Got a problem here, confirmed in Vista Business x86 SP1, Vista Home x64 SP1, and even the Win7 beta. The copy and/or read of certain (apparently signed) DLLs on write-protected media causes system freeze.
In summary, here's the setup to reproduce this issue:
- Install Avast Home 4.8
- On media you can write protect (i.e., a flash drive or software hard disk emulator, NOT CD/DVD media) make a copy of mfc71.dll (usually found in Windows\system32). Note that other MFC DLLs seem to have the same effect but try this one if you have it available.
- Now, remove the media, write-protect it using the hardware switch and re-insert it.
- Attempt to copy that DLL from the media to your desktop (NOT in \Windows or other highly protected areas). In my setups this copy process hangs tightly.
- Attempt to read the properties page of that DLL as it sits on the read-only media: it fails silently without even pop up a properties page. Also cause general Explorer issues unresolvable except by rebooting.
Under Avast Home 4.8 Troubleshooting, while the "Skip checking of digital signatures of infected files" box is unticked this lockup occurs. If the box is then ticked (I followed with another reboot) this operation works fine. Interestingly, untick it again and it still works after all that (perhaps because info is being cached?)Turns out that checkbox does NOT help the problem after all, at least not on every machine. Safe to say that selecting "Stop On-Access Protection" DOES prevent the issue every time, but that defeats the purpose of this. My x64 installation seems quite happy with all the settings back to where they started, suggesting cached data perhaps (the only other setting I toggled was "Disable the self-defense module" which didn't appear to have any effect on this issue).Note also that the DLL in question IS signed. THat might have some bearing on this.
Thanks again!
Your thoughts?
Note: I already took some of Microsoft's time hunting this bug down only to discover Avast is indeed the root cause. I'm very pleased with Avast thus far and I'm reporting this in order to help improve it a little (having the system lock up tight due to a simple copy or file->properties request on a known-good file is a pretty big problem).