Author Topic: Avast 4.8 skips "System Volume Information"  (Read 25499 times)

0 Members and 1 Guest are viewing this topic.

Offline alanrf

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 3866
  • Just an avast user
Re: Avast 4.8 skips "System Volume Information"
« Reply #15 on: April 12, 2008, 07:44:58 AM »
I just conducted an ashSimpl.ex scan of the same disk.  Filemon shows very clearly that ashSimpl.exe scanned the System Volume Information.

I ask again ... is there a reason you are failing to use a tool that will show if your concern is well founded?

By the way a Quick Scan is part of either ashSimple.exe or ashSimp2.exe the process ashquick.exe is, in fact a thorough scan with archive scanning by default.
« Last Edit: April 12, 2008, 07:47:05 AM by alanrf »

Malkor

  • Guest
Re: Avast 4.8 skips "System Volume Information"
« Reply #16 on: April 12, 2008, 07:46:19 AM »
Because I don't understand what it is used for.  Saying "run program X" doesn't justify a reason.  In other words how does Filemon work?

Offline alanrf

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 3866
  • Just an avast user
Re: Avast 4.8 skips "System Volume Information"
« Reply #17 on: April 12, 2008, 07:50:46 AM »
It is a Microsoft/System Internals product provided for the very function of reporting file system accesses.

It does not require an install it is just a program you download and run.

If you cannot believe the advice of igor (a prominent member of the avast team contributing to this forum) then I have to wonder why you feel able to trust the avast product on your system.
« Last Edit: April 12, 2008, 07:53:54 AM by alanrf »

Malkor

  • Guest
Re: Avast 4.8 skips "System Volume Information"
« Reply #18 on: April 12, 2008, 07:57:02 AM »
I never said I didn't believe the advice of Igor, it is just that whenever I undervolt my CPU, I know it literally doubles the scanning time when the System Volume Information is scanned.  Plus I do not think a 1600MHz Low Voltage M (600MHz at minimal power respectively) combined with a 4200RPM Hitachi can scan 2.1GBs of files in 0.0 seconds.

In other words, I find it pointless to run a tool whenever I look on my screen at the obvious.  It is occuring on all machines that I have run it on so far.  4.8 is new, and probably has a few changes (for example the "Would you like to set up a boot time scan" does not appear whenever I installed Avast! on a brand new Vista SP1 machine).

Offline alanrf

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 3866
  • Just an avast user
Re: Avast 4.8 skips "System Volume Information"
« Reply #19 on: April 12, 2008, 08:06:20 AM »
It seems you wish to confuse multiple issues to avoid the central issue of this thread.

You, almost certainly, do not know how the internals of avast work yet you installed it on your system apparently unconcerned by that fact.

A member of the team had provided you with a way of confirming your concern and you decide to ignore that advice.  I have to assume that you do not wish to see the evidence it might provide.

I regret to conclude that further discussion with you will be of no value to you and a waste of my effort.   

 


Malkor

  • Guest
Re: Avast 4.8 skips "System Volume Information"
« Reply #20 on: April 12, 2008, 09:26:13 AM »
Confuse?  I have already confirmed my problem, which is only one problem by means of simple logic.  Avast 4.8, when running a full thorough scan from the Simple User Interface will not scan "System Volume Information."  I did not mention any other issues.  All machines that I have done this show the exact same results.  You people keep assuming that it is my setup, and it is not.  My ThinkPad X31 works flawlessly. You didn't run the procedure I did either, that doesn't help.  If you hadn't noticed in 4.8, Avast! scans the main Windows folders for what seems to be a spyware/startup/memory check before it even touches the first file in alphabetical sequence for a scan.  Now granted it probably scans for spyware and viruses simultaneously, but then it doesn't make sense on the first folders it scans.  It doesn't do that on the boot time scan at all.

Here are the results of three scans I did recently:

Avast! Thorough scan using the SUI.
65115/1615 (Roughly 14200 files are done in the preliminary check and are scanned twice).
24:25
0 infected files
7.2GB of data.

Avast! Quick Scan on drive C: using right click and pressing "Scan C:\" from My Computer.  It does scan "System Volume Information."
~59000 files

Avast! Boot time scan on drive C: by scheduling it from the SUI.
59049 files
1855 folders

So let me add up the numbers.  I found that roughly 8000 files were in "System Volume Information."  If you take the 65000 I got from the SUI scan, subtract the duplicate files and add in the 8000, I get around 59000 files.  Both Quick Scan and boot time scan get me 59000 files.

Offline alanrf

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 3866
  • Just an avast user
Re: Avast 4.8 skips "System Volume Information"
« Reply #21 on: April 12, 2008, 09:40:47 AM »
Please tell us how simply, clearly what confirmation you have of your assertion that avast does not scan this folder. 

I have direct evidence from Filemon in the scans you specify that it does. I will be happy to post that evidence here.

Please post the clear evidence here that it does not.  Igor has proposed to you the evidence available in the Filemon report ... I simply cannot understand why you wish to avoid the real evidence when you persist in simply asking us to accept your supposition that it is not scanned. 

I am not here as a lackey of avast - I am doing my very best to reproduce the problem you report.  If you want help you need to show a little more willingness to work with those trying to help you.  Otherwise I will concentrate on trying to reproduce the problems (as I often do) reported by other users.     



 


Offline alanrf

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 3866
  • Just an avast user
Re: Avast 4.8 skips "System Volume Information"
« Reply #22 on: April 12, 2008, 09:52:07 AM »
Where on earth do you come up with the information that 8000 files are in system volume information? 

I have drives C: thru N: on my system and the largest System Volume Information on any of them is shown at 20Kb.

If you are relying as gospel on any of the "files scanned" by avast (especially in a thorough scan with archives) then you are in a dream world.  avast's counting of files is interesting ... just try an ashquick scan of just one MS Word document. 

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11809
    • AVAST Software
Re: Avast 4.8 skips "System Volume Information"
« Reply #23 on: April 12, 2008, 01:23:05 PM »
I'd like to clarify something - Malkor, I am not saying you are wrong about the files not being scanned on your computer, but
- it certainly doesn't happen on every computer (as you seem to expect), no matter if you reproduced it on your two or three machines
- I need the information from the File Monitor if I should do something about it; I'm not promissing anything, but without the File Monitor info, I can hardly do anything.

Offline Dwarden

  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 1793
  • Ideas, that's ocean without borders!
    • Bohemia Interactive
Re: Avast 4.8 skips "System Volume Information"
« Reply #24 on: April 12, 2008, 04:35:24 PM »
Malkor could You please do these simple steps:

1. open 'any' browser and visit this site http://technet.microsoft.com/en-us/sysinternals/bb896642.aspx
2. from there You can see url on right which lead to download http://download.sysinternals.com/Files/Filemon.zip
3. unpack anywhere, execute filemon.exe
4. on first window type into include line following: as*
5. do scan where You think it fail to scan System Volume Information directories
6. when done use CTRL+E to disable disk activity logging
7. open menu File > Save As.. and save the report
8. email it to Vlk or Igor with description

in short, this 5m(+- scan time) task would solve not just this discussion but maybe even help resolve the problem for once and all
https://twitter.com/FoltynD , Tech. Community, Online Services & Distribution manager of Bohemia Interactive

Malkor

  • Guest
Re: Avast 4.8 skips "System Volume Information"
« Reply #25 on: April 12, 2008, 05:51:18 PM »
Error: Email attachments can only be up to 10MB.  The log is 32MB.

I have confirmed this error on four different machines, so thus I want someone else to verify this for me.  The folder layout I will portray as default, meaning that there are only directories put in by Microsoft.  This discussion should be resolved if people will not insist on using the quick scan and actually using the SUI.

Step 1: Start Avast! Simple User Interface by using the taskbar icon or the start menu.
Step 2: Press the hard drive icon on the top right corner of the Avast! window.
Step 3: Move the slider to Thorough.
Step 4: Check "Scan Archived Files."
Step 5: Press play.
Step 6: Watch how Avast! scans between 8000 and 50000 files before even starting in alphabetical order, these files are scanned twice in 4.8.
Step 7: Before Avast! finishes Program Files (XP) or ProgramData (Vista), watch carefully.  Notice how it skips to C:\Windows (XP) or C:\Users (Vista) and does not display "C:\System Volume Information."
Step 8: Let the scan finish.
« Last Edit: April 12, 2008, 07:24:54 PM by Malkor »

Offline alanrf

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 3866
  • Just an avast user
Re: Avast 4.8 skips "System Volume Information"
« Reply #26 on: April 12, 2008, 07:30:58 PM »
I have only tested this on Win XP SP2 systems.  They produce identical results.

I have followed the steps you outline.  Since you specified the SUI I used the skinless SUI thorough scan with archive scanning.

The instant avast starts scanning a count appears along with the folder name currently being scanned. Scanning is not processed strictly in alphabetical order.

I suspect you do not see the system volume folder appear because it is so small and scanned so fast. 

Here is the Filemon log showing the access of the system volume information by avast during the scan.

Malkor

  • Guest
Re: Avast 4.8 skips "System Volume Information"
« Reply #27 on: April 12, 2008, 07:53:34 PM »
I guess you forgot the post that stated that 2.1GB cannot be scanned instantly.

Why does yours say AshSimp2?

I might add that on a brand new factory installed Vista machine, that System Volume Information is not properly accessed.

Number of scanned files/folders: 23/2
Run-time: 00:00:00
Size: 20.0K.

Using this fact, just because your FileMon reads the directory does not mean Avast! actually scans the files.

Edit: Another XP machine skipped "System Volume Information."
« Last Edit: April 12, 2008, 08:06:00 PM by Malkor »

Offline calcu007

  • Avast Evangelist
  • Poster
  • ***
  • Posts: 482
  • I'm lamma!
Re: Avast 4.8 skips "System Volume Information"
« Reply #28 on: April 12, 2008, 08:02:31 PM »
I guess you forgot the post that stated that 2.1GB cannot be scanned instantly.

Why does yours say AshSimp2?

Can't you follow simple instructions? If you want help,then follow Igor's instructions, if you don't then stop complaining.
Asus Intel i7 8GB RAM , Win 8.1 64 bit, Avast IS

Offline oldman

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 4142
  • Some days..... MOS...this bug's for you
Re: Avast 4.8 skips "System Volume Information"
« Reply #29 on: April 12, 2008, 08:03:36 PM »
ashsimp2 is the skinless version of the simple user interface. Same scanner, just no skin. It won't change the results.