HTTP Scanner causes large downloads to hang

Discussion in 'ESET NOD32 Antivirus' started by cowwoc, Sep 30, 2012.

Thread Status:
Not open for further replies.
  1. cowwoc

    cowwoc Registered Member

    Joined:
    Jun 1, 2008
    Posts:
    20
    NOD32 Antivirus 5.2.9.1, Windows 7 Ultimate 64-bit sp1

    1. Host a large file on a local (client and server on same machine) HTTP server. In my case, I am hosting http://dl.google.com/android/ndk/android-ndk-r8b-windows.zip which is 188MB on Tomcat 7.
    2. Invoke "wget <location of file>" to download the file
    3. About 50MB of the way through the download, it hangs. Meaning, no more bytes come down the pipe.
    4. Disable HTTP Scanner in NOD32
    5. Repeat #2. Notice hang is gone.

    This issue is reproducible 100% of the time.
     
  2. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    Remember that there's no size limit in the http scanner by default so it may take quite a long time until large archives are scanned completely and the data is passed to the application.
     
  3. cowwoc

    cowwoc Registered Member

    Joined:
    Jun 1, 2008
    Posts:
    20
    Hi Marcos,

    I don't think that's what's going on. Sometimes the download hangs 9MB into the 150MB download. At that point, the file is incomplete and there isn't really much NOD32 could be scanning. Also, it hangs for over 30 seconds before wget gives up and aborts the download. CPU usage is at 0%.

    Gili
     
  4. SaphireX

    SaphireX Registered Member

    Joined:
    Jul 29, 2004
    Posts:
    84
    I thought that maybe I was alone in having this incomplete d/l issue but not from all sources. For instance if I d/l a 800mb file from lets say hotfile it completes properly. Whilst if I d/l the same exact file from another service it hangs at the 99% for a long time then completes but the file is corrupt ie a movie file...I also affects other file types like .rar or .zip
    Usually after a 2nd d/l from the source that initially turned out to be a corrupt d/l the file is good? So it's not a question of a corrupt file in the first place...I shall disable http checking and report back (using just ole IE9 as the d/l application on a fresh install of Win7 x64 fully updated)
     
  5. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    Couldn't it be this case?
     
  6. SaphireX

    SaphireX Registered Member

    Joined:
    Jul 29, 2004
    Posts:
    84
    I would agree that whatever the hotfix was to IE9 is probably the root source of the problem here. Before the hotfix I had ZERO problems with corrupt d/l's. After the out of band hotfix is when I started noticing it and because of a separate issue dealing with the latest Intel RST

    http://communities.intel.com/thread/31847?start=15&tstart=0

    I did a secure erase and a fresh install of Win7 x64 (+ programs) and of course fully updated Win7 which included hotfix kb2735855 and once again..the failed d/l's intermittently occurs. So from my view your on the right track Marcos to pinpointing the cause and hopefully a fix?
    Thanks

    * I forgot to mention that If I temporarily disable http checking in NOD32 x64 so far in testing I have experienced zero d/l corrruptions so maybe thats a key?
     
    Last edited: Oct 1, 2012
  7. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    Microsoft has been given a minimalistic driver that is used in ESET's products to figure out the bug in their code. As soon as we receive a response from them, I'll update the thread mentioned above.
     
  8. FanJ

    FanJ Updates Team

    Joined:
    Feb 9, 2002
    Posts:
    2,564
Thread Status:
Not open for further replies.