Ekrn.exe - excessive CPU Time

[JamesWilliam 1]

I have a client, to whom I recommended ESET Internet Security.  (One of many that I've recommended ESET to over the last 15 years.)  This is perhaps the first time I've seen this, but I do find some other topics on this forum and elsewhere about it.  On her computer, ekrn.exe is using anywhere from 50% to 75% CPU time, as far as I've seen so far.  It does slow her computer down to a crawl at times.  I need a solution to this, or I will have to find a substitute for this client.

I've been unable to determine what ekrn.exe is doing to need so much CPU time:  It's not doing a lot of disk access; it's using about 166 MB of RAM, about normal in my experience.  It seems to run around 40 threads.  

Need some input here.

[Marcos 5,070]

- Is ESET the only AV installed? Isn't Malwarebytes installed as well?
- Is msmpeng.exe among running processes?
- Does temporarily pausing real-time protection make a difference?

[TrialUser 0]

I developed the same problem about 30 minutes ago.  Still going on.  CPU usage is 97% for ekrn.exe.  No scans going on that I can tell.  Have tried pausing protection - no change.  Have tried disabling various settings in Advanced settings as suggested my numerous web search results, - no change.  Lots of hits on Google for this problem.  I'm in the middle of my trial subscription and this is not good.  Note that I do have Malwarebytes installed, but msmpeng.exe is not among the running processes, and Malwarebytes does not seem to be doing anything.  If you know of an incompatibility between ESET and Malwarebytes, please share that concern here. 

Windows 7 64 bit Ultimate, 32 Gb ram.

Thanks!

 

[Marcos 5,070]

Yes, there are known issues if Malwarebytes is running with its drivers loaded when ESET is installed.

Try the following:
- temporarily disable protocol filtering in the advanced setup
- with protocol filtering enabled, temporarily uninstall MBAM.

If the issue goes away in either case, we'd need you to supply us with a complete memory dump generated at a time when observing a cpu spike. For information how to configure Windows to generate complete memory dumps and how to trigger a manual crash to generate one, please refer to https://support.eset.com/kb380.

Last but not least, running two or more security solutions each with its own drivers has never been recommended. Sooner or later they will clash, cancel each other, etc. You should use only one fully fledged AV solution and others only as second opinion scanners without any drivers loaded.

[TrialUser 0]

Thank you for the quick reply.  In your second step, did you mean with protocol filtereing *DIS*-abled?  Or are you saying try two different things?  That is, disable protocol filtering and see if problem goes away, and if not, then re-enable protocol filtering and uninstall Malwarebytes?

And when you say “temporarily” uninstall malwarebytes, does it mean that if the problem goes away, I should leave malwarebytes permanently uninstalled?

Is there overlap in functionality between ESET NOD32 and Malwarebytes?  That is, do you think having Malwarebytes on the same system as ESET is redundant and I will be OK with ESET alone?

The ESET trial was going fine for several days.  So what is it that triggers this sudden CPU problem?  It is important to me to know that this is not going to keep happening randomly.

Thanks again.

 

 

 

[Marcos 5,070]

I meant to try each of the steps separately. I assume that either one should resolve the issue but need to confirm my assumption.

If you want to use MBAM besides ESET, install it only as a second opinion on-demand scanner (ie. free version).

[TrialUser 0]

Sorry to be so dense, but I see there are several protocol parameters in advanced setup, and they have to do with email and web access.  Are these the ones  I should try disabling?  Which ones?  Thanks again.

 

[Marcos 5,070]

I meant this setting:

[itman 1,659]

2 hours ago, TrialUser said:

Sorry to be so dense, but I see there are several protocol parameters in advanced setup, and they have to do with email and web access.  Are these the ones  I should try disabling?  Which ones?  Thanks again.

 

See the below screen shot. Uncheck the circled field and click on OK to save your changes. Make sure to reenable the field after you are done testing.

Edited January 19, 2019 by itman