Instant Messaging provider and Trillian log files

[BreakfastPirate]

I'm having some trouble with the Instant Messaging on-access scanner scanning my Trillian log files.  The problem is that some of these log files are extremely large going back about 3 years into the past.  Whenever Trillian opens one of them it is scanned by Avast and it nearly pushes my computer to a halt.  Task manager shows the Avast service as using almost 50% of my 2.0Ghz Core 2 Duo when Trillian attempts to connect.  Is there any way I can exclude the log files from scanning?  Why are they even being scanned in the first place?  I thought the instant messaging scanner only handled received files.

[alanrf]

I think a read of this thread might help you:

http://forum.avast.com/index.php?topic=24312.0

Another recommendation - that may not be so palatable - is to regularly clear the logs or copy the logs to another location before clearing the current logs.

[Lisandro]

For the Standard Shield provider (on-access scanning):
Left click the 'a' blue icon, click on the provider icon at left and then Customize.
Go to Advanced tab and click on Add button...

For the other providers (on-demmand scanning such as the screen-saver or the Simple User Interface):
Right click the 'a' blue icon, click Program Settings.
Go to Exclusions tab and click on Add button...

You can use wildcards like * and ?.
But be carefull, you should 'exclude' that many files that let your system in danger.

[BreakfastPirate]

None of those solutions will solve my problem.  Like I said, the problem lies within the Instant messaging provider.  The standard shield is operating just fine and doesn't use up an extremely large amount of CPU when I open Trillian.  Whenever I have the Instant messaging provider enabled it scans the log files and nearly freezes the computer.  The other thread mentioned solved the problem by disabling the instant messaging provider completely.  This is not a solution as far as I'm concerned.

[alanrf]

Sorry, I had not read the other thread that I suggested thoroughly enough. 

I do not use Trillian personally or the avast IM scanner so feel free to discount anything I say from here on. 

There is not a whole lot that I have seen the avast team talk about in the detail of what the Instant Messaging scanner really does.

Instant messages themselves are not really of any great security concern.  What is of concern is that IM clients can and do transfer files within the IM sessions and then write the files to the user's system.  There is no standard way of transferring files in these clients (unlike with the Webshield and browsers) so avast cannot be scanning this activity as it is in flight.   Therefore I suspect that the major focus for avast is the file writes that are done by the IM client.  Those log files definitely did not get to the size they are just by Trillian reading them. 

So, in effect you have asked avast to scan every file written by Trillian and Trillian's logs are just another file being written by it and scanned by avast.  If these files are indeed years old and you do not regularly defragment your disk(s) then they are going to be scattered all over the disk and accessing them is going to be very inefficient.     

Personally I believe it would make sense for avast to provide an exclusion list in the Instant Messaging scanner so that such logging activity could be done without the effect you are experiencing.

Short of that or some other recommendation from the avast team I think that you are left with the options I mentioned to you earlier to manage your logs periodically with Trillian turned off to avoid the overhead. 

Just one other thought.

I use Windows Live Messenger - it allows me to specify that any file downloads I receive in Live Messenger should be scanned by avast; all I had to provide was the path to the ashquick.exe module in avast.  That means all my file transfers are subject to the most thorough scan available in avast.  I have read that you can specify in Trillian that you want all file transfers scanned by an antivirus scan and similarly provide the path.  It may not be quite politically correct of me to say so (but it may draw more info from avast) but I have to wonder if you have all file transfers in Trillian scanned by avast what more useful protection the Instant Messaging scanner provides to you.   

     
   

[Lisandro]

None of those solutions will solve my problem.  Like I said, the problem lies within the Instant messaging provider.

The Exclusion lists of the Standard Shield work for all parts of avast, like said in help files, and will affect the IM provider too.

This is not a solution as far as I'm concerned.

Did you try? 

[BreakfastPirate]

The Exclusion lists of the Standard Shield work for all parts of avast, like said in help files, and will affect the IM provider too.

Apparently this is not the case.  I even inputted the filter *.* on the exclusion list for the Standard Shield (which stopped it dead as I expected) but the Instant Messaging provider continued to scan log files as I logged on and off of Trillian.  I think alanrf's solution may be the only way around this.

This is not a solution as far as I'm concerned.

Did you try? 

Of course.  It worked flawlessly, lol

[alanrf]

Tech,

it was established also in the other thread I referred to above (in which you also participated) that excluding the log files did not resolve the problem ... the only way was to shut off the IM scanner itself.

Do you have it on the authority of the avast team that the exclusion list should work for the Instant Messaging scanner too?  Since neither IM or P2P has the "view detailed actions" we cannot tell what is being scanned and what is not.
 
It seems (at least to me) that the only complaints we see about IM and P2P scanners is slowdowns caused by avast scanning the log files of the applications themselves.

[Lisandro]

Tech,  it was established also in the other thread I referred to above (in which you also participated) that excluding the log files did not resolve the problem ... the only way was to shut off the IM scanner itself.

Sometimes it works... I start helping with the easier way and just go further if needed... that is my policy...

Do you have it on the authority of the avast team that the exclusion list should work for the Instant Messaging scanner too?

Yes... it's on the help files:

For the Pro version: It is important to keep in mind that these exclusions affect all tasks, except for the resident protection. If you want to set the exclusion for a single task only, you have to edit the particular task.

Igor had said this a lot of times either...
http://forum.avast.com/index.php?topic=12640.msg191940#msg191940
http://forum.avast.com/index.php?topic=25211.msg206282#msg206282

Since neither IM or P2P has the "view detailed actions" we cannot tell what is being scanned and what is not.
It seems (at least to me) that the only complaints we see about IM and P2P scanners is slowdowns caused by avast scanning the log files of the applications themselves.

It would be a good improvement to next avast versions.

[BreakfastPirate]

Do you have it on the authority of the avast team that the exclusion list should work for the Instant Messaging scanner too?

Yes... it's on the help files:

For the Pro version: It is important to keep in mind that these exclusions affect all tasks, except for the resident protection. If you want to set the exclusion for a single task only, you have to edit the particular task.

...

Correct me if I'm wrong, but I was under the impression that the instant messaging provider was part of the resident protection.  Even if we look under "Task name" for the IM provider, it shows resident protection (In the On-Access Control Panel).

[Lisandro]

Correct me if I'm wrong, but I was under the impression that the instant messaging provider was part of the resident protection.

Yes, it's inside of the resident protection. It runs at driver level (won't have an executable or process in background).

[BreakfastPirate]

So the exclusion list should not work for the Instant Messaging Scanner according to the help file you quoted.  Since we've already established that the Standard Shield options have no effect on the Instant Messaging Scanner, it would appear that there is no way to stop Avast from scanning log files in it's current state.

[alanrf]

I do not see any explicit confirmation from a member of the avast team anywhere in this forum that it is possible to exclude files from scanning by the Instant Messaging scanner.

If it can be done (which all the evidence posted seems to counter) then a simple explanation of how to from a member of the avast team would suffice.

I do not think it reasonable to assume any other than the short freezes are being caused by avast scans since turning of the IM scanner relieves the problem.  If it is not being caused by avast scanning the log files then again a recommendation from the avast team on further investigative steps is called for. 

[Lisandro]

So the exclusion list should not work for the Instant Messaging Scanner according to the help file you quoted.

On contrary...

Since we've already established that the Standard Shield options have no effect on the Instant Messaging Scanner

Exactly the opposite... Where have we established this?

It would appear that there is no way to stop Avast from scanning log files in it's current state.

For sure there is...

I do not see any explicit confirmation from a member of the avast team anywhere in this forum that it is possible to exclude files from scanning by the Instant Messaging scanner.

Well... They could correct me... but the Exclusions affect ALL providers, the Standard Shield exceptions work for all on-access (resident) protection... 

Which all the evidence posted seems to counter

Where? Who said that?

I do not think it reasonable to assume any other than the short freezes are being caused by avast scans since turning of the IM scanner relieves the problem.  If it is not being caused by avast scanning the log files then again a recommendation from the avast team on further investigative steps is called for. 

For sure... should be a solution. The Exclusion list is a WORKAROUND.

[alanrf]

Tech,

then why has nobody been able to make it work?

Either the users who have tried the exclusion list are incompetent - which I doubt or it does not work.

Recall that this user told us that an exclusion of *.* did not work ... since you are so sure please tell this user exactly how to make it work to stop the freezes.