Internal Errors

[JeremyWW]

OK, first off - I'm not getting any!!! - Internal Errors that is! ;) except this one in the scan log:

24/08/2007 23:03:56 D:\APPS\INSTALL PACK\Microsoft\Powerpoint Hotfix\258563_intl_i386_zip.exe » ZIP » office2003-KB912022-GLB.exe - internal error

I'm running the AV Beta. Seems very nice...some people here are saying they won't run the Beta until this 'internal error' thing is fixed. Could someone enlighten me with the 'facts' please. I'm not inclined to worry about myself, unless someone has a genuine reason...

Thanks

[flyrfan111]

Ok, I had over 3200 of them using both ESS and NOD 3 Beta, I submitted a few files for them to take a look at, they replied that it is a problem scanning password protected archives and would be fixed some time next week through auto update. My problem is none of my archives are password protected except the common ones, Super Antispyware and Spybot's quarantine files and the like(and those show as password protected in the log for NOD 2.7 but not for the betas). The Beta engine also appears (to me at least) to not handle Office 2007 xml files correctly as it shows every xml on my system as a ZIP file and reports these internal error messages.

As I said though, the word is it will be fixed next week sometime. In theory, it should not be a big deal as archived malware should have to be uncompressed to execute at which point it should be caught, I chose to go back to 2.7 for now.

[Marcos]

-{ Quote: "OK, first off - I'm not getting any!!! - Internal Errors that is! ;) except this one in the scan log:

24/08/2007 23:03:56 D:\APPS\INSTALL PACK\Microsoft\Powerpoint Hotfix\258563_intl_i386_zip.exe » ZIP » office2003-KB912022-GLB.exe - internal error
" }-

Could you please confirm or deny that the zip file is password protected? If it is, then it's just a wrong error message and the program should tell you instead that the file could not be scanned.

[Marcos]

-{ Quote: "No, it's not password protected." }-

If the file exceeds 5 MB, please upload it somewhere and PM me the link. Otherwise send it to support[at]eset.com along with this thread's url in the subject.

[flyrfan111]

How many people are seeing these errors in your demand scan logs? Of those who are seeing it what OS are you running? I think it may be related to Vista's UAC.

[flyrfan111]

Just Installed the beta on an XP Pro system and I get no errors even when scanning over the network to files that received the error on the Vista machine, so it is related to Vista's UAC.

[flyrfan111]

The XP machine does report the error only on password protected files.

[flyrfan111]

As a further check, turning off UAC resolves the problem.

[Marcos]

Jeremy confirmed that the file was actually password protected. We'll fix this error and we'll investigate the issue with UAC as soon as possible. I assume both issues will be fixed via automatic update within next week.

[flyrfan111]

Awesome!!;D

[JeremyWW]

-{ Quote: "Jeremy confirmed that the file was actually password protected. We'll fix this error and we'll investigate the issue with UAC as soon as possible. I assume both issues will be fixed via automatic update within next week." }-

Appears to be fixed after the last update - at least for me. Log now states correctly that the file is password protected.

[flyrfan111]

Can't check at the moment because I am on a system that still has 2.7 on it. Will check it later.

[Marcos]

-{ Quote: "Appears to be fixed after the last update - at least for me. Log now states correctly that the file is password protected." }-

I can confirm, it was fixed yesterday. However, the error can still be reported on Vista with UAC enabled as we have not found a common pattern for this yet.

[flyrfan111]

I have faith that you guys will get to the bottom of it. Let me know if you need any other files although it sounds like you guys can reproduce it.

[flyrfan111]

Error message has changed from "internatl error" to "decompression could not complete"

[Marcos]

-{ Quote: "I have faith that you guys will get to the bottom of it. Let me know if you need any other files although it sounds like you guys can reproduce it." }-

This error used to occur with v2 if NOD32 did not have write permission for the temp folder or if the disk was full.

[flyrfan111]

I am not out of RAM and the hdd is less than 30% full, 2GB RAM and 200GB hdd.

[flyrfan111]

Let me try disabling UAC to see if that helps.

[flyrfan111]

Yes, the messages go away with UAC disabled.

[Marcos]

-{ Quote: "Yes, the messages go away with UAC disabled." }-

No probs with UAC here. However, it might have sometihing to do with the fact that UAC denies access to the temp folders for the current user. However, this should not be a problem as the Eset service is running in the LSA account. Just in case, make sure that both the user and system temp variables point to a folder that actually exist.

[flyrfan111]

Yes both folders exist, isn't this the same from 2.7 though? Why does the beta give me problems with this when 2.7 doesn't?