Jump to content
Minimalist

uTorrent problem after 13.0.22.0 install

Recommended Posts

After installing latest version of Eset Internet Security, I have problem running uTorrent desktop application.

At first run I got attached error message, all later app startups are really slow ( 30+ seconds). If I pause protection, uTorrent starts normally.

Please give me instruction what data you need to help you troubleshoot this problem.

Regards.

Untitled1.png

Share this post


Link to post
Share on other sites

Are you running as a limited admin or a standard user?

As you are aware I assume, the screen shot popup occurs when the sign-on user account doesn't have sufficient privileges to perform the required action in reference to the object being accessed. 

Have you employed GPO in regards to SRP rules? Are you using any other security software that can restrict access to system objects such as SysHardener, OSArmor, etc..

Share this post


Link to post
Share on other sites
4 hours ago, Minimalist said:

After installing latest version of Eset Internet Security, I have problem running uTorrent desktop application.

At first run I got attached error message, all later app startups are really slow ( 30+ seconds). If I pause protection, uTorrent starts normally.

Please give me instruction what data you need to help you troubleshoot this problem.

Regards.

Untitled1.png

I do know eset detects utorrent as a potentional unwanted program so you may need to add it to exceptions but normally it would pop up and ask

Share this post


Link to post
Share on other sites
9 hours ago, itman said:

Are you running as a limited admin or a standard user?

As you are aware I assume, the screen shot popup occurs when the sign-on user account doesn't have sufficient privileges to perform the required action in reference to the object being accessed. 

Have you employed GPO in regards to SRP rules? Are you using any other security software that can restrict access to system objects such as SysHardener, OSArmor, etc..

I run as limited admin (UAC at max). I don't use other tools. Execution is not blocked by Windows or it's mechanisms but by ESET. It happens only first time after ESET install (I tested it twice). After first time blockage uTorrent later can be run, it just takes cca. 30 seconds to start.

Edited by Minimalist
Correction

Share this post


Link to post
Share on other sites
5 hours ago, SeriousHoax said:

Well surely this is not a direct solution to your problem but don't use uTorrent, use open source, ad free alternative Qbittorrent: https://www.qbittorrent.org/

Thanks for suggestion. I tested qbittorent in past but prefer to use utorrent instead.

Share this post


Link to post
Share on other sites
4 hours ago, peteyt said:

I do know eset detects utorrent as a potentional unwanted program so you may need to add it to exceptions but normally it would pop up and ask

I've tested different settings changes and two that help are: adding utorrent.exe to performance exclusion or disabling scan on file open option in real-time system protection. Other options disabled or enabled don't make a difference.

I checked what's happening in background using ProcessMonitor and it seems that ekrn.exe is performing same action again and again for cca 30 seconds when that executable is accessed or run.

Share this post


Link to post
Share on other sites

I've tried to reproduce the issue to no avail.

If you have another physical or virtual machine, could you try installing v13 from scratch, keep detection of pot. unwanted applications disabled and then install utorrent and reproduce it? If so, please provide 2 Procmon logs, one from time when the issue doesn't occur (e.g. when scan on open is disabled) and one from time when real-time protection is fully enabled and the issue manifests. Besides that, provide also logs collected with ESET Log Collector.

 

Share this post


Link to post
Share on other sites

As the OP noted in another forum, he installed utorrent prior to installing Eset. Assumed is he was careful not to allow any of the PUA installer crud that comes with it.

I am beginning to think the above might be a factor in the utorrent.exe startup in some way. Something along the lines that Eset keeps performing a detailed scan on startup for PUA crud and the like. As such, @Marcos suggestion to reinstall utorrent with Eset installed might also eliminate the issue.

Also don't believe excluding utorrent from real-time scanning is a good idea.

Share this post


Link to post
Share on other sites
6 hours ago, pps said:

Excluding process from scanning makes only a little difference. Also I doubt that it's related to file execution. IMO it's file Open that causes the problem. If I right-click on file, symptoms are the same: 30+ seconds till right-click menu appears and during that time  ekrn,exe using one CPU core. If I then select Properties from righ-click menu whole thing happens again. So it's not just program startup that causes the problem.

Share this post


Link to post
Share on other sites
23 minutes ago, Minimalist said:

If I right-click on file, symptoms are the same: 30+ seconds till right-click menu appears and during that time  ekrn,exe using one CPU core. If I then select Properties from righ-click menu whole thing happens again.

Does this happen only with utorrent.exe or any executable you select?

Edited by itman

Share this post


Link to post
Share on other sites
Just now, itman said:

Does this happen only with utorrent.exe or any executable you select?

It happens only with utorrent.exe.

Share this post


Link to post
Share on other sites
5 hours ago, Marcos said:

I've tried to reproduce the issue to no avail.

If you have another physical or virtual machine, could you try installing v13 from scratch, keep detection of pot. unwanted applications disabled and then install utorrent and reproduce it? If so, please provide 2 Procmon logs, one from time when the issue doesn't occur (e.g. when scan on open is disabled) and one from time when real-time protection is fully enabled and the issue manifests. Besides that, provide also logs collected with ESET Log Collector.

 

I can't reproduce it in VM (but I have other OS version installed there). Can I attach log files to my post or should I send you PM (I would like log files to be freely accessible to everyone)?

Edited by Minimalist

Share this post


Link to post
Share on other sites
20 minutes ago, Minimalist said:

I can't reproduce it in VM (but I have other OS version installed there). Can I attach log files to my post or should I send you PM (I would like log files to be freely accessible to everyone)?

Have you tried to reinstall utorrent as this may fix it as others have suggested

Share this post


Link to post
Share on other sites
1 minute ago, peteyt said:

Have you tried to reinstall utorrent as this may fix it as others have suggested

Not yet. Will wait until I submit log files if there could be a problem in EIS. If I reinstall utorrent and it solves the problem I might not be able to reproduce it again.

Share this post


Link to post
Share on other sites
43 minutes ago, Minimalist said:

I would like log files to be freely accessible to everyone)

Only way that is possible is if you upload them to a file sharing web site and post the link to them in the forum. Only Eset moderators can read any forum attachments.

Share this post


Link to post
Share on other sites

I have reproduced a weird behavior when ekrn starts unpacking some files after clicking the utorrent icon which normally happens if a process creates a new self-extracting or runtime-packed file. We're investigating it. Nevertheless, it'd help if you too provided a log from your system.

Share this post


Link to post
Share on other sites
56 minutes ago, itman said:

Only way that is possible is if you upload them to a file sharing web site and post the link to them in the forum. Only Eset moderators can read any forum attachments.

My bad. I was trying to say I wouldn't like... :)

Privacy concerns...

Edited by Minimalist

Share this post


Link to post
Share on other sites
54 minutes ago, Marcos said:

I have reproduced a weird behavior when ekrn starts unpacking some files after clicking the utorrent icon which normally happens if a process creates a new self-extracting or runtime-packed file. We're investigating it. Nevertheless, it'd help if you too provided a log from your system.

Attached are my logs from LogCollector and ProcessMonitor logs with and without a simulated problem. TY.

eis_logs.zip Logfile_problem.zip Logfile_no_problem.zip

Share this post


Link to post
Share on other sites
On 10/24/2019 at 8:29 AM, SeriousHoax said:

Well surely this is not a direct solution to your problem but don't use uTorrent, use open source, ad free alternative Qbittorrent: https://www.qbittorrent.org/

Yes. I got rid of utorrent and installed qbittorrent and the problem went away

Share this post


Link to post
Share on other sites

Have same issue. It disappeared when following option was disabled -  "SCAN ON - file open" at Real-time system protection setup.  

Share this post


Link to post
Share on other sites
1 hour ago, Passerby said:

Have same issue. It disappeared when following option was disabled -  "SCAN ON - file open" at Real-time system protection setup.  

It is dangerous to disable that option. If you want to use utorrent, exclude the executable in performance exclusions.

Share this post


Link to post
Share on other sites
1 hour ago, Marcos said:

It is dangerous to disable that option. If you want to use utorrent, exclude the executable in performance exclusions.

Just a quick question. I presume excluding utorrent would mean torrents and their files downloaded via utorrent would still be scanned

Share this post


Link to post
Share on other sites
2 hours ago, peteyt said:

Just a quick question. I presume excluding utorrent would mean torrents and their files downloaded via utorrent would still be scanned

Correct. Only utorrent.exe won't be scanned if added to the performance exclusion list.

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...