I tried the FileMon route in that long running thread I had and adding it to the startups works, but it doesn't get in there quick enough to monitor everything. It is however able to pick up the later stuff as the avast icon does it dance.
a 2-3 minute run of the monitor generated 13000+ line entries, a nightmare to check and still no nearer finding why certain files are scanned.
I did ask about the possibility of it scanning files because of explorer trying to find icons for the the Start menu or desktop icons, etc. If I remember that suggestion was po-pooed at the time, I could be wrong about that, it was a very large thread and some time ago. Now it is being trotted out as a possible source of the activity.
The only thing that helped me was to lower the Standard Shield to Normal sensitivity, but I would prefer to have it set to High, but that really does kill boot times. I know that avast is only reacting to requests to open/read files.
I feel someone has got to give some serious thought to what is scanned on boot and even give the user some input in the selection of what should be scanned. Things have been suggested to have a flag set to confirm a file has been scanned, I'm not so keen on that as it is just too easy to set a flag so the file isn't scanned when it should be.
My personal feeling is that only files that are actually loaded or executed should be scanned on boot. I have numerous uninstall???.exe files that are scanned also averylabelwizard.exe, as examples of files that haven't been used at all (uninstall files won't be there is the program has been uninstalled?) or for months in the case of the avery label wizard and others that wizz by at such a rate as I can't recall.
I sent the zipped filemon log (not sure if it was sent to your or Igor) but nothing was found out of the ordinary to say why so many files were being scanned. So the FileMon exercise in my case was futile.
