Jump to content

ebloch

Members
  • Content Count

    29
  • Joined

  • Last visited

  • Days Won

    2

ebloch last won the day on September 29 2017

ebloch had the most liked content!

Community Reputation

4 Neutral

About ebloch

  • Rank
    Immunet Insiders

Profile Information

  • Gender
    Not Telling
  1. With ClamAV OFF and D:/ excluded completed scan in 130.2 minutes. 179GB less but same time!! Now more confused because that would indicate BOTH F and D are the problem. Next run will be full scan without major exclusion, i.e., the original setup without ClamAV.
  2. Scan still with Immunet 7.4.4.20633 ClamAV OFF and F:\ excluded successful at 130.9 minutes.Next run will be with D:\ excluded. C:\ 465GB SSD with 178 GB Used D:\ 472GB on 1TB HDD with 103GB used F:\ 458GB on 1TB HDD with 282GB used
  3. Had to catch a plane Wed.Nov 10 and did not have time to make a report. Both ClamAV Engine and Update were set to "OFF" and the can failed at a similar time. I do not set complete AV scanner folders to be skipped because that would be an easy choice for bad guys to place a virus but I do have each scanner set to ignore the other's quarantine folders. I am going to try and narrow down the error by using File Exclusions of big chunks of data. My C:\ is an SSD with a 1TB spinner split into D:\ and F:\. Next scan will have F:\ excluded. I note that all other exclusions are on C:\.
  4. My exclusions always include Quarantine folders for the other scanners. Not blanket exclusions for all items for each scanner because that would be an easy choice for a "bad actor". I also looked at the "C:\Program Files\Immunet\7.4.4.20633\sfc.exe.log" which is full of error reports with some as information only and a few forcing an exit. Many entries I do not understand because they are comments that a file does not exist but I checked a few and they existed. I use Win 10 Pro 64 bit so maybe errors are from 32 bit or non-pro. If you are using Windows 10 please tell me your Dates Created and Modified for the following which were referenced in Event Logs.: C:\WINDOWS\SYSTEM32\ntdll.dll Created & Modified 03/30/21 C:\WINDOWS\SYSTEM32\ ucrtbase.dll Created & Modified 02/17/21
  5. Did the following: Uninstall Immunet. Deleted one remaining Immunet folder and contents. RegEdit -search for all Immunet items and deleted them (Some from old versions). Rebooted. Installed fresh Immunet download. Added Exclusions for Ad-Aware, Malwarebytes, and Defender Quarantine folders. Overnight batch ran Immunet but still had following error report: Faulting application name: sfc.exe, version: 7.4.4.20633, time stamp: 0x60f78ab4 Faulting module name: ntdll.dll, version: 10.0.19041.844, time stamp: 0x60a6ca36 Exception code: 0xc0000028 Fault offset: 0x0000000000102136 Faulting process id: 0x3bb0 Faulting application start time: 0x01d7d06806b08190 Faulting application path: C:\Program Files\Immunet\7.4.4.20633\sfc.exe Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll << last error was ucrtbase.dll Report Id: 5933cd0d-e5a7-4292-8678-3a784e5f691d
  6. Everything enabled except "Blocking Mode", " Allow Definition Updates", and "Scan Archive Files". I run a daily early evening batch to update definitions for Ad-Aware, Immunet, and MS Windows Defender..Malwarebytes updates before each scan and not by command. Defender with Malwarebytes are my basic defenses and are deactivated during the once a week scans with the others. An Immunet "Full Scan", when it completes, takes 5 to 6 hours so I do not want to run one except by unattended overnight batch. My experience with "Flash Scan" is that they only take minutes AND DO NOT have the error like "Full Scan". This leads me to a question: My Immunet "Exclusions" only list "C:\Program Files\Immunet" and "C:\Program Files\Cisco\Immunet\UC" that I think are Immunet related. BUT I do not have "C:\Program Files\Cisco\Immunet\UC" on my system: DO YOU? My system does have "C:\ProgramData\Cisco" which only contains a "UC uninstall" text file.
  7. I agree, probably a synced file but helpful since info is there. Today's scan exited with an error about half way thru or three hours short similar to previous weeks. I just scanned "Event Viewer - Windows Logs - Application" and last complete run appears to be 09/08/21. SFC error on all runs since then. I will uninstall, cleanup, reboot, and reinstall with fingers crossed.
  8. Small font not intentional. In fact I thought I was using larger than the default. I think I found the Exclusion list in "C:\Program Files\Immunet\local.xml" Examining in Notepad++ the file includes Exclusions in lines starting with <item>256|2|0|0| and <item>256|2|1|0| so added the file to my backup
  9. I do not know how one can find out what attempted to access the old folder contents just that the Windows last access date was current, The version comment was just that Immunet has changed the format of version numbers used in "C:\Program Files\Immunet\". That required a change to a batch I made to place the current version number of Immunet into a variable for later processing. I run an unattended overnight batch which, after some maintenance and data backup, initiates a scan by Ad-Aware, Malwarebytes, Immunet, or MS Security Essentials. Immunet every Wednesday early AM so will see what happens soon. If still a problem will go thru uninstall, clear all Immunet references I can find, reboot, and reinstall from a fresh download. Do you know the location of Immunet's Exclusion data? I would like to include it in my backups but now can only use a manual screen copy since I do not know the file name.
  10. I found something interesting which I will try BEFORE uninstall. Looking in "C:\Program Files\Immunet\" I find many folders from old versions with ".exe" flies which have been converted to documents (.txt). but are still showing as ".exe" AND with the same name as true ".exe" applications in the current version folder. All of these older version items show a "Date Recent;y Accessed" with current dates which I think may be a problem because it means Windows has attempted to run them by extension and found them not to be applications to run. I will delete all of these old version folders and see if that fixes the problem. Also note that the latest Immunet version 7.4.4.20633 has changed from previous n.n.n version number system.
  11. Problem has been for a while and I was watching this thread hoping for further info. Thanks for trying but but have already tried uninstall and "clean" install. Also looked at firewall and even tried bypassing it but same problem. Previous versions, but I do not remember how far back, worked with proper "non-error" completion. As you can see in attached Windows Event log it appears to be an SFC "dll" problem. Looking at suggestions in <https://www.minitool.com/news/0xc0000409.html> I am going to uninstall Immunet and do a Registry search for left overs and then reinstall. Will add results here.
  12. Win 10 Pro 64 bit [Version 10.0.19041.867] Immunet 7.4.420633 I am getting the same error but after some scan time with one threat Detected and Removed. I think that the scan was about half complete. Attached Immunet GUI image as stopped and System error report txt Immunet Error 10 20 21.txt
  13. I understand what you are suggesting but if a "bad operator" installs Immunet on his machine he knows this info and should be able to then deposit his payload someplace in that folder and it is then safe from scanning. That is also the problem Nirsoft and any other program that uses "hacking" like programs. For Nirsoft's programs I installed them on a USB stick and only placed the few apps I call from my batch on my HD and add them as exclusions.
  14. I would like to know the folder location that Immunet uses for quarantined files so that I can add that folder as an exclusion for other scan programs. Win 7 64bit Immunet 6.5.0 The reason is that I run an unattended overnight batch doing back ups and other housekeeping and then on different nights runs scans using Immunet, Windows Defender, or AdAware. I would like to place each scanners quarantine folder as an exclusion in the other scanners.
×
×
  • Create New...