Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an install of Windows Server 2008 R2 that keeps becoming unresponsive quite regularly. Event logs don't seem to pinpoint any service in particular that could be causing this. The server is running ESET Server Security and there seems to be an issue in ESET's knowledgebase which sounds similar. Does anyone know the solution for this, other than the temporary fix already given on ESET's website?

share|improve this question
    
You might want to also search for a solution and/or post your question to the NOD32 forums, wilderssecurity.com/forumdisplay.php?f=15 –  jftuga Aug 25 '11 at 15:43

1 Answer 1

up vote 3 down vote accepted

We have found the firewall filter in Eset NOD32 to cause blue screens (STOP 0x1E) on some servers, and it also disables the TCP Offload Engine in Windows. There is no permanent way to disable the filter in the software right now, although this may be included in the next major release according to their support personnel.

Additionally, disabling HTTP and SMTP filtering does not prevent the firewall driver from loading.

The two official ways to disable the driver are:

  1. Rename %WinDir%\system32\drivers\epfwwfpr.sys while in safe mode as outlined in the KB article you posted.
  2. In the registry, find HKLM\SYSTEM\CurrentControlSet\services\epfwwfpr, then change the value of Start to 0x4 (disabled) and reboot.

Unfortunately, either of these methods leaves an ugly warning in the NOD32 interface. Also at this time, I am not sure if software updates will re-enable the driver.

Hopefully Eset will give us the ability to disable and unload this device driver in the software sometime soon.

Note: This applies to the current 4.2.XX versions.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.