Jump to content

ESET Smart Security causing false 0x00000124 BSODs?


Recommended Posts

So glad I found this post - I have been having lockups since 24th June which seems to be the date people mentioned here (Z87 Asus board) usually 2-5 mins after boot. I spent so long with system restore, completed removing any overclocks etc.

 

Heres hoping the pre release fix holds. I appreciate them putting a fix out for this but this is the second major problem (assuming this fixes it) I've had with the product now this year after being a user for a long time.

Link to comment
Share on other sites

Thanks to the folks with the Gigabyte MoBo App Center Products and MoBo's

Hi,

I persisted with fixing this myself from the "Man" knows better than "Machine" standpoint. I took a lesson from Pizzly and Fanstein. Uninstalled the following: ASUS Sabertooth Z87 Apps. -- Removal completed successfully.

AI Suite III, ASUS Product Register Program, ASUS Product Register Program, Asus Fan Control Service, Asus WebStorage Windows Service

I reinstalled ESET 2014 from the CD with the downloaded update that gets Smart Security 8.0.312, AV Signature is 11881 (20150702) 6:15 PM (MST-7)

I am running on ESET 8.0.312, So far all is well.

As far as I can surmise something killed the Win8.1 of making BSOD dumps and also rendered the system incapable of running an ESET startup scan. 11/2014.

The ASUS geo-location of code writers manufacturers with malware are suspect.

Oh Well. Now more scans are needed and I do need the FAN Control back.

Need to find out why dumps did not occur too,

 

I resolved this with a "Man" knows better than the "Machine" approach too-

I did it this way;[/background]

-I uninstalled the Gigabyte APP Center completely and rebooted[/background]

-I uninstalled ESET Smart Security using the ESET Uninstaller Tool and also manually removed a couple of what appeared to be 'empty' ESET sub-directories in the 'USERS' directory[/background]

-I did a clean install of ESET I downloaded from the ESET download page[/background]

-I followed the '[/size][/background]How do I enable or disable pre-release updates in my ESET product?' to enable 'pre-release updates'

-I rebooted and then re-installed the Gigabyte APP Center and now both are 'playing nice' with each other and no more 'Blue Screens'

Later today I'll disable pre-release updates and enable the regular updates to see if they've fixed it on their end yet

Link to comment
Share on other sites

  • Administrators

Heres hoping the pre release fix holds. I appreciate them putting a fix out for this but this is the second major problem (assuming this fixes it) I've had with the product now this year after being a user for a long time.

 

Our investigation shows that the culprit is Gigabyte and ASUS applications and some other vendors have noticed the same issue with their scanners while these applications were installed. We only made a workaround via a module update as there was nothing to fix on ESET's side.

 

If you are still having issues with ASUS MB despite having Antivirus and antispyware module 1462 installed, we'll need a complete memory dump from BSOD or a manually generated dump if the system freezes.

Link to comment
Share on other sites

If you are still having issues with ASUS MB despite having Antivirus and antispyware module 1462 installed, we'll need a complete memory dump from BSOD or a manually generated dump if the system freezes.

 

@Marcos

Has there been any modifications to Smart Security for PC/Win 7 since I last posted on June 26th? I've had to uninstall SS since then - I can't see any point in reinstalling if there has been no change. I definitely  had module 1492 installed.

 

WRT to a memory dump, I obviously cannot create any dump for my system after it freezes - are you suggesting that a dump immediately after login could be useful to you? If so, then I will find time to install SS one last time to create such a dump - given the size, can you please PM me with an upload location?

 

Has this problem gone away for any other Asus users running AI Suite 3?

 

 

System: Asus z87 Pro, 16GB, Win 7 Pro SP1

Link to comment
Share on other sites

  • Administrators

If the system freezes to such an extent that generation of a memory dump can be triggered by pressing a combination of keys (as per the instructions in hxxp://kb.eset.com/esetkb/index?page=content&id=SOLN380),please create one. I will provide you with further instructions then.

Has this problem gone away for any other Asus users running AI Suite 3?

There were only a few users who reported the issue with an ASUS MB. I have such system with AI Suite III installed, however, everything has been working fine and haven't experienced any problems with system freezes.
Link to comment
Share on other sites

 

Heres hoping the pre release fix holds. I appreciate them putting a fix out for this but this is the second major problem (assuming this fixes it) I've had with the product now this year after being a user for a long time.

 

Our investigation shows that the culprit is Gigabyte and ASUS applications and some other vendors have noticed the same issue with their scanners while these applications were installed. We only made a workaround via a module update as there was nothing to fix on ESET's side.

 

If you are still having issues with ASUS MB despite having Antivirus and antispyware module 1462 installed, we'll need a complete memory dump from BSOD or a manually generated dump if the system freezes.

 

 

Apologies if i came across a little curt - hardware freezes are aggravating to say the least and my patience with it had grown thin. Unfortunately had my first lockup since the module fix but I have some suggestions to work with here at least.

Link to comment
Share on other sites

There were only a few users who reported the issue with an ASUS MB. I have such system with AI Suite III installed, however, everything has been working fine and haven't experienced any problems with system freezes.

 

Oh?! So here is my vote then. Hello forum.

 

NOD32, ASUS Gryphon Z87, Windows 7. System freezes a few minutes after boot, exactly at the moment when NOD32 tries to update. That is when the spinning icon appears on the task bar. It happens always. No, I can not provide a dump, because it stalls completely. No, I will not remove my system utilities. Please get this fixed,

 

But take your time, I have 23 days left for my Kaspersky trial.

Link to comment
Share on other sites

Echoing MaxBallauf above, I cannot provide any memory dumps as my system is frozen. This has been ongoing for more that 3 weeks now - has this issue been parked by ESET? I have been using Eset products since 2007 so I'm reluctant to dump them, but I cannot forgo protection much longer.

Link to comment
Share on other sites

  • Administrators

Echoing MaxBallauf above, I cannot provide any memory dumps as my system is frozen. This has been ongoing for more that 3 weeks now - has this issue been parked by ESET? I have been using Eset products since 2007 so I'm reluctant to dump them, but I cannot forgo protection much longer.

 

Please perform the following tests which will shed more light into the issue you're having:

 

TEST1

- update machine from pre-release servers

- set all settings to default values

- make sure that Antivirus and antispyware module installed is version 1462+ and HIPS 1188+

- disable Advanced memory scanner

- reboot the machine

Does the issue persist? If so, provide us with a dump + ESI log + hipsRules.bin file located in programdata\eset\... folder).

 

TEST2

- update machine from pre-release servers

- set all settings to default values

- disable network connection permanently so that the PC won't be connected to network after a reboot

- in safe mode replace em001_32 with the attached one

- reboot the machine

Does the issue persist? If so, provide us with a dump + ESI log + hipsRules.bin file located in programdata\eset\... folder).

 

TEST3

- update machine from pre-release servers

- set all settings to default values

- disable network connection permanently so that the PC won't be connected to network after a reboot

- in safe mode rename em001_32.dat file to em001_32.dat_ORIG

- reboot the machine

Does the issue persist? If so, provide us with a dump + ESI log + hipsRules.bin file located in programdata\eset\... folder).

 

TEST4:

- update machine from pre-release servers

- set all settings to default values (em001_32.dat is present and is not renamed)

- make sure that Antivirus and antispyware module installed is version 1462+ and HIPS 1188+

- disable network connection permanently so that the PC won't be connected to network after a reboot

- in safe mode rename em018_32.dat file to em018_32.dat_ORIG and (if exists) em018_64.dat to em018_64.dat__ORIG

- reboot the machine

Does the issue persist? If so, provide us with a dump + ESI log + hipsRules.bin file located in programdata\eset\... folder).

em001_32.dat

Link to comment
Share on other sites

From the looks of all the posts since mine on the first page, ESET is persisting in trying to push this on us and our PCs. Regardless of the fact that the problem started, at least on my PC, after THEIR update and ABSOLUTELY NOTHING had changed on my PC.
I'll give it another month and check back again. If they still are, I'll be dumping ESET from all my devices (PC, laptop, Android phone and tablet)

Link to comment
Share on other sites

  • Administrators

From the looks of all the posts since mine on the first page, ESET is persisting in trying to push this on us and our PCs. Regardless of the fact that the problem started, at least on my PC, after THEIR update and ABSOLUTELY NOTHING had changed on my PC.

I'll give it another month and check back again. If they still are, I'll be dumping ESET from all my devices (PC, laptop, Android phone and tablet)

 

The problem does not seem to be with ESET but with how AI Suite III works. This was also a problem of Gigabyte AppCenter, however, in that case we obtained dumps from users and were also able to reproduce it which enabled us to make the appropriate exception so that the problem does not manifest. Unfortunately, we weren't able to reproduce it with an ASUS-based pc nor didn't get any useful dumps from users. Unless users start to co-operate or we manage to reproduce the problem, we are in a blind alley and cannot make any workaround for users with AI Suite III installed.

Link to comment
Share on other sites

i have a sabertooth z87 with the AI Suite 3 installed

eset smart security version 8.0.312.0

virus database 11961

windows 7 pro 64 bit

 

can not supply memory dumps or error logs with this system cause none are produced

the system just locks up with the mouse locked to the center of the screen on the windows desktop the reset button no longer functions the only way to reset is to hold in the power button for 4 secs till system shuts down.....

 

no blue screen, no logs made i have tried everything i know to make it produce these logs for you guys

 

 

this is not a solution to fixing this... just makes it so the system will function for now

in the windows/system32/drivers/ehdrv.sys i renamed this file to ehdrv.sys.old in safe mode which shuts down HIPS and it runs stable this way

Link to comment
Share on other sites

well the memory dump is 683MB worth no way that is going to send through my email box..... So how do i get that too you

 

Before you send the dump you have to compress it (if you haven't done that already).

 

You could use wetransfer.com to send the file.

https://www.wetransfer.com/

 

When the upload is done, copy the download link and send the link in a PM to Marcos on the forum.

Link to comment
Share on other sites

It seems that Gigabyte has an application called APP Center which is capable of updating drivers and BIOS automatically. Did you notice it performing an automatic update yesterday? If the application has logs, are there some recent records of driver or BIOS updates?

 

 

The problem does not seem to be with ESET but with how AI Suite III works. This was also a problem of Gigabyte AppCenter, however, in that case we obtained dumps from users and were also able to reproduce it which enabled us to make the appropriate exception so that the problem does not manifest. Unfortunately, we weren't able to reproduce it with an ASUS-based pc nor didn't get any useful dumps from users. Unless users start to co-operate or we manage to reproduce the problem, we are in a blind alley and cannot make any workaround for users with AI Suite III installed.

 

Hello Forum, Hello Marcos,

 

I’m just watching the case all this time, but finally decide to come in and tell …

 

My problem also arose exactly 22 June, when stably working system suddenly goes to BSoD. After restart it started normally and seams OK first, but then repeated BSoD, three or four times that evening. Bluescreen Viewer pointed out to hal.dll and ntoskrnl.exe (0x00000124), all exactly as described by Henduluin, dwu and others in the beginning of this topic. Next few days a hardware testing was performed with no suspicious results… Then I noticed that ESET SS indicates broken (unsuccessful) update and decided to update it manually –> immediate BSoD at the process! Each attempt, steadily. Then I reinstall the SS, and it managed update to the latest files successfully. But only until computer restart: BSoD immediately after system logon with no possibility to see the Desktop. Starting in Safe Mode, system restoring , uninstalling SS thoroughly with removal tool (ESETUninstaller.exe) followed by registry and disk scan for any remnants, new attempt of clean installation of fresh-downloaded Smart Security Ver.8.0.312.0, and again BSoD after system logon at reboot…

 

Again system restoring, cleaning PC thoroughly with removal tool, and just UNPLUGGING INTERNET CABLE out of this PC for safety, what you can guess is EXTREMELY inconvenient… Here I am up to now for more than a month, still waiting for you with a final solution.  :(  However, the PC is rock stable now without AV all this time under heavy load: numerical calculations, video processing and other intense parallel jobs.

 

So my questions are:

1.       If you suspect the Gigabyte APP Center as the source of problem, why this only happen at June 22, 2015, while more than the year before the system was stable with it and ESET SS? Why it is stable now, without SS? I did not change ANYTHING, besides ESET SS uninstall! I checked all the files for AppCenter which I was able to find, and none of them were younger than 2014. Automatic update checking was switched off in the AppCenter settings after installation, just as “run on next reboot” checkbox is also unchecked. Nobody could manually update it on this PC, I’m the sole user; moreover, APP Center as an application itself doesn’t included in system startup in any way. Consequently, the conflict seems to be very odd for me. Could you explain: how it can be, please?

2.       If it is known that any part of AppCenter application is performing some hidden background actions (changes, updates) could you please point out specifically: which exactly file (module, driver, process) of the application is the culprit? I will check if it was somehow modified at June 22 or not long before.

3.       Could you estimate, when except correction mentioned above will be available as the regular ESET Smart Security Setup? Do I really need to uninstall/reinstall APP Center as pizzly did, if I would like to keep both apps then? I am waiting for the FINAL solution and will not experiment a lot with this PC. Do not want to retire ESET, but can’t keep the whole PC in quarantine without network for a long!

 

My system is:

Gigabyte GA-Z87X-UD5H with Intel i7-4770K, 32GB RAM, SSD, HDD, Dataram software RAMDisk (commercial version). No overclock, no separate video card. Win 7 x64 SP1 Enterprise; APP Center V.1.0.0.0.

Link to comment
Share on other sites

All....I have the same issue and it started sometime in the middle to late June.  I didn't have time to look into it until yesterday.  I found that uninstalling ESET antivirus (7.0.302.26) has solved the BSOD problem.  I'm sort of disappointed that this issue hasn't been fixed already in a a way a non-computer person could do it.  

Link to comment
Share on other sites

  • Administrators

All....I have the same issue and it started sometime in the middle to late June.  I didn't have time to look into it until yesterday.  I found that uninstalling ESET antivirus (7.0.302.26) has solved the BSOD problem.  I'm sort of disappointed that this issue hasn't been fixed already in a a way a non-computer person could do it.  

 

The problem is that although we've got hold of an ASUS system with AI Suite III installed, we haven't experienced any issues with it. Please refer to my post https://forum.eset.com/topic/5217-eset-smart-security-causing-false-0x00000124-bsods/page-5#entry30107, carry out all 3 tests and let us know about the result. Without getting the issue reproduced or without the help of users, it's impossible to figure out the cause.

Link to comment
Share on other sites

  • Administrators

1.       If you suspect the Gigabyte APP Center as the source of problem, why this only happen at June 22, 2015, while more than the year before the system was stable with it and ESET SS? Why it is stable now, without SS? I did not change ANYTHING, besides ESET SS uninstall! I checked all the files for AppCenter which I was able to find, and none of them were younger than 2014. Automatic update checking was switched off in the AppCenter settings after installation, just as “run on next reboot” checkbox is also unchecked. Nobody could manually update it on this PC, I’m the sole user; moreover, APP Center as an application itself doesn’t included in system startup in any way. Consequently, the conflict seems to be very odd for me. Could you explain: how it can be, please?

We don't suspect it, we have indeed confirmed that a driver utilized by APP Center was performing a memory mapping in a non-standard way that was explicitly not recommend by Microsoft due to possible issues that might occur in such case. The issue manifested when Advanced memory scanner was scanning memory utilizing standard API functions and that was not against recommendations by Microsoft.

 

We've already made a workaround for users with Gigabyte motherboards and released the appropriate module. Are you still having issues despite having current modules installed? Could you please post the information about installed modules from the About window?

Link to comment
Share on other sites


@ Marcos

 

OK, I can accept the statement as true; I understand this fact even from previous posts. Things may happen indeed; I know this well, being a software engineer. But please, could you just answer on my QUESTIONS?

 

First of all I’m wondering what’s happen at June 22 (or shortly before) and simultaneously in many systems? My PC was stable with BOTH applications before, for a long time, and the problem is definitely linked to some changes during late June! Was it AppCenter or ESET or Windows modification? Or what???

 

I have also questions 2 and 3, please do not ignore, if possible. Take your time if you need, I’ll be patient!

 

On your question: definitely I can post any useful information, but what modules did you mean? If ESET-related, I have no one at the moment, as described in my first message.   However I can install and check any one recommended at the nearest weekend.


 

Link to comment
Share on other sites

  • Administrators
First of all I’m wondering what’s happen at June 22 (or shortly before) and simultaneously in many systems? My PC was stable with BOTH applications before, for a long time, and the problem is definitely linked to some changes during late June! Was it AppCenter or ESET or Windows modification? Or what???

 

Memory scanning was improved via a HIPS module update which caused the mentioned issues with problematic drivers that were developed in a way not following Microsoft's recommendations.

Link to comment
Share on other sites

 

First of all I’m wondering what’s happen at June 22 (or shortly before) and simultaneously in many systems?

As Marcos said. They improved their memory scanner. Which revealed a bug in both Asus AI Suite 3 and Gigabyte APP Center, the system utilities of two major mainboard manufacturers. A non-standard memory mapping thing. But only on z87/z97 chipsets, as it seems. Don't you get it? :)

 

 

Well, on the ASUS side, the issue persists, when the scanner is disabled.

https://forum.eset.com/topic/5202-bsod-ekrnexe/page-3#entry29627

 

and is instead triggered exactly when NOD32 tries to update, or whatever it tries to do, when it shows that update icon:

https://forum.eset.com/topic/5217-eset-smart-security-causing-false-0x00000124-bsods/page-5#entry29919

 

which looks a little bit like this one (only that my machine freezes when it happens for the first time, so there is only one update icon):

https://forum.eset.com/topic/4027-eset-smart-security-crashing-and-restarting-in-windows-10-build-9926-ess-version-80304/#entry23839

 

and it sounds like this one:

https://forum.eset.com/topic/4027-eset-smart-security-crashing-and-restarting-in-windows-10-build-9926-ess-version-80304/#entry27917

 

 

 

Never mind,

Link to comment
Share on other sites

  • Administrators

We're going to release an updated Anti-Stealth module 1081 with a workaround for this kind of issues soon. It should be available on pre-release update servers first, with regular update servers to follow.

Link to comment
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...