HTTP Scanner causes large downloads to hang

NOD32 Antivirus 5.2.9.1, Windows 7 Ultimate 64-bit sp1

1. Host a large file on a local (client and server on same machine) HTTP server. In my case, I am hosting http://dl.google.com/android/ndk/android-ndk-r8b-windows.zip which is 188MB on Tomcat 7.
2. Invoke "wget <location of file>" to download the file
3. About 50MB of the way through the download, it hangs. Meaning, no more bytes come down the pipe.
4. Disable HTTP Scanner in NOD32
5. Repeat #2. Notice hang is gone.

This issue is reproducible 100% of the time.

 

Remember that there's no size limit in the http scanner by default so it may take quite a long time until large archives are scanned completely and the data is passed to the application.

 

Hi Marcos,

I don't think that's what's going on. Sometimes the download hangs 9MB into the 150MB download. At that point, the file is incomplete and there isn't really much NOD32 could be scanning. Also, it hangs for over 30 seconds before wget gives up and aborts the download. CPU usage is at 0%.

Gili

 

I thought that maybe I was alone in having this incomplete d/l issue but not from all sources. For instance if I d/l a 800mb file from lets say hotfile it completes properly. Whilst if I d/l the same exact file from another service it hangs at the 99% for a long time then completes but the file is corrupt ie a movie file...I also affects other file types like .rar or .zip
Usually after a 2nd d/l from the source that initially turned out to be a corrupt d/l the file is good? So it's not a question of a corrupt file in the first place...I shall disable http checking and report back (using just ole IE9 as the d/l application on a fresh install of Win7 x64 fully updated)

 

Couldn't it be this case?

 

I would agree that whatever the hotfix was to IE9 is probably the root source of the problem here. Before the hotfix I had ZERO problems with corrupt d/l's. After the out of band hotfix is when I started noticing it and because of a separate issue dealing with the latest Intel RST

http://communities.intel.com/thread/31847?start=15&tstart=0

I did a secure erase and a fresh install of Win7 x64 (+ programs) and of course fully updated Win7 which included hotfix kb2735855 and once again..the failed d/l's intermittently occurs. So from my view your on the right track Marcos to pinpointing the cause and hopefully a fix?
Thanks

* I forgot to mention that If I temporarily disable http checking in NOD32 x64 so far in testing I have experienced zero d/l corrruptions so maybe thats a key?

 

Microsoft has been given a minimalistic driver that is used in ESET's products to figure out the bug in their code. As soon as we receive a response from them, I'll update the thread mentioned above.

 

Hi SaphireX,

I started a separate thread about the Intel RST issue in the hardware forum:
https://www.wilderssecurity.com/showthread.php?t=333270