AvastSvc.exe 8min after Boot

[igor]

I'm afraid we'd need some more info to find out what's going on there.
If possible, please do the following:
1. Wait for the CPU usage to appear and give it some time (say one minute)
2. From an elevated prompt, execute the following command

Code: [Select]

sc.exe control "avast! Antivirus" 2543. It will take a moment - and a dump of the AvastSvc.exe process will be created in C:\ProgramData\Avast Software\Avast\log folder; it will be a file called unpXXXXXXX-manual.mdmp (where X are some numbers) and will probably have hundreds of megabytes in size.
4. Compress the dump (7-Zip, ZIP, RAR, ... whatever) and upload it under a unique name to ftp://ftp.avast.com/incoming
5. Post the name of the uploaded file here; I'll check if the code seems to be stuck in some weird place
Thanks.

[jmichaelm]

upload it under a unique name to ftp://ftp.avast.com/incoming

I think I can handle that but I don't see anyway to upload on that page, there are no buttons?

[Pondus]

upload it under a unique name to ftp://ftp.avast.com/incoming

I think I can handle that but I don't see anyway to upload on that page, there are no buttons?

https://support.avast.com/en-ww/article/FTP-file-upload/

[bob3160]

upload it under a unique name to ftp://ftp.avast.com/incoming

I think I can handle that but I don't see anyway to upload on that page, there are no buttons?

https://support.avast.com/en-ww/article/FTP-file-upload/

If I remember correctly, Chrome no longer supports ftp
I tried accessing the ftp server in Chrome without success.

[igor]

It used to be possible to upload via Windows Explorer (not Internet Explorer) - opening the address and dropping the file on the buttom/content panel.
If you have a preferred upload service, you can upload the dump there - just note that theoretically, there may be some private data in the dump (say some of the pages being visited), so you may want to password-encrypt the archive and PM me the password (or the link itself).

[jmichaelm]

As I think about this more I'm beginning to believe that this issue may be related to some file system corruption on my PC.  I've noticed increasing issues with file permissions/writing errors.

But isn't the bigger issue for Avast the inability to defeat this scan?  Obviously once I'm able to get past whatever Avast is trying to do 8 minutes after boot I don't have any problems.  Shouldn't disabling rootkit detection be able to solve this?  Looking at aswAr.log files, I do notice that the difference between the antirootkit scan in passive mode is that it does not scan the processes, just the services.  So it would appear my issue is related to the process scans.

[DavidR]

As I think about this more I'm beginning to believe that this issue may be related to some file system corruption on my PC.  I've noticed increasing issues with file permissions/writing errors.

1.  But isn't the bigger issue for Avast the inability to defeat this scan? 
Obviously once I'm able to get past whatever Avast is trying to do 8 minutes after boot I don't have any problems. 

Shouldn't disabling rootkit detection be able to solve this?  Looking at aswAr.log files, I do notice that the difference between the antirootkit scan in passive mode is that it does not scan the processes, just the services.  So it would appear my issue is related to the process scans.

1.  What inability to defeat this scan.

EDIT: removed incorrect advice and image.

[jmichaelm]

There is a rootkit detection enable/disable checkbox under the core shields settings.  This would presumably be able to disable the daily antirootkit scan but in my experience it did not.

[DavidR]

OK, I got the wrong screen so I have removed that advice from my previous post.

If you have disabled it there it should really stop it, if it isn't stopping it you can report it as a bug.
Right click the avast tray icon and select About Avast, from that screen use the Report Bug button.

I have my anti-rootkit scan enabled and don't often restart my laptop (only when a program/OS requires it), so don't bump into this issue.

[jmichaelm]

Reported as bug.  Thanks!

[DavidR]

You're welcome, hopefully the Avast Team can investigate it fully.

[jmichaelm]

Well it appears I've found 2 workarounds to this:

One is leave the PC in standby, and since waking is not a fresh boot, it does not do the scan.  No problems.

The other is manually run a 'smart scan' right after booting and this seems to run the entire antirootkit scan, including the processes, but for some reason this one does not hang up my CPU.  It only takes seconds to run this scan and close the Avast window then I'm good.

[igor]

To check the issue with the antirootkit scan (which should be rather fast, no matter the other things) we'd need the dump I mentioned before...

[jmichaelm]

UPDATE: It appears this issue has finally been resolved by one of the last few Avast updates.  No more AvastSvc.exe running continuous processing after boot.  Pretty sure I did nothing that could have resolved it.