Ewido 4.0 beta bug

[Chubb]

I have a display bug here.

Signatures in database: 313,

Only the 3 digits in the thousand column is shown..

See attached

[Blackcat]

Maybe we could post all beta bugs in this thread?

[Chubb]

{QUOTE-> Maybe we could post all beta bugs in this thread? <-QUOTE}

Good idea ;D , but I am not sure if Peter would move this thread to the beta forum, where I found only a few threads there :P .

[gerardwil]

{QUOTE-> I have a display bug here.

Signatures in database: 313,

Only the 3 digits in the thousand column is shown..

See attached <-QUOTE}

not here:

[.....]

Shouldn't we be posting in the BETA section? :blink:

[Blackcat]

Maybe one of the Mods can transfer this thread to the Beta section?

[Chubb]

{QUOTE-> not here: <-QUOTE}

Thanks gerardwil, I noticed from the first screenshot you posted already, but I am not sure what caused this. There was no incremental updates at the moment, maybe see what happens to the number after the next incremental update.

[Chubb]

{QUOTE-> Maybe one of the Mods can transfer this thread to the Beta section? <-QUOTE}

Maybe let's continue here so that the moderator can move the whole thread to the beta section, rather than having another new thread in the beta forum.

[Detox]

Thread moved to beta forum. ;)

[se7engreen]

I know this has already been posted in the beta announcement, but since this is going to be the bug-reporting thread, here it is again.

[gerardwil]

{QUOTE-> I know this has already been posted in the beta announcement, but since this is going to be the bug-reporting thread, here it is again. <-QUOTE}

hm strange:

[Chubb]

"Microsoft Messenger"

(1) Should that be Windows Messenger?

(2) It says: "Remove Microsoft Messenger". If I could remember, I have read somewhere in the Microsoft KB that if you wan to use MSN Messenger, you need to have Windows Messenger installed in order to have MSN Messenger function properly. But I could not locate the relevant Microsoft KB article at the moment. So I won't be able to use MSN Messenger if I have removed Windows Messenger. Please correct me if I am wrong.

[gerardwil]

You can still use MSN messenger then.

Gerard

[DarkX]

{QUOTE-> (2) It says: "Remove Microsoft Messenger". If I could remember, I have read somewhere in the Microsoft KB that if you wan to use MSN Messenger, you need to have Windows Messenger installed in order to have MSN Messenger function properly. But I could not locate the relevant Microsoft KB article at the moment. So I won't be able to use MSN Messenger if I have removed Windows Messenger. Please correct me if I am wrong <-QUOTE}

I already removed windows messenger manually and my msn messenger always worked without any problem.

[Chubb]

{QUOTE-> I know this has already been posted in the beta announcement, but since this is going to be the bug-reporting thread, here it is again. <-QUOTE}

I didn't get the error failed to connect to the server. I was able to run the update once I have installed it and the update was successful. A successful upating screenshot was posted in http://www.wilderssecurity.com/showthread.php?t=128988

After the connection to the server was finished, the "Please Wait" button will become "Start Update" some seconds later, and the "No Update was available" will revert back to "Ready for Update" also some seconds later.

[Chubb]

{QUOTE-> You can still use MSN messenger then.

Gerard <-QUOTE}

{QUOTE-> I already removed windows messenger manually and my msn messenger always worked without any problem. <-QUOTE}

Thanks gerardwil and DarkX for the information.:)

[se7engreen]

I think what I'm seeing is not related to the update process. I have this installed in a virtual machine and once the beta is installed the VM no longer has internet access. The VM still has access to the local LAN but internet access is cut off. This continues even if I shutdown Ewido.

[Chubb]

The autostart up listing.

In the Registry, HKML, I were able to find an entry for Ewido, which is:

!ewido
"E:\Program Files\ewido anti-malware 4.0\ewido.exe" /minimized

However, I were unable to find Ewido.exe in the Autostart tab, and I found a blank entry in the listing.

Looking at the System Configuration Utility, I also found a blank entry but also an Ewido.exe entry. Strange!!!

[Chubb]

Another display bug. The Scanned Objects counter fails to show the hundred figures after the thousand comma.

You can see that before 1,000 approaches, the number is 949, and after a thousand files have been scanned, only "1," was shown and the hundred figures XXX in "1,XXX" was missing.

[gerardwil]

{QUOTE-> Another display bug. The Scanned Objects counter fails to show the hundred figures after the thousand comma.

You can see that before 1,000 approaches, the number is 949, and after a thousand files have been scanned, only "1," was shown and the hundred figures XXX in "1,XXX" was missing. <-QUOTE}

A bug? Again not on my machine.

[Chubb]

I have a sample file "Trojan.exe" downloaded somewhere from the internet and I renamed it to "Trojan.exe".

Both Ewido version 3.5 and this 4.0 beta reported that the file was infected with the trojan "Trojan.Agent.sk". But scanning the file with KAV 6.0.0.299, NOD32 2.51.26 and Sophos AntiVirus 5.2.0 all with the latest signatures gave no infected findings. I am not sure if it is a false positive or a true positive.

Left-click on the orange "Recommended action" only gives, "Ignore Once", "Quarantine", "Delete", "Add to Ignore List" and "Recommended actions". After clicking on "Apply" to 'Quarantine" the file, I was bought to the infections tab where I was allowed to "Restore" or "Remove finally".

I want to submit the sample for your analysis but I found nowhere on the menu where I can find a way to submit the sample. Is there no submission function in this beta 4.0?

I need to click on "?Help", go to http://www.ewido.net/en/support/ to submit the sample under technical support.

[Chubb]

{QUOTE-> A bug? Again not on my machine. <-QUOTE}

You have a dot for 2.709, but I got a comma in "1,". So strange!! ???

[gerardwil]

{QUOTE-> You have a dot for 2.709, but I got a comma in "1,". So strange!! ??? <-QUOTE}

I assume that's the system language :) or not?

[Chubb]

Click on "? Help" on the top menu brought me to
http://www.ewido.net/en/support/

where there are FAQs on technical and customer service issues. Would there be a chm help file for 4.0?

[Chubb]

{QUOTE-> I assume that's the system language :) or not? <-QUOTE}

Hm...maybe, but this is the English version and I suppose the counter would be the same irrespective of your regional locale.

And, the hundred figures failed to be shown in my case. ???

[pwillener]

Regarding the display bugs reported earlier in this topic - I don't see them... (Windows XP SP2)

177773

I see the number correctly displayed, both before and after entering the license code.

[pwillener]

But I have an issue with the progress bar during the fast system scan. It progresses slowly to the right while scanning, then reaching the right end, but it is far from finished scanning. It just seems to go through once, without any relation to the remaining scan time.

In fact, I just did a test

Scan start: 14:30:05
Progress bar completed: 14:32:40 (2 min 35 sec)
Scan ended: 14:48:05 (18 min 0 sec)

This is so way off that I can imagine it will upset users that do a manual scan. There should be a way to estimate, e.g. the number of files to be scanned, and move the progress bar accordingly.

P.S. I don't know if Ewido 3.5 had a similar problem, as I never ran manual scans (but scheduled nightly scans).

[LM1]

When I try to generate PDF files by printing web pages using Edocprinterpro (a PDF application) from Firefox, Firefox closes and actually crashes.

This never happened before I installed Ewido 4.0 beta, so I assume that there is some conflict between these applications. (Other security software I have installed, if it makes a difference - Process Guard, full version; Netveda firewall; KAV 2006, with proactive defense enabled).

[scoopnoggin]

I am unable to receive signature updates. Is the server down?

Without the updates, ewido.exe uses 4 megs of ram and the guard uses 2 megs. Very nice.

Edit: Ooooo right now its using 3.7 megs. Well hey can't beat that! who needs sigs anyway? :)

Edit again: server up, update complete, houston we have liftoff

[CDomaille]

{QUOTE-> I have a display bug here.

Signatures in database: 313,

Only the 3 digits in the thousand column is shown..

See attached <-QUOTE}

Mine is OK, had an update this morning and it shows 314,075. maybe you need to run the update.

[Qark]

I have founded bug, when I use "Fast system scan"-mode, process bar shows that scan is over. But scan continue normal way. Here screenshots:

177775

[chaos]

Ewido is reporting at the front page...
-->Detected malware so far 4.
But I didn't receive any message to choose the required action when this malware was found.Additionally nothing can be found in the quarantine.
Also I did a fast system scan and nothing was found.Note that this system scan was before any malware was reported as found.
Is it possible that it is just tracking cookies automatically removed?

I can confirm also the progress bar bug.


I would like to congratulate the ewido team for releasing ewido antimalware 4 beta and to note that some people shouldnt be so suspicious just because other untrustworthy companies in the past have betrayed them and they havent kept their promises.
How long do you believe that it will take you to finalize the product?


A typing mistake is the following.
When you press the orange highlighted text (see the screen capture below)a menu appears.The last choice says "recommend actions" instead of "recommended actions".

[se7engreen]

Update on my problem earlier in the thread; my updating issue was due to problems with my VM and not ewido. VM is fixed and ewido is working as it should.

[Chubb]

Cofirmed the progress bar issue.

I did a scan of my partition with all the programs installed. It has around 61,000 files. During the scan, when it has scanned for only about 500 files, the progress bar showed a completion of about 25%, which should not be the case. 500 files was only about 0.8% of a total of 61,000 files, as opposed to the 25% competion shown.

Moreover, the scan engine stuck at the *.chm files in the Microsoft Office folder. I am using Office XP and my machine hanged severly when the scan window showed that Ewido was scanning the chm files in E:\Program Files\Microsoft Office\Office10\1028. The hang was so severe that I was unable to capture a screenshot to show the progress bar bug. It took me almost more than 5 minutes before I can bring up the Task Manager to kill the Ewido process.

[Chubb]

After running an update of the signature, the signatures in database still showed "314," instead of "314,XXX". The XXX is still missing. ??? ???

[Chubb]

{QUOTE-> A typing mistake is the following.
When you press the orange highlighted text (see the screen capture below)a menu appears.The last choice says "recommend actions" instead of "recommended actions". <-QUOTE}

Yes, you are right

[vinzenz.ewido]

{QUOTE-> I have a display bug here.

Signatures in database: 313,

Only the 3 digits in the thousand column is shown..

See attached <-QUOTE}

The progress Bar bug should be fixed soon. (Should be in 4.0.0.149)


@Chubb,

I'm wondering what Locale are you currently using? This is really strange. Can tell me? I have no idea why it is like that on your machine.

@ chaos

Yes the guard has deleted tracking cookies automatically if the option is enabeld ( check your shield settings if this option is enabled ;) (He won't tell you if he does it since this can be very annoying :p )

I can't tell you when it will be finished. I really don't know :(

<old>
The mistake is imho no mistake, this can be both "recommend actions" and "recommended action"

use the "recommended actions"
vs
"recommend actions" to me

Since it configures ewido anti-malware I personally would prefer the former.
</old>

Edit: OOooops misunderstanding. Will be fixed in 4.0.0.149 Sorry

BR

[vinzenz.ewido]

{QUOTE-> Update on my problem earlier in the thread; my updating issue was due to problems with my VM and not ewido. VM is fixed and ewido is working as it should. <-QUOTE}

Ok thats good for us *fg*

[Chubb]

{QUOTE->
@Chubb,

I'm wondering what Locale are you currently using? This is really strange. Can tell me? I have no idea why it is like that on your machine. <-QUOTE}

Hi vinzenz

The screenshot of settings for Regional Options is attached. See if you can reproduce the same.

Thanks

[vinzenz.ewido]

{QUOTE-> When I try to generate PDF files by printing web pages using Edocprinterpro (a PDF application) from Firefox, Firefox closes and actually crashes.

This never happened before I installed Ewido 4.0 beta, so I assume that there is some conflict between these applications. (Other security software I have installed, if it makes a difference - Process Guard, full version; Netveda firewall; KAV 2006, with proactive defense enabled). <-QUOTE}


This is really strange. Which version of Edocprinterpro and which version of Firefox are you using?
I can't reproduce it. :(

BR

[vinzenz.ewido]

{QUOTE-> Hi vinzenz

The screenshot of settings for Regional Options is attached. See if you can reproduce the same.

Thanks <-QUOTE}


No I'm sorry after installing the needed things and a reboot I've tested it. I can't reproduce it sorry :(

You're using an english version of Windows XP, aren't you? Home or Prof.? Do you have installed SPs installed? If so which one?

BR

[vinzenz.ewido]

{QUOTE-> Cofirmed the progress bar issue.

I did a scan of my partition with all the programs installed. It has around 61,000 files. During the scan, when it has scanned for only about 500 files, the progress bar showed a completion of about 25%, which should not be the case. 500 files was only about 0.8% of a total of 61,000 files, as opposed to the 25% competion shown.

Moreover, the scan engine stuck at the *.chm files in the Microsoft Office folder. I am using Office XP and my machine hanged severly when the scan window showed that Ewido was scanning the chm files in E:\Program Files\Microsoft Office\Office10\1028. The hang was so severe that I was unable to capture a screenshot to show the progress bar bug. It took me almost more than 5 minutes before I can bring up the Task Manager to kill the Ewido process. <-QUOTE}

You seem to be the master in bug detection :lurking:
I'm a bit disapointed that I'm not abled to reproduce your bugs, in this case I don't have Office XP :p But we'll have a look if we can check this. Maybe can you provide us the exactly version of your Office XP and probably what you have installed ( everything? )

BR

[vinzenz.ewido]

{QUOTE-> The autostart up listing.

In the Registry, HKML, I were able to find an entry for Ewido, which is:

!ewido
"E:\Program Files\ewido anti-malware 4.0\ewido.exe" /minimized

However, I were unable to find Ewido.exe in the Autostart tab, and I found a blank entry in the listing.

Looking at the System Configuration Utility, I also found a blank entry but also an Ewido.exe entry. Strange!!! <-QUOTE}

That's not a bug, that is just that users aren't confused why it comes back again and again :p
You can disable autostart in the tray menu, then the entry will be removed.
;)

[vinzenz.ewido]

{QUOTE-> Hi vinzenz

The screenshot of settings for Regional Options is attached. See if you can reproduce the same.

Thanks <-QUOTE}

Once again related to the regions stuff. I have a float numbers not integers (don't worry about the german text :p)

So are you sure that you don't have modified anything on your system?

[Chubb]

{QUOTE-> No I'm sorry after installing the needed things and a reboot I've tested it. I can't reproduce it sorry :(

You're using an english version of Windows XP, aren't you? Home or Prof.? Do you have installed SPs installed? If so which one? <-QUOTE}

{QUOTE-> Once again related to the regions stuff. I have a float numbers not integers (don't worry about the german text :p)

So are you sure that you don't have modified anything on your system? <-QUOTE}

Yes, I am using the English version of Windows XP updated to SP2 and the most recent hotfixes and security fixes and I have not installed any MUI pack of other languages. However, in addition to having the Chinese (HKSAR) locale as shown in the screenshots, I have also installed the HKSCS character set found in http://www.microsoft.com/hk/hkscs/default.aspx

The link to the file is http://202.181.238.4:5588/hkscs/hkscs2001.zip

HKSCS stands for HK Special Characters Set and is used for typing some special Chinese slang characters that cannot be shown correctly by standard Chinese character sets. I am not sure if this cause the problem, but I am not aware of similar problems in other English software installed on my Windows XP.

[Chubb]

{QUOTE-> That's not a bug, that is just that users aren't confused why it comes back again and again :p
You can disable autostart in the tray menu, then the entry will be removed.
;) <-QUOTE}

Hm...so you do mean that the empty entry in the Autostart tab is the Ewido.exe entry that was intentionally omitted to avoid the confusion of coming back and again?

[Chubb]

{QUOTE-> You seem to be the master in bug detection :lurking:
I'm a bit disapointed that I'm not abled to reproduce your bugs, in this case I don't have Office XP :p But we'll have a look if we can check this. Maybe can you provide us the exactly version of your Office XP and probably what you have installed ( everything? ) <-QUOTE}

I am using English Office XP, installed everything using customized install, updated to SP3 and all available fixes. I don't have Office 2003 and I am not sure if Ewido will also get freezes when scanning the chm files of Office 2003. The chm files ranges from 10K to 3M the largest, but I remember that when I do a full scan with KAV 5.X and the new 6.0.0.299, KAV also used quite a long time while scanning at the chm files, but it never get hung.

Hm...I am not the master in bug detection, just a computer enthusiast :P Just to share issues and comments.

[scoopnoggin]

This may not be of interest.... Cyberhawk of Novatix which is also still in beta appears to conflict 4.0. I don't believe it it has any issues with version 3.5. If both programs run together at start-up the GUI for Cyberhawk will not load. If ewido is disabled at start up and executed manually the tray icon doesn't appear, but otherwise seems to work fine.

[LM1]

{QUOTE-> This is really strange. Which version of Edocprinterpro and which version of Firefox are you using?
I can't reproduce it. :(

BR <-QUOTE}

I'm using Edocprinter 6.18, build 4060, and FF 1.5.0.2, under Win XP Pro.

[pwillener]

I have ewido 4 beta scheduled to run a nightly scan at 05:00.

When I open ewido, the Status page shows "Last scan at 2006/04/25". What does it mean:

the scheduled scan did not run last night?
only manual scans are show here?

Here is my Scheduler window

http://img244.imageshack.us/img244/2614/ewidosch8qf.gif

[vinzenz.ewido]

{QUOTE-> I'm using Edocprinter 6.18, build 4060, and FF 1.5.0.2, under Win XP Pro. <-QUOTE}


Hmm my firefox started crashing too for now. But after shuting down guard completly (shutting down its service) and ewido.exe (of 4.0) it made no different it was still crashing

after removing edocprinter and rebooting the problem was gone. I really think that problem is rather on edocs site than on our but I'll keep an eye on it.

BR

[vinzenz.ewido]

{QUOTE-> I have ewido 4 beta scheduled to run a nightly scan at 05:00.

When I open ewido, the Status page shows "Last scan at 2006/04/25". What does it mean:

the scheduled scan did not run last night?
only manual scans are show here?

Here is my Scheduler window

<-QUOTE}


Manual scan are not shown there. The statistics are for the scheduled scans only. The scheduler ist still a bit buggy, we're working on the problem.

BR

[pwillener]

I'm a bit concerned about the upgrade/install for 3.5 users - I mentioned it in the other 'Install question(s)' topic. I don't think this is the intended functionality - certainly not when the final version is released.

I installed the 4.0 beta without uninstalling 3.5 first (there were no instructions to do either)
When the installation was complete, 3.5 was still running
After a reboot, both 3.5 and 4.0 guards were launched
Trying to uninstall 3.5 I found that the 3.5 Add/Remove Program entry has disappeared (replaced with 4.0?)
I am unable to find a manual uninstaller for 3.5

I am aware that the two can co-exist; I just don't think this is the final solution. I think the final release should either do an upgrade of 3.5; or uninstall it, while keeping all the settings.

[peter.ewido]

There should definitely be an "uninstall.exe" inside the ewido 3.5 directory. If not, you could install 3.5 again and then uninstall it. 3.5 and 4.0 can co-exist without any problems (the overwritten uninstall entry in the CP is a bug in the current setup and will be fixed soon)

[chaos]

Another issue with the installer is this one.
When I downloaded ewido 4 beta I launched the installer immediately in order to install it.I believed that I would receive a message that ewido 3.5 was installed and 3.5 would be automatically removed by the installer of 4.0 beta.Since this didn't happen I understood that 4.0 would run with 3.5 so I decided to remove 3.5 manually and then continue with the installation
of 4.0.

So I left the installer of 4.0 running and I launched 3.5 uninstaller through control panel's Add/Remove programs .I received an error message in German(!) which is weird because I have configured ewido 3.5 in the english language and the uninstallation of 3.5 was aborted.
After trying running directly the uninstall.exe from 3.5 folder I still got the same message so I figured out that there was some kind of a conflict with ewido's 4.0 open installer.I terminated ewido 's 4.0 beta installer and 3.5 uninstalled succesfully.
So there is an issue when 4.0's installer is open and you try to uninstall 3.5.
I didnt think of capturing that error message in German yesterday nor I can remember what it was saying since I dont speak German.If you think this is a bug and you cannot reproduce it I would be happy to reinstall 3.5 and capture the error message.
Of course the whole issue could be just an installer issue not allowing two concurrent instances running but I cannot be sure since I cannot read the error message.

[Chubb]

I am having the same display problem with Windows 2000. I have Windows 2000 dual boot with my Windows XP. Regional options was configured to Chinese HKSAR. The signature database was shown as "314,", the same as in Windows XP which I have previous reported. ??? ???

My English version of Windows 2000 was updated to SP4 and all hotfixes and security fixes, and HKSCS characters from Microsoft was installed (HKSCS - 2001 support for Windows 2000 and Windows XP) in http://www.microsoft.com/hk/hkscs/default.aspx

By the way, was Ewido 4.0 written in unicode?

[peter.ewido]

Yes, full unicode support :)

[the mul]

I have been noticing over the last few days with the automatic updates, that the resident shield is disabled after ewido has updated.
I have to enable the resident shield on the main GUI and all is well again until next automatic update and the same problem again.
I dont know if this has been noticed by other beta testers.
Hopefully this will be looked into and others might confirm this.

THE MUL

[vinzenz.ewido]

{QUOTE-> I am having the same display problem with Windows 2000. I have Windows 2000 dual boot with my Windows XP. Regional options was configured to Chinese HKSAR. The signature database was shown as "314,", the same as in Windows XP which I have previous reported. ??? ???

My English version of Windows 2000 was updated to SP4 and all hotfixes and security fixes, and HKSCS characters from Microsoft was installed (HKSCS - 2001 support for Windows 2000 and Windows XP) in http://www.microsoft.com/hk/hkscs/default.aspx

By the way, was Ewido 4.0 written in unicode? <-QUOTE}

OK I can't reproduce the problem, but I can imagine why it can occour and I'm fixing it at the moment. I'm sorry for the inconvenience I made. :-[

BR

[Chubb]

{QUOTE-> OK I can't reproduce the problem, but I can imagine why it can occour and I'm fixing it at the moment. I'm sorry for the inconvenience I made. :-[

BR <-QUOTE}

Hi Vinzenez,

You know what is the cause of the problem? I just by chance saw the update ran by itself (automatically) and a balloon was popup in the system tray area. I was surprised to see that the number of signatures shown in the balloon was also "314,"!!! :o The screenshot was attached.

Anyway, thanks for fixing it..:)

[vinzenz.ewido]

{QUOTE-> Hi Vinzenez,

You know what is the cause of the problem? I just by chance saw the update ran by itself (automatically) and a balloon was popup in the system tray area. I was surprised to see that the number of signatures shown in the balloon was also "314,"!!! :o The screenshot was attached.

Anyway, thanks for fixing it..:) <-QUOTE}

Yeah, I know that it is there too. Thanks for the screenshot, but I would believe it without the screenshot too ;)

We just uploaded the latest build to the update server, can you please update ewido anti-malware 4 beta and check if the problem still exists?

Thanks. :)

[gerardwil]

{QUOTE-> Yeah, I know that it is there too. Thanks for the screenshot, but I would believe it without the screenshot too ;)

We just uploaded the latest build to the update server, can you please update ewido anti-malware 4 beta and check if the problem still exists?

Thanks. :) <-QUOTE}

Now there are 00 behind the comma?

[Eldar]

{QUOTE-> Now there are 00 behind the comma? <-QUOTE}Same here with build 150. :-\ ;)
Also although I installed on top the English version, it still showed a German window telling me
another copy was detected and would be updated. ;D

[Chubb]

{QUOTE-> Yeah, I know that it is there too. Thanks for the screenshot, but I would believe it without the screenshot too ;)

We just uploaded the latest build to the update server, can you please update ewido anti-malware 4 beta and check if the problem still exists?

Thanks. :) <-QUOTE}

Hi Vinzenz,

Thanks for fixing the issue. Just updated to 4.0.0.150 and the counter is now correct, "314,641" as shown.
"Files in quarantine" showed "0" and "Detected malware so far" showed "2".

But gerardwil's screen showed 0,00 now. So what is the problem?

[gerardwil]

Thanks 00 solved :)

Gerard

[chaos]

Ewido crashed after a I cancelled a fast scan and I pressed the button "new scan".
The crash generated an ewido.err file .
The file can be downloaded here
http://users.ntua.gr/el00133/ewido.err

It seems that I can reproduce the bug in a fairly simple manner.
I Start a fast system scan and I let it run till half way as shown in the first picture.
Then I press "cancel".Then when I press new scan I get the error message shown in picture 2.
I have tried stopping it earlier but it doesnt crash.It seems as if there is a point that after it passes when you stop the scan it crashes.

[chaos]

the error message is the following.(It doesnt let me upload two files in one post)

[chaos]

Also if you notice the previous capture there is the problem with the commas.
It says
"Skipped Objects: 0,00"
"Infected objects : 0,00"

[chaos]

well while trying to reproduce the previous bug I discovered one more.
Its really difficult to describe ...
While making a system scan either Full or fast or any other type of scan, it doesnt really matter,
there is a counter named "Scanned Objects" counting the number of objects being scanned.
Usually the format is something like:
Scanned Objects: 12.345
While the scan was progressing I noticed that while almost all the numbers are of
the above format some numbers (very few) had the following format
Scanned Objects: 12.345,00
There is no way to capture this in a photo because the counter increases very fast so
I took a video of it.Which is available here.
(Just the area that this counter is located)
http://users.ntua.gr/el00133/ewidozero_bug.avi

If you watch carefully the video you will notice that while all numbers are of the correct format
some numbers(very few .I think in the video they are only 4),during a blink of an eye(so dont even blink while watching the video),appear to
have the format XXX.YYY,00 where X & Y are digits.

Sorry for not capturing the whole program screen but my connection is slow (Pstn)and the video was about 30Mbytes.

Another way to see the problem is to just launch a scan and watch carefully the counter.There you will certainly see during 0.5 of a second that some numbers have a different format that changes for very little time from XXX.YYY to XXX.YYY,00.
I hope that you will be able to see these numbers!!

[Chubb]

{QUOTE-> well while trying to reproduce the previous bug I discovered one more.
Its really difficult to describe ...
While making a system scan either Full or fast or any other type of scan, it doesnt really matter,
there is a counter named "Scanned Objects" counting the number of objects being scanned.
Usually the format is something like:
Scanned Objects: 12.345
While the scan was progressing I noticed that while almost all the numbers are of
the above format some numbers (very few) had the following format
Scanned Objects: 12.345,00
There is no way to capture this in a photo because the counter increases very fast so
I took a video of it.Which is available here.
(Just the area that this counter is located)
http://users.ntua.gr/el00133/ewidozero_bug.avi

<-QUOTE}

Hi chaos,

I was able to capture the ,00 screenshots from your video using slow motion in PowerDVD ;D

[chaos]

:D :D
you are creative hehe...;)
nice now they have the proof I couldnt think how to provide them except from the video...;D

[Joliet Jake]

Just a small thing, spelling. I assume the last word should be threats rather than threads.

[Joliet Jake]

Grammar issue...should be 'these' and not 'this'...

[Joliet Jake]

Grammar issue... should be 'is' not 'was'...

[Joliet Jake]

Grammar issue... should be 'an' not 'a'...

[Joliet Jake]

Grammar and a missing word...Disallow scripts to 'be' executed.
Delete the word 'to' as it's not needed in this sentence.

[Joliet Jake]

All in all a great bit of work from ewido.
I really like the new look and all the additional tools and options.

Well done people.:D

[gerardwil]

I think it should be:

If the resident shield is not active this is a security risk. It will not block and clean threats trying to run on your system.

Gerard

[Notok]

Geez, I'm not getting any of these probs (except for the grammar errors, of course).. it's working perfectly smoothly on my machine, which is an absolute miracle :X

[Joliet Jake]

I think this should be...You should keep automatic updates active to always be up to date and protected against the latest threats.

[Joliet Jake]

{QUOTE-> Geez, I'm not getting any of these probs (except for the grammar errors, of course).. it's working perfectly smoothly on my machine, which is an absolute miracle :X <-QUOTE}

Me neither, so far so good.:)

[gerardwil]

{QUOTE-> Geez, I'm not getting any of these probs (except for the grammar errors, of course).. it's working perfectly smoothly on my machine, which is an absolute miracle :X <-QUOTE}

Apart from the cpu issue (will be fixed) it's running ok here to!
After a complete sys scan it found one (low risk) issue: NetworkActivePIAFCTM, but this app. was installed on my machine by myself :)

Gerard

[Brandon]

Here is an omitted word:
http://img260.imageshack.us/img260/5363/ewidopic30qp.jpg

[Brandon]

This doesn't sound right to me..
http://img284.imageshack.us/img284/1669/ewidopic43cw.jpg

I think you should take out the word "be" and put it after the word "always"..

[Chubb]

{QUOTE-> I think this should be...You should keep automatic updates active to always be up to date and protected against the latest threats. <-QUOTE}

My suggestion:

You should always keep automatic update active in order to get the most updated protection against the latest threats. :)

[Chubb]

{QUOTE-> I think it should be:

If the resident shield is not active this is a security risk. It will not block and clean threats trying to run on your system.

Gerard <-QUOTE}

My suggestion:

If the resident shield is not active, it will not be able to block and clean threats trying to run on your system. This is a security risk.

"This is a security risk", IMHO, is not necessary and optional. The title "Your computer is at risk" is already the result of not having the resident shield active. :P

[pwillener]

{QUOTE-> There should definitely be an "uninstall.exe" inside the ewido 3.5 directory. If not, you could install 3.5 again and then uninstall it. 3.5 and 4.0 can co-exist without any problems (the overwritten uninstall entry in the CP is a bug in the current setup and will be fixed soon) <-QUOTE}
I checked the backup I took before installing the 4.0 beta; nothing like uninstall* in there.

Anyway, it's not a big deal - I just wanted to let you know that with the current version there is no upgrade occurring. This should be addressed before the final release of version 4.

Thanks for a great product! :thumb:

[pwillener]

May I suggest that we create a new topic for spelling/grammar issues (since there seem to be so many [small ones, I admit]) ?

[chaos]

Well this is a good idea since those grammar mistakes are many (most of them are minor) and they are not really bugs.I suggest the next tester that will find a mistake should create a new topic with the appropriate title.

[vinzenz.ewido]

The wording bugs are listed here, are fixed in 4.0.0.151

Also the number displaying but ",00" _should_ be fixed. :-\
BR

[chaos]

{QUOTE-> The wording bugs are listed here, are fixed in 4.0.0.151

Also the number displaying but ",00" _should_ be fixed. :-\
BR <-QUOTE}
I just downloaded the 1.51 and ALL ,00 bugs that I described are gone.
Congratulations!;)
But this build still crashes when I cancel a fast system scan midway as described in one of my previous posts.

[vinzenz.ewido]

{QUOTE-> I just downloaded the 1.51 and ALL ,00 bugs that I described are gone.
Congratulations!;)
But this build still crashes when I cancel a fast system scan midway as described in one of my previous posts. <-QUOTE}

I tried to reproduce it but i can't :(

BR

[chaos]

Well Vinzenz there are more bugs ...
Firstly today I tested the Complete Scan and the program still crashes when cancelling the scan midway.
But lets forget this problem for a moment since there are also other bugs.
If I start any scan and then cancel the scan before it is completed the following things happen.
The progress bar reaches at once at the end and it reports that the scan has being completed.
Take a look at the three following screen captures.
You can clearly see in the first picture that we are in the middle of the scan.
But in the second picture right after cancelling the scan the progress bar is full and it says that the scan
is completed though you can see that the number of files scanned and the time elapsed are exactly the same.
In the third picture you can see that the main screen reports that the last scan was performed today (27/4/2006).
But today I didnt let on purpose none of the scans I started to complete!
So we have these problems ...
If someone starts a scan and then cancels it the program reports that scan is completed while its not.
Also the date of the last scan is set to reflect when this not-completed scan happened.
My opinion is that when it says Last scan it should report the last not-cancelled scan because when someone
checks the date of the last scan he cannot be sure whether the whole system was scanned or
not.A cancelled system scan does not ensure a malware free computer.So when a scan is cancelled instead
of reporting it as completed it should report it as stopped (or cancelled).

[chaos]

2nd picture

[chaos]

3rd picture

[chaos]

I have two more computers in my home with windows XP.
I will try to reproduce the crashing problem on them and I will tell you what heppened...

P.S
Can anyone else confirm the problem that occurs when cancelling a fast sytem scan or a complete scan midway?
I have described the problem in detail in the previous page.

[Chubb]

{QUOTE-> Well Vinzenz there are more bugs ...
Firstly today I tested the Complete Scan and the program still crashes when cancelling the scan midway.
But lets forget this problem for a moment since there are also other bugs.
If I start any scan and then cancel the scan before it is completed the following things happen.
The progress bar reaches at once at the end and it reports that the scan has being completed.
Take a look at the three following screen captures.
You can clearly see in the first picture that we are in the middle of the scan.
But in the second picture right after cancelling the scan the progress bar is full and it says that the scan
is completed though you can see that the number of files scanned and the time elapsed are exactly the same.
In the third picture you can see that the main screen reports that the last scan was performed today (27/4/2006).
But today I didnt let on purpose none of the scans I started to complete!
So we have these problems ...
If someone starts a scan and then cancels it the program reports that scan is completed while its not.
Also the date of the last scan is set to reflect when this not-completed scan happened.
My opinion is that when it says Last scan it should report the last not-cancelled scan because when someone
checks the date of the last scan he cannot be sure whether the whole system was scanned or
not.A cancelled system scan does not ensure a malware free computer.So when a scan is cancelled instead
of reporting it as completed it should report it as stopped (or cancelled). <-QUOTE}

Agreed

[vinzenz.ewido]

{QUOTE-> I have two more computers in my home with windows XP.
I will try to reproduce the crashing problem on them and I will tell you what heppened...

P.S
Can anyone else confirm the problem that occurs when cancelling a fast sytem scan or a complete scan midway?
I have described the problem in detail in the previous page. <-QUOTE}

It is reproducable that the last scan date will be updated although it was aborted.

The crash is still not reproducable :(

[chaos]

In the ewido exit message substitute "is not" with "will not be".

[chaos]

now as long as this crashing bug is concerned i think it should be wiser to just leave it for now and to try to solve it later if it insists since it happens only to my pc.
But if you think that there is any file which i can provide to you in order to help you trace the root of the problem I would be happy to give it to you.
In fact below I am attaching the txt file generated by windows drwtsn32.exe.
Also I noticed that after the crash only ewido.exe is terminated while guard.exe still runs in the background properly.

P.S
I suspect it may a windows XP sp2 bug and a problem from your side but I am not sure.

[chaos]

Also there is a slight gui design issue.
In the below image you can see that the only way to go back to the scan menu is to press cancel.I think you should add something like "go back" button or whatever you think fits better.Pressing cancel to go back to scan menu is really ugly.;)

[gerardwil]

{QUOTE-> Also there is a slight gui design issue.
In the below image you can see that the only way to go back to the scan menu is to press cancel.I think you should add something like "go back" button or whatever you think fits better.Pressing cancel to go back to scan menu is really ugly.;) <-QUOTE}

? not here

Gerard

[chaos]

{QUOTE-> ? not here

Gerard <-QUOTE}
Didnt quite understood what you mean?

[vinzenz.ewido]

{QUOTE-> ? not here

Gerard <-QUOTE}
<german>Er meint das Cancel kein guter Name ist um zurück ins Menü zugelangen. Man erwartet eher "Back to menu" oder so ;)</german>

BR

[gre87y]

The beta also crashed on my pc after attempting to cancel the full system scan.Other then that, things are working very well.

[Joliet Jake]

Tried canceling a scan midway and although I got the same result as chaos it didn't crash my PC.

[chaos]

Do you mean that you didnt receive the error message ?Did you receive the error message or not?
Because my pc didnt crash.The program only.It terminated abnormally.

[pwillener]

I uninstalled the beta temporarily (for reasons unrelated here), then installed the newest build and ran update, then a custom scan (memory, registry, C: drive), mainly to watch the progress bar. This issue seems to be fixed; the progress bar seems to really indicate progress now.

While watching, ewido suddenly went away - no message, nothing. Even the guard disappeared. And no, I did not click Cancel, nor anything else - just watching. Event log shows nothing.

Is there any way to debug such a crash?

[Joliet Jake]

{QUOTE-> Do you mean that you didnt receive the error message ?Did you receive the error message or not?
Because my pc didnt crash.The program only.It terminated abnormally. <-QUOTE}


It said 'scan completed' after I cancelled the scan 15 seconds in and on the status screen it updates the 'last scan' to the date of the one I cancelled.

There is no error message or anything in the event viewer.
I don't feel it's a bug as such but it is something that can perhaps be addressed by the programmers.
As someone else pointed out, it may be better if the date of the last scan was the last full scan.

[chaos]

{QUOTE-> It said 'scan completed' after I cancelled the scan 15 seconds in and on the status screen it updates the 'last scan' to the date of the one I cancelled.

There is no error message or anything in the event viewer.
I don't feel it's a bug as such but it is something that can perhaps be addressed by the programmers.
As someone else pointed out, it may be better if the date of the last scan was the last full scan. <-QUOTE}
Oh now i get what happened.
My program crashed after the cancelling of the scan whether yours didnt.
I was the one that suggested that the Last scan date should reflect the Last FULL scan.
http://www.wilderssecurity.com/showpost.php?p=736576&postcount=93

[scoopnoggin]

{QUOTE-> I have two more computers in my home with windows XP.
I will try to reproduce the crashing problem on them and I will tell you what heppened...

P.S
Can anyone else confirm the problem that occurs when cancelling a fast sytem scan or a complete scan midway?
I have described the problem in detail in the previous page. <-QUOTE}

The crash as you describe it occurs on my system as well. ewido throws up an error message and closes down. It has happened with the three builds. I believe it occurs when it reaches the file scanning portion of the scan, and not the memory or registry portions if that helps to recreate the bug.

[chaos]

I hope the guys from ewido address the problem...
You are right about when it crashes I have noticed it too.Maybe someone from ewido will request you to email him ewido.dmp file.

[vinzenz.ewido]

@Chaos
of course we do :lurking:


@scoopnoggin
PN sent to you ;)

BR

[chaos]

@vinzenz
I hope you overcome any problems and solve it fast.

I have a suggestion.
It would be nice if you created something like a report for every beta
build you release.For example something like:
Known Bugs
a]...
b]...
c]...
Fixed bugs from previous versions
a]...
b]...
c]...
I think it would help you to better address the remaining bugs and enable you to have more input about them.

P.S
I think that you should also add in the main page of 4.0 beta ,as it is in ewido 3.5, the version of the signatures database.

[vinzenz.ewido]

{QUOTE-> @vinzenz
I hope you overcome any problems and solve it fast.

I have a suggestion.
It would be nice if you created something like a report for every beta
build you release.For example something like:
Known Bugs
a]...
b]...
c]...
Fixed bugs from previous versions
a]...
b]...
c]...
I think it would help you to better address the remaining bugs and enable you to have more input about them.

P.S
I think that you should also add in the main page of 4.0 beta ,as it is in ewido 3.5, the version of the signatures database. <-QUOTE}

The best way to see what is done and what needs to be done is the grisoft beta bugzilla already mentioned here http://www.wilderssecurity.com/showthread.php?t=129504

_WE_ (the developer team) prefer this since it is easier since everything can be seen at once. And we don't have to track all forums all the time.
The beta bugzilla is imho much better than the changelog since you can query everything already posted.

The version of the database is imho not necessary since you can see the number of threats, and if you want to be sure that you have the latest signatures you can compare the number with the number on the website (in the upper right corner)

BR

[chaos]

{QUOTE-> The best way to see what is done and what needs to be done is the grisoft beta bugzilla already mentioned here http://www.wilderssecurity.com/showthread.php?t=129504

_WE_ (the developer team) prefer this since it is easier since everything can be seen at once. And we don't have to track all forums all the time.
The beta bugzilla is imho much better than the changelog since you can query everything already posted.

The version of the database is imho not necessary since you can see the number of threats, and if you want to be sure that you have the latest signatures you can compare the number with the number on the website (in the upper right corner)

BR <-QUOTE}
I didnt know about bugzilla.I will check it .
As for the version you are probably right.

[chaos]

Well I logged in and saw how it works and i think its a very efficient and convenient system.
Its really very nice and certainly much better than a simple log file.

[vinzenz.ewido]

{QUOTE-> Well I logged in and saw how it works and i think its a very efficient and convenient system.
Its really very nice and certainly much better than a simple log file. <-QUOTE}

Also you will be notified if you post a bug and there were changes with this bug. e.g. further questions, notification if it is fixed etc.

BR

[vinzenz.ewido]

@ Chaos & Chubb

Good news (I think) I have found both reasons for the crashes.
I was searching since yesterday for these damn bugs. And I think I got them.
It will be fixed in 4.0.0.152 but don't ask me when it will be uploaded. I can't tell you :-\

BR

[Chubb]

{QUOTE-> @ Chaos & Chubb

Good news (I think) I have found both reasons for the crashes.
I was searching since yesterday for these damn bugs. And I think I got them.
It will be fixed in 4.0.0.152 but don't ask me when it will be uploaded. I can't tell you :-\

BR <-QUOTE}

Thanks Vinzenz for the hard work :)
I started using the BugZilla for my suggestion and bugs found. The Bugzilla is quite useful because I can see the status, whether it is pending or resolved, but I could not attach any screenshots there, which is not convenient.

[chaos]

{QUOTE-> @ Chaos & Chubb

Good news (I think) I have found both reasons for the crashes.
I was searching since yesterday for these damn bugs. And I think I got them.
It will be fixed in 4.0.0.152 but don't ask me when it will be uploaded. I can't tell you :-\

BR <-QUOTE}
good job Vinzenz!:thumb:
When you upload the 152 I will test it and report back to you.

P.S
Dont forget to fix the Last scan date issue...

[Joliet Jake]

Ran a scheduled scan tonight and when I maximised the GUI from the icon it filled the whole screen and I couldn't see or access the buttons at the bottom of the screen or the minimise, maximise or close buttons at the top either.
I had to exit the program by right clicking on the icon.

[Chris12923]

Can anyone tell me how to add a new profile after you create one? or delete an old profile for that matter? I don't see any buttons to do it once I created one. maybe I am looking in the wrong section. I'm looking in the scheduler tab. It's either a bug or I'm lost.

Thanks,

Chris

[siliconman01]

{QUOTE-> Can anyone tell me how to add a new profile after you create one? or delete an old profile for that matter? I don't see any buttons to do it once I created one. maybe I am looking in the wrong section. I'm looking in the scheduler tab. It's either a bug or I'm lost.

Thanks,

Chris <-QUOTE}

Go to SCAN and then click on Custom Scan. That should permit you to modify, etc., your existing profile(s).

[Chris12923]

{QUOTE-> Go to SCAN and then click on Custom Scan. That should permit you to modify, etc., your existing profile(s). <-QUOTE}
Thank you very much. Guess I was just lost.

Thanks,

Chris

[sticky38]

The area for the "language" selection has been grayed from the beginning: I downloaded and installed over the actual one the last version without any result. No way of obtaining the "regional and language options" page.
Could it depend from the windows xp version I am using?
I have installed an Italian Windows XP SP2 version including all the till now updates.

[raven211]

There are too many letters written when I decide if the hole archive should be quarantined in order to get rid of a "infection".

See the attached image below..

[Tellurian]

{QUOTE-> I have a sample file "Trojan.exe" downloaded somewhere from the internet and I renamed it to "Trojan.exe".

Both Ewido version 3.5 and this 4.0 beta reported that the file was infected with the trojan "Trojan.Agent.sk". But scanning the file with KAV 6.0.0.299, NOD32 2.51.26 and Sophos AntiVirus 5.2.0 all with the latest signatures gave no infected findings. I am not sure if it is a false positive or a true positive.

Left-click on the orange "Recommended action" only gives, "Ignore Once", "Quarantine", "Delete", "Add to Ignore List" and "Recommended actions". After clicking on "Apply" to 'Quarantine" the file, I was bought to the infections tab where I was allowed to "Restore" or "Remove finally".
<-QUOTE}

I have experienced something similar with Ewido 4.0 beta.
The file that was reported as having "Trojan.Agent.sk" is a program that I have used for some time. I believe this to be a false positive and even had it scanned by VirusTotal online. When I tried to have Ewido ignore the item it quarantined it instead. I had to restore the file from the quarantine only to have it flagged and removed again when it was opened next.
Below are the results from the online scan at VirusTotal

[vinzenz.ewido]

{QUOTE-> The area for the "language" selection has been grayed from the beginning: I downloaded and installed over the actual one the last version without any result. No way of obtaining the "regional and language options" page.
Could it depend from the windows xp version I am using?
I have installed an Italian Windows XP SP2 version including all the till now updates. <-QUOTE}

This section is currently disabled since we have no translations at the moment. If there are translations this section will be enabled. But this is not related to your Windows version ;)

BR

[vinzenz.ewido]

{QUOTE-> There are too many letters written when I decide if the hole archive should be quarantined in order to get rid of a "infection".

See the attached image below.. <-QUOTE}

Will be fixed in 4.0.0.153. Thanks for reporting.
BR

[arithona]

{QUOTE-> A bug? Again not on my machine. <-QUOTE}
me,too

[dja2k]

Noticed that if you set ewido as on-demand only turning off guard\auto updates\auto run, when you run ewido, it still wants to turns on guard.exe yet it is not active in the GUI. After you shut down ewido GUI, the guard.exe stays on wasting memory even when not in use. To fix this from turning on, you have to go manually set it to disable in the windows services.

dja2k

[honeybunny]

Where's the language section in beta 4.0 ? I cannot find what you are talking about.

There must be an option to change the language, but, where can i find this option ? ???

[chaos]

One more bug for ewido 4.0
When I start the manual update process the program first downloads the new definitions and when it has finished downloading them then it downloads any program updates, if there are any (ewido.exe and guard.exe).
However if you cancel the update process while downloading the program updates then the counter in the main window that shows the number of the
"Signatures in database" is not updated to reflect the new
number of signatures although the new signatures have been downloaded and installed.
Only if you exit the program(not just close the gui) and relaunch it the number of "Signatures in database" is updated to reflect the correct number of singatures now installed .

P.S
@Vinzenz
Also the issue with the wrongly updated date after a cancelled scan remains.
You havent forgotten it?Have you?;D

[chaos]

{QUOTE-> Where's the language section in beta 4.0 ? I cannot find what you are talking about.

There must be an option to change the language, but, where can i find this option ? ??? <-QUOTE}
already answered above.
No language options yet ...

[vinzenz.ewido]

{QUOTE-> One more bug for ewido 4.0
When I start the manual update process the program first downloads the new definitions and when it has finished downloading them then it downloads any program updates, if there are any (ewido.exe and guard.exe).
However if you cancel the update process while downloading the program updates then the counter in the main window that shows the number of the
"Signatures in database" is not updated to reflect the new
number of signatures although the new signatures have been downloaded and installed.
Only if you exit the program(not just close the gui) and relaunch it the number of "Signatures in database" is updated to reflect the correct number of singatures now installed .

P.S
@Vinzenz
Also the issue with the wrongly updated date after a cancelled scan remains.
You havent forgotten it?Have you?;D <-QUOTE}

The Bug is not a bug, first it downloads all the files, then installs it. If you cancel the update they have not been installed completly (you have canceled before reloading the signatures)

No I don't have forgotten this. If you would check the beta bugzilla then you should mentioned that the state is switched to fixed.
;)

[vinzenz.ewido]

{QUOTE-> Where's the language section in beta 4.0 ? I cannot find what you are talking about.

There must be an option to change the language, but, where can i find this option ? ??? <-QUOTE}

The section can be found in the tray menu. But since there are no translations available at the moment nothing else can be choosen.

BR

[honeybunny]

{QUOTE-> The section can be found in the tray menu. But since there are no translations available at the moment nothing else can be choosen.

BR <-QUOTE}

Thanks a lot but i think, I must be blind because I cannot find it anymore.

May I have a screenshot please from anyone which shows it to me. :-*

Forget it, I've found it !!!

[chaos]

{QUOTE-> The Bug is not a bug, first it downloads all the files, then installs it. If you cancel the update they have not been installed completly (you have canceled before reloading the signatures)

No I don't have forgotten this. If you would check the beta bugzilla then you should mentioned that the state is switched to fixed.
;) <-QUOTE}
ok i agree but why when you shut it down it and then restart it ,it shows the correct number of signatures.
Is it because when it starts it is opening the database and finds the newly downloaded files and installs them or something else happens?

A question...why there are many signature files and the additional files do not merge with the original?

P.S
About the bugzilla...I thought it was too minor issue to be reported through bugzilla so i didnt login...

[Brandon]

Heres a grammer error:
http://img67.imageshack.us/img67/9775/ewidopic78yz.jpg
It should be "connecting".

[chaos]

Brandon is right.This should also be "receiving data"

P.S
Vinzenz please have a look at this thread
http://www.wilderssecurity.com/showthread.php?t=130249

[Brandon]

This is a very weird problem I am having. It seems Ewido 4.0 disables the Resident Shield by iteself at a random time. I can tell because the icon goes greyish and Resident Shield is unchecked..

[scoopnoggin]

{QUOTE-> This is a very weird problem I am having. It seems Ewido 4.0 disables the Resident Shield by iteself at a random time. I can tell because the icon goes greyish and Resident Shield is unchecked.. <-QUOTE}


I've had this happen as well. I thought maybe I was accidently turning it off and spacing out. It hasn't happened often enough to notice if something I'm doing is causing it. You are right, it is weird.

[Brandon]

{QUOTE-> I've had this happen as well. I thought maybe I was accidently turning it off and spacing out. It hasn't happened often enough to notice if something I'm doing is causing it. You are right, it is weird. <-QUOTE}

Its been happening for me for the last couple days, but wasn't sure if I didn't myself by accident too. But now I am sure it is doing it by itself.

[chaos]

In continuation of this post
http://www.wilderssecurity.com/showpost.php?p=741564&postcount=134
Though the problem described above is not a bug there is one other bug involved in this procedure.
If I complete the above procedure, then exit the program and then reload the program then the program loads all the downloaded definitions and reports correctly the updated number of signatures.This happens because the latest signatures files though not initially installed they were downloaded to the ewido signature folder and when the program was relaunched they were loaded(I suppose thats the procedure and thats how I would have designed it as well).
But take a look at the screen capture below.
The number of signatures includes all the updates till today (7/5/2006) but still because I cancelled every single manual update before completion ,the date of Last update is not reported correctly alhtough I have all latest signatures isntalled.
I think that the signature files should contain information about their release date .

P.S
I understand that last update reports the last completed update but let's suppose that someone updates manually every 7 days ewido.So in the 7th day he starts the update but he downloads only 5 days' updates and then cancels update procedure.Let's also suppose that there are no program updates.Would the last update date reported by the program be correct?

[Roger_]

It happened to me as well: after getting some mysterious shield inactivations, I checked I had disabled Ewido 3.5 trial version but had not uninstalled it (and it does share a guard.exe service name).
So, I uninstalled Ewido 3.5 and 4.0 beta and clean re-installed 4.0 beta.

Now, the clean beta version keeps telling me it is a free version and so I am not allowed to enable the shield....

When will there be 4.0.0.152 version available so that this may be corrected in order to restart testing?

[pwillener]

Sorry, I don't remember if this has come up before; this topic has become too large to read through it all 8)

It's about the scheduler; there seem to be no scheduled scans executed, although I have it scheduled to run nightly at 05:00.

http://img90.imageshack.us/img90/2848/ewisch4vq.gif

On the main page I get a warning that I haven't run a scan since its original installation.

Is this a known problem?

[stapp]

Is it a 24hour clock and you have yours set to run at 5am and your computer is switched off then?

[Joliet Jake]

{QUOTE-> Sorry, I don't remember if this has come up before; this topic has become too large to read through it all 8)

It's about the scheduler; there seem to be no scheduled scans executed, although I have it scheduled to run nightly at 05:00.

http://img90.imageshack.us/img90/2848/ewisch4vq.gif

On the main page I get a warning that I haven't run a scan since its original installation.

Is this a known problem? <-QUOTE}

Tick the box 'if scheduled time was missed, catch up as soon as possible.'
This means if your PC is shut down when the scan is meant to take place, the scan will happen when you boot it up next time.

Hope this helps.

[pwillener]

{QUOTE-> Is it a 24hour clock and you have yours set to run at 5am and your computer is switched off then? <-QUOTE}
This computer runs 24*7, and has several maintenance apps scheduled from 00:00 to 06:00. Ewido is scheduled to run at 05:00, but it appears as if it is not running.

[stapp]

Have you tried rebooting, sometimes this cures the strangest problems.
Also, if you do a manual scan, does it show that you have done one? (not in the scheduled bit of course)

[pwillener]

I reboot about twice a week - mostly to cure Windows irregularities.

And yes, a manual scan does show on the status page.

Does this mean that other beta users do not experience this problem, and daily (or nightly) scheduled scans run successfully?

[Joliet Jake]

My schedule runs nicely however it doesn't warn you it's away to start and the only indication I get is a bit of hard disk noise.
Open the ewido GUI and click the scanner tab and you'll see if it's scanning. Although the status screen will show you the date of the last scan.

[gerardwil]

I just tried myself a scheduled scan: no problem

Gerard

[gerardwil]

and after the scheduled time:

[pwillener]

OK, this has been confirmed to be a known bug in this separate topic (http://www.wilderssecurity.com/showthread.php?t=131073). (The Catch Up option must be checked in order to run the scheduled scans).

[Brandon]

Ok when the ewido gaurd (guard.exe) is "active" and if you try to end it using task manager you can't, but if you make the "resident shield" (ewido guard) set to "inactive" via the ewido main interface you can use task manager and end ewido's guard (guard.exe) successfully..is this normal?

[Joliet Jake]

{QUOTE-> Ok when the ewido gaurd (guard.exe) is "active" and if you try to end it using task manager you can't, but if you make the "resident shield" (ewido guard) set to "inactive" via the ewido main interface you can use task manager and end ewido's guard (guard.exe) successfully..is this normal? <-QUOTE}


I have no problems using task amanger with the shield enabled.

[pwillener]

I have no problems with the Task Manager either.

[goodgameral]

I didn't look through all the pages of this, but has anyone else had problems where it doesn't SAY that it found anything?

To test out my theory (origianlly that it wouldnt get FF cookies):

1. Went to screensaver.com
2. Ran Ewido 3.5
3. Found some thing but didn't remove
4. Scaned Cookies.txt w. Ewido 4
5. Didn't say it found anything
6. Scanned again w. Ewido 3.5; didn't find anything.

Sadly, I needed some spyware for this so I went to screensaver.com, it actually seemed very safe! The worst thing I had was 5 tracking cookies... Then again, I didn't download anything...

[dja2k]

When I am running Ewido Beta 4 active, it makes oasrv.exe from Online Armor AV+ jump cpu usage from 0 to about 13 + every few seconds. I am guessing they don't like each other or somehow ewido is running through OA's oasrv.exe. As stated before, Ewido beta 4 has been pointed out to cause mid cpu usage every few seconds but while running along side OA AV+, it is oasrv.exe doing the cpu jumping. I have tried this a lot of times to see if it was ewido and yes it was. When ewido guard is off, then the GUI is closed, oasrv.exe goes back to normal cpu usage of 0.

dja2k

[Qark]

edit. Sorry wrong alert. I fixed that bug myself.

[Qark]

Is this bug? I founded it newest version of ewido:

hxxp://img232.imageshack.us/img232/4126/nimetn4pu.jpg

[chaos]

bug reappeared...
notice the commas

[vinzenz.ewido]

{QUOTE-> Is this bug? I founded it newest version of ewido:

hxxp://img232.imageshack.us/img232/4126/nimetn4pu.jpg <-QUOTE}

This is ewido 4.0.0.172?

BR

[vinzenz.ewido]

{QUOTE-> bug reappeared...
notice the commas <-QUOTE}

I'll check this.

BR

[chaos]

{QUOTE-> I'll check this.

BR <-QUOTE}
The same problem also appearing while scanning...

[vinzenz.ewido]

{QUOTE-> The same problem also appearing while scanning... <-QUOTE}

What locale are you using.

[chaos]

{QUOTE-> What locale are you using. <-QUOTE}
I use the greek local and my windows XP sp2 are the greek version.
Nevertheless the last public beta version was working fine in my system.