Avast starts working daily(solved)

[gringojack]

Hi

everyday, at 2:05 pm avast (4.6 home + win xp pro sp2) starts working by itself. I can see that because of the small a ball in the quick launch area. I cannot see what is triggering it. I cannot stop it. Could anybody help with this topic? or tell me where I can stop it from! besides the small ball and the PC led, nothing shows it s working

thanks for advice

[DavidR]

Start by enabling the 'Show detailed info on performed actions' in Standard shield and see what files/s are being scanned it may give an indication of what is responsible for accessing the files, which would cause avast to also scan them.

Do you have any other security software that you have scheduled to scan at 2:05 pm (avast Home doesn't have a scheduled function) ?

[gringojack]

hi davidr

no scan scheduled at 2:05 pm

[Lisandro]

no scan scheduled at 2:05 pm

Any other program scheduled for that time could 'start' to be scanned by avast.
Are you in front of the computer at that time? If so, you can follow what David said. If not, where (log file, etc.) are you reading the info about avast activity?

[DavidR]

Well it isn't avast doing a scheduled scan, with the home version there is a work around but you have to jump through some hoops to do it and you would remember if you had done that.

So avast would appear to be responding to something and the only way to find that out is the Show detailed info that I mentioned.

I assume you checked the Task Scheduler (not just your other programs, etc.) to see if there is anything scheduled in there ?

[gringojack]

I did what david said, and noticed from time to time lists of files poping up from taskbar showing mostly dll's, in the same time, the avast a ball whirl
There is nothing scheduled in the task manager scheduler
It seems to me like if avast got triggered by an other activity

[DavidR]

It looks like something is accessing the thunderbird profile whether that is because of an email check or something (sorry I don't use thunderbird), why I have no idea. Do you have any form of automatic email checking, etc. ?
The first line in the image seems strange also, as that would appear to be something accessing the javascript file to close all thunderbird windows

How long does this last for a few seconds, minutes, longer ?

Is there any firewall activity in the firewall logs for the same times ?

What is the Sensitivity of Standard Shield, Normal (the default) or High ?

[gringojack]

it lasts about 40 minutes
the sensitivity of the standard shield is "normal"
there no noticeable firewall activity during the scan

[DavidR]

I'm at a loss as to what this could be, 40 minutes is a long time even if it were an on-demand scan with these settings.

Hopefully one of the Alwil team will join the topic.

You could try, uninstall, reboot, install, reboot.

If after that it is still happening (which it may) it would tend confirm that something else is scanning and avast is also checking files accessed in that scan.

[gringojack]

I just was running an on-demand scan. It shows on the task manager screen, which didn t appear before.
To day, I quarantined 2 signs of virus (see below) win32:startpage 173 [trj] They are not yet destroyed, only on quarantine. So, if these guys were guilty, to morrow at 2:05 pm, nothing should happen. Whatever arises, I will do as you said (uninstall.......)
I can see on the log that my system has been carrying this win32... for a few months!
what do you think? What is the meaning of the 2 middle lines?

[DavidR]

Sorry, I don't know I can't see the full text relating to the warning.

[Vlk]

Which process is taking the CPU time when the activity occurs? (Use the Windows Task Manager to find out).


Thanks
Vlk

[gringojack]

ok which tab?

[Vlk]

The 3rd one (on your screenshot, the one that says "Proces..."; in English Windows, it's the CPU column).

Which of the processes is taking a lot? Is it ashServ.exe?

[CharleyO]

***

Hi gringojack,

Here's the English version of what to look for. Notice the black arrow beside the column of zeros [ 00 ]. Scroll down until you see what program has the highest number in this column. Tell us the program (.exe) and the number. You can also tell us what the numbers are for any ash*.exe in the far left column.