System hang after soft reboot only

[Antoine42 0]

Hello,

I have noticed a weird problem on my computer.

When doing a "soft reboot" by using the restart button in Windows, the system hangs at next boot just after the NOD32 icon tray shows up. At this moment, I notice that if I right-click my desktop, I got a infinite spinning wheel, I can't start most of my program and explorer.exe is not responding. I can't shutdown or restart the computer at this point (hanging at "Restarting") so I hard reset the computer. Computer starts again and works just fine after a cold boot or a hard reset (no hang). Then if I process to restart via the Windows menu, it hangs again at next boot.

I can reproduce this 100% of the time. First I suspected one of my SSD drive failed but SMART monitoring tool is indicating that all drives are OK. I have also reloaded default BIOS option no luck.

Only after I have uninstalled NOD32, the problem stopped. I'm now using Windows Defender.

This is the time that NOD32 failed like that on me. Never had a problem with it for multiples years of usage (home and pro).

I have made an archive with the eset log collector. Where do I send the file? I don't want to send it to a public space as I suspect there are sensitive data inside.

 

Configuration:

• Windows 10 Pro version "20 04"
• Eset Nod32 13.2.15

 

 

[Marcos 5,090]

How did you install v13.2.15; via an automatic product update or manually by downloading the installer and installing it over an older version? If the latter, did you reboot immediately after upgrade? Ideally via the link in the gui to avoid performing just a quick reboot only.

If you haven't upgraded recently and the machine has already been rebooted, we would need a complete memory dump from the point when the system freezes for investigation.

[Antoine42 0]

13.2.15 was previously upgraded via in-product update some time ago (maybe 1 week? I don't remember). I did not use any installer. Considering your question about rebooting after upgrade, I must specify that I have "fast boot" disabled and when I reboot or shutdown, I use a custom command ("shutdown.exe /s /t 0" and "shutdown.exe /r /t 0"). This was a leftover when Windows didn't fully reboot or was constantly trying to reload my program at start. I still use those commands nowadays.

Also please note that when I uninstalled nod32 and saw that it made the problem disappears, I tried to reinstall nod32 with a fresh installer from eset.com, then proceed to fully reboot. Unfortunately, the problem was back again.

[Marcos 5,090]

Does temporarily disabling the 2 startup scan tasks in scheduler make the issue go away? Would it be possible to configure Windows to generate complete memory dumps and manually trigger a crash when the issue occurs to generate one? For instructions, please read https://support.eset.com/en/kb380-how-do-i-generate-a-memory-dump-manually.

[itman 1,668]

2 hours ago, Antoine42 said:

Computer starts again and works just fine after a cold boot or a hard reset (no hang).

Are you stating the PC hanging occurs when when booting via Win 10 Fast Startup option?

Note with the PC previously powered off by case power button or by manually performing an in program Win restart, Fast Startup is not performed.

Edited July 14, 2020 by itman

[Antoine42 0]

15 hours ago, Marcos said:

Does temporarily disabling the 2 startup scan tasks in scheduler make the issue go away? Would it be possible to configure Windows to generate complete memory dumps and manually trigger a crash when the issue occurs to generate one? For instructions, please read https://support.eset.com/en/kb380-how-do-i-generate-a-memory-dump-manually.

I will try those two things this weekend.

15 hours ago, itman said:

Are you stating the PC hanging occurs when when booting via Win 10 Fast Startup option?

Note with the PC previously powered off by case power button or by manually performing an in program Win restart, Fast Startup is not performed.

No, fast startup has always been disabled on all my computers. The computer hangs after a full reboot from the Windows menu or via the reboot command described earlier but doesn't hang if I completely shutdown the computer then power on or by pressing the hardware reset button.

Edited July 15, 2020 by Antoine42

[Antoine42 0]

Just remembered something.

Is it possible that this is caused by the Xbox App installing a virtual disk driver (when using Xbox Game Pass)? I could see a new drive labeled : "msft xvdd".

 

[itman 1,668]

36 minutes ago, Antoine42 said:

Is it possible that this is caused by the Xbox App installing a virtual disk driver (when using Xbox Game Pass)? I could see a new drive labeled : "msft xvdd".

You could temporarily uninstall Game Pass and see if the Eset issue disappears. If it does, you have identified the source of the problem.

[Ic3Lord 0]

Hello,

I have the same issue, exactly the same one Also have the XBOX App installed.

One reboot is OK, I can right click and reboot but the next os load is bad, i can't access my drives start task manager.

[Ic3Lord 0]

OMG, THIS WORKED!!!! IT IS THE SAME DAMN XBOX APPP!!!!

 

OMG 10 Days of troubleshooting!!!

Love you itman, i removed xbox app and it is working without any issues, did 3 reboots.

[Antoine42 0]

Hello

I didn't have time to test this weekend but I have more informations:

Computer still hangs after a software reboot:

• disabling all ESET tasks 
• changing HIPS filtering mode from Smart to Automatic
• reinstalling Nod32 with default settings (without using import/export settings)
• adding xvdd.sys to HIPS > Driver always allowed to load

Computer doesn't hang at boot:

• after a power cut or hard reset
• uninstalling Nod32
• disabling Real time protection
• disabling all Media to scan in Real time protection (local, removable, network)

I have still to try removing Xbox Game Pass but as I'm currently using it, I will not be able to for the time being. Still I pretty sure now that it is the culprit due to @Ic3Lord feedback.

I have left unchecked all checkboxes of Media to scan for the time being even if I understand that this will severely impact system protection but it's still better than removing Nod32.

Also I'm not willing to do a full system ram dump due to size and privacy reason.

[itman 1,668]

2 hours ago, Antoine42 said:

I have still to try removing Xbox Game Pass but as I'm currently using it

I would like to state that the problem is with the virtual drive being allocated to XBox Game Pass. But it appears that's only part of the issue.

A while back, I had mounted a .iso and subsequently later realized the virtual drive was still allocated. That is, the drive was permanently allocated and persisted after a system restart. No problems with Eset whatsoever.

What I believe might be going on in regards to XBox is the virtual drive it is using is not permanently allocated but is de-allocated at system shutdown time. When XBox starts up after a cold boot, the virtual drive is reallocated. Eset has no conflicts with this activity. Makes sense since it appears the xvdd.sys driver is what creates the virtual drive.

However in the case of a system restart, I suspect the virtual drive is not de-allocated but entering some type of unknown suspended state. When the virtual drive resumes it's normal state, this new status is what is causing Eset to hang and in turn, the entire system to hang.

I would check in the XBox forum for anyone have like issues with their AV product and what mitigations resolved it.

Edited July 22, 2020 by itman

[itman 1,668]

One possible workaround to this Eset restart issue is to terminate manually anything Xbox-wise that is running prior to a system restart. Might be that XBox Game Bar app? Not familiar with using XBox on a Win PC. 

After terminating XBox and prior to system restart, open Disk Management via Control Panel -> System and Security -> Administrative Tools -> Computer Management and verify that the virtual drive no longer exists. If so, then restart the device and see if this resolves the Eset hang up issue.

It also appears that the Microsoft.GamingServices app installs 2 drivers; xvdd.sys = XVD Disk Driver (Microsoft Gaming Filesystem Driver) and gameflt.sys = Gaming Filter (Microsoft Gaming Install Filter Driver). Assume it also creates a service for xvdd.sys. The key here is how the service for xvdd.sys is starting. If it is Automatic, the virtual drive is being created at each system restart. If it's Manual-triggered, then the virtual drive is being created whenever an existing Xbox service starts up I would imagine.

Edited July 22, 2020 by itman

[Ic3Lord 0]

Hello Guys,

Well I for one just removed Xbox Gaming App and everything worked fine.

Then proceeded to reinstall the OS to have everything "clean" but did not install the Xbox app from the store

Everything is working perfect for one week now.

I am searching where I can leave some feedback regarding the Xbox app, I am sure that the product team is not aware of the conflict.

[itman 1,668]

I recommend creating an Eset technical support request on this to make Eset aware of the issue. Obviously, this is an issue that can't be resolved in the forum.

[Marcos 5,090]

As mentioned earlier, in order to determine the root cause of the issue we will need a complete memory dump from the point when the system hangs. Please read https://support.eset.com/en/kb380-how-do-i-generate-a-memory-dump-manually for instructions.

[itman 1,668]

Interesting posting here: https://www.tenforums.com/virtualization/125684-virtual-drive-hard-disk-disappears-after-rebooting.html that confirms that virtual drives are de-allocated at system shutdown time:

Quote

First, attached virtual hard disks will always be detached when computer will be shut down (or restarted), and need to be re-attached after every boot. That's the default behaviour and there's nothing you can do for it.

To get around this behavior:

Quote

A workaround is to create a DISKPART script to be run every time you sign in to Windows to attach the VHD and assign a drive letter for it.

I suspect XBox might be doing above similar behavior and might be inconsistent in how it is doing so at cold boot vs. system restart time.

[itman 1,668]

Another thought just occurred to me.

Are those not having Eset issues after system shutdown time using Win 10 fast startup option? It would make sense that the XBox virtual drive is not being deallocated since fast startup is very similar in functionality to sleep mode.

Scratch this since OP stated Fast Start Up enabled.

Edited July 23, 2020 by itman

[itman 1,668]

Here's one that that hasn't been tried yet.

Eset ver. 12.2.15 introduced registry and WMI scanning. A limited scope scan of both are being performed at boot time. There were problems with this that were supposed to be fixed when Eset pushed a recent Cleaner module update.

Do this as a test. Prior to performing a system restart, temporarily disable Eset's scheduled startup scan by uncheck marking it. Now restart the system. If system doesn't hang, this is the culprit. 

Make sure you recheck mark the scheduled startup scan since it is a vital security mechanism.