Some bugs in ESET Smart Security 5 RC

[pykko]

1. Create a folder with more than 8000 files. Try to perform a custom scan selecting a random file from that big folder (not contextual-menu scan).
Eset will crash.

2. Try to scan the same big folder that contains more than 6000 infected files and scanning process will stop at 3 or 5% while automatic update starts and stays at 0%.

[NoobStick]

Originally Posted by pykko

1. Create a folder with more than 8000 files. Try to perform a custom scan selecting a random file from that big folder (not contextual-menu scan).
Eset will crash.

2. Try to scan the same big folder that contains more than 6000 infected files and scanning process will stop at 3 or 5% while automatic update starts and stays at 0%.

Hello pykko
Sorry Pykko but I can see the purpose with your post, personally I do not know any normal user who has or created a single folder with 8000 files or a single folder with 6000 pieces of malicious malware samples. If I have missed anything please enlighten me.

All the Best

NoobStick

[pykko]

These are critical bugs and I reported them.

I know "normal" users having their PCs full of more than 10.000 viruses. How is that NOD32 will stop at 5% scanning ?

I should mention ekrn.exe is using 99% of CPU during this scan.

[SFLORG]

Whoa!
Normal users that have 10k in active infections...
You don't have to lie to make friends. ~smiles~
1. Doubt any comp would run that's seriously infected with such.
2. I would assume any AV would freeze up, if not hid and ran for cover.

Now I do know some that have collected such for research and are very well locked down from the OS. They are not average users.

10K oh my. . .

[pykko]

Originally Posted by SFLORG

Whoa!
Normal users that have 10k in active infections...
You don't have to lie to make friends. ~smiles~
1. Doubt any comp would run that's seriously infected with such.
2. I would assume any AV would freeze up, if not hid and ran for cover.

Now I do know some that have collected such for research and are very well locked down from the OS. They are not average users.

10K oh my. . .

I usually disinfect many PCs and yes, they have more than 10.000 infected files.

But, it was a bug report, I will not argue with you, but with an ESET stuff.

[The PIT]

Originally Posted by SFLORG

Whoa!
Normal users that have 10k in active infections...
You don't have to lie to make friends. ~smiles~
1. Doubt any comp would run that's seriously infected with such.
2. I would assume any AV would freeze up, if not hid and ran for cover.

Now I do know some that have collected such for research and are very well locked down from the OS. They are not average users.

10K oh my. . .

I think the record I heard off is 26k
God knows how many my nephews had with ramnit a,b, and c

However I wouldn't call it a bug with eset in such cases it's normally best to remove the hard drive and scan from an clean machine.

[pykko]

Viruses are not active, so it's basically a scan of an infected HDD in a clean machine.

Av-Test.org, AV-Comparatives.org perform the same this part of their test.

[xxJackxx]

Originally Posted by pykko

Viruses are not active, so it's basically a scan of an infected HDD in a clean machine...

Sounds like a bug to me if they are not active. It should not be a problem to delete a bunch of inactive files regardless of how many there are.

[toxinon12345]

The two problems seems to be correlated to the scanning process.

Just to make sure, edit the "context menu profile" disable smart optimization and enable log all objects, save the changes and then right click the folder using windows explorer and select scan with ESET.

Post back your findings.

[agoretsky]

Hello,

On the first issue, scanning a directory with many (8,000+) files, what sort of files are inside the directory?

Regards,

Aryeh Goretsky

[pykko]

Originally Posted by agoretsky

Hello,

On the first issue, scanning a directory with many (8,000+) files, what sort of files are inside the directory?

Regards,

Aryeh Goretsky

Hello,

they are PE files: exe, dll, sys

[pykko]

I see maximum of interest in my bug report. Tipically ESET

[agoretsky]

Hello,

There was a bit of a power outage last week right before the weekend. Thank you for your patience and understanding.

Were the 8,000 files a clean set? Infected? Digitally or not-digitally signed? Some sort of mixture of these? Without know more details about how to reproduce the set, it is difficult to investigate the rest of your report.

Regards,

Aryeh Goretsky

[pykko]

Originally Posted by agoretsky

Hello,

There was a bit of a power outage last week right before the weekend. Thank you for your patience and understanding.

Were the 8,000 files a clean set? Infected? Digitally or not-digitally signed? Some sort of mixture of these? Without know more details about how to reproduce the set, it is difficult to investigate the rest of your report.

Regards,

Aryeh Goretsky

They were all infected, or at least 99% of them.

If you want, I'll PM you the source.

[toxinon12345]

When you see files in through the TreeView in egui, you are triggering file scanning in ekrn.
Thats why I recommend you to scan the folder using the context menu: if problem persist then could be a file causing excessive emulation or with an error in the unpacking.

[agoretsky]

Hello,

I see. Yes, please send me a PM.

Regards,

Aryeh Goretsky

[pykko]

Originally Posted by agoretsky

Hello,

I see. Yes, please send me a PM.

Regards,

Aryeh Goretsky

PM sent. Thank you!

[pykko]

I was able to replicate this bug on a second machine. I'm looking forward to a fix.

[agoretsky]

Hello,

Issue has been forwarded to engineers for further examination/research.

Regards,

Aryeh Goretsky

[pykko]

Originally Posted by agoretsky

Hello,

Issue has been forwarded to engineers for further examination/research.

Regards,

Aryeh Goretsky

Thank you and I hope things will be fixed.

Is possible, could you please tell me when this bug is fixed as I may test it ?

[agoretsky]

Hello,

Private message sent.

Regards,

Aryeh Goretsky

[pykko]

I've replied. Thanks.

[trjam]

ESS running lickity split here