Author Topic: 5.1.889 Behavior Shield problem - USB flash drive  (Read 10787 times)

0 Members and 1 Guest are viewing this topic.

Offline MikeRepairs

  • Jr. Member
  • **
  • Posts: 59
    • Mike's Computer Repair
5.1.889 Behavior Shield problem - USB flash drive
« on: January 14, 2011, 08:16:08 AM »
I am a technician and service many computers every day.
All computers I installed Avast Free 5.1.889 on are no longer able to install programs from my write locked PQI U338 flash drives. (unless I unlock it)

I have many program installers on PQI U338 (4G and 8G)USB flash drives I use to install common programs like CCleaner, Firefox, Java, Quicktime, Flash, etc.
Lets say I click on CCleaner install, the 5.1.889 behavior shield causes the light to rapidly blink and what would normally take a few seconds turns into 7 minutes. There is no error message but it is like time is slowed by a factor of 1000.

How I verified it was the behavior shield:
5.0.677 did not do this. Never had this problem until I started installing 5.1.889 on a bunch of computers today. Tested on WinXP and Win7 64 bit no other security software. If I uninstall the behavior shield in add/remove programs the problem goes away. If I switch the write lock switch on the flash drive to unlock, the problem goes away. (the light no longer rapidly blinks). I must be able to keep the write lock switch on the flash drive locked for security reasons, so viruses could never get on it when servicing computers.

Please fix this problem. Thanks for any help

Computer Service Technician (actual computer may vary)

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11808
    • AVAST Software
Re: 5.1.889 Behavior Shield problem - USB flash drive
« Reply #1 on: January 14, 2011, 10:13:20 AM »
How is the flash drive formatted - FAT or NTFS?

Offline GaAs

  • Full Member
  • ***
  • Posts: 181
  • My CPU is well seasoned. Mmmm, so good!
Re: 5.1.889 Behavior Shield problem - USB flash drive
« Reply #2 on: January 14, 2011, 12:57:43 PM »
Hi All.
Hi Igor.
This morning I suffered a blockage in the safe removal of my external HD USB. I have tried to identify the process that took up the device but it was impossible.
 I used "Process Explorer", "Tools to admin", "viewing the Windows event log. " But nothing.
 I proceeded to create the "rundll32.exe.dmp" (with: Hang Reporting Tool) at the very moment of the error message: "impossible to disable the device. "
 There may be of interest?
 If not, I might give a method to identify positively the process that locks the hardware disconnection?.
 Thank you very much.
Another antivirus, Core Duo T5600, 2.0 GB of RAM, W7_32bit, old oooooold whisky!

Offline pk

  • Avast team
  • Super Poster
  • *
  • Posts: 2085
Re: 5.1.889 Behavior Shield problem - USB flash drive
« Reply #3 on: January 14, 2011, 01:36:15 PM »
@MikeRepairs, thanks for your report. Actually, it took some time to get a USB Flash Drive with hardware r/w locking to verify this issue (even for IT company :)). But finally, we can confirm that and it's currently under investigation...

@GaAs, you can't use user-mode tools for that. I got into the same situation as you, unable to safe remove my USB HDD or USB flash drive. It hasn't happened before. I think it might be still a problem with antirootkit.

Offline GaAs

  • Full Member
  • ***
  • Posts: 181
  • My CPU is well seasoned. Mmmm, so good!
Re: 5.1.889 Behavior Shield problem - USB flash drive
« Reply #4 on: January 14, 2011, 01:43:33 PM »
@MikeRepairs, thanks for your report. Actually, it took some time to get a USB Flash Drive with hardware r/w locking to verify this issue (even for IT company :)). But finally, we can confirm that and it's currently under investigation...

@GaAs, you can't use user-mode tools for that. I got into the same situation as you, unable to safe remove my USB HDD or USB flash drive. It hasn't happened before. I think it might be still a problem with antirootkit.

Thank you PK.
If I can be useful for something let me know.
 :) ;)
Another antivirus, Core Duo T5600, 2.0 GB of RAM, W7_32bit, old oooooold whisky!

Offline MikeRepairs

  • Jr. Member
  • **
  • Posts: 59
    • Mike's Computer Repair
Re: 5.1.889 Behavior Shield problem - USB flash drive
« Reply #5 on: January 14, 2011, 06:19:47 PM »
How is the flash drive formatted - FAT or NTFS?


Some are FAT, some are FAT32
Computer Service Technician (actual computer may vary)

Offline =SKY=

  • Super Poster
  • ***
  • Posts: 1614
  • *2010* - Thanks for 10 years!!!
Re: 5.1.889 Behavior Shield problem - USB flash drive
« Reply #6 on: January 15, 2011, 08:47:29 PM »

@GaAs I got into the same situation as you, unable to safe remove my USB HDD or USB flash drive. It hasn't happened before.

Same at me, Peter! :'(

I'm unable to safe remove my cardreader with SD-card inside.

Never had such a problem before...

You give me hope to solve the problem!!! ;)
Win10 Home [x64] 21H1 @ Windows Defender | FF ESR |
My oldest darling: W2k Pro SP4 & UR1 @ avast! Free Antivirus 8.0.1497 | Palemoon & K-Meleon [BOTH MODIFIED for W2k] |

Offline Nesivos

  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 1352
  • Artists Rendering of New Pauley Pavilion @ UCLA
Re: 5.1.889 Behavior Shield problem - USB flash drive
« Reply #7 on: January 15, 2011, 09:20:54 PM »
I am a technician and service many computers every day.
All computers I installed Avast Free 5.1.889 on are no longer able to install programs from my write locked PQI U338 flash drives. (unless I unlock it)

I have many program installers on PQI U338 (4G and 8G)USB flash drives I use to install common programs like CCleaner, Firefox, Java, Quicktime, Flash, etc.
Lets say I click on CCleaner install, the 5.1.889 behavior shield causes the light to rapidly blink and what would normally take a few seconds turns into 7 minutes. There is no error message but it is like time is slowed by a factor of 1000.

How I verified it was the behavior shield:
5.0.677 did not do this. Never had this problem until I started installing 5.1.889 on a bunch of computers today. Tested on WinXP and Win7 64 bit no other security software. If I uninstall the behavior shield in add/remove programs the problem goes away. If I switch the write lock switch on the flash drive to unlock, the problem goes away. (the light no longer rapidly blinks). I must be able to keep the write lock switch on the flash drive locked for security reasons, so viruses could never get on it when servicing computers.

Please fix this problem. Thanks for any help



Did you scan the USB drive for infections after installing AIS 5.1.889?  I don't think that you said whether you did or not.  I am sure that as a technie that you know that USB drives are one of the worst sources of all kinds of bad stuff. Personally I never use them unless I absolutely must which is hardly ever.

If I was a techie :) I would use remote desktop access to my own computer to install software on someone else computer before I would use a USB drive but that is just me. :)   If I couldn't do that I would use a CD with all of the programs that I install on someone else computer before using a USB drive.

P.S. Plug and Play is also a high risk deal.  I have had Plug and Play turned off on my computers for years.
« Last Edit: January 15, 2011, 09:25:39 PM by Nesivos »
OS: W7-SP1, Security: AIS 7, SAS Pro, WinPatrol Plus Network:2 Dell 570MT x64 1 Dell 660 Desktop with 8GB RAM Default Browser & Email: Firefox & Thunderbird latest Betas

Offline MikeRepairs

  • Jr. Member
  • **
  • Posts: 59
    • Mike's Computer Repair
Re: 5.1.889 Behavior Shield problem - USB flash drive
« Reply #8 on: January 15, 2011, 09:42:23 PM »
Nesivos,

I am a full time computer technician.
There is nothing wrong with my method of using USB flash drives with the write lock switched to "lock" to service computers. Autorun viruses cannot get on it this way. CD drives are slow and some infected computers have broken TCP/IP stack. I am not looking for another method of performing my services, I was merely pointing out a bug I found in Avast 5.1.889
No viruses are on the USB drive. I have special technician tools I use to fight viruses on it. Also installers for common programs.
PK confirmed the problem and said it is currently under investigation.
« Last Edit: January 15, 2011, 09:49:51 PM by MikeRepairs »
Computer Service Technician (actual computer may vary)

Offline dansorin

  • Full Member
  • ***
  • Posts: 133
  • www.romanism.ro
Re: 5.1.889 Behavior Shield problem - USB flash drive
« Reply #9 on: January 16, 2011, 05:00:21 PM »
since upgrading to 5.1.889 i'm unable to safely eject the usb stick. happens on XP SP3 and W7 32b.
W7 Pro x86, avast! fan, Comodo Dragon, Ad Muncher, MBAM free, Easeus Todo Backup free.

Offline =SKY=

  • Super Poster
  • ***
  • Posts: 1614
  • *2010* - Thanks for 10 years!!!
Re: 5.1.889 Behavior Shield problem - USB flash drive
« Reply #10 on: January 16, 2011, 07:58:33 PM »
Hi dansorin,

pk can reproduce the problem. I think he and the others from the team will help us, look here:

... I got into the same situation as you, unable to safe remove my USB HDD or USB flash drive. It hasn't happened before. I think it might be still a problem with antirootkit.
Win10 Home [x64] 21H1 @ Windows Defender | FF ESR |
My oldest darling: W2k Pro SP4 & UR1 @ avast! Free Antivirus 8.0.1497 | Palemoon & K-Meleon [BOTH MODIFIED for W2k] |

Offline =SKY=

  • Super Poster
  • ***
  • Posts: 1614
  • *2010* - Thanks for 10 years!!!
Re: 5.1.889 Behavior Shield problem - USB flash drive
« Reply #11 on: January 18, 2011, 02:12:36 AM »
Same problem in this thread, too: http://forum.avast.com/index.php?topic=69594.0

Isn't it better, to create just one thread to this problem?
Win10 Home [x64] 21H1 @ Windows Defender | FF ESR |
My oldest darling: W2k Pro SP4 & UR1 @ avast! Free Antivirus 8.0.1497 | Palemoon & K-Meleon [BOTH MODIFIED for W2k] |

Offline =SKY=

  • Super Poster
  • ***
  • Posts: 1614
  • *2010* - Thanks for 10 years!!!
Re: 5.1.889 Behavior Shield problem - USB flash drive
« Reply #12 on: January 23, 2011, 08:05:10 PM »
When can we expect a solution for the problem? ???

I mean a really solution, not a workaround! :(
Win10 Home [x64] 21H1 @ Windows Defender | FF ESR |
My oldest darling: W2k Pro SP4 & UR1 @ avast! Free Antivirus 8.0.1497 | Palemoon & K-Meleon [BOTH MODIFIED for W2k] |

Offline pk

  • Avast team
  • Super Poster
  • *
  • Posts: 2085
Re: 5.1.889 Behavior Shield problem - USB flash drive
« Reply #13 on: January 23, 2011, 08:15:18 PM »
in next program update (and this will take 3-4 weeks)

Offline EagleGhost

  • Jr. Member
  • **
  • Posts: 94
Re: 5.1.889 Behavior Shield problem - USB flash drive
« Reply #14 on: January 24, 2011, 03:11:23 PM »
in next program update (and this will take 3-4 weeks)

Do you mean that "cannot remove USB device safely" issue?