Aggain, Eset crashes

[Guest Flew]

After apparantly succesfully restoring and updating the image everything seemed fine till I accessed Outlook Express (Win XP SP 3, 2004 AMD CPU). Suddenly the application crashed. First I got the Eset service error, then 'failure to read (or access?? not sure) firewall configuration'. Next thing, Eset seemed to be missing from the task bar (bar at the bottom of the screen) and Windows reported something about Eset or the firewall being disabled/absent.

 

I am not pleased !

 

I restarted the computer and Eset seemed fine again. However, for the time being I'll use something else.

 

I've had some Eset service errors recently when trying to access Outlook Express (after which I decided to restore an image).

 

 

Perhaps this can be fixed ?

[Arakasi 549]

Do you have document protection enabled ?

[Guest Flew]

I'm sorry about the typoes. Right now I'm dealing with svchost.exe at/near 100 % of my CPU. Not sure if it's related.

 

And I just noticed that Eset states thet the OS is out of date, there is a list of missing updates that I must have installed in the past.

 

 

[Guest Flew]

Document protection is not enabled.

[Guest Flew]

Everything is mostly at default, except that all categories for antivirus and antispyware are ticked, the firewall is at interactive and anti-theft is not enabled.

[Arakasi 549]

Marcus mentioned something about the document protection having conflicts with outlook.

I would start with everything unticked then 1 at a time tick to maybe find the culprit.

Svchost could be anything...

I know its hard to get forum support over the weekends. But most crashes and causes can be identified in sysinspector or event viewer.

I never recieved your system evtx. Only 1 entry.

Ill be around most the day. Evenings and weekends are my free time.

While fixing computers and networks are what i do during weekdays lol

[SweX 871]

Considering that I also have an AMD CPU form around that time 2003/2004 (Athlon 2800+) It might be worth to say that I too had the issue with an svchost.exe process that used around 100%. And of course the PC was unusable at that moment, so I restarted and it was fine after the restart, and since then I have never seen an svchost.exe use 100% CPU. 

 

I can't say anything about the Outlook issue since I don't use Outlook. But provide ESET with whatever logs they want from you so they can fix all the issue that the AMD CPUs 2003/2004 together with Win XP SP3 seem to cause for people. You, myself, and afaik member KOR also got an AMD CPU and XP SP3.

Edited August 18, 2013 by SweX

[Guest Flew]

Right now I'm using a different security setup so I don't have any logs available. but if I'm not mistaken, are those logs not sent to Microsoft ? I don't recall being offered to send any data to Eset, but maybe that's me.

 

Or does a 'log' refer to something else ? In my case the Eset 'security center' had disappeared so I doubt I would have been able to send anything. It was back after a reboot.

 

I also have an Athlon 2800+

 

Perhaps the svchost thing was related to MS update somehow. I tried to update, got the 100 % CPU svchost for some time and I had to stop trying. Same for letting the system do an automatic update on its own. At or near 100 % CPU. After I turned off MS update and set the MS update service to manual, some updates that I had downloaded in the past seemed to be missing according to the Eset security center ! That was probably the point I gave up.

 

I'm using Outlook Express, not Outlook.

 

[SweX 871]

Right now I'm using a different security setup so I don't have any logs available. but if I'm not mistaken, are those logs not sent to Microsoft ? I don't recall being offered to send any data to Eset, but maybe that's me.

 

Or does a 'log' refer to something else ? In my case the Eset 'security center' had disappeared so I doubt I would have been able to send anything. It was back after a reboot.

 

I also have an Athlon 2800+

 

Perhaps the svchost thing was related to MS update somehow. I tried to update, got the 100 % CPU svchost for some time and I had to stop trying. Same for letting the system do an automatic update on its own. At or near 100 % CPU. After I turned off MS update and set the MS update service to manual, some updates that I had downloaded in the past seemed to be missing according to the Eset security center ! That was probably the point I gave up.

 

I'm using Outlook Express, not Outlook.

Right, no I don't meant that type of logs, that is basically just "statistics"  sent away to MS, personally I never send these logs to MS. 

 

Anyhow, by logs I meant logs that ESET may ask you to create, but if Marcos or anyone else haven't asked you yet they may do so sooner or later, but you need to have ESS installed in order to make the "issue" appear so the logs are created and so forth.

 

Ah well, I don't use Outlook Express either. So I can't check if I got the same problem with it.

[Arakasi 549]

I was referring to system event viewer. Regardless of having ess installed these logs are still available going back for months.

Control panel > Admin tools > event viewer is one way to get to it.

Eset will primarily want sysinspector logs which is more specific to eset afaik.

[Marcos 5,070]

When reporting an issue to ESET, an ESET SysInspector log is the most essential thing to get for analysis along with the information which of the protection modules needs to be disabled in order for the issue to stop manifesting. Feel free to send me the log attached to a personal message.

[Guest Flew]

Thanks for offering me help, but it seems the issue has been fixed.

 

Now I can use Outlook Express without issues, no more crashes. This is after restoring an image.

 

I still had to deal with svchost consuming 100 % or close to 100 % of the CPU. Apparently, Microsoft Update seems to do that.

The manual MS update seems to be out of the question, it 'locks' the computer  at/near 100 % CPU for svchost, seemingly without end.

Letting it update by itself (MS update set to 'notify') resulted in a similar svchost issue, except that at one point it ended and several updates were available. Btw, while the CPU utilization was rather excessive, it appears there was plenty of RAM available (of a total of 512 MB).

 

 

[Guest Flew]

I responded in 'Latest update for Smart Security seems to crash application'.

 

The Eset service error seems to be back, perhaps in a different way. No more missing firewalls.

 

I did create a snapshot, but there is a lot of information in that and I don't want to send anything 'personal'. Right now I don't have the time to go through all that. It's a trial version.

[Marcos 5,070]

If the ESET service (ekrn) crashes, enable generation of complete application memory dumps in the main setup -> Tools -> Diagnostics. When it crashes again, please compress the dump, upload it to a safe location and pm me the download link.

[Guest Flew]

Well, I didn't get around to doing that and i just tried. Under 'tools' there does not seem to be an option called 'diagnostics' !
 
Is perhaps this error message (technical details of any use) ? :
szAppName : ekrn.exe     szAppVer : 6.0.316.0     szModName : msvcr80.dll    
szModVer : 8.0.50727.4053     offset : 00015849
 
It happened when I opened Outlook Express (keyboard) while both IE 7 and opera 12.15 were open.
 
Everything seems to work fine for most of the time. According to the eventvwr, the eset service restarted on its own.

[Marcos 5,070]

You can find diagnostic settings here:

 

[Peter Randziak 1,130]

Hello Flew,

 

please try updating from pre-release servers.

Anti-Stealth support module: 1051 should be fixing issues with crashing ekrn.exe catalyzed by Outlook express starting.

 

Please let us know.

[PodrskaNORT 17]

Flew,

If problem is still present - did you try to disable Automatic updates /Windows update service (and restart afterwards)?

 

Someone mentioned Windows update could be the reason, and I second that oppinion as a most suspicious point.

 

Tomo

[SweX 871]

Considering that I also have an AMD CPU form around that time 2003/2004 (Athlon 2800+) It might be worth to say that I too had the issue with an svchost.exe process that used around 100%. And of course the PC was unusable at that moment, so I restarted and it was fine after the restart, and since then I have never seen an svchost.exe use 100% CPU. 

Hmm I just had the problem when an svchost.exe process started to use 95-99% CPU again.

 

And the only way to get it sorted was as I say in the quote above to restart. After that it's just fine. 

 

First time it happened was the same day I installed the ESS V7 BETA. (104)

And then again today 3-10 min after I turned the PC on.

 

But there is no way I can re-produce this just like that, considering that I have probably turned off, and turned on the PC 30-40 times since it happend the first time. 

 

OS is WinXP SP3.

[Aryeh Goretsky 378]

Hello,

A few minutes after V7 is installed on a system for the first time it performs a full scan. Perhaps that is what you saw?

Regards,

Aryeh Goretsky

[SweX 871]

Hello,

A few minutes after V7 is installed on a system for the first time it performs a full scan. Perhaps that is what you saw?

Regards,

Aryeh Goretsky

Hi Aryeh.

 

No I don't think so (well not today the second time anyway), as the ESS V7 BETA has been installed 30-40 days, and as I said it has only happened two times, the day it was installed, and then again today. And the svchost.exe process just stays at 95-99% CPU usage there's no way stopping it as far as I have found, and in both cases I made a restart to make it stop and it was back to normal after the restart.

Edited September 11, 2013 by SweX

[SweX 871]

Again today it has happened two times, one svchost.exe process used 99% CPU. First time I restarted as that has helped before, but it started again after the restart so I waited a while longer to see if I could spot any connection to this in the task manager, and I did see that the startup scan was running but it never finished it was running and running, it took at lot of time over 2 Min until it was done.

 

So the startup scan could very well be part of the problem here. 

 

Usually the startup scan finishes in between 3-10 seconds, but today it runned for 2,28Minutes. And all this time that svchost.exe process used 99%CPU and everything became slow because of that obviously. 

[SweX 871]

OK update two.

 

It happened once again just now 5min ago, I saw a popup notfication saying "The programs module have been updated" and after that bam an svchost.exe process started using 99% CPU again. But I restarted straight away when I saw it happening as I didn't know for how long it could go on. So no startup scan involved this time.

 

This needs to be fixed, or else I will uninstall and wait for the next BETA.   And I also don't get it why it's more frequent now the past 2 days, nothing has been updated in the system, though I was about to run a Windows update earlier today but I put that on hold for now, as it would likely not work well if svchost.exe start to use 99% CPU in the middle of the win update process.

 

Right now at this very second everyting is normal 

Edited September 12, 2013 by SweX

[Peter Randziak 1,130]

Hello Swex,

 

please provide us with SysInspector log and manually created full memory dump from that state.

Please let the svchost.exe use CPU for al least minute or two.

[Marcos 5,070]

When you encounter the issue, we'll need to get the following:

1, a complete memory dump created manually as per the instructions at hxxp://msdn.microsoft.com/en-us/library/windows/hardware/ff545499(v=vs.85).aspx

2, SysInspector log

3, information about installed module

4, export of product settings

5, information about the OS and platform (should be included in the SysInspector log)