Page 1 of 2
Kaspersky crashes in Vista?
Posted: Fri Dec 14, 2007 10:27 am
by clarence
I have a problem with UE in Vista on both of my 2 machines (1 running Vista 32bit and one 64bit). Sometimes (not always) when I issue a search UE just hangs (doesn't return results - I once waited half an hour), but still responds until after I click 'cancel search' it crashes completely.
This alone wouldn't be a huge problem, I just would have to terminate the task with the task-explorer and restart UE, BUT it doesn't let me do that... I need to reboot to get rid of the UE-task and shutting down windows in this case takes ages - I assume vista just waits a few minutes for UE to shut down and when that doesn't happen it terminates it the hard way I suppose.
As I said, I experience this behavior on 2 different intel cpu machines, one 2 GB the other 4 GB ram. I had no problem whatsoever with XP before.
Is this a known problem?
Thanks
Posted: Fri Dec 14, 2007 12:41 pm
by Josef K
Are there any differences besides XP/Vista? Did you use a firewall in XP that you don't use in Vista? If so, either check your config for UE in your firewall settings and adjust them if need be. The search service is dynamic and can change when necessary to counteract things like IP changes to the search service server. Maybe it's the port that is changing since sometimes it happens and sometimes not. The IP may be the same but you might have only allowed through one particular port.
If you are running a firewall, either temporarily disable it to test or delete and re-add UE to the ruleset.
Posted: Fri Dec 14, 2007 4:23 pm
by clarence
Yes, I am running an identical setup with internal vista/xp firewall disabled and Kaspersky allowing UE to do whatever it wants. This method works with XP without a hitch, only vista gives me problems. I'll try to disable Kaspersky completely, but it would be a major annoyance if I would have to do this every time I issue a search in UE though...
Posted: Fri Dec 14, 2007 10:10 pm
by Josef K
I run Kaspersky also (Vista x64) and it gave me a couple of problems in the beginning. Are you using it in training mode, giving you popups whenever anything wants access? It might be that you haven't allowed UE outside access on other ports. Really, all you should need to do in a worst case scenario is to delete UE from your rules, run it again and allow through your NNTP servers and the UE search server.
Since you say you've allowed UE full complete access then this shouldn't even be an issue. Then again, Kaspersky have their own ideas of how they think a firewall should work. I'm not entirely comfortable with configuration in Kaspersky - it sometimes seems illogical and help files and FAQs often seem to refer to previous versions even though they are listed as being appropriate to the current one.
How often does this problem happen and how far apart? Hours, days? Does rebooting fix it?
Posted: Sun Dec 16, 2007 11:04 am
by clarence
After fooling around with Kaspersky to no avail I disabled it completely but still get the same crashes, which occur about every 5th search or so. I even experienced some odd crashes while autosaving which never happened before.
Posted: Sun Dec 16, 2007 12:31 pm
by Josef K
Usually any problems that seem hard to nail down can be traced back to firewalls and/or antivirus interfering with UE's network flow. In your case it must be something else. Maybe you have a firewalled router that interrupts the flow. However, you say that there was no problem with XP and you have it occurring on two separate systems with both x86 and x64 Vistas.
I think this is one for Alex to put his mind to now unless you can find out whatever else you may be running on both systems that in some way monitors or alters network traffic that could be causing this.
Posted: Sun Dec 16, 2007 2:54 pm
by Josef K
Do you use Windows Update and have you updated recently? Also, when did you first start seeing this problem?
I'm actually seeing something similar but I always tend to leave some time to narrow things down before I jump in and blame something. I've been doing some heavy duty things on my computer and I've been putting any problems with UE seeming to hang or freeze down to that. I just updated Vista (most recently on the 14th) and it's coinciding with my heavy duty stuff over the past few days. One thing I've noticed is everything, mouse included, freezes while Kaspersky begins updating itself then later pops up a box saying it failed. Now this isn't that unusual since what I've been doing needs a lot of hard drive work and with most of my drives being on RAID5, the slowdowns associated with the RAID controller calculating parity are something I've become used to. There will always be other apps affected by this process.
If you've updated Windows in the past few days, just before this started happening, what are their KB numbers? It wouldn't be the first time that Microsoft released an update that I had to uninstall because it did more harm than good.
Posted: Tue Dec 18, 2007 3:43 am
by alex
you mention crashes but you don't mention what crashes.
do you see something in log.txt in the UE database directory?
usually in most cases i can track down the crashes and tell what causes it especially if it is network related.
with defective memory there is also certain pattern, unless the malfunctioning driver/hooks corrupts the UE process memory heap and the exception hander is not invoked.
also i don't understand you tell in one post there is problem with 32 and 64 bit version and in another post it is 64 bit, which is it then? until now the behaviour was consistent for both and no problems reported.
if you suspect kaspersky try to uninstall it completely, then check whether the problem disappears and then install it again to see the problem is gone.
if crashes caused by drivers or hooks i cannot do anything since it is third party code which you have installed is running in the UE address space, it is like compromising the system and process running in separate address space integrity like back to 16 bit windows, the driver level must function properly since if not the integrity of every process is compromised, but not the opposite, if there is a buggy process nothing else is affected.
from your description it follows most likely it is firewall to blame when you invokes search it tries to connect to the server it doesn't get there when you press cancel it closes open sockets from another thread and it crashes, with buggy firewalls it is the frequent point of failure.
in the past i had crash reports on closesocket operation, sometimes there is a part of third party winsock provider running in the user mode so those crashes get to exception handler, but mostly those were different firewalls like imon.dll from NOD32 and one more i forgot what, not kaspersky (but with kaspersky there were problems reported with vista, see a thread several months ago, then they fixed it, maybe now it is something new again).
when you first experience this when you upgraded to vista or you were it running in vista for some time without problems and it started recently?
Posted: Tue Dec 18, 2007 8:58 am
by clarence
First of all, thanks for your reply. Sorry for blaming UE, but I've really put in lots of effort to rule out any botched system configuration of mine. I am running currently 2 PCs (Vista 64bit, Xp Home) at my home and 1 at work (vista 32bit). I've never experienced any problems with XP, but am seeing the same problems on both vista machines. I am also running newsbin prof. in parallel, which doesn't give me any problems (I absolutely prefer UE though, that's why I really want it work). My vista 64 bit machine is completely new, it's a quad 6600 with a fresh OS installation and nothing on it beside UE, yet (no printer, 16bit drivers or anything). I am directly connected to the internet (25mbit cable) without any additional router.
There is a log file in the UE-dir, but it's empty, besides (--Login-- (v1.9.9.7)). The crash trace is checked and has always been! I doubt that UE really 'knew' it crashed, because it appears it's just sitting idle but not responding.
Since it is happening on both my vista machines (32/64bit), I would rule out defective memory. The only thing that both machines have in common is they are running kaspersky internet security. I already tried to disable it while running UE of course, but that doesn't seem to suffice. I guess I will have to deinstall it completely, which I am reluctant to, because I just purchased a 1 year license for it...
What bothers me most is, that you can't terminate the UE-task in vista! You have to reboot every time you want to get rid of it - and this takes ages (not like a normal reboot)!
I've been using UE for several years now (this is my 2nd license) and would really appreciate it getting it to work on my vista machine!
Posted: Wed Dec 19, 2007 1:51 am
by Josef K
Update on this:
I've read some more through the Kaspersky forums and possibly found a fix. Read
this thread (posts #31 and #32), update Kaspersky and reboot.
Since I applied this I've tried a number of various ways to try to reproduce the same problems with, happily, no luck yet. I went a bit crazy with searches, downloading, saving and a combination which has seemed to be where the issue usually arises. So far so good but I'll need more time and testing to be sure.
Posted: Wed Dec 19, 2007 9:22 am
by clarence
Thanks for investigating, but I doubt this has something to do with my UE problem, because I've never had the ill-fated 13th December update on my computer. I wasn't at home for a few days, so I know for sure...
Strange thing is that closing KIS alltogether doesn't help at all. I've checked with processexplorer that no instance of kaspersky is running, still I get a hanging UE after every 3rd or 4th search...
Posted: Wed Dec 19, 2007 4:03 pm
by Josef K
Not being there when the update was released doesn't necessarily mean you didn't eventually get it. Kaspersky by default checks and downloads new updates (both definitions and program updates) every few hours. If your computer wasn't on during this time, the definitions would have been downloaded, installed and all you'd need to do is to reboot to allow the program updates to take effect. This is all assuming you didn't change the preferences to manually update it yourself.
Closing Kaspersky should, as you say, completely stop it. It's my experience that any software that hooks into the system like this - firewalls and AV - can sometimes not really deactivate. McAfee is usually the worst culprit since there isn't one executable, there can be a dozen or more, one for each component. Have you tried using UE in safe mode and/or using MSConfig to prevent Kaspersky from loading in the first place?
Posted: Thu Dec 20, 2007 2:04 am
by alex
Ok, if the same problem is mentioned on Kaspersky forum (see the link above) and the post date exactly as yours, I wonder how it can be a coincidence.
You cannot see Kaspersky drivers running, because they run inside the system and are mapped into every process address space (so they run inside every user process as a part of the process), you cannot even get rid of drivers by disabling the firewall, you need to uninstall the firewall completely and the uninstall will request for system reboot to really get rid of them, you cannot just rip off a driver from every application address space.
Posted: Thu Dec 20, 2007 10:59 am
by clarence
Ok, I didn't know that, I thought by shutting down Kaspersky I got rid of it already.
I've uninstalled it now and everything seems to work as it should.
I guess I will have to look around for a better virus protection.
Posted: Thu Dec 20, 2007 11:58 am
by Josef K
clarence wrote:I guess I will have to look around for a better virus protection.
Don't be so hasty, especially since you've already paid for a subscription. Kaspersky is actually the most consistently highest rated AV program in terms of what it can catch, along with being updated every few hours. I will have to hunt out any links for the proof if you need it when I get back again later. You can also search for it yourself. I suppose Kaspersky, in their quest to be the absolute best, have gone slightly overprotective so far as to break a few things - the price of being cutting edge, maybe...
Reinstall Kaspersky and use the other update server as I mentioned above - it takes a minute or two to do and it has seemed to fix the issue with searching for me. With two of us testing Kaspersky alongside UE, we can determine whether or not they are a good combination but right now things are looking like back to normal here.