Jump to content
URBAN0

NOD32 Antivirus and HDDs help

Recommended Posts

Posted (edited)

I really like NOD32 antivirus  but I'm facing issue that I don't seem to be able fix it. I have several internal HDDs that are turned off after 10 min. and they stay that way until I need it. My OS its on SSD and here is the issue...when HDDs are in sleep mode they will stay that way but as soon I open NOD32 either via tray icon or main UI all of the drives are waking up, they will go to sleep after giving time even with UI been open, but as soon I close main UI and reopen it wakes HDDs again.  I have try disabling local drives  but nothing works.

 

I was going to pull the trigger and purchase the license but If i can't fix that I am afraid I wont.

Any help would be really appreciated and I hope I could become new NOD32 member

 

Thanks in advanced

 

Btw. Im on Windows 7 x64 pro

Edited by URBAN0

Share this post


Link to post
Share on other sites

Do you have ESET installed on the SSD? Do the disks start spinning up right after double clicking the ESET icon in the tray?

Share this post


Link to post
Share on other sites
Posted (edited)

Hi there,

Thank you for quick response.

Yes ESET is installed on SSD and yes  1 click on tray icon and when main UI is appearing all HDDs will be waking up. I have tried play around with settings but nothing seem to make any difference.

I have  started to like this AV so I hope this can be resolved

 

Also, for now I have left the setting on defaults until we can get to the bottom of this

 

Thank you

Update:

I know this that once UI is up HDDs will go to sleep as they should at giving time only upon closing UI and later bring it up again will turn HDDs on again.

I hope this will help to figure out the issue

Edited by URBAN0

Share this post


Link to post
Share on other sites
28 minutes ago, Marcos said:

Do you have ESET installed on the SSD? Do the disks start spinning up right after double clicking the ESET icon in the tray?

I was really hoping its a small thing that can be corrected fairly quick but doesn't sound like that's the case.... does it..hmm

Share this post


Link to post
Share on other sites
Posted (edited)

I need to correct something that I didn't see it until now.

In my first post I said all HDDs will turn of after 1110 min. what a bummer I meant 10 min, that is a huge difference, sorry about that, it kind of didn't make a sense

I have corrected my first post, sorry again.

I have also submitted this inquiry to customer service/technical support so I ho they will be able to help.

Thanks again and sorry for all these changes to my posts

Edited by URBAN0

Share this post


Link to post
Share on other sites
Posted (edited)

Appears to me all installed SSD/HDD drives spin up upon Eset GUI opening is by design. The Computer scan -> Advanced scan option for example allows for selection of drives/folders to scan.

I also believe opening Windows Explorer will also cause all installed drives to spin up so that they can be displayed.

-EDIT- You might consider unmounting/mounting drive option instead: https://www.wikihow.com/Unmount-a-Drive

Edited by itman

Share this post


Link to post
Share on other sites

Please temporarily lower the sleep time for disks to 5 minutes or even more so that logs are not too big. Then start logging with Procmon as per the FAQ on the right-hand side of this forum, reproduce the issue and then save the log. When done, compress it, upload it to a safe location and drop me a message with a download link.

Share this post


Link to post
Share on other sites
Posted (edited)

Thank you Marcos I will do that and will contact you.

I will lower to 2 min.  so the log won't be too big and I'm so hoping that your with your help you can get to the bottom of this strange behavior.

 

Your help Is very much appreciated.

Thank you

 

Edited by URBAN0

Share this post


Link to post
Share on other sites
Posted (edited)
On 5/29/2019 at 9:16 AM, itman said:

Appears to me all installed SSD/HDD drives spin up upon Eset GUI opening is by design. The Computer scan -> Advanced scan option for example allows for selection of drives/folders to scan.

I also believe opening Windows Explorer will also cause all installed drives to spin up so that they can be displayed.

-EDIT- You might consider unmounting/mounting drive option instead: https://www.wikihow.com/Unmount-a-Drive

Hello itman and thanks for suggestion.  To confirm your suspicion, no, the explorer doesn't wake any of the HDDs, they are in tact sleeping, Its only when GUI launches that HDDs are waking up.

I'm on Win 7 and the option of  mounting HDDs isn't available. Although your suggestion could work I prefer to have all of my HDD's mounted at all times. I hope that this is not be design and can be fixed one way or the other.

I just remember one more thing, when you unmount HDDs they run constantly that is another bummer.

Thank you again for your input I appreciate that very much.

Edited by URBAN0

Share this post


Link to post
Share on other sites
Posted (edited)
14 hours ago, Marcos said:

Please temporarily lower the sleep time for disks to 5 minutes or even more so that logs are not too big. Then start logging with Procmon as per the FAQ on the right-hand side of this forum, reproduce the issue and then save the log. When done, compress it, upload it to a safe location and drop me a message with a download link.

Hello Marco,

I have made the requested logs and I have sent you a massage with links were you can download them.

Thank you again and hope to hear from you with some good news.

 

Edited by URBAN0

Share this post


Link to post
Share on other sites

Hi itman!

Today I have try to install Internet security on one of my other systems to see if the HDDs behavior persists or if that makes any difference with Internet Security and it does the same thing. Once you open main GUI it wakes up all HDDs.

Also, while HDDs are in sleep mode and I happen to insert USB into my hub or directly to PC USB port, once again, instead just scanning that USB as I have set it up, it wakes all drives...that is not the best thing to have always all drives being trigger by just inserting USB device.

This is such nice software but if your correct and I hope you're not and this is by design, that's  not the ideal implementation, let's see what Marcos will come up with I have sent him some logs.

 

Thank you

Share this post


Link to post
Share on other sites

The logs didn't show ESET touching files on other than the C drive.

Try the following:
- run cmd as an administrator
- start logging by running "wpr -start GeneralProfile -start Power"
- reproduce the problem, ie. click the ESET tray icon and make sure the disks spin up
- save the trace by running "wpr -stop trace.etl"

Also try temporarily uninstalling the following software, one at a time:

DeepFreeze
AquaComputerService (wtf)
Outpost

Share this post


Link to post
Share on other sites

You can mount disks. You create a mountpoint on an existing, visible partition/drive, eg., C:\mount and in DISK MANAGER you do NOT allocate a drive letter to a partition but assign a mountpoint.  These will be hard mounts.  You cannot usually get any properties info directly but have to open the mountpoint properties then open the mount properties. A small thing.

I have several drives/partitions mounted without drive letters.  However, they are mounted on mountpoints under D:\ and E:\  so they do only spin up when booting system or when accessing partitions mounted.  In my case, these are usualy archive directories for AUDIO, VIDEO and PHOTOS so no running .exe exists and, because of this I have excluded them from any scans.

My other mounted partitions are on SSD and contain all kinds of files but no noise so no spin-up...or down.

Share this post


Link to post
Share on other sites
1 hour ago, Marcos said:

The logs didn't show ESET touching files on other than the C drive.

Try the following:
- run cmd as an administrator
- start logging by running "wpr -start GeneralProfile -start Power"
- reproduce the problem, ie. click the ESET tray icon and make sure the disks spin up
- save the trace by running "wpr -stop trace.etl"

Also try temporarily uninstalling the following software, one at a time:

DeepFreeze
AquaComputerService (wtf)
Outpost

HI Marcos,

Thanks for your input.

As far  is:

DeepFreeze
AquaComputerService (wtf)
Outpost

I actually didn't have none of the apps installed when I still had that issue with all HDD's. When I firs installed ESET NOD32 I did it on clean windows installation, there were only SP1 and all up to date updates and still was the same thing.

Still I will follow your suggestion and send you logs again.

Thank you

Share this post


Link to post
Share on other sites
1 hour ago, Hpoonis said:

You can mount disks. You create a mountpoint on an existing, visible partition/drive, eg., C:\mount and in DISK MANAGER you do NOT allocate a drive letter to a partition but assign a mountpoint.  These will be hard mounts.  You cannot usually get any properties info directly but have to open the mountpoint properties then open the mount properties. A small thing.

I have several drives/partitions mounted without drive letters.  However, they are mounted on mountpoints under D:\ and E:\  so they do only spin up when booting system or when accessing partitions mounted.  In my case, these are usualy archive directories for AUDIO, VIDEO and PHOTOS so no running .exe exists and, because of this I have excluded them from any scans.

My other mounted partitions are on SSD and contain all kinds of files but no noise so no spin-up...or down.

Hmm and that can be done on Windows 7? Tbh. I never done that, maybe doesn't sound bad. Is there detail description on how to go about that with Windows 7?

Thanks for suggestion, although I would still prefer to have them mounted as normally and ESET not waking them up every time GUI is ON

Share this post


Link to post
Share on other sites

Guys!!

Thank you for your help really and although I love NOD32 Antivirus, it's by far the best and most customizable software in its class I think I will look elsewhere.

I don't think  I should have that issue right from Get-go so there is something to do with NOD32 as I have tried the other day other Antivirus programs just to see if the same behavior exists and no, It doesn't.

 

Maybe I will try again sometimes down the line but for now I will just let go of that.

This thread can be close please.

 

And once again, thank you for all your help.

 

Share this post


Link to post
Share on other sites

Honestly, if I were you I would rather sacrifice a little time of troubleshooting than giving up a top-notch protection. As I wrote, we checked the logs and ESET didn't touch other drives when gui was opened so it remains a mystery as to what's going on there. We are willing to do further troubleshooting in case you decide so.

Share this post


Link to post
Share on other sites
Posted (edited)
2 hours ago, Marcos said:

Honestly, if I were you I would rather sacrifice a little time of troubleshooting than giving up a top-notch protection. As I wrote, we checked the logs and ESET didn't touch other drives when gui was opened so it remains a mystery as to what's going on there. We are willing to do further troubleshooting in case you decide so.

I really appreciate that. I don't want to give up because..  and I mean it... NOD32 is truly stellar software and I would love to use it on all my workstations.

What I will do is I will reload my windows to clean system, only SP1 and all updates to date, then I will do as you suggested.

I will do this within hour or 2 and I will send you logs again. I will probably sent you links to download the logs later this afternoon..well might be different time were your at but I will do it today

 

Thank you Marcos for hanging there for me.

 

Edited by URBAN0

Share this post


Link to post
Share on other sites
Posted (edited)

 

11 hours ago, Marcos said:

The logs didn't show ESET touching files on other than the C drive.

Try the following:
- run cmd as an administrator
- start logging by running "wpr -start GeneralProfile -start Power"
- reproduce the problem, ie. click the ESET tray icon and make sure the disks spin up
- save the trace by running "wpr -stop trace.etl"

Also try temporarily uninstalling the following software, one at a time:

DeepFreeze
AquaComputerService (wtf)
Outpost

Marcos! these commands don't work

And again, now I have nothing installed on my system, its literately bare only updates all is installed :

Asmedia USB Host Controller Driver    Asmedia Technology    5/20/2018    5.47 MB    1.16.35.1
ESET Security    ESET, spol. s r.o.    5/31/2019    78.5 MB    12.1.34.0
Intel(R) Management Engine Components    Intel Corporation    5/20/2018        11.0.0.1173
Intel(R) Network Connections 21.1.30.0    Intel    5/20/2018    34.8 MB    21.1.30.0
Intel(R) USB 3.0\3.1 eXtensible Host Controller Driver    Intel Corporation    4/26/2018        5.0.3.42
Microsoft .NET Framework 4.7.2    Microsoft Corporation    8/28/2018        4.7.03062
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005    Microsoft Corporation    5/31/2019    20.5 MB  
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005    Microsoft Corporation    5/31/2019    17.1 MB  
Microsoft Visual C++ 2017 Redistributable (x64) - 14.13.26020    Microsoft Corporation    5/31/2019    25.6 MB  
Microsoft Visual C++ 2017 Redistributable (x86) - 14.13.26020    Microsoft Corporation    5/31/2019    22.1 MB  
NVIDIA Graphics Driver 399.24    NVIDIA Corporation    5/31/2019        399.24
NVIDIA PhysX System Software 9.17.0524    NVIDIA Corporation    5/31/2019        9.17.0524
Realtek High Definition Audio Driver    Realtek Semiconductor Corp.    5/20/2018        6.0.1.7727

 

and still as soon as I touch the icon and GUI pops my HDDs waking up, this is very weird I even added all HDDs to exclusion

 

You know what! for the heck of it I literately disabled pretty much everything e.g. everything on scanner option , anti-stealth , everything in Media to scan and still.

 

What I'm thinking is that a lot of people don't use multiple HDD's in their systems as a secondary storage and if they do they might be using quiet drives and  if you have 1 or 2 additional HDDs you wont hear much so they might not be aware of this issue.

 

I have fairly big system with roughly 50TB of internal storage, some WD 6TB Blacks and some20190110_093829.thumb.jpg.20ebb4bc6946331c877322985614b44c.jpg 10TB HGST. This system serves multi purpose I don't game but I do other heavy computing work that requires ton of storage and I wont use cloud or external drives so there is no other option.

 

As you can see, the whole NOD32 its pretty much disabled and yet when GUI comes on desktop or if I insert USB device to hub it wakes all hdds. I think there might be an issue with NOD's GUI, something is happening that I don't get it.

1-min.png

2-min.png

20190110_093542.jpg

Edited by URBAN0
adding additional info

Share this post


Link to post
Share on other sites
Posted (edited)
8 hours ago, URBAN0 said:

What I'm thinking is that a lot of people don't use multiple HDD's in their systems as a secondary storage and if they do they might be using quiet drives and  if you have 1 or 2 additional HDDs you wont hear much so they might not be aware of this issue.

I've noticed the same issue, I just haven't got around to investigating it. BTW, hourly update also wakes my additional HDD.

To run WPR you need to install the WPT (Windows Performance Toolkit) by downloading ADK from
hxxp://www.microsoft.com/en-US/download/details.aspx?id=39982

Edit: attached trace

trace.zip

Edited by stackz
attach log

Share this post


Link to post
Share on other sites
Posted (edited)
1 hour ago, stackz said:

I've noticed the same issue, I just haven't got around to investigating it. BTW, hourly update also wakes my additional HDD.

To run WPR you need to install the WPT (Windows Performance Toolkit) by downloading ADK from
hxxp://www.microsoft.com/en-US/download/details.aspx?id=39982

 

Thank you for confirmation of that issue.

For a moment I thought maybe that particular  issue was related only to windows 7 but earlier today I have tried NOD32 on my sons PC (Windows 10) that have only 1 secondary mechanical HDD for a storage  and the same thing was happening with 1 small exception...

When I was testing it on his PC I couldn't hear when NOD32 GUI was waking up that secondary HDD and that is because 1 mechanical HDD is virtually inaudible. 

So my earlier theory could be  correct, this might be an issue that some users aren't even aware of and until you have enough storage to be audible you just go on and it's no big deal. But also, many users let their drives spin constantly so again, they wouldn't  know this issue either.

I have heard about NOD32 being exceptional antivirus but  until  just recently I didn't realize it was better than I expected and if only this issue was rectified I would purchase several licenses and use only ESET but unfortunately this mysterious issue is a deal breaker for me as I am not only silent's freak  but I also I don't like to keep my storage spinning if there is no need.

For now I have reinstalled my avast Pro and if this ever gets fixed I will be the first to  switch to ESET.

 

 

 

Edited by URBAN0

Share this post


Link to post
Share on other sites

Please run the following command and provide the output:

wmic pagefile list /format:list

Share this post


Link to post
Share on other sites
Posted (edited)
2 hours ago, Marcos said:

Please run the following command and provide the output:

wmic pagefile list /format:list

Hello Marcos,

Here is the result of cmd run:

 

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Windows\system32>wmic pagefile list /format:list


AllocatedBaseSize=65446
CurrentUsage=0
Description=C:\pagefile.sys
InstallDate=20180520200633.520012-240
Name=C:\pagefile.sys
PeakUsage=0
Status=
TempPageFile=FALSE

 


C:\Windows\system32>

 

Also, I didn't realize until yesterday when I spoke with my nephew, he just purchased PC through one of the retailers, it was custom build that came with NOD32 preinstalled and  he told me that he has the same issue.

I really hope that this will get fix. I'm a bit disappointed that this is even happening, but I still have a faith that this can can get sort it out.

 

Thank you

 

Edited by URBAN0

Share this post


Link to post
Share on other sites
1 hour ago, Marcos said:

Please run the following command and provide the output:

wmic pagefile list /format:list

Marco!! This issue must have been reported before wasn't it ?

Share this post


Link to post
Share on other sites
Posted (edited)
https://forum.eset.com/topic/8377-100-disk-usage-in-v8-v9/

It appears that there have been  issue related to HDDs and NOD32 whey back, maybe not exactly the same thing but HDD related😯

Such a wonderful program but it seem to have problematic issue that comes and goes🙁

Edited by URBAN0

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Recently Browsing   1 member

×
×
  • Create New...