Severe XP SP3 issues when combined with NOD32 Antivirus

[jayneg]

Hi there moderators.

This is a followup from a post from a while back with a similar topic title. I had posted info about new incompatibility with Eset NOD 32. I'd like to continue exploring this as it is unresolved and the plot only thickened with a new recent discovery!

Here is the original post:

[snip]

Hello. I haven't seen anyone post about NOD32 Antivirus 4.x. I install the free version on most of my customer's machines. Win7/Vista = no problems. WinXP SP3 = same hard crashing as mentioned above by many. I am one person, but am a tech and have installed MB 1.60.1.1000 & 1.60.1.1800 on dozens of machines in the past month or three and I am getting SLAMMED with calls about computer freezes from my customers with XP.

When 1.60.1.1000 first came out and started crashing machines, I did indeed use the MBAM_cleaner to perform a clean uninstall. Upon reinstallation it seemed to work for a bit, but alas, 1.60.1.1800 came out and auto downloaded and all the machines starting crashing again upon reboot. (Quietly in the back of my head, I thought, they didn't fix all of it yet... I hope someone tells them about the newly created incompatibility with NOD32!)

The IMPORTANT part of my story is that this is even happening with NEW WINDOWS BUILDS, meaning, I have: tested the hard drive for bad sectors, wiped the hard drive, reinstalled windows, patched windows fully, disabled windows firewall, installed MB 1.60.1.1800, then NOD32 Antivirus 4.x and then CRASH!

No need to use the cleaner as this is a brand new build.

I am one person, but have experienced this hard crashing described in this thread on dozens of XP SP3 machines most of them being new builds with the commonality of NOD32 Antivirus 4.x and MB 1.60.1.1800, and in the case of old builds, the problem persists after using the clean uninstall utility and reinstalling 1.60.1.1800 from scratch. As soon as you enable the protection module... BLAM! Within a few seconds, it's cyber bedlam.

You cannot stop NOD32 from running its startup scan. My temp fix is to disable the protection module so I have control of the machine long enough to uninstall MB. Even with the protection module off, the MBAM.exe process still runs and crashes the machine at startup, so I have to uninstall the program entirely and wait for the next version which will hopefully have a fix.

Hopefully with the info contained in this post, you wonderful folks at MB will be able to contact "Eset", the makers of NOD32, and have a chit chat...

I have touted MB for years as being a rare and wonderfully harmonious program that just seems to work well with others. My winning combination of protection was NOD32 2.x and then 4.x, MB and SuperAntiSpyware. I could run all three program scans at once with NO problems as they all scan in different ways and don't step on each other’s toes. But with the advent of MB version 1.60.1.1000, something went awry. Please, please, please know that 1.60.1.1800 has NOT solved all the issues!

Thanks,

Jayneg

[end snip]

I have to make some clarifications/additions to that 1st post:

1. This only affects paid for /trial versions of MB. The free version is fine due to MBAM service not running...

2. I may have been hallucinating, but I swear I BRIEFLY saw a version 1.60.1.1800. It may have only been out there for an hour or a day, and that's what I thought was the latest version when I 1st wrote the post a while back. In the end, it doesn't matter. The problem began in the version just before 1.60.1.1000 (1.60.0.1800?) and persists in the current version! Plus I made a new discovery which I will detail in a bit

4. One of the admin’s replies to this first post:

"I would love to test this out for you Jayneg but I'm not aware of any "free" version from ESET. They do offer a 30 free trial but it's certainly not a free version that I'm aware of. If you can provide more details on that I will investigate this error you're speaking of."

*To clarify, when I am preparing a machine, I install the trial (which is a full version, but with a 30 day countdown timer). After this trial period is up, many customers go on to purchase the full program... But it did not matter if it was the trial or the paid version, the problem was occurring regardless. I realize I used the word "free" instead of "trial" in the original post. Sorry for the confusion.

3. After posting this, I started migrating folks over to the latest release of NOD 32 5.x to satisfy the MB admin's request and POOF! Same problem with the ADDITION of a new problem:

4. In NOD 5.x, there is a new feature that watches for and scans removable media when 1st inserted. Well, if MBAM.exe is running in Win XP SP3, your machine quickly grinds to a HALT whenever an external hard drive or USB key is inserted. The only solution: hard kill! I will give the link to the thread AND cut & paste from the forum I found this info on:

http://www.wildersse...ad.php?t=309335

[snip from page 7, post #155]

March 5th, 2012, 06:58 AM

rcdailey

Regular Poster

Join Date: Dec 2009

Posts: 141

Re: NOD 32 5.0.93.0 & 5.0.94.0:PC freezes when USB HD is connected

Quote:

Originally Posted by Marcos

Oswald2 resolved the issue by installing the hotfix already provided to those who requested it here before.

I believe that I have isolated and resolved the issue I was having with NOD32 v 5.0.95.0. The conflict that I found and eliminated was with MalwareBytes. I have the paid version of that software and I found that even with real-time protection disabled in MalwareBytes, the MBAM service would still load with Windows. This service was what prevented ESET NOD32 from checking when a drive was initially connected to the system while up and running. When this happened, the system would lock up. By either disabling the MBAM service or setting it to "manual," the conflict went away and the popup to select the action to take with respect to the USB drive would display and the appropriate option could be selected.

In any case, with my system running XP SP3, this is what I found and how I decided to handle it. I also have SuperAntiSpyware ver 5.0.1144 installed and running in real-time and it does not conflict with NOD32 ver 5.0.95.0. It is a little disappointing to have to disable MalwareBytes, but I can live with it.

I can now connect a USB hard drive while the system is running and it won't lock up. I can remove a USB hard drive while the system is running and it won't lock up. If anyone else using XP SP3 is running MalwareBytes in real-time and is having issues with ESET NOD32 v 5.x, try disabling the MBAM service and see whether that solves the problem. Adding to this, MalwareBytes will run a scan and can be updated manually without the MBAM Service enabled. I have checked that just now and can confirm that. Also, if the MBAM Service is set to "manual" it does not load when MalwareBytes is run. For most people who like to use MalwareBytes, that should be enough and there won't be a conflict with ESET NOD32 ver 5.x. One more note: If you do have the paid version of MalwareBytes and you decide to re-enable protection, then the MBAM Service will be reset to "automatic" and it will load with Windows, so keep that in mind.

Last edited by rcdailey : March 5th, 2012 at 07:31 AM.

[end snip]

My only comment on rcdailey's post is that when you change the MBAM service to manual start in "services", MB starts spitting out periodic error messages about not being able to perform expected tasks. So, to me, this is not an option when preparing a customer's machine. They won't understand/want to see any error messages on a clean built/fixed machine. So AGIAN, my only option is to uninstall MB! Boo!

I'd like to also add that I vouch for rcdailey's post. I tested it out. NOD32 + MBAM service running + plug in USB HD/USB key = disaster (hard kill only way to shut machine off)

As soon as I turn MBAM service off, all systems nominal! I think MBAM service and NOD removable media watch service (not sure which process it is) are fighting!

In closing, I assert that this is happening on ALL the XP machines I'm working on (over 100 by now) and there are no infections and that the systems are fully patched and all hardware is tested good.

Final clarification: The problem where the XP machine would just lock/freeze at startup just outright without doing anything else seems to have gone away, although NOT with the release of the latest version. Did you guys sneak in a mini-patch on one of the definition updates? XP seems to get through the startup sequence now without crashing on its own, but only as of about a few weeks ago?!? (mystery) So I thought to myself YEAY! They fixed it in an unadvertised, non-version number changing mini-patch! I began installing it again on all my customer machines and then got hit with the External HD problem! ARGH!

One last observation: There is even new quirky behavior in a few Win7 machines with NOD 5.x and MB newest ver. Again, it usually happens right at startup when I sometimes try to terminate mbam service from taking over 100% processor, so i can quickly bring up a video or program, the machine will lock up just like with XP. It feels different and of course it is being brought on by my terminating a running service, but the combo of Eset and MB both eating up startup juice for the first two minutes is sometimes too much to bear. & windows shouldn't totally hose itself from terminating a "non-critical" process. This is just a side note; something to think about in the future... The MAIN problem is XP as outlined above. What other info do you need from me to help you resolve this? NOD & MB used to work harmoniously together. Now between the latest few releases from both companies, this has changed... Please get on the "phone" with Eset and do some testing collaboratively.

THANKS-

Jayneg

[daledoc1]

Hello, jayneg:

Until an MBAM staffer arrives.....

I haven't seen many/any posts lately about compatibility issues with MBAM and NOD32, especially with v5.

(The past updating issue was resolved months ago with the release of v. 1.60.1.1000 -- this is the most current official release, although there is a BETA of 1.61.0.1300 being publicly tested now.)

Having said that, since your post seems to indicate that you are using/installing MBAM in a technician/repair shop/business/corporate environment, you probably ought to contact the corporate help desk directly for one-on-one assistance with your issue.

Please contact corporate support HERE.

Also make sure you have malwarebytes.org and salesforce.com in your Safe Sender list in your email program.

In order to assist you better please provide the following information when contacting them:

Cleverbridge Order Reference Number:

Organization name:

Approved Contact name:

If you no longer have access to the order number, you can contact Cleverbridge to obtain information about your order:

Cleverbridge customer service

cs@cleverbridge.com

Phone: +1-866-522-6855

Monday - Friday: 8:00 AM - 8:00 PM (CST)

Thank you very much,

daledoc1

[Strenalis]

Hi Jayneg,

Sorry for the late response! Before I can investigate your first issue, it would be great if I could get some information about your setup process. What version of NOD32 4 are you using? You can determine this by opening NOD32, clicking on the Help and support tab and selecting "About ESET NOD32 Antivirus". The reason I ask is because I'm attempting to replicate this issue by installing both NOD32 4.2.71.2 and MBAM 1.60.1.1000 in an XP SP3 environment, but so far I've been unsuccessful in freezing the system. Does the freeze occur only during startup after both programs have been installed? Are you using a different version than I am? The more details you can provide, the better.

For the second issue regarding external USB devices, we are currently looking into this in correspondence with ESET to find the source of the problem.

Thank you very much for following up and bringing this to our attention.

[davidi]

More info as I know it to be (check with Marcos at ESET in below referenced forum/thread or other knowledgeable ESET programmers):

LONG ESET thread but jump to this post and read it and information around page 9 (ie - safe yourself a couple hours of having to read pages 1-7 or so): http://www.wilderssecurity.com/showpost.php?p=2064391&postcount=215

Happens with only XP SP3 systems (32 bit and 64 bit) [Not Vista, Not Win 7] with MBAM Pro/paid (I'm using 1.61.0.1400) and ESET 5.0.93, 5.0.94 and most recent version ESET 5.2.9. (ESET NOD32 though likely also their Security Suite product as well as I believe it has the same AV core and thus the same external USB device connection/detection code in both - conjecture on my part.) NOTE however that this issue did NOT occur with ESET's version 4 or version 3 code base (AFAIK) but only with their new functionality in the 5.x code base that has code that now is on the lookout for connection of certain types of external USB devices (hard drives, usb flash drives) and then would want to ask the user if they wanted ESET to scan them now or scan later. So - if you have a 4.x version of an ESET product you likely will NOT experience or see this. You need to have ESET 5.x.

From reading earlier posts in that long ESET thread it seems as if there were at one time several software vendors that had drivers in the same area where ESET was trying to do its job and there were conflicts. My interpretation from the thread is that ESET found a 'workaround' and implemented it in their 5.2.9 code and it's acceptable for a lot of apps that did have conflicts ***however*** MBAM remains a serious issue.

The only answer right now as far as I know is to disable mbam service (from automatic to disabled or manual) or effectively turn off the features of active (paid) protection that mbam pro users have paid for. When the mbam service is not running then external USB devices can be hooked up to the XP system and ESET seems to be free to ask the user if they want to 'scan now' or 'scan later'. But with MBAM service running it is my experience (and it seems many others) that a Windows XP PC with ESET 5.x and MBAM service will 'lock up', freeze, hang. No chance for even cntrl-alt-del. Only option - hard restart (5 second start button push) of the XP system. And even then - you really need to go into safe mode and disable the mbam service and then restart to end up with a system protected by ESET that doesn't hang when a USB HD is attached to the system (although there is no longer any 24x7 protection from MBAM now.)

My post (plea) to ESET/Marcos is http://www.wilderssecurity.com/showpost.php?p=2067033&postcount=218 is asking to be kept in the 'know' about when there is a compatible resolution between MBAM and ESET. The answer affects my name, my reputation, and to some slightly comical degree my marriage!

Any PC I touch or consult on gets a strong (and 99% 'yes' answer) that they should have not just MBAM but extremely importantly MBAM Pro!!! Since I also an a big proponent of ESET as well and I've repeated the concept that MBAM is completely compatible with just about any AV product there is .... well this current situation now isn't quite the truth and makes for an uncomfortable situation until some amicable resolution can be arrived at between Malwarebytes and ESET about what's happening in both programs under the hood.

And so my plea is to Malwarebytes that somehow you let me know what the best way to keep up-to-date on this issue and hopefully compatible resolution might be. I'll follow this topic but if you know of another topic for me to follow or can keep me on a list to keep informed when this is done I would greatly appreciate it.

I will continue to extoll the virtues of MBAM Pro (especially Pro) - as well as my recommended favorite paid AV product, ESET. But for the time being I'm the wiser to know there is a compatibility issue and I don't like the work around (disable MBAM or use a different AV product) but I do know how to at least get the recommended software setup and working even if it's not 100% of the function I want and hope to eventually turn back on.

Hope this helps.

- davidi

[Strenalis]

Hello jayneg and davidi,

I'd like to inform you that our investigation into this issue is now ongoing. I can't go too much into the specifics, but I can tell you that I've sent this problem up directly to our developers. The next step will be for them to get into contact with the ESET developers in order to solve this issue. Unfortunately, there is no temporary fix that we're currently aware of to make our product and ESET's cooperate when an external USB storage device is plugged in. If that ever changes, I'll be sure to give an update on this thread.

Thanks once more for making this known to use.

[Danowan]

I am having the same issue as the OP, and upon reading this thread, I am certain that it is a conflict between MBAM and ESET products. The moment I uninstall either ESET or MBAM, the problem of freezing/hanging upon bootup ceases and I am able to use my computer again. I too have customers, so I want them to have the best of the best in anti-spyware/malware/virus software; and no error messages either.

What is the status of the resolution to this issue? Is it a Windows XP SP3 issue, or is it a conflict between MBAM and ESET?

Thanks for your time,

Daniel

[mmecseki]

Same here, long time already "fighting" with this problem. Now its "solved", nod32 and mbam together makes XPSP3 hanging when i attach usb hdd! When one is gone then everything is ok!

Till now mbam has to go Hope you will resolve this problem!

Though nod32 is making more and more troubles, before was live stream with axis camera, now with mbam ;(

Starting to be very annoying (eset)!