Sporadic data corruption on large downloads

Discussion in 'ESET NOD32 Antivirus' started by bcronin, Oct 18, 2012.

Thread Status:
Not open for further replies.
  1. bcronin

    bcronin Registered Member

    Joined:
    Jun 24, 2004
    Posts:
    105
    Location:
    Hyde Park, NY USA
    I have extremely solid evidence that there is a defect in nod32 (v5 and v6beta) protocol filtering. When it is on, better than 50% of the daily downloads that I do of large video podcasts end up corrupted (unable to play all the way through in Windows Media Player). With it off, it doesn't happen.

    I studied the nature of the corruption by re-downloading a corrupted file until I got a copy that played through to the end with no problem. Then I compared the two (byte by byte). The bad file was exactly 8,192 bytes shorter than the good one. Further, the two files were identical up to a specific offset (call it X, about halfway through the nearly 1GB file). At that point there was an 8K block of data in the good file that was not in the bad. After that point, the data in the good file exactly matched the remaining data in the bad file after offset X. The bottom line is an 8K block of data got lost somewhere.

    This happens more frequently the larger the file is (though I have observed it affecting smaller files as well, just not as often).

    This all began happening sometime within the last month or so. Prior to that I had never had any unplayable video files in over several years of downloads.

    How can I help to collect diagnostic information that Eset can use to help find and fix this problem?
    --
    bc
     
  2. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    Coulnd't it be this case?
     
  3. bcronin

    bcronin Registered Member

    Joined:
    Jun 24, 2004
    Posts:
    105
    Location:
    Hyde Park, NY USA
    Sure sounds like it. Is there a workaround?
    --
    bc
     
  4. bcronin

    bcronin Registered Member

    Joined:
    Jun 24, 2004
    Posts:
    105
    Location:
    Hyde Park, NY USA
    Oh, so now i see this wasn't a Windows Update, but a hotfix that I would have had to specifically apply. I did not do that. So, unless the fix was integrated into a Windows Update that I did apply, this is probably not it (but it sure sounds similar).
    --
    bc
     
  5. bcronin

    bcronin Registered Member

    Joined:
    Jun 24, 2004
    Posts:
    105
    Location:
    Hyde Park, NY USA
    Further searching revealed this was indeed issued as a Windows Update on 12 Sep 2012 (right about the time I noticed the corrupted video downloads). Sigh. Thanks MS.

    I've disabled the http protocol filter and the problem is gone. Is this the recommended workaround? Do you have any confidence that MS will fix this? I am uncomfortable running without the http filter ...
    --
    bc
     
  6. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    Disabling HTTP filtering is not safe, I'd prefer uninstalling the problematic hotfix until MS comes up with a solution.
     
  7. bcronin

    bcronin Registered Member

    Joined:
    Jun 24, 2004
    Posts:
    105
    Location:
    Hyde Park, NY USA
    Oh, I saw some discussion that implied the hotfix could not easily be uninstalled. You're saying it can?
    --
    bc
     
Thread Status:
Not open for further replies.