Duncan Mac Leod

Command Line Scanner problems on Windows Server 2012 R2

Recommended Posts

I am using the Command Line Scanner within my Application scanning incoming files in a certain directory. My Application opens a DOS process in which we run the command line scanner, capturing the output and analysing the results (I wrote a little parser for the output).

This worked for the last years without any problems. We use it on three servers, 2 of them are running Windows Server 2008 R2 and 1 server runs on Windows Server 2012 R2.

Since yesterday the 2012 R2 server had problems running the command line scanner, the process hangs and did not finish. The other 2 servers on 2008 R2 are still running without any problems.

I did a reinstall of EMSIsoft on the 2012 R2, the problem still exists. Are there any known problems on 2012 R2 using the Command Line Scanner?

  • Like 1

Share this post


Link to post
Share on other sites

I'm not aware of any problems on Server 2012 R2. What parameters do you pass to a2cmd.exe when executing it? Also, what version of a2cmd.exe are you using?

Share this post


Link to post
Share on other sites

I 've installed the EMSIsoft AV Software for Windows Server (a2cmd.exe is part of it). Downloaded LATEST Version yesterday from your Site to make a reinstall, after I could not fix the problem. After reinstall problems still exist.

Parameters are: /f="<Filename>" /s /pup /a

Please read my posting exactly. My application is running for YEARS without any problems. The problem occured yesterday for the very first time.

A friend of mine who is also running EMSIsoft on a 2012 R2 server told me that he noticed the same 'HANG' of his service (completely different software, not my software) using the scanner.

As I reported in my previous post, our two Win 2008 R2 server are not affected so far.

These 'hangs' started yesterday before MS released their patches and after the patches the situation is still the same.

Share this post


Link to post
Share on other sites
21 hours ago, Duncan Mac Leod said:

Please read my posting exactly. My application is running for YEARS without any problems. The problem occured yesterday for the very first time.

I understand that, but I also need as much information as possible to figure out what's going on.

 

Would it be possible for you to save a memory dump of a2service.exe after the scanner has hung? A memory dump of a2cmd.exe might be handy as well. Be sure to open Emsisoft Anti-Malware, go to the settings, and turn off self-protection before trying to save a memory dump (otherwise it will just cause a freeze). You can use a tool such as Process Hacker to do that. Just find the processes in Process Hacker, right-click on them, and select "Create dump file".

You can ZIP the memory dumps to make them smaller, although they will more than likely exceed the forum attachment limit and need to be sent to us using a file sharing service.

Share this post


Link to post
Share on other sites

Sorry, memory dump not possible as our company has very strict policy for data security. I try to ask a friend of mine for a memory dump as he has exact the same issue on his 2012 R2 server.

Oh, one more thing. My friend send me the file logs.db3 of his system and I am allowed to provide you with that data. If you want it for debugging, please mail me at: ******** and I'll send it to you.

We also found out that using AV scanner in file explorer (selected some files for scanning, right mouse click -> scan with EMSI) hangs EMSI completely (see our screenshot).

This occured on our system and on my friend's system, so I am sure you can reproduce this behavior on every 2012 R2 server. I also assume that this error/behavior is connected to our command line scanner problem.

emsi_error01.jpg
Download Image

Edited by GT500
Removed e-mail address.

Share this post


Link to post
Share on other sites

We recommend not posting e-mail addresses publicly. It's best to send those in a private message so that they don't get picked up by spam bots and scammers. ;)

 

I assume that all of the Win 2012 R2 servers are 64-bit?

 

11 hours ago, Duncan Mac Leod said:

We also found out that using AV scanner in file explorer (selected some files for scanning, right mouse click -> scan with EMSI) hangs EMSI completely (see our screenshot).

That's a known issue, and I would believe reproducible in our own testing, so we should be able to fix that one.

Share this post


Link to post
Share on other sites

If your context-scan hang is the same as mine (affecting W8.1), beta 8572 doesn't have a fix in it.  But the hang is only of 'file explorer' here, and in W8.1 if while the blue spinning thing is spinning I double-click on a desktop shortcut Windows recognises that file explorer is hung and then stops & restarts it.  The desktop vanishes and then comes back and the machine seems fine.   Also, although it's a pain, a 'custom scan' that only looks at one file seems to work.

Share this post


Link to post
Share on other sites
On 4/13/2018 at 4:30 AM, Duncan Mac Leod said:

Any ETA for the fix? Should we switch to Beta-Channel to get the fix asap?

I think we're in the preliminary stages of debugging the issue with the context menu scan, so we don't have a fix available yet. As for ETA's, we don't generally announce ahead of time when new builds or fixes will be ready.

Share this post


Link to post
Share on other sites

Everything seems to work again. No more issues on 2012 R2 servers.

Indeed there is a connection between AV scanner in file explorer (right mouse click on file -> scan) and the Command Line Scanner.

Tested first in file explorer, no more hangs. Then we used the Command Line Scanner, no problems so far.

Thank you for fixing (whatever you did ;-) !).

P.S.: I DID NOT disable self-protection.

Share this post


Link to post
Share on other sites

We did publish an update a couple of days ago to resolve this. It wasn't posted on our changeblog since it was a small update to a single driver, and the product version number wasn't changed.

I'm glad to hear that the update helped. ;)

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now


  • Recently Browsing   0 members

    No registered users viewing this page.