Windows XP Boot Issue

[kamiran.asia 5]

Hi dears ESET Admins.

This week we have many report from XP SP3 Clients that fails to boot. ESET Endpoint Security 7.0 ins installed on them.

It hang on Logon screen and then Restarted.

Unisntalling ESET Endpoint 7.0 from Safe mode will solve the issue !

 

We ask them to send us full log and ESET Log Collector to check. but before that any same Reported problem ?

 

[Marcos 5,070]

Note that the last version of Endpoint with official support for Windows XP is 6.5. Newer versions of Endpoint are not tested on Windows XP and issues occurring on this OS may not be considered bugs.

In safe mode please rename "C:\Program Files\ESET\ESET Security\Drivers" (e.g. to Drivers_bak) and then the following drivers, one at a time until you narrow it down to the troublesome one:

C:\Windows\System32\drivers\eamonm.sys
C:\Windows\System32\drivers\ehdrv.sys
C:\Windows\System32\drivers\epfw.sys

Let us know if renaming any of them helped.

[kamiran.asia 5]

On 12/7/2019 at 11:36 AM, Marcos said:

Note that the last version of Endpoint with official support for Windows XP is 6.5. Newer versions of Endpoint are not tested on Windows XP and issues occurring on this OS may not be considered bugs.

In safe mode please rename "C:\Program Files\ESET\ESET Security\Drivers" (e.g. to Drivers_bak) and then the following drivers, one at a time until you narrow it down to the troublesome one:

C:\Windows\System32\drivers\eamonm.sys
C:\Windows\System32\drivers\ehdrv.sys
C:\Windows\System32\drivers\epfw.sys

Let us know if renaming any of them helped.

Dear Marcos.

We find that the problem is accrued in XP SP3 With AMD Possessor ( Maybe , Because all issues is accrued in XPSp3+AMD).

We test Version Endpoint 6.5 , 5 , and even ESET NOD32 V8Home Edition !!! , ... . In all cases after Update Windows will restarted in logon.

Reinstalling windows will not solve the problem !

We update one PC with update of 2019/11/25 . It will not restart. It just restart on windows logon with the latest update.

It seems that there is some conflict in the recent module update !

We will check the renaming soon.

[Nightowl 202]

It's much recommended to move on from Windows XP , to some Windows that is currently supported by Microsoft.

[kamiran.asia 5]

5 minutes ago, Rami said:

It's much recommended to move on from Windows XP , to some Windows that is currently supported by Microsoft.

We are ESET ME partner company and It is not possible right now in some special cases for our special customers.

[Nightowl 202]

11 minutes ago, kamiran.asia said:

We are ESET ME partner company and It is not possible right now in some special cases for our special customers.

I understand that , XP is obsolete these days. , but I understand that you have some needs that is why you stick with this system.

[kamiran.asia 5]

On 12/7/2019 at 11:36 AM, Marcos said:

Note that the last version of Endpoint with official support for Windows XP is 6.5. Newer versions of Endpoint are not tested on Windows XP and issues occurring on this OS may not be considered bugs.

In safe mode please rename "C:\Program Files\ESET\ESET Security\Drivers" (e.g. to Drivers_bak) and then the following drivers, one at a time until you narrow it down to the troublesome one:

C:\Windows\System32\drivers\eamonm.sys
C:\Windows\System32\drivers\ehdrv.sys
C:\Windows\System32\drivers\epfw.sys

Let us know if renaming any of them helped.

Renaming all These items not solve the Logon Restart problem:

C:\Program Files\ESET\ESET Endpoint Security\Drivers
C:\Windows\System32\drivers\eamonm.sys
C:\Windows\System32\drivers\ehdrv.sys
C:\Windows\System32\drivers\epfw.sys

 

So even when drivers is not loaded system will restart.

[kamiran.asia 5]

Restoring em...dat files in V6.5 and Modules Folder in V7.0 with older module update will solve the restart problem temporary.

[kamiran.asia 5]

Any Opinion ?

Still they can not update the Clients. After Update windows will not load.

[Marcos 5,070]

If I understand correctly, the system doesn't BSOD but it stays on a black screen while Windows starts?

Would it be possible to configure Windows to generate complete memory dumps and generate one manually when the system is in unresponsive state? https://support.eset.com/en/how-do-i-generate-a-memory-dump-manually

Also please provide logs collected with ESET Log Collector in safe mode so that we can check what modules you have installed.

[kamiran.asia 5]

4 minutes ago, Marcos said:

If I understand correctly, the system doesn't BSOD but it stays on a black screen while Windows starts?

Would it be possible to configure Windows to generate complete memory dumps and generate one manually when the system is in unresponsive state? https://support.eset.com/en/how-do-i-generate-a-memory-dump-manually

Also please provide logs collected with ESET Log Collector in safe mode so that we can check what modules you have installed.

No BSOD , No Black Screen. Just Windows restarted after windows XP Logo ( Before Logon Screen )

Memory Dump and ESET Log Collector will be generated soon.

[kamiran.asia 5]

No BSOD , No Black Screen. Just Windows restarted after windows XP Logo ( Before Logon Screen )

Can our customer generate Memory Dump in this case ?

According to article full memory dump can not be generated when we have loop restart issue.

[kamiran.asia 5]

2 hours ago, Marcos said:

If I understand correctly, the system doesn't BSOD but it stays on a black screen while Windows starts?

Would it be possible to configure Windows to generate complete memory dumps and generate one manually when the system is in unresponsive state? https://support.eset.com/en/how-do-i-generate-a-memory-dump-manually

Also please provide logs collected with ESET Log Collector in safe mode so that we can check what modules you have installed.

Memory Dump is not Generated automatically and Manual way did not work in this case because of loop restart.

ESET Log Collector is send via Priveate message dear @Marcos.

 

[Chaluha 2]

Hi I have same problem with BSOD on 3 computers with Windows XP. Two have Athlon XP and one Pentium III processor. Eset Endpoint Security v5.

[Marcos 5,070]

On 12/13/2019 at 9:14 AM, Chaluha said:

Hi I have same problem with BSOD on 3 computers with Windows XP. Two have Athlon XP and one Pentium III processor. Eset Endpoint Security v5.

We have released newer HIPS and Anti-Stealth modules on the pre-release update channel that are compatible with old processors. The HIPS module is already on the regular update channel, the Anti-Stealth module should follow soon. We strongly recommend that you upgrade Endpoint to v6.5 on Windows XP and to v7.2 on Windows 7 and newer in order to be protected against current threats. As for Windows XP, it will remain vulnerable since Microsoft stopped releasing security updates for it years ago with the exception of very critical vulnerabilities.

[kamiran.asia 5]

It is about 20 days and no solution have been found yet.

All these systems can not be updated any more and we have freeze their update.

 

[Marcos 5,070]

We have received no reports of issues with Windows XP from partners around the world. In all cases recent reports were about BSOD that was caused by modules compiles with Spectre mitigation enabled and in all cases update of modules helped. I'm afraid that without manually crashing the system when the blank screen appears and generating a full memory dump we are in a blind alley. Nevertheless, I'd strongly recommend raising a support ticket with customer care.

[kamiran.asia 5]

3 minutes ago, Marcos said:

We have received no reports of issues with Windows XP from partners around the world. In all cases recent reports were about BSOD that was caused by modules compiles with Spectre mitigation enabled and in all cases update of modules helped. I'm afraid that without manually crashing the system when the blank screen appears and generating a full memory dump we are in a blind alley. Nevertheless, I'd strongly recommend raising a support ticket with customer care.

We have Support Ticket ESET ME (CASE:55720) , But we do not receive any update .

Last update From Support :
" We will share the logs with our developers and get back to you once we have an update from them. "

Because this Case is special , we manually edit Update.ver and delete all modules except Engine and some necessary modules, ... , while this way is a security risk because not all of modules are updated and just Database Engine is updating but better than loop restart.

in this way we can check module by module to check wittch one cause the problem but our customer have not enough time to do these tests.

[Chaluha 2]

On 12/31/2019 at 1:23 PM, Marcos said:

We have received no reports of issues with Windows XP from partners around the world. In all cases recent reports were about BSOD that was caused by modules compiles with Spectre mitigation enabled and in all cases update of modules helped. I'm afraid that without manually crashing the system when the blank screen appears and generating a full memory dump we are in a blind alley. Nevertheless, I'd strongly recommend raising a support ticket with customer care.

Hi for me ESET Endpoint Security v5 working now fine. Just need to delete Eset folder in Program Files before install Eset, otherwise it will load bad modules during installation and crash.

[Marcos 5,070]

ESET Endpoint v5 doesn't provide sufficient protection against current threats. We strongly recommend upgrading to Endpoint 7.2 as soon as possible. In the case of Windows XP, Endpoint 6.5 is the last one that supports this OS.