NAV Virus Scan won't complete

I've searched this forum for similar issues but couldn't find any. To save you some reading, the problem is now fixed, it seems, so this is just to solicit any opinions as to what may have caused it.

Using WinXP Home, OE6, NAV 2002 with Mailwasher invoked. When opening mail this morning, I deleted the usual spam and processed the good stuff. With OE open while reading, a new email arrived, not through Mailwasher but direct to my inbasket...no subject, no addressee, only an icon of an envelope. Without thinking, I opened the new email, and all it said was 'test'... and I immediately deleted it. I figured I'd just opened an infected email and checked NAV's log, but there was nothing about it.

Did an update of NAV but was already up to date. Tried a virus scan and the scan hung....kept repeating the attemps and the scan continued to hang, alway at Temp files. Norton wouldn't close unless I hit 'stop scan' but when I did, it kept popping up with a 'serious error' message and said to close it. Occasionally it said it was a script error and so I checked Symantec's suggestions but found no script error fixes which matched those Symantec provided.

Finally, after perhaps a dozen scan attempts, a window pops up to say just uninstall and reinstall, which I did and the problem seems to have resolved itself. After reinstalling the scan completed without problems.

Was this just an unexplained glitch with NAV (there seems to be some issues of unexplained problems with NAV and WinXP), or, was the 'test' email really some sort of virus or trojan?

 

This may be just a WILD guess but it appears that you received one of those Nasties that may disable any AV and/or Firewall software.

I would double check to make sure your Firewall software ( if you have same ) is working correctly.

I would also check out any and all registry ( or what ever ) backups.. That includes Restore Points in Windows ME.

alway at Temp files.

I take that to mean the Tmp Int Files.

If so, CLEAN HOUSE ASAP Cookies and all.

But if it refers to the C:\Windows\temp folder CLEAN HOUSE there also.

I also strongly suggest you get a second opinion from some online AV checker.

BillyBob

 

Here's one thing...

Go into your OE options and turn off the check mail every ____minutes. While you were checking the 1st increment of mails, OE went and got some more. Let Mailwasher do the checking and you will get a chance to delete/bounce before OE gets in the picture.

 

Maybe?

 

Thanks all for your suggestions...

When billybob says to clean house, about all I know how to do is 'delete' cookies, temp files and history, by clicking on the signposts in Tools. Anything more complicated than that, I'm lost.

The 'Temp' file the scan stopped at was in C:\docs & settings\myname\Temp\____ So, when you say: if it refers to the C:\Windows\temp folder CLEAN HOUSE there also, I'm not sure just how to do that.

I should have mentioned in my initial post that when I couldn't get my NAV to scan for viruses, I went to Symantec's site and did a virus check from their website. It scanned fine and no infections were found. However, I don't know how up to date they maintain that free program, and so I didn't take that as proof positive that I was in the clear.

 

doubleu - you could possibly have 2 or even 3 temp folders on your PC.

The personal one you have found under your user folder and the local folder in Docs & Settings.

The one in c:\windows is based on older systems that only have a single temp file. The 9X versions put theirs in c:\windows\temp. NT3/4 put theirs in c:\temp.

You may or may not have a second or third temp folder somewhere. Easiest to open windows explorer and do a search on your system drive for temp and see if you can locate a second one. If so, delete any contents.

 

OOPS !! Sorry !!

I did not wake up to the fact until after I wrote the reply that you had said USING XP. So it may make a difference as to folder name but I believe the idea as a whole may fit.

Also is NAV 2002 completely compatable with XP ? ( just wondering there. )

I also FULLY agree with turning off the Check for Mail every xxx minutes.

BillyBob

 

Seems I have the problem back.

Today after downloading the latest NAV virus updates (successfully, it appears), I attempted another scan and it failed.
(Note: after re-installing NAV2002 yesterday, the scan completed successfully....)

Today I received a pop up message headed: Norton AV Scanner Module, and inside the box was:

Error Signature

AppName: NAVW32.exe
ModVer: 7.0.2600.1106
AppVer: 8.07.17
ModName: msvcrt.dll

As well, I again ran a virus check off Symantic's website, and it ran successfully and found no viruses.

Also, relative to the above....I found some 'temp' files but was reluctant to empty them as they 'seemed' legit...to my untrained eye.

At any rate, does any of this suggest a solution? If not, I'll send it off to Symantic for comment.

 

Housecall

I would suggest another opinion from Housecall.

I am strongly thinking that something exists that is getting reactvated.

Sometimes it may find something the NAV does not.

Especially since it seems that NAV * may not * be working properly.

As to what you find in any TEMP folder. I would suggest sending it to the Recycle Bin and then cleaning out same. Then restart Windows.

I would also suggest getting Ad-Aware ( from Lavasoft ) and Cleaner3 ( from Moosoft ). Then run both to check for Spyware and Trojans.

Also you might give some thought to upgrading to NAV 2003. As I believe there are problems with 2002.

Also do you run the Liveupdate ? That not only updates the deffs but the program itslef.

It updated AV, NIS and deffs this morning for me.

BillyBob

 

Billybob...ran Housecall and came up clean.

I also run Ad-Aware as well as Spybot, and clean up every day.

I used Liveupdate in NAV to download latest updates, prior to attempting the scan.

Doesn't sound like I have a virus, but something's blocking the virus scan......

 

Just a thought which may well be a wild one.

If you have Ad-Aware and are loading the TCMonitor at start up that might cause a problem.

I have had problems with that when running scandisk or defrag.

And even though you stop it from loading it will be re-actvated everytime you update Ad-Aware.

I myself use Startup Cop to control what loads at startup

The problem may be caused by something running in the background.

Other then this I am fresh out of ideas right now.

BillyBob

 

Dunno. I've run the Norton Internet Security Suite 2002 with 2Kpro and now with XP-pro and all is well.

I have not as yet loaded SP1 for XP so can't be sure that won't cause problems but certainly the original XP release for me has been fine on 2 PCs at home and one at work.

 

I have now found the solution to my problem:

By going to Options in NAV, then Manual Scan and unchecking "Scan within compressed files ", the anti-virus scan will run to completion.

 

That is a mistake on my part and I am surprised that no one caught the bad reference in the above.

TCMonitor is part of RegCleaner3 ( Trojan Checker/Cleaner ) not Ad-Aware.

But it will still stop defrag from working and may hang up Scandisk.

BillyBob

 

doubleu

i just (and i do mean just) found that solution myself. i had the exact same problem. figured it was SpyBot .zip files in the Recovery folder. it was the only thing i had loaded on two separate machines that each experienced the same interrupted virus scans.

anyway, i found the remedy in the symantec knowledge base... uncheck "scan within compressed files ". and according to symantec, this does not compromise your system, because compressed files are then scanned when unzipped.

i should add that i think i was incorrect in singling out the SpyBot Recovery files, because tonight i scanned just the SpyBot folder and the scan ran fine.

anyway, i was happy to see that you got your prob fixed up! i'm good once again, too!

regards,



mark

 

... so long as you keep on-access scanning enabled at all times

 

MrMark.....thanks for your note, and especially this:

according to symantec, this does not compromise your system, because compressed files are then scanned when unzipped.

I didn't see this in Sympatec's material and had just fired off a not too pleasant note to them before reading your comments. It makes sense that the scan would happen when the files are unzipped. I'll await Symantec's response while eating humble pie.

 

hi brett

excellent point! thanks for making it, too.

i believe you are referring to auto-protect, correct? i keep it enabled and have it starting when windows starts.

thanks for your input, as always!



mark

 

hi doubleu

i'm going to post links to a couple symantec knowledge base documents that address the prob you and i just experienced. the following note is excerpted from the first link...

"NOTE: Turning off scanning of compressed files is not a risk because Auto-Protect will scan any compressed files again when the files are opened. "

http://service1.symantec.com/SUPPORT/nav.nsf/docid/2001092409093706

and this link is also pertinent and quite informative...

http://service1.symantec.com/SUPPOR...Me/98/XP&base=https://www-secure.symantec.com

i wouldn't worry about it, doubleu. my experience with symantec techs has been that they seldom read what you have written! LOL!

btw, could you tell me if you are running SpyBot or Ad-aware on your machine? since you and i had the same av scanning prob at the same time, i'm still trying to track the cause. i have recently added updates to my machine for both of those programs.

of course, the other more likely cause is the av defs were funky. i use the norton intelligent updater to retrieve defs, and to my knowledge, all has gone smoothly in doing so.

your input is appreciated.



mark

 

MrMark...I'm running both Ad-aware and Spybot, which is likely a redundancy, but I don't mind. Spybot is more aggressive than Ad-aware and seems to find more stuff.

As I don't run a virus check every day, I don't know when my scanning problem started but my suspicions remain with a strange email I received which hung up the AV scan, then forced Norton to abort. The email had no subject or addressee, just an envelope icon. When I stupidly opened it, all it said was 'test'. The next time I ran a virus scan, my scanning problem started. That said, Housecall didn't detect any viruses, so I still have no idea what caused my problem. Clearly, however, its a common problem as Symantec has a fix for it.

To sidetrack a bit, I was having problems with 'doubleclick' and a couple of other sypwares that neither Ad-aware nor Spybot seemed to be able to delete permanently. I even tried putting doubleclick's url in my restricted sites and using wildcards to shut it down, all to no avail. I finally fixed them by installing
this neat little program. I think it was Brett who pointed me to it. At any rate, just an fyi.