avast! File System shield causing severe slowdowns in Win XP SP3 explorer

Avast Free Antivirus / Premium Security
1

This is a problem I noticed occurring recently (in the past month).

When using Windows XP SP3 explorer to browse files, the standard view is “tiles.” Tiles require explorer to hunt down some basic file information on .exe files, and display it. When these .exe files are installer programs from 500 MB - 1.5 GB in size, it utterly cripples Explorer. If you aren’t running Explorer in separate threads, this also cripples the Start menu.

What appears to be happening, judging by the 500+MB of memory usage that avastsvc grows to, then grows to again, is that avast! is doing a complete scan of each 500-1.5GB exe just to do normal functions in “Tile” view. While it is scanning the file, the explorer appears to crash, and if there are multiple installer files in the directory, it will pause for minutes at a time scanning each one for basic information (like the internal “program name”). Explorer will not allow access to even close the window until the avastsvc is finished, meaning that avast! is holding up the Explorer, and the entire functionality of the machine, for many minutes just to retrieve some basic file info. Explorer is not executing the files, but avast! is treating it like it is.

As a workaround, I have set the default folder view to icons, but the same exact thing will happen if you right click on a file to get properties, albeit only for the one file you’ve clicked on.

In fact, if the file info pane is displayed on the left hand side, just clicking on the icon will create the same problem, and on a slow machine cause a serious apparent lock-up.

This problem is also evident in my Windows 7 install, where right clicking on a large .exe file will cause the machine (which is much faster) to pause for 15 seconds or so to scan the entire file, before the menu appears, just to bring up the properties dialog.

This is not the protection I want. I have already told the File System Shield not to scan any packers, but this didn’t help at all. Lowering heuristics to “off” also doesn’t help. The only way to conveniently work with large (500MB+) .exe files, even to move them or check their properties, is to temporarily disable the shield.

So, is this a bug or an unintended consequence? I do not feel more protected when avast! treats an .exe as if I am executing it, when I just want to get some file properties, especially since retrieving those properties is built into Windows XP explorer’s default folder view. It is a nuisance, and if there’s no way to fix it, I’ll have to try some other product.

Please help. Either with an update that fixes whatever causes large .exe’s to slow down the machine, or with settings that will work. I am seriously considering a switch of AV, because this is not the performance I have come to expect from avast! I have been a user since version 4.

2

Doesn’t happen here on XP.

  • Which avast!..?? (Free/Pro/IS)
  • Which version…??
  • Other security related software installed…??
  • Which AV did you use before avast!..??
3

Avast! 7 free edition. 7.0.1474

It only occurs automatically when using large .exe files (such as the installer for Gog’s XIII, which weighs in at 1.8GB). It occurs automatically when these files are viewed in explorer in “tiles” mode, because basic file information is shown. Over a minute on my old Athlon XP 3200+

Even on the quad core system I’m posting from, I count over 20 seconds before a right click menu “properties” dialogue appears up for my “setup_XIII.exe” file. Please try the test cases I have suggested, large .exe files, notably installers. I am certain you will notice a huge delay.

On my Athlon XP machine, it goes to sleep for almost a minute just checking that file. If I’m in “tiles” view, and there are several large .exe files (as in my GOG download directory), it can go away for five minutes or so.

4
  1. Sorry, don’t have such huge installers available to test. :wink: But I guess 1.8GB will take a while…
  2. Just exclude the directory, if you don’t want it scanned.
5

If you don’t have such large .exe’s available, why did you claim it “doesn’t happen here on XP?” :-\

See also this thread:

http://forum.avast.com/index.php?topic=108127.msg856866

I think this is a similar problem. I first noticed the issue (and isolated the way explorer causes the issue) while making a network copy of one of the installers, but the XP file explorer issue (in “tiles” mode) is not solved by merely excluding checks on “write.” In any event, to anyone who may be experiencing this issue, switching the explorer view to “icons” or “list” display and carefully never clicking on the large .exe is a decent mitigation. I would, however, like to see this issue fixed, because it shouldn’t happen at all.

For a modern platform example, I timed my “setup_XIII.exe” properties dialogue on my Win 7 machine (i5 760, with 4GB) and it takes 18-22 seconds for the properties dialogue to appear after selecting it from a right click file menu. Every time. Persistent cache doesn’t help. Avast loads the entire file into memory, as AvastSvc.exe’s private memory set shoots up to 1.8GB, and this is just to enter a properties dialogue. I am not executing the file. If I right click and choose properties on a 2GB data file, however, the properties dialogue appears immediately.

Same goes for large popular game demos, such as MassEffect2DemoEN.exe and DragonAge2Demo.exe.

I could exclude the directory, but unfortunately this is exactly the sort of thing I want avast! to check (rogue infected installers). But I want it to check them this carefully when they are executed. Not just to retrieve file resource information. avast! doesn’t have this problem retrieving the icon from the resource section of the file, as I can work around by going into “icons” mode. As it is, an 18-22 second wait on a quad-core 4GB machine turns into an eternity on my single core Athlon 3200+ with only 1.5 GB of RAM. Avast is sending my 1.5 gig machine to swap file memory just for file properties for a large .exe file. It’s literally grinding to a halt.

I can only hope this is being addressed in an update. Even an 18-22 second wait is not acceptable for the properties dialogue, and that’s on a quad-core Win7 x64 machine. I do not feel more secure because my antivirus is making my system take 18-22 seconds longer than it used to just to pull up a properties dialogue. I have always kept the “Test whole files” box unchecked for this reason. It seems like my preference is being overridden for .exe files.

I will also note that I have all “cloud” services turned off. So no reputation services, and no cloud updates, and neither provided mitigation when I turned them on for a short time. The poster in the thread linked above seems to think that this problem began with a recent set of signatures. It did not happen in the original 7.0.1426, with the signatures that installer provided.

I’d appreciate a response from someone who may be looking at this performance issue from a development standpoint. Is this a regression? Is it on the schedule for a new release?

6

I think I’m having the same problem, also in XPsp3. Every single time I open a folder in thumbnail view, avast! starts scanning the contents: The icon in the system tray starts rotating, my processor cores start churning (reaching 100% load of one core and maybe 50% of the second core). Task manager says this is due to avastsvc.exe.

And that scanning doesn’t stop until I close the folder – as an experiment, I left a graphics folder open for a couple of hours, and avast! was still churning away (and my CPU temp was up to 72C!). Closing the folder immediately dropped the CPU load to 2-3% per core; it took a few minutes for the temp to drop below 40C. I reopened the folder, and avast! started churning again immediately. This is totally unacceptable behavior, IMO. It doesn’t happen in Details view, but that’s not much help when I have a folder full of photos or graphics projects.

This is a recent change in behavior, with no changes by me to the program settings. It continues to be an issue with version 7.0.1474

I have time, and am willing to guinea pig possible solutions, if you have suggestions.

7

Well I have XP Pro SP3 and don’t have this issue and I have many folders set in thumbnail view.
Do you happen to have the windows indexing service running ?

Is the File System Shield on the default settings ?
I appreciate that you say you have made no changes since the update.

Avast doesn’t scan files of its own volition, it responds to activity, so something has to touch these files (open with Write permission as opposed to Read permission, etc.) in a way that the avast scanner will hook the file and scan it.

I had something like this happen before and I found the cause to be another security application MBAM it was opening files to be scanned that in turn forced avast to intercept and scan the same files. What other security applications do you have installed (resident on-access ones) ?

See image1, screenshot of FSS stats (2475 files scanned) before opening one of my folders with 210 thumbnails and image2, screenshot of FSS stats (2478 files scanned) after opening that folder. Zero activity almost. The difference of 3 files scanned I believe are unrelated to actually opening the folder (probably the image capture software). I have subsequently opened several other folders with thumbnail view and there was no increase in the scanned file count.

8

I have Windows Search installed on XP SP3. This turns off the default indexer, in preference to Windows Search 4’s indexer. There’s no accounting for it with the delay for a properties dialogue to appear on Windows 7, but I believe 7 uses similar (Windows Search 4) indexing technology. If it’s an interaction between the two, I’d be surprised. Other AV programs have no problem with my SP3 install, or Windows Search.

The File System shield is on mostly default settings, but with autosandboxing turned off. As I mentioned, I do have reputation and streaming updates disabled (I have sometimes flaky wireless), but enabling these didn’t seem to mitigate. Unticking “scan on execute” completely eliminates any performance issue, at the cost of negating any benefit from running a persistent scanner. That’s the setup, if you’re trying to reproduce.

I have to ask, did you try a directory with large installer files (500MB+)? It’s hardly noticeable if the exe is smaller and/or the machine is fast. I was running this on a single core 2nd gen Athlon XP 3200+ with only 1.5 GB of single channel RAM and an EIDE hard disk. On that system, the AV has to perform, or its very noticeable. I had ditched AVG for avast! for performance reasons, years ago.

As mentioned, even on my quad-core Win7 SP1 platform, it takes 20 seconds or so to get a properties dialogue from a 1.8GB exe installer. It loads the entire file into memory just to allow explorer to look at the resource properties.

As an aside, I have since tried Norton 360 on the XP machine and it runs fast. Norton isn’t as customizable as avast!, and I would rather use avast! because it respects the idea of asking the user what they want to do with a positive match (and avast! has much better quarantine management), but for performance’s sake it’s a no-brainer. Lucky for me, my ISP provides it for free. I want to return to using avast! From a user customization standpoint, it’s a better program, but performance needs to improve to make it usable again.

Edit: I noticed you mention “Thumbnails” view. Thumbnails do not display file properties alongside the icon. The problem occurs in “Tiles” view, where it has to retrieve file properties to display the directory. You may have meant “tiles,” but if you’re actually in “Thumbnails,” that is a working display mode much like “icons” and “list.”

9

Open explorer. Choose any view other than “Tiles” in the “View” menu of the explorer window. Then choose “Tools->Folder Options…” On the “View” tab, click the button “Apply to all Folders.” (The button is under some text explaining that “You can apply the view… for this folder to all folders.”) I find defaulting to “Icons” view to be the best choice. YMMV.

What that does is tell explorer to never use “Tiles” mode. Until (if?) there is a fix, that should avoid the bulk of the problem.

Tell me if that worked for you. Avast should no longer scan complete exe files while browsing files, because you aren’t using “Tiles” mode. If It didn’t work, you have a different problem.

10

@ R Hansen
Firstly my response was directly to the post above mine (otherwise I would use the quote function, for what I’m responding to).

I mention Thumbnail ‘view’ only because it is ‘Thumbnails’ in the View menu and directly related to the fact that bigbootay is using that view.

Generally I have all my folders set to Details, other than image folders when the thumbnail of the image is more useful than the Details. But for me it doesn’t matter what the folder is in explorer when I open a folder I don’t get any scanning at all for files within the actual folder. Even if I highlight a file or single click it the file doesn’t get scanned.

Even if it is on Tiles view, no difference even on Filmstrip and cycling through the images, I don’t get any scan activity.

My settings are broadly the default, however any changes are generally for higher sensitivity, so I honestly can’t understand why there is a huge difference.

I don’t use the apply to all folders option as I don’t want the settings across the folders or that would change all of the image folders (not what I would want).

You could try Backing up your avast settings (avastUI, Settings, Maintenance) and then reset the avast defaults (avastUI, Settings, Troubleshooting, Restore Factory Defaults, Shield settings) and see if that makes any difference. If not you can use the same (avastUI, Settings, Maintenance) to Restore settings.