Avast & temp disk writes (revisited)

[alanrf]

First my thanks to the Alwil development team for another excellent release of Avast  - I have been trying out some of the new features, epecially NNTP scanning and the Webshield, with much interest.

When I first installed Avast 4.5 I wrote in this forum about the huge volume of temporary disk writes that are invoked by scanning of archive files.  At that time I suggested that consideration be given to allowing the user to direct those writes to a location other than the Windows defined "temp" space.  Igor responded at that time that it might be considered for a later registry defined override.  Anyway, I could avoid the issue by not selecting to scan archive files. 

With the new release installed I found that NNTP scanning was on by default with the internet mail provider and I turned on the new Webshield. 

Reviewing my system I see that NNTP scanning writes all of my NNTP activity to temporary disk space and Webshield writes all of my HTTP activity to temporary disk space.  I have to wonder why this must be written to disk by Avast, I assume to keep the memory use down, but it certainly represents a large amount of new disk i/o.  All of this constant writing of temp files is significantly eroding the value of another of my security tools, Goback. Certainly I can change the placement of all temp files to a disk on my system not covered by Goback, but I think that the volume of temp file writing in Avast is now way beyond that I have encountered in any other product.     

My browser of choice, Firefox, and IE both allow me to direct the placement of temporary files.  My news reader (and most others I know) also allow me to direct the placement of their  file activity too. 

I suggest that Avast, getting into constant writing of NNTP and HTTP data needs to follow the lead of the applications in this area and allow the user to determine where this activity is to be directed. 

[Vlk]

Well the fact is, it CAN be set, and this has been true since day 1.

Go to Control Panel -> System -> Advanced -> Environment Variables, and change the values (both) as seen on the following screenshot.

Don't forget to restart the avast services after making the changes.

Cheers
Vlk

[igor]

At that time I suggested that consideration be given to allowing the user to direct those writes to a location other than the Windows defined "temp" space.  Igor responded at that time that it might be considered for a later registry defined override. 

Actually, I believe I did add the possibility to change the placement of the temp files... I guess I forgot to announce that, sorry 

OK, to change the temporary folder of avast! Antivirus, navigate to
HKEY_LOCAL_MACHINE\SOFTWARE\ALWIL Software\Avast\4.0
and create the string value called Avast4TempFolder that holds the path where you want to write the temp files to.
Alternatively, you can create an environment variable %Avast4TempFolder% holding the same info, but I think a registry value is better.
A restart will be needed for the changes to take effect.


However, Vlk is right - it doesn't have much sense to set the temporary folder separately for every application you use. Setting the TEMP/TMP variables is what you should do - the purpose of the TEMP folder is to write temporary files there, and many applications do it (if you run a big InstallShield installer, hundreds of megabytes may be written there for the runtime of the installation). Of course, you don't want to backup such files - so, you should point it to a non-backed-up place and you don't have to worry about it anymore.

[alanrf]

Igor & VLK thank you both for your responses.

VLK, I made clear in this message and in the earlier thread that I knew that I could move all temporary files.  Indeed, in response to the deluge of temporary files now being created by Avast I had already done it. 

However, if I choose to revert my system disks to a precisely chosen moment, a choice provided to me by the Goback product, I may well wish to include files that are using the "temp" space defined in Windows in a more "conventional" manner than that now adopted by Avast.

Avast is now writing all email, NNTP and HTTP activity to temporary files.  This is not some infrequent activity needing a relatively small, short term, temp space  this is a persistent requirement for large amounts of disk i/o.

Like other products that perform large amounts of data writes I thank you for the courtesy of allowing us, the users of the product, to determine the placement. 

Maybe not many users of Avast will feel the need to use this option as perhaps not too many people choose to change the placement of the internet temporary files in IE or the cache in Firefox, but both were convinced of the need to provide it.

Again, my thanks to you and the Alwil team for the excellent support you are providing us and for the extra effort that is clearly going into helping us with this new release.   

Alan

[Vlk]

Just a small follow-up: changing the system-wide TEMP/TMP environment variables as shown above will not atually change the placement of temp files coming from ALL application, just system services. All regular temp files coming from applications that you execute on your desktop will be placed to the user-specific TEMP locations, as defined in the other field of that dialog (see above).

Cheers
Vlk

[alanrf]

I just had that strange feeling when implementing the registry change for the temp file placement that the Webshield writers had not got the message. 

I had noticed earlier that most Avast temp files are written to the _Avast_ subdirectory in the temp files space but the HTTP traffic is written directly to the Windows temp file space. 

So there is an _Avast_ subdirectoy now created by Avast on the drive I assigned it in the registry setting, email and NNTP traffic is being written there but the HTTP traffic is still being written to the Windows temp directory.   

[alanrf]

Igor,

is it likely that, when the Webshield is being worked on, it may use the registry override too?

Thanks.

[electronikk]

Reviewing my system I see that NNTP scanning writes all of my NNTP activity to temporary disk space and Webshield writes all of my HTTP activity to temporary disk space.  I have to wonder why this must be written to disk by Avast, I assume to keep the memory use down, but it certainly represents a large amount of new disk i/o. 

Actually I'm a little confused, because on http://www.avast.com/eng/whats_new_in_avastve.html it says the following:

"Unlike most competitive solutions, the Web Shield's impact on browsing speed is almost negligible. This is because of a unique feature called "Intelligent Stream Scan" that lets the Web Shield module scan objects on-the-fly, without the need of caching them locally. Stream scanning is performed in operating memory only (without the necessity to flush the contents to disk), providing maximum possible throughput rates."

Now is the webShield traffic cached locally?
I mean this doesn't have too much impact on me but I'm just curious... perhaps we can expect the feature that's mentioned above to be realized in the future? (Thus increasing performance?)

[alanrf]

Thanks for pointing that out electronikk.

I just conducted some tests checking and unchecking "Use intelligent stream scanning" in the Webshield interface.  The temporary files are created whatever the setting.  At least unchecking the "Enable Web scanning" box does appear to turn off the scanning and the creation of the temporary files.

I agree that the creation/deletion of these files does not have any noticeable effect on the surfing experience.  Indeed I assume that system caching will mean it really appears as though the data is being scanned "on the fly in memory". 

My concern is with the effect the (eventual) writes have on products that work at the disk suface change level and not on  disk space in use.  For example Norton Goback (which I use), Norton Ghost and Acronis True Image (which I use).     

Hence my desire to direct these writes to a drive I use specifically for disk writes I am not concerned about recovering and I keep outside of the scope of the above products.

[Vlk]

Stream scan runs in memory.
Full scan (after a file is downloaded in its entirety) runs on disk.

There are two reasons for this:
- less importantly, downloaded objects may be too large (but this could have been distinguished)
- most importantly, we do full unpacker/decompression scan which cannot be generally done i memory only.

Anyway, we believe that the performance hit shouldn't be so high. This is why:
- the browser is usually caching the data as well
- download speeds are usually a magnitiude lower than HDD access speeds (sometimes more)


Anyway, alanrf, you're right about the location of the temp files in WebShield. I'll see what can be done about that.


Thanks
Vlk

[electronikk]

Thanks again for your quick and detailed answer! Sounds perfectly reasonable! 

Keep it up, everybody!