Slow scanning of *.*_ files

Avast Free Antivirus / Premium Security
1

Just noticed that on my system scans are taking much longer than before. Any (compressed) files ending with _ are taking around 10 seconds each to scan. If I right click on the i386 folder in Windows and use ashquick to scan, it is taking hours to scan when before it was minutes. Even simple BUBBLES.BM_ takes around 10seconds, cpu utilisation is very low around 3% between files.

Any idea what this could be ? Avast is up to date (4.6.763) vpn 606-4.

Thanks
Dennis

2

If you are scanning archives then there is a likelihood that scans could take longer as avast have included support for a number of packers, where in the past these files couldn’t be unpacked to scan the contents now they can, so effectively more files are likely to be scanned.

This may have something to do with it but hopefully one of the Alwil team will pick up on this thread.

3

Strange. What is your CPU speed and what operating system do you use?
Does it make any difference if you scan it with Simple User Interface, and possibly if you choose lower sensitivity there?

4

System is an AMD Athlon xp2600 with 768 Mb RAM, running Win XP SP2

If i turn off archive scanning it is very fast in the simple interface. but if turned on then it is slow. The files nnn.nnn_ in i386 are i believe ‘archives’ but only one file in each ie Bubbles.bm_ is just bubbles.bmp and only 21k long so it shouldn’t take long to scan. in fact cpu just bursts to 20% every ten second or so when a file is scanned. it then returns to idle.

thanks for your help
Dennis

5

Do you have any other software installed that might interfere with disk access (don’t know exactly what it could be… another antivirus, or a similar tool that somehow intercepts file opening)?

6

No other antivirus, I’ve disabled MS anti-spyware.

My other pc, with same Avast build seems fine.

Does the right click scan (ashquick) always scan archives or can it be set somewhere ?

7

ashQuick scan has the highest possible sensitivity, i.e. it should correspond to scanning from the Simple User Interface, using “Thorough scan” with archives enabled.

8

Hm, I’m afraid I’m unable to reproduce the behavior with the files you sent me - the scan is lightning fast every time (it should be, they’re just a few tiny CAB archives).

Just to make sure, let me summarize:

  1. The files are on your local disk (not on network, for example)
  2. If you copy the files (e.g. Bubbles.bm_) to some other folder on your disk, out of your i386 folder, and scan them there using the Explorer Extension, the same problem occurs (usually)
  3. The problem occurs even if you scan a single file, using ashQuick
  4. If you use Simple User Interface and disable scanning of archives, the problem doesn’t occur, even with “Thorough scan”.
  5. With archive scanning enabled, the problem occurs even in Simple User Interface.
    Right?

Please, open Task Manager and check the scanner process when scanning the file (when the problem occurs). Besides CPU usage, enable also columns “Mem Usage”, “Peak Mem Usage”, “VM Size”. For ashQuick, make sure you have the option “Show Explorer Extension results” enabled in program Settings, so that it doesn’t disappear immediatelly.

Is there any suspiciously big memory value? Is there any other process using significant amount of CPU, except for the scanner?

9

igor, my slow scan problem is somewhat similar to DennisT.Thorough scan with archives scan pretty fast until reaches i386,then comes to a crawl.Subject was “avast pro takes to long”.Not trying to change subject. Posted a shot of task mgr during slow scan.Hope this helps.

10

Igor,

You are correct on all five points.

Memory usage during scan is around 14 Mbytes, peak the same, VM around 9M.

I’ve moved some of the files to a new folder out of I386. The slow scan happens around 80% of the time.

I will be away now for the next week, will check when i get back.

Dennis

11

Well, what surprises me the most is that the CPU utilization (during the long scan) is not 100%, but only low (it is low, right?)

If there was a heavy CPU utilization, it would mean avast! is actually doing something… but this way it seems that it’s only waiting for the system to finish something (like, read the file from the disk). ???

12

Does the problem happen even if you e.g. scan ten of the files? I.e. copy them out to a different folder, and from within the Simple UI, start a scan of that folder.

If so, it would be useful to generate a dump file of ashSimpl.exe at the moment this is happening (i.e. it is scanning something but CPU load is zero).

To do this, download and run http://cat.asw.cz/~vlk/hangrep.exe . In the list of processes select ashSimpl.exe and use the Save button. This generates a file which you can either send to my email address (if it’s smaller than e.g. 1 MB, ZIPed), or upload to ftp://cat.asw.cz/incoming .

Thanks
Vlk

13

Hi, I’m back now and the problem still exists.

Just to confirm the CPU utilisation is zero during the wait. No other tasks seems to be taking any CPU. I copied 20 of the files to a new folder and the problem still exists for about 80% of the time. I have tried opening the files with a hex editor and there is no delay, viewing the properties is also immediate. I’ve also turned off system restore but it makes no difference.

I have generated the hang report as requested by Vlk and uploaded to the ftp site. Filename is ashSimpl.exe.zip 19 February 2006, 17:50:42.

Let me know if you find anything or need more info.

Thanks
Dennis

14

That actually helped! :slight_smile: Thanks a lot for the dump. This really seems to be a bug in the CAB unpacker (a minor synchronization issue), it should be fixed in the upcoming update (there’ll also be a beta of the update available before it goes official, so it would be nice if you could check it out and verify that it indeed does solve the problem).

Thanks
Vlk

15

Let me know how to get the beta and I’ll give it a try.

Thanks for your help

Dennis

16

I am still suffering from this problem, a scan of the full disk now takes over ten hours instead of the old 40 minutes.

any update on when it might be fixed ?

Thanks

Dennis

17

Dennis, avast 4.7 is on its way… more two or three weeks… Hopefully it will be there 8)