JonB 0 Posted December 8, 2020 Report Share Posted December 8, 2020 I was running a custom scan (scan for rootkits/use direct disk access) and about two thirds through I got a notification that "emisoft emergency kit is downloading from onedrive" this is on a windows 10 PC. I tried cancelling but keep getting a message that "cancelling downloads could cause Emisoft Emergency Kit to close" I tried cancelling again and the message just keeps reappearing. Any help/advice would be appreciated. I do have a backup copy of the program folder for Emergency Kit on Onedrive. Blocking the app doesn't stop the notifications. EEK 2020.5.1.10518 Free Version Processor Intel(R) Core(TM) i5-4460 CPU @ 3.20GHz 3.20 GHz Installed RAM 8.00 GB System type 64-bit operating system, x64-based processor Edition Windows 10 Home Version 20H2 Installed on 10/29/2020 OS build 19042.662 Experience Windows Feature Experience Pack 120.2212.551.0 Security Software: Norton Security Online & Malwarebytes Pro Macrium Reflect for backup Quote Link to post Share on other sites
GT500 860 Posted December 8, 2020 Report Share Posted December 8, 2020 Do you have a folder on OneDrive configured as a drive in Windows? Quote Link to post Share on other sites
JonB 0 Posted December 8, 2020 Author Report Share Posted December 8, 2020 Hi, I don't have any folder configured as you describe. Some more information: After I posted last night, which was while this was happening, I tried again to cancel the download and my computer froze for a couple minutes with the taskbar going blank. I think I had stopped the scan and closed EEK by then. Also there were five files attempting to download totaled at 4.00 MG although they didn't seem to actually download. I also said in the first post that the notice appeared when the scan was about two thirds finished but in retrospect that is when I saw the notice, I can't say for sure when it actually occurred. After the computer became responsive again I did a restore with Macrium Reflect. I have to admit this kind of rattled me. It felt like I had a program, a security one at that, going rogue. I tried uploading a picture I took with my phone, (I'm embarrassed to say I didn't know how to do a screenshot), of the notification but it isn't working. Thank-you. Quote Link to post Share on other sites
JeremyNicoll 78 Posted December 8, 2020 Report Share Posted December 8, 2020 You say you've got Norton Security, and also Malwarebytes Pro. Are either / both of those configured to do real-time protection? Was the notification (about EEK downloading from Onedrive) from one of those, or from EEK? Quote Link to post Share on other sites
JonB 0 Posted December 8, 2020 Author Report Share Posted December 8, 2020 They both have real time protection. Sorry, I just realized I didn't say where the notification was from. The notification about EEK was from Windows. Quote Link to post Share on other sites
GT500 860 Posted December 9, 2020 Report Share Posted December 9, 2020 The freeze could have happened due to the security software with real-time protection. Adding exclusions to them for EEK may help prevent that. As for the OneDrive issue, I'll ask QA if there are any known instances where EEK will try to scan files that are stored on OneDrive. Quote Link to post Share on other sites
JonB 0 Posted December 9, 2020 Author Report Share Posted December 9, 2020 Sounds good and thank-you. It's a pretty weird problem, I have to admit. I don't know if it matters or would be helpful but I've tried a couple times to upload the picture I took of the notification but have not had any success. Thanks again. Quote Link to post Share on other sites
JonB 0 Posted December 9, 2020 Author Report Share Posted December 9, 2020 Here is a copy of the scan results for the scan in question. I have the OneDrive folder installed on my D:\ drive and as I mentioned I have the EEK install folder backed up there along with some other rootkit/malware scanners: Emsisoft Emergency Kit - Version 2020.5 Last update: 12/1/2020 3:51:38 PM XXXXXXX Windows 10x64 Scan settings: Scan type: Custom Scan Objects: Rootkits, C:\, D:\, E:\ Detect PUPs: OFF Scan archives: OFF Scan mail archives: OFF ADS Scan: OFF Direct disk access: ON Scan start: 12/7/2020 3:24:26 PM Scanned 401708 Found 0 Scan end: 12/7/2020 5:38:18 PM Scan time: 2:13:52 Quote Link to post Share on other sites
stapp 152 Posted December 9, 2020 Report Share Posted December 9, 2020 13 minutes ago, JonB said: Sounds good and thank-you. It's a pretty weird problem, I have to admit. I don't know if it matters or would be helpful but I've tried a couple times to upload the picture I took of the notification but have not had any success. Thanks again. Did you try zipping the file before uploading it? Quote Link to post Share on other sites
JonB 0 Posted December 9, 2020 Author Report Share Posted December 9, 2020 No, it's only 3.13 MB but I tried again just now after zipping it and it still fails. Quote Link to post Share on other sites
GT500 860 Posted December 9, 2020 Report Share Posted December 9, 2020 When you run your Custom Scan, select drive D:\ from the list, and click the button to remove it. That way your OneDrive folder won't be scanned. Quote Link to post Share on other sites
GT500 860 Posted December 9, 2020 Report Share Posted December 9, 2020 7 hours ago, JonB said: I don't know if it matters or would be helpful but I've tried a couple times to upload the picture I took of the notification but have not had any success. Some ad blockers can cause trouble with attachments on the forums. If you have an ad blocker (uBlock Origin, Adguard, Adblock Plus, etc) then try disabling it and then refreshing the page before attaching files (make sure to copy anything you write in the reply field before refreshing the page in case the forums didn't autosave it). Quote Link to post Share on other sites
JonB 0 Posted December 9, 2020 Author Report Share Posted December 9, 2020 I've tried disabling my ad blocker and using a different browser. I even tried using my ipad but no luck still. Every time I get a white rectangle pop up that has a black triangle with an exclamation sign in it and next to that the number -200. This is what shows under Uploaded images: Upload Failed 20201207_175300.jpg 3.1 mb · Upload Failed Quote Link to post Share on other sites
stapp 152 Posted December 9, 2020 Report Share Posted December 9, 2020 Is that error from today? I only ask as it shows the wrong date for today. Quote Link to post Share on other sites
JonB 0 Posted December 9, 2020 Author Report Share Posted December 9, 2020 7 minutes ago, stapp said: Is that error from today? I only ask as it shows the wrong date for today. Sorry, not sure what error you mean. Quote Link to post Share on other sites
JeremyNicoll 78 Posted December 9, 2020 Report Share Posted December 9, 2020 I think Stapp means the jpg name, dated two days ago. Quote Link to post Share on other sites
JonB 0 Posted December 9, 2020 Author Report Share Posted December 9, 2020 Yes the picture is the one I've been trying to upload for two days without success. It shows the windows notification about EEK trying to download files from OneDrive. Quote Link to post Share on other sites
JeremyNicoll 78 Posted December 9, 2020 Report Share Posted December 9, 2020 Can't you put the picture somewhere - Onedrive for example (which I know nothing about but assume it's like Dropbox and that you can get a URL that points to a single file)? - and give us the URL to that file? Or put it on a picture upload site (assuming there's nothing confidential in the picture) and give us that URL. Quote Link to post Share on other sites
JonB 0 Posted December 9, 2020 Author Report Share Posted December 9, 2020 I'll try sharing from OneDrive. Quote Link to post Share on other sites
JonB 0 Posted December 9, 2020 Author Report Share Posted December 9, 2020 Here's the link to the image: https://1drv.ms/u/s!AsDzuI0IUwuoiJNJ5X9YF3mhpNdSgQ?e=xELXU6 Quote Link to post Share on other sites
GT500 860 Posted December 10, 2020 Report Share Posted December 10, 2020 Did removing the D:\ drive from the Custom Scan settings before scanning help? Quote Link to post Share on other sites
JeremyNicoll 78 Posted December 10, 2020 Report Share Posted December 10, 2020 It seems to be normal that apps that want to open files (stored online only on any cloud provider's service) will trigger a download. That's reasonable, because how else can an app use such a file? According to: https://www.tenforums.com/tutorials/101977-allow-block-automatic-file-downloads-apps-windows-10-a.html option three, you can disable this per-app. That might be useful while Emsisoft work out whether there's a way to prevent EEK from trying to open such files. Quote Link to post Share on other sites
JonB 0 Posted December 10, 2020 Author Report Share Posted December 10, 2020 13 hours ago, GT500 said: Did removing the D:\ drive from the Custom Scan settings before scanning help? Yes. Just finished scanning C:\ & E:\ drives only with no issues. Quote Link to post Share on other sites
GT500 860 Posted December 11, 2020 Report Share Posted December 11, 2020 9 hours ago, JonB said: Yes. Just finished scanning C:\ & E:\ drives only with no issues. OK, that's what I was expecting. Just note that if EEK scans files that are on OneDrive, you'll see that notification from Windows, as the files need to be downloaded to be scanned. Quote Link to post Share on other sites
JonB 0 Posted December 11, 2020 Author Report Share Posted December 11, 2020 22 minutes ago, GT500 said: OK, that's what I was expecting. Just note that if EEK scans files that are on OneDrive, you'll see that notification from Windows, as the files need to be downloaded to be scanned. That's good to know and makes sense now. Guess I was being a bit paranoid. I really appreciate everyone's help. Thank-you all. Quote Link to post Share on other sites
GT500 860 Posted December 12, 2020 Report Share Posted December 12, 2020 You're welcome. Quote Link to post Share on other sites
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.