Eset Service constantly restarts and hangs system

[One Business 1]

Goodmorning,

Since yesterday , I have an increasing amount of PCs having issues with Eset. On my personal computer, the service restarts all the time and then at random times applications stop responding. I cant even CTRL+SHIFT+ESC to bring up the task manager. The only way to proceed is to force shutdown the PC using the button. I currently have this issue on 5 different computers , each of them running windows 10. 

Edited December 5, 2023 by One Business

[Marcos 5,097]

Please carry on as follows:

1. Download Procdump from https://learn.microsoft.com/en-us/sysinternals/downloads/procdump and extract the archive to the disk
2. Run as an administrator: procdump -i -ma
3. After ekrn has crashed, run procdump -u
4. Compress the generated ekrn dump(s)
5. Upload the archive here or to a safe location and drop me a personal message with a download link.

[One Business 1]

The are no dump files created. The service restarted two times though.

Edited December 5, 2023 by One Business

[manos_v_tax 0]

can't upload the zip

[Marcos 5,097]

4 minutes ago, manos_v_tax said:

can't upload the zip

Maybe it's too big to upload here. You can upload it to a file sharing service, such as OneDrive, DropBox, Google Drive, etc. and drop me a private message with a download link.

[One Business 1]

Uhm. wrong thread? My issue is still present and procnum doesnt generate any dump file. I tried to change the folder from which I run it too.

[Marcos 5,097]

Just now, One Business said:

Uhm. wrong thread? My issue is still present and procnum doesnt generate any dump file. I tried to change the folder from which I run it too.

If the system becomes unresponsive, please configure Windows to generate complete memory dumps as per https://support.eset.com/en/kb380. When the system is unresponsive, manually trigger a crash so that a dump is generated. Then compress it and supply it to us for perusal.

 

[myriad 0]

Hi!

I have a similar problem. The problem started appearing after the ESET Internet Security update.

Eset Service constantly restarts and hangs system. Looks like the WATCHDOG timer is triggered.

When working in the Firefox browser, a message appears: "Something went wrong. Restart the secure browser to ensure it is fully active."

[constexpr 46]

Please open ESET advanced settings (F5) and disable Protected Service

then follow Marcos instructions

2 hours ago, Marcos said:

Please carry on as follows:

1. Download Procdump from https://learn.microsoft.com/en-us/sysinternals/downloads/procdump and extract the archive to the disk
2. Run as an administrator: procdump -i -ma
3. After ekrn has crashed, run procdump -u
4. Compress the generated ekrn dump(s)
5. Upload the archive here or to a safe location and drop me a personal message with a download link.

When service is restarted, check whethet you see .dmp file in the same folder like procdump

Thanks a lot

[One Business 1]

14 minutes ago, constexpr said:

Please open ESET advanced settings (F5) and disable Protected Service

then follow Marcos instructions

When service is restarted, check whethet you see .dmp file in the same folder like procdump

Thanks a lot

That worked. I pm'ed @Marcos with the link for the log files.

[Marcos 5,097]

A newer version of the Cleaner module 1245.1 with a fix is going to be released today. When available, check if it resolves your issue. Should the problem persist, let us know.

[One Business 1]

Thank you very much!

[RicardoSL 0]

Hello
Same issue. Since a couple of day.
First, with version ESET Endpoint security 10.1.2058.0 but now I found one PC with version 10.1.2050.0 whith the same problem. All with windows 10.

Nombre de registro:System
Origen:        Service Control Manager
Fecha:         05/12/2023 12:50:52
Id. del evento:7031
Categoría de la tarea:Ninguno
Nivel:         Error
Palabras clave:Clásico
Usuario:       No disponible
Equipo:        M77
Descripción:
El servicio ESET Service terminó inesperadamente. Esto se ha repetido 1 veces. Se realizará la siguiente acción correctora en 0 milisegundos: Reiniciar el servicio.
XML de evento:
<Event xmlns="hxxp://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="49152">7031</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2023-12-05T15:50:52.2829205Z" />
    <EventRecordID>40450</EventRecordID>
    <Correlation />
    <Execution ProcessID="760" ThreadID="12316" />
    <Channel>System</Channel>
    <Computer>M77</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">ESET Service</Data>
    <Data Name="param2">1</Data>
    <Data Name="param3">0</Data>
    <Data Name="param4">1</Data>
    <Data Name="param5">Reiniciar el servicio</Data>
    <Binary>65006B0072006E000000</Binary>
  </EventData>
</Event>

 

Nombre de registro:System
Origen:        Service Control Manager
Fecha:         05/12/2023 12:50:52
Id. del evento:7034
Categoría de la tarea:Ninguno
Nivel:         Error
Palabras clave:Clásico
Usuario:       No disponible
Equipo:        M77
Descripción:
El servicio ESET Firewall Helper se terminó de manera inesperada. Esto ha sucedido 617 veces.
XML de evento:
<Event xmlns="hxxp://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="49152">7034</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2023-12-05T15:50:52.2829205Z" />
    <EventRecordID>40451</EventRecordID>
    <Correlation />
    <Execution ProcessID="760" ThreadID="12316" />
    <Channel>System</Channel>
    <Computer>M77</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">ESET Firewall Helper</Data>
    <Data Name="param2">617</Data>
    <Binary>65006B0072006E0045007000660077000000</Binary>
  </EventData>
</Event>

 

Thanks in advance

 

[Marcos 5,097]

Please check if the issue is resolved with the Cleaner module 1245.1 when available.

[RicardoSL 0]

In this moment the cleaner module Is versión 1245 (31 oct 2023)

[RicardoSL 0]

Thank you Marcos. After upgrading the Cleaner module from version 1245 to 1245.1, the issue was resolved.

However, there are computers with the Cleaner module version 1245 that have not presented any problems.

[Marcos 5,097]

13 minutes ago, RicardoSL said:

However, there are computers with the Cleaner module version 1245 that have not presented any problems.

It is likely that there are no incorrectly quoted paths in registry locations scanned by the startup scanner on machines where ekrn wasn't crashing.

[VirMan 0]

Same crashing problem here, even after yesterday's module update, this time not even Firefox that causes problems. I play WOT and each time the ekrn restarts the game drops (alt-tabs) to desktop but the computer works and i can go back to the game but after it does so a couple of times the computer hangs and i have to shut it down on the reset or power button. The only solution i found so far was to revert back to v16. System logs show pretty much the same errors as with other users here on v17.0.15.0

For what it's worth, AMD system with Windows 10. Up until v17 there were no issues whatsoever.

[Marcos 5,097]

29 minutes ago, VirMan said:

Same crashing problem here, even after yesterday's module update, this time not even Firefox that causes problems. I play WOT and each time the ekrn restarts the game drops (alt-tabs) to desktop but the computer works and i can go back to the game but after it does so a couple of times the computer hangs and i have to shut it down on the reset or power button.

Please provide logs collected with ESET Log Collector. Does the issue occur as soon as you install v17.0.15 with default settings?

[VirMan 0]

Yes it does, as i said since v17 the problems started. Even after disabling the advanced script detector. Right now i am back to v16 so i have to update to v17 first to be able to create logs and i will be able to do that later when i get back from work (and revert back again to v16 to be able to use my computer...).

[VirMan 0]

Oddly enough when i uninstalled v16 to install v17, disabled advanced script for browsers everything works good so far. Will reply here if the problem comes back.

[Marcos 5,097]

What issues are you having after re-enabling the Browser script scanner in v17? Is it related to playing WOT that you mentioned above?

[One Business 1]

I can confirm that the issue was resolved with the update on the cleaner module.

Edited December 7, 2023 by One Business