Avast! 4.8.1227 Pro causing slow Vista startup

Up until this new version it took me about 60 seconds to get to a functional desktop. All my startup programs have been started by this time and are functional.

Now it takes more then twice as long. My programs do not startup as fast as they used to. There are long delays between them. I also noticed that ashServ.exe is utilizing a solid 50% of the CPU by the time I can run Task Manager which might account for my slow startup. This continues while everything else starts up and my system is very unresponsive. Eventually things settle down.

I tried the option to delay avast startup. My programs still started up slowly but when they were all running I didn’t notice the high CPU utilization. I was using the 1218 beta and didn’t run across this.

Any thoughts on this? All I am using is the Standard shield and I have all the Troubleshooting options checked.

I see no difference in my boot still close to 1 minute, same as 4.8.1201. So I don’t know what might be going on with your system, considering what you have disabled.

I have delay loading of avast services after other system services (I have had this for some time), the Skip checking of digital signatures of infected files is a default selection.

streetwolf, once the system is functional (freshly after a reboot), please click the avast (a)-ball tray icon, click “Details”, scroll down to the Standard Shield provider and see the “Scanned count” field. What does it show?

Thanks
Vlk

Finally got the culprit who was causing this to happen.

I use a freeware program called Startup Delayer (the beta version) to delay a few programs that won’t initialize properly when started the ‘normal’ way. I’ve been using this program for a long time and never had this sort of problem before.

I got rid of this program and found other ways to accomplish the same thing. My system starts just like before.

I did look at the scanned count when I was having the problem and it was pretty small. Around 100 or so I think.

Well I was wrong about my start up program.

When I booted up this morning my system become very unresponsive. Again ashServ.exe was utilizing in excess of 50% of the CPU. Looking at what was being scanned it appears that “C:\Windows\Installer\6d36e.msp” is being scanned continuously. This might be the cause of the problem. When I was able to get into avast I paused the standard shield and my system came back to normal.

I guess I could exclude this file from a scan but that is just a circumvention.

Haven’t you customized the packer settings for the Standard Shield?
I can imagine that something like this may be happening if you e.g. enabled scanning of all packers.
The .msp file takes some time to extract/scan.

Thanks
Vlk

Yeah I had all packers checked. But I had this with the 1218 beta and it never scanned the installer folder.

Why is avast even scanning these files when all I specify is to scan programs that are being executed and loaded DLL’s in the Standard shield (the first tab)?

And why just this installer? All I kept seeing was the scan count going up slowly and this file was always the one displayed? Also I did a manual scan of it and it completed in a flash. I think there were 42 files in it. Something doesn’t seem Kosher to me.

Add in the fact that it the scan doesn’t always take place. This is why when I got rid of my startup program and avast didn’t slow down I thought I had the problem nailed.

What is your recommendation for which packers to choose? Also why is there no packers tab on the standard shield menu? I found it via settings for the Resident portion of avast?

OLE file scanning is not enabled? [.msp files are in fact OLE documents]

Well for the avast on-access scanner to scan a file, a program actually needs to access it, of course. It doesn’t scan the file just like that.

So, I don’t know what is the trigger (a way to find this out would be to use FileMon or ProcMon from www.sysinternals.com) but in any case, the problem is not really the fact that the file is scanned, but that the file is unpacked (which is a very expensive operation, and something IMHO unnecessary to do during an on-access scan).

Again, this has to be related to a program that is accessing the file.

I think the default settings are just fine for smooth operation. I.e. keep Self-Extracting Executables checked and all others unchecked…

Yeah, it is only accessible via the Enhanced user interface… we know about this “glitch”, it will most likely change in avast v5, but that’s all I can say about it at this time…

Thanks
Vlk

Oh yeah I have OLE scanning checked too. But I had that with 1218 and it either scanned the msp’s without any problems or it didn’t scan them at all.

Well anyways I think with your help I’ll be able to stop the scanning but I still find it peculiar that 1227 seems to being doing things that previous versions didn’t and not always good for my system at least.

I still find avast the best AV out there. God knows I tried them all.

I just downloaded ORCA to read the MSP file. It appears to be Office 2007 SP1. Why would anything access a patch file on startup?