Avast WEBforum
Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: pinuccio on May 01, 2008, 04:41:56 PM
-
ashserv.exe big cpu occupancy is not related to scanning but as i read here searching for a solution
"The new rootkit scan happens about two minutes after your desktop is up as it needs to compare what windows API shows against what is hidden, so it shouldn't get in the way too much"
i tryed to boot and doing nothing but checking the task manager
infact after two minutes hd started working and ashserv.exe started growing in cpu occupancy so slowing the pc , you can do only soft work until the ashserv stops his work
in my pc xp sp2 2.8hz 1giga ram it takes about 12 minutes for ashserv to stop using the cpu so much , then everything is perfect
i hope this helps to find a way for avast to reduce or eliminate the problem
-
The rootkit scan needs to compare two sets of data as you found.
However, I don't notice any impact on my system which is no speed freak. If as you say, you are doing nothing, how does it slow your system.
What you are seeing doesn't seem to be the rootkit scan but something else (as your system is effectively more powerful than mine), so we need to find what else is going on.
Have (or did) you another AV installed in this system, if so what was it and how did you get rid of it ?
What other security based software do you have (especially that which is also running) ?
Is the avast ' a ' icon rotating during this high CPU (what percentage is attributed to ashServ.exe) ?
What sensitivity do you have the Standard Shield on (normal is the default) ?
-
i made several tryes , after the ashserv occupancy grows up if i navigate or do other things i notice that the pc is slower
i have no other av or similar programs and only necessary programs running in task manager , explorer , ashdp , cfmon
i had avg 3 years ago ,uninstalled in the classical way
normal or high has no influence , the icon is not rotating(obvious i'm doing nothing ) ,after two minutes i see the hd working and ashserv starts growing in occupancy
-
The reason for asking about the sensitivity is if you had it on High it would be scanning more files. However, if the icon isn't rotating then it may have stalled as the rootkit scan should take seconds rather than minutes.
- Vlk, always says that the guidelines for solving of the problem "ashServ.exe using too much CPU" has always been the same:
1. Check if the avast tray icon is spinning (while CPU usage is high)
2. If it is, click it (wait for the dialog box to open), and check which file is being scanned (the Last Scanned field); the Scanned Count value should be increasing (spinning icon means a scan is in progress)
3. Find out which of the providers is scanning the file (click "Details" button and check out the Last Scanned value for each of the providers). The most common providers that may cause this are Standard Shield, P2P Shield and IM Shield.
Again this may not be to helpful as you say the avast icon isn't rotating, but it is worth checking.
Short of that revealing anything I would suggest a clean reinstall.
Download the latest version of avast http://www.avast.com/eng/download-avast-home.html (http://www.avast.com/eng/download-avast-home.html) and save it to your HDD, somewhere you can find it again. Use that when you reinstall.
Download the avast! Uninstall Utility, find it here (http://www.avast.com/eng/avast-uninstall-utility.html) and save it to your HDD.
Now uninstall (see below) using the Add Remove programs, reboot, run the avast Uninstall Utility, reboot, install the latest version, reboot.
It may be necessary to disable the avast! Self-Defence module (Program Settings, Troubleshooting section) if you are unable to uninstall using the Add Remove Programs before running the Uninstall Utility. Or, boot into safe-mode and start aswClear.exe (the uninstall utility) from there.
-
"The new rootkit scan happens about two minutes after your desktop is up as it needs to compare what windows API shows against what is hidden, so it shouldn't get in the way too much"
Where did you read this?
I wish I had a more configurable situation here... can't we delay some minutes?
after two minutes i see the hd working and ashserv starts growing in occupancy
Does an 'i' icon appear? Isn't VRDB set to be generated when the computer is idle?
Besides this, you can follow David's suggestions as well.
-
"The new rootkit scan happens about two minutes after your desktop is up as it needs to compare what windows API shows against what is hidden, so it shouldn't get in the way too much"
Where did you read this?
This is something that I said in another topic, and it relates to something either Vlk or Igor said in explanation of the rootkit scan. I can't recall the topic now but I do remember it being stated that it runs after two minutes as there needs to be a delay, otherwise the scan might happen too soon before a rootkit is established so wouldn't appear in the comparison.
I don't know if a value in the avast4.ini file would be a particularly good idea.
1. it would then be possible to start it earlier possibly missing a rootkit not yet established.
2. the longer you delay it the more programs that would be running and some of those might throw up interesting results (not least an alert), by the fact that they are hidden (for legitimate reasons).
I think the Rootkit detection alert needs to be looked at as it isn't too clear if something is a rootkit or just suspicious/hidden. We have already seen this user confusion in the forums.
-
I don't know if a value in the avast4.ini file would be a particularly good idea.
Each computer has a different startup profile... stablishing two minutes without a possible change for this is, imho, a big mistake. It will make boot time longer and, in some cases, will mess the boot/login... you can bet it.
I think the Rootkit detection alert needs to be looked at as it isn't too clear if something is a rootkit or just suspicious/hidden. We have already seen this user confusion in the forums.
We'll have new messages in the next program update (I have already translated them).
-
in my pc xp sp2 2.8hz 1giga ram it takes about 12 minutes for ashserv to stop using the cpu so much , then everything is perfect
I have to doubt that this has anything to do with a rootkit scan at all. If, the information here is anywhere near correct there is some other problem. I have no issues of this kind (12 minutes!) on my old XP SP2 system (1Ghz and 512Mb).
-
"The new rootkit scan happens about two minutes after your desktop is up as it needs to compare what windows API shows against what is hidden, so it shouldn't get in the way too much"
Where did you read this?
This is something that I said in another topic, and it relates to something either Vlk or Igor said in explanation of the rootkit scan.
I think you must mean this message.
The rootkit scan runs a few minutes after the desktop loads (it's a rootkit scan - looking for active rootkits (= hidden files, processes, ...); so, there's actually no point in trying to load as soon as possible, because if the rootkit is not yet active - it's not hidden, and it wouldn't get detected, at least not as a rootkit).
The boot-time scanner has also been improved, regarding the detection of hidden files (should the rootkit already be loaded at the time boot-time scanner runs).
in my pc xp sp2 2.8hz 1giga ram it takes about 12 minutes for ashserv to stop using the cpu so much , then everything is perfect
I have to doubt that this has anything to do with a rootkit scan at all. If, the information here is anywhere near correct there is some other problem. I have no issues of this kind (12 minutes!) on my old XP SP2 system (1Ghz and 512Mb).
We've got a similar system (XPSP2 2.0ghz CPU 1gb memory) here but it takes no more than a few minutes.
-
The rootkit scan runs a few minutes after the desktop loads (it's a rootkit scan - looking for active rootkits (= hidden files, processes, ...); so, there's actually no point in trying to load as soon as possible, because if the rootkit is not yet active - it's not hidden, and it wouldn't get detected, at least not as a rootkit).
Igor, can't this be configurated? :(
-
Please don't take this the wrong way Tech ... but what has the timing got to do with this?
Surely the problem here is not the timing of the rootkit scan but what is happening on this system that is taking up so much CPU. On my systems this scan takes seconds not many minutes.
The user is not going to like the scan at any time if it makes the system so slow.
-
Tech:
[AntiRootkit]
WaitOnStart=time_in_seconds
pinuccio: What if you run
<avast-path>\ashQuick.exe "<RTK>SUPERQUICK"
- how long does the scan take?
-
[AntiRootkit]
WaitOnStart=time_in_seconds
Thanks Igor.
Updated info: http://forum.avast.com/index.php?topic=1647.msg21553#msg21553
-
Tech:
[AntiRootkit]
WaitOnStart=time_in_seconds
pinuccio: What if you run
<avast-path>\ashQuick.exe "<RTK>SUPERQUICK"
- how long does the scan take?
cannot make it work , don't find the route
c:\programmi\ alvill....
-
strange
probably i have just realized avast has never scanned my mail in 3 years
i had "outlook-excange" in avast , never seen the icon of mail in work and no written confirmation in mails sent
in the last avast installed there is "internet mail" and now works even with "outlook-excange" terminated , but i use outlook express not mail in internet , with "internet mail" i now see that mails are scanned
"outlook-excange" doesn't work with outlook express ?
-
<snip>
pinuccio: What if you run
<avast-path>\ashQuick.exe "<RTK>SUPERQUICK"
- how long does the scan take?
cannot make it work , don't find the route
c:\programmi\ alvill....
Open a command window, type cmd in the windows, start, Run window, then try changing the folder to the avast4 folder and type the command again or contain the path in quotes " " as well, not just the "<RTK>SUPERQUICK" part.
<snip>
"outlook-excange" doesn't work with outlook express ?
I suggest a browse of the avast help file.
-
so
i can do boot scan
once booted , i can do the quick scan option but standard and thorough don't work scan is stopped wuile scanning windows dir, i read that rootkit scan is done only on standard and thorough
is the rootkit scan done in boot scan ?
-
Yes a boot-time scan includes the rootkit scan, however a Quick scan in the Simple User Interface doesn't (only Standard and Thorough include it).
-
Yes a boot-time scan includes the rootkit scan, however a Quick scan in the Simple User Interface doesn't (only Standard and Thorough include it).
ok i remembered well (read somewhere)
so it is almost impossible to understand why avast locks up in standard and through mode i think (they lock in windows dir but other antivirus do not lock up and this lock up wasnì't present time ago maybe before the rotkit scan , who knows ?),anyway boot scan , quick and scan with other antivirus are all ok
at least i have discovered that my mail was not protected and i solved it
i prefer avast anyway , has blocked those few dangers i met and has solved with a network scan a huge problem in another pc with another antivirus that was fooled by a bad virus
-
so it is almost impossible to understand why avast locks up in standard and through mode i think (they lock in windows dir but other antivirus do not lock up and this lock up wasnì't present time ago maybe before the rotkit scan , who knows ?)
avast shouldn't lock up anything and shouldn't be locked up at any folder...
anyway boot scan , quick and scan with other antivirus are all ok
Other antivirus? ???
At the same time as avast?
-
not At the same time
-
not At the same time
Good.
Right now, any problem with avast? Can we help further?
-
selecting folders then thorough scan, it works , no locks up ,maybe rootkit scan is'nt involved with that scan option , anyway it works fine
thanks
-
has the roootkit scan been moved forward in the last software updates ?
now instead of 120 seconds ashserv.exe starts working hard after 5 minutes from the boot
ps.quick scan works , standard scan lock up after some second in windows dir , thorough scan lock up in windows dir too but after some minute
just curious
-
Yes, I think the rootkit scan has been postponed a bit.
It's better to run an antirootkit scan when "nothing is happening" (i.e. not very soon after the computer is started, because many programs are being started and finished at that time, which is not good).
-
Yes, I think the rootkit scan has been postponed a bit.
Which is the default now?
-
ok
with the last avast upgrade rootkit scan seems starting after 8 minutes but there is no more the cpu usage lasting for 13 inutes (same in standard and thorough scan , no more lock ups for 13 minutes)
very good , but
how can i be sure avast has done the rootit scan ? the stand alone rootkit scan still goes on for miutes while the standard rootkit scan in avast is unnoticed , good but while before i had that behaviour now it seems too good to be true
-
If you look in the avast log folder you will find a file containing a report of the last rootkit scan with start and end times logged. The file is called aswAr.log.
-
If you look in the avast log folder you will find a file containing a report of the last rootkit scan with start and end times logged. The file is called aswAr.log.
thanks found
is it possible it lasts only 6 seconds ?
the stand alone goes on for minutes like it did before the avast version too
-
Mine only lasts for 3 seconds.
Which "standalone" do you mean the asqhquick method or the aswar.exe program?
-
Rootkit scanning is much faster... is just comparing 'before' and 'after' processes running to discover hidden files and infections.
-
Mine only lasts for 3 seconds.
Which "standalone" do you mean the asqhquick method or the aswar.exe program?
aswar.exe
-
aswar.exe
Do you mean that default avast antirootkit scan last only few seconds? ???
-
The aswar.exe has not been updated since the initial beta release (at least it had not been yesterday when I checked again). No doubt when the standalone version is released as a full product it will display the same speed improvements that are now incorporated into the main antivirus.
-
aswar.exe
Do you mean that default avast antirootkit scan last only few seconds? ???
yes , the avast rootkit scan at start up after 8 minutes lasts few seconds, check the log , the same in standart and thorough scan , very good , before i had to disable it because my pc was very slow for many minutes
standalone aswar.exe beta stll lasts many minutes at high cppu occupancy as said above