Here’s the scenario, and I’ve tracked the symptoms down to Avast! (uninstalling makes it go away, installing makes it come back.)
Copy a largish file (several hundred megs) from one computer to another computer running Avast! Home edition. Watch the CPU usage on the computer running Avast! It will spike up to 80% or higher for the duration of the file copy.
Alternatively, copy a file THROUGH the network layer on the same computer, such as copying a file from c:\temp\ to \localhost\c$. This avoids actual network traffic but causes a huge spike in CPU for the duration of the copy.
It doesn’t seem to affect the copy speed much, but it does make the target computer basically unusable because the System Process is taking up all the available CPU. Further digging with Process Explorer showed that it was the srv.sys driver inside the System process taking up the CPU. It appears Avast! has some sort of hook on this driver, as the symptoms disappear once Avast! is uninstalled.
Can anyone confirm this behavior? (I’ve seen it on two computers already.)
Next, of course, is does anyone know a workaround? I’ve tried disabling kernel-mode scanning (and even rebooting afterward) but it doesn’t seem to have any effect.
I run a daily copy of several gigabytes of data from one computer to another. Even with avast! active on both computer I haven’t observed inordinately high cpu usage. I’ll try to remember to check the actual usage tomorrow and post again.
I am trying to reproduce the condition reported but without success.
I am transferring a multi Gb file between 2 WinXP Pro SP2 systems, both systems have avast active. When I use my older 1GHz uniprocessor system as the receiver of the file the CPU utilization is remaining steady at about 60% (for a utilization on the 100Mbps lan of about 82%).
If I stop all avast on access protection the CPU utlization is steady at about 57%, when I uninstall avast - the CPU utilization is unchanged.
If I use my new dual 3Ghz processor system as the receiver of the file the CPU utilization is steady at about 15% (for a utilization on the 100Mbps lan of about 82%). At that level I am not inclined to bother with uninstalling avast to see what difference it makes.
It occurs to me that I (and we) could be clearer about out avast configurations.
I run only the Standard Shield, Webshield and Internet Mail providers. I was wondering if the Network Shield (which I do not run) might be an issue here.
Standard Shield > Normal (or less), not scanning while open/create/modify files. I did not change the default options for the task into the Enhanced Interface.
There is not a scheduled task running in background.
Normal browsing while that occurs… almost freezing the computer.
Since NetShield was born it did NOT even scan a single thread for me…
I don’t think this things are related each other.
By the way, Vlk, while using the beta and then upgrading to last release, a lot of ‘trash’ files are left behind in the DATA folder.
I’ve noticed that comparing the two folders (the old, before uninstalling) and the new (fresh one), working again 8)
Tech, clearly some difference in our systems even with avast running.
This system has been running for about 9 hours and includes the time when I was testing the transfer of the large file to this system. Page faults for ashServe.exe are currently at 111,534. However page faults for explorer.exe are 1,077,730.
Perhaps I am not conducting my file transfer the same way as you and Saturn49.
I did the copy this morning on two identical computers over a 100mbs wired lan:
Windows XP Home SP 2
Pentium 4 @ 2.5ghz
avast! standard shield = high
avast! network shield = high
The source peaked at about 24% and fluctuated between 8% and 15% thereafter, while the target peaked at 79% then went down to 50% - 55%.
Edit: After about 90 minutes my page faults are 283,000 for ashserv.exe
Edit:
Tech,
Now about 5 1/2 hours with almost 1.4 million page faults for ashserve.exe on each of the 3 computers in the network, but I’m still not experiencing any slow downs. Yes its a lot of page faults but maybe not related to your or Saturn’s slowness.
You keep talking about the system process, which has nothing to do with avast so I can’t see where this interaction comes from.
Do you mean System as in the User Name, if so what Image Name (process) is the one using cpu %
Avast processes begin with ash or asw and there are usually 4 in the list, so what are their cpu % use figures ?
No, I mean the actual System process (PID 4 on my system.)
This is the one that actually hosts some (all?) of the drivers in the system. As I said in the OP, the driver that spikes is the srv.sys driver. Avast! must have a hook into it somehow (driver filter maybe?)
I don’t pretend to understand why or how exactly this happens, but it is very reproducable on multiple systems.
system PID 4 on my XP Pro is currently at 0% CPU and doesn’t get high in file transfers, unfortunately on a stand alone system I can’t test network transfers. As far I’m aware avast doesn’t have any hook into system but I don’t know about srv.sys as avast is not a server product I wouldn’t have thought so.
If avast were in fact scanning something the avast icon would be rotating and the ashServ.exe would show cpu activity.
So using your examples:
“This pegged the CPU at 100%, 16% was Explorer.exe, the other 84% was the System process.” This would mean there is no activity on ashServ.exe or any other avast process.
“Without Avast! the copy takes about 50% CPU, with 16% Explorer, and 34% System process.” Now without avast there is still a high system cpu usage which I can’t understand for a simple file transfer. Although I can’t see why it would drop to 50% cpu use after avast was uninstalled, when previously there was no avast activity.
Baffling, that you are able to replicate this on other systems but those here that have tried haven’t experienced the same problem and considering Alanrf’s comments after uninstalling.
If I stop all avast on access protection the CPU utlization is steady at about 57%, when I uninstall avast - the CPU utilization is unchanged.
Perhaps those who tested the cpu utilisation could check the processes using the cpu time as the system process PID 4 seems high when I would have expected ashServ.exe to be eating some of the cpu % that doesn’t appear to be the case with Saturn49’s system.
Perhaps as Alan mentions Network Shield has an impact in network transfers and we don’t see a process PID for that, so it might use ashServ.exe also or perhaps system ???
You can test this without a network, just by copying from c:\temp to \localhost\c$\ or something.
That’s why the CPU is so high on my test. If you remember from the OP, an actual network transfer only spikes the CPU to around 60-80% w/ Avast, and only 15% or so w/o.
However, taking the network bottleneck out of the equation and just copying from a local drive to localhost, it uses the network layer, but doesn’t actually go out on the network. This makes the test easier to do and exacerbates the problem so it is more readily visible.
I’m thinking that Avast! is simply hooking into the server process, and even though the network shield is disabled, the hook is still there, and executing some bit of (inefficient) code in Avast! that appears under the System process.
I should also note that the CPU spike ONLY happens on the destination, not the source. (so copying from \localhost\c$ to c:\temp would NOT reproduce the issue.)
Well I tried that copying a 1.5GB file using a batch file (copy c:\temp\test.v2i \localhost\c$) so I could monitor task manager but it was so quick I knew it failed. So I put a pause in after the command and saw the error “The network path was not found 0 files copied.”
Now I have many un-neccessary processes disabled including network DDE and network DDE DSDM, whether that has anythig to do with it but it would appear I’m unable to test it.
I had a similar issue today but, for me, it ended up being Avast scanning each time my PocketPC and PC synched when it was docked.
I solved it by excluding the directory of an app that had a desktop and pocketpc version as Avast was scanning whenever they synched and causing my pc to lock up temporarily.
An hour or so of that happening every few seconds was way too much.
