Prevx RC 3.0.4.228

Joe,
I have just had another BSOD the same as I reported in the thread on bld 221 and have managed to get the crash log this time so will forward to report @ prevxresearch for you look at in a minute.
As last time I have OA++ and Prevx 228 installed.

 

I've analyzed the crashdump and can't see anything Prevx-related in it Do you have any way to reproduce this on-demand or is it completely random?

 

I'm honestly not sure what would be causing it... Prevx doesn't do anything strange with the network stack or modify any data going through. Could you possibly try uninstalling avast and see if the issue still occurs?

 

The KeyScrambler "issue" is a non-issue (as long as its still the same one which you had before where the keystrokes were "unencrypted" - this just means that Prevx is preventing KeyScrambler from seeing the keystrokes).

We're still unable to reproduce any issues with Ad Muncher... if you have any further details or if you'd be willing to open a remote support session, this would be extremely useful (and I'm sure we'd be able to solve it very swiftly )

 

No, I cannot reproduce this on-demand. I tried removing Shadow Defender and installing a fresh download in case SD had been corrupted but it seems not. I'm beginning to wonder if there is a conflict with OA, perhaps I'll remove Prevx for a few days and just run SD and OA and see if I can get it to happen again.
The strange thing is that there is nothing showing in the Event Viewer at the time of the BSOD

 

ill give it a try, this will be my last attempt tho, if this doesnt do anything then, . if this IS the issue, ill forward it to the avast team and hopefully get it straightened out.

 

huh...non issue....KeyScrambler unencrypted strokes means all gibberish is written instead of what you want to write....example instead of say "prevx" it is "?ca/c" this regardless of whether prevx is doing/not doing its bit

the crashes are not endearing at all...i am back to v 3.0.4.65....but okay i am game even though the skeletons in my closet are planning a revolt n takeover..

 

I have experienced the same things as yours, kaspersking, when I was using the 32-bit version.

 

well i tried this and same thing, no AV installed just prevx and same stuff is happening...

 

Joe
Have a performance question: in this latest version as well as older releases, I noticed that even after initial (or scheduled) scan is finished, launching some applications takes longer than usual due to Prevx scanning files that are loading and are part of that application. Some examples are VLC Player, MediaMonkey, DivX player, anything VMWare, anything requiring Cygwin libraries.
I guess my question is why Prevx re-scanning these files on load, when it should've picked them up during on-demand scan and mark them as safe?
Thanks as always!

 

Are you experiencing this on the first execution of one of these programs or subsequent executions? It may be worth running a few of them and sending me a scan log so that I could see if there is anything obvious which is causing the delayed scan to take place.

Thanks!

 

I'm honestly not sure what would cause it in that case. Prevx doesn't do anything irregular with the network stack or send anything out-of-the-ordinary across the network.

To take a stab at a possible cause, could this be your ISP blocking traffic after misidentifying Prevx as a threat? I honestly would love to solve the problem but we have had no other user ever report a problem like this and the v3.0.1.65 build has been out for > 5 months without a single change so it's very hard to correlate/cross-reference data to try and find the underlying cause.

 

I think we will end up disabling some of our protection when KeyScrambler is installed and active (just because it does duplicate some of the functionality and when dealing with cut+dry things like encrypting keystrokes, it opens up quite a bit of room for incompatibilities).

If you could send me a PM with when you'd be available tomorrow or any time later in the week, I'd much appreciate being able to fix the problems remotely

 

I noticed that too. Currently, Prevx is scanning a lot of files that I've scanned before. I'll wait a couple more days to see if something changes.

 

I'd be interested in getting a scan log from you as well in that case if it isn't too much trouble - the more cases we can compare, the better

Thanks!

 

Wow, that was quick!
This usually happens on first execution after new version is installed, but AFTER initial scan is completed. Am I wrong to assume that initial "learning" scan would've seen these files and classified them as safe already?

 

The learning scan doesn't necessarily scan every file from every program. In the case of a program like VLC, it has literally hundreds of components which it loads dynamically when executed. Therefore, Prevx may not have caught them all on the initial scan as they aren't directly registered within the system or able to load on their own. When they do come to load, however, we will scan them and then allow/block as they're accessed.

We should generally be able to determine the intent of a program or component within a few seconds after the first sighting so I'm a bit surprised you're receiving persistent scans like this (which could be a result of an inconclusive program determination but those are relatively rare).

One other factor which could be involved is the infection status of your PC - do you currently have any threats or test viruses on your PC?

 

My Security Center again shows PrevX RC as "not active".
I ran a Windows x-64 update before and restarted the computer.

 

Hi Joe this problem seems solved:

- SAS and MBAM scanning is sometimes slowed when Prevx is active: This is an issue stemming back a while and is solved by stopping Prevx protection while scans are taking place. We're investigating whether it would be possible to identify the operations SAS/MBAM are making in the system to prevent us from intercepting their file reads to improve their scan times


We try scan with MBAM & SAS and everithing goes well, time scan with Prevx off and Prevx on is quite the same.
You can delete the issue
Thanks

 

Hi Joe,
I do have a small "harvest" of test viriis, would this throw it off?
Thanks!

 

One more thing I noticed with SafeOnline on: any links I click in Gtalk open up as a blank tab in Opera instead of opening the actual URL. All other links in chat clients like Hotmail, OCS, Trilian and such open up fine, so not sure if this is something special in the way Gtalk launches new browser window.

 

My Security Center still shows Prevx as "inactive".

 

It shows fine on my 3 computers! XP, Vista & Win 7 all 32bit

TH

 

Just to clarify - are you using a fully registered version of Prevx? We only integrate into the security center when you have a full license.

 

Yes i do use a paid version.