Avast WEBforum
Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: hrova on March 09, 2005, 04:19:18 AM
-
When I scan a file using the context menu, an Avast box pops up for a few seconds, then disappears. I assume that it is normal to get no feed back unless there is a virus detected. Is that correct?
Also, when I scan a single file through the context menu (say a word document or some single document), the pop up box will say "Number of Tested Files 2" even though there was only one file (that is before the box disappears....)
Is this all normal??? Sorry I'm so new, and y'all seem so helpful....
-
Yes, avast! doesn't normally show the results unless a virus is found. You can change the behavior in program settings (page "Common", the option "Show results of Explorer Extension").
As for the number of files - if you scan a single file and the dialog shows more, it means that the file is some kind of archive (ZIP, RAR, of just a packer executable, e.g. by UPX). Every "packed object" counts.
-
Thanks....
So, would a normal *.doc or *.xls file have reason to show as two files? Do they have some internal archive - or something?
Literally, I have tried several files - which I thought were individual files - and I can't get any to show up as scanning only one file. I know that is probably not important... just a curiousity. Any input?
-
Interesting... so, when you create a .txt file with Notepad, containing one word, and scan it - it will still be shown as 2 files in the result?
-
I haven't gone that far - I don't normally use Notepad. I'll try it tonight....
But... is it normal for a plain old .xls, or even a .jpg or .pdf file to show two files scanned?
-
I don't think so.
-
I tried a plain text Notepad document - brand new document, one word in the contents, saved to desktop....
Context menu scan showed two files scanned...
I tried on second computer, similar results...
However - and this is odd... I noticed when I hand typed in the whole file name, such as "Test.txt" and saved it, it showed as scanning two files...
But, If I left Notepad's default (highlighted) .txt in there, used the back arrow to get to the front, and then typed in the file name, saved it that way, it only showed as one file being scanned...
Go figure.... and this happened on two machines at our home.....
I know.. this is a trivial thing compared to some problems people have. This is not even a problem at all, but more of a trying to figure it out type thing....
Thanks for your time... this forum is what really sold me on avast! (I was debating avast! or AVG.....)
-
Well, you are right that it's probably not a big problem, but I would still like to know what's behind this :)
I have prepared a modified version of the Explorer Extension application. So, please do the following:
1. Backup the ashQuick.exe file in your avast! installation folder, if you wish
2. Download this file (http://www2.asw.cz/~glucksmann/ashQuick.exe) and put it to your avast! installation folder, overwriting the original ashQuick.exe file.
3. Now, try again to scan a file (that's showing as 2 files in the result). The modified version now pops up a messagebox for every file that's going to be scanned. Of course, it would be very annoying for scanning folders or big archives, but maybe we'll find out what is actually being scanned this way.
4. To revert to the original ashQuick.exe, either restore it from the backup, or simply invoke an avast! update (VPS or Program) - the installer will put the original version back, even though it will probably ask for restart after that.
Let me know how it goes (i.e. how many messageboxes appear and what do they show) :)
-
I will do this, but not sure when....
Thanks.
-
I named a text file test.txt and scanned using context menu... here are the pop ups and final scan stats....
-
OK, so we know what the secret object is.
The file has an alternate data stream (NTFS ADS) - and that's what avast! scans (as an "archive").
Honestly, I don't know how the ADS got into the newly created file (I have seen similar behavior with attachments saved from Outlook Express - the files was stored with an ADS, which even seemed to vanish after system restart ???). In any case, the operating system is reporting an ADS to be present in the file, so I think it's not really an avast! problem.
I wouldn't worry much about it (even though I would like to know what/why puts the ADS there).
-
Okay... One last question... when I put in that file you directed me to, it did what you said. I replaced it from my backup, and on the first shut down after doing that, I got an "Error ashserv.exe"on shutdown. I've read others with that problem in these forums... But after that one shutdown, I don't seem to be getting it - just got it that once after I played in the install folder.... Would that be the randomness of that error? Or would it have something to do with playing around in the avast! folder? I had never gotten it before... and haven't gotten it in the few shotdowns since (I intentiaonlly started and shut down a couple of times to check...)
I guess that message is not uncommon and a known issue, so I shouldn't worry about it....
Again, thanks for your time. Hope y'all have a nice weekend.
-
No, the error certainly didn't have anything to do with the fact that you replaced the ashQuick file - it was just a coincidence.
-
Same problem, i also get 2 files scanned when i scan .txt and .doc. Let us know something.
-
I have also noticed this problem. I want to add two important items to what other people have posted:
1. The "Number of tested files" count isn't always twice what it should be - it's just always really wrong. For instance, when I scan the folder with my .mp3 files, the "Number of tested files" count goes up by 3 for every file it scans.
2. This problem is not limited to only the Explorer Extension scans. Try performing the same "experiment" in a normal folder scan - the count will still be very wrong.
I saw in an earlier post that this problem was just written off as an operating system issue. However, I've never seen this problem in any other virus scanner (and I've used plenty). It would seem then that this is a specific avast! problem, wouldn't it?
Regardless of whose "fault" it is, it would be very nice to see this problem fixed in the future, as I consider it to be the only downside of the entire avast! program. But you know what though? If that's the only fault in this software, that's pretty damn good! :)
-
I'm running Win2k and use FAT32 (for compatibility reasons). The filecounts of Avast are almost always correct. It is probably NTFS that causes the overcount, so Igor is right.
It may occur that a file contains actually more files in spite of not being shown as an archive or folder. Very common with viruses !
-
You are correct in assuming that I am using NTFS. However, as I mentioned before, I've used other virus scanners (under Windows XP using NTFS) that did not have this problem, so it seems obvious that it's an avast! problem.
Also, the files I'm scanning definitely do not have embedded or recursive files within them (and don't have any viruses either) - I'm only scanning .mp3's, text documents, and the like.
-
I've tested it on 8 systems. All XP pro, ntfs.
Avast is displaying the correct amount of files scanned.
No mather what filetype I scanned or how many files I scanned.
So it is not a problem from Avast.
The real question is: "Where are the ADS's on your systems come from?"
-
Thought I might as well get into this discussion. I downloaded the attached file that was sent showing the scanned results and noticed while no message shows unless the option to show the results is set to do so there is a very quick message which disappeared very quickly. Even so I was able to read the message and I notice ONE file scanned in the message.
I though ah ha, maybe when I set Avast to show the results of the scan then it will some how effect the result and I would see TWO files like the others in this thread are seeing.
So I scanned the file again with Avast set to show the scanned results and I am happy to say that I still only get ONE file scanned. So I tried a WORD document and scanned the file and again I get ONE file scanned.
So it would appear that I don't have the same problem that the others in this thread have. ;D
I am using WIN98SE with MS Office 97. Of course the downloaded JPEG file that was attached in this thread would have nothing to do with MS Office 97 so the version of WORD would not seem to be the problem.
Possibly there is a setting in Avast that I do not have that others have set which could be the cause. ???
Incidently I had no problems (so far) in regards to uninstalling 6 years and 2 versions worth of NAV2004 as so many others have. One thing I made sure every aspect of NAV2004 was turned OFF before I did the uninstall which is possilby something others did not do.
I'm not usually this lucky... :D
-
Incidently I had no problems (so far) in regards to uninstalling 6 years and 2 versions worth of NAV2004 as so many others have. One thing I made sure every aspect of NAV2004 was turned OFF before I did the uninstall which is possilby something others did not do. I'm not usually this lucky... :D
As I've posted elsewhere, I'm almost sure that the uninstallation problem was due to NAV2003.
NAV2004 has a better uninstall behavior and should not bring as many much problems after uninstalled as NAV2003.
-
Well, it seems that my computer has alternate data streams for some of my files and they are causing the miscount. (I've looked into it briefly and found that some of the streams were put there by Internet Explorer when I downloaded files and some were put there by Kaspersky Anti-Virus). I understand the importance of scanning the ADS's since they can be used maliciously to attach nasty things to legitimate files. However, couldn't one argue that these ADS's shouldn't be added to the file count? After all, they aren't separate files, but rather an extension of the data...
Or, maybe avast! could keep a separate count for files and ADS's?
After looking into this a bit more, I think I have stumbled on another potential avast! fault. I've been scanning this one particular .pdf file I have with the modified version of ashQuick.exe that was posted above, and it displays this:
Scanning: <.pdf file>\UnnamedStream_1
However, I have analyzed that .pdf file with two separate ADS viewers (LADS (http://www.heysoft.de/nt/ep-lads.htm) and the Windows Shell Extension (http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnfiles/html/ntfs5.asp)) and neither one shows any streams in that file. Any ideas?