Author Topic: Scan problems  (Read 4979 times)

0 Members and 1 Guest are viewing this topic.

jonv

  • Guest
Scan problems
« on: November 28, 2004, 11:22:11 PM »
Since the 4.5 update, when I try to scan (thorough inc. archives), it starts ok but, keeps finding eicar - Not a virus in C:\Documents and Settings\Jon\Local Settings\Temp\_avast_\ where it keeps finding it in every other file there which it can't do anything with, and filling the directory up with gb's of files?
Also when I click stop because its takes for ever its lists lots of files scanned internal program error.
A clean install also resulted in same.
Windows xp sp2.

Thansk

Offline Eddy

  • Avast Evangelist
  • Maybe Bot
  • ***
  • Posts: 31301
  • Watching (over?) you
    • Malware removal, Biljart and other things.
Re:Scan problems
« Reply #1 on: November 28, 2004, 11:28:29 PM »
eicar is indeed not a virus, it is a file designed to test av software. (information)

Do you have 4.5.536? If not, I suggest you upgrade.

jonv

  • Guest
Re:Scan problems
« Reply #2 on: November 29, 2004, 12:07:03 AM »
I updated it but its made no difference...

lots of unable to scan internal program error in the results.
First instance of finding eicar, clicked on move to chest, appears to work ok and continue scanning, but log shows error occured during moving file to chest. The operation was canceled by user.
then again finds it in ..\temp\_avast_\unp#####\eicar.com.txt.
Also that \_avast_\ directory is getting full up with huge amounts of files (18GB) when i stopped the scan last time which are not getting deleted.


Offline Eddy

  • Avast Evangelist
  • Maybe Bot
  • ***
  • Posts: 31301
  • Watching (over?) you
    • Malware removal, Biljart and other things.
Re:Scan problems
« Reply #3 on: November 29, 2004, 12:15:55 AM »
Quote
then again finds it in ..\temp\_avast_\unp#####\eicar.com.txt.
unp in Avast normally is short for "unpacked"

Quote
lots of unable to scan
Can you give some examples of files that give this message? (including location)

Quote
Also that \_avast_\ directory is getting full up with huge amounts of files (18GB) when i stopped the scan last time which are not getting deleted.
I'm not sure, but I believe that Avast removes the files there at the end of a scan, which is never reached since you aborted it.

Have you run a boot scan?

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67247
Re:Scan problems
« Reply #4 on: November 29, 2004, 12:41:21 AM »
C:\Documents and Settings\Jon\Local Settings\Temp\_avast_\

For any reason your temporary files are not being deleted...
You could (and should) delete all files in this folder and boot after  ;)
The best things in life are free.

jonv

  • Guest
Re:Scan problems
« Reply #5 on: November 29, 2004, 01:02:37 AM »
I did and do delete those files and boot after, but surely even if you cancel/stop a scan the program should clean up it's own temporary files? and 19gb seem a little excessive since it only scaned about 700MB of files? also seems alot slower than 4.1?

ok boot scan, and online scanners seem to work fine and show up as clean. I did remove the eicar test virus from sent mail in netscape mail thou.

Here's some of the log file where the errors seem to occur, (it's rather long to post all here)

Thanks 4 help thou..

C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit4.zip\sbRecovery.ini [E] Archive is password protected. (42056)
C:\Documents and Settings\Jon\Application Data\Mozilla\Profiles\default\fv5k5kcw.slt\Mail\mailhost.zen.co.uk\Sent\PartNo_0\eicar.com.txt [L] EICAR Test-NOT virus!! (0)
C:\Documents and Settings\Jon\Application Data\Mozilla\Profiles\default\fv5k5kcw.slt\Mail\mailhost.zen.co.uk\Sent [E] Internal program error. (42003)
C:\Documents and Settings\Jon\Application Data\Mozilla\Profiles\default\fv5k5kcw.slt\Mail\mailhost.zen.co.uk\Sent [E] Internal program error. (42003)
C:\Documents and Settings\Jon\Application Data\Mozilla\Profiles\default\fv5k5kcw.slt\Mail\mailhost.zen.co.uk\Sent.msf [E] Internal program error. (42003)
C:\Documents and Settings\Jon\Application Data\Mozilla\Profiles\default\fv5k5kcw.slt\Mail\mailhost.zen.co.uk\Templates [E] Internal program error. (42003)
C:\Documents and Settings\Jon\Application Data\Mozilla\Profiles\default\fv5k5kcw.slt\Mail\mailhost.zen.co.uk\Templates.msf [E] Internal program error. (42003)
C:\Documents and Settings\Jon\Application Data\Mozilla\Profiles\default\fv5k5kcw.slt\Mail\mailhost.zen.co.uk\Trash [E] Internal program error. (42003)
C:\Documents and Settings\Jon\Application Data\Mozilla\Profiles\default\fv5k5kcw.slt\Mail\mailhost.zen.co.uk\Trash.msf [E] Internal program error. (42003)
C:\Documents and Settings\Jon\Application Data\Mozilla\Profiles\default\fv5k5kcw.slt\mailViews.dat [E] Internal program error. (42003)
C:\Documents and Settings\Jon\Application Data\Mozilla\Profiles\default\fv5k5kcw.slt\mimeTypes.rdf [E] Internal program error. (42003)
C:\Documents and Settings\Jon\Application Data\Mozilla\Profiles\default\fv5k5kcw.slt\netscapetoolbar.rdf [E] Internal program error. (42003)
C:\Documents and Settings\Jon\Application Data\Mozilla\Profiles\default\fv5k5kcw.slt\panacea.dat [E] Internal program error. (42003)
C:\Documents and Settings\Jon\Application Data\Mozilla\Profiles\default\fv5k5kcw.slt\panels.rdf [E] Internal program error. (42003)
C:\Documents and Settings\Jon\Application Data\Mozilla\Profiles\default\fv5k5kcw.slt\prefs.bak [E] Internal program error. (42003)
C:\Documents and Settings\Jon\Application Data\Mozilla\Profiles\default\fv5k5kcw.slt\prefs.js [E] Internal program error. (42003)
C:\Documents and Settings\Jon\Application Data\Mozilla\Profiles\default\fv5k5kcw.slt\search.rdf [E] Internal program error. (42003)
C:\Documents and Settings\Jon\Application Data\Mozilla\Profiles\default\fv5k5kcw.slt\secmod.db [E] Internal program error. (42003)
C:\Documents and Settings\Jon\Application Data\Mozilla\Profiles\default\fv5k5kcw.slt\training.dat [E] Internal program error. (42003)
C:\Documents and Settings\Jon\Application Data\Mozilla\Profiles\default\fv5k5kcw.slt\XUL.mfl [E] Internal program error. (42003)
C:\Documents and Settings\Jon\Application Data\Mozilla\registry.dat [E] Internal program error. (42003)
C:\Documents and Settings\Jon\Application Data\Sun\Java\Deployment\deployment.properties [E] Internal program error. (42003)
C:\Documents and Settings\Jon\Cookies\index.dat [E] Internal program error. (42003)
.
.
.
C:\Documents and Settings\Jon\Local Settings\Temp\_avast4_\unp104584811 [E] Internal program error. (42003)
C:\Documents and Settings\Jon\Local Settings\Temp\_avast4_\unp104633093\eicar.com.txt [L] EICAR Test-NOT virus!! (0)
C:\Documents and Settings\Jon\Local Settings\Temp\_avast4_\unp104633093 [E] Internal program error. (42003)
C:\Documents and Settings\Jon\Local Settings\Temp\_avast4_\unp104633093 [E] Internal program error. (42003)
C:\Documents and Settings\Jon\Local Settings\Temp\_avast4_\unp104716281\eicar.com.txt [L] EICAR Test-NOT virus!! (0)
C:\Documents and Settings\Jon\Local Settings\Temp\_avast4_\unp104716281 [E] Internal program error. (42003)
C:\Documents and Settings\Jon\Local Settings\Temp\_avast4_\unp104716281 [E] Internal program error. (42003)
C:\Documents and Settings\Jon\Local Settings\Temp\_avast4_\unp104808031\eicar.com.txt [L] EICAR Test-NOT virus!! (0)
C:\Documents and Settings\Jon\Local Settings\Temp\_avast4_\unp104808031 [E] Internal program error. (42003)
C:\Documents and Settings\Jon\Local Settings\Temp\_avast4_\unp104808031 [E] Internal program error. (42003)
C:\Documents and Settings\Jon\Local Settings\Temp\_avast4_\unp104833643\eicar.com.txt [L] EICAR Test-NOT virus!! (0)
Operation was canceled by the user...
While moving file to chest, error occurred: The operation was canceled by the user
Infected files: 90
Total files: 5674
Total folders: 507
Total size: 703.2 M

*
* Task stopped: Sunday, November 28, 2004 10:00:06 PM
* Run-time was 37 minute(s), 33 second(s)
*
« Last Edit: November 29, 2004, 01:06:57 AM by jonv »

jonv

  • Guest
Re:Scan problems
« Reply #6 on: November 29, 2004, 01:17:32 AM »
hmmmm, is still finding it in the sent folder even thou I deleted it before.. and getting same internal program errors etc..

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67247
Re:Scan problems
« Reply #7 on: November 29, 2004, 01:20:52 AM »
Probably Alwil will have interest on receiving the files marked as 'Internal program error'. Maybe you can send it to pk...
Can you send him an IM and talk about? Thanks.
The best things in life are free.

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11809
    • AVAST Software
Re:Scan problems
« Reply #8 on: November 29, 2004, 10:06:45 AM »
This is certainly very strange.
How big are those unpXXX files (e.g. C:\Documents and Settings\Jon\Local Settings\Temp\_avast4_\unp104633093)? Is there any small one? If yes, could you send it to us?

Thanks.

jonv

  • Guest
Re:Scan problems
« Reply #9 on: November 29, 2004, 06:11:03 PM »
Yes I can send, which address? they're all 4.72MB in size.

jonv

  • Guest
Re:Scan problems
« Reply #10 on: November 29, 2004, 07:59:15 PM »
Hello, thanks for the help/reply's, I've narrowed it down to a single file that seems to be the root cause of the problem.
It is/was the sent mail file in netscape 7.2
Removing/excluding this resulted in the scan running perfectly, with no internal program errors and back 2 normal speeds..
So maybe the file is corrupt in someway?
Don't think there is any important emails in it, I can send it if you would like it?

Thanks.

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11809
    • AVAST Software
Re:Scan problems
« Reply #11 on: November 29, 2004, 08:29:28 PM »
I've sent you a private message, jonv.

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67247
Re:Scan problems
« Reply #12 on: November 30, 2004, 01:32:57 AM »
Try the last program update (official release, not a beta) 4.5.542 to see if it corrects your problem: right click the avast icon > Updating > Program Update.  ;)
The best things in life are free.