ESET locks up the whole system when doing certain things

[Haruka 0]

Lemme explain the title further here. I know it's too vague.

 

The exact situation: I'm on Windows 10 with WSL2 running. I'm using ESS premium. I have Rust (programming language, not the game) installed on Windows. I tried to open CLion and open a Rust project on WSL filesystem (through \\wsl$\). CLion starts to index the project. After a little while, the whole system becomes pretty much unresponsive - new processes could be created, but stuck for at least 5-10 seconds or longer (even several minutes have been observed) before they actually start to run.

 

Why I know it's an ESET issue? I tried to inspect the stack of the stuck process (I know I shouldn't be able to, but trust me I did succeed once), and the stack shows the the ESET driver is waiting for something in OS kernel. (eset component dll, ekrn, then OS kernel on some synchronize calls. Now thinking about it, the screenshot here could be very helpful in debugging the issue, but unfortunately I didn't do that.) Also, when everything is stuck, I tried to change some ESET settings, but when saving the changes, ESET itself stuck as well. When it unstuck, everything becomes normal again.

 

I've failed to pinpoint on any of the protection feature. I guess the mapping of eset component dll -> feature is also a secret.

 

What should I do now to investigate it further? Is there any specific logging I need to do?

 

 

[Haruka 0]

I have disabled HIPS and now things work as intended. Guess I'll work this way for now as I really need a productive system.

 

 

[Marcos 5,070]

Please try re-enable HIPS, reboot the machine and and disable only Deep Behavior Inspection or Advanced Memory Scanner to narrow it down.

Also configure Windows to generate complete memory dumps as per https://support.eset.com/en/kb380 and trigger a crash to generate one when the issue occurs. Then raise a support ticket and provide:

- zipped memory dump
- logs collected with ESET Log Collector
- step-by-step instructions how to reproduce the issue
- information about the module / setting that you have narrowed down the issue to