Avast WEBforum
Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: larrymcg on July 06, 2011, 02:04:13 AM
-
Using avast! 6.0.1203 and latest virus defs (110705-1).
I know that Retrospect 6.5 is old but it works just fine on my WinXP system and I've also had multiple generations of Avast! running on the system for several years. But the latest program upgrade to avast 6.0.1203 is killing Retrospect. The symptom is that starting Retrospect takes several minutes (rather than a few seconds). During that time the PC is essentially unresponsive: e.g., task manager takes 30+ seconds to start; the avast! icon in the system tray is spinning very very slowly and jerkily; trying to open avast! take a minute or so; etc. The task manager shows no cpu load (System Idle Process at 98+ percent). Disabling the real-time shields clears everything up.
I haven't a clue about how to diagnose this. I tried enabling the 8 shields one at a time. The File System shield certainly causes the problem but so does the Script Shield and I think others. The Behavior shield was OK. Turning the shields on and off finally caused Retrospect to generate an error claiming it couldn't save my configuration and all of a sudden Retrospect was set back to a just installed condition with all my selectors (and other customizations) gone! So I quit the experiment of turning shields on and off and tried to reconstruct my Retrospect customizations. (I think I recreated the most important ones.)
Turning off the shields is not how I want to do my backups but I will if I have to.
I tried a System Restore to go back a few days but the restore acted flakey and I felt lucky I got a running machine back. Although System Restore claimed that the restore to the earlier date worked I still had the latest Avast program but I had an earlier definitions file (which avast updated quickly). And Retrospect was still hosed.
Suggestions what to look for?
--Larry
-
I posted a concern earlier today, similar to yours.
My application was Raxco's Perfect Disk 7 (a defragger from 2004)
which I've had installed for years and has worked fine with Avast!
until this latest update.
IN my case disabling the shields didn't affect the problem.
EDIT I was wrong, disabling the shields alleviates the problem.
-
I'm glad it didn't break Norton Ghost (my "other" backup facility). But I'm still wondering if I will find some other apps that have been broken.
I don't suppose that just a virus definition file update could clear things up?
--Larry
-
Do you see a process called "sf.bin" running during the wait?
Thanks
Vlk
-
No sf.bin during the wait. I didn't see it at all.
I should also mention that the big slowdown does not clear up even after Retrospect has finally gotten started. For example, clicking the avast! icon opens the avast user interface but it takes a long time to open and then clicking anything in the avast interface is really, really slow. But so is clicking anything in the Retrospect interface.
Closing Retrospect takes a long time and then the system returns to normal.
--Larry
-
I have observed the same behavior as larrymcg.
Vlk, it should be easy for Avast! to recreate the problem? Seems to be a combination
of some specific programs, recent version of Avast! and XP.
-
Same issue here.
Win XP
Retrospect ver 7.6.123
avast free 6.0.1.203
Worked ok before the update to v203
I was able to determine that turning off 3 of the shields (file, p2p, and im) and leaving the others active took care of the issue, so there may be a common file or process in those 3 shields that is the cause.
The only solution as of now is to go back to the previous version of avast.
Can anyone from Avast respond to this issue?
-
Same, exact program versions and issues and solutions as major28.
Would like a better solution than turning off shields!
-
Hi everyone,
I'm running Retrospect Express 7.6.123 and seeing exactly this issue with Avast! Free 6.0.1203 in Windows XP SP3.
I would strongly suggest grabbing a copy of Process Monitor 2.95, found here:
http://technet.microsoft.com/en-us/sysinternals/bb896645
...and using it to observe what happens when Avast! 6.0.1203 is disabled vs. enabled while running Retrospect or anything else that seems to slow to a crawl with Avast!'s shields enabled, as I've been able to at least narrow things down a bit this way. I've also filtered things by process name, including only AvastSvc.exe, avastUI.exe (which I am using to selectively enable or disable various components of Avast! one at a time), and sf.bin (have not seen it but just in case) - in addition to retrorun.exe and Retrospect.exe, which are Retrospect's processes. I also suggest enabling advanced output in the Filter menu of Process Explorer, and cross-referencing the operations detected with the descriptions found in these links:
http://msdn.microsoft.com/en-us/library/ff550710%28v=VS.85%29.aspx
http://www.osronline.com/article.cfm?id=166
What I have found so far is as follows:
* When Avast!'s shields are all disabled, I can run Retrospect with no issue; speed is fine. When it is running, I see Retrospect.exe checking the root directory of each of my drives, one after the other, apparently just making sure they're available for use as far as I can tell - this is constant but pretty low level and causes no noticeable slow-down, so I presume it's normal activity.
* I can enable Mail Shield, Web Shield, Script Shield, Network Shield and Behavior Shield, all with default settings, without this changing.
* When I enable File System Shield, P2P Shield or IM Shield - to be clear, enabling any of these individually with the others disabled causes the same result - Retrospect.exe goes absolutely bonkers, and starts pounding the MFT on my root drive with IRP_MJ_READ operations, in addition to simultaneously carrying out all kinds of FASTIO_ACQUIRE_FOR_CC_FLUSH and FASTIO_RELEASE_FOR_CC_FLUSH operations on various files, primarily Windows system files (i.e. in C:\WINDOWS\ and various subdirectories) with some additional action targeted at my Program Files (C:\Program Files\*) and my local user profile (C:\Documents and Settings\Username\*). What's weird is that Avast itself doesn't seem to be doing much at all during this time - perhaps I've missed a process, but I don't see any activity at all, really. Based on my reading, I believe the IRP_MJ_READ operation to be just that - a read operation - so Retrospect is being induced to read the MFT of the partition on which it's installed constantly. Also from my reading, the FASTIO operations above are designed to open and close the file in question for access - so Retrospect appears to be repeatedly opening and closing all kinds of files for access on my OS partition as well, without actually doing anything to them. Very odd.
I have tried disabling all features in the Expert Settings of each of the offending shields, to no avail - even then the same behavior occurs, so it's something those settings do not touch.
I recently let Retrospect attempt a backup under these conditions; it ran incredibly slowly and generated 1017 errors indicating that it was unable to write to the catalog file, snapshot, and backup set due to insufficient permissions. I don't find any problems with the permissions associated with these files.
At this point, I'm at a loss as to what else to try; nevertheless, I hope the folks will find this information useful and the Avast! staff can find a fix for this ASAP - as the other posters have said, this is seriously annoying >:( Even if it turns out to be the fault of the folks who coded Retrospect / other applications that experience this, I would emphasize that in almost two years of using Avast! and Retrospect together, this is the first I've seen of this, meaning it should be possible to alter Avast! to prevent it from happening; clearly, that's what needs to be done. Would welcome comments from others as to whether they see similar behavior.
In the meantime, I intend to disable these shields temporarily to perform backups - this is going to require me to backup manually, which is extremely obnoxious, but it beats not having a backup at all.
Regards,
DS
-
DS,
What an amazing first post! Thanks!
I hope it helps someone get a handle on the problem.
--Larry
-
Same issue here. :'(
Win XP
Retrospect ver 6.5
avast free 6.0.1.203
-
Hello again,
Quick update - with the File System Shield, P2P Shield and IM Shield disabled but the other shields running, Retrospect Express 7.6 was able to carry out my usual backup process successfully, in the usual time and without incident.
For those with issues running Retrospect, I would recommend doing the following: just before leaving your PC for sufficient time for your backup routine to complete (i.e. going to sleep, going to work, whatever), disable only the above three shields until the next restart (need to open the Avast UI to do this), run Retrospect manually, set it to shut down or reboot once finished, and disable any network services / file transfers from untrusted sources while this is going on. These procedures should minimize the security risks associated with this annoyance, and will save you from having to remember to manually turn the shields back on the next time you use the computer (plus if you run a server that's set to execute on startup, it should come back as well).
PS - larrymcg, thanks very much for the kind and positive feedback! We are hoping for the same thing :)
Regards,
DS
-
Same, exact program versions and issues and solutions as major28.
Would like a better solution than turning off shields!
Well, I did suggest the solution.
Go back to the previous version of avast.
6.0.1125 works just fine...just set autoupdate virus definitions only, and to notify for program updates. That way you don't install the buggy version.
The workaround posted by others is too messy.
-
Hmmm...actually, that gives me an idea... The release history for Avast! is here:
http://www.avast.com/release-history
The changes from 6.0.1125 (which behaves) to 6.0.1203 (which does not) are as follows:
improved compatibility with Windows Vista SP0/SP1 (activation issues)
attempt to solve the "Windows Media Player using a red skin" problem
Firewall: solved the compatibility problem with uTorrent
improved load time of WebRep IE plugin
fixed a bug in Google Chrome WebRep plugin causing excessive CPU usage
improvements in the silent installer
improved the CommunityIQ sample submission process
improved detection/removal of the most stubborn rootkits (TDL family)
various stability and compatibility improvements in the sandbox module
added new CreditAlert feature (US customers only)
added Thai and Serbian language packs
While code can be fickle, the vast majority of these changes would not seem to be the sort that would cause the issue we're observing. My guess, therefore, is that this is the most likely culprit:
various stability and compatibility improvements in the sandbox module
Downgrading is a good stop-gap measure, but it's clear that this problem needs to be identified and dealt with. Since the update cycle is pretty short for Avast!, hopefully this will not take too long; I imagine it should be possible for them to reproduce the issue, revert the above changes one by one, and see which one is causing it.
Regards,
DS
-
The latest program upgrade to Avast! 6.0.1203 killed Norton Ghost 12.0 for me. Reverted back to 6.0.1125 and Ghost is happy again. I am running 6.0.1125 with the latest virus defintions so it's definitely the program and not the definitions. Hope the guys at Avast figure this out, so I can continue to keep my program up-to-date. For now I've switched off automatic program updates.
-
dustygold,
It doesn't affect my Norton Ghost 10. Probably lots of changes between versions 10 and 12 of Ghost.
--Larry
-
This is also happening to me with SUMO (a program that helps you keep your soft up to date) on winXP 64. On win7-64 it works just fine.
I must say, though, that I DO see sf.bin opening and closing several times a minute while SUMO is running. All other progs work fine.
It worked fine before...
-
any clues as to this sf.bin issue?
It's not only that sf.bin opens and closes continously, but that it slows down the PC to a crawl while it's happening.
-
I also noticed that the Sandbox options are missing from the "additional protection" tab, only Webrep and URL Blocking.
So, no way to change the sandbox options. I suspect sf.bin is related to Sandboxing.
What is wrong here?
I even un-installed avast and re-installed b1023, to no avail.
any ideas?
-
We found the problem - you can patch avast (see here (http://public.avast.com/~kurtin/patches/)) or wait for next program update
Thanks!
-
Thanx a lot!!!!
-
Oops, patch didn't work at all.
1) the files contained in the patch zip file didn't replace any files on \windows\system32\drivers) (the files aswndis2.sys and aswndis2.sys.sum didn't exist in \windows\system32\drivers).
2) I see no change in behaviour: sf.bin continues opening and closing and the autosandbox options are completely missing from the additional protection tab).
In short: nothing changed.
too bad...
-
@jvidal, those patches are only for PerfectDisk/Norton Ghost/Retrospect apps -- you have a problem with sf.bin
-
What can I do about that?
Uninstalling avast makes SUMO work ok again.
And SUMO worked fine with prev. versions of avast...
What can I do?
bye!
-
What can I do about that?
Uninstalling avast makes SUMO work ok again.
And SUMO worked fine with prev. versions of avast...
What can I do?
bye!
I'll test it and let you know...
-
The patch did not fix anything on my WinXP system w.r.t.Retrospect.
The two files in the download did not exist anywhere on my system until I got them from the download.
The instructions say to disable avast's self-protection. I wasn't sure what that was referring to so I disabled all the real-time shields and the Self-defense module. None of these things is called "self-protection".
--Larry
-
From the avastUI, Settings, Troubleshooting, there you can disable the self-defence module.
-
DavidR,
As I said in my post, that's what I did (in addition to disabling the real-time shields).
Anyone getting a good result with the patch?
--Larry
-
Isn't aswndis2 the Avast! firewall ? Is this applicable to the free version ?
-
I'll test it and let you know...
Thanks, I'll wait for the good news.
Strangely enough, though, everything seems fine under w7-64.
-
After updating to Avast!6.0.1203 I had the same symptoms:
after startup all activities were very very slow, if not impossible. After deleting Retrospect process from the list of active processes in the task manager, things worked normal.
Instead of going back to older Avast-Version I now removed RetrospectExpress HD (Ver. 2.5.108) and Avast! works fine after startup.
I will chose another backup software until this conflict is fixed in Avast!
-
Win XP SP3
Retrospect Ver 6.5
AVAST PAID 6.0.1.203
Same here.
Retrospect 6.5 will not load and I am unwilling to jump through all of the hoops suggested here.
I pay for AVAST and the most recent version is unacceptable.
AVAST you broke it, you need to fix it, if not I will be gone.
-
The patch referenced here (http://forum.avast.com/index.php?topic=81135.msg667922#msg667922 (http://forum.avast.com/index.php?topic=81135.msg667922#msg667922)) fixed my problem with Retrospect. Thanks for the quick response.
-
The posted patch fixed my Retrospect related problem, too.
Thanks!
:)
-
Amazing! The avast folks changed the patch without telling us (at least I can't see an announcement). The new download has different files in it (at least for the 32bit version for Retrospect). They don't even have the same names. I think the instructions for installing the patch are different too. :-\
But the good news is that the updated patch worked for me (whereas the original patch didn't).
Thanks for the updated patch!
--Larry
-
Hi all,
For the record, I can confirm that the most recent patch does work with Retrospect Express 7.6 under XP SP3. Very good to see this fixed, now I can stop doing backups manually with shields partially disabled...
DS
-
And for the record, I can confirm that the virus definition update 110723-0 breaks the patch.
Have not tried reinstalling the patch yet as I am trying to decide whether to go back again to the previous version or keep patching this thing over and over.
-
That's a very odd result, especially given that the patch was for the actual code (aswMon2.sys), not the definitions - would be strange that definitions would be able to cause bad behavior in code. Not impossible, mind you, but very strange.
To test this, I installed the 110723-0 definitions on my system as well - again, WinXP SP3 with Retrospect Express 7.6.3.102 and Avast! Free 6.0.1203. I then cranked up Process Monitor and ran Retrospect, but saw no slowdown nor any of the activity associated with the slowdown that I reported before, so unfortunately I'm not able to reproduce this behavior. Has anything else changed with respect to your system, or did it only start doing this on reboot or something? Have not rebooted my system yet, to be fair... The only thing we might've done differently is that I did not overwrite the old aswMon2.sys in Avast!'s INF folder - rather, I renamed it aswMon2.sys.bak - don't see why that should make a difference, though...
DS
-
Disabling shields in Avast! solved this problem for me. However the problem also existed for me with Diskeeper9, and disabling the shields in Avast! solved this problem, too. Both of these programs failed to load unless I disabled the Shields in Avast!
WinXP Home SP3 OS.
-
That's a very odd result, especially given that the patch was for the actual code (aswMon2.sys), not the definitions - would be strange that definitions would be able to cause bad behavior in code. Not impossible, mind you, but very strange.
To test this, I installed the 110723-0 definitions on my system as well - again, WinXP SP3 with Retrospect Express 7.6.3.102 and Avast! Free 6.0.1203. I then cranked up Process Monitor and ran Retrospect, but saw no slowdown nor any of the activity associated with the slowdown that I reported before, so unfortunately I'm not able to reproduce this behavior. Has anything else changed with respect to your system, or did it only start doing this on reboot or something? Have not rebooted my system yet, to be fair... The only thing we might've done differently is that I did not overwrite the old aswMon2.sys in Avast!'s INF folder - rather, I renamed it aswMon2.sys.bak - don't see why that should make a difference, though...
DS
Nothing has changed.
An inspection of aswmon2.sys shows that the update reverted it back to a file date of 7/4/2011 wheras the patched file had a date of 7/18/2011.
-
Hi major28,
Again, very odd - this did not happen when I applied the most recent definitions update. Did you disable Avast's auto-protection module then copy all patched files to both directories as indicated in patch instructions? In any event, I would just try again, it *does* work...
DS
-
Win XP SP3
Retrospect Ver 6.5
AVAST PAID 6.0.1.203
Same here.
AVAST you broke it, you need to fix it, if not I will be gone.
The fix is here: http://public.avast.com/~kurtin/patches/
Use it..!! ;)
-
Hi major28,
Again, very odd - this did not happen when I applied the most recent definitions update. Did you disable Avast's auto-protection module then copy all patched files to both directories as indicated in patch instructions? In any event, I would just try again, it *does* work...
DS
Yes, did the patch in accordance with the instructions.
Reapplied it again....and it looks like it stayed ok after a shutdown/startup.
I am sure it was applied correctly before also...was fine for a couple of days.
I don't think I am the only one with the issue, as I believe I read that another person also had it revert back after an update, so we'll monotor it and I'll post if it happens again.
-
Glad to hear it worked on reapplication at least! Not sure what to say otherwise, as I say the only potential difference I can think of is that I renamed instead of overwriting... Odd.
DS
-
Ditto -- WinXP SP3
-
The latest program update to Avast Free also broke my Ghost 12 -- the service is apparently blocked from starting by Avast.
-
The latest program update to Avast Free also broke my Ghost 12 -- the service is apparently blocked from starting by Avast.
Use the patch: http://public.avast.com/~kurtin/patches/
-
Thanks for the info on the patch. My copy of Retrospect Express 7.6.123 now seems to be running 'normally' and is in the middle of my first backup for a few weeks! :)
-
Avast! 6.0.1125 upgrade also killed my System Mechanic Professional 10.5. Previous version of Avast! worked fine together. Now I'm getting "Invalid Floating Point Operation" error when I try to load SM and it tries to load continuously. Will Avast! 6.0.1203 update fix this issue?
-
Hi major28,
In regards to your previous post:
And for the record, I can confirm that the virus definition update 110723-0 breaks the patch.
Have not tried reinstalling the patch yet as I am trying to decide whether to go back again to the previous version or keep patching this thing over and over.
...I think I now have an explanation. As I'm sure you recall, my own experience was not the same in that when I updated my definitions, the patch kept working. That said, I recently scheduled a full boot-time scan on my machine. Once I did that, the patch stopped working and the problem returned. Recopying the files solved the issue. Bizarre behavior, but likely a result of the self-protection routines built in to Avast, I'm guessing - presumably it restores the original files during the boot-time scan... Anyway, just wanted to let you (and others) know, in case they ran into the same issue. I'm now wondering if perhaps any sort of scan of the directories in which the patched files reside would do the same. Anyway, let's hope a more permanent fix emerges soon. Best wishes,
DS
-
Still having problems as it seems every update "breaks" the patch. If I continually re-install the patch after every update, then all works again. But REALLY??? This is getting ridiculous.
-
Just to add another voice to the chorus: Since upgrading avast! yesterday to 6.0.12, my Retrospect 7.0.5 is running riot, rendering our network server practically useless. Since there appears to be no solution in sight and rolling back avast! isn't very practical, I guess it's time to replace avast!...
-
Correction: Found the patch and can confirm that it appears to resolve the issue. I am surprised that avast continue to distribute the 6.0.1203 build. Why not replace with a patched 6.0.1204 image?
-
After several weeks of troublefree performance with Retrospect, something (possibly a virus definition update) broke it again today. Why this happens from time to time is mysterious. It reverts aswMon2.sys back to the 7/4/2011 date as opposed to the "patched" 7/18/2011 date. And, it only does this in the program directory...the \Windows\System32\drivers copy of the file remained intact.
-
After several weeks of troublefree performance with Retrospect, something (possibly a virus definition update) broke it again today. Why this happens from time to time is mysterious. It reverts aswMon2.sys back to the 7/4/2011 date as opposed to the "patched" 7/18/2011 date. And, it only does this in the program directory...the \Windows\System32\drivers copy of the file remained intact.
Use the latest beta: http://forum.avast.com/index.php?topic=83583.0