AVAST! 5 IS Firewall causes high CPU usage

[Manasa]

 

Hi, all of you. I've recently installed AVAST! 5 IS (trial) and soon after noticed that 1 of my cores was using between 70 and 90 % of it's capacity. Also, RAM usage increased to anything between 50 and 85 %. Re-starting the PC solved the issue - for a while, but after some hours the same build-up of increased CPU/RAM usage started again    After 12 - 15 hours I can hardly use my mouse and the whole thing freezes up almost completely (something I had last noticed with P4 procesors).

I didn't quite want to suspect AVAST! to be the culprit, so I installed MS SQL and executed some analysis which pointed at the NDIS.sys driver (a Network component) to cause the high amount of "interrupt calls" which build up so much CPU/RAM usage. So I dis-  and enabled several of the networking programs on my PC and, as soon as I decided (for some reason or other) to disable the AVAST! Firewall the CPU usage immediately dropped down to it's usual 3 - 7 %. After 10 minutes I enabled the FW and immediately had the aforementioned Core up at 70 %. So I turned the thing off (the Firewall, not AVAST!) for good.
Question - is that a bug in the AVAST! Firewall or does it enter into conflict with Windows' own Firewall? Or what?

I'm running Win 7 ultimate 64-Bit...PC has a Q6600 procesor, 4 GB RAM DDR3, and so on....

I can live without the Firewall, given that Windows has one, but I would like to know/understand what's happened and maybe learn something new. Thanks & Bye

[megalodon]

Interesting. I keep it in mind when it happens to me. So far, I didn't see much of a difference between my WinXP firewall & Avast's in terms of cpu usage. Perhaps it's system/OS specific?

[Hermite15]

Perhaps it's system/OS specific?

nope, I don't notice that here.

[Manasa]

Hi again,

I thought that maybe I should post a little more information:

I did notice this problem only and once I installed Avast! 5.0 (some 2 weeks ago)...and it hasn't recurred since I've diabled the FW. But I'd still like to know why and how to resolve the issue.

My PC runs 24/7 as I download lots of music/movies (there's very little decent stuff to be had over here)  and I'm using uTorrent for torrents (which is disabled in the P2P shield) as well as JDownloader for direct downloads. I also have Diskeeper 2009 running and have noticed that it's - albeit only at times - consuming some 20% of CPU capacity which I can't remember ever happening before....which would make sense if Avast! scans the fragments when Diskeeper moves them around??? Does Avast! do that?

Diskeeper using some more CPU at times doesn't really bother me, but if it has anything to do with Avast! it might be of interest to the developers . After all, there's quite a bit of competition out there.
By the way, despite all of my efforts I've never managed to actually install a virus in my PC. Before Avast! 5 I've had Avast! 4.8 installed and never has anything gotten by it's shields...so Thank You for that one!

Apart from that, has anynoe got any further ideas?

[dajisan]

Hello Manasa and eveyone here!

Before i found this thread, i was all over the net looking for some answers why my computer stutters after an hour or two that it has been booted/restarted. I replied to this thread because we have something in common thats causing/might be causing the issue including this issue. these are:

-Windows 7 ultimate 64 bit
-Avast Internet security 5.0.462
-uTorrent

I ran the analysis and the high System Interrupt cpu usage is because of the ndis.exe too (similar to your pc's high usage)
I can no longer update the nVidia nForce network controller driver because it said in the device mgr that the best driver is already installed. So the temporary solution that i have (instead of restarting which takes time) is to disconnect to the internet for about ten mins (just to refresh the network) and connect back up. That stopped the high cpu usage for a little while.

However, i still have one issue that makes me think that Avast has something to do with the high interrupt rate.
-everytime i boot the pc, the avast! NDIS firewall network device (or something like that) attampts to install at startup, then fails, so when i check the devicemgr to update it, it still fails.

I hope i can find the permanent fix for this. This is getting frustrating, im thinking of switching to Ubuntu, i hear it is more secured than MS operating systems...

[Tweaknews]

This is the same thing I am seeing.

[scs]

Same here.

We bought Avast! Internet Security.
Sometimes the cpu is very high, because of a process AvastFW or something .

It also happens when I print a large file over the network.
While testing with uTorrent or some other p2p program with a lot of connections, cpu is very high.

I think it is related with the fw log. It seems to be huge.
If I try to see the log in the interface, it takes 5-10 minutes with max cpu to load and scrolling is impossible.

I try to find a setting to limit the size of the log or to erase it, but found nothing yet.

I hope there will be a solution soon, because the rest of Avast works very well.
I don't want to disable this FW and install an extra program like Comodo.

ATTENTION!!  The same issue is discussed in this thread of 27-4: AIS firewall high CPU load
Avast people have commented there.

[Hermite15]

ATTENTION!!  The same issue is discussed in this thread of 27-4: AIS firewall high CPU load
Avast people have commented there

yes I think that's my thread. The issue might indeed come from the log showing tens of irrelevant entries with blocked connections (these connections are not blocked at all, the entries are wrong).

[lukor]

ATTENTION!!  The same issue is discussed in this thread of 27-4: AIS firewall high CPU load
Avast people have commented there

yes I think that's my thread. The issue might indeed come from the log showing tens of irrelevant entries with blocked connections (these connections are not blocked at all, the entries are wrong).

Hi Logos, I am afraid these two issues are completely unrelated.

[Hermite15]

ATTENTION!!  The same issue is discussed in this thread of 27-4: AIS firewall high CPU load
Avast people have commented there

yes I think that's my thread. The issue might indeed come from the log showing tens of irrelevant entries with blocked connections (these connections are not blocked at all, the entries are wrong).

Hi Logos, I am afraid these two issues are completely unrelated.

I was just guessing because someone mentioned a huge log here, again, just guessing...could well be that it's completely unrelated.

[lukor]

I was just guessing because someone mentioned a huge log here, again, just guessing...could well be that it's completely unrelated.

Yes it is rather probable, I would remember fixing that.

[scs]

Dear lukor,

You are the expert here.
Can we adjust/delete the log of the FW ?
If so, I can't find how. Did I overlook something?

[Hermite15]

you must deactivate the self-defense module first and then stop the firewall service (in computer management) manually). Then you can delete the log, manually again. It's a file called fw.db IIRC (I don't have the firewall running atm) found here: C:\ProgramData\Alwil Software\Avast5 (replace program data by documents and settings\all users if you're in XP).
 Not very useful as it will get quickly recreated and populated again with tens of wrong entries.

[scs]

Well thanks, I just give it a try.

WHAT !?!?  
This file is 423 MB , That is absurd !!

It is growing steadily while I am looking !!  Approx 1kb per minute
This must be a bug, the pc is doing nothing on internet or the network, and I am behind a NAT.

Sending an email added approx. 10KB !

afwServ.exe is using minimal <1% cpu.


Mr. Lukor,
can I provide you with info before I try to delete this file?

[lukor]

Hi scs,
if you still have the file, please try to compress it and upload to our FTP server - ftp.avast.com/incoming. It contains IP addresses of the webpages and other host you have contacted - but the FTP server is write-only, only Alwil staff can read it from it.

Thanks.
Lukas.

Edit: On none of the systems I have here for testing grows the log so quickly. Its size is 0.5MB after several weeks. Would you mind also sending the config.xml file from Application Data\Alwil Software\avast5\fw folder?