Scanning items which are deleted

Discussion in 'Prevx Betas' started by Sherlock_Holmes, Aug 12, 2011.

Thread Status:
Not open for further replies.
  1. Sherlock_Holmes

    Sherlock_Holmes Registered Member

    Joined:
    Mar 21, 2010
    Posts:
    1,449
    Location:
    Mumbai
    I just noticed that when i do a quick scan the scanning items shows that wsa is scanning items that i deleted 3 days ago [ songbird portable and splayer portable ]

    Tue 2011-08-09 20:08:21.0225 Monitoring process D:\SongbirdPortable\SongbirdPortable.exe [5949661BEFF4D1D4128AB3DA8A39D810]. Type: 3
    Tue 2011-08-09 20:08:21.0225 Monitoring process D:\SongbirdPortable\SongbirdPortable.exe [5949661BEFF4D1D4128AB3DA8A39D810]. Type: 4
    Tue 2011-08-09 20:08:21.0225 Monitoring process D:\SongbirdPortable\SongbirdPortable.exe [5949661BEFF4D1D4128AB3DA8A39D810]. Type: 8
    Tue 2011-08-09 20:08:21.0225 Monitoring process D:\SongbirdPortable\SongbirdPortable.exe [5949661BEFF4D1D4128AB3DA8A39D810]. Type: 6
    Tue 2011-08-09 20:08:21.0677 Monitoring process D:\SongbirdPortable\App\songbird\songbird.exe [5944F9DE4263EA115F7D9C00ACE9E28C]. Type: 3
    Tue 2011-08-09 20:08:21.0677 Monitoring process D:\SongbirdPortable\App\songbird\songbird.exe [5944F9DE4263EA115F7D9C00ACE9E28C]. Type: 4
    Tue 2011-08-09 20:08:21.0677 Monitoring process D:\SongbirdPortable\App\songbird\songbird.exe [5944F9DE4263EA115F7D9C00ACE9E28C]. Type: 5
    Tue 2011-08-09 20:08:21.0677 Monitoring process D:\SongbirdPortable\App\songbird\songbird.exe [5944F9DE4263EA115F7D9C00ACE9E28C]. Type: 7
    Tue 2011-08-09 20:08:21.0682 Monitoring process D:\SongbirdPortable\App\songbird\songbird.exe [5944F9DE4263EA115F7D9C00ACE9E28C]. Type: 8
    Tue 2011-08-09 20:08:21.0682 Monitoring process D:\SongbirdPortable\App\songbird\songbird.exe [5944F9DE4263EA115F7D9C00ACE9E28C]. Type: 6
    Tue 2011-08-09 20:08:22.0162 Monitoring process D:\SongbirdPortable\App\songbird\songbird.exe [5944F9DE4263EA115F7D9C00ACE9E28C]. Type: 2
    Tue 2011-08-09 20:08:38.0981 Monitoring process D:\SongbirdPortable\App\songbird\songbird.exe [5944F9DE4263EA115F7D9C00ACE9E28C]. Type: 3
    Tue 2011-08-09 20:08:38.0981 Monitoring process D:\SongbirdPortable\App\songbird\songbird.exe [5944F9DE4263EA115F7D9C00ACE9E28C]. Type: 4
    Tue 2011-08-09 20:08:38.0981 Monitoring process D:\SongbirdPortable\App\songbird\songbird.exe [5944F9DE4263EA115F7D9C00ACE9E28C]. Type: 5
    Tue 2011-08-09 20:08:38.0982 Monitoring process D:\SongbirdPortable\App\songbird\songbird.exe [5944F9DE4263EA115F7D9C00ACE9E28C]. Type: 7
    Tue 2011-08-09 20:08:38.0983 Monitoring process D:\SongbirdPortable\App\songbird\songbird.exe [5944F9DE4263EA115F7D9C00ACE9E28C]. Type: 8
    Tue 2011-08-09 20:08:38.0984 Monitoring process D:\SongbirdPortable\App\songbird\songbird.exe [5944F9DE4263EA115F7D9C00ACE9E28C]. Type: 6

    Tue 2011-08-09 20:15:34.0523 Monitoring process D:\splayer\splayer.exe [E6940D01C334BB433CB00515BA632541]. Type: 3
    Tue 2011-08-09 20:15:34.0523 Monitoring process D:\splayer\splayer.exe [E6940D01C334BB433CB00515BA632541]. Type: 4
    Tue 2011-08-09 20:15:34.0621 Monitoring process D:\splayer\splayer.exe [E6940D01C334BB433CB00515BA632541]. Type: 8
    Tue 2011-08-09 20:15:34.0621 Monitoring process D:\splayer\splayer.exe [E6940D01C334BB433CB00515BA632541]. Type: 6
    Tue 2011-08-09 20:16:18.0552 Monitoring process D:\splayer\Updater.exe [E72741C1F8C82670D52741982EE3BAA8]. Type: 3
    Tue 2011-08-09 20:16:18.0552 Monitoring process D:\splayer\Updater.exe [E72741C1F8C82670D52741982EE3BAA8]. Type: 4
    Tue 2011-08-09 20:16:18.0592 Monitoring process D:\splayer\Updater.exe [E72741C1F8C82670D52741982EE3BAA8]. Type: 8
    Tue 2011-08-09 20:16:18.0592 Monitoring process D:\splayer\Updater.exe [E72741C1F8C82670D52741982EE3BAA8]. Type: 6
    Tue 2011-08-09 20:16:20.0201 Monitoring process D:\splayer\Updater.exe [E72741C1F8C82670D52741982EE3BAA8]. Type: 2
     
  2. PrevxHelp

    PrevxHelp Former Prevx Moderator

    Joined:
    Sep 14, 2008
    Posts:
    8,242
    Location:
    USA/UK
    The scan log includes debugging information about files that have been seen since the installation. This let's us improve our whitelisting and diagnose issues within WSA. You'll notice the date on the log entries as being from a few days ago, which is why it won't log new entries (as you've removed the files now).

    Hope that helps!
     
  3. Sherlock_Holmes

    Sherlock_Holmes Registered Member

    Joined:
    Mar 21, 2010
    Posts:
    1,449
    Location:
    Mumbai
    The log entries are old i agree but my point is the names of these files appear when i do quick scan even now ... they appear just before wsa connects to webroot database
    have uninstalled it as wrdata folder was getting arnd 500 mb
    will install again later and report back
     
  4. PrevxHelp

    PrevxHelp Former Prevx Moderator

    Joined:
    Sep 14, 2008
    Posts:
    8,242
    Location:
    USA/UK
    These files are probably still registered within the system somewhere, which is why WSA would try to scan them. I wouldn't be worried as the lookup is very quick - it looks for older files as a precaution.
     
  5. vojta

    vojta Registered Member

    Joined:
    Feb 26, 2010
    Posts:
    830
    Hitman Pro and F-Secure, for example, show the same behavior. F-Secure seems to fully scan deleted files, they are still in the hard disk until they are overwritten.
     
  6. Sherlock_Holmes

    Sherlock_Holmes Registered Member

    Joined:
    Mar 21, 2010
    Posts:
    1,449
    Location:
    Mumbai
    i did wipe the free space in d drive with ccleaner and had again done a scan but it was still showing
    anyways have uninstalled and re isntalled wsa as wrdata folder was close to 500 mb
    now these items are not showing up in scan
     
Thread Status:
Not open for further replies.