Avast 4.7 home hangs up during scanning

[mrex]

Hi!

I cannot perform full system scan, because Avast is hanging up always on some file. It starts C:\Re........... Don't know which file because the name seems to be long. "Recovery..." something? Tried to check that folder on my computer, but cannot see it although i have chosen "show hidden files" in folder options.

Anyway, Avast is unable to continue, and I have waited always about 30 minutes and then shutted down the scanning process (chose "stop scanning" or so). Avast always hangs up in the same file/folder.

[Lisandro]

How exactly does it freeze? Does it happen always approximatelly at the same place/folder of the scan?
Do you see a hard disk activity (when it freezes)? Is only the program frozen, or the whole computer (possibly with mouse cursor)?

Additionally, you can go to the program settings and turn on the creation of the report file (with "OK files" to be included as well in the report). This way, you can find out where the scan really stopped (it's going to be close to the end of the report).

After avast! disappears, check the end of the report file - the "troublesome" file is likely to be close to the end (close in the sense that this particular file will probably not be written in the report, but the previous one will be the last line, so it shouldn't be hard to guess). We would certainly like to have this file - if it really causes problems to avast! - so that we could fix the problem.

The report file created (if you turned it on in program settings) will be (default location) at <avast4>\Data\Report\Simple User Interface.txt

[mrex]

How exactly does it freeze? Does it happen always approximatelly at the same place/folder of the scan?

Freezing: Avast doesn't do anything. There seems to be some activity on harddisk (led light is blinking from time to time - not actively) and processes shows some activity to ashsimpl.exe.

Additionally, you can go to the program settings and turn on the creation of the report file (with "OK files" to be included as well in the report).

Started scanning: whole computer, including compressed files, scanning method "normal"...

Now it stopped in file:
C:\recyclers\S-1-5-21-2044912210-309414939..\ymcd.exe

No activity at all, waited about 30 minutes again =>
1. clicked the mouse over Avast panel
2. chose "pause scanning" (or what ever it is in english)
3. choce "end scanning" (- '' -)
4. clicked X-mark on Avast panel to close the program and the panel disappear after a while


Second attempt:

1. clicked the title "Report files"
2. marked every possible things
3. started scanning: whole computer, scannin method "normal" ...

Now it stopped in file:
C:\Program files\zone labs\zoneAlarm

No activity at all, waited about 30 minutes again =>
1. clicked the mouse over Avast panel
2. chose "pause scanning"
3. choce "end scanning"
4. clicked X-mark on Avast panel to close the program and the panel disappear after a while

I got some report.  End of the report:

C:\Program Files\ZoneAlarmSB\bar\1.bin\Z4PLUGIN.DLL

• on OK

C:\Program Files\ZoneAlarmSB\bar\1.bin\Z4POPBLK.DLL

• on OK

C:\Program Files\ZoneAlarmSB\bar\1.bin\Z4SPYBLK.DLL

• on OK

C:\Program Files\ZoneAlarmSB\bar\Cache\00486EB9 [E] Tiedosto ohitettiin tarkistusasetusten takia. (42016) =file was passed due to the settings...
C:\Program Files\ZoneAlarmSB\bar\Cache\files.ini [E] Tiedosto ohitettiin tarkistusasetusten takia. (42016)
C:\Program Files\ZoneAlarmSB\bar\History\search2 [E] Tiedosto ohitettiin tarkistusasetusten takia. (42016)
C:\Program Files\ZoneAlarmSB\bar\Settings\prevcfg2.htm

• on OK

C:\Recycled\desktop.ini [E] Tiedosto ohitettiin tarkistusasetusten takia. (42016)
C:\Recycled\INFO2 [E] Tiedosto ohitettiin tarkistusasetusten takia. (42016)
C:\RECYCLER\S-1-5-21-2044912210-3094149399-556958001-1004\desktop.ini [E] Tiedosto ohitettiin tarkistusasetusten takia. (42016)
C:\RECYCLER\S-1-5-21-2044912210-3094149399-556958001-1004\INFO2 [E] Tiedosto ohitettiin tarkistusasetusten takia. (42016)
C:\sqmdata00.sqm [E] Tiedosto ohitettiin tarkistusasetusten takia. (42016)
C:\sqmnoopt00.sqm [E] Tiedosto ohitettiin tarkistusasetusten takia. (42016)
C:\SYSINFO\INSERTCD.EXE

• on OK

C:\SYSINFO\OS.INI [E] Tiedosto ohitettiin tarkistusasetusten takia. (42016)
C:\System Volume Information\MountPointManagerRemoteDatabase

• on OK

[mrex]

Third attempt:

I booted computer and run the same settings (scan the whole computer, normal scanning).

There seems to be some activity on harddisk (led light is blinking from time to time) and processes shows some activity to ashsimpl.exe. But it seems to be hanged up again. After ending scanning and closing Avast panel I got this report (marked on "delele old report file" or something like that (Im using finnish translation so I have no clue what they are called in english))

It stopped scanning in folder C:\Program files\zoneAlarmSB\bar\1.bin (folder size 551 KB (564 894 bytes), marked as 'read only' folder)

C:\Program Files\ZoneAlarmSB\bar\1.bin\Z4HIGHIN.EXE

• on OK

C:\Program Files\ZoneAlarmSB\bar\1.bin\Z4NTSTBR.JAR [E] Tiedosto ohitettiin tarkistusasetusten takia. (42016)
C:\Program Files\ZoneAlarmSB\bar\1.bin\Z4NTSTBR.MANIFEST [E] Tiedosto ohitettiin tarkistusasetusten takia. (42016)
C:\Program Files\ZoneAlarmSB\bar\1.bin\Z4PLUGIN.DLL

• on OK

C:\Program Files\ZoneAlarmSB\bar\1.bin\Z4POPBLK.DLL

• on OK

C:\Program Files\ZoneAlarmSB\bar\1.bin\Z4SPYBLK.DLL

• on OK

C:\Program Files\ZoneAlarmSB\bar\Cache\00486EB9 [E] Tiedosto ohitettiin tarkistusasetusten takia. (42016)
C:\Program Files\ZoneAlarmSB\bar\Cache\files.ini [E] Tiedosto ohitettiin tarkistusasetusten takia. (42016)
C:\Program Files\ZoneAlarmSB\bar\History\search2 [E] Tiedosto ohitettiin tarkistusasetusten takia. (42016)
C:\Program Files\ZoneAlarmSB\bar\Settings\prevcfg2.htm

• on OK

C:\Recycled\desktop.ini [E] Tiedosto ohitettiin tarkistusasetusten takia. (42016)
C:\Recycled\INFO2 [E] Tiedosto ohitettiin tarkistusasetusten takia. (42016)
C:\RECYCLER\S-1-5-21-2044912210-3094149399-556958001-1004\desktop.ini [E] Tiedosto ohitettiin tarkistusasetusten takia. (42016)
C:\RECYCLER\S-1-5-21-2044912210-3094149399-556958001-1004\INFO2 [E] Tiedosto ohitettiin tarkistusasetusten takia. (42016)
C:\sqmdata00.sqm [E] Tiedosto ohitettiin tarkistusasetusten takia. (42016)
C:\sqmnoopt00.sqm [E] Tiedosto ohitettiin tarkistusasetusten takia. (42016)
C:\SYSINFO\INSERTCD.EXE

• on OK

C:\SYSINFO\OS.INI [E] Tiedosto ohitettiin tarkistusasetusten takia. (42016)
C:\System Volume Information\MountPointManagerRemoteDatabase

• on OK

Don't know if this is the same file again - did Avast replace it or not? Looks very similar though..

[mrex]

Fourth attempt:

Did the same as above but I manually deleted the log file at first before starting the scanning process. There seems to be some slow harddisk activity (blinking led light from time to time) and ashsimpl.exe is using CPU again.

Avast hangs up: It stopped again scanning the folder C:\Program files\zoneAlarmSB\bar\1.bin

End of the report file:

C:\Program Files\ZoneAlarmSB\bar\1.bin\Z4HIGHIN.EXE

• on OK

C:\Program Files\ZoneAlarmSB\bar\1.bin\Z4NTSTBR.JAR [E] Tiedosto ohitettiin tarkistusasetusten takia. (42016)
C:\Program Files\ZoneAlarmSB\bar\1.bin\Z4NTSTBR.MANIFEST [E] Tiedosto ohitettiin tarkistusasetusten takia. (42016)
C:\Program Files\ZoneAlarmSB\bar\1.bin\Z4PLUGIN.DLL

• on OK

C:\Program Files\ZoneAlarmSB\bar\1.bin\Z4POPBLK.DLL

• on OK

C:\Program Files\ZoneAlarmSB\bar\1.bin\Z4SPYBLK.DLL

• on OK

C:\Program Files\ZoneAlarmSB\bar\Cache\00486EB9 [E] Tiedosto ohitettiin tarkistusasetusten takia. (42016)
C:\Program Files\ZoneAlarmSB\bar\Cache\files.ini [E] Tiedosto ohitettiin tarkistusasetusten takia. (42016)
C:\Program Files\ZoneAlarmSB\bar\History\search2 [E] Tiedosto ohitettiin tarkistusasetusten takia. (42016)
C:\Program Files\ZoneAlarmSB\bar\Settings\prevcfg2.htm

• on OK

C:\Recycled\desktop.ini [E] Tiedosto ohitettiin tarkistusasetusten takia. (42016)
C:\Recycled\INFO2 [E] Tiedosto ohitettiin tarkistusasetusten takia. (42016)
C:\RECYCLER\S-1-5-21-2044912210-3094149399-556958001-1004\Dc1.txt [E] Tiedosto ohitettiin tarkistusasetusten takia. (42016)
C:\RECYCLER\S-1-5-21-2044912210-3094149399-556958001-1004\desktop.ini [E] Tiedosto ohitettiin tarkistusasetusten takia. (42016)
C:\RECYCLER\S-1-5-21-2044912210-3094149399-556958001-1004\INFO2 [E] Tiedosto ohitettiin tarkistusasetusten takia. (42016)
C:\sqmdata00.sqm [E] Tiedosto ohitettiin tarkistusasetusten takia. (42016)
C:\sqmnoopt00.sqm [E] Tiedosto ohitettiin tarkistusasetusten takia. (42016)
C:\SYSINFO\INSERTCD.EXE

• on OK

C:\SYSINFO\OS.INI [E] Tiedosto ohitettiin tarkistusasetusten takia. (42016)
C:\System Volume Information\MountPointManagerRemoteDatabase

• on OK

Ok, still looking the same and i did delete the old report file manually.

[Lisandro]

Igor, can you help here?

[py1ha]

I have the same problem.Try to do a on line scan and see if you still have this problem I am using XP pro and I am quite sure that the pc is not infected as I can scan all files without any problem

[Lisandro]

I suggest:

1. Disable System Restore and reenable it after step 3.
2. Clean your temporary files (browser and recycle bin).
3. Schedule a boot time scanning with avast with archive scanning turned on.

[mrex]

I have the same problem.Try to do a on line scan and see if you still have this problem I am using XP pro and I am quite sure that the pc is not infected as I can scan all files without any problem

I did online scanning by F-Secure online scanner scanning all files including compressed files. No problem.

I try that boot time scanning when I restart the system next time.

[Lisandro]

I try that boot time scanning when I restart the system next time.

The report file is created automatically in <avast4>\Data\Report\aswBoot.txt

[mrex]

This is the report, i chose to scan compressed files too:

03/04/2008 16:43
Tarkistetaan kaikki kiintolevyt (Scanning all drives)
Tiedosto C:\WINDOWS\system\RCDSETUP.EXE\%SYS%\OCXSETUP.WS4 Virhe 42146 {Asennustiedosto on vahingoittunut.} (Installer archive is corrupted.)

Tarkistettuja kansioita: 3483 (Scanned folders)
Tarkistettuja tiedostoja: 400974 (Scanned files)
Tartunnan saaneita tiedostoja: 0 (Infected...)

What's the problem with rcdsetup.exe? Google found information on Avast and rcdsetup.exe only in italian and french. I don't understand either 

[Lisandro]

Can you send C:\WINDOWS\system\RCDSETUP.EXE file for analysis to virus@avast.com?
Can you submit it to www.virustotal.com ?

[igor]

I'd suggest to ignore the "corrupted archive" message.
Regarding the freeze... I don't know, it's strange... is it still happening?

[mrex]

VirusTotal:
http://www.virustotal.com/analisis/4ffc772707599e64364a15a01aaec7c9

Sent the file RCDSETUP.exe to Avast.

Freezing.. Yes it's still freezing. I used scanning options: all drives with "thorough" scanning method including compressed files (quick scanning <-> normal scanning <-> thorough scanning). It is called "perusteellinen" in finnish and I don't know what it is called in english but it is the extremely scanning method.

After 20 minutes, still showing the same "C:\" and no activity (neither on harddisk or in processes). Look the picture.

End of the report file after I ended the scanning.
...
C:\Program Files\ZoneAlarmSB\bar\1.bin\Z4NTSTBR.MANIFEST

• on OK

C:\Program Files\ZoneAlarmSB\bar\1.bin\Z4PLUGIN.DLL

• on OK

C:\Program Files\ZoneAlarmSB\bar\1.bin\Z4POPBLK.DLL

• on OK

C:\Program Files\ZoneAlarmSB\bar\1.bin\Z4SPYBLK.DLL

• on OK

C:\Program Files\ZoneAlarmSB\bar\Cache\00486EB9

• on OK

C:\Program Files\ZoneAlarmSB\bar\Cache\files.ini

• on OK

C:\Program Files\ZoneAlarmSB\bar\History\search2

• on OK

C:\Program Files\ZoneAlarmSB\bar\Settings\prevcfg2.htm

• on OK

C:\Recycled\desktop.ini

• on OK

C:\Recycled\INFO2

• on OK

C:\RECYCLER\S-1-5-21-2044912210-3094149399-556958001-1004\desktop.ini

• on OK

C:\RECYCLER\S-1-5-21-2044912210-3094149399-556958001-1004\INFO2

• on OK

C:\sqmdata00.sqm

• on OK

C:\sqmnoopt00.sqm

• on OK

C:\SYSINFO\INSERTCD.EXE

• on OK

C:\SYSINFO\OS.INI

• on OK

C:\System Volume Information\MountPointManagerRemoteDatabase

• on OK

System information:
- Windows XP Pro (eng) with all recent updates (sp2)
- 1,25 GB RAM

[Vlk]

Please create a dump of the ashSimpl.exe process (when the problem is simulated, i.e. the scan is stuck) and upload it to our ftp site ftp://ftp.avast.com/incoming.

To create the dump, download and run http://public.avast.com/~vlk/hangrep.exe . In the list of processes select ashSimpl.exe and use the Save button. This generates a file which you can upload to the ftp site.

Thanks
Vlk