Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: Micha in Berlin on January 22, 2015, 09:58:14 AM

Title: different messages after scanning with rescue disk
Post by: Micha in Berlin on January 22, 2015, 09:58:14 AM
Hello AVAST Forum,
sorry for bad english. I´m giving my best :-) .

I used AVAST rescue disk to scan my computer.
At the end of scanning avast first creates a temporary log file, that I saved localy:

start of file
...
scan begin: time
infected files: 12303
scanner result: 0
scan end: time
...end of file

after that a second window showed me a totaly different result:

833965 files scanned
77931 MB scanned
0 files infected

BIG ???????????????
What is the meaning of that?

Thanks for helping.
Regards
Michael
Title: Re: different messages after scanning with rescue disk
Post by: Izibia on June 25, 2015, 07:25:03 PM
Nobody cares about such a serious problem??
I have got the same issue with last Avast free and Rescue Disk created several days ago.

After the scan finishes AvastPE shows me:

Firstly, there is an open Notepad file with

Quote
This file is just temporary ...
...
Scan begin: ...
Infected files: 130
Scanner result: 0
Scan end: ...

then Avast opens another window with this content:

Quote
Scanned files: xyz
Infected files: 0
Size of Scanned files: xyz
Fix automatically or do it manually


So accordingly to Avast PE, the number of infected files is 0 and 130 simultaneously

I chose to "fix manually" and I had got a table with approx. 130 files (a note: the column "virus name" was blank for all files). Later  in Windows, i tried to rescan some of these files from the context menu, and I got no malware but files that "could not be scanned":
- error: archive is password protected
- error: the file is a decompression bomb (this happened with "memory-report.json.gz" from a Firefox profile)

(edit: typos.)
Title: Re: different messages after scanning with rescue disk
Post by: Izibia on June 26, 2015, 04:44:40 PM
I have got more experience with the bug:

Good news:
it looks the problem happens with packed files only

Bad news:
AvastPE reports 0 infected files...
Quote
Scanned files: xyz
Infected files: 0
Size of Scanned files: xyz
Fix automatically or do it manually
...but if you click "Fix automatically" Avast will start to delete files.


So here are the aggregate Avast reports:
Quote
Infected files: 130 (reported by notepad)
Infected files: 0 (reported by Avast UI)
Fix automatically...
deleted files: 130 (reported by Avast UI)
(I remind these deleted files are not malware files but files that could not be scanned by Avast)
Title: Re: different messages after scanning with rescue disk
Post by: Izibia on June 26, 2015, 05:10:12 PM
I used this thread to report a bug, so I will use it to file a feature request:

the report in the notepad is a useful feature, because it allows users to save the report
but another report in the notepad is missing after the fixing procedures
Title: Re: different messages after scanning with rescue disk
Post by: Rednose on June 26, 2015, 05:12:42 PM
Hi Ibizia :)

That Avast can not scan password protected files is normal. Otherwise the password protection wouldn't make sense.
About the Rescue Disk ( and its actions ) : It's a very long time ago I have tried/used is myself, so I have to look at it first.

Greetz, Red.
 
Title: Re: different messages after scanning with rescue disk
Post by: Izibia on June 27, 2015, 11:50:04 AM
That Avast can not scan password protected files is normal.

:) But this is not normal:
- Avast claims these (clean!) files are infected
- then Avast calms the user down: they are not infected
- then Avast deletes them and proudly announces total number of deleted files
Title: Re: different messages after scanning with rescue disk
Post by: Izibia on September 08, 2015, 12:08:09 PM
similar issue:
https://forum.avast.com/index.php?topic=149362
Title: Re: different messages after scanning with rescue disk
Post by: Pondus on September 08, 2015, 12:32:43 PM
Could you post some screenshots

Title: Avast Rescue destroyed my Windows 10 installation
Post by: 1234ava on September 09, 2015, 02:48:09 PM
@Pondus
Here are the photos.
By the way, this little test wrought havoc in my Windows 10 (UEFI SecureBoot) installation.
I had to re-install Windows after that.
In fact, Avast Rescue deleted thousands of Windows files after I clicked the right scrollbar in order to scroll the "Fix it manually" window, as you can see in pictures n.3 and 4 (in my next post).
I see this as a serious issue.
I would recommend Avast removes "Rescue Disk" from the Avast suite until it is fixed.








Title: Re: Avast Rescue destroyed my Windows 10 installation
Post by: 1234ava on September 09, 2015, 02:52:34 PM
@Pondus
Here are the photographs.
By the way, this little test wrought havoc in my Windows 10 (UEFI SecureBoot) installation.
I had to re-install.
In fact, Avast Rescue deleted thousands of Windows files after I clicked the right scrollbar in order to scroll the "Fix it manually" window, as you can see in pictures n.3 and 4 (in my next post).
I see this as a serious issue.
I would recommend Avast removes "Rescue Disk" from the Avast suite until it is fixed.

Here are pics #3 and #4.


Title: Re: different messages after scanning with rescue disk
Post by: Milos on September 09, 2015, 03:07:00 PM
Hello,
can you send us the detected files to analyze, please? Use https://support.avast.com/ -> Avast Virus Lab, report False positive on file.

Milos
Title: Re: different messages after scanning with rescue disk
Post by: 1234ava on September 09, 2015, 03:46:40 PM
@Milos
I can't send the detected files because Avast Rescue deleted them, like I said.
Anyways, they were thousands of files in the c:\Windows folder.
I was testing the "Rescue Disk" (actually a pendrive) on a malware-free system (according to Avast IS and other scanners). It was a perfectly functioning system, before Avast Rescue broke it.

Regardless of what files they were and why Avast detected them, Avast Rescue gave incorrect and contradictory information (51,000 infected files... then 0 infected files!, then again they were listed in the "Fix it manually" window) and deleted those files without user request (I just clicked the scroll-bar, not the Delete button! you can even see where the cursor was in my photo #3).


I also tested Avast Rescue on another PC, an old notebook with Windows Vista: no problem there.

Maybe Avast Rescue has issues on systems with UEFI SecureBoot?


Title: Re: different messages after scanning with rescue disk
Post by: Izibia on September 09, 2015, 06:03:56 PM
Hello,
can you send us the detected files to analyze, please? Use https://support.avast.com/ -> Avast Virus Lab, report False positive on file.
Milos

I don't think you need to analyze files.
In order to recreate the bug, have passworded packed files in the scanned system (see my previous posts for details)

I also tested Avast Rescue on another PC, an old notebook with Windows Vista: no problem there.

Maybe Avast Rescue has issues on systems with UEFI SecureBoot?

It seems unlikely that UEFI would cause the issue. The issue happened to me on two different computers with BIOS. edit: one computer was with Windows XP, another one with Windows 7.
Title: Re: different messages after scanning with rescue disk
Post by: 1234ava on September 17, 2015, 05:49:52 PM
...snip...
So accordingly to Avast PE, the number of infected files is 0 and 130 simultaneously

Bump! Is Avast working on this bug? It was reported by several users since January 2015 at least.
Title: Re: different messages after scanning with rescue disk
Post by: bob3160 on September 17, 2015, 05:54:23 PM
...snip...
So accordingly to Avast PE, the number of infected files is 0 and 130 simultaneously

Bump! Is Avast working on this bug? It was reported by several users since January 2015 at least.
Avast is probably waiting for someone to send them the files as they requested in a prior reply.
Title: Re: different messages after scanning with rescue disk
Post by: 1234ava on September 17, 2015, 06:09:53 PM
...snip...
So accordingly to Avast PE, the number of infected files is 0 and 130 simultaneously

Bump! Is Avast working on this bug? It was reported by several users since January 2015 at least.
Avast is probably waiting for someone to send them the files as they requested in a prior reply.

You mean when they asked to send the deleted files?
Title: Re: different messages after scanning with rescue disk
Post by: bob3160 on September 17, 2015, 08:57:27 PM
That's correct. :)
Title: Re: different messages after scanning with rescue disk
Post by: 1234ava on September 17, 2015, 11:09:18 PM
That's correct. :)

  ::) ;)
 
Anyways, I noticed the first two file names in the list (as in my screenshot #3: AcGenral.dll and AcLayers.dll in C:\Windows\AppPatch). I retrieved those two files from a recent backup of mine (a few days before the Rescue disk test) and compared them with the same files in my brand new Windows 10 installation (reinstalled after Rescue disk destroyed Windows). Same hashes, they are the same files exactly.
I guess am going to send those two files in case it helps, even though they are the same files that can be found in any Windows10 Home 64-bit installation: AcGenral.dll v.10.10240.16384 and AcLayers.dll v.10.10240.16425.