2 Replies Latest reply on Aug 10, 2011 3:35 AM by APB

    Problems with OAS locking Explorer

      Hi all,

       

      I'm getting problems with VSE 8.8 timing out while scanning files using OAS.   When the timeout occurs the PC become unresponsive to anything using Explorer.exe (start menu,accessing explorer windows),  but TaskManager can still be opened and shows no excessive CPU (typically <10%,McShield peaking to 50% briefly), RAM usage (1GB in use, 1GB free, McShieldusing 42MB), disk activity is not constant (several seconds gap between readsby watching the disk activity light).    Other applications such as Word and browsers behave as normal.

       

      In the OnAccessScanLog.txt I get this sort of error message:

       

      09/08/2011     12:33:26          Not scanned  (scan timed out)           <Domain>\<Username>     C:\WINDOWS\Explorer.EXE    C:\AVTest\testexe\iview428_setup.exe         none (Virus)

      09/08/2011     12:34:18          Not scanned  (scan timed out)           <Domain>\<Username>     C:\WINDOWS\Explorer.EXE    C:\AVTest\testzips\help_epo_460.zip            none (Virus)

       

      The file sizes are 1.4MB for the .exe, 21MB forhelp_epo_460.zip and note that I have turned off scanning inside .zip files.

       

      I can repeat the problem by just opening  the appropriate folder after 10 minutes or so since the last time it was accessed, any shorter than that and it appears not to scan the file again.   I have multiple folders with these files (for testing this problem) and opening each folder in Explorer will cause the timeout.    These are not the only files that cause the problem just some that were in the folder where I first spotted the problem.   Other.exe & .zip files don’t cause this problem and at the moment I can’t tell what the difference between those that do and those that don't.

       

      The timeout will cause Explorer not to work for about 1min 15secs so is pretty significant.

      I’m able to replicate this on 2 systems so far but not a third and get the problem on different DATs (6426, 6431, 6432).

       

      I'm running ePO 4.6, Agent 4.6.0.1694, VSE 8.8.0.777 and engine 8400.1158.  

       

      Anyone have any thoughts?    Excluding the files isn't really an option as I can't (yet) determine every file that causes the lock - for example every .ePO/VSE product zip file I've checked causes the problem.

       

      Thanks,

       

      Adrian.

        • 1. Re: Problems with OAS locking Explorer
          Katalyst

          Hi Adrian,

           

          In your VSE 8.8 "On-Access General Policy", what is your maximum scan time set to?

           

          If you don't have this option enabled and defined, it can cause some issues whilst trying to perform OAS on some files.

          • 2. Re: Problems with OAS locking Explorer

            Hi Katalyst,

             

            It's enabled and at the default of 45 seconds.   I guess that potentially this could be taken down to 5 seconds as the only files that should take that long to scan are going to be large zip files which I don't scan until they are unpacked anyway.

             

            I ran a full on-demand scan of the drive last night and no timeouts came up in the on-demand scan, I'll do more tests later today.

             

            Thanks,

             

            Adrian.