NOD32 cannot complete scan or clean

I have stumbled across a way of crashing NOD32. If I scan or clean my mailer directory* and select email files in objects to diagnose, at precisely the same point in the scan or clean, NOD32 will simply disappear. No error messages, nothing in Event Viewer (this is on XP Pro SP2) and Dr Watson could not care less. All that happens is I am left with undeletable entries in the NOD32 Scanner logs with status as 'scanning' or 'cleaning'. If I do not select email files in objects to diagnose, NOD32 happily scans or cleans the 28,000 plus files it finds. Out of curiosity, does anyone know, or think they know, why NOD32 is behaving like this?

*I avoid relying on mailers such as Outlook that store email in idiosyncratic file formats as great lumps on the hard drive waiting to be corrupted, so my mailers - Polarbar is my current default - store each email separately in formats that can be readily accessed even by the primitive notepad provided in Windows.

 

I can add a little more to the puzzle. I ran another scan/clean with email files selected and managed to stop the cleaning just before NOD32 has been predictably disappearing. The following message is in the scan log (this is the last thing that happens before NOD32 disappears, along with the record of the message):

C:\Program Files\Polarbar\Mailer\MailData\Netcom\BT\45U011JL.POP »MIME »part002.txt - error occured while reading archive

Here is an indication of the content of the email that NOD32 is finding so much difficulty handling:

"Yahoo! Mail Virus Protection detected the virus '"W32.Netsky.P@mm"' in the file '"document.zip"', attached to the enclosed email message. We scanned the file using Norton AntiVirus but were unable to clean it. Therefore, we removed the content of the attachment from the message. Please contact the message sender if you want to receive the attachment. They must clean the file and resend it before we can deliver it to you safely."

FWIW, eScan AntiVirus Toolkit Utility has no problems scanning/cleaning any of these email files, including the one above.

 

Is it just a coincidence.....All your post are slagging off NOD32?
With negative titles for the name of the thread.

Why do you come here?

To promote other brands of software?

 

I regard your post as an entirely unwarranted personal attack on me and I expect the moderators to address this.

 

Gents,

Let's keep the discussion on subject. There's nothing wrong with the subject line of this thread, it's a simple statement of the factual situation that Howard is facing. The mention of other AV's which handle this situation is entirely within the scope of the discussion.

Howard,

What's the size of the file in question? Small enough to reasonably forward to Eset for examination?

I ran into a somewhat similar situation, described here, with the difference that the scan simply hung - NOD32 remained active. Never really figured out what happened. Something was munged somewhere (or course I was testing lots of stuff around this time) and a reinstall did fix things. Have you tried this course of action? Also what version levels of NOD32 are you running?

Blue

 

Thanks for your supportive comments Blue. The file in question is small, less than 3 KB. I am using version 2.12.2 with virus update 1.889 I shall take your advice and send the file to Eset with a link to this thread.

 

Thanks Howard, would appreciate you keeping us in the loop, as we can all learn from peoples experiences and the results they had...

Cheers

 

Will do

 

Brief update, as promised. I received a reply from NOD32 Technical support and it is clear the file I thought was causing the problem was, in fact, not the culprit. I did some more rummaging - there are 32200+ files in the problem directory - and definitely identified the problem file (NOD32 crashes when it is present in my mailer's directory, scans/cleans without problem after I deleted it from within my mailer, will crash on just this file saved to a temp directory). I have now sent this file to NOD32 Technical support. The file in question, by the way, is a pretty routine promotional html file from Dixons, a fairly well known electrical goods company in the UK. If anyone wants to 'play' with this file - it is 32.7 KB, scans clean with Escan Antivirus Toolkit Utility - then let me know.