different messages after scanning with rescue disk

[REDACTED]

Hello AVAST Forum,
sorry for bad english. I´m giving my best :-) .

I used AVAST rescue disk to scan my computer.
At the end of scanning avast first creates a temporary log file, that I saved localy:

start of file
...
scan begin: time
infected files: 12303
scanner result: 0
scan end: time
...end of file

after that a second window showed me a totaly different result:

833965 files scanned
77931 MB scanned
0 files infected

BIG
What is the meaning of that?

Thanks for helping.
Regards
Michael

[REDACTED]

Nobody cares about such a serious problem??
I have got the same issue with last Avast free and Rescue Disk created several days ago.

After the scan finishes AvastPE shows me:

Firstly, there is an open Notepad file with

This file is just temporary ...
...
Scan begin: ...
Infected files: 130
Scanner result: 0
Scan end: ...

then Avast opens another window with this content:

Scanned files: xyz
Infected files: 0
Size of Scanned files: xyz
Fix automatically or do it manually

So accordingly to Avast PE, the number of infected files is 0 and 130 simultaneously

I chose to "fix manually" and I had got a table with approx. 130 files (a note: the column "virus name" was blank for all files). Later  in Windows, i tried to rescan some of these files from the context menu, and I got no malware but files that "could not be scanned":
- error: archive is password protected
- error: the file is a decompression bomb (this happened with "memory-report.json.gz" from a Firefox profile)

(edit: typos.)

[REDACTED]

I have got more experience with the bug:

Good news:
it looks the problem happens with packed files only

Bad news:
AvastPE reports 0 infected files...

Scanned files: xyz
Infected files: 0
Size of Scanned files: xyz
Fix automatically or do it manually

...but if you click "Fix automatically" Avast will start to delete files.


So here are the aggregate Avast reports:

Infected files: 130 (reported by notepad)
Infected files: 0 (reported by Avast UI)
Fix automatically...
deleted files: 130 (reported by Avast UI)

(I remind these deleted files are not malware files but files that could not be scanned by Avast)

[REDACTED]

I used this thread to report a bug, so I will use it to file a feature request:

the report in the notepad is a useful feature, because it allows users to save the report
but another report in the notepad is missing after the fixing procedures

[Rednose]

Hi Ibizia

That Avast can not scan password protected files is normal. Otherwise the password protection wouldn't make sense.
About the Rescue Disk ( and its actions ) : It's a very long time ago I have tried/used is myself, so I have to look at it first.

Greetz, Red.
 

[REDACTED]

That Avast can not scan password protected files is normal.

But this is not normal:
- Avast claims these (clean!) files are infected
- then Avast calms the user down: they are not infected
- then Avast deletes them and proudly announces total number of deleted files

[REDACTED]

similar issue:
https://forum.avast.com/index.php?topic=149362

[Pondus]

Could you post some screenshots

[1234ava]

@Pondus
Here are the photos.
By the way, this little test wrought havoc in my Windows 10 (UEFI SecureBoot) installation.
I had to re-install Windows after that.
In fact, Avast Rescue deleted thousands of Windows files after I clicked the right scrollbar in order to scroll the "Fix it manually" window, as you can see in pictures n.3 and 4 (in my next post).
I see this as a serious issue.
I would recommend Avast removes "Rescue Disk" from the Avast suite until it is fixed.

[1234ava]

@Pondus
Here are the photographs.
By the way, this little test wrought havoc in my Windows 10 (UEFI SecureBoot) installation.
I had to re-install.
In fact, Avast Rescue deleted thousands of Windows files after I clicked the right scrollbar in order to scroll the "Fix it manually" window, as you can see in pictures n.3 and 4 (in my next post).
I see this as a serious issue.
I would recommend Avast removes "Rescue Disk" from the Avast suite until it is fixed.

Here are pics #3 and #4.

[Milos]

Hello,
can you send us the detected files to analyze, please? Use https://support.avast.com/ -> Avast Virus Lab, report False positive on file.

Milos

[1234ava]

@Milos
I can't send the detected files because Avast Rescue deleted them, like I said.
Anyways, they were thousands of files in the c:\Windows folder.
I was testing the "Rescue Disk" (actually a pendrive) on a malware-free system (according to Avast IS and other scanners). It was a perfectly functioning system, before Avast Rescue broke it.

Regardless of what files they were and why Avast detected them, Avast Rescue gave incorrect and contradictory information (51,000 infected files... then 0 infected files!, then again they were listed in the "Fix it manually" window) and deleted those files without user request (I just clicked the scroll-bar, not the Delete button! you can even see where the cursor was in my photo #3).


I also tested Avast Rescue on another PC, an old notebook with Windows Vista: no problem there.

Maybe Avast Rescue has issues on systems with UEFI SecureBoot?

[REDACTED]

Hello,
can you send us the detected files to analyze, please? Use https://support.avast.com/ -> Avast Virus Lab, report False positive on file.
Milos

I don't think you need to analyze files.
In order to recreate the bug, have passworded packed files in the scanned system (see my previous posts for details)

I also tested Avast Rescue on another PC, an old notebook with Windows Vista: no problem there.

Maybe Avast Rescue has issues on systems with UEFI SecureBoot?

It seems unlikely that UEFI would cause the issue. The issue happened to me on two different computers with BIOS. edit: one computer was with Windows XP, another one with Windows 7.

[1234ava]

...snip...
So accordingly to Avast PE, the number of infected files is 0 and 130 simultaneously

Bump! Is Avast working on this bug? It was reported by several users since January 2015 at least.

[bob3160]

...snip...
So accordingly to Avast PE, the number of infected files is 0 and 130 simultaneously

Bump! Is Avast working on this bug? It was reported by several users since January 2015 at least.

Avast is probably waiting for someone to send them the files as they requested in a prior reply.