Comodo AV stalls during scanning [284]

Scans hardly ever finish on all my computers. No crashes, CIS just hangs and sits there. Won’t even respond to Stop Scan button. It hangs at various and different points each time so isn’t a specific file that’s doing it. My systems are all completely clean.

If I turn off the Cloud scanning the scans never hang. Cloud scanning is now turned off for manual and scheduled AV scans.

Mark

Is this a clean or upgrade installation?

Upgrade from v4. Kept cfgx file just as 1000s others did I suppose…

This looks like a bug to me. Are you willing to file a bug report about this?

In case you want to do this there are two ways to go. First we need to know what file(s) are causing the engine to hang. The procedure to determine this is described in How to determine which file is causing a manual scan to hang. You report it could be multiple files causing it to hang. Start with one. When you happen to find other afterwards you can always add them.

Next step is the actual bug report which is described in Bug Reports - CIS board following the format as described in FORMAT & GUIDE - just COPY/PASTE it!.

It would be of great help to Comodo if you would file this.

I’m almost certain this isn’t a case of certain files causing the engine to hang.
These files all passed CIS v3 and v4 previously. The system is totally clean. It happens on 2 computers and different files on them.

CIS doesn’t crash. CPU rates are zero. Disk activity is zero. If I click ‘Stop Scan’ it asks me if I want to stop. I say yes and it then tries to continue not abort - the Stop button going back from disabled grey to normal again. I can’t close the progress dialog. The only way to stop it is to close CIS. The computer then takes ages to turn off and I have to resort to power switch.
It’s as though CIS is waiting for something, that there is an unfinished item somewhere or got into a loop.

The scans stop at different places, and often go past the point of where the previous ‘problem file’ was.
If I manually ask it to check those files they pass OK - no hang.

But crucially the scans all work when Cloud Scanning is turned off - all files pass.

It would help Comodo greatly if you could post a bug report about your findings. We will leave out the part about files causing it to hang.

Would you please consider submitting this as a bug. You can use this topic for the bug report. Once it is complete I will move it to the bug board.

Bug report on its way, just done a scan on laptop, same hang with Cloud Scanning selected, dumps collected.

Mark

Cool. Keep us posted.

The bug/issue

  1. What you did:
    Ran Windows folder Manual AV scan. Switched “Enable Cloud Scanning” on.

  2. What actually happened or you actually saw:
    Scanning stopped after 41469 files at C:\WINDOWS\xobglu32.dll. It’s always a different file!

    cmdagent had 160 outbound connections, left them to clear down.
    CPU at 0-43% changing on every beat of Task Manager. Memory Usage just flickering up and down 12K.
    cfp.exe CPU 0-12%

    When cmdagent outbound connections cleared CPU 0%. Memory cleared down to 1,508K

    cfp.exe still flickering between 0-10%

    Computer still usable, only problem was with CIS.

    Running same and other AV scans with Cloud Scanning OFF always work OK and scans finish.

  3. What you expected to happen or see:
    The scan to finish! ;D

  4. How you tried to fix it & what happened:
    Process Explorer mini-dumps made.

    In Scanning progress dialog, I tried to click on “Stop Scan”. “Are you sure…” dialog appeared, click Yes. “Pause” and “Stop Scan” buttons became disabled grey. Nothing happens. cfp.exe still active CPU 0-10%.

    Click on dialog window close button. “Are you sure…” dialog again appears. Click Yes and “Pause” button disappears. “Stop Scan” button now active again. And so on…

    So Exit CIS and Scanning dialog also exits.

    cfp.exe and cmdagent still in Task Manager but no CPU or memory usage activity.
    Try to start CIS again, a close window click occurs and it doesn’t appear in Task Bar.

    Have to restart computer to get CIS up and running again. On desktop machine closing down Windows takes ages and sometimes I just hit the reboot button

  5. Details (exact version) of any software involved with download link:
    ?

  6. Any other information you think may help us:
    Manual scan on the file above was OK.
    No OS crash minidump was made (OS didn’t crash)
    No CIS dump made.

Files appended

  1. Screenshots illustrating the bug:
    Not necessary

  2. Screenshots of related event logs or the active processes list:
    None

  3. A CIS config report or file.
    None available

  4. Crash or freeze dump file:
    ProcessExplorer mini-dump for cfp.exe and cmdagent.exe and handles list etc. for cmdagent.

Your set-up

  1. CIS version, AV database version & configuration used:
    CIS 5.0.162636.1135 Database: 6290
  2. Whether you imported a configuration, if so from what version:
    Imported cfgx from V4 after upgrade - worked OK with V4
  3. Defense+ and Sandbox OR Firewall security level:
    Defense+ Safe Mode. Sandbox off. Firewall Custom Policy
  4. OS version, service pack, no of bits, UAC setting, & account type:
    2 separate computers, laptop and desktop machines running Windows XP SP3 32-bit up-to-date. Administrator accounts. Systems are clean and always have been.
  5. Other security and utility software running:
    No other security software except router firewall.
  6. Virtual machine used (Please do NOT use Virtual box):
    None

[attachment deleted by admin]

Thanks for the report. I split your posts and moved them to the bug board.

I have one last question for you. I see you are using an imported configuration from v4. Does the same thing also happen when you are using one of the v5 configurations?

Made active standard default CIS Proactive Security profile. Turned off Sandbox.

Set up a manual scan of whole of C: drive on laptop. Made sure Cloud Scanning was on.

Scan stopped at a Quicktime file QuickTimeImageLocalized.qtr after 111775 files. Tried to get mini-dumps from ProcessExplorer but it crashed whilst doing so. Tried closing it in Task Manager but it also crashed. Closing any program crashed. Had to restart system.

Tried again, scan stopped at another QuickTime file QuickTimeH24Lacalized.qtr after 111740 files. Same as above - ProcessExplorer crashes when making mini-dumps. I made sure Defense+ was set up to allow access to CIS memory.

These files passed every other day during normal scans with Cloud Scanning off.

The only thing I could save from ProcessExplorer is attached.

Mark

[attachment deleted by admin]

Sorry process explorer is crashing on you.

A couple of other things to try if you have the patience:

  1. Disable D+ using the slider instead of allowing memory access.
  2. Check what priority process explorer is running at should be 13. If not use process explorer to raise its own priority (programmer was a super bright guy…).
  3. Don’t have a file handle view visible in process explorer when getting minidump (or before at any time during scan)

Best wishes

Mouse

Hi

I forgot to mention that on the second attempt I did disable Defense+ from the task bar thinking I may have got the memory access to CIS wrongly configured the first time.

I had the file handle view visible the very first time with my own CIS profile bug report and that went ok.

I’ll look at it again though.

Mark

Yes the file handle thing is strange one.

You can use it as an alternative approach to identifying the file if you cannot get a dump. Details here.

But I’ve found that with some scanner hangs a sort of loop develops with cmdagent opening more and more handles, and process explorer trying to keep up and using lots of CPU to do so, so slowing down cmdagent, and resulting in long periods being spent seemingly on one file

If the latter is the problem you’ll find the scanner eventually leaps back into life again. In one case that happened after 2 hours for me :slight_smile:

The only other way is manual. Note the directory and scan each file individually with a right click scan. You can speed this up with a binary serachapproach. Scan half the files - no hang its in the other half, hang its in that half. Then scan half the half which hangs etc.

Best wishes

Mouse

Good luck

Failed to get the laptop to hang today using default Proactive profile. ???

Same files present that supposedly caused the hang yesterday.

At one point I noticed 260 outbound connections for cmdagent when going through the QuickTime folder where it hung twice yesterday.

In answer to some of your points - ProcessExplorer was on priority 13 (which is default setting).
I’m sure I had File Handle view when I made the original dumps using my CIS profile.
On several occasions on both computers I had left the hang to clear for a couple of hours to no effect.

In looking at the original bug report it seems to me that it is CFP that is hanging not cmdagent. The latter shows no CPU and disk activity whereas CFP continues to use 0-10% CPU time whilst hung.

I’m not certain it is hanging on a particular file, in other words, that it is the direct effect of scanning a file and that file’s contents that is causing CFP to hang. Why does that file pass a manual scan on it? Why does the scan pass by that file OK today? But most importantly why does having Cloud Scanning off result in no hangs at all and only when I turn it on can I guarantee a hang?

Also, I am wondering if my other topics
https://forums.comodo.com/antivirus-help-cis/why-cloud-udp-in-connection-t62403.0.html
and especially
https://forums.comodo.com/antivirus-help-cis/router-log-entries-from-cloud-t62763.0.html
have anything to do with this?

Mark

Thanks for an excellent report and follow-up analysis

Now forwarding to verified.

Mouse

having a similar problem, but cloud scanning is already turned off for manual & scheduled scans.
v5.0.163652.1142 running on windows server 2008 r2 enterprise x64

it got stuck on a .gif file under C:\windows\winsxs\somefoldername\ with 126,000 files already scanned…
scan duraction 14 hours, lol.

3 big cheers if a future update can make comodo AV recognize and recover from this issue, or fix it 100%

I had the same issue on my Win 7 64 bit machine. Wasn’t using Cloud as this was the prior version of Comodo. It would simply hand at around 160,000 files scanned and CIS would Freeze. Computer would work fine and I could open other programs but I could not get CIS to shut down. It was just stuck in the middle of my screen. Would love to use the program. This was all during summer prior to the new version 2011 being launched. Would love to try the product and use it as I have always loved the Comodo firewall but I’m reluctant to take my Avast Pro off at this point if the new version 2011 will have these same issues.

Hi, I could be totally of track but I was wondering if it could be a temperory cloud server clitche to cause this, because I know this defeats the purpose of the cloud but if you leave cloud enabled but disable internet connection it does not hang. Also if it does hang on a file and I wait a little while and try again it seems ok. Kind regards.

Mine would hang and just do nothing. It would stay that way for hours if I let it. I just don’t want to uninstall Avast to try again if I’m going to have these same problems. I like the Avast product but feel the Comodo will give me better security and much more control over my security settings.