Nod32 causing downloads to freeze

Let's realize what is happening during the download:
- an application starts downloading a file (archive)
- web access protection saves the file to a temp. folder
- after the download completes, the last packet (default setting) or the entire file is held until the file is scanned or the archive is completely extracted and each file scanned
- after that, the last packet or the entire file is passed to the application

That means the delay after downloading a file is normal and depends on the size of the downloaded file or the number of files within the archive than need to be extracted and scanned.

 

Hi Marcos,

Quick question. Once this process of scanning is completed by the web protection scanner, is this process then repeated again by the real-time scanner? I would assume after the file is 100% completed and finally written that the real-time scanner would do the same thing if the same controls were enabled as the web protection scanner, especially on those computers that are reporting that the protocol scanner failed to start properly. (I get those the odd time)

 

Hi

so basically what your saying is that this way of scanning is totally and only used by Eset?

I dont see any other AVs having this problem yet surely they have some kind of web protection and file protection?

 

I've just tried Avast, it detected eicar only in reasonably small archives. Larger archives are not scanned (at least not with default settings). Eicar slipped through it in about 40 MB archive with just two files inside without being detected. The same would most likely happen with any antivirus if you don't see any delays.

ESET does not use any limits but allows the user to configure them according to their needs.

Update: tested with KAV Pure, the same archive was detected but there was a several seconds delay due to archive extraction and subsequent scan of the files inside.

 

I used to run admuncher actually. So you may be onto something as recently when I download files the problem doesnt appear to be there.

Back in the time when I reported things like nvidia driver downloads hanging I was using admuncher.

admuncher also causes very weird IE8 gui issues so I ditched it plus the fact still no http 1.1 support in it.

alternatives are either proximitron with something like sidki filters, however these for me are starting to break too many mainstream sites such as youtube, or simple adblock. simple adblock uses the same filters as easylist on ff's adblock plus. However when I last used simple adblock it was a bit buggy on back/forward.

Shame about admuncher as it worked well in XP and ie6 but recently is showing its age and lack of development.

 

can you answer the other question please that someone asked.

if realtime and web access protection are both enabled, do downloaded files get scanned twice? or is nod32 intelligent enough to skip the realtime check.

 

In order to check this for yourself, try the following: -

1. With realtime protection enabled and web access protection disabled, download a large file that you have observed generates a noticable delay and make an estimate of the scan time.

2. Now download the same file again, this time with realtime protection disabled and web access protection enabled, and make an estimate of the scan time. It should be similar to the first test.

3. Finally download the file again, this time with both realtime and web access protection enabled and see if the total scan time has roughly doubled.

I don't currently have NOD32 installed but when I last tried this test a couple of months ago, the measures that I got did suggest that it was scanning twice.

 

It is fairly annoying this and even more so when it seems to complete followed by a time out.
Also why does pausing the download and then resuming when the scan starts allows the control to handed straight back to firefox instantly and the download is available.

 

It is the real time scanner that does the work anyway and ultimately if it can't detect then game over.

better solution is always nice to have though

 

Found myself facing the very same issue while downloading pretty much anything. Spare me the "it is too big of an archive you moron" kind of comment, it ain't the kind of PR that'll make me renew my subscription when the time will come. Moreover, Nod32 managed to kneel my quad core several seconds even when downloading the puny PuTTy installer (1.67 Mb) or WinSCP (3 Mb) and those two are no linux ISO...

I'm not especially fond of disabling anything in the realtime protection as "adviced" either, since it's the realtime scanner - and not the web one - which causes the issue.
Is there any hope to see that issue actually fixed rather than denied ? The problem isn't the scanning taking forever, I don't care if the scanner wants to spend 5s scanning a 3 Mb setup exe. What's putting people off is having the browser completely frozen during that time. And that should never happen no matter what, and doesn't happen with other AV.

And if that issue ain't fixed, or if I get that apparently common "well that's normal, please add exclusions" I will simply see elsewhere. I just moved out from Kaspersky because it was hogging the resources, I certainly won't keep Eset/Nod32 either if it does freeze my browser 3s everytime an exe is downloaded...

(All of this occuring on a Win7 64bits ultimate)​