When the computer starts to slow down, refusing to promptly respond to any actions taken by the user, the first thing they usually do is call the “Process Manager”, regardless of the version of Windows, and see which program, service or processor “devours” most of the resources PC, processor and memory.
But finding out the culprit is not enough – it may turn out to be an important system process, the removal of which will lead to the complete collapse of the operating system. Today we will try to deal with the ekrn.exe module, which sometimes provokes such freezes.
Contents
What is this ekrn.exe file / process, what is it responsible for
Do not be surprised if you do not find such a process in your Task Manager – it only hangs for those users who use the well-known ESET package as antivirus protection. That is, the executable file ekrn.exe is part of this antivirus software, although the users themselves may not know about it – from the name of the process one can hardly guess about its blood ties with the installed antivirus. However, competitors are also guilty of this, but one should not look for malicious intent in this.
And since you’ve found ekrn.exe in Task Manager, it’s worth knowing what this file is responsible for. His immediate duties are to scan all programs and data loaded into memory for the presence of malicious code. The process works hard in the background and does not show itself in normal conditions.
The file itself is located in the directory where the antivirus itself is installed, and this path can be different if you are used to changing the default installation folder. You need to search in a subdirectory named x86 / x64, depending on the bitness of your version of Windows.
You can set the exact location of the file right in the Manager by following these steps:
- use the combination Ctrl + Shift + Esc to start remote sensing;
- click on the “Processes” or “Details” tab;
- looking for the ekrn.exe file;
- call the context menu by pressing RMB;
- select the option “Open file storage location”.
Explorer will open in the folder where the module you are looking for is located.
Can ekrn.exe be malware?
For the initial check, we need to make sure that the process is launched from the ESET installation directory (by default, something like C: Program_Files ESET_Smart_Security), and not from another folder.
Use the “Task Manager” for this, as described above. If this is not the case, the likelihood that a virus is disguised under the antivirus module really exists.
In this case, you should use one more check using the Microsoft Process Explorer utility. It does not require installation, just run the program, go to the “Options” tab and activate the “Check Legends” item. After that, press the View button and select the Select Columns item. It remains to add to the columns “Verified Signer”. Suspicion should be raised by the status of the process being investigated “Unable to Verify” with respect to the “Verified Signer” parameter.
Although not all normal processes can be marked as having a verified signature, “bad” processes will definitely not have this status.
Finally, consider the file size: a “real” process will not weigh more than 47MB regardless of version.
So if you find that it is ekrn.exe that loads the system (processor, memory) (in Windows 10/8/7 / XP), perform these three simple checks to make sure that you are dealing with the original file and not a virus …
You can try to remove the virus (physically from the disk) by removing it from startup as well. Changing the antivirus program right away is not the best move, by definition there is no perfect antivirus.
You may not be able to remove ekrn.exe right away – try to do this by booting the system in safe mode, or use other antivirus products that do not require installation.
But what if the ekrn.exe process that loads the system is genuine? Let’s figure it out.
How to restore normal PC performance
The first question that users usually ask in such cases is, can you just uninstall the ESET Service?
Since this is an important part of the anti-virus package, without which the protection of your computer will be absolutely ineffective, it is not recommended to take such a drastic step unless absolutely necessary.
You can check this file by means of the antivirus itself by running a complete system analysis of the computer and OS with Reimage, and if the file is indeed qualified as a virus, it will be automatically deleted or quarantined, that is, neutralized.
If you are convinced that this is not malware, but it prevents the computer from functioning normally, you can manually delete the file. How do I uninstall the ekrn.exe process and ESET Service? In a standard way, using the standard antivirus uninstaller. If you could not find this file, use the Windows Add / Remove Programs utility included in the Control Panel for all OS versions:
- go to the PU through the “Start” button, in the Windows 8 panel, select the “Programs” item, XP has an “Add or Remove Programs” button, in other versions (10 / Vista / 8.1 / 7) click “Uninstall a program”;
- find the ESET Smart Security application in the list that appears and click the “Remove” button (in XP it will be called “Remove or Change”);
- follow the instructions of the uninstaller.
The ekrn.exe file can lead to PC freezes as a result of integrity violations caused by various malfunctions of the OS or antivirus. In this case, erroneous messages may appear with the mention of this module like
“Ekrn.exe failed” or “ekrn.exe not found / not running”. Erroneous messages can appear in different situations, during ESET installation, when Windows is shutting down, when ESET Smart Security is running, and these messages can be used to troubleshoot the cause of a problem.
Let’s consider the most common ways to fix the normal operation of the PC, disturbed by the ekrn.exe process.
Completion of the process
Since it is strongly discouraged to delete the file for the reasons stated earlier, you can simply try to temporarily disable the ekrn.exe process. When you restart Windows, it should start working again in normal mode, perhaps without loading the processor, this will indicate an accidental problem.
You can unload a process from RAM through the Task Manager by placing the cursor on ekrn.exe and clicking the End Process button. As a rule, the performance of the PC will be restored.
Setting limits
Perhaps the antivirus simply cannot cope with the huge number of tasks it performs, this usually happens if the user unknowingly ticks all the checkboxes, including those that are obviously unnecessary.
You can try to set scan limits in the antivirus settings:
- go to “Settings”;
- in the list “Virus protection” look for the item “File system protection”;
- at the top, click on the “Settings” button, and then on the “Limits” tab;
- reduce the scan time to 10-15 seconds, and set the “Maximum size” parameter to 80 MB.
ESET will continue to perform its functions, but the load on the CPU should be significantly reduced.
Disable service
You can also disable ekrn.exe permanently without deleting the file itself. This can be done as follows:
- in the “Run” console, enter the services.msc command, confirm by clicking OK;
- in the “Services” tab, look for the ESET Service line, double-click on it;
- specify the “Disabled” startup type in the module properties.
As a result, the process will not start until we do the opposite.
Disable scheduled tasks
Another rather radical way to solve the freeze problem is to disable scheduled tasks in the antivirus settings. This will reduce the security of your computer, as ESET will not be able to perform system scans on its own, but the CPU load will definitely decrease.
Manufacturer Tips
ESET programmers themselves admit that PC freezes can occur due to the fact that the specified module checks too many files in real time and does not cope with such a load. Recommendations from the company’s specialists also lie in the plane of the anti-virus package settings – you need to click on the “Protection Methods” tab in the “Advanced settings” panel and uncheck all the boxes, leaving only the heuristic and signature analysis items enabled. In the “Protocol filtering” tab, you need to do the same, leaving the leftmost mode working.
By default, most of these options are already disabled, that is, this is the result of ill-considered actions on the part of the user.
As you can see, the computer freezing due to the ekrn.exe process can be caused by various reasons, and in order to diagnose them, you have to do a lot of work. But sometimes all of the above actions are ineffective. What can you advise in such cases? Reinstalling Windows is hardly an acceptable solution, but changing your antivirus can help. But it does not guarantee that new problems will not appear …