Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: eric37200 on November 24, 2004, 01:06:26 PM

Title: 5 minutes to scan 4 mails........ :-(
Post by: eric37200 on November 24, 2004, 01:06:26 PM: hello

its becae to be very annoying...
i used avast with xp pro fr sp2 since...a long time...
since the new version of avast i've got always this same big problem...
avast made a long time to scan my mails when it found a virus and i cant delete this virus when avast ask me what i want to do....i just can click "ok"...
...if i click "delete", avast say it cant find the mail with virus.... ???
(http://)

help me please !
Title: Re:5 minutes to scan 4 mails........ :-(
Post by: Eddy on November 24, 2004, 01:18:31 PM: Set Avast to run in silent mode. Let us know if it helps/solves anything.
Title: Re:5 minutes to scan 4 mails........ :-(
Post by: eric37200 on November 24, 2004, 01:21:18 PM: i try this in the past...
http://forum.avast.com/index.php?board=2;action=display;threadid=8838;start=0 (http://forum.avast.com/index.php?board=2;action=display;threadid=8838;start=0)
i try avast beta too...
Title: Re:5 minutes to scan 4 mails........ :-(
Post by: Lisandro on November 24, 2004, 03:51:24 PM: Quote from: eric37200 on November 24, 2004, 01:06:26 PM
...if i click "delete", avast say it cant find the mail with virus.... ???

If you choose the Silent Mode, when you click on the buttom, maybe the infected file was already deleted ::)
Title: Re:5 minutes to scan 4 mails........ :-(
Post by: eric37200 on November 24, 2004, 03:53:31 PM: no...virus is not deleted....virus's always attached with my mail....
Title: Re:5 minutes to scan 4 mails........ :-(
Post by: Lisandro on November 24, 2004, 06:53:52 PM: Can you schedule a boot-time scanning?
Start avast! > Right click the skin > Schedule a boot-time scanning
Select for scanning archives.
Boot.

It will be good running SpyBot and Ad-aware too... You're infected :'(
Title: Re:5 minutes to scan 4 mails........ :-(
Post by: eric37200 on November 24, 2004, 07:45:05 PM: no infections : i do a complete scan by avast last night, i used spybot and ad-aware too
i used spyware guard and spyware blaster....and i've got a firewall well configured... 8)
Title: Re:5 minutes to scan 4 mails........ :-(
Post by: eric37200 on November 24, 2004, 08:55:15 PM: Quote from: Eddy on November 24, 2004, 01:18:31 PM
Set Avast to run in silent mode. Let us know if it helps/solves anything.
no change... ::)
Title: Re:5 minutes to scan 4 mails........ :-(
Post by: Lisandro on November 25, 2004, 02:48:37 AM: Eric, it's becoming a mistery... :-\ ???
Is the attached file (the infected one) a big one or an archive file?
Title: Re:5 minutes to scan 4 mails........ :-(
Post by: eric37200 on November 25, 2004, 08:13:21 AM: generally an archive files.... ::)
Title: Re:5 minutes to scan 4 mails........ :-(
Post by: galooma on November 25, 2004, 08:17:48 AM: have you tried an online scanner?
:)
Title: Re:5 minutes to scan 4 mails........ :-(
Post by: eric37200 on November 25, 2004, 12:34:43 PM: yep...with trend pc-cillin...

....and this problem happened just with the last update of avast...
...i used avast since...1 year at least, and i've got no problem...
Title: Re:5 minutes to scan 4 mails........ :-(
Post by: Lisandro on November 25, 2004, 12:44:16 PM: Quote from: eric37200 on November 25, 2004, 08:13:21 AM
generally an archive files.... ::)

Which one? *.zip, *.arj?
What is the size of the files?
Title: Re:5 minutes to scan 4 mails........ :-(
Post by: eric37200 on November 25, 2004, 01:23:17 PM: i cant reply before...next viruses.... :)
i delete files manually at each times...in case of my girlfriend ad a bad idea when seein these files.... 8)

but i repeat i've got this problem only with new avast...i used it since at least 1 years with no problems...and spread good speech about it.... :)
Title: Re:5 minutes to scan 4 mails........ :-(
Post by: Vlk on November 26, 2004, 09:26:55 AM: Hi Eric, you were saying that you get a number of those:

AAVM - scanning error: ClientRqDispatchThread: OpenEventsAndMapping failed - client probably died, 00000159.

in the Event Log. Each such an error should be preceded by another one (a different message, such as "OpenEventsAndMapping: xxxx failed"). Do you see any such a message? If so, can you post their exact form?

Or even better, can you post the contents of the file <avast>\data\log\error.log?

BTW aren't you, by any chance, using the Fast User Switching feature of Windows XP? Or a Remote Desktop?

Thanks
Vlk
Title: Re:5 minutes to scan 4 mails........ :-(
Post by: eric37200 on November 26, 2004, 01:45:29 PM: hi vlk
as soon as possible i reply....(night was short... 8) )
i try avast beta version since yesterday and i haven't got this message...but always problems...
...but to answer your question, this is the other message : "AAVM - scanning error: OpenEventsAndMapping: OpenEvent failed!, 00000002. "

and a extract of the contents of the file <avast>\data\log\aswMaiSv.log...
...i havent got error logs files...
--POP Mail is clean
11/26/04 02:48:30 00000EE8: --POP Timeout during ProcessFile
11/26/04 02:48:31 00000FF0: --POP Timeout during ProcessFile
11/26/04 02:48:40 00000EE8: --POP Timeout during ProcessFile
11/26/04 02:48:41 00000FF0: --POP Timeout during ProcessFile
11/26/04 02:48:50 00000EE8: --POP Timeout during ProcessFile
11/26/04 02:48:51 00000FF0: --POP Timeout during ProcessFile
11/26/04 02:49:00 00000EE8: --POP Timeout during ProcessFile
11/26/04 02:49:01 00000FF0: --POP Timeout during ProcessFile
11/26/04 02:49:10 00000EE8: --POP Timeout during ProcessFile
11/26/04 02:49:11 00000FF0: --POP Timeout during ProcessFile
11/26/04 02:49:20 00000EE8: --POP Timeout during ProcessFile
11/26/04 02:49:21 00000FF0: --POP Timeout during ProcessFile
11/26/04 02:49:30 00000EE8: --POP Timeout during ProcessFile
11/26/04 02:49:31 00000FF0: --POP Timeout during ProcessFile
11/26/04 02:49:40 00000EE8: --POP Timeout during ProcessFile
11/26/04 02:49:41 00000FF0: --POP Timeout during ProcessFile
11/26/04 02:49:50 00000EE8: --POP Timeout during ProcessFile
11/26/04 02:51:20 00000E9C: TimeoutThread error -1(0xFFFFFFFF)
11/26/04 02:51:20 00000E9C: --POP Mail is infected
11/26/04 02:51:20 00000E9C: SendTimeout2 error 10053(0x00002745)
11/26/04 02:51:20 00000E9C: RecvTimeout error 10053(0x00002745)
11/26/04 02:51:21 00000494: --SMTP Mail is clean
11/26/04 02:51:21 00000494: RecvTimeout error 10053(0x00002745)
11/26/04 02:51:28 00000964: --POP Heuristic module found something and user wants to delete message
11/26/04 02:51:28 00000964: SendTimeout error 10053(0x00002745)
11/26/04 02:51:28 00000964: --POP [Heuristic] : Cannot send modified message!
11/26/04 02:51:28 00000964: TimeoutThread error -1(0xFFFFFFFF)
Title: Re:5 minutes to scan 4 mails........ :-(
Post by: Lisandro on November 26, 2004, 07:09:00 PM: Are you using the last build 4.5.536?
It solves the timeout problems.
Title: Re:5 minutes to scan 4 mails........ :-(
Post by: eric37200 on November 26, 2004, 07:15:44 PM: actually i try last beta version updated...
...with same results....
:-\
Title: Re:5 minutes to scan 4 mails........ :-(
Post by: farfouille on November 27, 2004, 02:41:34 PM: Hello,

I've the same problem as eric with avast beta 4.5.536 ; it takes more than 3 minutes to pop an eicar infected simple mail while a clean simple one is very quick.

Configuration :
laptop win xp sp2 french.
outlook express 6, get mail with pop protocol
ISP connection through dial-up (connect at 33kb/s)
avast home beta 4.5.536 french / silent mode / mail scanner at normal sensibility /
setup to send an SMTP alert when a virus is found

Test :
Get eicar infected mail and clean mail from :
http://www.aleph-tec.com/eicar/index.php

Result :
Long delay to get mail and the following error in avast error.log :

27/11/2004 14:09:36 1101560976 SYSTEM 1752 AAVM - scanning error: OpenEventsAndMapping: OpenEvent failed!, 00000002.
27/11/2004 14:09:36 1101560976 SYSTEM 1752 AAVM - scanning error: ClientRqDispatchThread: OpenEventsAndMapping failed - client probably died, 00000003.

Remark :
When I switch the ISP connection from dial-up to ADSL, the mail are retrieved quickly but still the infected mails are longer than clean ones to get. No avast error with ADSL.

Hope you can find a solution

Farfouille
Title: Re:5 minutes to scan 4 mails........ :-(
Post by: eric37200 on November 27, 2004, 02:49:45 PM: yep !
same problem....im not alone.... :P
just one difference : i used adsl everytime...
...actually to retrived quickly my mails i should stop avast mail protection... ::)
Title: Re:5 minutes to scan 4 mails........ :-(
Post by: Lisandro on November 27, 2004, 03:22:30 PM: Farfouille and Eric, if you both uninstall your firewall, will the message be scanned faster?
Did you set your 'proxy' settings of avast (Updates (Basic) > Details > Proxy) to not a proxy at all?
Title: Re:5 minutes to scan 4 mails........ :-(
Post by: farfouille on November 27, 2004, 04:12:49 PM: Hi Technical

Thank for your help.

My proxy setting are the default : automatic detection (IE settings)

Firewall : I use SP2 fw so I can't desinstall it. I've tried to disable it and the result is the same (infected files very very slow to retrieve).

Farfouille
Title: Re:5 minutes to scan 4 mails........ :-(
Post by: Lisandro on November 27, 2004, 05:22:02 PM: Quote from: Farfouille on November 27, 2004, 04:12:49 PM
My proxy setting are the default : automatic detection (IE settings)

This could be a problem. Set not a proxy at all.

Quote from: Farfouille on November 27, 2004, 04:12:49 PM
Firewall : I use SP2 fw so I can't desinstall it. I've tried to disable it and the result is the same (infected files very very slow to retrieve).

No need for uninstall as the internal firewall blocks only inbound attacks and not outbound connections.
Title: Re:5 minutes to scan 4 mails........ :-(
Post by: eric37200 on November 27, 2004, 05:32:21 PM: Quote from: Technical on November 27, 2004, 03:22:30 PM
Farfouille and Eric, if you both uninstall your firewall, will the message be scanned faster?
Did you set your 'proxy' settings of avast (Updates (Basic) > Details > Proxy) to not a proxy at all?
yep...i try...but no viruses at this time to say if its good or no...
...but i test proxy settings : thats ok
....and all of this happened only with da new version of avast...strange...
i used avast since at least 1 year without problems...so good antivirus !
Title: Re:5 minutes to scan 4 mails........ :-(
Post by: farfouille on November 27, 2004, 05:55:14 PM: To Technical :

I've changed the proxy setting of avast! to use direct connection but it is not better.
Btw I don't understand how the setting for updates can change something to the mail scanner. Imo they are 2 different parts of avast...

To Eric :
You can use this site to send you eicar pseudo infected mail (harmless) and test your settings :
http://www.aleph-tec.com/eicar/index.php

Farfouille
Title: Re:5 minutes to scan 4 mails........ :-(
Post by: eric37200 on November 27, 2004, 06:19:30 PM: yep thanks farfouille...just when i test with eicar, i received real viruses... :)
....and i stop avast.....avast scan scan & scan....between this time i cant received mails....3 minutes later i stopped avast....desinstalled avast beta version....and reinstalled avast ....for the last time.... :-[
Title: Re:5 minutes to scan 4 mails........ :-(
Post by: Lisandro on November 27, 2004, 08:34:39 PM: Quote from: Farfouille on November 27, 2004, 05:55:14 PM
Btw I don't understand how the setting for updates can change something to the mail scanner. Imo they are 2 different parts of avast...

There are two questions in the same thread: updade and mail scanner. I tried to answer the first one. Proxy filters do interfere with updates 8)
Title: Re:5 minutes to scan 4 mails........ :-(
Post by: farfouille on November 27, 2004, 09:13:04 PM: Technical,

There is only one question : behaviour of the mail scanner with infected mail which is really an issue because I think Eric is near to give up and, sure, many people will, if this is not adressed with next releases...

I do understand that proxy setting can affect updates, but once again it is not the question. Neither Eric nor me have problem with updates. No offense there, you answer to so many questions and your devotion to help users is priceless.

Farfouille
Title: Re:5 minutes to scan 4 mails........ :-(
Post by: eric37200 on November 27, 2004, 09:32:56 PM: back again.... :)
i've just re-installed last version of avast...
....everything is ok at this time...
sensitivity = high ....as usual for me...
....wait & see..................... 8)
Title: Re:5 minutes to scan 4 mails........ :-(
Post by: farfouille on November 27, 2004, 10:23:47 PM: Eric

When you say everything is normal, do you mean that you received infected mail (eicar or else) and that the mail scanner didn't take much time to handle it ?

Farfouille
Title: Re:5 minutes to scan 4 mails........ :-(
Post by: eric37200 on November 27, 2004, 11:41:38 PM: yep 8)
wait & see
Title: Re:5 minutes to scan 4 mails........ :-(
Post by: Lisandro on November 28, 2004, 02:35:48 PM: Quote from: Farfouille on November 27, 2004, 09:13:04 PM
I do understand that proxy setting can affect updates, but once again it is not the question. Neither Eric nor me have problem with updates. No offense there, you answer to so many questions and your devotion to help users is priceless.

Thanks and sorry to mess my answers... :-[
Eric, in fact, when a virus is found avast could enter in paranoid behavior, I mean, all security levels are set to high in order to avoid infection spread.
Anyway, it should not freeze or take that time to process the emails... you're right.

Can't anybody from Alwil say anything about this? ;D
Title: Re:5 minutes to scan 4 mails........ :-(
Post by: farfouille on November 28, 2004, 04:24:54 PM: I think I've solved the problem...

What I did :
- uninstall avast 4.5.536 + reboot + delete remaining files/directories
- install avast 4.5.523 (the last official release) + avast automatically updates the vps to 0448-1
- test with the eicar stuff : OK : no time delay to deal with the infected mail
- I then restore avast parameters : silent mode + send alert mail on infection
- reboot
- test with aicar stuff : KO : long delay (3min.) to handle infected mail
- I then removed the send alert mail on infection and everything run smooth again
(all test using dialup connection)

Conclusion : It seems that the send alert mail is the problem...
Title: Re:5 minutes to scan 4 mails........ :-(
Post by: Lisandro on November 28, 2004, 06:18:59 PM: Thanks for debugging it, Farfouille.

What is set for your default smtp server into avast4.ini file?
Title: Re:5 minutes to scan 4 mails........ :-(
Post by: eric37200 on November 28, 2004, 06:51:37 PM: Quote from: Farfouille on November 28, 2004, 04:24:54 PM
I think I've solved the problem...

What I did :
- uninstall avast 4.5.536 + reboot + delete remaining files/directories
- install avast 4.5.523 (the last official release) + avast automatically updates the vps to 0448-1
- test with the eicar stuff : OK : no time delay to deal with the infected mail
- I then restore avast parameters : silent mode + send alert mail on infection
- reboot
- test with aicar stuff : KO : long delay (3min.) to handle infected mail
- I then removed the send alert mail on infection and everything run smooth again
(all test using dialup connection)

Conclusion : It seems that the send alert mail is the problem...
maybe maybe.... :)
for me when i test my smtp...."unknown error"...
i dont know why...i used always same smtp server (smtp.free.fr)...::)
i prefer this...actually avast work well... 8)
Title: Re:5 minutes to scan 4 mails........ :-(
Post by: farfouille on November 28, 2004, 08:37:27 PM: Quote from: Technical on November 28, 2004, 06:18:59 PM
Thanks for debugging it, Farfouille.

What is set for your [/i]default[/i] smtp server into avast4.ini file?

Technical, it is very cute to thank me but I have to confess that I'm a software developper and that kind of problem always ring my professional bell... ;)

Well the laptop I used to make the test is now far away from home (it is not mine, i had it to ... install avast). So I can't look into the avast4.ini but I remember well that when I configured the smtp alert avast asked me for the smtp server and the originator mail. I entered the same smtp server as the ISP which is 'free' (smtp.free.fr).

If you guess that it can be a configuration problem with the smtp server or mail adresses set up for the alert, let me tell you that you are right to think of such a problem but I've double checked that and it was ok. Btw when an infected mail was detected (and take a long time to be processed), I received the alert (I am the receiver). If I can find some time I will make some further test with my adsl connection using the smtp alert.

Eric do you use the smtp alert feature of avast when an infected mail is received ?

Farfouille
Title: Re:5 minutes to scan 4 mails........ :-(
Post by: eric37200 on November 28, 2004, 08:59:45 PM: yep i used smtp alert....but now as i say in my lat message, i cant...
...its not very important....but i cant : when i test, i've got error message....

...but avast work well actually... :)
Title: Re:5 minutes to scan 4 mails........ :-(
Post by: farfouille on November 29, 2004, 08:37:35 AM: Thank you Eric.

It appears that we both have problem with stmp alert.

I think we can reasonably pass the baby to alwil team. :D

Farfouille
Title: Re:5 minutes to scan 4 mails........ :-(
Post by: Vlk on November 29, 2004, 09:38:41 AM: Thanks, acknowledged, will fix asap. Good work guys! :)
Title: Re:5 minutes to scan 4 mails........ :-(
Post by: eric37200 on November 29, 2004, 12:18:44 PM: Just another little thing : when i re-installed avast, i made a boot scan (avast found nothing...like always... :)).
when i've got problems, the other time, i do not made a boot scan...
...maybe another reason... ::)
Title: Re:5 minutes to scan 4 mails........ :-(
Post by: Vlk on November 29, 2004, 01:59:46 PM: Oddly enough, this was only problem on single-processor machines. Dual or more (or hyperthreading-enabled) machines did not have this problem :)

Anyway, we've isolated and fixed the problem now.

Thanks!
Vlk
Title: Re:5 minutes to scan 4 mails........ :-(
Post by: farfouille on November 29, 2004, 02:37:54 PM: Quote from: Vlk on November 29, 2004, 01:59:46 PM

Anyway, we've isolated and fixed the problem now.

Good news for all of us
Title: Re:5 minutes to scan 4 mails........ :-(
Post by: eric37200 on November 29, 2004, 08:46:43 PM: to close this topic.... 8)
i've clean my registry with avast bart demo version and after that my problem re-appeared..... :(
...i made update for my preferred antivirus ;D
....and my problem is solved !
great !
thanx ! ;)

cheers
ERIC
Title: Re:5 minutes to scan 4 mails........ :-(
Post by: Lisandro on November 30, 2004, 01:34:04 AM: Quote from: eric37200 on November 29, 2004, 08:46:43 PM
...i made update for my preferred antivirus ;D
....and my problem is solved !

Which one (antivirus) are you talking about? ???

Did you have time to test the last program update (official release, not a beta) is 4.5.542 and fixes many of the earlier problems ::)
Title: Re:5 minutes to scan 4 mails........ :-(
Post by: eric37200 on November 30, 2004, 02:09:52 AM: Quote from: Technical on November 30, 2004, 01:34:04 AM
Quote from: eric37200 on November 29, 2004, 08:46:43 PM
...i made update for my preferred antivirus ;D
....and my problem is solved !

Which one (antivirus) are you talking about? ???
AVAST of course !!! :D
Title: Re:5 minutes to scan 4 mails........ :-(
Post by: Lisandro on November 30, 2004, 03:03:21 AM: Glad to hear this Eric... I though you have give up... :-[ :-[
Did you try the last program update (official release, not a beta): 4.5.542?
Title: Re:5 minutes to scan 4 mails........ :-(
Post by: eric37200 on November 30, 2004, 11:11:09 AM: Quote from: Technical on November 30, 2004, 03:03:21 AM
Glad to hear this Eric... I though you have give up... :-[ :-[
Did you try the last program update (official release, not a beta): 4.5.542?
never give up ! :)
and everythin ok now with the last program update ! :D