CPU Spikes and Chrome Browser Speed Slowdown over USB Ethernet Devices caused by Nod32 AntiVirus

[talynone 0]

Operating System: Windows 10 64bit

Memory: Systems with 32GB and 16GB 

Eset Anti Virus Version: Spanning back several years to current latest version

I've had this problem for a very long time and have tried to diagnose it on and off across several years/computers/dongles. Have finally determined Eset Antivirus is the culprit. I could never figure out why doing a speed test on speedtest.net would cause my mouse cursor/system to lag during the test, and the download result was never what it should have been in Chrome.

I recently got 1200 megabits down Internet service which again I'm trying to take advantage of via a USB to Ethernet 2.5GBE adapter (tried 4 different brands, several different laptops and previously tried with 5 other brands of Gigabit to Ethernet adapters, all with Eset AntiVirus experience the same issue). 

If I turned off "Web access protection" my speed test in Chrome instantly jumps up 300+ megabits to where it should be, but the CPU spikes from ekrn.exe are still there even if I disable everything in the antivirus including HIPS. As soon as I do a Chrome speed test mouse lags and cpu spikes to 30% on a quad core gen mobile Intel CPU. I would like to take advantage of my full Internet speed without having to disable web protection and have no huge cpu spikes without having to uninstall Eset, please advise, thanks. 

 

[Marcos 5,274]

Please carry on as follows:

- when the issue occurs, enable advanced oper. system logging under Tools -> Diagnostics in the advanced setup
- after 1-2 minutes disable logging
- collect logs with ESET Log Collector
- upload the generated archive to a safe location and drop me a private message with a download link.

Does the issue persist after uninstalling ESET and installing the latest version with default settings? Does switching to the pre-release update channel in the advanced setup make a difference?

[itman 1,748]

I have a gigabyte fiber DSL connection from AT&T. I also use LANSocket Ethernet adapters which does reduce my download speeds considerably.

With EIS 14.1.20 installed, I just performed a speedtest.net test using FireFox.

Results are:

With Eset Web Access enabled - 114.5 Mbps

With Eset Web Access disabled - 111.5 Mbps

Interestingly, my download speed was actually a tad faster with Eset Web Access protection enabled.

There is also a possibility this is a Chrome related issue.

Edited May 9, 2021 by itman

[talynone 0]

16 minutes ago, itman said:

I have a gigabyte fiber DSL connection from AT&T. I also use LANSocket Ethernet adapters which does reduce my download speeds considerably.

With EIS 14.1.20 installed, I just performed a speedtest.net test using FireFox.

Results are:

With Eset Web Access enabled - 114.5 Mbps

With Eset Web Access disabled - 111.5 Mbps

Interestingly, my download speed was actually a tad faster with Eset Web Access protection enabled.

There is also a possibility this is a Chrome related issue.

I see the speed problem in both FireFox and Chrome (private mode or regular), but strangely enough not through the Speedtest windows store application. I tried screen recording the issue with Web access protection on and off and while screen recording it was still not where it should be. I had to turn off screen recording and web access protection to get full speed with CPU spike still being high. This leads me to believe web access protection was just adding the cpu pegging problem rather than being fully responsible for it. High speed browser traffic even with all Eset services turned off make the ekrn.exe process go crazy.  

Edited May 9, 2021 by talynone

[itman 1,748]

I didn't use any browser add-on/extension but rather the speedtest.net web site.

What was strange is a bit later, I checked FireFox memory usage using Win 10 Task Manager. It was using over 1 GB of memory. I have never previously seen that high of system memory use. Normal FireFox usage is around 500 M on my system.

[talynone 0]

1 hour ago, Marcos said:

Please carry on as follows:

- when the issue occurs, enable advanced oper. system logging under Tools -> Diagnostics in the advanced setup
- after 1-2 minutes disable logging
- collect logs with ESET Log Collector
- upload the generated archive to a safe location and drop me a private message with a download link.

Does the issue persist after uninstalling ESET and installing the latest version with default settings? Does switching to the pre-release update channel in the advanced setup make a difference?

Thanks, just sent a PM with a download link to the requested logs. I've had this issue across several laptops across many eset versions. If the logs don't show anything illuminating I can uninstall and see what effect that has, but it might be a day or two as I already spent the entire weekend on this. 

[talynone 0]

7 minutes ago, itman said:

I didn't use any browser add-on/extension but rather the speedtest.net web site.

What was strange is a bit later, I checked FireFox memory usage using Win 10 Task Manager. It was using over 1 GB of memory. I have never previously seen that high of system memory use. Normal FireFox usage is around 500 M on my system.

Same, I was just relaying I tried with all extensions disabled through incognito mode and the problem still occurs through the speedtest.net website on both FireFox and Chrome. I also noticed before I rebooted to try with HIPS off the eset  ekrn.exe process was taking over a gigabyte of memory, looked like a memory leak. But memory usage on that process seems to be fine all day today after the reboot even with HIPS re-enabled. 

Edited May 9, 2021 by talynone

[itman 1,748]

1 hour ago, talynone said:

I also noticed before I rebooted to try with HIPS off the eset  ekrn.exe process was taking over a gigabyte of memory,

I never saw that type of memory usage from ekrn.exe. The 1 GB memory usage reference I posted was from firefox.exe.

Edited May 9, 2021 by itman

[talynone 0]

After thing that fixes the CPU spike/speed slowdown (beyond removing NOD32) is adding the Chrome .exe to the "Excluded applications" area of Advanced Setup->Web and Email->Protocol Filtering section. 

[itman 1,748]

56 minutes ago, talynone said:

After thing that fixes the CPU spike/speed slowdown (beyond removing NOD32) is adding the Chrome .exe to the "Excluded applications" area of Advanced Setup->Web and Email->Protocol Filtering section. 

To further narrow down the Eset source of the issue, first remove chrome.exe from Protocol filtering Excluded applications. Next, under Eset SSL/TLS settings, find chrome.exe in List of SSL/TLS filtered applications. Change its Scan action to "Ignore."

Now retest using speedtest.net and observe if the above changes resolved the download speed issues you are experiencing.

Edited May 10, 2021 by itman

[talynone 0]

43 minutes ago, itman said:

To further narrow down the Eset source of the issue, first remove chrome.exe from Protocol filtering Excluded applications. Next, under Eset SSL/TLS settings, find chrome.exe in List of SSL/TLS filtered applications. Change its Scan action to "Ignore."

Now retest using speedtest.net and observe if the above changes resolved the download speed issues you are experiencing.

Here's what I observed
 

1.) A browser restart is necessary to make sure the changes are applied.

2.) Putting chrome as ignored under the SSL/TLS filtered applications instead of in protocol filtering behaved a lot better than having everything enabled, the lag spikes were at the end of the test instead of throughout.

3.) Putting chrome.exe in the protocol filtered applications still gave best performance

The lag spikes are system wide, my testing procedure includes moving the mouse in a circle throughout the speed test when it lag spikes the mouse cursor stops moving and skips around until the download test is over, no spikes are observed during the upload test. My ISP download speed is around 1400 megabits and is much faster than my upload which is around 40 megabits. So I figure the rate of speed/amount of data NOD32 has to filter through is some factor of the issue. 

. 

Edited May 10, 2021 by talynone

[Marcos 5,274]

I've created a ticket for developers. If further information is needed, I'll let you know.

[Marcos 5,274]

On 5/10/2021 at 5:44 PM, talynone said:

The lag spikes are system wide, my testing procedure includes moving the mouse in a circle throughout the speed test when it lag spikes the mouse cursor stops moving and skips around until the download test is over

 

Could you please try using touchpad or a mouse connected via PS/2, if possible? We assume that you should not experience the issue as long as the touchpad is not connected to the USB bus.

[itman 1,748]

4 hours ago, Marcos said:

Could you please try using touchpad or a mouse connected via PS/2,

A couple of problems with this:

1. Only older PC's have a PS/2 connector.

2. If a PS/2 connector is available, non-wireless mice no longer ship with the USB to PS/2 adapter.

3. Many these days use a wireless mouse that connects through a USB2 dongle.

Edited May 11, 2021 by itman

[talynone 0]

On 5/11/2021 at 10:33 AM, Marcos said:

 

Could you please try using touchpad or a mouse connected via PS/2, if possible? We assume that you should not experience the issue as long as the touchpad is not connected to the USB bus.

I am using the touchpad. PS/2 mice and ports haven't been built into laptops for many years. This is a CPU usage issue. Also remember the problem goes away when Nod32 is removed from the system.

Edited May 13, 2021 by talynone

[Marcos 5,274]

CPU usage didn't go over 30% in the logs you provided, however, the logs showed high DPC latencies which account for the mouse lags.  The fact that the lags occur when using the touchpad means that the touchpad is internally connected through USB.

Will keep you posted about the development of the case.