AMON Freezes Office Update Scan

Discussion in 'NOD32 version 2 Forum' started by COSMO26, Nov 8, 2005.

Thread Status:
Not open for further replies.
  1. COSMO26

    COSMO26 Registered Member

    Joined:
    Oct 21, 2003
    Posts:
    404
    Win Me / Office XP / EMON Disabled / Stand-alone desktop - - After Re-Install of Office XP and IE6SP1 netted No Help I am thrilled to discover that AMON is the cause of Office Update Scans Freezing at 48-58% (Cntrl-Alt-Del shows "IE Not Responding" and forcing me to Power Down the computer after "End Task" & Cntrl-Alt-Del Re-boot attempts lock- - AMON "OFF" nets Update Scan completion-suggestions as it should.
    Not intuitive to me that the AMON Exclusions Tab would Help via "Files-Folders", so how can I tell AMON to "butt-out" of these Office Update Scans? (AMON Detections & Options Tabs members All Checked per Blackspear)- I am willing to Disable AMON JUST for the Update Scans unless someone has an answer OR knows that I'm susceptible to back-door "baddies" with it "OFF". Any thoughts appreciated!!
     
  2. alglove

    alglove Registered Member

    Joined:
    Jan 17, 2005
    Posts:
    904
    Location:
    Houston, Texas, USA
    Is there any effect if you disable DMON? I ask about DMON because I believe Office Update uses an ActiveX control.
     
  3. COSMO26

    COSMO26 Registered Member

    Joined:
    Oct 21, 2003
    Posts:
    404
    Thanks for replying. Disabling DMON locked up the Update Scan page at 58% and I couldn't get Cntrl-Alt-Del to even offer Re-Start / Had to Power Off the computer. Disabled AMON and it paused on 58% and then Finished with an Update offering. If I'm the only one on the planet with this I don't expect a Fix to be "researched" but at least I can make the darn thing Scan for Updates again with AMON "OFF".
     
  4. fosius

    fosius Registered Member

    Joined:
    Oct 14, 2004
    Posts:
    479
    Location:
    Partizanske, Slovakia
    Try not only disabling but UNLOADING modules...
     
  5. COSMO26

    COSMO26 Registered Member

    Joined:
    Oct 21, 2003
    Posts:
    404
    Fosius, what's your logic in trying "unload" versus "disable" on IMON and DMON? Do you think AMON would Not Cause the Update Scan Freeze IF IMON or DMON were Unloaded versus "Dis-abled"? That's the only logic I can think of to try that. Having to Power-Off the computer after every lock-up gets old.
     
  6. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    It actually makes sense for IMON and DMON.
     
  7. COSMO26

    COSMO26 Registered Member

    Joined:
    Oct 21, 2003
    Posts:
    404
    Thanks Marcos- I Unloaded both IMON and then DMON, but not at same time, and each Office Update Scan froze at 58% with AMON Enabled. Had to re-boot per ESET pop-up to re-activate IMON but DMON returned without lock-ups or re-boot required after I did the "End Task" from the locked Update Scan page.
    I'm willing to Disable AMON [ONLY] for Office Update Scans.
     
  8. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    Maybe you could try setting AMON to scan only files with default extensions that might potentially carry a malicious code.
     
  9. alglove

    alglove Registered Member

    Joined:
    Jan 17, 2005
    Posts:
    904
    Location:
    Houston, Texas, USA
    OK, this seems pretty repeatable at 58%. Is there any way you can have the AMON window up on the screen as you do the Office Update? Maybe that way we can find out if a particular file is involved (though it may also be that the file you see displayed is the one before the one that causes problems...).

    Here is a checklist from Microsoft for troubleshooting Office Update problems. Maybe something in there will help, besides disabling AMON.

    http://support.microsoft.com/kb/304498
     
  10. COSMO26

    COSMO26 Registered Member

    Joined:
    Oct 21, 2003
    Posts:
    404
    Marcos, Office Update Scan Works! if I choose the AMON Default List of Extensions (about 61 entries from ASP thru {* Rather than "Scan All Files". For Update Scans I'll just use Default and then use "Scan All Files" the rest of the time. I presume ESET's Default List would not be offered if it wasn't a Very Protective List. Thanks for the idea.
     
  11. alglove

    alglove Registered Member

    Joined:
    Jan 17, 2005
    Posts:
    904
    Location:
    Houston, Texas, USA
    I think I may have found the culprit. I was running Microsoft Update on a Windows XP computer that has Office XP installed. There was a new update named "Update for Access 2002: October 18, 2005". When I would try to install it, the CPU usage would zoom to 100%. The computer would seem to be frozen, but if I was patient enough, I could see that the computer was still working.

    When Microsoft Update finally finished, it said that the installation had failed. A quick look at the Event Viewer should that there was a problem with the file "MSACCESSop.MSP" could not be installed, and that a temporary file in the C:\Windows\Installer could not be accesses. However, once I added this folder to the AMON Exclusion list, the problems went away. The update installed successfully.

    I believe I have located the MSACCESSop.MSP file in this folder, but with a different name. Any time I try to access it in any way (copy it, move it to Recycle Bin, even right-click --> Properties), the CPU goes crazy. I am submitting it via the Quarantine utility, with a link to this thread.

    Here is a link to the Microsoft Knowledge Base regarding this update:

    http://support.microsoft.com/default.aspx?scid=kb;en-us;904018

    ***EDIT***
    The file is too large to submit via Quarantine. I believe there is enough info in the Microsoft link to track this file down. If you want me to submit it manually, just let me know.
     
  12. COSMO26

    COSMO26 Registered Member

    Joined:
    Oct 21, 2003
    Posts:
    404
    Thanks, Al. I'll defer your offer to help further to Marcos or ESET staff-er as to whether the time to address it is worth it to ESET. If the issue is just me I wouldn't expect the special attention. That it interfered with your Office XP Update, also, may be a prediction of more future problems if it's left as is. Marcos, what do you think? Thanks again to both of you for your interest and help! Edit: If AMON is set to Scan All Files & I Exclude, as Al did, Folder ["C:\Windows\Installer" & check "Exclude Subfolders: No"] Office XP Update completes the Scan. Is this "Exclude" setting on "Permanent" a safe setting and a suitable solution?
     
    Last edited: Nov 11, 2005
  13. alglove

    alglove Registered Member

    Joined:
    Jan 17, 2005
    Posts:
    904
    Location:
    Houston, Texas, USA
    I don't think so. Many programs and patches that use the Windows Installer use this folder. This is precisely the type of thing you would want to have scanned by your antivirus program.

    This is a classic example of why some programs say, "Close all programs and disable antivirus software when installing this program." If at all possible, I try to ignore the part about disabling antivirus software whenever possible (which is most of the time).
     
  14. COSMO26

    COSMO26 Registered Member

    Joined:
    Oct 21, 2003
    Posts:
    404
    Thanks again, Al. I Deleted the Installer Folder Exclusion & will await a Marcos/moderator response to see if they want you to send anything in to study. Although both our problems were solved by dealing with C:\Windows\Installer, we did have two different issues that I hope are "brothers" and solved with the same correction, if ESET pursues it.
     
Thread Status:
Not open for further replies.