ekrn.exe hangs on user login

[silnocus 0]

We've been having an intermittent issue with ESET Endpoint Security on our client machines located within the domain, in that ekrn.exe will hang when a user tries to log in (usually first thing in the morning) causing the computer to get stuck at the Windows 7 "Welcome" loading screen. With some luck, we can get them logged in after a time, sometimes by simply waiting, sometimes by force-restarting the computer. The computers this happens to don't all do it every day, although some of them do.

 

We've tried reinstalling Endpoint Security on these PCs, but to no avail. I've attached a "Report.wer" (renamed to .txt) from Windows Error Reporting, which, as far as I can tell, is the same error that shows up on every computer that does this. The Event Log shows nothing particularly helpful other than that "ESET Service" failed to start.

 

This has been occurring since we started using this product, about 2 months ago. I've run out of ideas, and would really appreciate any help, or if this is a known issue with a fix, some direction.

 

Thank you.

 

Report.txt

[Marcos 5,278]

Are there any dumps created in the "C:\ProgramData\ESET\ESET Endpoint Security\Diagnostics" folder? If so, please upload the recent 1-2 dumps to a safe location and pm me the download link. Also make sure that KB2664888 is installed (hxxp://support.eset.com/kb2567/).

[silnocus 0]

There are dumps, but they are empty, showing 0 KB, nothing when opened in Notepad++. Would you still like me to upload them?

 

I've applied Part I of that KB article to the ERA Server (replacing the network.dll). If the issue continues until tomorrow morning, I'll try Part II (installing the hotfix).

[gobbli 0]

same here on some Windows 7 Pro Computers and Domain login. Can´t post a logfile today because i am not at office

Edited February 1, 2016 by gobbli

[Marcos 5,278]

There are dumps, but they are empty, showing 0 KB, nothing when opened in Notepad++. Would you still like me to upload them?

 

I've applied Part I of that KB article to the ERA Server (replacing the network.dll). If the issue continues until tomorrow morning, I'll try Part II (installing the hotfix).

 

Installing the hotfix is important. Replacing network.dll is just a workaround to prevent the bug in Windows Filtering Platform from manifesting, however, the bug will still be there and certain network-aware applications that utilize WFP may trigger the very same issue.

[silnocus 0]

 

There are dumps, but they are empty, showing 0 KB, nothing when opened in Notepad++. Would you still like me to upload them?

 

I've applied Part I of that KB article to the ERA Server (replacing the network.dll). If the issue continues until tomorrow morning, I'll try Part II (installing the hotfix).

 

Installing the hotfix is important. Replacing network.dll is just a workaround to prevent the bug in Windows Filtering Platform from manifesting, however, the bug will still be there and certain network-aware applications that utilize WFP may trigger the very same issue.

 

Apparently so, it's happened again a few times. Strangely enough, we've found that just opening Computer Management and connecting to the offending computer with it seems to immediately resolve the issue, so we've found a temporary fix for our particular situation.

 

Regardless we've begun installing the appropriate hotfix on the computers displaying the issue. I'll post back here in a few days with results.

 

Thanks for your help.

[silnocus 0]

Applying Hotfix KB2664888 has worked on every computer we've tried it on so far. I'm going to go ahead and call it a win. Thanks for all your help!

Edited February 29, 2016 by silnocus