ESET Insiders Minimalist 16 Posted October 23, 2019 ESET Insiders Posted October 23, 2019 After installing latest version of Eset Internet Security, I have problem running uTorrent desktop application. At first run I got attached error message, all later app startups are really slow ( 30+ seconds). If I pause protection, uTorrent starts normally. Please give me instruction what data you need to help you troubleshoot this problem. Regards.
itman 1,801 Posted October 23, 2019 Posted October 23, 2019 Are you running as a limited admin or a standard user? As you are aware I assume, the screen shot popup occurs when the sign-on user account doesn't have sufficient privileges to perform the required action in reference to the object being accessed. Have you employed GPO in regards to SRP rules? Are you using any other security software that can restrict access to system objects such as SysHardener, OSArmor, etc..
SeriousHoax 87 Posted October 23, 2019 Posted October 23, 2019 Well surely this is not a direct solution to your problem but don't use uTorrent, use open source, ad free alternative Qbittorrent: https://www.qbittorrent.org/ ram1220 and elquenunca 2
Most Valued Members peteyt 396 Posted October 23, 2019 Most Valued Members Posted October 23, 2019 4 hours ago, Minimalist said: After installing latest version of Eset Internet Security, I have problem running uTorrent desktop application. At first run I got attached error message, all later app startups are really slow ( 30+ seconds). If I pause protection, uTorrent starts normally. Please give me instruction what data you need to help you troubleshoot this problem. Regards. I do know eset detects utorrent as a potentional unwanted program so you may need to add it to exceptions but normally it would pop up and ask
ESET Insiders Minimalist 16 Posted October 24, 2019 Author ESET Insiders Posted October 24, 2019 (edited) 9 hours ago, itman said: Are you running as a limited admin or a standard user? As you are aware I assume, the screen shot popup occurs when the sign-on user account doesn't have sufficient privileges to perform the required action in reference to the object being accessed. Have you employed GPO in regards to SRP rules? Are you using any other security software that can restrict access to system objects such as SysHardener, OSArmor, etc.. I run as limited admin (UAC at max). I don't use other tools. Execution is not blocked by Windows or it's mechanisms but by ESET. It happens only first time after ESET install (I tested it twice). After first time blockage uTorrent later can be run, it just takes cca. 30 seconds to start. Edited October 24, 2019 by Minimalist Correction
ESET Insiders Minimalist 16 Posted October 24, 2019 Author ESET Insiders Posted October 24, 2019 5 hours ago, SeriousHoax said: Well surely this is not a direct solution to your problem but don't use uTorrent, use open source, ad free alternative Qbittorrent: https://www.qbittorrent.org/ Thanks for suggestion. I tested qbittorent in past but prefer to use utorrent instead.
ESET Insiders Minimalist 16 Posted October 24, 2019 Author ESET Insiders Posted October 24, 2019 4 hours ago, peteyt said: I do know eset detects utorrent as a potentional unwanted program so you may need to add it to exceptions but normally it would pop up and ask I've tested different settings changes and two that help are: adding utorrent.exe to performance exclusion or disabling scan on file open option in real-time system protection. Other options disabled or enabled don't make a difference. I checked what's happening in background using ProcessMonitor and it seems that ekrn.exe is performing same action again and again for cca 30 seconds when that executable is accessed or run.
pps 4 Posted October 24, 2019 Posted October 24, 2019 (edited) Try excluding utorrent.exe process then using full path under process exclusions. https://help.eset.com/eis/12/en-US/idh_config_processes_exclude.html https://help.eset.com/eis/12/en-US/idh_config_processes_exclude.html?idh_config_processes_exclude_add.html Edited October 24, 2019 by pps
Administrators Marcos 5,451 Posted October 24, 2019 Administrators Posted October 24, 2019 I've tried to reproduce the issue to no avail. If you have another physical or virtual machine, could you try installing v13 from scratch, keep detection of pot. unwanted applications disabled and then install utorrent and reproduce it? If so, please provide 2 Procmon logs, one from time when the issue doesn't occur (e.g. when scan on open is disabled) and one from time when real-time protection is fully enabled and the issue manifests. Besides that, provide also logs collected with ESET Log Collector.
itman 1,801 Posted October 24, 2019 Posted October 24, 2019 As the OP noted in another forum, he installed utorrent prior to installing Eset. Assumed is he was careful not to allow any of the PUA installer crud that comes with it. I am beginning to think the above might be a factor in the utorrent.exe startup in some way. Something along the lines that Eset keeps performing a detailed scan on startup for PUA crud and the like. As such, @Marcos suggestion to reinstall utorrent with Eset installed might also eliminate the issue. Also don't believe excluding utorrent from real-time scanning is a good idea.
ESET Insiders Minimalist 16 Posted October 24, 2019 Author ESET Insiders Posted October 24, 2019 6 hours ago, pps said: Try excluding utorrent.exe process then using full path under process exclusions. https://help.eset.com/eis/12/en-US/idh_config_processes_exclude.html https://help.eset.com/eis/12/en-US/idh_config_processes_exclude.html?idh_config_processes_exclude_add.html Excluding process from scanning makes only a little difference. Also I doubt that it's related to file execution. IMO it's file Open that causes the problem. If I right-click on file, symptoms are the same: 30+ seconds till right-click menu appears and during that time ekrn,exe using one CPU core. If I then select Properties from righ-click menu whole thing happens again. So it's not just program startup that causes the problem.
itman 1,801 Posted October 24, 2019 Posted October 24, 2019 (edited) 23 minutes ago, Minimalist said: If I right-click on file, symptoms are the same: 30+ seconds till right-click menu appears and during that time ekrn,exe using one CPU core. If I then select Properties from righ-click menu whole thing happens again. Does this happen only with utorrent.exe or any executable you select? Edited October 24, 2019 by itman
ESET Insiders Minimalist 16 Posted October 24, 2019 Author ESET Insiders Posted October 24, 2019 Just now, itman said: Does this happen only with utorrent.exe or any executable you select? It happens only with utorrent.exe.
ESET Insiders Minimalist 16 Posted October 24, 2019 Author ESET Insiders Posted October 24, 2019 (edited) 5 hours ago, Marcos said: I've tried to reproduce the issue to no avail. If you have another physical or virtual machine, could you try installing v13 from scratch, keep detection of pot. unwanted applications disabled and then install utorrent and reproduce it? If so, please provide 2 Procmon logs, one from time when the issue doesn't occur (e.g. when scan on open is disabled) and one from time when real-time protection is fully enabled and the issue manifests. Besides that, provide also logs collected with ESET Log Collector. I can't reproduce it in VM (but I have other OS version installed there). Can I attach log files to my post or should I send you PM (I would like log files to be freely accessible to everyone)? Edited October 24, 2019 by Minimalist
Most Valued Members peteyt 396 Posted October 24, 2019 Most Valued Members Posted October 24, 2019 20 minutes ago, Minimalist said: I can't reproduce it in VM (but I have other OS version installed there). Can I attach log files to my post or should I send you PM (I would like log files to be freely accessible to everyone)? Have you tried to reinstall utorrent as this may fix it as others have suggested
ESET Insiders Minimalist 16 Posted October 24, 2019 Author ESET Insiders Posted October 24, 2019 1 minute ago, peteyt said: Have you tried to reinstall utorrent as this may fix it as others have suggested Not yet. Will wait until I submit log files if there could be a problem in EIS. If I reinstall utorrent and it solves the problem I might not be able to reproduce it again.
itman 1,801 Posted October 24, 2019 Posted October 24, 2019 43 minutes ago, Minimalist said: I would like log files to be freely accessible to everyone) Only way that is possible is if you upload them to a file sharing web site and post the link to them in the forum. Only Eset moderators can read any forum attachments.
Administrators Marcos 5,451 Posted October 24, 2019 Administrators Posted October 24, 2019 I have reproduced a weird behavior when ekrn starts unpacking some files after clicking the utorrent icon which normally happens if a process creates a new self-extracting or runtime-packed file. We're investigating it. Nevertheless, it'd help if you too provided a log from your system.
ESET Insiders Minimalist 16 Posted October 24, 2019 Author ESET Insiders Posted October 24, 2019 (edited) 56 minutes ago, itman said: Only way that is possible is if you upload them to a file sharing web site and post the link to them in the forum. Only Eset moderators can read any forum attachments. My bad. I was trying to say I wouldn't like... Privacy concerns... Edited October 24, 2019 by Minimalist
ESET Insiders Minimalist 16 Posted October 24, 2019 Author ESET Insiders Posted October 24, 2019 54 minutes ago, Marcos said: I have reproduced a weird behavior when ekrn starts unpacking some files after clicking the utorrent icon which normally happens if a process creates a new self-extracting or runtime-packed file. We're investigating it. Nevertheless, it'd help if you too provided a log from your system. Attached are my logs from LogCollector and ProcessMonitor logs with and without a simulated problem. TY. eis_logs.zip Logfile_problem.zip Logfile_no_problem.zip
beancounter 6 Posted October 25, 2019 Posted October 25, 2019 On 10/24/2019 at 8:29 AM, SeriousHoax said: Well surely this is not a direct solution to your problem but don't use uTorrent, use open source, ad free alternative Qbittorrent: https://www.qbittorrent.org/ Yes. I got rid of utorrent and installed qbittorrent and the problem went away SeriousHoax 1
Passerby 0 Posted November 8, 2019 Posted November 8, 2019 Have same issue. It disappeared when following option was disabled - "SCAN ON - file open" at Real-time system protection setup.
Administrators Marcos 5,451 Posted November 8, 2019 Administrators Posted November 8, 2019 1 hour ago, Passerby said: Have same issue. It disappeared when following option was disabled - "SCAN ON - file open" at Real-time system protection setup. It is dangerous to disable that option. If you want to use utorrent, exclude the executable in performance exclusions.
Most Valued Members peteyt 396 Posted November 9, 2019 Most Valued Members Posted November 9, 2019 1 hour ago, Marcos said: It is dangerous to disable that option. If you want to use utorrent, exclude the executable in performance exclusions. Just a quick question. I presume excluding utorrent would mean torrents and their files downloaded via utorrent would still be scanned
Administrators Marcos 5,451 Posted November 9, 2019 Administrators Posted November 9, 2019 2 hours ago, peteyt said: Just a quick question. I presume excluding utorrent would mean torrents and their files downloaded via utorrent would still be scanned Correct. Only utorrent.exe won't be scanned if added to the performance exclusion list.
Recommended Posts