* Introducing * - beta version of upcoming avast update (NOW 4.7.979)

[Vlk]

Thomas123,

But, I notice something wrong for avast! Web Scanner process.

After I surfed the web for an hour and closed my Opera browser, I opened Task Manager and saw that avast! Web Scanner process consumed 50% CPU usage constantly.

Please do the following: when the problem is simulated (ashWebSv.exe is at steady 50% CPU use [btw this means that it takes 100% of one of your CPU cores]), right click the process in the Task Manager and choose the "Create Dump File" option. Then ZIP the resulting file and upload it to our ftp site as described here: http://support.avast.com/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=18 .


alanrf, please make sure to submit the file in question to ALWIL. BTW I suppose it's being reported inside an archive? (I.e. the file, in its unpacked form, does not reside on your hard drive at all - otherwise, it would have been detected by the previous version as well).

Thanks
Vlk

[alanrf]

Vlk,

BTW I suppose it's being reported inside an archive? (I.e. the file, in its unpacked form, does not reside on your hard drive at all - otherwise, it would have been detected by the previous version as well).

You suppose incorrectly.  The file is detected as Adware on the system with the avast beta installed both in its normal position as an "unpacked file" in the program folder and also within the install file of the Diskeeper. 

On the system running the current production version of avast (both systems have the same VPS version - now 0731-1) both files are scanned by avast as clean.

[Thomas123]

Thomas123,

Please do the following: when the problem is simulated (ashWebSv.exe is at steady 50% CPU use [btw this means that it takes 100% of one of your CPU cores]), right click the process in the Task Manager and choose the "Create Dump File" option. Then ZIP the resulting file and upload it to our ftp site as described here: http://support.avast.com/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=18

I have uploaded the zip named Thomas123

[Vlk]

You suppose incorrectly.  The file is detected as Adware on the system with the avast beta installed both in its normal position as an "unpacked file" in the program folder and also within the install file of the Diskeeper.

The culprit is in the "\[" hiding at the end of the file name in the Adware Found dialog (unfortunately, the path is too long so we don't see it in its entirety). Could you please post the whole path name (the field is scrollable).

Thanks
Vlk

[alanrf]

Vlk,

the extra characters are, I suspect, figments of the imagination of the new avast beta and its new unpackers. I attach a new image of the error (with a different skin selected - widescreen) that shows a longer view of the error message.  The extra characters are not part of any file name that is shown by the Windows operating system.   

I have zipped and sent the .exe file to virus@avast.com for your review.  The .msi installation file for Diskeeper Professional is too large to be sent via my ISP (at 16.5Mb) if you want it sent via another alternative let me know.

The image I posted earlier showed the error reported from ashquick.exe (avast scan from the right click on the file).  I should also report that if I simply click on the close button of the errror message then it provokes a failure of the ashquick.exe program (ashquick.exe has encountered a problem and needs to close... etc). 

[igor]

There's no error here (appart from the false positive, of course) - everything is as expected
The file is, indeed, "detected" with the help of a new unpacker.

[alanrf]

Igor,

do you mean the failure of ashquick.exe is also "as expected"?

[igor]

Ah, no, certainly not - I was refering to Vlk's question about the archives and the notes about the \[ parts.
Is the ashQuick.exe error reproducible?

[alanrf]

Igor,

Is the ashQuick.exe error reproducible?

It was until I changed the skin to display more of the error message.

Lemme see what happens if I take my system back a couple of hours.

[igor]

That's bad... I can't reproduce it either with this file.
What are your settings of the Explorer Extension? (on the first page of program settings?)
Also, what exactly do you mean by the "close button"? The cross in the upper right corner of the window, or the "Stop" button?

[Dwarden]

seems like this false positive is related to new unpackers too in (checked via Ashquick)

new version of PowerStrip
http://www.entechtaiwan.com/files/pstrip.exe
http://www.entechtaiwan.com/files/pstrip-i.exe

gets flagged as Win32:Trojan-gen. {Other}

D:\Downloads\new\pstrip.exe\[Embedded#0c43a]\[ASProtect]\[Embedded#18052c]
D:\Downloads\new\pstrip-i.exe\[Embedded#00c43a]\[ASProtect]\[Embedded#18052c]

[Dwarden]

and another one , test via Avast! Simple User Interface

selected folder, drive I: started scan (all fine u can see progress)
stopped
unselected folder, selected I: again and started again

for some reason now i see only progress indicator (these squares from left to right)
but tested files = unchanged
last scanned = unchanged

yet the scan is running (it keeps finding and reporting badware

...

[alanrf]

Igor,

sorry for the delayed response to your questions, my ISP took network down - so I went off to bed.

Anyway, I can no longer reproduce the ashquick.exe failure but it occurred when I used the close icon (cross - upper right). 

Attached image shows error from event log - (ashquick failures in the log are the same - but are on different days - so the condition persisted from 04/06 through 04/09).  Also an image of my explorer extension settings.   

[igor]

Hmm, ActiveSkin... that's not good.
Even if I could simulate the problem, I somehow suspect the only thing I could do would be suggesting to disable the skins for Explorer Extension... 
ActiveSkin is a third-party module (i.e. we don't have sources for that) - so it's rather hard to fix any bugs in there.

[igor]

and another one , test via Avast! Simple User Interface

selected folder, drive I: started scan (all fine u can see progress)
stopped
unselected folder, selected I: again and started again

for some reason now i see only progress indicator (these squares from left to right)
but tested files = unchanged
last scanned = unchanged

yet the scan is running (it keeps finding and reporting badware

I'm afraid I can't reproduce this... anything special on your I: drive?