I have an install of Windows Server 2008 R2 that keeps becoming unresponsive quite regularly. Event logs don't seem to pinpoint any service in particular that could be causing this. The server is running ESET Server Security and there seems to be an issue in ESET's knowledgebase which sounds similar. Does anyone know the solution for this, other than the temporary fix already given on ESET's website?
1 Answer
We have found the firewall filter in Eset NOD32 to cause blue screens (STOP 0x1E) on some servers, and it also disables the TCP Offload Engine in Windows. There is no permanent way to disable the filter in the software right now, although this may be included in the next major release according to their support personnel.
Additionally, disabling HTTP and SMTP filtering does not prevent the firewall driver from loading.
The two official ways to disable the driver are:
- Rename
%WinDir%\system32\drivers\epfwwfpr.sys
while in safe mode as outlined in the KB article you posted. - In the registry, find
HKLM\SYSTEM\CurrentControlSet\services\epfwwfpr
, then change the value ofStart
to 0x4 (disabled) and reboot.
Unfortunately, either of these methods leaves an ugly warning in the NOD32 interface. Also at this time, I am not sure if software updates will re-enable the driver.
Hopefully Eset will give us the ability to disable and unload this device driver in the software sometime soon.
Note: This applies to the current 4.2.XX versions.