Sorry, I should split reply.
I digged a bit deeper and I think that there’s still hope as I actually genuinely think that this can be resolved via a definitions update. I’m not sure whether it’s gonna do anything for DiehardWin98’s issue, but it should at least help mitigating one of the issues occurring on Virtual Machines.
I’ve therefore submitted the following request to the avast lab.
Avast is causing issues with Virtualbox versions newer than 7.0.18 r162988 when Guest Additions are installed. Although the Guest Additions themselves, when scanned, don’t show up in a report, Avast is injecting itself in the threads created by the VBoxTray.exe process and it causes them to go into an infinite loop. In a 4c/4th VM, you would see 25% usage which means that 1 core is cycling at 100%. Inserting the C:\WINDOWS\system32\VBoxTray.exe under the exception in all shields doesn’t help and if a stack trace is performed we can see that aswArPot.sys and aswSnx.sys are there. To confirm that this is the case, uninstalling avast makes the VBoxTray.exe process execute normally with all its threads. There’s nothing from the Virtualbox side that could cause any lockup, so this needs to be addressed on the Avast side. Please release a new definitions update in which the Virtualbox Guest Additions are whitelisted so that they won’t cause an issue on Windows Guests.
I’ve then attached the latest Virtualbox Guest Additions ISO.
Hopefully, they’re gonna review the request and release a new definitions update and, with a bit of luck, it should solve one of the issues we’re facing.
EPILOG:
On my WinXP mchine I have a 10/25/24 Image backup. On the current build, I deleted the curent virus defs by deleting files with that time stamp in \Defs, \Setup, and \Docs&Settings. Then I copied the files from the backup with the time stamp 10/25/24. This reverts the virus defs back to that time, Now Avast18.8 reports that date
The OS works beautifully two days after. AvastSvc is well behaved. A monthly virus scan that took 82 minutes on Feb1 took 20 mininutes when run again. This is about the same as the Jan1 scan.
In this thread, when I re-installed Avast18.8 and immediately updated to current, my thought was a single bad virus defs update carried forward. This is because online updates are mostly incremental, they build on the prior one. I didn’t consider that the next one would also be corrupt. Vpsupd, I thnk, is more like a full database update.
Sometime after 1/1/25 some/all of the virus defs updates were/are corrupt. I still do virus defs updates on my Vista machine since AvastSvc using high CPU is less crippling. But, AvastSvc still uses high CPU
If Avast is going to stop vius defs updates for Avast12 thru 18, it would be great if they created a final working vpsupd like they did for Avast4.8(Win98) and Avast8(Win2K). These are still downloadable.
FranceBB, thanks for continuing to convince Avast for a fix. I don’t have the knowhow to create a bug report for Avast
It’s been a while, so here I am back with an update.
The definitions update are still rolling out for Avast 18.8.4084.409 which means that they’re still rolling out on Windows XP and Windows Vista as we can see from here (they’re downloaded regularly automatically and they can be downloaded manually as well, but streaming updates won’t work):
As of today, not all problems have been fixed by the Avast team, in the sense that if you’re running Windows XP in a Virtual Machine using Virtualbox on a version newer that 7.0.18 r162988 it will still interfere with one of the threads of the VBoxTray.exe process. Suspending the affected thread, however, makes the issue go away. As to bare metal Windows XP, the situation actually looks much better than before, in fact we can see that the CPU usage got back to normal:
Overall the situation looks ok:
Obviously not everything is “back to normal” in the sense that AvastSvc.exe and csrss.exe still have high activity at the very beginning and you get the warning on the shields at the very beginning right after boot, but give it 5-10 minutes (go for a cup of coffee or a cappuccino in the morning) and it will clear itself out. All in all I guess this is the best outcome we could get out of this, which basically also means that it was indeed one of the definitions updates that caused this before it went away. There’s still the issue with virtual machines and guest additions which should be resolved, though, because it will affect anyone running Windows XP and Windows Server 2003 in Virtualbox and obviously manually pausing the affected thread isn’t exactly an option, especially for corporations etc. Still, we’re close to the resolution, one final push and we might as well get there. C’mon Avast, do it for us.
My Windows XP system (real hardware) with avast 18.8 (updated from an older version) was using a lot of CPU. I found that csrss.exe was actually consuming the remaining CPU cycles, which made the CPU constantly report 100% usage.
By investigating in a VM (for obvious speed reasons) with Windows XP I found:
- If I install avast with the offline installer of version 2015.10.2.2218 and then upgrade to the latest version from within avast’s built-in updater, then once 18.8 is installed, avast/csrss will consume all CPU cycles (ie. 100% cpu usage).
- If I install avast version 18.8.4084, by using the offline installer, then there is no such CPU consumption.
These tests were conducted with a “minimal install” of avast (ie. without their extra tools), on Windows XP SP3 (with all windows updates installed).
So, those still having an issue like me may proceed this way to fix it:
- Uninstall avast from your system (with the uninstaller, through Add/Remove programs), even if it’s already 18.8.
- Reinstall directly version 18.8.4084 from the offline installer of that version (which is the last version that supports XP)
I suspect that nowadays there is a problem during the built-in updater of the “software” part in Windows XP (not the virus definitions).
Just to inform that a few days later, the high cpu usage was back. So the trick doesn’t seem to work, and automatic updates might indeed be in cause. I reverted back to an older version of avast that keeps stuck at older signatures.
First, I’m an Avast user and not an Avast Team member.
Personally I’m surprised that it still works at all, but obviously you can’t go beyond this offline installation version. I don’t know if that would also include keeping the virus database up to date. Which would leave you in a state of flux.
WinXP users still using the latest vpsupd virus defs will find that if you run a rootkit scan ( full or qiuck) you will get false positives.
I ran a quick scan and it flagged 363 files. Whn I chose RESOLVE, ultimately the result was none were resolved.
A rootkit scan using pre Jan 25 virus defs flagged no files