Overzealous file scanning - system performance hit

[the_doc]

I have some large files (compressed installation files with extension .exe) that I've been transferring between drives (local and network).
Avast! has been quite over zealous in it's scanning, scanning every file and slowing the transfer process down significantly.

I've noticed that these same files are scanned if I transfer them to/from the trashcan (why?)

I did some testing with an old backup that used an older version of Avast! and this problem was not apparent.


I don't know what has changed - I looked at the expert settings within the "File System Shield' and changed most of the settings with no difference in overactive scanning.

The only thing that fixes this is to turn off the File System Shield.



Any ideas?
Why so overzealous Avast? - you were not like this in the past.

*oh* and repair of Avast! does not change the problem and uninstall and reinstall does not fix the problem.

[CraigB]

I find avast is extreemly fast with it's scanning, if you have been changing alot of the default behaviour within avast maybe it would be best to restore defaults ( Settings/Troubleshooting ) as default is the optimal for performance and protection and see if you problem persists.

[the_doc]

I only changed the settings when attempting to determine the source of the problem within Avast.

Settings are at default and these large files (1-3GB each) are individually scanned during a file transfer (not opened, just copied) or moved to/from the trashcan.


Avast! did not do this before.

[the_doc]

downgraded to 7.0.1456 and problem still there

downgraded to 7.0.1426 and the problem is still there


why???

[DavidR]

Nothing has changed - The reason these self extracting archives get scanned is that they would present an immediate risk if executed. Moving from one location to another effectively triggers the scan newly created files as it is newly created in the moved to location, that hasn't changed for as long as I can remember.

Newly created/Modified files that present an immediate risk if executed are scanned.

If you browse the viruses and worms forum you may notice that the trashcan (recycler) is used by some malware to hide/store its files.

[the_doc]

Well other AV solutions do not have this aberrant function - unfortunately the other AV solutions are not as good as avast.

I've placed a file exclusion on writing .exe and that has solved the problem - avast is proactive enough, IMO, to catch problem files on reading and executing


and btw it has changed - I can go to an older installed version (v7) of the program with older definitions and this excessive scanning did not occur
interestingly it was when I only updated the virus definitions is when the the excessive scanning reappeared.

[Lisandro]

Well other AV solutions do not have this aberrant function - unfortunately the other AV solutions are not as good as avast.

The ability to configurate is a positive thing and we thank avast! for that. If other av do not offer such flexibility, worse for them.

I've placed a file exclusion on writing .exe and that has solved the problem - avast is proactive enough, IMO, to catch problem files on reading and executing

You have decreased your protection level. Virus analysts could say what will happen if you do that. But will they have time to post?

[mchain]

downgraded to 7.0.1456 and problem still there

downgraded to 7.0.1426 and the problem is still there


why???

I only changed the settings when attempting to determine the source of the problem within Avast.

Settings are at default and these large files (1-3GB each) are individually scanned during a file transfer (not opened, just copied) or moved to/from the trashcan.


Avast! did not do this before.

This issue is likely related to the size of your files you are copying (1-3 GB).  Never heard of a GB + size .exe file?

Suggest once you are done transferring, re-enable File System Shield to default settings to restore your protection level, tho.  You can also change (decrease) the maximum file size and capacity of the recycle bin as well if you do not think you will need a file this large in the future; this would result in a permanent deletion of that file, just so you know.

[Nesivos]

I find avast is extreemly fast with it's scanning, if you have been changing alot of the default behaviour within avast maybe it would be best to restore defaults ( Settings/Troubleshooting ) as default is the optimal for performance and protection and see if you problem persists.

With this kind of computer

Intel Core i7 2630QM 16GB RAM, Nvidia GeForce GTX 560M 3GB,

I would hope so

[securitest]

WinXP SP3, Avast 7.0.1466

Personally I consider this problem as the only real weak point of Avast.

The file shield should not scan a file when renaming/moving it
(at least within the same partition of the same drive),
because only the path of the file is changed (a write operation in the MFT).
The content of the file is not written nor read by any application,
so avoiding this scan would not lower the security.

Rename/move is just what happens when a file is sent to the recycle bin :
the file path is changed so as to place it under '[Drive_Letter]:\Recycler\'

With EXE file there's the problem of the specific program icon which needs to be read inside the file.
But the problem also occurs with files with generic icons (for example a file with an unknown extension).
And the problem occurs repetitively (renaming A.blob > B.blob > A.blob) even with the transient cache active.
And the problem still occurs if I disable all scanning on 'file write'. (!)

In fact you don't even need to rename/move a file to trigger a file scan :
1. just begin to edit a file name (you are still editing it, no change yet done) and the file is already scanned
2. right-click a file to see its properties and the file is scanned EACH time, even with the transient cache active