System Process high CPU while copying files.

[Saturn49]

Here's the scenario, and I've tracked the symptoms down to Avast!  (uninstalling makes it go away, installing makes it come back.)

Copy a largish file (several hundred megs) from one computer to another computer running Avast! Home edition.  Watch the CPU usage on the computer running Avast!  It will spike up to 80% or higher for the duration of the file copy.

Alternatively, copy a file THROUGH the network layer on the same computer, such as copying a file from c:\temp\ to \\localhost\c$\.  This avoids actual network traffic but causes a huge spike in CPU for the duration of the copy.

It doesn't seem to affect the copy speed much, but it does make the target computer basically unusable because the System Process is taking up all the available CPU.  Further digging with Process Explorer showed that it was the srv.sys driver inside the System process taking up the CPU.  It appears Avast! has some sort of hook on this driver, as the symptoms disappear once Avast! is uninstalled.

Can anyone confirm this behavior? (I've seen it on two computers already.)

Next, of course, is does anyone know a workaround?  I've tried disabling kernel-mode scanning (and even rebooting afterward) but it doesn't seem to have any effect.

[mauserme]

Can anyone confirm this behavior? (I've seen it on two computers already.)

Hi Saturn49,

I run a daily copy of several gigabytes of data from one computer to another.  Even with avast! active on both computer I haven't observed inordinately high cpu usage.  I'll try to remember to check the actual usage tomorrow and post again.

M

[alanrf]

I am trying to reproduce the condition reported but without success. 

I am transferring a multi Gb file between 2 WinXP Pro SP2 systems, both systems have avast active.  When I use my older 1GHz uniprocessor system as the receiver of the file the CPU utilization is remaining  steady at about 60% (for a utilization on the 100Mbps lan of about 82%). 

If I stop all avast on access protection the CPU utlization is steady at about 57%, when I uninstall avast - the CPU utilization is unchanged. 

If I use my new dual 3Ghz processor system as the receiver of the file the CPU utilization is steady at about 15% (for a utilization on the 100Mbps lan of about 82%).  At that level I am not inclined to bother with uninstalling avast to see what difference it makes.   

[Lisandro]

I had the same problem... The only solution what uninstall > boot > install > boot
Reconfigure everything... 

Why the page faults rise to millions while the other applications rise just to thousands?

[alanrf]

It occurs to me that I (and we) could be clearer about out avast configurations.

I run only the Standard Shield, Webshield and Internet Mail providers.  I was wondering if the Network Shield (which I do not run) might be an issue here.

[Lisandro]

It occurs to me that I (and we) could be clearer about out avast configurations.

Standard Shield > Normal (or less), not scanning while open/create/modify files. I did not change the default options for the task into the Enhanced Interface.
There is not a scheduled task running in background.
Normal browsing while that occurs... almost freezing the computer.  :'(

I run only the Standard Shield, Webshield and Internet Mail providers.  I was wondering if the Network Shield (which I do not run) might be an issue here.

Since NetShield was born it did NOT even scan a single thread for me...
I don't think this things are related each other.

By the way, Vlk, while using the beta and then upgrading to last release, a lot of 'trash' files are left behind in the DATA folder.
I've noticed that comparing the two folders (the old, before uninstalling) and the new (fresh one), working again 

[alanrf]

Tech, clearly some difference in our systems even with avast running.

This system has been running for about 9 hours and includes the time when I was testing the transfer of the large file to this system.  Page faults for ashServe.exe are currently at 111,534.  However page faults for explorer.exe are 1,077,730.

Perhaps I am not conducting my file transfer the same way as you and Saturn49.

[Lisandro]

To Vlk:

By the way, Vlk, while using the beta and then upgrading to last release, a lot of 'trash' files are left behind in the DATA folder.
I've noticed that comparing the two folders (the old, before uninstalling) and the new (fresh one), working again 

To Alan: well, my problem is not related to file copying only... the common part is the CPU usage while using the computer.

[mauserme]

I did the copy this morning on two identical computers over a 100mbs wired lan:

Windows XP Home SP 2
Pentium 4 @ 2.5ghz
avast! standard shield = high
avast! network shield = high

The source peaked at about 24% and fluctuated between 8% and 15% thereafter, while the target peaked at 79% then went down to 50% - 55%.

Edit:  After about 90 minutes my page faults are 283,000 for ashserv.exe

Edit: 

Tech,

Now about 5 1/2 hours with almost 1.4 million page faults for ashserve.exe on each of the 3 computers in the network, but I'm still not experiencing any slow downs.  Yes its a lot of page faults but maybe not related to your or Saturn's slowness.

[igor]

Well, Saturn never told us (for example) what his settings of the Standard Shield are...

[Saturn49]

Sorry to leave everyone hanging  , I've been gone a while.

I'll try installing Avast! again and see what happens.

For reference, I only had the on-access scanner on, everything else was off.  However, even if I turned that scanner off, it didn't seem to help any.

[Saturn49]

The problem still seems to exist after installing Avast! again.

My test was simply to copy a file from c:\temp to \\localhost\c$\

This pegged the CPU at 100%, 16% was Explorer.exe, the other 84% was the System process.  Copying from c:\temp to c:\ does not do this.

Only the Standard scanner was on, and everything else was left at the defaults.

Edit:  Just uninstalled Avast! and ran the same test again.  Without Avast! the copy takes about 50% CPU, with 16% Explorer, and 34% System process.

Edit2:  I should note this is not an uber-powerful machine.  Athlon 1900+.  I've also duplicated the problem on a Pentium 4 1.7Ghz.

[DavidR]

You keep talking about the system process, which has nothing to do with avast so I can't see where this interaction comes from.

Do you mean System as in the User Name, if so what Image Name (process) is the one using cpu %
Avast processes begin with ash or asw and there are usually 4 in the list, so what are their cpu % use figures ?

[Saturn49]

No, I mean the actual System process (PID 4 on my system.)

This is the one that actually hosts some (all?) of the drivers in the system.  As I said in the OP, the driver that spikes is the srv.sys driver.  Avast! must have a hook into it somehow (driver filter maybe?)

I don't pretend to understand why or how exactly this happens, but it is very reproducable on multiple systems.

[DavidR]

system PID 4 on my XP Pro is currently at 0% CPU and doesn't get high in file transfers, unfortunately on a stand alone system I can't test network transfers. As far I'm aware avast doesn't have any hook into system but I don't know about srv.sys as avast is not a server product I wouldn't have thought so.

If avast were in fact scanning something the avast icon would be rotating and the ashServ.exe would show cpu activity.

So using your examples:
"This pegged the CPU at 100%, 16% was Explorer.exe, the other 84% was the System process." This would mean there is no activity on ashServ.exe or any other avast process.

"Without Avast! the copy takes about 50% CPU, with 16% Explorer, and 34% System process." Now without avast there is still a high system cpu usage which I can't understand for a simple file transfer. Although I can't see why it would drop to 50% cpu use after avast was uninstalled, when previously there was no avast activity.

Baffling, that you are able to replicate this on other systems but those here that have tried haven't experienced the same problem and considering Alanrf's comments after uninstalling.

If I stop all avast on access protection the CPU utlization is steady at about 57%, when I uninstall avast - the CPU utilization is unchanged.

Perhaps those who tested the cpu utilisation could check the processes using the cpu time as the system process PID 4 seems high when I would have expected ashServ.exe to be eating some of the cpu % that doesn't appear to be the case with Saturn49's system.

Perhaps as Alan mentions Network Shield has an impact in network transfers and we don't see a process PID for that, so it might use ashServ.exe also or perhaps system