Try these and disable Malwarebytes real-time scanning and see if there is any difference, try to use HitmanPRO (not free) if you would like to switch to another on-demand scanner.

[Wolfwalker 0]

Thank you.  I will try the feature disabling of MBpro.  I will also gather the information as per Marco's instructions.

thank you all for the quick responses...

[mippster 0]

Rami, I'm using uBlock origin with Google Chrome and Adblock Plus with Firefox but I'm still back to my point that all was fine for years and as of a few weeks ago I'm having the CPU usage at 99%.  What did ESET do to cause this?  Can this be undone?  I paid for a lifetime subscription to Malwarebytes a few years back which, to my knowledge, has not been offered since.  As of right now I have "Web protection" turned off in Malwarebytes but "Exploit protection", "Malware protection" and "Ransomeware protection" are still enabled with my CPU running normally.

Marcos, Malwarebytes offers a fully functional premium version for 14 days so you can actually install it and hopefully, in 14 days, find out what's causing ESET's CPU issue with it.  Thanks again!!!

[Wolfwalker 0]

It happened again this afternoon.  I was in the middle of submitting a bid and had a deadline.  I just turned off MB and everything went to normal.  So I didn't get the report..but will.  I happen to agree with mippster about this being fine until a few weeks ago.

Mippster, is the web protection what I need to disable?

[Marcos 5,070]

I was unable to reproduce it. The CPU usage has been below 0,02% for ekrn.exe and 1,4% for mbam.exe if no on-demand scan was running.

If the issue has started to manifest just recently, it might have been cause by an update of ESET, ESET's module, MBAM, MBAM's module or operating system itself. Moreover, other applications might have influenced it as well.

Please find out disabling which of the protection modules resolves the issue. A complete memory dump from time when the issue is manifesting might shed more light.
Nevertheless, bear in mind running multiple security solutions at a time may lead to clashes. Even if it seems that two AVs run alright together, nobody will ever be able to guarantee that it will stay like that forever or that the 2 protections won't clash or cancel out each other when actual malware is encountered.

[Nightowl 202]

On 1/8/2019 at 3:58 AM, Wolfwalker said:

I to have Malwarebytes installed and have NEVER had this problem before...Any help would be greatly appreciated....this has only happened 2 times in the last 12 twelve days. I don't play games and only use for personal and work.

What is sure for me that Malwarebytes will cause troubles if it's set to scan as real-time with ESET realtime engine , because both of them will try to claim the file and scan it , and it might cause false positives because if one of them gets hold of the file first , the other cannot access it and might report a false positive about it, so that might be the cause of high CPU usage , because it might be that ESET is always trying to scan the files while MB prevents it

Try to close all of the features that MalwareBytes provides and open them one by one and see what makes the CPU spikes (Real-Time Scanning should be disabled), and for Ransomware protection , I think ESET can protect you from Ransomware , but if you want more layers of security , just disable all of the features and enable them one by one and see what makes the difference or the spikes and keep it disabled.

I do remember when Malwarebytes v2 used to work just fine , in v3 they introduced many different things , in their websites they claim that MB is smarter than the antivirus because AVs are traditional and slow to react to new threats because they are dumb , according to them that they work in ways that can identify 0-day threats which most of these techniques are used by AVs companies , but what I wanted to say that V3 was meant to replace the traditional Antivirus , so a sure thing it will make conflicts with ESET or any other AV that do run in real-time.

Edited January 9, 2019 by Rami

[Wolfwalker 0]

Rami-

I will give it a go when it happens again.  Usually around 2-3 pm. I will probably disable one by one to narrow faster.  Seems when I shut it all off and then start it up, it goes fine until the next day.

[Nightowl 202]

58 minutes ago, Wolfwalker said:

Rami-

I will give it a go when it happens again.  Usually around 2-3 pm. I will probably disable one by one to narrow faster.  Seems when I shut it all off and then start it up, it goes fine until the next day.

Okay , report back if it helps or not , I think it goes fine until the next day , that means you do reboot the PC or turn it on again? , maybe the drivers load again and the CPU spikes again

[Ugtopian 0]

We know we'd never want to be running multiple anti-virus programs, at the same time, but NOD32 and MWB have been working in harmony, for a very long time.  And, if there were no complaints, there was no reason to change my behavior.  It was like having a double lock on your door,   In the last few weeks, one program or the other (or both) has changed, and so will my practices.

If testing for compatibility, you don't see the adverse behavior, right away.  It would take about half the day, after a reboot, for the ekrn.exe to spike.  

[Nightowl 202]

13 minutes ago, Ugtopian said:

We know we'd never want to be running multiple anti-virus programs, at the same time, but NOD32 and MWB have been working in harmony, for a very long time.  And, if there were no complaints, there was no reason to change my behavior.  It was like having a double lock on your door,   In the last few weeks, one program or the other (or both) has changed, and so will my practices.

If testing for compatibility, you don't see the adverse behavior, right away.  It would take about half the day, after a reboot, for the ekrn.exe to spike.  

It's not both developers responsibility to make the program with the other program unless they are cooperating with eachother

with MBAM v2 it wasn't the 'antivirus replacement' , MBAM v3 is sold as 'antivirus replacement' so most likely it will conflict with any other AVs