Virus

Questions and Answers : Windows : Virus
Message board moderation

To post messages, you must log in.

AuthorMessage
Profile Xavier Cesal

Send message
Joined: 24 Aug 00
Posts: 1
Credit: 26,198
RAC: 0
Italy
Message 213993 - Posted: 14 Dec 2005, 14:50:09 UTC

My Trend Micro virus scanner found a presumed virus in c:\\Programs\\boinc\\client_state_next.xml .... Do you think it's an antivirus misunderstandig or it's really an infected file?

Thanks
ID: 213993 · Report as offensive
Profile Jord
Volunteer tester
Avatar

Send message
Joined: 9 Jun 99
Posts: 15184
Credit: 4,362,181
RAC: 3
Netherlands
Message 214022 - Posted: 14 Dec 2005, 15:35:15 UTC

client_state_next.xml is as far as I can find, a file that is being written to multiple times a second, before its contents are written to the client_state.xml file and the former file deleted. Then the next second it's made again, written to multiple times a second, contents written off to elsewhere and deleted.

That may look like virus activity.

Since you can slow down & corrupt any project's crunching with an active AV scan on your BOINC directory, it's best to leave the whole BOINC directory out of the scan path of the AV scanner.
ID: 214022 · Report as offensive
Profile Mark A. Craig
Volunteer tester

Send message
Joined: 16 Jan 01
Posts: 71
Credit: 103,077
RAC: 0
United States
Message 214368 - Posted: 15 Dec 2005, 1:36:52 UTC - in response to Message 214022.  

client_state_next.xml is as far as I can find, a file that is being written to multiple times a second, before its contents are written to the client_state.xml file and the former file deleted. Then the next second it's made again, written to multiple times a second, contents written off to elsewhere and deleted.

That may look like virus activity.

Since you can slow down & corrupt any project's crunching with an active AV scan on your BOINC directory, it's best to leave the whole BOINC directory out of the scan path of the AV scanner.


I use the (free) AVG6 utility from Grisoft.cz (Czech company). It doesn't offer that degree of configurability, but it's not needed: AVG has never had a complaint about any BOINC files. OTOH, it does supposedly vet XML files in real time, and that might have something to do with the intermittent CPU bottlenecks I've noticed, esp. with the Einstein plugin. Until yesterday I thought it was only with the Einstein plugin, but last night it happened (things grinding to a halt, even text entry) again while the SETI plugin was front and center. At that, it's quite intermittent and random.

Mark
ID: 214368 · Report as offensive
Profile Jord
Volunteer tester
Avatar

Send message
Joined: 9 Jun 99
Posts: 15184
Credit: 4,362,181
RAC: 3
Netherlands
Message 214404 - Posted: 15 Dec 2005, 2:13:53 UTC - in response to Message 214368.  
Last modified: 15 Dec 2005, 2:15:25 UTC

I use the (free) AVG6 utility from Grisoft.cz (Czech company). It doesn't offer that degree of configurability, but it's not needed: AVG has never had a complaint about any BOINC files.

That's probably because AVG6 is quite old and no longer updated. AVG7 Free is the latest and is updated almost daily and does allow you to exclude files & folders. I am using it.
ID: 214404 · Report as offensive
Profile Mark A. Craig
Volunteer tester

Send message
Joined: 16 Jan 01
Posts: 71
Credit: 103,077
RAC: 0
United States
Message 214749 - Posted: 15 Dec 2005, 13:20:30 UTC - in response to Message 214404.  

I use the (free) AVG6 utility from Grisoft.cz (Czech company). It doesn't offer that degree of configurability, but it's not needed: AVG has never had a complaint about any BOINC files.

That's probably because AVG6 is quite old and no longer updated. AVG7 Free is the latest and is updated almost daily and does allow you to exclude files & folders. I am using it.


I was mistaken and forgetful: I'm using version 7.

Mark
ID: 214749 · Report as offensive

Questions and Answers : Windows : Virus


 
©2025 University of California
 
SETI@home and Astropulse are funded by grants from the National Science Foundation, NASA, and donations from SETI@home volunteers. AstroPulse is funded in part by the NSF through grant AST-0307956.