Avast WEBforum
Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: neommy on September 29, 2011, 11:26:15 PM
-
Recently, I had a slowdown at my IE 9. I found the reason as the temporary files produced by Avast, at the %temp%, Low, _avast_ folder. Well I like surfing, and there were 850,000 files there, deposited nearly in one month, and it required hours for deleting! :-[ Now I can surf as quickly as before! Is there a way of preventing such a build of temporary files? Is such a huge number of temporary files required for Avast to work? I deleted them 2 days ago, and they are already 35000 now! :-\
-
The unp99999999.tmp files in the c:\windows\temp\_avast_\ folder (is where avast unpacks/sends copies of files to be scanned) are placed there by avast so that they can be scanned, on successful completion of the scan that folder should cleared with exception to the webshlock.txt file.
So clearly there is something wrong on your installation, something blocking the clearing/scanning of files in that folder.
Have (or did) you another Anti-Virus installed in this system, if so what was it and how did you get rid of it ?
What other security based software do you have installed (and are they resident), anti-spyware/malware applications, etc. ?
-
" The unp99999999.tmp files in the c:\windows\temp\_avast_\ folder (is where avast unpacks/sends copies of files to be scanned) "... The _avast_ folder at " temp " seems completely empty. The avast temporary files are gathered at " temp\Low\_avast_ folder! The full correct path is; AppData\Local\Temp\Low\_avast_ ...
I reinstalled already, and 35000 temp files in just two days! I have resident Comodo, Spybot Search and Destroy, no other anti-virus and I did not try any. Sometimes I full scan with Malwarebytes Anti Malware or Windows Defender. And I could not see " webshlock.txt " file there, in both _avast_ files? I am using windows 7, 64 Bit.
I have been using Avast free since nearly 5 years, mostly together with the Comodo and Spybot. I never had such a problem. I think everything started at most one or one and a half month ago. But I do not have the slightest idea why?
-
The webshlock.txt is only there when you are browsing and the web shield is active.
Reinstalling isn't going to resolve it if there is any conflict from another security application blocking the removal of the files in that folder.
I specifically asked about resident security applications, if MBAM isn't MBAM Pro it is unlikely to be that ?
I would advise you exclude the AppData\Local\Temp\Low\_avast_ from windows defender which is resident. I don't know how you have this AppData\Local\Temp\Low\_avast_ as the avast temporary folder as the one I mentioned is the default location. Presumably you have changed your environment variables for the Temp folder location ?
This strange Temp location may be the cause of the failure to empty it.
-
Just for info...I have this folder, but it is empty...
I have:
Appdata\temp\_avast_ <- Empty
Appdata\temp\low\_avast_ <- Empty
C:\Windows\Temp\_avast_ <-This is the one that is used, and contains webshlock.txt
-
Thank you for clear information about pathways spg SCOTT; :)
Sorry, for some misinformation, the correct ones are written below;
Appdata\temp\_avast_ <- This folder is empty at my computer!
Appdata\temp\low\_avast_ <- This folder is full with unp.......tmp files and their number is increasing steadily.
C:\Windows\Temp\_avast_ I have this folder with webhlock.txt, and nothing else.
I do not think that I have changed the place of any temp folder, at least knowingly.
In the last 3-4 days I have performed chkdsk twice.
I excluded C:\Windows\Temp\_avast_ from Windows Defender but nothing changed.
No, it is not MBAM Pro, I am using free version for making monthly scans only.
-
Check your environment variables and change the Temp location to c:\Windows\Temp\ that should then force avast to use the c:\windows\temp\_avast_ folder to unpack/scan/remove the files from that folder.
Though I'm at a loss as to why the webshlock.txt file is in there and no files. So I would also guess that the webshlock.txt isn't present in your Appdata\temp\low\_avast_ folder.
I'm not too surprised nothing happened with your exclusion in windows defender as there are no files in there, as you say they are in the Appdata\temp\low\_avast_ so that would be the folder to exclude.
Though I would say that you should consider changing the Temp environment variable.
-
Thank you for your help DavidR, I will try to change the Temp environment variable, but I am not an expert and it will take a few days.
-
Just use the windows Help & Support feature in your OS and type in Environment and that should pull up all the information you need to do this, see image extract (which is on my XP system, will differ for your OS).
Usually you can access this from Control Panel, System, Advanced System Settings, in my win7 system this is shown as:
Variable - TEMP
Value - %USERPROFILE%\AppData\Local\Temp
This uses the c:\windows\temp folder as the Temp environment variable and avast uses the c:\windows\temp\_avast_ folder.
-
Ok, below is the latest situation! ???
I reinstalled Avast free edition again and as you have said it did not solve my problem, I have these now;
C:\Windows\Temp\_avast_ Contains webshlock.txt...And there are some other files in Temp folder like hp files etc. too.
Appdata\temp\_avast_ <- Empty
Appdata\temp\low\_avast_ <- Still full of unp...tmp files.
In the Environment Variables I have two variables;
1.st one is;
Variable - TEMP
Value - %USERPROFILE%\AppData\Local\Temp
2.nd one is;
Variable - TMP
Value - %USERPROFILE%\AppData\Local\Temp
I now changed TEMP variable's Value to " C:\Windows\Temp " ..hope it will work, I must test a few minutes! :-\
-
I hope so too as this has been a weird one.
-
Sorry DavidR, no use: Still it is producing files, at somewhere else.
Now the situation is;
C:\Windows\Temp\_avast_ Contains webshlock.txt. No other file in _avast_ folder.
Appdata\local\temp\_avast_ <- Empty
Appdata\local\temp\low\_avast_ <- Still full of unp...tmp files.
Yes, and I do not know the slightest idea how this happened? :'(
-
I am not "the owner of the absolute truth", so I'm going to say this from a humble position, and I might be wrong.
I think you are "playing with fire" here. The defaults for TEMP and TMP are the ones you HAD.
For a clean complete uninstallation of Avast, you need to run the specific removal tool from Windows Safe Mode, indicating in the removal tool the correct installation folder and version(s). You need to reboot into Safe Mode for each version of Avast you ever had, so to really remove all relevant remnants.
Before reinstalling, you can delete all temporal files / folders related to Avast, manually and under Safe Mode if possible.
Then you need to download anew the latest stable setup.exe for Avast, install as administrator (right-click -> "Run as Administrator") and reboot immediately after the installation finished (no testing, no checking, no scanning, "nada" before reboot).
Whichever the reason for the old temp folders of Avast, or the current accumulation of "too many" temporal/older files related to Avast, I seriously doubt that changing the traditional TEMP folders is the solution. It might had been, if it was the other way around (using TEMP folders other than the traditional).
Of course, this is your system and you are free to try whatever you want.
-
ady4um, yes the system is my system, and so I changed everything to default, I uninstalled Avast with utility, ( and spybot and comodo and MBAM etc. ) very strictly doing what you have said. But nothing changed.
-
ady4um, yes the system is my system, and so I changed everything to default, I uninstalled Avast with utility, ( and spybot and comodo and MBAM etc. ) very strictly doing what you have said. But nothing changed.
There are also removal utilities for other security tools that you may think that you uninstalled. Some (but not all) of them are found at http://thewebatom.net/uninstallers/security-software/ (http://thewebatom.net/uninstallers/security-software/).
What I was trying to say is that, if you already have the default paths of TEMP/TMP (as it seems you had before you changed it), then those paths shouldn't be the reason for those temporal files, hence, why change it?
When you say "nothing changed", let me ask you specifically: after uninstalling all those tools (including Avast), have you deleted all those temporal files manually under Safe Mode, before reinstalling Avast under Normal Mode?
And to be clear, temporal files ARE created. The only problem would be if Avast is unable to delete them once in a while (BTW I don't know if the deletion frequency is constant). The creation (and deletion) frequency depends on the updates of Avast (which are sometimes more "partial" with less KB to download, and sometimes more "complete").
-
Thank you for the removal utility page, ady4um, will use in the future!
And yes I cleaned all the tmp files before reinstallation manually in the safe mode, I even cleaned the registry manually, for the word " Avast".
I think best will be a new system installation in a short time, and until that manually cleaning the tmp files from time to time.
-
... and until that manually cleaning the tmp files from time to time.
If you have enough space, then I would try leaving it "as-is". Windows itself also partially works like this, automatically cleaning some areas only when "really" needed.
By "letting it be", you could also test this Avast temporal files/folders during and up to, say, 40 days, to check if either the number or the total size is still increasing, or it has stabilized in a certain value (more or less).
It may well be "just annoying but nothing to really worry about".
-
Yes, I will leave it as it is. But as I mentioned in my first message, ( when I understood the problem because of the slowing at IE, the number of files were 850000! ) it takes a long time to delete after such a build up of files. I will delete them in every two weeks at most. And I will watch the situation, as DavidR mentioned this is a very weird problem.
Thank you for your help DavidR and ady4um.
-
This is interesting...
Just got an alert in this location...
08/10/2011 16:55:47 C:\Users\Scott\AppData\Local\Temp\Low\_avast_\unp208123638.tmp [L] HTML:Iframe-inf (0)
File was successfully moved to chest...
FileSystemShield alerted. On what should have been a webshield alert...weird...
(I say webshield because it is a website that is causing this alert.)
-
Well I still think that there an issue with the temp variables, since the webshlock.txt file as far as I'm aware would have to be in the folder in which the files should be.
If webshlock.txt file isn't in that folder then I guess any files sent there aren't being scanned by the web shield, that would also follow that the folder wouldn't be cleared and why the subsequent detection by the File System Shield on a file that essentially shouldn't be there.
Definitely weird.
-
FileSystemShield alerted. On what should have been a webshield alert...weird...
(I say webshield because it is a website that is causing this alert.)
Evidently FSS is scanning that file, as it would do with any html file in any other location. WS should scan "things" from a website (essentially). Avast is not interpreting this file as from a website, but as a file as any other.
-
FileSystemShield alerted. On what should have been a webshield alert...weird...
(I say webshield because it is a website that is causing this alert.)
Evidently FSS is scanning that file, as it would do with any html file in any other location. WS should scan "things" from a website (essentially). Avast is not interpreting this file as from a website, but as a file as any other.
I understand that, but what I meant is that the webshield should have got it first.
-
I understand that, but what I meant is that the webshield should have got it first.
I understood what you meant. I just disagree with the "absolute" character of the assumption. If the file was not infected when you actually got to the original website (meaning the file was infected *after* that moment), or if Avast was not able to identify the specific malware in that same moment, then the FSS can find that file after that first moment, either because now the FSS now finds the infection (that maybe wasn't there before), or because a new database update is able to find the infection (and previously, it wasn't).
Just to be clear, I am NOT saying you are incorrect. I am saying that there are other possibilities other than "the Web Shield is not working as it should".
If the WS was supposed to catch that and it didn't, and just a few seconds after that the FSS warned you (with no database update in between), then you are correct in your assumption. But I would extend that a little bit forward. Why the Network Shield didn't stop the file from being downloaded and saved in your system in the first place?
-
Well, the FSS alerted on the page loading, which is what made me assume that it was missed by the webshield...I see what you meant now, about my choice of words :P
Either way, I am not exactly sure what is happening there...maybe this is slightly OT here, I don't know.
-
Is the webshlock.txt file in that location, as I suspect that it isn't and I don't know if that is required to lock the for for scanning by the web shield. And subsequent removal from the folder on successful completion of the scan.
-
The webshlock.txt is in C:\Windows\Temp\_avast_ where it should be.
-
It's most likely the Script Shield, not Web Shield, and possibly has something to do with the IE Protected Mode.
neommy, are those leftover unp*.tmp files empty (0 bytes in size), or do they contain any data?
Furthermore, are you logged on as an administrator, or some other user?
-
The webshlock.txt is in C:\Windows\Temp\_avast_ where it should be.
Yes, that is where I would expect it to be along with the unp.....tmp files. But I will bet there isn't one in the C:\Users\Scott\AppData\Local\Temp\Low\_avast_\unp208123638.tmp folder, which is what I'm on about.
e.g. If it isn't in the same folder as the unp.....tmp files:
Is the webshlock.txt file in that location, as I suspect that it isn't and I don't know if that is required to lock the for for scanning by the web shield. And subsequent removal from the folder on successful completion of the scan.
-
No there isn't one in the Temp\Low\_avast_ folder, never was. ;)
Nearly replied to igor earlier but caught his edit ;D
-
It's most likely the Script Shield, not Web Shield, and possibly has something to do with the IE Protected Mode.
neommy, are those leftover unp*.tmp files empty (0 bytes in size), or do they contain any data?
Furthermore, are you logged on as an administrator, or some other user?
They are 0 bytes in size, and do not contain any data.
As far as I know I am logged as an administrator.
-
No there isn't one in the Temp\Low\_avast_ folder, never was. ;)
<snip>
That is what I thought and why I think content in that folder might not be being scanned or if it is, not cleared as there is no reference to the files locked by the web shield (web sh lock.txt).
That is my concern to coordinate this so that everything goes to the one folder whatever that happens to be. For me in XP Pro and Win7 32bit it is c:\windows\temp\_avast_.
Whilst in my win7 netbook I don't have the <users>...\Temp\Low\_avast_ folder, I do have an <users>...\Temp\_avast_ folder, but when browsing the web I don't get any unp.....tmp files in that location they all go to c:\windows\temp\_avast_ folder.
So I don't understand this disparity. Edit: perhaps this is used for other shields, such as the script shield as Igor mentions. If so I can't understand the logic in this surely it would be best to use the one _avast_ location.
-
A mí también me pasa lo mismo.
Este problema empezó cuando instalé la version de avast la 6.0.1289. y solo me pasa cuando utiliza el Internet Explorer 9.
Pd. Perdonar si escribo en español.
-
Ok for the members who do not read Spanish.
A mí también me pasa lo mismo.
Este problema empezó cuando instalé la version de avast la 6.0.1289. y solo me pasa cuando utiliza el Internet Explorer 9.
Pd. Perdonar si escribo en español.
Solidacid, the poster above, says that the same is happening to him but just when using IE 9. I just mentioned to him, from Spanish Forum, that he was not the only one with this problem and up to now there seems to be no fix.
@ Solidacid
Si se llegara a encontrar una solucion te lo aviso en el hilo que tenemos en el foro de español.
Saludos.
-
Thank you Solidacid, nice to know that I am not all alone in this big world, ;D and iroc9555 for the English translation.
I am still having temporary files, I am using IE9, and Avast 6.0.1289, and all I can add is that the date of the beginning of this problem is at most 12-15 days before the beginning date of this topic.
-
Neommy.
Thank you.
After you answered igor question in reply # 29, he never got in touch with you afterwards ? I thought he could have had an answer to this glich.
Regards.
-
I'm afraid I don't, as I wasn't able to simulate the behavior.
I might try to get rid of the temporary files in the Script Shield altogether, which would solve the problem as a side effect, but I'd still like to know what's causing this thing.
-
Igor.
Thanks for answering. This is a rare event.
Regards.
-
Well, this may not be such a rare event indeed;
I am deriving this result from the solution! After doing many things to solve the problem, ( actually my number one suspect were network adjustments at the control panel, I have the habit of playing with everything at my computer ) I finally did two more things;
1) I made a deep clean at my computer, with Windows 7 64 Bits's and IE 9's own tools, and CCleaner. And then I uninstalled Comodo, both from the Control Panel then with its own community prepared uninstallation tool, rebooting many times, and deleting many times. I even used Registry Seeker just to delete " comodo " name from everywhere at the registry.
2) Then I resetted IE9. From tools-internet options-advanced-I used both of the two tools here.
rebooted, and it was gone!
I reinstalled Comodo.
I now have one _avast_ folder in Temp, and one _avast_ folder in Temp-Low ...But now no temporary file is produced, both of these _avast_ folders are empty since one day! ;D