Author Topic: More files(additonal 30 - 40 files) can't be scanned as usual by full virus scan  (Read 784 times)

0 Members and 1 Guest are viewing this topic.

Offline Harry S.

  • Jr. Member
  • **
  • Posts: 24
Hi all,

In short, I would like to report that for full virus scan, lots of files can’t be scanned. I use Avast for a very long time and I know it is normal to have unscanned files. However, compared with past experience (say 2 weeks ago), 30 – 40 ‘new’ files can’t be scanned now.

Background:
Avast free antivirus: ver 24.2.6105 – build 24.2.8918.827
Virus def: ver 240327 – 4
Settings in Geek Area: Reported items include hard errors, soft errors and skipped (I have these settings for a very long time and I haven’t changed it)

Window 10, 22H2 (OS 19045.4170)

Findings
Compared with scanning results 2 weeks ago, additional 30 - 40 files can’t be scanned, for example:

C:\Users\Home Members\AppData\Local\Microsoft\WindowsApps\Skype.exe [E] 1920

C:\Users\Home Members\AppData\Local\Microsoft\WindowsApps\python.exe [E] 1920

C:\Windows\Logs\waasmedic\waasmedic.20240323_150221_894.etl [E] 2

C:\Windows\System32\WDI\ (Skipped the long number code)\snapshot.etl [E] 3

As far as I remember, similar abnormal findings happened long time ago and was reporting here by other users. The issues were solved by Avast that time. While it is normal to have files not being scanned, it will be safer if full virus scan could scan as many files as possible. Please kindly review whether improvements could be made with the new version and new definition of Avast, or the mentioned incident is caused by other party (say MS window).

Thank you and have a nice day. Happy Easter to you all.

« Last Edit: March 28, 2024, 03:44:38 PM by Harry S. »

Offline Harry S.

  • Jr. Member
  • **
  • Posts: 24
For your reference only.

As far as I remember, similar abnormal findings happened long time ago and was reporting here by other users. The issues were solved by Avast that time  --->2017 incident, https://forum.avast.com/index.php?topic=209475.0

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37534
  • Not a avast user
Quote
As far as I remember, similar abnormal findings happened long time ago and was reporting here by other users. The issues were solved by Avast that time. While it is normal to have files not being scanned, it will be safer if full virus scan could scan as many files as possible. Please kindly review whether improvements could be made with the new version and new definition of Avast, or the mentioned incident is caused by other party (say MS window).
As explained in this forum and avast blog many times, this is normal and happens to all malware scanners so not a avast problem

If you search kaspersky/eset/malwarebytes/f-secure……….. forums you find it asked and explained there also

https://blog.avast.com/2014/02/28/how-do-i-handle-files-that-avast-cant-scan/

https://community.f-secure.com/common-home-en/kb/articles/5471-some-files-cannot-be-scanned-why




Offline Harry S.

  • Jr. Member
  • **
  • Posts: 24
Thank you for your reply, but for the reported case, I am not sure whether this could be considered as ‘normal’ or a general case. My rationale behind is if the amount of the unscaned file is kept at a steady level, this may not raise any doubt. However, since there is a sudden and obvious increase in the numbers of file that can’t be scanned (in my case, 30 – 40 files now, 4 times the usual amount that cannot be scanned), I suspect something in-between has changed

That’s the reason why I hope Avast could verify whether something could be done, or the issue is caused by other factors outside Avast. In case just like the 2017 incident and the root cause lie on Avast’s side, they could trace the cause and keep the amount of unscaned files as small as possible, not further increasing.

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89065
  • No support PMs thanks
The fact that a file can't be scanned doesn't mean it is infected or malicious, just that it can't be scanned.

The .etl files are log files and I wouldn't have thought log files (being essentially inert) would have been scanned, so I would have wonder what your scan settings were.

Extract from a very old topic post, reply.
Quote
ETL files are log files that have been created by the Microsoft Tracelog software application. This Microsoft program creates event logs in the binary file format. These logs are created from the kernel in a Microsoft operating system.

The ETL logs can contain information about disk access and page faults, logging high-frequency events and recording the performance of the Microsoft operating system. This information can be used to analyze and adjust voice response software applications.
As it is only a log then you can delete it

As for the others in the AppData\Local\Microsoft\WindowsApps location a search returns some hits this is an extract from a Microsoft forum reply.
Quote from: Extract
WindowsApps is a hidden folder where Windows 10 keeps installed apps from the Store. If you are not using any of the app that are showing up, I would request you to uninstall the application. You can remove the programs/applications that you do not need. There are 2 ways you can remove Windows applications:
.

As for running this scan:
- With a resident (on-access) scanner the need for on-demand scans is much depreciated. For the most part dormant/inert files are being scanned, the other active files are going to be scanned by the resident shields when they are activated.

In this case .exe files when run would first be scanned by the File System Shield.

Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.3.6108 (build 24.3.8975.762) UI 1.0.801/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline claudiu13

  • Jr. Member
  • **
  • Posts: 21
just that it can't be scanned.

So why do you consider a normal thing for an antivirus not to scan an    .exe file???   (C:\Users\Home Members\AppData\Local\Microsoft\WindowsApps\Skype.exe)

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37534
  • Not a avast user
just that it can't be scanned.

So why do you consider a normal thing for an antivirus not to scan an    .exe file???   (C:\Users\Home Members\AppData\Local\Microsoft\WindowsApps\Skype.exe)
Is the file:
- currently used by the operating system ?
- protected/locked by the operating system?



Offline Harry S.

  • Jr. Member
  • **
  • Posts: 24
Thanks all for your participation in this post. Forgive me as I am not an IT expert, I just view the issue as an ordinary computer user. I really don’t know (or don’t know how to explain) which files could be scanned or could not be scanned by Avast. I try to re-emphasis and share my points in a general way.


1. Summary of Full Virus Scan Settings
- Basically check all boxes
- Selection parts: all hard disks, scan all archives, scan all files

2. Since I haven’t changed the settings for a very long time, just simply think if long-existing factors are constant, those unscanned files will remain unscanned, those scanned files can still be scanned. Expressing in another way, it may be reasonable to expect unscanned items exist in previous scanning reports too, but it is not my reported issue as those unscanned items only appear recently. Although having unscanned files are normal, I doubt a sudden significant increase in unscanned files may not be the case. 2017 incident mentioned before to a certain extent alarm me.

3. I am not sure whether the root cause is related to Avast or not. Since I remember something similar in the past and after investigation, Avast can indeed do something to remedy the situation during 2017 incident, I report here for necessary investigation and measures if required.

4. Thanks for providing supplementary information for full virus scan and other aspects. While real-time protection like file shield can serve as a frontline protection or final protection (unscanned files during full virus scan), the core concern is if there is something unusual occurred or improvement could be made, the functionality (scope) of full virus scan may also be addressed or discussed. Users have different preference for safety level, some may believe having real-time protection is enough, some may think if unluckily some faults are present in those shields and not being noticed for a certain time interval, carrying other manual scan regularly may serve as a backup or other way of checking. I understand DavidR’s points, if all shields successfully do their job, there is no great need for on-demand scan. However, as long as full virus scan is introduced in Avast’s product and to some users, full virus scan still has its values, some questions or enquiries about on-demand scan may also be raised, discussed and addressed.

5. For Avast’s side, if the team suggests such sudden increase for unscanned files are normal (or unlike 2017 incident mentioned) and it is not an issue caused by Avast, users could eliminate one of the potential cause.

6. For the scopes of window apps that can’t be scanned, say Skype.exe, I can confirm I am not using it as I don’t use Skype for a very long time. For real player.exe, I can’t recall whether I am using it. For others such as GameBarElevatedFT_Alias.exe, WindowsPackageManagerServer.exe, etc., I even don’t know their existence and as far as I remember, I just use the computer as usual and in my perception, it is not likely to suddenly activate so many files that I even don’t know.

7. For the question ‘is the file protected/locked by the operating system, I can’t tell. What I could say is I just use my computers as usual these days, I haven’t tried any new software or intentionally do anything to protect and lock those files that can’t be scanned suddenly. 

8. Finally, thanks all for your time and sharing again   

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37534
  • Not a avast user
Quote
For the scopes of window apps that can’t be scanned, say Skype.exe, I can confirm I am not using it as I don’t use Skype for a very long time.
But have you turned off the default startup ?




Offline Harry S.

  • Jr. Member
  • **
  • Posts: 24
Quote
For the scopes of window apps that can’t be scanned, say Skype.exe, I can confirm I am not using it as I don’t use Skype for a very long time.
But have you turned off the default startup ?

Yes, I do it via Task Manager --> startup before. I check it now and it remains 'turned off'.