Some bugs in ESET Smart Security 5 RC

Discussion in 'ESET NOD32 Antivirus/Smart Security Beta' started by pykko, Sep 7, 2011.

Thread Status:
Not open for further replies.
  1. pykko

    pykko Registered Member

    Joined:
    Apr 27, 2005
    Posts:
    2,236
    Location:
    Romania...and walking to heaven
    1. Create a folder with more than 8000 files. Try to perform a custom scan selecting a random file from that big folder (not contextual-menu scan).
    Eset will crash.

    2. Try to scan the same big folder that contains more than 6000 infected files and scanning process will stop at 3 or 5% while automatic update starts and stays at 0%.
     
  2. NoobStick

    NoobStick Guest

    Joined:
    Jun 23, 2011
    Posts:
    0
    Hello pykko
    Sorry Pykko but I can see the purpose with your post, personally I do not know any normal user who has or created a single folder with 8000 files or a single folder with 6000 pieces of malicious malware samples. If I have missed anything please enlighten me.

    All the Best

    NoobStick
     
  3. pykko

    pykko Registered Member

    Joined:
    Apr 27, 2005
    Posts:
    2,236
    Location:
    Romania...and walking to heaven
    These are critical bugs and I reported them.

    I know "normal" users having their PCs full of more than 10.000 viruses. How is that NOD32 will stop at 5% scanning ?

    I should mention ekrn.exe is using 99% of CPU during this scan.
     
    Last edited: Sep 7, 2011
  4. SFLORG

    SFLORG Registered Member

    Joined:
    Jul 5, 2011
    Posts:
    15
    Whoa!
    Normal users that have 10k in active infections...
    You don't have to lie to make friends. ~smiles~
    1. Doubt any comp would run that's seriously infected with such.
    2. I would assume any AV would freeze up, if not hid and ran for cover.

    Now I do know some that have collected such for research and are very well locked down from the OS. They are not average users.

    10K oh my. . .
     
  5. pykko

    pykko Registered Member

    Joined:
    Apr 27, 2005
    Posts:
    2,236
    Location:
    Romania...and walking to heaven
    I usually disinfect many PCs and yes, they have more than 10.000 infected files.

    But, it was a bug report, I will not argue with you, but with an ESET stuff.
     
  6. The PIT

    The PIT Registered Member

    Joined:
    Sep 4, 2008
    Posts:
    185
    I think the record I heard off is 26k
    God knows how many my nephews had with ramnit a,b, and c

    However I wouldn't call it a bug with eset in such cases it's normally best to remove the hard drive and scan from an clean machine.
     
  7. pykko

    pykko Registered Member

    Joined:
    Apr 27, 2005
    Posts:
    2,236
    Location:
    Romania...and walking to heaven
    Viruses are not active, so it's basically a scan of an infected HDD in a clean machine.

    Av-Test.org, AV-Comparatives.org perform the same this part of their test.
     
  8. xxJackxx

    xxJackxx Registered Member

    Joined:
    Oct 23, 2008
    Posts:
    3,600
    Location:
    USA
    Sounds like a bug to me if they are not active. It should not be a problem to delete a bunch of inactive files regardless of how many there are.
     
  9. toxinon12345

    toxinon12345 Registered Member

    Joined:
    Sep 8, 2010
    Posts:
    1,180
    Location:
    Managua, Nicaragua
    The two problems seems to be correlated to the scanning process.

    Just to make sure, edit the "context menu profile" disable smart optimization and enable log all objects, save the changes and then right click the folder using windows explorer and select scan with ESET.

    Post back your findings.
     
  10. agoretsky

    agoretsky Eset Staff Account

    Joined:
    Apr 4, 2006
    Posts:
    4,030
    Location:
    California
    Hello,

    On the first issue, scanning a directory with many (8,000+) files, what sort of files are inside the directory?

    Regards,

    Aryeh Goretsky
     
  11. pykko

    pykko Registered Member

    Joined:
    Apr 27, 2005
    Posts:
    2,236
    Location:
    Romania...and walking to heaven
    Hello,

    they are PE files: exe, dll, sys
     
  12. pykko

    pykko Registered Member

    Joined:
    Apr 27, 2005
    Posts:
    2,236
    Location:
    Romania...and walking to heaven
    I see maximum of interest in my bug report. Tipically ESET :)
     
  13. agoretsky

    agoretsky Eset Staff Account

    Joined:
    Apr 4, 2006
    Posts:
    4,030
    Location:
    California
    Hello,

    There was a bit of a power outage last week right before the weekend. Thank you for your patience and understanding.

    Were the 8,000 files a clean set? Infected? Digitally or not-digitally signed? Some sort of mixture of these? Without know more details about how to reproduce the set, it is difficult to investigate the rest of your report.

    Regards,

    Aryeh Goretsky
     
  14. pykko

    pykko Registered Member

    Joined:
    Apr 27, 2005
    Posts:
    2,236
    Location:
    Romania...and walking to heaven
    They were all infected, or at least 99% of them.

    If you want, I'll PM you the source.
     
  15. toxinon12345

    toxinon12345 Registered Member

    Joined:
    Sep 8, 2010
    Posts:
    1,180
    Location:
    Managua, Nicaragua
    When you see files in through the TreeView in egui, you are triggering file scanning in ekrn.
    Thats why I recommend you to scan the folder using the context menu: if problem persist then could be a file causing excessive emulation or with an error in the unpacking.
     
  16. agoretsky

    agoretsky Eset Staff Account

    Joined:
    Apr 4, 2006
    Posts:
    4,030
    Location:
    California
    Hello,

    I see. Yes, please send me a PM.

    Regards,

    Aryeh Goretsky
     
  17. pykko

    pykko Registered Member

    Joined:
    Apr 27, 2005
    Posts:
    2,236
    Location:
    Romania...and walking to heaven
    PM sent. Thank you!
     
  18. pykko

    pykko Registered Member

    Joined:
    Apr 27, 2005
    Posts:
    2,236
    Location:
    Romania...and walking to heaven
    I was able to replicate this bug on a second machine. I'm looking forward to a fix.
     
  19. agoretsky

    agoretsky Eset Staff Account

    Joined:
    Apr 4, 2006
    Posts:
    4,030
    Location:
    California
    Hello,

    Issue has been forwarded to engineers for further examination/research.

    Regards,

    Aryeh Goretsky
     
  20. pykko

    pykko Registered Member

    Joined:
    Apr 27, 2005
    Posts:
    2,236
    Location:
    Romania...and walking to heaven
    Thank you and I hope things will be fixed.

    Is possible, could you please tell me when this bug is fixed as I may test it ?
     
  21. agoretsky

    agoretsky Eset Staff Account

    Joined:
    Apr 4, 2006
    Posts:
    4,030
    Location:
    California
    Hello,

    Private message sent.

    Regards,

    Aryeh Goretsky
     
  22. pykko

    pykko Registered Member

    Joined:
    Apr 27, 2005
    Posts:
    2,236
    Location:
    Romania...and walking to heaven
    I've replied. Thanks.
     
  23. trjam

    trjam Registered Member

    Joined:
    Aug 18, 2006
    Posts:
    8,939
    Location:
    North Carolina
    ESS running lickity split here:thumb:
     
Thread Status:
Not open for further replies.