Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: MikeRepairs on January 14, 2011, 08:16:08 AM

Title: 5.1.889 Behavior Shield problem - USB flash drive
Post by: MikeRepairs on January 14, 2011, 08:16:08 AM
I am a technician and service many computers every day.
All computers I installed Avast Free 5.1.889 on are no longer able to install programs from my write locked PQI U338 flash drives. (unless I unlock it)

I have many program installers on PQI U338 (4G and 8G)USB flash drives I use to install common programs like CCleaner, Firefox, Java, Quicktime, Flash, etc.
Lets say I click on CCleaner install, the 5.1.889 behavior shield causes the light to rapidly blink and what would normally take a few seconds turns into 7 minutes. There is no error message but it is like time is slowed by a factor of 1000.

How I verified it was the behavior shield:
5.0.677 did not do this. Never had this problem until I started installing 5.1.889 on a bunch of computers today. Tested on WinXP and Win7 64 bit no other security software. If I uninstall the behavior shield in add/remove programs the problem goes away. If I switch the write lock switch on the flash drive to unlock, the problem goes away. (the light no longer rapidly blinks). I must be able to keep the write lock switch on the flash drive locked for security reasons, so viruses could never get on it when servicing computers.

Please fix this problem. Thanks for any help

Title: Re: 5.1.889 Behavior Shield problem - USB flash drive
Post by: igor on January 14, 2011, 10:13:20 AM
How is the flash drive formatted - FAT or NTFS?
Title: Re: 5.1.889 Behavior Shield problem - USB flash drive
Post by: GaAs on January 14, 2011, 12:57:43 PM
Hi All.
Hi Igor.
This morning I suffered a blockage in the safe removal of my external HD USB. I have tried to identify the process that took up the device but it was impossible.
 I used "Process Explorer", "Tools to admin", "viewing the Windows event log. " But nothing.
 I proceeded to create the "rundll32.exe.dmp" (with: Hang Reporting Tool) at the very moment of the error message: "impossible to disable the device. "
 There may be of interest?
 If not, I might give a method to identify positively the process that locks the hardware disconnection?.
 Thank you very much.
Title: Re: 5.1.889 Behavior Shield problem - USB flash drive
Post by: pk on January 14, 2011, 01:36:15 PM
@MikeRepairs, thanks for your report. Actually, it took some time to get a USB Flash Drive with hardware r/w locking to verify this issue (even for IT company :)). But finally, we can confirm that and it's currently under investigation...

@GaAs, you can't use user-mode tools for that. I got into the same situation as you, unable to safe remove my USB HDD or USB flash drive. It hasn't happened before. I think it might be still a problem with antirootkit.
Title: Re: 5.1.889 Behavior Shield problem - USB flash drive
Post by: GaAs on January 14, 2011, 01:43:33 PM
@MikeRepairs, thanks for your report. Actually, it took some time to get a USB Flash Drive with hardware r/w locking to verify this issue (even for IT company :)). But finally, we can confirm that and it's currently under investigation...

@GaAs, you can't use user-mode tools for that. I got into the same situation as you, unable to safe remove my USB HDD or USB flash drive. It hasn't happened before. I think it might be still a problem with antirootkit.

Thank you PK.
If I can be useful for something let me know.
 :) ;)
Title: Re: 5.1.889 Behavior Shield problem - USB flash drive
Post by: MikeRepairs on January 14, 2011, 06:19:47 PM
How is the flash drive formatted - FAT or NTFS?


Some are FAT, some are FAT32
Title: Re: 5.1.889 Behavior Shield problem - USB flash drive
Post by: =SKY= on January 15, 2011, 08:47:29 PM

@GaAs I got into the same situation as you, unable to safe remove my USB HDD or USB flash drive. It hasn't happened before.

Same at me, Peter! :'(

I'm unable to safe remove my cardreader with SD-card inside.

Never had such a problem before...

You give me hope to solve the problem!!! ;)
Title: Re: 5.1.889 Behavior Shield problem - USB flash drive
Post by: Nesivos on January 15, 2011, 09:20:54 PM
I am a technician and service many computers every day.
All computers I installed Avast Free 5.1.889 on are no longer able to install programs from my write locked PQI U338 flash drives. (unless I unlock it)

I have many program installers on PQI U338 (4G and 8G)USB flash drives I use to install common programs like CCleaner, Firefox, Java, Quicktime, Flash, etc.
Lets say I click on CCleaner install, the 5.1.889 behavior shield causes the light to rapidly blink and what would normally take a few seconds turns into 7 minutes. There is no error message but it is like time is slowed by a factor of 1000.

How I verified it was the behavior shield:
5.0.677 did not do this. Never had this problem until I started installing 5.1.889 on a bunch of computers today. Tested on WinXP and Win7 64 bit no other security software. If I uninstall the behavior shield in add/remove programs the problem goes away. If I switch the write lock switch on the flash drive to unlock, the problem goes away. (the light no longer rapidly blinks). I must be able to keep the write lock switch on the flash drive locked for security reasons, so viruses could never get on it when servicing computers.

Please fix this problem. Thanks for any help



Did you scan the USB drive for infections after installing AIS 5.1.889?  I don't think that you said whether you did or not.  I am sure that as a technie that you know that USB drives are one of the worst sources of all kinds of bad stuff. Personally I never use them unless I absolutely must which is hardly ever.

If I was a techie :) I would use remote desktop access to my own computer to install software on someone else computer before I would use a USB drive but that is just me. :)   If I couldn't do that I would use a CD with all of the programs that I install on someone else computer before using a USB drive.

P.S. Plug and Play is also a high risk deal.  I have had Plug and Play turned off on my computers for years.
Title: Re: 5.1.889 Behavior Shield problem - USB flash drive
Post by: MikeRepairs on January 15, 2011, 09:42:23 PM
Nesivos,

I am a full time computer technician.
There is nothing wrong with my method of using USB flash drives with the write lock switched to "lock" to service computers. Autorun viruses cannot get on it this way. CD drives are slow and some infected computers have broken TCP/IP stack. I am not looking for another method of performing my services, I was merely pointing out a bug I found in Avast 5.1.889
No viruses are on the USB drive. I have special technician tools I use to fight viruses on it. Also installers for common programs.
PK confirmed the problem and said it is currently under investigation.
Title: Re: 5.1.889 Behavior Shield problem - USB flash drive
Post by: dansorin on January 16, 2011, 05:00:21 PM
since upgrading to 5.1.889 i'm unable to safely eject the usb stick. happens on XP SP3 and W7 32b.
Title: Re: 5.1.889 Behavior Shield problem - USB flash drive
Post by: =SKY= on January 16, 2011, 07:58:33 PM
Hi dansorin,

pk can reproduce the problem. I think he and the others from the team will help us, look here:

... I got into the same situation as you, unable to safe remove my USB HDD or USB flash drive. It hasn't happened before. I think it might be still a problem with antirootkit.
Title: Re: 5.1.889 Behavior Shield problem - USB flash drive
Post by: =SKY= on January 18, 2011, 02:12:36 AM
Same problem in this thread, too: http://forum.avast.com/index.php?topic=69594.0 (http://forum.avast.com/index.php?topic=69594.0)

Isn't it better, to create just one thread to this problem?
Title: Re: 5.1.889 Behavior Shield problem - USB flash drive
Post by: =SKY= on January 23, 2011, 08:05:10 PM
When can we expect a solution for the problem? ???

I mean a really solution, not a workaround! :(
Title: Re: 5.1.889 Behavior Shield problem - USB flash drive
Post by: pk on January 23, 2011, 08:15:18 PM
in next program update (and this will take 3-4 weeks)
Title: Re: 5.1.889 Behavior Shield problem - USB flash drive
Post by: EagleGhost on January 24, 2011, 03:11:23 PM
in next program update (and this will take 3-4 weeks)

Do you mean that "cannot remove USB device safely" issue?
Title: Re: 5.1.889 Behavior Shield problem - USB flash drive
Post by: Sparxx on January 24, 2011, 03:22:41 PM
in next program update (and this will take 3-4 weeks)

Do you mean that "cannot remove USB device safely" issue?

Yes.
Title: Re: 5.1.889 Behavior Shield problem - USB flash drive
Post by: =SKY= on January 24, 2011, 09:19:46 PM
in next program update (and this will take 3-4 weeks)
Hi Peter,

thank you for your fast answer!!!

It's good to know, that you're looking for a solution.
Hope it will be succesful. Thank you! ;)
Title: Re: 5.1.889 Behavior Shield problem - USB flash drive
Post by: Chim on January 25, 2011, 03:17:25 PM
Alright, PK, THAT's what I wanted to hear ... an official answer that y'all WERE working on the issue.  :) It's impossible to read all the threads / comments and up to now I wasn't sure if the issue was being looked into.  But, now I see that it is.  YES!