[04466702] Problems with PSANHost.exe stopping partway through scan using Panda AV Pro

Post your query about Panda Global Protection, Panda Internet Security and Panda Gold Protection here!
User avatar
PandaSupport1
Official moderator
Official moderator
Posts: 517
Joined: Mon, 02 Apr 2012, 18:34
Location: PSI Headquarters

Re: [04466702] Problems with PSANHost.exe stopping partway through scan using Panda AV Pro

Post by PandaSupport1 » Wed, 18 Jan 2017, 10:45

Good morning,

I have your hotmail e-mail adress, so i will ask you about the remote session through email and we will continue using this communication tool.

Thanks for your help.
Regards,

Image
Alberto Domínguez
TechSupport Department - Panda Security

I don't reply to private messages unless I have previously requested them

acorne6184
Registered user
Registered user
Posts: 20
Joined: Fri, 16 Dec 2016, 00:03

Re: [04466702] Problems with PSANHost.exe stopping partway through scan using Panda AV Pro

Post by acorne6184 » Tue, 24 Jan 2017, 06:39

Following up on our 1/23/17 remote session: Attempted to run Panda AV Custom scan on single folder on external drive connected to my machine via USB.

1) Launched Windbg.

2) Started Panda AV Custom scan on single folder on external drive connected to my machine via USB.

3) Attempted to attach to PSANHost.exe process by pressing F6 in Windbg and choosing PSANHost.exe process. Windbg prevented this; the dialog box "Access is Denied" appeared.

4) Attempted to attach to PSUAMain.exe process. This was successful.

5) In Windbg, clicked on Debug > Go. Scan resumed successfully.

Results:

1) After 305,000 files were scanned, Windbg's Active services dialog detection generated a dump on PSANHost.exe after AV scan reached 36% progress, and no more. Saved dump using command string ".dump /f /ma c:\panda\[filename].dmp". Dump file from Active services dialog detection (17-01-23_Panda_PSANHost.dmp) is on Dropbox site:

https://www.dropbox.com/sh/0uqkt427ccsb ... 7-Q7a?dl=0

2) PSUAMain.exe continued to run in the Windbg session that had the PSUAMain.exe process attached.

3) Cancelled Custom scan. Panda AV opened dialog box "Unexpected Error. Error Code 1". Clicked to close dialog box.

4) Panda AV subsequently opened another dialog box asking if I want to cancel the scan. Clicked OK to close dialog box.

5) PSUAMain.exe stopped running in the Windbg session that had the PSUAMain.exe process attached.

6) Saved Windbg session for attached process PSUAMain.exe using command string ".dump /f /ma c:\panda\17-01-23_Panda_PSUAMain.dmp". Uploaded dump file "17-01-23_Panda_PSUAMain.dmp" to the same Dropbox site.

Let me know if you need more information. If you need to start another remote session, we can coordinate this via my Hotmail account.

User avatar
VirusBuster
Official moderator
Official moderator
Posts: 7596
Joined: Mon, 02 Apr 2012, 18:53
Location: Panda HQ - Bilbao

Re: [04466702] Problems with PSANHost.exe stopping partway through scan using Panda AV Pro

Post by VirusBuster » Tue, 24 Jan 2017, 11:45

My colleague Alberto already replied to you last email
If you were unable to attach to PSANHost is because WinDbg needs to be run as Administrator, sorry, we forgot to mention that

I see that you already replied to his email and are already running the scan with Windbg being attached to PSANHost.exe so we'll wait for the dump
Regards,

Image
Jorge Torre
TechSupport Department - Panda Security

I don't reply to private messages unless I have previously requested them

acorne6184
Registered user
Registered user
Posts: 20
Joined: Fri, 16 Dec 2016, 00:03

Re: [04466702] Problems with PSANHost.exe stopping partway through scan using Panda AV Pro

Post by acorne6184 » Tue, 24 Jan 2017, 20:28

I did hear from Alberto after my previous post. I repeated the steps after running Windbg as Administrator. That allowed me to successfully attach PSANHost.exe as a process and generate a dump file (17-01-24_Panda_PSANHost.dmp). I've posted it to the following Dropbox site:

https://www.dropbox.com/sh/0uqkt427ccsb ... 7-Q7a?dl=0

Let me know if you need anything else for your research on this issue.

User avatar
VirusBuster
Official moderator
Official moderator
Posts: 7596
Joined: Mon, 02 Apr 2012, 18:53
Location: Panda HQ - Bilbao

Re: [04466702] Problems with PSANHost.exe stopping partway through scan using Panda AV Pro

Post by VirusBuster » Wed, 25 Jan 2017, 15:28

Thank you, we have downloaded the dump and are stuying it
Regards,

Image
Jorge Torre
TechSupport Department - Panda Security

I don't reply to private messages unless I have previously requested them

acorne6184
Registered user
Registered user
Posts: 20
Joined: Fri, 16 Dec 2016, 00:03

Re: [04466702] Problems with PSANHost.exe stopping partway through scan using Panda AV Pro

Post by acorne6184 » Thu, 26 Jan 2017, 09:58

Re-ran the Panda AV Custom scan on the same Backup set on a remote drive connected to my machine via USB. Here are the results:

Custom Scan 1: Crashed at 1% with 68,873 files scanned. This is the first time that it crashed on the scan of this folder with less than 305,000 files scanned. Crash saved using commands previously provided as "17-01-25a_Panda_PSANHost.dmp".

Custom Scan 2: Crashed at at 36% with 305,000 files scanned, as has been reproduced previously. Crash saved using commands previously provided as "17-01-25b_Panda_PSANHost.dmp".

Both .dmp files have been zipped together as "17-01-25_Panda_PSANHost.zip", which has been uploaded to the following Dropbox site:

https://www.dropbox.com/sh/0uqkt427ccsb ... 7-Q7a?dl=0

Folder from "C:\Users\[username]\AppData\Local\Mozilla\Firefox\Profiles\" has also been zipped and uploaded to this Dropbox site. It's not the file that you specifically saw in the previous dump I provided you, but if the latest scan crashed on a Firefox\Profiles folder (the dump of which is currently on the Dropbox site), this was the only subfolder in that Profiles folder. Should give you something to start with this morning.

Both of these zipped folders are protected using the same password I provided in my most recent e-mail to Jorge in your support department.

Let me know what you find out.
Last edited by acorne6184 on Fri, 27 Jan 2017, 01:22, edited 1 time in total.

User avatar
VirusBuster
Official moderator
Official moderator
Posts: 7596
Joined: Mon, 02 Apr 2012, 18:53
Location: Panda HQ - Bilbao

Re: [04466702] Problems with PSANHost.exe stopping partway through scan using Panda AV Pro

Post by VirusBuster » Thu, 26 Jan 2017, 17:13

Hi

A correction ror memory overlaps when scanning certain files has been published.
This issue should be corrected with the next signature update/synchronization.
Regards,

Image
Jorge Torre
TechSupport Department - Panda Security

I don't reply to private messages unless I have previously requested them

acorne6184
Registered user
Registered user
Posts: 20
Joined: Fri, 16 Dec 2016, 00:03

Re: [04466702] Problems with PSANHost.exe stopping partway through scan using Panda AV Pro

Post by acorne6184 » Fri, 27 Jan 2017, 07:06

After today's signature update/synchronization, it looks like the issue is still consistently reproducible.

I successfully performed a manual synchronization of Panda AV protection (from "Settings>General>Automatic Updates") at 8:25 AM PT on 1/26/2017 to update the signatures. Re-ran the Panda AV Custom scan on the same Backup set on a remote drive connected to my machine via USB. Here are the results:

Custom Scan 1: Crashed at 20% with 131,820 files scanned. This is the second time that it crashed on the scan of this folder with less than 305,000 files scanned. The crash was saved using commands previously provided as "17-01-26a_Panda_PSANHost.dmp". After dump was saved and Windbg closed, Panda AV Pro indicated it was disabled, and eventually re-enabled itself.

Rebooted machine and re-ran the Panda AV Custom scan on the same Backup set on a remote drive connected to my machine via USB. Here are the results:

Custom Scan 2: Crashed at at 36% with 305,000 files scanned, as has been reproduced previously. Crash saved using commands previously provided as "17-01-26b_Panda_PSANHost.dmp". After the dump file was created and the scan cancelled, Panda AV was disabled, and had to be re-enabled manually (thogh I may have re-enabled it before it had a chance to do it itself).

Both .dmp files have been zipped together as password-protected file "17-01-26_Panda_PSANHost.zip", which has been uploaded to the following Dropbox site:

https://www.dropbox.com/sh/0uqkt427ccsb ... 7-Q7a?dl=0

The password is the same as on the last compressed files. Let me know the next steps.

User avatar
VirusBuster
Official moderator
Official moderator
Posts: 7596
Joined: Mon, 02 Apr 2012, 18:53
Location: Panda HQ - Bilbao

Re: [04466702] Problems with PSANHost.exe stopping partway through scan using Panda AV Pro

Post by VirusBuster » Mon, 30 Jan 2017, 13:58

Could you try the new 18.0.0 version?
These new 18.0.0 versions can't be activated with your previous 2016/2017 codes, thats why I'm providing you the link for the Free version
You can download it from here
Regards,

Image
Jorge Torre
TechSupport Department - Panda Security

I don't reply to private messages unless I have previously requested them

acorne6184
Registered user
Registered user
Posts: 20
Joined: Fri, 16 Dec 2016, 00:03

Re: [04466702] Problems with PSANHost.exe stopping partway through scan using Panda AV Pro

Post by acorne6184 » Tue, 31 Jan 2017, 04:23

The issue is still reproducible using Panda AV Free 18.0.0:

1) Rebooted.

2) Uninstalled the following products:
a) Panda AV Pro 17.0.1.
b) Panda Safe Web 4.3.
c) Panda URL Filtering.

3) Rebooted.

4) Installed Panda AV Free 18.0.0 and Panda Safe Web simultaneously.

5) Rebooted.

6) Launched Windbg.

7) Launched Panda AV Free 18.0.0 console:
a) Ran manual update; Verified that Panda AV Free 18.0.0 had the latest definitions.
b) Ensured settings were the same as Panda AV Pro 17.0.1: Turned Scan Compressed Files on for on-demand Scans.
c) Ran Custom Scan on single folder on external drive connected to my machine via USB containing backup set of compressed files (one of the same folders I was able to reproduce the issue using Panda AV Pro 17.0.1).

8) Attached to PSANhost.exe process in Windbg. Resumed scan.

9) Scan stopped after 10,623 files scanned at 1%. Windbg indicated that the Panda AV scan had crashed.

10) Saved crash using command string ".dump /f /ma C:\Panda\17-01-30a_Panda_PSANHost.dmp".

11) Rebooted once dump was written to file.

12) Launched Windbg.

13) Launched Panda AV Free 18.0.0.

14) Ran Custom Scan on the same single folder on external drive connected to my machine via USB.

15) Attached to PSANhost.exe process in Windbg. Resumed scan.

16) Scan stopped after 305,041 files scanned at 36%. Windbg indicated that the Panda AV scan had crashed.

17) Saved crash using command string ".dump /f /ma C:\Panda\17-01-30b_Panda_PSANHost.dmp".

Password-protected zipped file "17-01-30b_Panda_PSANHost.dmp", containing both .dmp files mentioned above has been uploaded to the following Dropbox site:

https://www.dropbox.com/sh/0uqkt427ccsb ... 7-Q7a?dl=0

Password is the same as the previously-uploaded zipped files.

Next steps?

Post Reply

Return to “Consumer - Issues”