Long black screen duration before windows login screen

[StructuralEngineer 0]

Hello,

I' m posting the mail that I sent to support@helpdesk.eset.com 4 days ago.
"Recently I have migrated my windows 10 to a new m2 ssd drive (Samsung NVMe SSD 980). Old one was a normal SSD. After migration, I noticed a long black screen duration (10 to 30 seconds) time before windows login at nearly each boot. After many tries (changing used sata slots, updating drivers, removing other storage drives from the system, migrating to old ssd by using a recovey image) I have found that If my new SSD is connected, there is no way to get rid of this black screen delay except uninstalling Eset Internet Security. When I unistalled Eset Internet Security, boot time returned to normal.
I want to use both my new ssd and Eset Internet Security. So please fix this problem."

Additionaly after this mail I disabled HIPS from eset advanced options and black screen duration decreased dramatically.

I' m sending eset log file link since its size I couldn't add as an attachment.

https://drive.google.com/file/d/1SJSBEXHDC-qhvw5siBP_Qee5yyb8EwK8/view?usp=sharing

Thanks & Regards.

[Marcos 5,084]

Does the problem persist if you re-enable HIPS but disable Deep Behavioral Inspection and reboot the machine?

[StructuralEngineer 0]

@Marcos as you suggested I enabled HIPS and disabled Deep Behavioral Inspection. I restarted the computer twice and did not encounter the black screen problem.

[Marcos 5,084]

Would it be possible to configure Windows to generate complete memory dumps as per https://support.eset.com/en/kb380, re-enable Deep Behavioral Inspection (DBI), reproduce the issue and manually trigger a crash to generate a memory dump? When done, please supply it for perusal compressed in an archive. Afterwards you can temporarily disable DBI while the issue will be investigated.

[StructuralEngineer 0]

I couldn't reproduce black screen problem by enablings HIPS at the begining. Then I realized that I uninstalled samsung magician tool before I disabled HIPS. So inorder to reproduce the black screen problem , I reinstalled samsung magician tool. After some reboot I able to reproduce the problem and took a dump file in a long black screen. This time disabling DBI to get rid of black screen wasn't enough. So I had to disable HIPS.

Apart from these details There is also a lagging problem of ESET services in my PC. When I login to windows, ESET logo shows up little late (10-15 seconds) and starting of eset services like firewall takes additional 30-60 seconds. I took a screen shot during this period. And also during this period I can't start any application in my computer including start menu. They freeze, and multiple clicking results in a delayed open these apps with multiple instances. So I think I have bigger problem than black screen.

Dump file:
https://drive.google.com/file/d/1DvOc4nNBhEGwX6qfMiNZEJD0L0KfJzJr/view?usp=sharing

[Marcos 5,084]

Please do one more thing. After re-enabling HIPS and before restarting Windows, temporarily enable logging of blocked operations in the advanced HIPS setup:

After the reboot when the black screen disappears after a while and you are able to log in, collect fresh logs with ESET Log Collector.

[StructuralEngineer 0]

Eset log collector files after enabling HIPS with Log all blocked operations option is enabled:

First reboot with a shorter black screen duration time: https://drive.google.com/file/d/11rlTeLYKKTwYfqGt-z6xmWsiARoyRgAq/view?usp=sharing
Second reboot with a little bit longer screen duration time and delayed eset services opening time: https://drive.google.com/file/d/15WFNnXiwMTOPFPD_7z4tvNcUqeND_136/view?usp=sharing

[Marcos 5,084]

Please carry out 2 tests:

TEST1
------

• Enable HIPS and all its underlaying technologies (AMS,EB, AntiRansomwre etc) - set them all to default
• Reboot the machine (we expect issue will occur)
• Now disable the Firewall completely
• Reboot the machine

Does the issue persist? If so, please create a full memory dump from such state.

TEST2
------

• Enable the firewall
• Export the configuration to save custom firewall rules
• Remove all custom rules (non default ones) while leaving only the default settings
• Reboot the machine

Does the issue persist? If so, please provide another full memory dump

[StructuralEngineer 0]

I encountered with long black screen at task1 and I' m sending dump file for this task. For task2 black screen durations seemed pretty short and normal at my two restart trial.

Test1 memory dump file:
https://drive.google.com/file/d/1NgvTb4e6xiSebD8Zp4Vq5luvxb7B3chD/view?usp=sharing

[Marcos 5,084]

Please do one more test.

TEST3:

1. Uninstall ESET Internet Security
2. Reboot the machine
3. Install ESET NOD32 Antivirus
4. Reboot the machine

Does the issue persist? If so, please generate a full memory dump.

[StructuralEngineer 0]

For test3 everythings seems normal. After installing nod32, I restared my PC two times and no black screen duration occured.

[StructuralEngineer 0]

I should add that There is no problem after uninstalling Nod32 and reinstalling Eset Internet Security. It seems strange but I guess the problem was about firewall rules that I created in years by using interactive mode.

[Alasedo 0]

Hello, same problem here. Eset Internet Security v17.0.16.0 and Windows 11 version 23h2 22631.2861. my system specs Intel i7-11700 + 48gb 3200mhz ddr4 ram + 500 gb. pci4 m2 Samsung 980 Pro ssd + Nvidia RTX 4070. When importing my eset settings to clean installed Eset then Windows boot start normally and long black screen duration before windows login screen. i used Eset firewall with Interactive mode. i restored Eset firewall settings to default state and enable Interactive mode again. My all firewall rules removed. And after system boot back to normal. There is problem Eset firewall and import settings. This problem become with Eset new version update. Never had a problem like this before. Can you help me please.

[Marcos 5,084]

40 minutes ago, Alasedo said:

Hello, same problem here. Eset Internet Security v17.0.16.0 and Windows 11 version 23h2 22631.2861. my system specs Intel i7-11700 + 48gb 3200mhz ddr4 ram + 500 gb. pci4 m2 Samsung 980 Pro ssd + Nvidia RTX 4070. When importing my eset settings to clean installed Eset then Windows boot start normally and long black screen duration before windows login screen. i used Eset firewall with Interactive mode. i restored Eset firewall settings to default state and enable Interactive mode again. My all firewall rules removed. And after system boot back to normal. There is problem Eset firewall and import settings. This problem become with Eset new version update. Never had a problem like this before. Can you help me please.

It sounds like that no rule exists for communication that occurs upon logon. Since the gui is not loaded yet, the interactive window cannot be displayed and the communication is blocked in interactive mode. Try switching to learning mode for a while, reboot the machine, log in and then switch back to interactive mode.

[Alasedo 0]

3 hours ago, Marcos said:

It sounds like that no rule exists for communication that occurs upon logon. Since the gui is not loaded yet, the interactive window cannot be displayed and the communication is blocked in interactive mode. Try switching to learning mode for a while, reboot the machine, log in and then switch back to interactive mode.

Hello, thank you for answer. i try 2 diffrent PC and result not changed. i switched to learning mode, autonatic mode, disable firewall.. result is same. now uninstall Eset Internet Security and pc logon screen fastly came. I have been using Eset for a long time and i think there is a problem with this version Eset. Never had a problem like this before. i dont know what i do about this problem.

[Marcos 5,084]

I'd suggest that you install v17 from scratch without importing the previous configuration. If you don't want to use automatic firewall mode, switch to learning mode for a few days and then switch to interactive mode.

[Alasedo 0]

6 minutes ago, Marcos said:

I'd suggest that you install v17 from scratch without importing the previous configuration. If you don't want to use automatic firewall mode, switch to learning mode for a few days and then switch to interactive mode.

i cant do that because there are 25 PCs here.

[Marcos 5,084]

On such number of machines we recommend installing ESET Endpoint Security and manage them centrally via ESET PROTECT.

[Alasedo 0]

6 minutes ago, Marcos said:

On such number of machines we recommend installing ESET Endpoint Security and manage them centrally via ESET PROTECT.

i know that but this time i need easy way. i again say; this problem become new. im not new user Eset Internet Security.. and i have special firewall rules for per pc...

[x7007 4]

I have the same issue with black screen, it takes a whole 10-15 sec of black screen like it tries to connect to something or load some kind of service which is ESET. ESET just became such a burden, nothing works with it now.

[Alasedo 0]

4 hours ago, x7007 said:

I have the same issue with black screen, it takes a whole 10-15 sec of black screen like it tries to connect to something or load some kind of service which is ESET. ESET just became such a burden, nothing works with it now.

I have the same issue too. i am waiting for a solution from admins.  i think this problem become with last v17.xx update.

[x7007 4]

15 hours ago, Alasedo said:

I have the same issue too. i am waiting for a solution from admins.  i think this problem become with last v17.xx update.

 

I even tried version 16.1 it happens there too!! I just moved to another AV software, no issues at all, no black screen no nothing, no issues with firewall and no event viewer errors.

Interactive mode with the other AV works PERFECT.

I am not supposed to be DEBUGGER for this software! I bought it to use it not looking for issues or to fix issues.!

Edited January 4 by x7007

[Alasedo 0]

On 1/5/2024 at 2:48 AM, x7007 said:

 

I even tried version 16.1 it happens there too!! I just moved to another AV software, no issues at all, no black screen no nothing, no issues with firewall and no event viewer errors.

Interactive mode with the other AV works PERFECT.

I am not supposed to be DEBUGGER for this software! I bought it to use it not looking for issues or to fix issues.!

Definitely I agree with you. I agree the same. It didn't suit a brand like Eset at all.

[itman 1,664]

The long black screen at Win startup time is obviously a Win startup issue.

When this occurs and after the Win desktop is displayed, open Win Task Manager. Then open the Startup tab.

Displayed are tasks that ran at system startup time and their impact on startup time. The only Eset task shown here is "Eset Command line Interface"; i.e. ecmds.exe, and on my Win 10 22H2 build, its impact is shown as low. What you need to look for are tasks shown as high impact.

[Marcos 5,084]

Does temporarily pausing or disabling the ESET firewall in the advanced setup make a difference? If so, please provide logs collected with ESET Log Collector so that we can check your firewall configuration.