Jump to content
Sign in to follow this  
ptoye

SAS sometimes hangs and gives inconsistent results

Recommended Posts

I'm trialling SAS Free, and am having some problems.

Firstly, it hangs when file scanning. In safe mode this seems to happen when I'm logged into my user account, but not when logged in as Admin. When I tell it to scan the folder that it's hanging in it doesn't hang and reports that it's scanned 2 files, which is odd as there are 4 files (all with the .dat extension) in the folder. I have to use Task Manager to kill it, and then of course there isn't a log file to examine.

Secondly, in safe mode, when I log in as user it finds 5 tracking cookies before it hangs. As Admin it finds a different tracking cookie and 2 purported Trojans (which are odd - they're in a VB .exe file which I wrote myself).

Is SAS meant to get different results for different logins, or have I got a really interestingly nasty piece of malware?

If I run it in normal mode it hangs whatever the login.

I've used another malware scanners and it doesn't find any trojans, by the way.

[Later] Tried again in safe mode logged in as Admin. The first time it exited without giving any log or report. I think it was in the middle of a scan. The next time it completed the scan without hanging. Maybe I've got a duff disk.

Share this post


Link to post
Share on other sites

I'm trialling SAS Free, and am having some problems.

Firstly, it hangs when file scanning. In safe mode this seems to happen when I'm logged into my user account, but not when logged in as Admin. When I tell it to scan the folder that it's hanging in it doesn't hang and reports that it's scanned 2 files, which is odd as there are 4 files (all with the .dat extension) in the folder. I have to use Task Manager to kill it, and then of course there isn't a log file to examine.

Secondly, in safe mode, when I log in as user it finds 5 tracking cookies before it hangs. As Admin it finds a different tracking cookie and 2 purported Trojans (which are odd - they're in a VB .exe file which I wrote myself).

Is SAS meant to get different results for different logins, or have I got a really interestingly nasty piece of malware?

If I run it in normal mode it hangs whatever the login.

I've used another malware scanners and it doesn't find any trojans, by the way.

[Later] Tried again in safe mode logged in as Admin. The first time it exited without giving any log or report. I think it was in the middle of a scan. The next time it completed the scan without hanging. Maybe I've got a duff disk.

1. Be sure that you are trialing the latest version of SAS which is V4.51.1000. If you do not have this version, uninstall SAS and download/install the latest version from https://www.superantispyware.com

2. When you sign on under different accounts, you need to run the SAS updater to obtain the latest definitions for the account that you are signed on under. Unfortunately, the version 4 series of SAS does not update the definitions globally for all accounts. The variation that you are describing sounds like you may not have the latest definitions updated on each of the accounts. In the new V5 of SAS which is soon to be released, the definitions update will be global which corrects this issue.

3. You should submit the two VB.exe files that you wrote and SAS is detecting. These are most like False Positives. Below is a link showing how to submit suspected false positives.

https://www.superantispyware.com/supportfaqdisplay.html?faq=28

4. What version of Windows (include service pack number) are you running?

5. Try running a CHKDSK /r /f on your hard drives to ensure the integrity of the hard drives.

Windows 7 & Vista

http://www.w7forums.com/use-chkdsk-check-disk-t448.html

Windows XP

http://support.microsoft.com/kb/315265

Share this post


Link to post
Share on other sites

1. Be sure that you are trialing the latest version of SAS which is V4.51.1000. If you do not have this version, uninstall SAS and download/install the latest version from https://www.superantispyware.com

2. When you sign on under different accounts, you need to run the SAS updater to obtain the latest definitions for the account that you are signed on under. Unfortunately, the version 4 series of SAS does not update the definitions globally for all accounts. The variation that you are describing sounds like you may not have the latest definitions updated on each of the accounts. In the new V5 of SAS which is soon to be released, the definitions update will be global which corrects this issue.

3. You should submit the two VB.exe files that you wrote and SAS is detecting. These are most like False Positives. Below is a link showing how to submit suspected false positives.

https://www.superantispyware.com/supportfaqdisplay.html?faq=28

4. What version of Windows (include service pack number) are you running?

5. Try running a CHKDSK /r /f on your hard drives to ensure the integrity of the hard drives.

Windows 7 & Vista

http://www.w7forums.com/use-chkdsk-check-disk-t448.html

Windows XP

http://support.microsoft.com/kb/315265

1. The latest version announced itself while I was running the tests - so I updated & started again.

2. I didn't know this. I assumed that the latest version installed itself everywhere. Seems a bit odd to have a computer-based (rather than user-based) tool being user-sensitive. Design problem? Is the updater sensitive to whether I'm in normal or safe mode? Because I tend to run safe mode without networking which makes updating a mite difficult.

3. I'll do this separately.

4. Win 7 home premium SP1

5. My thought entirely - already did it - no problems found.

Thanks for the ideas and help.

But it's the hangs and sudden exits that worry me most.

Share this post


Link to post
Share on other sites
2. I didn't know this. I assumed that the latest version installed itself everywhere. Seems a bit odd to have a computer-based (rather than user-based) tool being user-sensitive. Design problem? Is the updater sensitive to whether I'm in normal or safe mode? Because I tend to run safe mode without networking which makes updating a mite difficult.

I'm referring specifically to the malware definitions updates, not an update that installs a new program version. You should run the SAS updater under your Admin account before you switch to SAFE MODE.

Try this and see if the program still hangs during a scan...both SAFE MODE and Normal Mode.

1. Under Preferences>Scanning Control tab, uncheck the following:

- Use Kernel Direct File Access (recommended)

- Use Kernel Direct Registry Access (recommended)

- Use Direct Disk Access (recommended)

2. Run the scan and see if it completes okay in both SAFE MODE and Normal Mode.

Are you getting any errors pertaining the SuperAntiSpyware in the System Event Viewer? The "sudden exits" cause may be some type of error that will be defined in the Event Viewer.

Share this post


Link to post
Share on other sites

I'm referring specifically to the malware definitions updates, not an update that installs a new program version. You should run the SAS updater under your Admin account before you switch to SAFE MODE.

Try this and see if the program still hangs during a scan...both SAFE MODE and Normal Mode.

1. Under Preferences>Scanning Control tab, uncheck the following:

- Use Kernel Direct File Access (recommended)

- Use Kernel Direct Registry Access (recommended)

- Use Direct Disk Access (recommended)

2. Run the scan and see if it completes okay in both SAFE MODE and Normal Mode.

Are you getting any errors pertaining the SuperAntiSpyware in the System Event Viewer? The "sudden exits" cause may be some type of error that will be defined in the Event Viewer.

Very interesting. Firstly, I made sure that it had the latest definitions. (6908:4720)

1) Then ran in normal mode as Admin. It found one tracking cookie on the C: drive before hanging.

Then booted in Safe mode and logged in as Admin.

2) Ran again - it did a sudden exit. There was nothing in the Event log at that time.

Unchecked all 3 boxes and ran. Same.

3) I went back into Preferences/Options and found that the boxes were ticked, so unticked them again. This time it completed normally with 1 tracking cookie.

4) Ticked just Direct Disk Access. Result as (3)

5) Ticked just Kernel Direct File Access. Result as (3)

6) Ticked just Kernel Direct Registry Access. Result as (3)

7) Ticked all boxes. Result as (3)! At this point I'd used up the entire afternoon (it takes 20 minutes to do a scan) and gave up to do something productive.

8) This morning (UK time) I booted into Safe mode, logged in as Admin, made sure all the boxes were ticked and ran. Same again - it completed without problems.

So now I'm totally confused (as I expect are you). And don't know how to continue, if at all. Any ideas welcome!

Share this post


Link to post
Share on other sites

Very interesting results for sure. :blink:

Does it scan to completion now in Normal Mode with all three boxes checked? The reason I ask this is that one tracking cookie you found. At one point, there was a particular cookie that was causing SAS fits (I do not recall the name of the cookie). At any rate, I assume that you let it remove the cookie. So now does it scan to completion in Normal Mode?

The other option is to submit a Customer Support Request and let the SAS gurus run an analysis of your system to see if that picks up anything weird.

https://www.superantispyware.com/precreateticket.html

OR you could try the new version 5.0.1078 pre-release which has many, many enhancements in it....both in the engines and in the GUI. The version is very near final release so it should run okay on your system. You can download V5.0 from the link below.

https://www.superantispyware.com/sasprereleaselimited.php

Uninstall V4.51 before you install the new V5.0 pre-release.

Share this post


Link to post
Share on other sites

Very interesting results for sure. :blink:

Does it scan to completion now in Normal Mode with all three boxes checked? The reason I ask this is that one tracking cookie you found. At one point, there was a particular cookie that was causing SAS fits (I do not recall the name of the cookie). At any rate, I assume that you let it remove the cookie. So now does it scan to completion in Normal Mode?

The other option is to submit a Customer Support Request and let the SAS gurus run an analysis of your system to see if that picks up anything weird.

https://www.superantispyware.com/precreateticket.html

OR you could try the new version 5.0.1078 pre-release which has many, many enhancements in it....both in the engines and in the GUI. The version is very near final release so it should run okay on your system. You can download V5.0 from the link below.

https://www.superantispyware.com/sasprereleaselimited.php

Uninstall V4.51 before you install the new V5.0 pre-release.

I've been a bit busy recently, and haven't had tme to try scanning until today (by which time, no doubt, other tracking cookies will have infiltrated themselves). Rather worrying - in the middle of the scan in Normal mode (logged in as Admin), SAS stopped working with a Microsoft-generated message:

Problem signature:

Problem Event Name: APPCRASH

Application Name: SUPERAntiSpyware.exe

Application Version: 4.51.0.1000

Application Timestamp: 4daf023f

Fault Module Name: SUPERAntiSpyware.exe

Fault Module Version: 4.51.0.1000

Fault Module Timestamp: 4daf023f

Exception Code: c0000005

Exception Offset: 00000000000512b4

OS Version: 6.1.7601.2.1.0.768.3

Locale ID: 2057

Additional Information 1: 7a94

Additional Information 2: 7a94651b1e2ddd1ff4c4e0be08587722

Additional Information 3: e111

Additional Information 4: e1118dbe9eb111f1aaef37726316bcf7

Read our privacy statement online:

http://go.microsoft.com/fwlink/?linkid=104288&clcid=0x0409

If the online privacy statement is not available, please read our privacy statement offline:

C:\Windows\system32\en-US\erofflps.txt

Share this post


Link to post
Share on other sites

I strongly suspect that either a hardware driver is conflicting with SAS or that you have some program running on your system that has a driver that is conflicting with SAS. Either that or you have a memory problem. Are your hardware drivers up-to-date?

1. Run an indepth memory test as per the link below.

http://windows.microsoft.com/en-US/windows7/Diagnosing-memory-problems-on-your-computer

2. If memory tests show no problems, submit a SAS Customer Support Reguest and let the SAS gurus help isolate the problem. They will probably want the minidump from the application crash so that they can thoroughly analyze what is happening on your system.

http://windows.microsoft.com/en-US/windows7/Diagnosing-memory-problems-on-your-computer

Share this post


Link to post
Share on other sites

I strongly suspect that either a hardware driver is conflicting with SAS or that you have some program running on your system that has a driver that is conflicting with SAS. Either that or you have a memory problem. Are your hardware drivers up-to-date?

1. Run an indepth memory test as per the link below.

http://windows.microsoft.com/en-US/windows7/Diagnosing-memory-problems-on-your-computer

2. If memory tests show no problems, submit a SAS Customer Support Reguest and let the SAS gurus help isolate the problem. They will probably want the minidump from the application crash so that they can thoroughly analyze what is happening on your system.

http://windows.microsoft.com/en-US/windows7/Diagnosing-memory-problems-on-your-computer

Memory test ran OK.

Mouse driver was out of date - updated.

Ran SAS again in normal mode as Admin and it hung again on the same file as before. This is getting silly.

Share this post


Link to post
Share on other sites

Are you running 64 bit windows? What is your configuration?

64 bit Windows Home Premium SP1. 4GB RAM. Intel i5 760 4-processor CPU. What else do you need to know?

Share this post


Link to post
Share on other sites

What is the manufacturer of the computer?

Has the system been running a lot slower lately?

Home-built.

It was taking a long time from booting to being able to use it (about 2 mins sometimes). Since turning off the EFS service it's now usually OK, but once or twice it's been slow. When this happens there's an automatic login and then the desktop comes up OK but mouse clicks don't do anything. Then, after the delay, the mouse clicks all take effect. I think this started happening when I installed SP1 but Microsoft decided to update my keyboard and mouse software at the same time. It was fine before that.

I brought this up on the Microsoft answers forum and they recommended running SAS. Which I'm still trying to do!

It might be a driver taking ages to initialise itself (possibly my Netgear wireless dongle), but it's difficult to separate cause and effect here.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

×