Avast Mac Security - cannot initiate scans

Avast Mac Security
1

Hi,

Earlier today I ran a scan on my Macbook Pro without problems, though I did abort the scan near the end as I needed to reboot. After rebooting (at Feb 19 15:23:15) I didn’t try to do a full scan again until some 3+ hours later, at which point initiating a (full system) scan failed, the error being:

Error 7005: Connection to antivirus engine has been lost

Looking at syslog I can see the problem, this matching pair of errors is repeated every second for a long time…

Feb 19 15:33:59 Anthony-Tooles-MacBook-Pro.local com.avast.daemon[139]: avldrDuplicateHandle(): Too many open files
Feb 19 15:33:59 Anthony-Tooles-MacBook-Pro.local com.avast.daemon[139]: accept(): Too many open files

Looks like this error was seen almost 15000 times, something is very unhappy.
Anthony-Tooles-MacBook-Pro:~ anthony$ less /tmp/avast.log | grep “Too many open files” | wc -l
14777
Anthony-Tooles-MacBook-Pro:~ anthony$ less /tmp/avast.log | grep “Too many open files” | head -1
Feb 19 15:33:59 Anthony-Tooles-MacBook-Pro.local com.avast.daemon[139]: avldrDuplicateHandle(): Too many open files
Anthony-Tooles-MacBook-Pro:~ anthony$ less /tmp/avast.log | grep “Too many open files” | tail -1
Feb 19 18:27:08 Anthony-Tooles-MacBook-Pro.local com.avast.daemon[139]: avldrDuplicateHandle(): Too many open files
Anthony-Tooles-MacBook-Pro:~ anthony$

I have since restarted the daemon process which has fixed things and I can now scan. However the root cause of the problem is unknown…

Two questions:

  1. I’ve seen other people report the 7005 error and the “Too many open files” errors, but often not together, and I’ve not seen any definite advice as to what the problem is.

Is this simply a new bug in the daemon causing a file descriptor leak?

  1. The avast GUI didn’t report any problems (until I tried to start a scan) which is a bit worrying! Would it have been doing on-access scanning successfully? Or is this a bug in the reporting?

I’ll try to attach a full logwith all references to com.avast from syslog - if the forum will let me…

Thanks,
Anthony

2

I can’t upload files, but here is the log on pastebin… I had to edit out the really verbose logs (that were happening every second, see above) and it starts from the laptop reboot

http://pastebin.com/95a214sy

3

There was a serious bug that caused the scan engine to deadlock
on some special files in 10.6. Version 10.7 (43713) fixed this.

4

Thanks, looks like 10.7 was installed earlier today so that problem should be fixed.

What about the issue with the GUI? If the daemon is non-functional, then shouldn’t the GUI be reporting that loud and clear?

5

The thing is, that the daemon was still running and even responsible to other scan requests (e.g. from the shields). Only the thread executing the scan on the special file was eating all CPU available to it. That’s why there wasn’t any reporting in the GUI. One could however find some info in the system log which is the place where to look first, when there is something strange going on in your system.

6

I couldn’t start an on-demand scan, so the daemon certainly wasn’t fully responsive.

Would it have been accepting requests from the file/web shields, but refusing them from an on-demand scan?

7

That’s true, after a chain of resulting consequences the daemon was out of file descriptors and thus most probably unusable for any scan. But…

…the problem is, the GUI can not1 decide whether the issue is only in its scan session or it is global.

[1] In general. There are special cases where it can and is doing so.