Avast WEBforum
Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: Malkor on April 09, 2008, 01:26:07 AM
-
Whenever I upgraded Avast! Home to 4.8 (and uninstalled and reinstalled just to make sure by Avast! support) it skips over the "System Volume Information" whenever I scan the system. I always do a thorough scan with archived files checked. I also notice that it skips from 29% to 57% whenever it goes from Documents and Settings to Program Files and goes from 79% to 100% whenever it finishes scanning.
However if I do a boot scan it works perfectly fine and scans all files with the percentage going up steadily.
Any thoughts?
-
Well the system volume information folder can be absolutely huge unless you restrict its size in the system restore. I have seen it balloon to over 1.5GB. The progress isn't a precision tool and I think it updates after folders, so that may account for the jump.
There is nothing in the program to make it skip the system volume information folder/s unless you specifically exclude it from scans, unwise.
Right click on the folder and see how big it is ?
The boot-time scan I don't think scans all files. I don't see this huge jumps on my system, for one I don't do a thorough scan with archives, life it too short.
Archive (zip, rar, etc.) files are by their nature are inert, you need to extract the files and then you have to run them to be a threat. Long before that happens avast's Standard Shield should have scanned them and before an executable is run that is scanned. Thorough is also by its design very thorough and perhaps a little overkill for routine use, were a Standard scan without archives should be adequate.
I have only ever done a through scan with archives once shortly after installation just to ensure a clean start state, but with XP for example avast will do a boot-time scan after installation if you select it, this I believe will be quicker and reasonably effective. Like everything in life things are a compromise.
-
By default the folder is locked, although the size is set up to 3433MB.
-
Are you saying the previous version (4.7) of avast! scanned this folder even from Windows for you, but now (4.8) it doesn't - or you don't know if anything has changed?
Are you logged on as an administrator, or as an ordinary user?
-
By default the folder is locked, although the size is set up to 3433MB.
I would suggest you recover some of this disk space, and reduce the size. You may also consider setting a new clean restore point and clearing the old restore points, obviously when you are happy that things are right with your current setup.
-
David makes a good suggestion. I just lowered the amount I allowed for "Sys Restore" on my XP box to about 2% from 12%. It freed up over 2 Gig of HDD space. The default was 12% or about 28 Gig on my 250 Gig HDD. WAY TOO much stuff was being saved. It's suggested that it be set for around 1 gig -- but not less than 500 meg. Here's a good link if interested:
Keeping System Restore Healthy:
http://bertk.mvps.org/html/healthy.html
Adjust the Disk Space Used (or data store) by System Restore. By default System Restore will use 12% disk space for most size drives. With new larger drives the data store can get quite large, which has been know to cause problems in System Restore. Setting the data store to just under 1GB should be adequate. Note: Reducing the data store size will purge the oldest restore points on a FIFO (first in first out) bases and leave as many recent restore points as the new size will allow. Restore points over 90 days are purged automatically by default.
-
Are you saying the previous version (4.7) of avast! scanned this folder even from Windows for you, but now (4.8) it doesn't - or you don't know if anything has changed?
Are you logged on as an administrator, or as an ordinary user?
I'm the only user on the machine in question, but other multi-user machines I am set as administrator. Yes, Avast! 4.7 scanned the folder, but 4.8 will not (only under boot time scan it will).
I would suggest you recover some of this disk space, and reduce the size. You may also consider setting a new clean restore point and clearing the old restore points, obviously when you are happy that things are right with your current setup.
Good point, which I can easily do on my computer, but family machines I opt to leave all points in because, from time to time, they bring me the machine with problems a few weeks later than I would like. My workstation only is equipped with a 30GB drive (which is not upgradeable above 40GB under normal specifications) which shouldn't be much of a problem when it comes to large sizes. On external drives I disable it in its entirety because it is quite useless when some points are system specific.
I went ahead and tried it on a few other computers and it has the same symptoms.
-
Interesting... what operating system is that?
-
Interesting... what operating system is that?
Windows XP Home SP2 by Hewlett Packard and Windows XP Professional OEM SP2 (using IBM serial).
-
Try the following, please:
Download File Monitor (http://technet.microsoft.com/en-us/sysinternals/bb896642.aspx), run it and set a filter (Ctrl+L) to *ashquick* (those asterisks included)
Then, rightclick the "System Volume Information" folder in a file manager and choose "Scan" (alternatively, you may use ashQuick.exe from avast! installation folder: ashQuick.exe "c:\System Volume Information" ).
What does File Monitor show afterwards?
-
I didn't need to download the File Monitor for the quick scan to test System Volume Information.
-
I didn't need to download the File Monitor for the quick scan to test System Volume Information.
No, but Igor needs the information to troubleshoot what's going wrong with your system...
-
As far as I know, there is nothing wrong with my ThinkPad.
Assuming that Avast! scans in alphabetical order, it has skipped "System Volume Information" on two other machines. The HP which I mentioned and a Toshiba Satellite running Vista SP1.
All three systems are laptops, but I don't think Avast! distinguishes between desktops and laptops.
Note: The Vista machine blocks access to the folder when I try to scan it manually.
-
Every weekly scan (I use ashquick.exe) has terminated for a couple of years now (through all versions of avast) with:
N:\System Volume Information
I followed the request from igor (but I already keep the very useful Filemon on my system) and it clearly shows that the folder is scanned. It is not clear to me why you appear reluctant to comply with the request.
-
The Quick Scan sees the System Volume Information perfectly, I'm referring to the ashSimpl.exe.
-
I just conducted an ashSimpl.ex scan of the same disk. Filemon shows very clearly that ashSimpl.exe scanned the System Volume Information.
I ask again ... is there a reason you are failing to use a tool that will show if your concern is well founded?
By the way a Quick Scan is part of either ashSimple.exe or ashSimp2.exe the process ashquick.exe is, in fact a thorough scan with archive scanning by default.
-
Because I don't understand what it is used for. Saying "run program X" doesn't justify a reason. In other words how does Filemon work?
-
It is a Microsoft/System Internals product provided for the very function of reporting file system accesses.
It does not require an install it is just a program you download and run.
If you cannot believe the advice of igor (a prominent member of the avast team contributing to this forum) then I have to wonder why you feel able to trust the avast product on your system.
-
I never said I didn't believe the advice of Igor, it is just that whenever I undervolt my CPU, I know it literally doubles the scanning time when the System Volume Information is scanned. Plus I do not think a 1600MHz Low Voltage M (600MHz at minimal power respectively) combined with a 4200RPM Hitachi can scan 2.1GBs of files in 0.0 seconds.
In other words, I find it pointless to run a tool whenever I look on my screen at the obvious. It is occuring on all machines that I have run it on so far. 4.8 is new, and probably has a few changes (for example the "Would you like to set up a boot time scan" does not appear whenever I installed Avast! on a brand new Vista SP1 machine).
-
It seems you wish to confuse multiple issues to avoid the central issue of this thread.
You, almost certainly, do not know how the internals of avast work yet you installed it on your system apparently unconcerned by that fact.
A member of the team had provided you with a way of confirming your concern and you decide to ignore that advice. I have to assume that you do not wish to see the evidence it might provide.
I regret to conclude that further discussion with you will be of no value to you and a waste of my effort.
-
Confuse? I have already confirmed my problem, which is only one problem by means of simple logic. Avast 4.8, when running a full thorough scan from the Simple User Interface will not scan "System Volume Information." I did not mention any other issues. All machines that I have done this show the exact same results. You people keep assuming that it is my setup, and it is not. My ThinkPad X31 works flawlessly. You didn't run the procedure I did either, that doesn't help. If you hadn't noticed in 4.8, Avast! scans the main Windows folders for what seems to be a spyware/startup/memory check before it even touches the first file in alphabetical sequence for a scan. Now granted it probably scans for spyware and viruses simultaneously, but then it doesn't make sense on the first folders it scans. It doesn't do that on the boot time scan at all.
Here are the results of three scans I did recently:
Avast! Thorough scan using the SUI.
65115/1615 (Roughly 14200 files are done in the preliminary check and are scanned twice).
24:25
0 infected files
7.2GB of data.
Avast! Quick Scan on drive C: using right click and pressing "Scan C:\" from My Computer. It does scan "System Volume Information."
~59000 files
Avast! Boot time scan on drive C: by scheduling it from the SUI.
59049 files
1855 folders
So let me add up the numbers. I found that roughly 8000 files were in "System Volume Information." If you take the 65000 I got from the SUI scan, subtract the duplicate files and add in the 8000, I get around 59000 files. Both Quick Scan and boot time scan get me 59000 files.
-
Please tell us how simply, clearly what confirmation you have of your assertion that avast does not scan this folder.
I have direct evidence from Filemon in the scans you specify that it does. I will be happy to post that evidence here.
Please post the clear evidence here that it does not. Igor has proposed to you the evidence available in the Filemon report ... I simply cannot understand why you wish to avoid the real evidence when you persist in simply asking us to accept your supposition that it is not scanned.
I am not here as a lackey of avast - I am doing my very best to reproduce the problem you report. If you want help you need to show a little more willingness to work with those trying to help you. Otherwise I will concentrate on trying to reproduce the problems (as I often do) reported by other users.
-
Where on earth do you come up with the information that 8000 files are in system volume information?
I have drives C: thru N: on my system and the largest System Volume Information on any of them is shown at 20Kb.
If you are relying as gospel on any of the "files scanned" by avast (especially in a thorough scan with archives) then you are in a dream world. avast's counting of files is interesting ... just try an ashquick scan of just one MS Word document.
-
I'd like to clarify something - Malkor, I am not saying you are wrong about the files not being scanned on your computer, but
- it certainly doesn't happen on every computer (as you seem to expect), no matter if you reproduced it on your two or three machines
- I need the information from the File Monitor if I should do something about it; I'm not promissing anything, but without the File Monitor info, I can hardly do anything.
-
Malkor could You please do these simple steps:
1. open 'any' browser and visit this site http://technet.microsoft.com/en-us/sysinternals/bb896642.aspx
2. from there You can see url on right which lead to download http://download.sysinternals.com/Files/Filemon.zip
3. unpack anywhere, execute filemon.exe
4. on first window type into include line following: as*
5. do scan where You think it fail to scan System Volume Information directories
6. when done use CTRL+E to disable disk activity logging
7. open menu File > Save As.. and save the report
8. email it to Vlk or Igor with description
in short, this 5m(+- scan time) task would solve not just this discussion but maybe even help resolve the problem for once and all
-
Error: Email attachments can only be up to 10MB. The log is 32MB.
I have confirmed this error on four different machines, so thus I want someone else to verify this for me. The folder layout I will portray as default, meaning that there are only directories put in by Microsoft. This discussion should be resolved if people will not insist on using the quick scan and actually using the SUI.
Step 1: Start Avast! Simple User Interface by using the taskbar icon or the start menu.
Step 2: Press the hard drive icon on the top right corner of the Avast! window.
Step 3: Move the slider to Thorough.
Step 4: Check "Scan Archived Files."
Step 5: Press play.
Step 6: Watch how Avast! scans between 8000 and 50000 files before even starting in alphabetical order, these files are scanned twice in 4.8.
Step 7: Before Avast! finishes Program Files (XP) or ProgramData (Vista), watch carefully. Notice how it skips to C:\Windows (XP) or C:\Users (Vista) and does not display "C:\System Volume Information."
Step 8: Let the scan finish.
-
I have only tested this on Win XP SP2 systems. They produce identical results.
I have followed the steps you outline. Since you specified the SUI I used the skinless SUI thorough scan with archive scanning.
The instant avast starts scanning a count appears along with the folder name currently being scanned. Scanning is not processed strictly in alphabetical order.
I suspect you do not see the system volume folder appear because it is so small and scanned so fast.
Here is the Filemon log showing the access of the system volume information by avast during the scan.
-
I guess you forgot the post that stated that 2.1GB cannot be scanned instantly.
Why does yours say AshSimp2?
I might add that on a brand new factory installed Vista machine, that System Volume Information is not properly accessed.
Number of scanned files/folders: 23/2
Run-time: 00:00:00
Size: 20.0K.
Using this fact, just because your FileMon reads the directory does not mean Avast! actually scans the files.
Edit: Another XP machine skipped "System Volume Information."
-
I guess you forgot the post that stated that 2.1GB cannot be scanned instantly.
Why does yours say AshSimp2?
Can't you follow simple instructions? If you want help,then follow Igor's instructions, if you don't then stop complaining.
-
ashsimp2 is the skinless version of the simple user interface. Same scanner, just no skin. It won't change the results.
-
I guess you forgot the post that stated that 2.1GB cannot be scanned instantly.
Why does yours say AshSimp2?
Can't you follow simple instructions? If you want help,then follow Igor's instructions, if you don't then stop complaining.
I did, I got a 32MB log file. Not to mention the instructions did not state what to do with the file. What, just leave it on my hard drive platters for me to stare at?
-
Using this fact, just because your FileMon reads the directory does not mean Avast! actually scans the files.
Why not? FileMon clearly shows that AshSimp2.exe accessed (see the process column) the files. You even don't understand the program. Why you argue with Avast developers? You think that you know more than them.
-
I guess you forgot the post that stated that 2.1GB cannot be scanned instantly.
Why does yours say AshSimp2?
Can't you follow simple instructions? If you want help,then follow Igor's instructions, if you don't then stop complaining.
I did, I got a 32MB log file. Not to mention the instructions did not state what to do with the file. What, just leave it on my hard drive platters for me to stare at?
Then make a screen shot like Alan made
-
I should have the screen shot ready in 45 minutes.
-
Here is the screen shot, the error can be duplicated on six computers.
-
Well, I can say that this doesn't really make much sense to me... I mean, the fact that the System Volume Information content cannot even be enumerated certainly means that it won't be scanned (let's put aside the reason why for now) - but the percentage certainly shouldn't "jump" here, because even the estimation wouldn't know about the files inside...
Anyway, I'd be interested in the "ashQuick" scan of the System Volume Information folder only (the File Monitor log), as I wrote in my original post... it's rather unnecessary to scan the whole drive using Simple UI,,,
-
I am able to reproduce the error seen by Malkor (access denied) by performing a scan as a limited account user.
The other tests I conducted were as an administrator.
-
Error: Email attachments can only be up to 10MB. The log is 32MB.
Did you zip it?
-
Tech,
I think that sending the filemon log is probably unnecessary now since the relevant section was posted above and I suspect that the "access denied" is occurring for the reason I gave above.
If the file is really needed then I am sure the team will advise.
-
Tech,
I think that sending the filemon log is probably unnecessary now since the relevant section was posted above and I suspect that the "access denied" is occurring for the reason I gave above.
If the file is really needed then I am sure the team will advise.
Ok. My question remains... did the user zip the log? I'm impressed with a zipped file of 32Mb...
-
I doubt that the user had zipped the file. My equivalent log (for scanning just my C: drive) was 76.5Mb and zips down to just less than 5Mb.
-
My email provider bans the use of zip and exe files. I should be able use rar and other formats if memory serves.
Out of all of the machines, two of them are logged as "the Administrator" account and still has this bug.
It only occurs whenever I use the full system scan option, as it also double scans files as well (no other scan does this to my knowledge). However on Windows Vista I am totally banned (even on "the Administrator" account, the people who built the machine had it set up that way despite Microsoft not recommending it) from accessing the data in System Volume Information.
-
In "double scanning" do you have the avast report log that shows the files being scanned twice or are you relying on the numbers that you see appearing in the interface?
As I mentioned earlier the number of files scanned as reported by avast in a thorough scan with archives can give numbers that include the files scanned within an archive file.
If you have not set the report to include the scanned files then the filemon log you have created would also serve to show any files that have been scanned more than once.
-
I use both numbers I see in the interface as well as the Filemon log.
-
As I have tried to explain - the numbers in the interface are not reliable.
Can you post the screenshots of the log showing the same files being scanned please?
-
As I have tried to explain - the numbers in the interface are not reliable.
Can you post the screenshots of the log showing the same files being scanned please?
I am going to assume you're saying Avast! is not reliable.
I will post a screen shot whenever I get my other test rig fully operational. It's still working on updates.
-
By the way the thorough scan with archives is precisely the same scan that is performed when you right click on a file in the explorer folder view and select that you want the file scanned by avast.
Just for your own interest you may wish to perform that scan on one of the files in question to see what numbers are reported to you.
-
Avast! Thorough scan using the SUI.
65115/1615 (Roughly 14200 files are done in the preliminary check and are scanned twice).
24:25
0 infected files
7.2GB of data.
Avast! Quick Scan on drive C: using right click and pressing "Scan C:\" from My Computer. It does scan "System Volume Information."
~59000 files
Avast! Boot time scan on drive C: by scheduling it from the SUI.
59049 files
1855 folders
These are the results from a few days ago, just in case that helps you or not.
-
When you scan archives avast is reporting back to you all the files it scanned within the file.
It is reliably reporting to you that it scanned a lot more in an archive file than 1 file. When you are unaware of that it is easy to be confused by the numbers you see in the user interface.
You are not the first to say this in the forum - it comes up over and again and always causes an interesting discussion. Indeed, a long time ago, I was the one in your position pointing out that the numbers on an archive scan did not make sense.
-
I do not believe there is a "preliminary" check. However, if am wrong I am sure I will be corrected by someone in the team.
-
For some reason, according to Filemon, Avast! is scanning absolutely nothing that makes sense during the first files. All it comes up with is "I:\" (Long story short, media reader has drives C-F with XP SP2 on that machine) with a few directory hits. Although the SUI keeps displaying random system directories and the Avast! directory. I started a second scan and aborted once it began Documents and Settings, I get 2.1GBs of data scanned.
The test machine fails to open "System Volume Information" using the thorough scan using the SUI (and selecting the system scan if I hadn't already mentioned).
I went ahead and ran Filemon on the Quick Scan, and the compressed file is 167KB.
-
And can you upload the ashQuick FileMon log to ftp://ftp.avast.com/incoming - for example?
Thanks.
-
Yup and done.
-
I must say the log didn't show anything suspicious, the files were scanned as usual...
Anyway, I got probably slightly confused by the references to "quick scan" in some posts (it's not always clear where "quick scan" is used to describe Quick/Standard/Thorough scan sensitivity inside Simple UI, and when it means Explorer Extension (= ashQuick.exe)).
First, regarding the double scanning:
- When Simple UI runs a Standard or Thorough scan, it performs a rootkit scan first (on specific areas - not the whole disk, as far as I know). So, it may seem that these areas are scanned twice, but it's a different type of scan
- There's additional initial disk access that "browses" all the selected areas somehow - to estimate the size and display the progress somehow - so it File Monitor log, it might seem that there another scan running - but it's as expected.
So, you are saying the all the scans (ashQuick.exe, boot-time scan, Quick/Standard scan in Simple UI) scan the files in System Volume Information, but Thorough scan in Simple UI doesn't... right?
What if you choose "Folder selection" in Simple UI (with Thorough scan) and select the System Volume Information folder only - does the scan finish immediatelly?
-
Damn, when I was writing the post (and formulating the questions), I've realized that there indeed might be a problem there... I'll check it tomorrow and will let you know.
-
Only whenever the rootkit scan is invoked, Avast! SUI fails to access the System Volume Information. Assuming I answered that correctly. Scans that don't invoke it (AshQuick.exe*, Boot-time scan**, individual folder scan in SUI*) work fine.
I wasn't familiar with the rootkit scan, though thanks for clarifying.
*XP only. On Vista SP1 the AshQuick causes Vista to display "Access Denied" error and the SUI scan only scans 20kbs of data.
**Not tested on Vista yet.
Edit: I would probably suggest people to reference the shell extension as Quick Scanner and SUI one as Quick Scan. I get confused too and assume people meant the shell extension unless the AshQuick.exe is specified.
-
The problem should be fixed in the next program update.
Thanks for your help!
-
You're most certainly welcome. Keep up the good work, igor.
-
The issue should be fixed in the latest beta (http://forum.avast.com/index.php?topic=34612.0).