SLOW. oh my gosh, is it ever slow.

Avast Free Antivirus / Premium Security
1

OK, 2 hours reading lots of fascinating material.
Searched till blue.
Ready to beg for assistance.
<The late NAV will not be returning, and BDF was ok, though non-resident.

Finally figured out that Avast hasn’t ever actually run thru a complete scan (though I thought I had done that when installed, early June). I have a vague recollection of what I think (at the time) I perceived as a flat stall of the program that never did get resolved, too many issues, moved on, forgot to re scan, etc.
Anyway, the spinning a-ball keeps spinning, and it’s talking to me every day about how up to date it is now, again. So I think “great…it’s all hunky-dory”
Anyway.
Well, so the computer began behaving strangely…odd Outlook behavior, crashie MS Word, etc. Repairs no help…amplifying to scanpst.exe demand.

So, finally I checks me avast, and she’s a not a wanna have been scanned, since the day installed.

So fine…initiated the thorough scan…THREE DAYS AGO!
Still making my way through that entire circle now.
I thought it would never finish scanning…but it did claim to find 30 infected files, of various ilks:
Mydoom/Beagle/Netsky/(1 other that I can’t read in the results, because I can’t scroll in the results, because I am in process of “Processing results…” after having selected all 30 of them, and Action, and delete.)

Fine, impressive screening deep into OLD archives & backups…dig that.
However, it seems to be fully engaged and slowly counting bars in the

“Processing results…” dialog. 12 bars…ope! now 13 bars…that’s about right in the middle of the scale now…can’t tell exactly what it’s processing, as the string is apparently longer than the dialog has room for…can’t widen it either.
From what I can tell, it’s still working on the first of the 30 infected files that I selected to delet

I’m reckoning that I’ve been eyeing it for about TWO HOURS now, from the moment that the thorough THREE DAY virus scan finally finished, and the results were displayed for my selection. This suggests that my computer may be finished with this virus removal task in 120 hours or so from now…
During which time, pretty much everything, including browsing, is slow.
FIVE MORE DAYS?

I do not think so.
Please advise.

XPSP2
ZA5.5.094.000
avast4.6.691Jul2005
Privoxy3.0.3
HiJackthis1.99.0.1
SpywareBlaster 3.4.00
SpybotS&D(adv.mode)1.2.0.3
AdAwareSEP6.2.0.236

2

I don’t understand whats the problem…

3

Well, is this normal behaviour? (estimating forward) 7 days to complete a full deep scan and virus cleaning?

4

Well, depends on your hardware. But Thorough scans with Archive scanning enabled can be extremely slow.

5

What about the process of deleting files in the results window?

That’s where I’m at now…as noted.
Though now it’s 14 bars now on the scale of perhaps 26.
It’s still working on that first of 30 files in process of deletion.

What is the average processing time for deletion of a single file?

6

I don’t understand which bars do you mean. Can you make a screenshot of them and paste it here?

7

refresher on how exactly to do a screenshot? :-[

8

Just pres Prt Scr button on keyboard when you see that bars on screen.
Open image editing program (MS Paint is fine) and use Paste command (or press Ctrl+V keys). After that save it to JPEG/JPG.

You can upload it here and then paste link to the image here (use direct link) :slight_smile:

9

ok, see how this is, but I don’t get what you mean by “direct link”. How do I upload? Sorry so wankin. I tried it as an attachment under additional options, but I get a message back that “the document contains no data”, when I click post. Then I am unable to continue typing in the message window, unless I refresh it with the browser.
Can’t paste it here either, after copying the jpg.
tedium

10

So anyway, barring a screenshot…
Avast is “processing results…” after my having selected the 30 infected files that showed up in the “results of last scan” window, and then selected “action”, and then “delete” (BTW there are a total of 1826 lines listed in the results, the rest are “password protected” says the list)
“17 bars” is an expression that describes the progress of the activity as reflected in the onscreen scale that crawls forward in the “Processing results…” window, directly below the words "Processing file C:\Documents and Settings.…*.yak.

During the 3 day scan, I placed each one that came up, in the chest. Now that it’s finally offered me a chance to delete the offenders, that’s what I chose to do.
So avast is running full blast, hard drive spinning away…on the first of the 30 files selected, several hours now after beginning the deletion process.

It is extremely disconcerting to have a delete process take as long as this is taking. What the heck is it doing? Scrubbing everything?
Please help!

11

How did you initiated the scan?
With what settings?
How many data is on the drive(s)?
Are you running the scan in normal or safe mode?
Tried a boottime scan?
Got many large files on the system? (like movies and such)

12

I’ve got to sleep…nodding off…4am…please consider this and I’ll try to get back to it immediately upon awakening later today.

13
  1. through the radio lookin-silver skin.
  2. thorough Drive C, is all I remember…3 days ago!
  3. 43.8GB scanned
  4. normal mode. did not see any suggestion to do otherwise.
  5. yes, boottime scan yielded nothing
  6. sure, like anybody.

The first file in the selected list to delete is, that it’s dragging on deleting is called data.zip\data.scr[UPX] and the result said Infection:Win32Mydoom[Unp]

(This file is apparently in the archive.pst, which is the archive for Outlook.

14

OK, I’m back.
now there’s a message dialog on the screen from Avast! quick scanner…guess it did the scheduled scan I set up yesterday with Scheduler.
It claims to have
tested: 81424 files
Tested file: C:\D&S\me\Local Settings\App data\outlook.…etc.
and specifying (inexpicably) one particular folder in the archive.pst file (but not specifying a file there). Anyhow, the number tested isn’t changing, so I think the only thing is to click on the only button I am presented with in that dialog…Cancel.

Anyhow, the original “Processing results…” dialog appears still to be also creeping through the previously mentioned first file deleted on the results list, seems to have now acheived…22 bars of what appears to be 26 total (or about 85 % completed on the deletion of 1 of 30 files.

Had started this process, (selected the 30 files for deletion, and clicked Action/
Delete) 2 hours before my first contact…so thats…well it must be about 5:30p your time now, so from 7:30a your time that’s about 10 hours to delete 85% of an infected file (of unknown size) which …there are 29 more behind it, I suppose.

OK, while typing this, I think that the (Processing results…) dialog has just closed…so there is some movement right now…to? who knows what.

30 files are still shown, all selected, among 1826 lines, still the same…just as it was before the 10 hour processing of the first file, and it seems to be waiting as before, for me to select an action.

??? what was avast DOING for 10 hours???

It seems clear that my system is infected. The infected items seem all to be in archive.pst & outlookbackup.pst, which, based on the particular folders (all mails received, in folders I haven’t used in ages), that the infection is OLD. Which means that NAV was even less useful than I had previously thought.
I suppose this means also that I might have actually HAD an active virus (or, more properly, 30 of them) for quite some time. Rueful.

How to know if I’m actually protected NOW, by avast, is a mystery to me.
After all, I thought I had already scanned the C drive for viruses, before enabling all the providers in June…but nope, learned otherwise.

What is my next best move, in the state I’m presently in, as described in excrutiating detail here, in hopes that I might save both myself and others from any further grief?

15

Further info:
I see now that in the “results of last scan” window, the “operation” column contains errors on all the 30 infected files’ lines.
Most read as follows: Error occurred during moving file to chest: File is not packed.
The exception there is that the 28th & 30th lines reference a Trojan horse, it’s been here a while too, by the folder it resides in in outlookbackup.pst. Both lines end with a similar reference.
ID:BRSKMO/SPY & ID:BRSKMO/SPYKILLER.

I don’t know if this stack of details was present before the 10 hour process most recent, or whether it is a result of that process. I thought I had responded ‘move to chest’ repeatedly over the 3 day scanning process, and then selected the 30 infected lines to Action/Delete (not move to chest). I can’t be certain.

Other challenges:
Most of the rest of the (still) 1861 lines in the “results of last scan” window consist of “Unable to Scan: archive is password protected” files. anomalies (?) :

  • Norton Cleansweep\Cleansweep.cfg (yes, I still use some of the Systemworks tools, though completely uninstalled the NAV portion)- AdAware Personal\Skins\AdAwareSE default.ask- Spybot S&D\Recovery

Also, there are a couple of singular entries:
C:\I386\LANG\HWCHT.DL_\hwxcht.dll
AND
A .FPT file (textual information for The Master Genealogist dataset) reported as “unable to scan: the file is a decompression bomb”. That’s a 71MB file. It doesn’t seem to have had any problem with another 500MB .FPT in the same folder, so that’s odd.
I’m not sure it actually even is a compressed file, so how does that make sense?

Anyhow…lots of details for the determined reader.
WHAT NEXT?

16

ok, searching on the 0x80040119 error, I see that scanpst.exe on the Outlook’s archive.pst & outlook backup.pst are recommended, which I had already done one the main outlook.pst. So, that’s underway.
Any more clues, anyone?

17

What type of scan did you choose and how did you initiate it?

Personally I think you have used the wrong tool for the job if you have been using the work around to get a scheduled scan using ashQuick.exe (it was never designed for this purpose).

The major disadvantage with the task scheduler trick of using ashquick.exe is, it will scan every file of the hdd, partition, folder or file that you set it to scan; even those files not considered a potential threat (mp3, etc.), this can take a very long time.

I would suggest you stop any ongoing scan with ashQuick.exe and schedule a boot-time scan from within the avast Simple User Interface, Menu.

http://img.photobucket.com/albums/v325/for-dwr/boottime.jpg

18

boot time scan took about 20 minutes, found nothing. I ran that BEFORE the 3-day odyssey (now running up on 5) .
Ashquick by scheduler found nothing, scanned little. I set that up at about 4 am pst, to run at six, which it did, with a separate little return window on that and nothing to fix.

Meanwhile the 0x8 error was about needing to run the inbox repair tool on the Outlook archive & Outlook backup files, which I’ve now done. Coincidentally, these were also the same files that contained folders that contained mail that avast said was infected.

Next I’ll have to tackle the odd CAB archive corrupted error in C:\I386\LANG\HWCHT.DL_\hwxcht.dll (has something to do with chinese characters)
AND
The decompression bomb tagged, thus unscannable, .FPT file (textual information for The Master Genealogist dataset) which…by the way, I don’t get the reference on this topic in another thread, to exactly how and where in the .ini to make an adjustment the limit, or really even whether that is actually the problem, since it’s a smallish file, compared to other larger .fpt files in the same folder, and since none of those had that error.

19

Quick report on the Delete action, after scanpst.exe on the .pst archives that contained the infected files.
It didn’t work.
Still get error deleting files, with the 0x80040119 error on all 30 infected files.
scratching my head…

20

What does seem to have worked is deleting the actual files referenced in the ‘results of last scan’. Since the items were in particularly identified outlook folders, and since googling on avast’s deleting error (0x80040119) seemed to suggest that running scanpst.exe (the inbox repair tool) would be wise, I did that first. I did it on the main outlook.pst, as well as the archive.pst, and the outlook backup.pst.

I then was able to delete the outlook backup file outright, solving for the several iinfected files that were in the backup, since I can always back up the cleaned main file again. A risk, I know, but you’ve got your potential fire, and then you’ve got your fully engulfed building…

Then I opened Outlook and deleted the mail subfolders that avast referenced as containing the infected files, so as not to have to preview them individually before deleting them.
Then I went into Outlook’s Deleted Items and deleted them all permanently, because for some reason, shift-delete in the previous step did not allow me that shortcut to permanently delete.

I then initiated a cleaner session with avast’s cleaner.
I also started another scanning session through the simple interface, of the folders in which the deleted subfolders had resided.

I should have done them one at a time, because one of them (as it turned out, the cleaner) did find another instance of the Mitglieder trojan (which was one of the additional items that I couldn’t read in a way earlier reference).
Because the scanner was running also, when the cleaner found it, I got a message from avast that only one instance of the tool could run at a time, upon clicking remove the entire infection from this computer. The cleaner was paused on the file referenced in the alert, so I first paused, then stopped, then closed, the scanner instead, thinking this would allow there to be only a single instance of the tool. I tested for availability of the remove the entire infection tool at each step, without success: same message.
I figured it couldn’t hurt to do a boot time scan either, so I scheduled one of those, and then I tried the move to chest button.
The alert did allow me to move the file to the chest.
(I think)

Anyhow, I’m now going to restart & do the boot time scan, and see what happens. Perhaps in this mode, I will actually be able to Completely Remove the Infection.

Thanks for hanging in there. :-*
I may not be part of avast’s circle of adherents (yet), but I do appreciate your providing a resource that allows me to record the results of this journey so that others may possibly not tread and grieve.