Author Topic: * Introducing * - beta version of upcoming avast update (NOW 4.7.979)  (Read 56973 times)

0 Members and 1 Guest are viewing this topic.

Offline Vlk

  • Avast CEO
  • Serious Graphoman
  • *
  • Posts: 11655
  • Please don't send me IM's. Email only. Thx.
    • ALWIL Software
Re: * Introducing * - beta version of upcoming avast update (4.7.971)
« Reply #60 on: April 09, 2007, 09:50:41 AM »
Thomas123,

Quote
But, I notice something wrong for avast! Web Scanner process.

After I surfed the web for an hour and closed my Opera browser, I opened Task Manager and saw that avast! Web Scanner process consumed 50% CPU usage constantly.

Please do the following: when the problem is simulated (ashWebSv.exe is at steady 50% CPU use [btw this means that it takes 100% of one of your CPU cores]), right click the process in the Task Manager and choose the "Create Dump File" option. Then ZIP the resulting file and upload it to our ftp site as described here: http://support.avast.com/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=18 .


alanrf, please make sure to submit the file in question to ALWIL. BTW I suppose it's being reported inside an archive? (I.e. the file, in its unpacked form, does not reside on your hard drive at all - otherwise, it would have been detected by the previous version as well).

Thanks
Vlk
If at first you don't succeed, then skydiving's not for you.

Offline alanrf

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 3870
  • Just an avast user
Re: * Introducing * - beta version of upcoming avast update (4.7.971)
« Reply #61 on: April 10, 2007, 01:14:22 AM »
Vlk,

Quote
BTW I suppose it's being reported inside an archive? (I.e. the file, in its unpacked form, does not reside on your hard drive at all - otherwise, it would have been detected by the previous version as well).

You suppose incorrectly.  The file is detected as Adware on the system with the avast beta installed both in its normal position as an "unpacked file" in the program folder and also within the install file of the Diskeeper. 

On the system running the current production version of avast (both systems have the same VPS version - now 0731-1) both files are scanned by avast as clean.

Thomas123

  • Guest
Re: * Introducing * - beta version of upcoming avast update (4.7.971)
« Reply #62 on: April 10, 2007, 05:16:21 AM »
Thomas123,

Please do the following: when the problem is simulated (ashWebSv.exe is at steady 50% CPU use [btw this means that it takes 100% of one of your CPU cores]), right click the process in the Task Manager and choose the "Create Dump File" option. Then ZIP the resulting file and upload it to our ftp site as described here: http://support.avast.com/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=18

I have uploaded the zip named Thomas123


Offline Vlk

  • Avast CEO
  • Serious Graphoman
  • *
  • Posts: 11655
  • Please don't send me IM's. Email only. Thx.
    • ALWIL Software
Re: * Introducing * - beta version of upcoming avast update (4.7.971)
« Reply #63 on: April 10, 2007, 08:54:55 AM »
Quote
You suppose incorrectly.  The file is detected as Adware on the system with the avast beta installed both in its normal position as an "unpacked file" in the program folder and also within the install file of the Diskeeper.

The culprit is in the "\[" hiding at the end of the file name in the Adware Found dialog (unfortunately, the path is too long so we don't see it in its entirety). Could you please post the whole path name (the field is scrollable).

Thanks
Vlk
If at first you don't succeed, then skydiving's not for you.

Offline alanrf

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 3870
  • Just an avast user
Re: * Introducing * - beta version of upcoming avast update (4.7.971)
« Reply #64 on: April 10, 2007, 11:50:18 AM »
Vlk,

the extra characters are, I suspect, figments of the imagination of the new avast beta and its new unpackers. I attach a new image of the error (with a different skin selected - widescreen) that shows a longer view of the error message.  The extra characters are not part of any file name that is shown by the Windows operating system.   

I have zipped and sent the .exe file to virus@avast.com for your review.  The .msi installation file for Diskeeper Professional is too large to be sent via my ISP (at 16.5Mb) if you want it sent via another alternative let me know.

The image I posted earlier showed the error reported from ashquick.exe (avast scan from the right click on the file).  I should also report that if I simply click on the close button of the errror message then it provokes a failure of the ashquick.exe program (ashquick.exe has encountered a problem and needs to close... etc). 
« Last Edit: April 10, 2007, 11:57:57 AM by alanrf »

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11865
    • AVAST Software
Re: * Introducing * - beta version of upcoming avast update (4.7.971)
« Reply #65 on: April 10, 2007, 11:55:27 AM »
There's no error here (appart from the false positive, of course) - everything is as expected ;)
The file is, indeed, "detected" with the help of a new unpacker.

Offline alanrf

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 3870
  • Just an avast user
Re: * Introducing * - beta version of upcoming avast update (4.7.971)
« Reply #66 on: April 10, 2007, 11:59:45 AM »
Igor,

do you mean the failure of ashquick.exe is also "as expected"?

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11865
    • AVAST Software
Re: * Introducing * - beta version of upcoming avast update (4.7.971)
« Reply #67 on: April 10, 2007, 12:06:26 PM »
Ah, no, certainly not - I was refering to Vlk's question about the archives and the notes about the \[ parts.
Is the ashQuick.exe error reproducible?

Offline alanrf

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 3870
  • Just an avast user
Re: * Introducing * - beta version of upcoming avast update (4.7.971)
« Reply #68 on: April 10, 2007, 12:12:56 PM »
Igor,

Quote
Is the ashQuick.exe error reproducible?

It was until I changed the skin to display more of the error message.

Lemme see what happens if I take my system back a couple of hours.

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11865
    • AVAST Software
Re: * Introducing * - beta version of upcoming avast update (4.7.971)
« Reply #69 on: April 10, 2007, 12:36:46 PM »
That's bad... I can't reproduce it either with this file.
What are your settings of the Explorer Extension? (on the first page of program settings?)
Also, what exactly do you mean by the "close button"? The cross in the upper right corner of the window, or the "Stop" button?

Offline Dwarden

  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 1793
  • Ideas, that's ocean without borders!
    • Bohemia Interactive
Re: * Introducing * - beta version of upcoming avast update (4.7.971)
« Reply #70 on: April 10, 2007, 03:19:30 PM »
seems like this false positive is related to new unpackers too in (checked via Ashquick)

new version of PowerStrip
http://www.entechtaiwan.com/files/pstrip.exe
http://www.entechtaiwan.com/files/pstrip-i.exe

gets flagged as Win32:Trojan-gen. {Other}

D:\Downloads\new\pstrip.exe\[Embedded#0c43a]\[ASProtect]\[Embedded#18052c]
D:\Downloads\new\pstrip-i.exe\[Embedded#00c43a]\[ASProtect]\[Embedded#18052c]
https://twitter.com/FoltynD , Tech. Community, Online Services & Distribution manager of Bohemia Interactive

Offline Dwarden

  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 1793
  • Ideas, that's ocean without borders!
    • Bohemia Interactive
Re: * Introducing * - beta version of upcoming avast update (4.7.971)
« Reply #71 on: April 10, 2007, 08:40:47 PM »
and another one , test via Avast! Simple User Interface

selected folder, drive I: started scan (all fine u can see progress)
stopped
unselected folder, selected I: again and started again

for some reason now i see only progress indicator (these squares from left to right)
but tested files = unchanged
last scanned = unchanged

yet the scan is running (it keeps finding and reporting badware :)

...
https://twitter.com/FoltynD , Tech. Community, Online Services & Distribution manager of Bohemia Interactive

Offline alanrf

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 3870
  • Just an avast user
Re: * Introducing * - beta version of upcoming avast update (4.7.971)
« Reply #72 on: April 11, 2007, 12:41:11 AM »
Igor,

sorry for the delayed response to your questions, my ISP took network down - so I went off to bed.

Anyway, I can no longer reproduce the ashquick.exe failure but it occurred when I used the close icon (cross - upper right). 

Attached image shows error from event log - (ashquick failures in the log are the same - but are on different days - so the condition persisted from 04/06 through 04/09).  Also an image of my explorer extension settings.   

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11865
    • AVAST Software
Re: * Introducing * - beta version of upcoming avast update (4.7.971)
« Reply #73 on: April 11, 2007, 11:31:42 AM »
Hmm, ActiveSkin... that's not good.
Even if I could simulate the problem, I somehow suspect the only thing I could do would be suggesting to disable the skins for Explorer Extension...  :-\
ActiveSkin is a third-party module (i.e. we don't have sources for that) - so it's rather hard to fix any bugs in there.

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11865
    • AVAST Software
Re: * Introducing * - beta version of upcoming avast update (4.7.971)
« Reply #74 on: April 11, 2007, 11:32:39 AM »
and another one , test via Avast! Simple User Interface

selected folder, drive I: started scan (all fine u can see progress)
stopped
unselected folder, selected I: again and started again

for some reason now i see only progress indicator (these squares from left to right)
but tested files = unchanged
last scanned = unchanged

yet the scan is running (it keeps finding and reporting badware :)

I'm afraid I can't reproduce this... anything special on your I: drive?