it seems the anti-virus doesn't stop scanning

[Guest]

[Ronny]

What does it display if it "crashes" can you provide a screenshot ?

[Carbofos]

Well, I must've explained it wrong, it doesn't visibly crash, just stop scanning, as described in posts above.

[Ronny]

Can you reproduce this with a manual scan ?

If so are you familiar with the tool Process Monitor ? we could monitor cmdagent.exe with it and see if it "stalls" on the same files/folders every time...

[Carbofos]

I'll try running manual scan with procmon running and post back. The problem is, the scan takes several hours on my laptop, so I'll have to leave it running while I'm off to work.

As for same files/folders, I've tried to manually scan just the folder the scheduled scan stuck on last time and it completed successfully, so I guess the files might not be the cause...

[nssc]

I'm having what looks like the same problem, on an IBM ThinkCentre PC running Windows XP SP3 with 2.5GB RAM and Comodo 3.12.

I've tried several times over the last few days to complete a scan, but after a while (usually just after 40,000 files or so) the program hangs. Event Viewer shows no application errors apart from when I attempt to terminate the program with ProcMon.

[Carbofos]

I've tried to run a manual scan, but another problem came in the way: at some point Windows warned me (for the 1st time ever, I've never seen that warning before) that it's running low on memory and prompted to close some application that apparently used more than others (it wasn't Comodo, according to Process Explorer graph, cmdagent.exe consistently used 100-150MB and always freed up the memory back to around 100MB after a while).

After I've confirmed that, CFP.exe and Procmon.exe crashed with some memory-related message. The problem is that I've started Comodo again, it still seems to scan the files, but I can't get to see the progress window or stop the current scan to restart it...

Update: looks like it's eventually finished scanning, but started over all by itself.

[Ronny]

Please check to see if your running the latest version of procmon and also remember that it's default "backed by pagefile" that means if you leave procmon monitoring long enough your system will drain on memory and this message could appear...

[Carbofos]

Yes, I've figured procmon ate all the memory, but re-run of the scan completed successfully, without stucking, so I guess it won't be easily reproducible...

[DangerousDan]

I've had the anti-virus scan (Display) choke more than once, and no two times did it display the same filename.  I've run three manual scans since the last choike, and they've all completed.  The last time the anti-virus display stopped on a single filename, I let it run for almost 48 hours and it never completed.

[DangerousDan]

It did it again.  The dialog, "Scanning: My Computer (Scheduled)" shows "Status: C:\ooTmp\New Folder\openofficeorg1.cab" [this blinks occasionally, but doesn't change]  Total Objects Scanned: 824614
 Total Threats Found: 0  Duration: 08:28:30 [and counting]

Until I hit the Stop Scan button, Process Monitor showed that it continued to read files:

ReadFile   C:\WINDOWS\system32\cmd.exe   SUCCESS   Offset: 344,064, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O
ReadFile   C:\WINDOWS\system32\cmd.exe   SUCCESS   Offset: 376,832, Length: 11,776, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O
RegOpenKey   HKLM\SYSTEM\Software\Comodo\Firewall Pro\Configurations   SUCCESS   Desired Access: Read   
RegQueryValue   HKLM\SYSTEM\Software\Comodo\Firewall Pro\Configurations\Signature   SUCCESS   Type: REG_QWORD, Length: 8, Data:    
RegCloseKey   HKLM\SYSTEM\Software\Comodo\Firewall Pro\Configurations   SUCCESS
RegOpenKey   HKLM\SYSTEM\Software\Comodo\Firewall Pro\Configurations   SUCCESS   Desired Access: Read
RegQueryValue   HKLM\SYSTEM\Software\Comodo\Firewall Pro\Configurations\Signature   SUCCESS   Type: REG_QWORD, Length: 8, Data:    
ReadFile   C:\Program Files\COMODO\COMODO Internet Security\framework.dll   SUCCESS   Offset: 40,960, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O   
ReadFile   C:\WINDOWS\system32\ntdll.dll   SUCCESS   Offset: 394,240, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O
...

When I hit the Stop Scan button, Process Monitor showed three threads exiting.  Immediately after that, it created a file *java*.js, queried it [standard information file], did something else with it, created it again, queried it again and I don't know what else.  I'd give more information, but the 'X' key is right next to the 'C' key and when you tell Process Monitor <ctrl>X, it clears the display and there doesn't appear to be any way to restore it. ![at]#%& clumsy fingers.

And now, to get that annoying and dishonestly spinning magnifying glass, I'm going to log off of my computer, and if necessary, reboot.

[DangerousDan]

Fortunately, I have a computer with a RESET button.  After logging off of my [non-administrative] windows user account, the login screen was almost completely unresponsive.  I could move the mouse pointer, but could do nothing else.  I must presume that cmdagent.exe, lacking competition, was using all of the processor cycles to do whatever it does when the Virus scanner freezes.

[GarethR]

I have the same problem.  The last 4 or 5 scans I have done (all manual) have hung, so when it happened again last night I uninstalled CIS, reinstalled it and then ran another manual scan, this time just of critical files.
Once again it hung (on the file zapotec.bmp, a Windows desktop image file), which is the same file it hung on last night. I didn't note what it had hung on in previous incidents.
Given the file name (i.e. beginning with 'z'), it makes me wonder whether this is the last file scanned and CIS just doesn't know how to stop.
The most irritating thing is there is no way to stop it as clicking on 'Stop scan' or the red cross brings up the message 'Are you sure you want to stop the scan', I click 'Yes' and nothing happens, it just ploughs on (the 'Duration' figure, that is. The 'Total Objects Scanned' figure doesn't change and nor does the 'Status. That danged magnifying glass carries on going though...).
The only way I can find to stop it is a button press reboot, which I shouldn't have to do.
I am on a Windows XP machine.

[Tags:]