Avast 6 not scanning large files

[The Kitchen Sink]

Hi folks. First time here and sadly I am only here because of a problem I'm getting with avast.

About 2 weeks ago approximately. I did a backup of all my important files. They scanned fine and all went well.

Now I notice only in the past several days(because I hadn't grabbed anything new until 3-4 days ago), that the large files I'm getting are not being scanned by avast. When last back up they scanned normally.

I like to watch video files (like television) in the MKV format. This is what tipped me off there was a problem.

These files range from 200mb-900mb and it is 1 file.

I have:
OS-Vista 64 Home Premium SP2
Avast! Free 6.0.1203

So far tested the entire system with:(all builds current as of time of post)
-SuperAntiSpyware
-Malware Bytes
-Windows Defender
-Spybot Search & Destroy

Results- All came up completely clean. Used in OS safe mode and normal mode. Full scans as each allow.

Now for the primary problem. For all intents an purposes the machine appears completely clean with no apparent anomalous behavior at all from anything I have seen in the 2 years of its use.

The only thing bothering me to no end is that every time I scan a file of large proportion(not archival or even .exe). The dang blasted avast tells me it was "No Threat Found" after ZERO seconds. When I know for a fact just a few weeks prior this same type of scan would take almost a full minute to finish.

Some can call me paranoid. But heres a kick in the back side. I scan a whole folder of about 5 MKV files at roughly 300mb. Same thing. Scan ends instantly.

Information of what I try. Context menu scan(aka- the Right mouse click scan). Also any the specific folder scan(start, choose the folder to scan). Also the every other avast scan seems to skip the large files, but its so fast its hard to be 100% sure. =/

Scan results usually tell me the file scanned(if only 1 tested at the time). The size of the file. The usual results as if it scanned it. But its pretty evident its not actually scanning them.

Other possible thoughts of what this could be. No transient options had been check marked. No cacheing used. "Scan All files" used. "Test Whole Files" option used. Complete avast removal and re-install and updated, with all options made the same as before this behavior started.

No apparent conflicts with any programs above mentioned over the course of 2 years of use.

This is truly bothering me as the measure of security is now in dire question. I want to continue using Avast. But this obviously isn't something good =/

[igor]

http://forum.avast.com/index.php?topic=80507.msg659411#msg659411

[The Kitchen Sink]

Thank you for the quick reply. But As I ask in the linked thread. I have concerns that these are skipped files or....?

I think the admin says that such video formats are just not attacked. Thus why scan them using profiles that would never even attack such video formats. I mean. That is logical. But I also have to wonder if the files have anything that is scanned for. IE- if the engine scans for virus types that DO match these formats.

Are they being skipped? Or just very very, low attacks upon such file formats?

Anyone replying. Thank you for your time.

I have been stressing over this dilemma for a few days. =/

[ady4um]

@The Kitchen Sink,

What the developers are saying is that they can change the "engine" of Avast by making "little" changes in the antivirus database, without the need to update the complete program.

The database is usually updated twice a day, and if there is a critic problem they can update it more often too.

The "engine" evaluates the real need to completely scan bit by bit a certain (type of) file.

Avast Team came to the conclusion that certain files are not worth checking, at least for now. "Videos" are mostly skipped, but maybe, one day, without even announcing it, the developers could add some type of file to the regular scan.

So, unless the "zero seconds scans" are happening "everywhere" (no matter the type or size of files), then you can trust that everything that needs to be scanned, is scanned (if your settings are correct).

To be perfectly clear, the "zero seconds scans" indeed happened to me in the past, but it was clear that it was happening "everywhere". I didn't find a "solution", but a "workaround". I downloaded the "clean uninstall" utility from Avast, started "Windows Safe Mode", and clean it.

After a clean installation, the "zero seconds scans" disappeared, together with my concerns.

There are additional reasons to "zero second scans", like for example the "cache" that Avast can use to improve its performance.

So, if you are in doubt, "clean uninstall" Avast, and "clean install" it again (following the correct steps).

Other than that, I think that Avast is protecting you successfully.

I hope this answers your questions, but you are free to ask again and for sure you will get your answer.

[The Kitchen Sink]

I seriously hope you are kidding about them skipping video files. Video files being skipped because they just didn't feel like having them in there??? =/

I think I need to have someone who actually knows tell me what they did over random opinion please.

I am concerned, because I know that many people have 100's of video files. If to assume they will be skipped over. That is just stupid. It negates the whole aspect of security if the engine allows a large group of users to have barn door openings.

Can any dev team people tell me what is going on with video files, such as mkv format?

This is very much a concern for myself and many others.

[ady4um]

You are asking what you already received, IMHO. Igor posted in this topic a link to an additional topic. Igor is part of Avast Team, and the link he posted also points to information posted by a developer of Avast.

I'm sorry my post didn't help you nor minimized your concerns. Maybe Igor or some other user or Avast Team member can do what I couldn't, and/or correct/add/specify any additional information about your concerns.

[Vlk]

Kitchen Sink, I'm not sure I understand...

Let's go through some theory first.

Definition: An IDEAL antivirus software is such a program that detects 100.0% of malware with 0 false positives in zero time.

Now, let me say that the change we recently implemented (skipping of scanning of certain files, such as big video files) moved avast to the direction of an ideal antivirus. I mean, this is exactly the impact of that change:

1. It didn't change the detection rates of malware in any way
2. It did reduce some false positives
3. It did reduce scan time.

As you can see, it was a good change and there's absolutely no reason to be concerned.


Hope this helps,
Vlk

[The Kitchen Sink]

I apologize if I seemed rude.

My concern was that they are skipped why? I am not certain how avast engine works regarding these file types.

To me, skipping files makes a security risk. So that makes me nervous when behavior like this happens.

Many people have 100's of large videos and I do as well. That is why if I see them all skipped. I have to ask. What was the engine doing before they were skipped? How can I be certain exploits are not missed?

I DO appreciate every ones time and patience. Thank you.

[Vlk]

I apologize if I seemed rude.

I thought that if large video files are skipped. Then scanning them before opening them would be the better idea. I am not certain how avast engine works regarding these file types.

To me, skipping files makes a security risk. So that makes me nervous when behavior like this happens.

Many people have 100's of large videos and I do as well. That is why if I see them all skipped. I have to ask. What was the engine doing before they were skipped? How can I be certain exploits are not missed?

I DO appreciate every ones time and patience. Thank you.

The scan of these files is not skipped though.
They of course all go through the engine.
It's just that we implemented some internal shortcuts in the engine that allow us to process these files much, much faster.

Thanks
Vlk

[The Kitchen Sink]

Oh I see. That makes more sense. Again. I do not want you to think I am being rude.

I just did not understand them being skipped. They are NOT skipped, just not problems like .exe?

That makes more sense to me, thanks =D

[The Kitchen Sink]

"(skipping of scanning of certain files, such as big video files)"


"The scan of these files is not skipped though.
They of course all go through the engine.
It's just that we implemented some internal shortcuts in the engine that allow us to process these files much, much faster."


Because you say 2 things.

Question:

1-All files are scanned + big video files.

or

2-All files are scanned, EXCEPT large video = skipped.

It really does seem hard to believe 20gb scans in less than 1 second 0_0

[igor]

The files are not skipped completely - quick checks to determine the file type, and also to check for viruses in specific areas, are performed. Just the full scan of the whole file "body" - for viruses that cannot be there anyway (i.e. which was kinda unnecessary previously) - is skipped.

[The Kitchen Sink]

Thank you folks for your time. It is much appreciated.

I always feel, that if there is any doubt or question in mind. Ask more questions =D

I was very worried files would be skipped and un noticed if anything bad WERE to happen. So I felt I had to ask again XD

Thanks for the clarification. =)


Edit-

Question 1:
Does size matter that much or are all files now much faster?

Example:

1 file = 500mb any faster/slower than. 1 file = 1mb?


--------

Question 2:

Although some people would like this feature of not scanning the whole "body" of the file.
I would like this option to scan the whole "body" of a file. I request this as an option. Slow scans do not bother me. I really liked that feature. It made me feel more confident in Avast software.

Would this be changed back? (As an option)

[igor]

1. There is not size limit (at least I believe so), so it should apply for all files of specific file types.
2. No, I don't think so - if anything was detected during the full-body scan, it would be a false positive anyway.