Some small problems with avast

system · 2007-09-08T05:48:03.000Z

Hi, ;D

I found some small problems with avast when i use it , like:
1/a place not completely translated to Chinese like “malware type : exploit”(see 0b.jpg) and "exploit "should be “漏洞利用” in simplified Chinese version.

2/When i use avast to scan a lot of virus samples it may sometimes warns me “Instruction at 0x7c936f1c referenced memory at 0x0000000 the memory could not be read” .

3/When avast scans a file packed by some strange packers avast may say "complete scan,but found some internal error "

4/avast could not detect a virus that packed by packer named “nakedpack” (like a file on my computer , when it didn’t packed by naked pack avast reports it as “Win32:Spyware-Gen [Spy]” and when it packed , avast reports “No malware”)

(excuse for my english … my grammar is pool =_=b)

Lisandro · 2007-09-08T22:07:30.000Z

Qianwenxiang post:1:

a place not completely translated to Chinese

Hope Igor take a look on this. But, indeed, some messages are mixed from more than one place. So, the one who translated into Chinese could have left inhomogeneity behind.

Qianwenxiang post:1:

2/When i use avast to scan a lot of virus samples it may sometimes warns me “Instruction at 0x7c936f1c referenced memory at 0x0000000 the memory could not be read” .

Do these messages appear on the screen or you’re reading in the log?

Qianwenxiang post:1:

3/When avast scans a file packed by some strange packers avast may say "complete scan,but found some internal error "

Please, post the full name and path of these files.

Qianwenxiang post:1:

4/avast could not detect a virus that packed by packer named “nakedpack” (like a file on my computer , when it didn’t packed by naked pack avast reports it as “Win32:Spyware-Gen [Spy]” and when it packed , avast reports “No malware”)

Maybe just a packaging problem. Again, can you post full name and path of these files?

system · 2007-09-09T02:24:47.000Z

Hope Igor take a look on this. But, indeed, some messages are mixed from more than one place. So, the one who translated into Chinese could have left inhomogeneity behind.

ok,thanks

Do these messages appear on the screen or you’re reading in the log?

they only appear on the screen but not in the log

Please, post the full name and path of these files.

it seems like they only appear when a file is binded with many malwares(the last error occured at “C:\test\0901\1.exe”,and it probably binded with 40 adwares)

Maybe just a packaging problem. Again, can you post full name and path of these files?

It seems like that avast will ignore all viruses packed by naked pack (http://filecoast.com/?file=AfqbdxXH_nakedpack.rar)

(like attachment “0e.png”,before they packed avast can detect 80 virus and after some(sorry ,it can only packs one file at one time.so i only tested 8 files) of them are packed avast wont detect any)

Lisandro · 2007-09-09T03:09:00.000Z

Qianwenxiang post:3:

It seems like that avast will ignore all viruses packed by naked pack

Hope they could take a look in this packager…

system · 2007-09-09T08:07:38.000Z

Tech™ post:4:

Hope they could take a look in this packager…

I think so and then thanks for all of you,hope avast will be better.

igor0 · 2007-09-09T11:20:03.000Z

Qianwenxiang post:1:

I found some small problems with avast when i use it , like:
1/a place not completely translated to Chinese like “malware type : exploit”(see 0b.jpg) and "exploit "should be “漏洞利用” in simplified Chinese version.

As far as I know, these “virus types” (exploit, and there was one more I think) were added into avast! shortly before the release, so I didn’t send the translation packages to the translators, as most of them wouldn’t come back in time anyway. So yes, this word is not translated, in most of the languages.

Qianwenxiang post:1:

2/When i use avast to scan a lot of virus samples it may sometimes warns me “Instruction at 0x7c936f1c referenced memory at 0x0000000 the memory could not be read” .

I would need to take a look at the samples causing the error. The problem is that the actual error might be caused by one file, but the error actually appears later during the scan (if you’re saying that you are scanning a big number of samples). So, if you could somehow find out which file causes the problem (by scanning only some of the samples and making sure the error appears… possibly by dividing the samples into smaller group) - and if you could send me the problematic file (or even an archive full of files - if this archive reproduces the problem), it would be great.
I’d certainly like to fix the problem, but I can’t do it without the file(s) to reproduce the problem.

Qianwenxiang post:1:

3/When avast scans a file packed by some strange packers avast may say "complete scan,but found some internal error "

Again, please can you send us the files? I’d take a look at them as soon as possible. (Or, if the files are many or huge, you can upload them to ftp://ftp.avast.com/incoming) Thanks.
I am certainly looking for this kind of errors, but none appears on our (huge) collections, as far as I know. So, any samples causing these problems are welcome.

Qianwenxiang post:1:

4/avast could not detect a virus that packed by packer named “nakedpack” (like a file on my computer , when it didn’t packed by naked pack avast reports it as “Win32:Spyware-Gen [Spy]” and when it packed , avast reports “No malware”)

There are hundreds of packers that avast! (and also many other antiviruses) can’t unpack. So, why are you worried just about NakedPack?
Actually, the unpacker for NakedPack has been added in the last avast! update (4.7.1043) - but the unpacker is somehow incompatible with “-Gen” detections (Trojan-Gen, Spyware-Gen, etc.). So, if you repack the file detected as Trojan-Gen with NakedPack, in won’t be detected indeed (but, you have just created a new malware variant; if this variant gets in the wild, we’d add another detection for it).
To fix this “incompatibility” between the unpacked and -Gen detections, the detection algorithm would have to be changed - which is planned, but will require a big change to the VPS, so will most likely happen in avast! 5.

system · 2007-09-09T14:32:01.000Z

As far as I know, these “virus types” (exploit, and there was one more I think) were added into avast! shortly before the release, so I didn’t send the translation packages to the translators, as most of them wouldn’t come back in time anyway. So yes, this word is not translated, in most of the languages.

Ok,i see.

I would need to take a look at the samples causing the error. The problem is that the actual error might be caused by one file, but the error actually appears later during the scan …
I am certainly looking for this kind of errors, but none appears on our (huge) collections, as far as I know. So, any samples causing these problems are welcome.

I’ve scanned again and it crashes again but in different forms,when it scanns “abc.rar\2\13.exe” ,it warns me as “Win32:Crypt-VA” and then it ignores other viruses that it hasn’t scanned(before it crashed , i have quickly clicked “Continue” when the virus warning windows appeared),but when I use on-demand scanner to scan this virus again,it doesnt crashed any more…so i guess if it’ll crash as users let it scan a lot of samples then quickly click “continue”,and i have uploaded the file ‘13.exe’ to you.

There are hundreds of packers that avast! (and also many other antiviruses) can’t unpack. So, why are you worried just about NakedPack?
Actually, the unpacker for…
I think so , i am worried about it because some viruses here packed by naked pack that they can pass avast and some other avs easily and some avs just report it as “Heuri/Packed”.

system · 2007-09-09T14:37:56.000Z

wait a moment , i am now sending the file to your ftp server…

system · 2007-09-09T14:44:20.000Z

I dont know if I have successfully upload it , so if you cant find the file abc.rar you can also download it from
http://filecoast.com/?file=WdRD4MtW_ABC.rar

igor0 · 2007-09-09T15:04:01.000Z

Thanks for the file. Unfortunatelly, it doesn’t produce an error here…
A few questions:
Do you have the latest build of avast!? (4.7.1043)
How do you scan these files? I mean, do you use avast! Simple User Interface (if yes, what sensitivity did you set?), or Explorer Extension (“quick scanner”)?
Did you scan only this folder (“1”) when the crash occurred, or did you scan multiple folders in that scan?

system · 2007-09-10T05:03:27.000Z

igor post:10:

Thanks for the file. Unfortunatelly, it doesn’t produce an error here…
A few questions:
Do you have the latest build of avast!? (4.7.1043)
How do you scan these files? I mean, do you use avast! Simple User Interface (if yes, what sensitivity did you set?), or Explorer Extension (“quick scanner”)?
Did you scan only this folder (“1”) when the crash occurred, or did you scan multiple folders in that scan?

ha, i often persecute my computer … and there’re often some strange errors on my pc,again , thanks for your patient , I’ve updated it to 4.7.1043 and then use quick scanner to scan multiple folders like this record(http://filecoast.com/?file=FuDJnEM5_rec1.rar), you can see in the record at 1:10 as i clicked continue and then its scanning process cannot be canceled (can only terminate its process from task explorer)

But … i’ve asked some people ,their avast do not have this problem , so I guess if i use it normally it wont be any errors In the end, wish avast 5(and other versions of avast ) can be the best ones of the world ;D and give my best wishes for you all.

(I think i have to continue study english now…my english is so terrible…)

igor0 · 2007-09-11T07:00:28.000Z

Well, maybe this doesn’t have anything to do with the scanner engine itself… please try to disable skinning of the Explorer Extension (on the first page of avast! settings, uncheck the option “Enable skins for Explorer Extension”). Does it help?

system · 2007-09-11T14:28:16.000Z

igor post:12:

Well, maybe this doesn’t have anything to do with the scanner engine itself… please try to disable skinning of the Explorer Extension (on the first page of avast! settings, uncheck the option “Enable skins for Explorer Extension”). Does it help?

Yes,it works well after disabled the skin , and … probably i need to learn more about avast , thank u.

Lisandro · 2007-09-11T15:42:48.000Z

Igor, why is this problem related to the skin?

igor0 · 2007-09-13T22:14:06.000Z

No idea, it was mostly a guess (first because I’m quite confident in the stability of the Engine itself, second because Qianwenxiang emphasized that it happened when he quickly clicked the “Virus found!” windows away). So, I thought it’s more likely to be a GUI stuff than a scanner/unpacker problem… and yes, ActiveSkin seems to have some issues.

Unfortunatelly, it also means that we can’t do anything about it (even if we were able to simulate the problem)… since the skinning part is a 3rd party library we don’t have sources for :-\

Announcements