Script blocker says it scans a script by Explorer.exe when i run windows search.

[arturo82]

Hi, im new here, greetings to everyone

I installed a few days ago Avast Pro 4.8 on windows XP sp2, and having fun by looking what files are currently being scanned by the Resident Protection modules, i found something odd to me by looking the script "last scanned file" section. And then i used the "show detailed  info on performed action" option (to see when is being scanned a script).

i made these tests without being connected to internet or a network.

Test: In windows XP, when i go to "Start"--->"Search"   i get a popup from Avast saying "Scanning a script started by C:\WINDOWS\Explorer.EXE" for a few seconds and then dissapears.

Once inside the Search window thing (then one with the light-brown dog mascot), when i answer "what do i want to search for" and click "all files and documents" then i get 10 pop-ups from avast saying "Scanning a script started by C:\WINDOWS\Explorer.EXE" for a few seconds and then dissapears.

Question: Is this Normal?, i mean, i didnt know that Explorer.exe (the legit one) could run scripts, (anyway im not windows OS expert im just an ordinary skill person with user-level of computer knowledges ).

Can any of you make the test to see of this happens to you guys as well?.

Thank you in advance.

Arturo.

Ps: Please make the test using the original standard windows, and theme, i mean entering the search thing with the damn dog inside, because other people may have windows unatented editions or modified without the doggy.  hehe, thanks.

[YoKenny]

Welcome arturo82

I do not see that happen on my XP Pro system but then I have Windows Service Pack 3 that has been available for a year and contains several Critical Security updates plus performance improvements.

You need to start Internet Explorer then go to Tools then Windows Update and download all of the available updates.

Also you should enable Automatic Updates or at least be notified that Updates are available.

Go to Control Panel then Automatic Updates then select Automatic (recommended) or at least Notify me but don't automatically download or install them.

Go to Secunia Online Software Inspector then run it to see what other applications are vulnerable:
http://secunia.com/vulnerability_scanning/online

[DavidR]

@ arturo82
First let me say I don't use the Pro version, so this is what I believe is happening as I can't test it practically.

In order for a search to be carried out you input a file name (or string) and a location perhaps, these are what are called parameters and a script is compiled based on these parameters to return the hist mad using that script.

So windows explorer is actually using a script of sorts to perform the search and that script would be checked by the avast Script Blocker as it monitors Windows Scripting Host and other scripts.

YoKenny wouldn't see this as he isn't using the Pro version of avast but the Home version, which doesn't have the script blocker.

So whilst his comment to get SP3, which is well advised won't change what you are seeing.

[spg SCOTT]

Hi,

I would just disable the 'show detailed info...', you will definately find it annoying...

Frankly computers are stupid, let me elaborate:

Say you want to find a name in an unordered list. You could just look at it and say instantly where it is, but a computer can't.
First the list has to be in alphabetical order, requiring a sorting algorithm.
Then this list has to subjected to a searching algorithm to find the desired name.

Both the algorithms use comparisons and 'if' commands which is where the script comes in, the script is what tells the computer how to execute the commands and comparisons based on the results of the previous step.
(for example: If the selected name is alphabetically after the desired name, discard selected and all after)

Remember, you are smarter than a computer, it needs help to find a name in a list

-Scott-

[YoKenny]

YoKenny wouldn't see this as he isn't using the Pro version of avast but the Home version, which doesn't have the script blocker.

David, please read my signature which shows I am running avast! Pro on my XP Pro system

Code: [Select]

P4 2.8GHZ, 768MB RAM, 40GB HD, XP Pro SP3, avast! Pro, Finjan SecureBrowsing
I do use Search with the cute doggie as I like it but I do not see any popups from Avast saying "Scanning a script started by C:\WINDOWS\Explorer.EXE" at any time.

[spg SCOTT]

I imagine that you have not ticked the 'show detailed info...' box?

[YoKenny]

I imagine that you have not ticked the 'show detailed info...' box?

No I haven't and that is way too noisy when doing anything as it pops up messages all the time.

[spg SCOTT]

Then you wouldn't see the popup, and I agree with you there, very noisy...

... And then i used the "show detailed  info on performed action" option (to see when is being scanned a script).

But that was the original posters point, if you do tick that box, you see the message and they wondered why explorer used scripts

[DavidR]

YoKenny wouldn't see this as he isn't using the Pro version of avast but the Home version, which doesn't have the script blocker.

David, please read my signature which shows I am running avast! Pro on my XP Pro system

Code: [Select]

P4 2.8GHZ, 768MB RAM, 40GB HD, XP Pro SP3, avast! Pro, Finjan SecureBrowsing

I was looking at the "E5200 2.5GHZ, 4GB RAM, 160GB HD, Windows 7, avast! Free, Browser Defender" one on the first line of your signature

[YoKenny]

I hope arturo82 returns as I am sure that all the help given should help with the satisfaction of avast!

[arturo82]

Hey guys,  sorry for the delay, i was cold to death thinking about if this pop-ups are normal or not. Again MANY thanks for the several replies i really apreciate it, i cant thank enough.

Im gonna make some quotes:

Quote from: spg SCOTT on Yesterday at 01:25:39 AM to Yokenny
I imagine that you have not ticked the 'show detailed info...' box?

No I haven't and that is way too noisy when doing anything as it pops up messages all the time.

Mr.YoKenny, please turn on the "'show detailed info...' box in script blockler and see if you get the pop-ups this time

By SCOTT to YoKenny:
But that was the original posters point, if you do tick that box, you see the message and they wondered why explorer used scripts

Yes sir, your correct.

---
Im gonna take some screenshot and upload it to imageshack to share with you, please wait some minutes.

Btw, the pc has Windows XP Pro- SP2 (my good old vintage Pentium 4 , 1,7Ghz

I'll be back with the pictures.
(Ps: "Ill be back" phrase is copyright of Arnold - no infringement intented)

 

[arturo82]

Hi again, as i said in my previous reply,  here're the screenshots 

First (when i go to "start"-->search)




-----------
Secong picture (when i click "all files thing..")



-------------------
Third Picture (when i click on doggy)



---

Well, i hope this helps.
And please Mr.YoKenny, tell me if this happpens to you (but remember to have ticked the 'show detailed info...' box first

Well, feel free to ask me any questions, and thanks again in advance.

Arturo.

[calcu007]

They are normal. As the message states, it is scanning the scripts nothing is wrong. Windows Explorer uses scripts to do some tasks

[YoKenny]

@arturo82

I see what you mean but I do not run avast! Pro with  'show detailed info...' checked as it is not a default setting and is way too chatty for my liking so would only enable it for debugging purposes.  

You should install Windows Service Pack 3 that has been available for a year and contains several Critical Security updates plus performance improvements.

You need to start Internet Explorer then go to Tools then Windows Update and download all of the available updates.

Also you should enable Automatic Updates or at least be notified that Updates are available.

Go to Control Panel then Automatic Updates then select Automatic (recommended) or at least Notify me but don't automatically download or install them.

Go to Secunia Online Software Inspector then run it to see what other applications are vulnerable:
http://secunia.com/vulnerability_scanning/online

[onlysomeone]

To deactivate this messages you have to untick the checkbox YoKenny already mentioned...

Rightclick the avast!-symbol in the taskbar --> On Access Scanner (first entry in the list) --> select the script-blocker-provider --> Customize --> advanced --> untick "Show detailed information on performed action"
(the names of the buttons/tabs can be different as I don't use the English version)
I also attached a screenshot to make it easier to understand

kind regards
onlysomeone