Extraneous I/O activity?

Avast Free Antivirus / Premium Security
1

Anyone know why Outpost Firewall, which seems to do some I/O every 4 seconds, triggers AVAST Home 4.1.289 on a quiet Win98FE system. Results captured with Filemon.exe

Thank you
Arn

12:45:49 AM Outpost:FFFE90CF Attributes C:\PROGRAM FILES\COMMON FILES\AGNITUM SHARED\AUPDATE\UPDATE.INI SUCCESS GetAttributes
12:45:49 AM Outpost:FFFE90CF Open C:\PROGRAM FILES\COMMON FILES\AGNITUM SHARED\AUPDATE\UPDATE.INI SUCCESS OPENEXISTING READWRITE DENYWRITE
12:45:49 AM Outpost:FFFE90CF Ioctl C: SUCCESS Subfunction: 08h
12:45:49 AM Outpost:FFFE90CF Attributes C:\PROGRAM FILES\COMMON FILES\AGNITUM SHARED\AUPDATE\UPDATE.INI SUCCESS Get Modify
12:45:49 AM Outpost:FFFE90CF Seek C:\PROGRAM FILES\COMMON FILES\AGNITUM SHARED\AUPDATE\UPDATE.INI SUCCESS End Offset: 0 / New offset: 0
12:45:49 AM Outpost:FFFE90CF Seek C:\PROGRAM FILES\COMMON FILES\AGNITUM SHARED\AUPDATE\UPDATE.INI SUCCESS Beginning Offset: 0 / New offset: 0
12:45:49 AM Outpost:FFFE90CF Read C:\PROGRAM FILES\COMMON FILES\AGNITUM SHARED\AUPDATE\UPDATE.INI SUCCESS Offset: 0 Length: 512
12:45:49 AM Outpost:FFFE90CF Close C:\PROGRAM FILES\COMMON FILES\AGNITUM SHARED\AUPDATE\UPDATE.INI SUCCESS CLOSE_FINAL
12:45:49 AM Ashserv:FFFE8213 Attributes C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\DATA\AVAST4.INI SUCCESS GetAttributes
12:45:49 AM Ashserv:FFFE8213 Open C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\DATA\AVAST4.INI SUCCESS OPENEXISTING READWRITE DENYWRITE
12:45:49 AM Ashserv:FFFE8213 Ioctl C: SUCCESS Subfunction: 08h
12:45:49 AM Ashserv:FFFE8213 Attributes C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\DATA\AVAST4.INI SUCCESS Get Modify
12:45:49 AM Ashserv:FFFE8213 Seek C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\DATA\AVAST4.INI SUCCESS End Offset: 0 / New offset: 0
12:45:49 AM Ashserv:FFFE8213 Seek C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\DATA\AVAST4.INI SUCCESS Beginning Offset: 0 / New offset: 0
12:45:49 AM Ashserv:FFFE8213 Read C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\DATA\AVAST4.INI SUCCESS Offset: 0 Length: 2620
12:45:49 AM Ashserv:FFFE8213 Close C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\DATA\AVAST4.INI SUCCESS CLOSE_FINAL

2

I’m not sure but seems that your firewall is being notified about avast! updates… Do you use a dial-up or a permanent connection to the Internet?

3

Permanent cable connection. FYI the log is from oldest (top) to newest (bottom)

4

Just changed the options to include millisecond to the log
6:24:52.636 AM Outpost:F7557987 Attributes C:\PROGRAM FILES\COMMON FILES\AGNITUM SHARED\AUPDATE\UPDATE.INI SUCCESS GetAttributes
6:24:52.636 AM Outpost:F7557987 Open C:\PROGRAM FILES\COMMON FILES\AGNITUM SHARED\AUPDATE\UPDATE.INI SUCCESS OPENEXISTING READWRITE DENYWRITE
6:24:52.636 AM Outpost:F7557987 Ioctl C: SUCCESS Subfunction: 08h
6:24:52.636 AM Outpost:F7557987 Attributes C:\PROGRAM FILES\COMMON FILES\AGNITUM SHARED\AUPDATE\UPDATE.INI SUCCESS Get Modify
6:24:52.636 AM Outpost:F7557987 Seek C:\PROGRAM FILES\COMMON FILES\AGNITUM SHARED\AUPDATE\UPDATE.INI SUCCESS End Offset: 0 / New offset: 0
6:24:52.636 AM Outpost:F7557987 Seek C:\PROGRAM FILES\COMMON FILES\AGNITUM SHARED\AUPDATE\UPDATE.INI SUCCESS Beginning Offset: 0 / New offset: 0
6:24:52.636 AM Outpost:F7557987 Read C:\PROGRAM FILES\COMMON FILES\AGNITUM SHARED\AUPDATE\UPDATE.INI SUCCESS Offset: 0 Length: 512
6:24:52.636 AM Outpost:F7557987 Close C:\PROGRAM FILES\COMMON FILES\AGNITUM SHARED\AUPDATE\UPDATE.INI SUCCESS CLOSE_FINAL
6:24:53.211 AM Ashserv:FFFE8213 Attributes C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\DATA\AVAST4.INI SUCCESS GetAttributes
6:24:53.211 AM Ashserv:FFFE8213 Open C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\DATA\AVAST4.INI SUCCESS OPENEXISTING READWRITE DENYWRITE
6:24:53.211 AM Ashserv:FFFE8213 Ioctl C: SUCCESS Subfunction: 08h
6:24:53.211 AM Ashserv:FFFE8213 Attributes C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\DATA\AVAST4.INI SUCCESS Get Modify
6:24:53.211 AM Ashserv:FFFE8213 Seek C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\DATA\AVAST4.INI SUCCESS End Offset: 0 / New offset: 0
6:24:53.211 AM Ashserv:FFFE8213 Seek C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\DATA\AVAST4.INI SUCCESS Beginning Offset: 0 / New offset: 0
6:24:53.211 AM Ashserv:FFFE8213 Read C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\DATA\AVAST4.INI SUCCESS Offset: 0 Length: 2620
6:24:53.211 AM Ashserv:FFFE8213 Close C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\DATA\AVAST4.INI SUCCESS CLOSE_FINAL

5

Will desinstalling and reinstalling avast! work?
Try avast 4.0 Uninstall…

I’m using ZA with no such trouble with avast!
Maybe you can make a search in foruns to Outpost Firewall and see if anybody related a similar trouble… :wink:

6

I’ll hold re-installing as a last resort. It took me awhile to get Avast working the way I wanted, and I don’t want to mess with success.

Which version of ZA are you running? Iwas a long time ZAF user, but switched to Sygate then Outpost.

I cross posted this topic on Agnitum’s forum, maybe someone over there has an answer.

7

This “problem” is not related to Outpost in any way. It’s normal for avast to periodically touch its avast4.ini file (it’s not triggered by Output), just like it’s normal for Outpost to periodically touch its update.ini…

Do you care?
Vlk :wink:

8

Yes, I care, but I may be unable to do anything about it. I keep overhead to a mininimum on my geriatric 300mhz chip. However, when I terminate Outpost, Avast’s activity totally stops.

C:\PROGRAM FILES\COMMON FILES\AGNITUM SHARED\AUPDATE\UPDATE.INI was added to Avast’s excluded files; rebooted system; no change.

Are you saying Avast! hits it’s avast4.ini file every 4 to 5 seconds? That’s what shows on my system monitor.

9
Are you saying Avast! hits it's avast4.ini file every 4 to 5 seconds? That's what shows on my system monitor.

I wouldn’t be too surprised… but maybe only under Win2K/XP. Under (geriatric ;D) Win98 it behaves differently (the Standard Shield’s are very different).

However, when I terminate Outpost, Avast's activity totally stops.

That is an interesting point (you didn’t say that in the original post). In this case I guess there must be some connection – try e.g. pausing the Standard Shield and/or terminating the whole on-access protection to see if it has any effect…

Thanks
Vlk

10

Thank you for the suggestions

  1. Stopped Standard Shield - no change
  2. Stopped Onaccess protection and exited - no change
11
  1. Stopped Outpost - BIG change?
12

Ummm… How do I do that? I can’t find a close request or a flag that says do not run on next boot. Maybe I’m just missing something. Can I safely close ASHMAISV in the Task manager???

13

I meant the Outpost firewall :wink:

14

My version is the last freeware one (3.7.211) :wink:
For your answers to Vlk I suppose the trouble remains in Outpost Firewall… :-\

15

Oops I was in a hurry to get out of the house when I read that message. ::slight_smile: That info was posted earlier.

When I terminate Outpost, Avast’s activity totally stops.

16

Received an answer from the moderator of the Outpost forum which follows.

“It looks like you have the Tools/Automatically Check for Update option ticked on your Outpost menu. Deselect this and the activity should stop (I was not aware that it ran that often though…).”
http://www.outpostfirewall.com/forum/showthread.php?s=&postid=61384#post61384

Shut it off, and the I/O activity ceased for Outpost and Avast. For anyone out there running Outpost version 1, this option hangs out under the HELP menu.

Thank you to Technical & VLK for your help and suggestions
Arn

17

Thanks for your explanations. Give us a little bit more of knowleage. Wellcome to avast! foruns… See you round… :wink: