Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: hgratt on May 16, 2005, 11:34:23 PM

Title: Avast 4.6.652 Email Problem
Post by: hgratt on May 16, 2005, 11:34:23 PM
I have an IBM R40 Thinkpad with win xp pro, sp2 and all latest patches. I also use Zone Alarm Free 4.xx (no privacy stuff, etc).

I use Comcast cable modem as a provider.

I have just now noticed that when I send emails, my upload speed is about a 1/3 of what it should be. If I disable outbound scanning, upload speeds are near normal.

What is going on and how do I fix it so it works with outbound scanning enabled?

Thanks,
Harvey
Title: Re: Avast 4.6.652 Email Problem
Post by: lukor on May 17, 2005, 12:21:04 AM
What do you mean by upload speed?
Title: Re: Avast 4.6.652 Email Problem
Post by: hgratt on May 17, 2005, 12:26:07 AM
I use Netpersec to monitor my download and upload speeds. When I send a large file (several MBytes), I see around 30 Kbytes/sec speed in uploading the file to the designated email address. If I disable outbound scanning, I see about 90-92Kbytes/sec sending speeds.

Harvey
Title: Re: Avast 4.6.652 Email Problem
Post by: lukor on May 17, 2005, 12:29:43 AM
I use Netpersec to monitor my download and upload speeds. When I send a large file (several MBytes), I see around 30 Kbytes/sec speed in uploading the file to the designated email address. If I disable outbound scanning, I see about 90-92Kbytes/sec sending speeds.

Harvey

Hmm, by speed one usually mean transferring certain amount of stuff (let's say pieces of eight) in certain amount of time (let's say seconds). If your download speed lowers to 1/3, does it also takes 3 times longer to send an email of the same size?


Don't understand me wrongly; since I know how outbound scan works I can easily imagine that speed measuring software does not measure correctly.
Title: Re: Avast 4.6.652 Email Problem
Post by: hgratt on May 17, 2005, 12:32:47 AM
I use Netpersec to monitor my download and upload speeds. When I send a large file (several MBytes), I see around 30 Kbytes/sec speed in uploading the file to the designated email address. If I disable outbound scanning, I see about 90-92Kbytes/sec sending speeds.

Harvey

Hmm, by speed one usually mean transferring certain amount of stuff (let's say pieces of eight) in certain amount of time (let's say seconds). If your download speed lowers to 1/3, does it also takes 3 times longer to send an email of the same size?




Yes, one can see the significant slowdown in the upload file transfer.

Harvey

Title: Re: Avast 4.6.652 Email Problem
Post by: lukor on May 17, 2005, 12:43:38 AM
With outbound mail scanning you are uploading the mail twice - firstly it's uploaded and cached in the internet mail provider, then it is analyzed, attachments unpacked, scanned for viruses and then it is continuing its way to the destination server.
From the mail client perspective it goes very quickly, than it stops for a while transferring 0 bytes/s, then again it goes very quickly (for the next email). That is why the speed measurement might get confused.

This process and the upload (even to localhost mail scanner) takes some time and may be visible when network speed are very high - but I would not expect a significant slowdown with speeds about 90 Kbytes/s. We can re-check it in the morning and see if we see such a slowdown.

Of course, sending large compressed file has its own overhead. The attachment needs to be uncompressed before scanning and for large files it really does take some time.

Title: Re: Avast 4.6.652 Email Problem
Post by: hgratt on May 17, 2005, 12:52:10 AM
FWIW, I have just swithced to Avast from Norton NAV 2004. NAV would scan the file for a few seconds,and then send it off at about 92KBytes/sec to the mail server.

Avast does seem to be noticibly slower overall as well as showing slower transfer speeds. I assume that Avast has also scans the file completely before sending it off. If so, I would expect speeds to the mail server in the 90-92 KBS range.

Thanks,
Harvey
Title: Re: Avast 4.6.652 Email Problem
Post by: alanrf on May 17, 2005, 02:04:10 AM
When I first saw this post I assumed that this was just a perception issue and  that the numbers could be explained by the "double send" that Lukas has explained above. 

I am also a Comcast cable user so I thought I would put it to the test.

I sent the same message 4 times. Each message was sent to the same address through my Comcast smtp server.  The message contained one word of text and a single ~2.5Meg pdf file attachment.   

The only measurement I used was the elapsed time from clicking the send to receiving the "mail successfully sent" message in my mail client. 

Message 1  without Avast scanning   90 seconds
Message 2       with Avast scanning 137 seconds
Message 3       with Avast scanning 138 seconds
Message 4  without Avast scanning   90 seconds

So about 50% longer to send the same file with Avast scanning active for my system and Comcast connection, but nowhere near the decrease reported by hgratt.

I must assume that hgratt has a non-standard Comcast cable connection.  Mine is 4Mbps/384Kbps.  With my non-Avast scan I am uploading at about 30Kbytes/sec.  You would have to have a significantly faster upload connection to be sending mail at 90-92Kbytes/sec (either that or Netpersec is giving misleading information).
Title: Re: Avast 4.6.652 Email Problem
Post by: MFB on May 17, 2005, 02:08:06 AM
FWIW, I have just swithced to Avast from Norton NAV 2004. NAV would scan the file for a few seconds,and then send it off at about 92KBytes/sec to the mail server.

Avast does seem to be noticibly slower overall as well as showing slower transfer speeds. I assume that Avast has also scans the file completely before sending it off. If so, I would expect speeds to the mail server in the 90-92 KBS range.

Thanks,
Harvey

You just switch from Norton?  Make sure you check and remove every single thing with Norton or symantec in it's name.  If I recall, after you unistall Norton, Symantec live update still remains in your computer.  ;)
Title: Re: Avast 4.6.652 Email Problem
Post by: hgratt on May 17, 2005, 02:18:45 AM
When I first saw this post I assumed that this was just a perception issue and  that the numbers could be explained by the "double send" that Lukas has explained above. 

I am also a Comcast cable user so I thought I would put it to the test.

I sent the same message 4 times. Each message was sent to the same address through my Comcast smtp server.  The message contained one word of text and a single ~2.5Meg pdf file attachment.   

The only measurement I used was the elapsed time from clicking the send to receiving the "mail successfully sent" message in my mail client. 

Message 1       with Avast scanning   90 seconds
Message 2  without Avast scanning 137 seconds
Message 3  without Avast scanning 138 seconds
Message 4       with Avast scanning   90 seconds

So about 50% longer to send the same file with Avast scanning active for my system and Comcast connection, but nowhere near the decrease reported by hgratt.

I must assume that hgratt has a non-standard Comcast cable connection.  Mine is 4Mbps/384Kbps.  With my non-Avast scan I am uploading at about 30Kbytes/sec.  You would have to have a significantly faster upload connection to be sending mail at 90-92Kbytes/sec (either that or Netpersec is giving misleading information).

I have the so-called gold speeds - 6mbps/768kbps. As I indicated, I get about 30-34 KBS with outbound scanning active and about 90 KBS with outbound scanning disabled.

If you use the "stop watch test", then I can see where the time spent in scanning the file would change the overall speeds. I think in your case, 384kbs should be about 48 KBS. FWIW, when I had the 4/384 package my upload speeds would be about 46 KBS. I have also verified these upload speeds on various speed test sites.

BTW, should the "with and without" messages be reversed? I assume the longer times correspond to the outbound scanning active case.

Thanks,
Harvey
Title: Re: Avast 4.6.652 Email Problem
Post by: hgratt on May 17, 2005, 02:20:40 AM
FWIW, I have just swithced to Avast from Norton NAV 2004. NAV would scan the file for a few seconds,and then send it off at about 92KBytes/sec to the mail server.

Avast does seem to be noticibly slower overall as well as showing slower transfer speeds. I assume that Avast has also scans the file completely before sending it off. If so, I would expect speeds to the mail server in the 90-92 KBS range.

Thanks,
Harvey

You just switch from Norton?  Make sure you check and remove every single thing with Norton or symantec in it's name.  If I recall, after you unistall Norton, Symantec live update still remains in your computer.  ;)

Yeah, I was careful. I used add/remove and then made sure to hunt down all the symantec folders and manually remove them.

Thanks,
Harvey
Title: Re: Avast 4.6.652 Email Problem
Post by: alanrf on May 17, 2005, 02:39:41 AM
hgratt,

thanks for spotting the error in my timing report.  I have edited it.

A thought that just occurred to me - I have not checked the effect yet.  I have the same ZoneAlarm firewall as you - do you have the message scan disabled in ZoneAlarm?

Title: Re: Avast 4.6.652 Email Problem
Post by: hgratt on May 17, 2005, 02:56:50 AM
hgratt,

thanks for spotting the error in my timing report.  I have edited it.

A thought that just occurred to me - I have not checked the effect yet.  I have the same ZoneAlarm firewall as you - do you have the message scan disabled in ZoneAlarm?



I had the basic message scan enabled, but it's only for incoming mail. I tried turning it off and it made no difference. Also, shutdown ZAF, but again minimal difference.

Right now, I'm not getting good speeds even with outbound scanning turned off - but better than with it turned on. I may try uninstalling Avast and see what happens.

Harvey
Title: Re: Avast 4.6.652 Email Problem
Post by: alanrf on May 17, 2005, 03:20:31 AM
Rather than uninstalling Avast try this:

On the Internet Mail Scanner:

Customize > Redirect tab

Change the SMTP port to a something like 15025

Select OK

Terminate and restart the Internet Mail Scanner.

Now try your test.

I've just being doing some scanning - I'll write it up in another post.
Title: Re: Avast 4.6.652 Email Problem
Post by: hgratt on May 17, 2005, 03:23:02 AM
Uninstalling Avast made no difference. Still getting not quite so good speeds - I guess a Comcast problem for now. FWIW, I also tried AVG and could not get it to function with my email at all.

Anyway, the problem still persists, I need to disable outbound scanning in order to get acceptable upload speeds.

Harvey
Title: Re: Avast 4.6.652 Email Problem
Post by: MFB on May 17, 2005, 03:29:29 AM
Whoa there, don't run AVG with avast!  Get rid of AVG cause those two Anitivirus never get along.   :o
Title: Re: Avast 4.6.652 Email Problem
Post by: hgratt on May 17, 2005, 03:35:22 AM
Whoa there, don't run AVG with avast!  Get rid of AVG cause those two Anitivirus never get along.   :o
[/quote

I had uninstalled Avast, rebooted and then installed AVG.

Thanks,
Harvey
Title: Re: Avast 4.6.652 Email Problem
Post by: MFB on May 17, 2005, 03:37:00 AM
Whoa there, don't run AVG with avast!  Get rid of AVG cause those two Anitivirus never get along.   :o
[/quote

I had uninstalled Avast, rebooted and then installed AVG.

Thanks,
Harvey

Oh I see, but for me, Running AVG is like 100xworst than avast! and AVG conflicting each other.   ;D But if you feel happy with AVG, then fine I'll respect your choice.   :)
Title: Re: Avast 4.6.652 Email Problem
Post by: hgratt on May 17, 2005, 03:40:36 AM
Rather than uninstalling Avast try this:

On the Internet Mail Scanner:

Customize > Redirect tab

Change the SMTP port to a something like 15025

Select OK

Terminate and restart the Internet Mail Scanner.

Now try your test.

I've just being doing some scanning - I'll write it up in another post.


O.K, I did as you suggested and it worked - no real difference between having outbound scanning enabled or disabled - speeds are still somewhat slower than they should be 75-80KBS vs. 90-92KBS. Still not sure why - maybe an Internet issue, we'll see tomorrow.

Could you explain the port change that you gave - why does it work? Any negative issues?

Thanks,
Harvey
Title: Re: Avast 4.6.652 Email Problem
Post by: MFB on May 17, 2005, 03:44:55 AM
Rather than uninstalling Avast try this:

On the Internet Mail Scanner:

Customize > Redirect tab

Change the SMTP port to a something like 15025

Select OK

Terminate and restart the Internet Mail Scanner.

Now try your test.

I've just being doing some scanning - I'll write it up in another post.


O.K, I did as you suggested and it worked - no real difference between having outbound scanning enabled or disabled - speeds are still somewhat slower than they should be 75-80KBS vs. 90-92KBS. Still not sure why - maybe an Internet issue, we'll see tomorrow.

Could you explain the port change that you gave - why does it work? Any negative issues?

Thanks,
Harvey

What modem are you using? DSL?  Turn off your computer and unplug the DSL modem for 45 seconds and plug it in again and turn on your computer.
Title: Re: Avast 4.6.652 Email Problem
Post by: alanrf on May 17, 2005, 03:45:41 AM
I just did some tracing of the file activity involved in the sending of the message to which I referred in my post above. 

The message is apparently sent in fairly large blocks by the mail client.  These blocks are redirected to Avast which files them to a temporary
file.  Attachments increase in size when they are encoded so that filing took
8 seconds. 

Then for 151 seconds Avast was reading the file in 4k chunks and then, I assume sending each 4k chunk on to the network (and perhaps waiting for an acknowledgement).

On reading in the same message back in the network delivers in fairly large chunks which are passed to Avast and filed.  Avast then reads the file and scans it in 4K chunks before it is passed to the mail client.  since that is internal to the machine it is much faster than outbound and took only 5 seconds for the same message just sent out. 

It looks to me as though the Avast folks should look to making the transmission of the scanned message much more like the transmission from the mail client, ie much fewer and larger blocks.

Since this message can be read and scanned in 5 seconds Avast can do a much better job of making the transmission time a closer approximation of that which can be done by the client when Avast is not involved.
Title: Re: Avast 4.6.652 Email Problem
Post by: hgratt on May 17, 2005, 03:53:12 AM
Rather than uninstalling Avast try this:

On the Internet Mail Scanner:

Customize > Redirect tab

Change the SMTP port to a something like 15025

Select OK

Terminate and restart the Internet Mail Scanner.

Now try your test.

I've just being doing some scanning - I'll write it up in another post.


O.K, I did as you suggested and it worked - no real difference between having outbound scanning enabled or disabled - speeds are still somewhat slower than they should be 75-80KBS vs. 90-92KBS. Still not sure why - maybe an Internet issue, we'll see tomorrow.

Could you explain the port change that you gave - why does it work? Any negative issues?

Thanks,
Harvey

What modem are you using? DSL?  Turn off your computer and unplug the DSL modem for 45 seconds and plug it in again and turn on your computer.

I'm using a cable modem not DSL. I don't think that is an issue since I get good up and down speeds when I use a speed test site.

Thanks,
Harvey
Title: Re: Avast 4.6.652 Email Problem
Post by: hgratt on May 17, 2005, 03:56:07 AM
I just did some tracing of the file activity involved in the sending of the message to which I referred in my post above. 

The message is apparently sent in fairly large blocks by the mail client.  These blocks are redirected to Avast which files them to a temporary
file.  Attachments increase in size when they are encoded so that filing took
8 seconds. 

Then for 151 seconds Avast was reading the file in 4k chunks and then, I assume sending each 4k chunk on to the network (and perhaps waiting for an acknowledgement).

On reading in the same message back in the network delivers in fairly large chunks which are passed to Avast and filed.  Avast then reads the file and scans it in 4K chunks before it is passed to the mail client.  since that is internal to the machine it is much faster than outbound and took only 5 seconds for the same message just sent out. 

It looks to me as though the Avast folks should look to making the transmission of the scanned message much more like the transmission from the mail client, ie much fewer and larger blocks.

Since this message can be read and scanned in 5 seconds Avast can do a much better job of making the transmission time a closer approximation of that which can be done by the client when Avast is not involved.

Not sure if you saw my previous reply. Why did changing the SMTP port work? Are there any negative effects to keeping the port number you indicated?

Thanks,
Harvey
Title: Re: Avast 4.6.652 Email Problem
Post by: hgratt on May 17, 2005, 04:16:06 AM
Upon further reflection - does using an SMTP port number that is NOT 25 mean that no scanning is done on the outbound file regardless of the box being checked?

Harvey
Title: Re: Avast 4.6.652 Email Problem
Post by: Lisandro on May 17, 2005, 04:28:56 AM
Upon further reflection - does using an SMTP port number that is NOT 25 mean that no scanning is done on the outbound file regardless of the box being checked?
Harvey, I was trying to read the thread but it's too long for me now... I start late...
Well, if you use any other port than the default ones, you should set them into the 'Redirect' tab of the Internet Mail provider settings (or MS Outlook plugin). Can you follow me? Do you need help in other specific point?
Title: Re: Avast 4.6.652 Email Problem
Post by: alanrf on May 17, 2005, 06:26:00 AM
Harvey (and any other readers),

in the redirect ports tab, if port 25 is specified and the Internet Mail Provider is active then the outbound mail traffic is still intercepted by Avast.  Whether that traffic is then scanned is determined by the "scan outbound mail" checkbox in the SMTP case.         
 
This is true for all the intercept ports in Internet Mail Provider.  Should one wish to have the provider active and "opt out" of having a particular class of traffic intercepted (for example NNTP) then it is necessary to ensure the the real port used is not specified to Avast.

At present, I believe that you have identified a real performance flaw in the SMTP scanning of Avast.  I shall be interested to hear the response from the Avast team. 

In the great scheme of things though, having my email take a bit longer to be scanned outbound I can live with.  Especially at the price point I pay for Avast which is, I believe, a great product. 

I am not a bigot on these products. If you check the e-mail forum of AVG you will find a "sticky" under my userid.  I did test it a while back and I got my e-mail to be scanned. 

I honestly believe that the email scanning is easier in Avast.  On one thing I regret I cannot defer, the support in this forum and the direct participation and assistance of the Avast development team cannot be matched by AVG.
   
 
 
Title: Re: Avast 4.6.652 Email Problem
Post by: MFB on May 17, 2005, 06:30:02 AM
I never been to a AVG forum, but I'm sure thier support team is somewhat helping othersas well.  :)
Title: Re: Avast 4.6.652 Email Problem
Post by: alanrf on May 17, 2005, 06:56:51 AM
The purpose of the AVG support forums is the same as those of Avast and I have made a contribution there.

However, if you have never visited then I'm sure your faith is well justified, despite the fact that participation in the AVG forums by the developers is very rare. 

Title: Re: Avast 4.6.652 Email Problem
Post by: lukor on May 17, 2005, 09:14:20 AM
Not sure if you saw my previous reply. Why did changing the SMTP port work? Are there any negative effects to keeping the port number you indicated?

Thanks,
Harvey

It has a slight drawback - the SMTP scanning is not working AT ALL. Unless of course you are connecting to TCP port 15025 which is rarely the case.
Title: Re: Avast 4.6.652 Email Problem
Post by: alanrf on May 17, 2005, 09:20:03 AM
Lukas,

your comment is somewhat disengenuous if you read the thread.  He wanted to conduct a test with Avast not intercepting the traffic, I told him how to do this and I made it very clear that this was a method of not intercepting SMTP traffic. 

Perhaps you can come back and advise us of the team's finding on the basic point of this thread ...  that this user has identified a performance flaw in the way Avast transmits the SMTP traffic after scanning the data.

Will you also confirm (truth in advertising) that selecting the "do not scan outgoing messages" does not stop Avast from intercepting the traffic on the port specified or defaulted in SMTP in the Redirects tab?
Title: Re: Avast 4.6.652 Email Problem
Post by: lukor on May 17, 2005, 09:41:58 AM
Lukas,

your comment is somewhat disengenuous if you read the thread.  He wanted to conduct a test with Avast not intercepting the traffic, I told him how to do this and I made it very clear that this was a method of not intercepting SMTP traffic. 

Perhaps you can come back and advise us of the team's finding on the basic point of this thread ...  that this user has identified a performance flaw in the way Avast transmits the SMTP traffic after scanning the data.

Will you also confirm (truth in advertising) that selecting the "do not scan outgoing messages" does not stop Avast from intercepting the traffic on the port specified or defaulted in SMTP in the Redirects tab?

Sorry, perhaps I did not understood it correctly. I though this is being offered a solution to speed the whole process not as a diagnostic measure.

Anyway, unchecking the checkbox "Scan outbound mail" on SMTP tab has exactly the same effect - it does stop avast from intercepting the traffic on the particular port completely. Slightly different behavior is in WebShield, when with unchecked "Enable Web Scanning" checkbox it still redirects the traffic and may do the page blocking if configured.
Title: Re: Avast 4.6.652 Email Problem
Post by: lukor on May 17, 2005, 09:52:29 AM
Lukas,

your comment is somewhat disengenuous if you read the thread.  He wanted to conduct a test with Avast not intercepting the traffic, I told him how to do this and I made it very clear that this was a method of not intercepting SMTP traffic. 


Don't want to argue but from this:

Quote from: hgratt
O.K, I did as you suggested and it worked - no real difference between having outbound scanning enabled or disabled - speeds are still somewhat slower than they should be 75-80KBS vs. 90-92KBS. Still not sure why - maybe an Internet issue, we'll see tomorrow.

Could you explain the port change that you gave - why does it work? Any negative issues?

one can think that hgratt is not entirely aware of the fact, that turning outbond scanning on or off with the changed redirected port makes no real difference since it is (for all practical considerations) turned OFF completely.

Title: Re: Avast 4.6.652 Email Problem
Post by: alanrf on May 17, 2005, 10:11:23 AM
Lukas,

you are the professional and I but the humble user and, honestly, it saddens me to disagree with you here. 

However , I just clicked off the "scan outgoing mail" and I monitored the file activity in the the temporary Avast folder.

Avast created exactly the same temporary file and read exactly the same temporary file as when I had "scan outgoing mail" selected for exactly the same message as I reported earlier in this thread.     

Now please tell me again that it does not intercept the traffic.
Title: Re: Avast 4.6.652 Email Problem
Post by: lukor on May 17, 2005, 10:22:31 AM
Alan,
the redirected port is unregistered when the outbound scanning is turned off. The service remains running but it stops to listen on that specific TCP port on localhost (12025 in this case). You can verify this but running netstat -a or TCPView.
Title: Re: Avast 4.6.652 Email Problem
Post by: alanrf on May 17, 2005, 10:29:45 AM
Perhaps a concession is in order that we may both be correct in a way.

I have just conducted the test again.

When I click off the "scan outgoing mail" then port 12025 ceases to be listening. 

It does not remove the intercept on port 25.

If I then terminate and start (again) the Internet Mail Provider then following the restart there is no intercept on port 25 and the temporary files associated with intercepted mail are not created.   
Title: Re: Avast 4.6.652 Email Problem
Post by: alanrf on May 17, 2005, 10:59:19 AM
I will happily agree that de-selecting the "scan outbound mail" option will stop intercepting the SMTP stream (ok - I admit I do think it should be with the proviso "but stop and restart the provider" to be sure). 

However, I do hope that the team will give serious attention to the points raised on the efficiency of the onward transmission of the scanned SMTP stream.

with respect and thanks to Lukas and all other participants,
 
Alan

who will now (try to) leave this one up to the Avast team.
Title: Re: Avast 4.6.652 Email Problem
Post by: lukor on May 17, 2005, 12:44:53 PM
I made some tests on our connection, sending 5,6MB mail with PDF attachment.

Avast disabled: 4 s
Avast enabled: 7 s

It is no doubtly a slowdown, but the times are so small I don't this this is a percentual slowdown of 75%. However Vojtech is aware of this thread, perhaps he'll be able to detect some performance issues in the code.

Lukas.
Title: Re: Avast 4.6.652 Email Problem
Post by: alanrf on May 17, 2005, 01:13:50 PM
Lukas,

with your connections - who needs to worry about performance?

(Except for us poor folks).

Thanks for the update.

Title: Re: Avast 4.6.652 Email Problem
Post by: lukor on May 17, 2005, 01:58:36 PM
Lukas,

with your connections - who needs to worry about performance?

(Except for us poor folks).
Thanks for the update.


On contrary. If there is a performance problem, it would appear on high speed networks more loudly. On dial-up even poorly written server is capable of serving data at 5kb/s, however serving at 100 Mbps is a completely different story.
Title: Re: Avast 4.6.652 Email Problem
Post by: hgratt on May 17, 2005, 06:13:42 PM
O.K, I did some more testing using a stop watch to verify the speeds that NetPerSec  was reporting. NetPerSec IS reporting the correct speeds - transmitted file size was about 2.2 MB.

Based on input from this thread, I have compared 3 scenarios (all standard ports are enabled):

1. Avast uninstalled -  I pretty much get my full upload speeds (90-92KBS), 24 seconds

2. Avast installed, outbound scanning on - about 40KBS, 59 seconds

3. Avast installed, outbound scanning off - about 81-83KBS, 27 seconds

FWIW, NAV always gave me the 90-92KBS speeds after it scanned any attached files.

So again, as indicated in this thread, is this a significant performance problem and if so, how long does it typically take to get something like this fixed?

Thanks,
Harvey
Title: Re: Avast 4.6.652 Email Problem
Post by: DavidR on May 17, 2005, 06:42:32 PM
Quote
FWIW, NAV always gave me the 90-92KBS speeds after it scanned any attached files.
The only problem I see with this statement is can you be sure that NAV and avast is scanning to the same level and method of scan/transmission, e.g. does NAV use a transparent proxy/localhost for scanning email and if it is a PDF attachment say, does NAV fully scan pdfs as there is a perception that pdfs are safe (if you only have the reader installed)?

I'm not sure what levels avast goes to in various attachment types but to make a comparison between avast and NAV they would need to be the same!
Title: Re: Avast 4.6.652 Email Problem
Post by: lukor on May 17, 2005, 06:48:31 PM
Hgratt, by the way what is your mail client?
Title: Re: Avast 4.6.652 Email Problem
Post by: alanrf on May 17, 2005, 09:21:51 PM
It seems to me pretty clear that the issue here is not one of scanning at all.

As I tried to make clear in an earlier post:

Scanning and onward transmission of my test message took 151 seconds when going outbound to the network.

The message just sent out was immediately read back in.

Scanning and onward transmission of my test message took 5 seconds when going inbound to the mail client.

I have to assume the same scanning of the same message is performed inbound and outbound. 

I believe Avast significantly changes the way the transmission is handled (number of blocks sent/blocksize).  That will not matter too much inbound where it is all internal to the machine but will cause delays in the onward transmission outbound.
Title: Re: Avast 4.6.652 Email Problem
Post by: hgratt on May 17, 2005, 09:32:40 PM
Hgratt, by the way what is your mail client?

I'm using the Mozilla Suite (1.7.8).

Another data point. I have a win98se machine (latest patches) which gives the same upload speed whether or not scanning is enabled (only get about 75KBS, not 90KBS). However, the redirect tab stuff is greyed out, so I'm assuming that no outbound scanning is done in win98se. Is this correct?

Thanks,
Harvey
Title: Re: Avast 4.6.652 Email Problem
Post by: lukor on May 17, 2005, 10:11:58 PM
Hgratt, have you performed the test with ZoneAlarm completely disabled? (right click on the icon and choose exit)
Thanks.
L.

Title: Re: Avast 4.6.652 Email Problem
Post by: hgratt on May 17, 2005, 10:19:49 PM
Hgratt, have you performed the test with ZoneAlarm completely disabled? (right click on the icon and choose exit)
Thanks.
L.



Yes, several times. The results are the same.

Harvey
Title: Re: Avast 4.6.652 Email Problem
Post by: alanrf on May 17, 2005, 10:42:42 PM
I just conducted my tests again this time with ZoneAlarm turned off.

I confirm Harvey's findings.  My are the same as I reported yesterday.

Just one extra test I conducted.

I paused the Internet Mail Provider.  It is my understanding that pausing the provider still intercepts the mail but does not scan it.  So it is just receiving the mail from the client and then retransmitting it to the network.

Result: the delay was exactly the same as when the provider is scanning.





Title: Re: Avast 4.6.652 Email Problem
Post by: sded on May 17, 2005, 11:36:34 PM
Another data point.  Since I encrypt all email (SSL/TLS) and normally scan with avast! anyway, using Stunnel for the encryption/decryption, compared uploading messages with/without avast!, but still using TLS.  Setup is 384kbps DSL uplink, XP with SP2, Thunderbird mail client, Sygate PF.  Total message size as received was 5.3MB, including a .kap (map) attachment.  With avast!/Stunnel took 176 sec (30KB/sec) to upload; without avast!, using TLS in TB, took 150sec (35KB/sec).  Max achievable link would be about 40KB/sec without encryption.  So even with encryption, I am not seeing the scanning overhead of the others.      Renamed the .kap to an .exe, and it took 195 seconds, including waiting for a warning message from avast that it was a suspicious file extension.  Tried again with a real .exe about the right size, actually ran slightly faster (more efficient scanning of known types?).  So what does all this mean?   Seems like there is nothing inherent in the flow through avast! that causes huge time discrepancies, at least with XP.    Results are entirely satisfactory and about as expected.  Message takes a lot longer oubound than inbound, but this is normal because the link is assymetric in speed.  Unable to repeat other results; do not see an avast! problem in this area.  Zone Alarm an issue? (vs Sygate).  Use of W98 and issue?  Faster uplink an issue?  (93kBps or 750kbps is much faster than most).  Something else to chew on.
Title: Re: Avast 4.6.652 Email Problem
Post by: alanrf on May 18, 2005, 12:08:32 AM
sded,

interesting observations. 

Both Harvey and I are on Win XP Pro SP2.  Both of us use ZoneAlarm as the firewall.  Both of us have reported here that the results are unchanged when ZoneAlarm is deactivated.

I, like you, use Thunderbird and, like you, I have a 384Kbps upload speed but I am using the same cable service provider as Harvey even though he has a much faster uplink.

 We both experience a slowdown when the outgoing mail is interecepted (whether it is actually scanned or not in my testing).  It does seem that Harvey, with his much faster uplink, encounters a greater degree of slowdown than I do. 

So, Win98 is not an issue, nor is the Firewall. 

Unfortunately I do not have an account similar to yours that I can test mimicking your encrypted configuration as an apples to apples test. 
Title: Re: Avast 4.6.652 Email Problem
Post by: hgratt on May 18, 2005, 12:24:47 AM
Another data point.  Since I encrypt all email (SSL/TLS) and normally scan with avast! anyway, using Stunnel for the encryption/decryption, compared uploading messages with/without avast!, but still using TLS.  Setup is 384kbps DSL uplink, XP with SP2, Thunderbird mail client, Sygate PF.  Total message size as received was 5.3MB, including a .kap (map) attachment.  With avast!/Stunnel took 176 sec (30KB/sec) to upload; without avast!, using TLS in TB, took 150sec (35KB/sec).  Max achievable link would be about 40KB/sec without encryption.  So even with encryption, I am not seeing the scanning overhead of the others.      Renamed the .kap to an .exe, and it took 195 seconds, including waiting for a warning message from avast that it was a suspicious file extension.  Tried again with a real .exe about the right size, actually ran slightly faster (more efficient scanning of known types?).  So what does all this mean?   Seems like there is nothing inherent in the flow through avast! that causes huge time discrepancies, at least with XP.    Results are entirely satisfactory and about as expected.  Message takes a lot longer oubound than inbound, but this is normal because the link is assymetric in speed.  Unable to repeat other results; do not see an avast! problem in this area.  Zone Alarm an issue? (vs Sygate).  Use of W98 and issue?  Faster uplink an issue?  (93kBps or 750kbps is much faster than most).  Something else to chew on.

My upload speed is 768Kbits/sec or about 96KBS. When I have scanning turned on, my upload speed averages around 35 to 40KBS which is just about equal to your max upload speed. It may be that you don't see the effect since your scanning transfer speed is around the maximum upload speed that your ISP allows.

On the other hand, since I should see about 90-92KBS, I do see the effect.

Harvey
Title: Re: Avast 4.6.652 Email Problem
Post by: sded on May 18, 2005, 12:32:53 AM
Mine is definitely scanned, I see it in avast!  And get messages saying .exe attachments are suspicious.  Zone Alarm is still a concern because of all of the avast! incompatibilities earlier-and because it is hard to kill.  The encryption is actually inline with the scanning-TB to avast! unencrypted, scanned there, then encrypted in Stunnel and sent to the smtp server.  Both TB and avast! are unaware of the encrypted link, and even with the additional overhead all works fine.  Are either of you using OE?  It has a very nice logging capability under tools/options/maintenance that will log all the server commands and perhaps provide some insight.  Log will be at documents and settings/yourname/local settings/application data/identities/{garbage}/microsoft/outlook express/smtp.log with all the time stamped server traffic.
Title: Re: Avast 4.6.652 Email Problem
Post by: hgratt on May 18, 2005, 05:03:48 AM
Some more data points. I've now noticed that as time goes by with my browser open and Avast running, my upload speeds drop back down to low values even though scanning is disabled.

Also, if I send large files via Comcast webmail, I get full upload speed - around 92-94 KBS!

I can only conclude that email sending is, in general, broken in Avast 4.6. 

I will soon be able to get fiber optic cable with 2 mps upload speeds - I sure hope I don't have to go back to NAV in order to make use of the upload speed!

Harvey
Title: Re: Avast 4.6.652 Email Problem
Post by: alanrf on May 18, 2005, 06:56:44 AM
Harvey,

The figures posted by sded indicate that he does not encounter the problem though I wish he would do us both the favor of assuming we are capable of disabling a firewall. 

The timings posted by Lukas earlier today (while they may have a huge upload capacity - given the numbers posted) indicate that even for them there is a very clear deterioration in the sending capacity with Avast intercepting outgoing mail.  This is in line with the information we have supplied to Avast.

My experience with Avast has been that a problem is often not encountered by all users, the Avast team seem to accept that and work on the problem.  I do not, for a moment, believe that the Avast team is discounting this issue and I think it only fair to allow them time pursue their investigations.

As you know from your own experience not all anti-virus solutions are as easy to implement as Avast.   I have confidence that you will not need to return to NAV.

Alan