Avast Free consumes 100% of CPU

[hmw]

I have a Windows XP Pro SP3 computer that I use primarily for a few DOS programs, and some Microsoft programs that I never installed on my Windows 7 Pro SP1 computer. I use the XP infrequently.

Several years ago, when Microsoft Security Essentials stopped supporting the XP, I moved to Avast Free Antivirus. I currently have version 18.8.2356, which from reading posts on this thread, I believe to be the last version that Avast released for the XP.

I have always had a problem with Avast consuming large amounts of CPU time, but it seems to have gotten worse in the last year or so. A few weeks ago, I uninstalled the program (which also was version 18.8.2356) and reinstalled it. A few days ago I ran a normal Scan on Malwarebytes. It found nothing. So yesterday I ran a Full Scan on the C:, D:, and E: drives that are on the XP {E: is connected via USB}). It took almost 9 hours. It found 6 potential issues. All were leftover plug-ins for programs uninstalled years ago. I removed them. They had no effect on my problem.

For the last few days, as soon as I boot the XP, I open Windows Task Manager, and follow the CPU% and CPU Time for the .exe files shown there. The situation is always the same. For the 1st 4 or so minutes, the System Idle Process 'uses' about 99% of the CPU. At that point AvastUI.exe (and to a much lesser extent AvastSVC.exe) take over, and within 10-15 seconds these two combined Avast files consume 98%-99% of the CPU time. This lasts for about 8 minutes. During this time, it is impossible to open any other programs. One just gets a white screen.

After the 8 minutes, the usage of those two Avast files drops to 0%, and the System Idle Process goes back to 99%. Now any of the installed programs can be opened and run just fine.

So my question is: What is Avast doing that consumes so much CPU time for 8 minutes? I have looked at all my Avast user settings, and I can't find anything that might be causing the problem, although I do have virus definitions and the program set for automatic updates (every 240 minutes).  I do NOT run Behavior Shield. This high CPU consumption issue never existed with Microsoft Security Essentials.

If anyone had come across this problem, and has any suggestions, they would be much appreciated.


Harry

[DavidR]

This situation is never clear cut as there are many things that impact system performance and running scans.

Malware\bytes isn't a full blown Antivirus and it isn't scanning all as many files.

There is going to be a heavy hit when scanning USB drives as speed is slower communication between the OS and USB drives and quickest for  internal IDE drives.  Whilst that would add to the overall time taken. 
Whilst 9 hours does seem excessive, but you don't say what the CPU and RAM are on this system ?
Nor do you mention how much free space is on the C & D drives as this can also impact system performance ?

What you don't say is:
Have you changed the Default settings for the Quick Scan ?
What are the sizes of the C, D and E drives ?
What stats were returned for the Scan, total files, folders and size of data scanned.  This can be greater than the data on your drives as it also involves scanning of compressed files.

[rocksteady]

So my question is: What is Avast doing that consumes so much CPU time for 8 minutes?

@Harry, In answer to your question.
I also have a WinXP rig which I use infrequently, also with Avast Free 18.8.2356.
Also seen same CPU burden after startup. Noone seems to know what this is due to. However, one of the things that has to be done after a period of no use is update of virus definitions. System tray icons warn of AV out-of-date until this is done. Also I suspect some form of scan is being done by Avast at startup, which hogs CPU for a few mins.
I see similar CPU behaviour on my Win10 rig with latest Avast Free, so think this is a common "feature" of Avast and just put up with it.

[hmw]

So my question is: What is Avast doing that consumes so much CPU time for 8 minutes?

@Harry, In answer to your question.
I also have a WinXP rig which I use infrequently, also with Avast Free 18.8.2356.
Also seen same CPU burden after startup. Noone seems to know what this is due to. However, one of the things that has to be done after a period of no use is update of virus definitions. System tray icons warn of AV out-of-date until this is done. Also I suspect some form of scan is being done by Avast at startup, which hogs CPU for a few mins.
I see similar CPU behaviour on my Win10 rig with latest Avast Free, so think this is a common "feature" of Avast and just put up with it.

Thanks for your feedback. My Virus definitions are set to  'automatic update', but I never see the 'out of date' warning you mention. See my test results in my reply to David R, below.

Harry

[hmw]

David R:

Sorry to take so long to respond. I have been booting my XP every day, recording CPU times for various files, sometimes making changes, then shutting down and rebooting the next day.

I probably confused the issue when I added the Malwarebytes scans. I did that only to see if I might have some malware on the computer. None was found.

The problem with Avast is when I boot my XP computer. As I noted, for the first 4 to 6 minutes or so, the System is idle about 99% of the time while various Windows files and the programs in my startup directory are loaded.

Then AvastUI.exe and AvastUI.svc began to consume CPU usage, and they quickly reached 99%. Avast's CPU usage remained at 99% for about 7 or 8 minutes, then dropped to essentially zero.

You asked if I used the Avast default settings. It has been so long I have no idea how close my settings are to the default. I created a backup file, but I can't read it with any program I have. I would send it to you if you could read it.

When I first contacted you, I did NOT have Avast set to automatically check for updates, nor to do a scan. I did have it set to automatically update for Virus definitions.

My XP computer was custom built years ago by a local shop.
Here is the information on my processor hardware:
IntelCore2 Duo CPU E6550 @2.33GHz 1.98GB of RAM
My software is Windows XP Professional, Version 2002, Service Pack 3.

After you replied, in the general section of the Avast settings, I added 'animate the icon when scanning'. The icon never moves while this problem occurs.

Below are what appear to be the key settings that might have some affect:
1.   Program update settings is "Manual update', which I assume overrides the 'Auto-update every  xx minutes shown lower on the page. Is that a correct assumption?
2.   Enabled rootkit scan on system startup. (in Troubleshooting)
3.   Load Avast services only after loading other system services is NOT selected.
4.   On the Update screen, my Virus definitions are set to 'Automatic update', and 'Enable streaming updates' is checked.

Even with these changes I was still having problems: sometimes AvastUI.svc would remain at ~ 100% for an hour or so, before I would do a hard reset on my computer. Other times, it would take the 7 minutes or so as noted above.

I then searched this forum, and I found a couple of suggestions from you.

First you said go to 'Add/Delete Programs', right click on Avast, and select 'Repair'. On the XP, there is no 'Repair' option for Avast.

Your other suggestion was to go to the Troubleshooting screen, and check 'Load Avast Services only after loading other system services'. I did that. I first booted that way about 3 weeks ago, and have been running that way every day since. Not clear if made any real improvement. For a few days, AvastUI.exe consumed 100% of the CPU for 3 or 4 minutes, and then System Idle Process returned to 99% of CPU. Then AvastUI.exe was back to consuming 100% for 7-8 minutes. For the last week or so, about 3-4 minutes.

But on Sunday (4/12/2020) AvastUI.exe and AvastSvc.exe only consumed 100% of the CPU for 24 seconds! And at 1 AM (EST) on Saturday (4/25/2020) AvastUI.exe and AvastSvc.exe only consumed 100% of the CPU for 33 seconds! Later on Saturday (4/25/2020, 3:40 PM EST) these two files consumed 100% for about 4 minutes. So the amount of CPU time that the Avast files consume just after boot is now varying quite a bit. But at least it is no longer using 100% for an hour or so.

So what is Avast doing while AvastUI.exe and AvastSvc.exe are consuming almost 100% of my CPU time for 4 to 7 minutes just after booting? Microsoft Security Essentials never did this on my XP, nor does it do it on my Windows 7 Pro.


Harry

[DavidR]

@  hmw
Your system is much the same as my XP Pro SP3 system and I didn't have a startup issue on that.

18.8 was the last version released for XP?Vista systems, but you will see that I fell back to avast! free version 18.5.2342 as I had performance issues during browsing, etc. as from version 18.6 onwards that issue was still present.  But as mentioned I had no boot issues.

I have since had another component problem (monitor or graphics card) with that system and I really haven't had the time or inclination to try and resolve it, so I haven't used it for a few months.

I don't know if you kept old versions of avast or can find one it might be worth trying to go back to avast 18.5 as I did.  I have had Program Updates set to Manual for a very long time even on my win10 system (with avast free 20.2.2401).  If you go back to 18.5 or even if the repair does work I would keep it on Manual program update to prevent a possible update to 18.8.

Avast Settings:
1.  I have had Program Updates set to Manual for a very long time even on my win10 system
2.  The rootkit scan occurs after about 8 minutes so this may be relevant, you could disable it as a test, but that was never an issue on my old XP system.
3.  I would suggest enabling the -  Load Avast services only after loading other system services.
Whilst this I don't believe would give you anything like 7 or 8 minutes off this lagging/high CPU usage, but it is worth a try.
4.  I would leave the Virus Definitions and streaming updates as you have them for now. 

Previously I did do a mod some time ago to the avast5.ini file to delay the virus definitions update as that runs not to long after your boot. But I don't want to over complicate this for now and your system spec should really be up to that.

I would also suggest that you check what other Programs are allowed to run on start up, it seems that they all want to run on boot, when most are only needed when you actually want to run them.

REPAIR:
The Repair option is if I recall now in the Uninstall Option, when you click on that it doesn't start an uninstall but throws up another window and Repair is an option there.

AvastUI.exe & Avastsvc.exe:
In XP if my memory is correct, the AvastUI is also involved in the Virus Definition updates and the User Interface.  The Avastsvc.exe is the main  avast driver and process controlling the various shields (scanning), both are essentially essential.

So the more active your system, the more scanning (by the avastsvc.exe) is required.

[hmw]

David R:

Thanks for your comprehensive reply. I have been running tests at least once/day since.

I forgot to mention last time that I already have checked 'Load Avast services only after loading system services'.

I tried changing Virus Definitions to 'Manual update'. That made no difference, which surprised me, so I changed it back to 'Automatic Update'.

Most days AvastUI.exe consumes 100% of the CPU from 3 to 7 minutes, but a couple of days (one being a Sunday) it only consumed 100% for about 30 seconds. AvastSVC.exe never consumes CPU time for more than 30 seconds.

I then unchecked 'Enable rootkit scan on system startup'. For the next two days, each time I booted, AvastUI.EXE and avBugReport.exe, consumed 100% of the CPU for hours! After forcing an exit and unplugging the computer, I got it to run. I then 'Enabled rootkit scan on startup', and it has run normally (i.e, AvastUI.exe consuming 100% of the CPU from 3 to 7 minutes) ever since.

I found a thread on this forum about avBugReport.exe. The author of that thread had similar issues and deleted all the copies of the file from his computer.

I searched my computer, and found two copies: one in the Avast directory, and one in the Avast/setup directory. I also found AVBUGREPORT>EXE-17B0B851.pf in Windows\Prefetch. This file is only 38 KB, whereas the two .exe files are 3,129 KB.

Since I assume that what these files do is provide information to Avast to help solve problems, and that there is no longer support for version 18, can I just delete these three files?

I just checked for version 18.5.2342, and downloaded one from here:
https://www.filepuma.com/download/avast_free_antivirus_18.5.2342-19226/

Do you know anything about the quality of downloads from this site, or a way that I can determine if it is legitimate, before I try to install it? I found several other sites that offer 'cracked' versions, but I stayed away from them.

I will also check my XP uninstall to see if when I click on uninstall, there is a Repair option.


Harry

[DavidR]

David R:
Thanks for your comprehensive reply. I have been running tests at least once/day since.

You're welcome

<snip>

I found a thread on this forum about avBugReport.exe. The author of that thread had similar issues and deleted all the copies of the file from his computer.

I searched my computer, and found two copies: one in the Avast directory, and one in the Avast/setup directory. I also found AVBUGREPORT>EXE-17B0B851.pf in Windows\Prefetch. This file is only 38 KB, whereas the two .exe files are 3,129 KB.

Since I assume that what these files do is provide information to Avast to help solve problems, and that there is no longer support for version 18, can I just delete these three files?

I honestly don't know if deletion would be a problem or not.
1.  You would possibly need to disable the avast self-defence module.
2.  I don't know if what may trigger the avBugReport.exe, still wouldn't trigger it and result in a different error, but unlikely that would add to cpu load.

I just checked for version 18.5.2342, and downloaded one from here:
https://www.filepuma.com/download/avast_free_antivirus_18.5.2342-19226/

Do you know anything about the quality of downloads from this site, or a way that I can determine if it is legitimate, before I try to install it? I found several other sites that offer 'cracked' versions, but I stayed away from them.

I will also check my XP uninstall to see if when I click on uninstall, there is a Repair option.

Harry

I haven't come across or used filepuma.com before, I downloaded that file and A) no avast alert and B) the file is digitally signed, so it would appear to be fine.

It would certainly be worth trying the Repair, before trying to install 18.5.  I would also suggest doing a clean install, removal of 18.8 before installing 18.5.  Download link for XP version of avastclear - https://install.avcdn.net/iavs9x-xp/avastclear.exe download and save it somewhere you can find it again.

First uninstall 18.8, reboot, run avastclear.exe, reboot and install 18.5.

[hmw]

[
I haven't come across or used filepuma.com before, I downloaded that file and A) no avast alert and B) the file is digitally signed, so it would appear to be fine.

It would certainly be worth trying the Repair, before trying to install 18.5.  I would also suggest doing a clean install, removal of 18.8 before installing 18.5.  Download link for XP version of avastclear - https://install.avcdn.net/iavs9x-xp/avastclear.exe download and save it somewhere you can find it again.

First uninstall 18.8, reboot, run avastclear.exe, reboot and install 18.5.

Thanks for all the great info and guidance. I downloaded avastclear.exe. I'll follow your guidance and try the Repair first.


Harry

[DavidR]

You're welcome.

[hmw]

David:

Once again, it has taken me a long time to respond.

I ran Repair. All seemed to go OK. I have been turning the XP on every day or two, letting it run for 45 minutes or so, taking a screen shot of Windows Task Manager, and then shutting it down. Through yesterday Avast related programs were consuming between 2 minutes and 6 minutes of 100% CU time during the first 15 minutes after I booted. No real improvement, but no problems.

Today was different. I have attached a photo of the screen. You will see that there are TWO entries for AvastUI.exe, and together they were consuming over 90% of the CPU for over 80 minutes, so no other program would run. I tried to shut it down. It was very slow, and eventually got to the blue screen with only the cursor arrow. Two hours later, I had to do a hard shutdown.

No matter what you determine might have caused this, I plan to follow your procedure to uninstall 18.8 (after making a backup of my settings), run avastclear, and then install Version 18.5.

I have one question. As I am installing 18.5, will Avast automatically try to download a newer version? I ask because Google Chrome does that. I learned that as soon as Chrome starts to load, I have to disconnect my Ethernet. Then once it is loaded, I can change the requisite setting so that Chrome always asks me if I want to update. That way I don't get automatic updates.

So will I have this problem with Avast, or will it install 18.5, and then not try to update unless I say it s OK?

Harry

[DavidR]

Two instances of the AvastUI, isn't unusual and with a system that is off-line for a while could well be downloading a new full virus database, but I don't thing a few days shouldn't be enough to trigger that.

As and When you step back to 18.5 ensure that the first thing that you do is set Program Updates to Manual before rebooting.  When my XP system was still up and running it never updated from 18.5 to 18.8 and I had program updates set to Manual.

[hmw]

David R:

Again, so sorry being so late in replying.

Earlier you said:
 "I would also suggest doing a clean install, removal of 18.8 before installing 18.5.  Download link for XP version of avastclear - https://install.avcdn.net/iavs9x-xp/avastclear.exe download and save it somewhere you can find it again."

Followed your advice, did a clean install, and ran avastclear.exe.

All seemed to go OK. I wasn't sure if Avast was going to try to install 18.8 automatically, so I disconnected the Ethernet to my XP computer. Seems like that although I have the 18.5 .exe file, Avast requires something from the internet, and it would not load.

So I reconnected my Ethernet cable, and all went fine. As you probably remember, Avast asked if I wanted to update or use 18.5. So I chose 18.5 then immediately went to the setting to prevent Avast from even asking if I wanted to update.

The good news is it seems to run fine. I have probably booted my XP a couple of dozen times since I made the change. It has so far never 'hung' trying to open avast.exe, so that problem seems fixed.

But Avast.exe still consumes almost 100% of the CPU time for 2.5 minutes to 7 minutes, starting about 4 minutes after booting the computer.

So I will just live with that.


Thanks for all of your help and patience.


Harry

[DavidR]

You're welcome.

Many things happen shortly after boot on your system and not just from Avast so that can trigger the on-access scanner.  There are also things happening within avast such as Virus Definitions update and other processes running, at around 8 minutes a rootkit scan normally occurs. Even with 18.5 installed and set to Manual Program Update I believe the Emergency Update Check also happens.

My best advice would be to be brutal on what programs that you allow to run on boot unless they are absolutely essential.  Media players being just one such program type that seem to insist on running on boot, when they really only need to start when you play music/video, etc.

Given your system spec:

My XP computer was custom built years ago by a local shop.
Here is the information on my processor hardware:
IntelCore2 Duo CPU E6550 @2.33GHz 1.98GB of RAM
My software is Windows XP Professional, Version 2002, Service Pack 3.

You would be surprised what more RAM could do to improve performance as the more memory you have the less has to be switched out and in to the Windows swapfile.  All of this swapping could also generate avast activity.  Even a minor upgrade to 4GB of RAM would be a benefit at a reasonably low cost.  A CPU chip would be more costly, but not unreasonably so if you could find a second user IntelCore2 Duo processor.

[Paradoox]

Sorry, I'm late to the party.

I just found this while researching the same problem I am having on two OLD Windows XP boxes that I just turned on for the first time in almost 2 years in preparation for listing them on Ebay. 

I am chiming in to point out that even after disabling all Avast Shields until reboot, AvastUI is still using 99% of the CPU. 

I'm going to try disabling all Avast Shields permanently and rebooting to see if that solves the problem temporarily.   In which case I may just sell the machines with no AV on them.   (I guess you get what you pay for.)