Null Virus displayed in the catalog status screen

[gprzybyl]

When avast finds a virus on a system it changes it's icon to red and puts the virus name in the upper right panel of the catalog window on the line containing the infected machine.  Sometimes I notice that the computer's icon goes red and the virus is updated with (NULL) for a name.  Why?

[Vlk]

"Sometimes" is an interesting word here. Do you know of exact steps how to reproduce the problem?

BTW the "service hung on startup" thing is now fixed?

Thanks
Vlk

[gprzybyl]

I don't know if this will recreate it or not but when my scan local disks task ran last night I now have 12 systems with the (NULL) virus.  These did not generate alerts either.  It did find one additonal virus (a generic Trojan) which I believe may be a false positive I'll investigate that further.  Anyway here is what the display screen looks like (minus the icon)

CY15711   MONETRICS   0452-0, 12/21/2004   4.5.239.0   Windows 2000  (Service Pack 4)   Today at 10:27:04 AM   (NULL)   MONETRICS
JXD4L01   MONETRICS   0451-2, 12/17/2004   4.5.204.0   Windows 2000  (Service Pack 3)   Today at 10:25:26 AM   (NULL)   MONETRICS
THANGA2003   MONETRICS   0451-2, 12/17/2004   4.5.250.0   Windows 2000  (Service Pack 4)   Today at 10:29:18 AM   (NULL)   MONETRICS
5DJMV21   MONETRICS   0452-0, 12/21/2004   4.5.204.0   Windows XP  (Service Pack 1)   Today at 10:26:04 AM   (NULL)   MONETRICS
SO003   SVCS   0451-2, 12/17/2004   4.5.173.0   Windows 2000  (Service Pack 3)   Today at 10:24:32 AM   (NULL)   SVCS
SO001   SVCS   0451-2, 12/17/2004   4.5.173.0   Windows 2000  (Service Pack 3)   Today at 10:31:07 AM   (NULL)   SVCS
EDISON   MONETRICS   0451-2, 12/17/2004   4.5.250.0   Windows NT, version 4.0 (Service Pack 6)   Today at 10:21:58 AM   (NULL)   MONETRICS
HSGPD11   MONETRICS   0452-0, 12/21/2004   4.5.250.0   Windows 2000  (Service Pack 4)   Today at 10:29:00 AM   (NULL)   MONETRICS
APPWEB02   SVCS   0451-2, 12/17/2004   4.5.173.0   Windows 2000  (Service Pack 3)   Today at 10:27:38 AM   (NULL)   SVCS
KEMENY   MONETRICS   0451-2, 12/17/2004   4.5.250.0   Windows NT, version 4.0 (Service Pack 6)   Today at 10:23:25 AM   (NULL)   MONETRICS
DDVBKK01   MONETRICS   0452-0, 12/21/2004   4.5.239.0   Windows 2000  (Service Pack 4)   Today at 10:30:41 AM   (NULL)   MONETRICS
DDQKCB01   MONETRICS   0451-2, 12/17/2004   4.5.250.0   Windows 2000  (Service Pack 4)   Today at 10:22:06 AM   (NULL)   MONETRICS
HUBMAN   MONETRICS   0452-0, 12/21/2004   4.5.250.0   Windows 2000  (Service Pack 2)   Today at 10:28:52 AM   Win32:Trojan-gen. {Other}   MONETRICS

[gprzybyl]

PS - Yes, the latest build does fix the avast hung on startup error.

   Thanks

[Vlk]

Does the client have the latest version of avast installed?
And what about the management server? Does it have the "release" version? (btw did you notice - adnm was released yesterday!


Cheers
Vlk

[gprzybyl]

Both ADNM and some of the affected (most of actually) clients are the latest some are a release old.  
  Congratulations on the productioin release!  If ADNM is 4.5.242 that is the "released" product correct?  I don't have to update it again (don't think it would let me anyway).  

[Vlk]

Yes, the release builds are 242 for the ADNM itself and 250 for the clients (as seen on http://www.avast.com ).

It's a bit unfortunate that there's still this problem (the (null) virus name), hopefully we'll find a solution soon. Haven't been able to simulate it here yet (even though I let a couple of clients scan our whole virus DB - hundreds of thousands of infected files... )


Cheers
Vlk

[mshuard]

I too am showing null viruses in the computer listing.

CMMTEMP001   xxxx   0453-1, 12/31/2004   4.5.250.0   Windows XP  (Service Pack 2)   Today at 2:16:33 PM   (NULL)   xxxx

JSADLER   xxxx   0453-1, 12/31/2004   4.5.250.0   Windows XP  (Service Pack 2)   Today at 2:10:21 PM   (NULL)   xxxx

The above is copied from the "computers with agent" screen.

[gprzybyl]

Mshuard, do you do on demand scanning tasks?  If so what packers do you have checked?  If not what packers do you have checked for the resident shield.  My hunch is that it is caused by either win32 or the zip packer being unable to open an archive.  I'm awaiting confirmation from Vlk that this is what it is.

[Vlk]

Yes guys you're right it's a confirmed bug in the current version of AMS (I should rather say it WAS a confirmed bug). It already was fixed and will be included in the ADNM update due later this week.

Thanks
Vlk