when screen saver kicks in, Avast starts scanning

[nomad47]

Every time my screen saver kicks in (not the Avast one) my hard drive goes nuts. I turned off the disk indexing and VRDB, but it still goes nuts whenever a screen saver kicks in. Is there a solution to this problem?

nomad47

[igor]

And what makes you think that it has anything to do with avast?

[nomad47]

I checked for spyware, using several scanners, and they found nothing. When I finally uninstalled Avast, the disk activation stopped.

nomad47

[Lisandro]

If you can test avast again, please, check avast log viewer to see if anything into logs are related to this problem. Also, you can configure Standard Shield to show the latest file being scanned and then help on guessing what's wrong... On a first appreciation, this does not seem to be related to avast... so we need further info to troubleshoot.

[igor]

So, the VRDB is set to "Disable VRDB generation", right?

[nomad47]

My apologies. This may not be related to Avast. I will have to run more tests.

My hard drive light activates sometimes when the screen saver is on. I don't know what the reason is. I've run several spyware and anti-virus scanners.

Disk indexing and VRDB are disabled.

It's driving me nuts, and it's a short drive. I'm about ready to take a hammer to this thing.

nomad47

[DavidR]

Is there any process in the Task Manager using CPU % when this is going on ?

You say you have the windows indexing disabled, do you have MS Office as that also has some from of fast search indexing also.

[nomad47]

I don't have MS Office.

The hard drive activation starts soon after the screen saver kicks in, so I can't see what's on the task manager. As soon as I hit a key to see what's going on, the screen saver goes off and the hard drive stops.

I'll have to leave the task manager running, and see if I can spot anything using CPU when the screen saver goes off.

I'm thinking of installing ZoneAlarm, to see if anything is trying to 'call home'. (I used to use ZoneAlarm, but switched to the default Windoze firewall when ZoneAlarm got bloated, and I learned that the outbound protection is being defeated anyways by the current crop of malware.

nomad47

[Lisandro]

I'm thinking of installing ZoneAlarm

You can try others... like OnlineArmor, PCTools, Comodo.

[DavidR]

I'm thinking of installing ZoneAlarm

You can try others... like OnlineArmor, PCTools, Comodo.

Also see A Forum discussion on free firewalls http://forum.avast.com/index.php?topic=30808.0
See http://www.matousec.com/projects/firewall-challenge/results.php.

[nomad47]

Thank you for the firewall suggestions. I'm going to take a few days to see how my laptop runs without Avast installed, and see if the problem persists. (Since I uninstalled Avast, I have seen the hard drive activate, but only once, so far). I only use it for access to a few trusted sites.

nomad47

[DavidR]

It isn't the trusted sites you have to worry about, but the myriad of potential hostile attack from other sites, bots, etc. it simply isn't worth the risk. I hope you have a good and practiced backup and recovery strategy in place.

[nomad47]

I'm sitting behind a router and firewall, so I understand that I would have to actually go to a bad site before I get hit. I was on the Internet from 1996 until 2006 before I started using a full-time anti-virus, and I never got hit. It wasn't until my wife started catching stuff, and the bugs got more malicious that I started using a full-time scanner.

The laptop serves only a very limited purpose, and I do have a back-up/restore plan. There is nothing important on this computer.

If there's something I missed here, I stand to be corrected.

nomad47

[DavidR]

You don't have to go anywhere near a theoretical bad site, that is the problem, any number of sites get hacked and are compromised. Just visiting the hacked page could run malware from another site and effectively you initiated it so it would be allowed by your router.

So if you have no protection anything that gets on to your system it is free to reap havoc and connect to the internet and download more malware.

The Blaster, Sasser and other worms, infected systems when people just visited windows update after they had new systems and they were connecting to ensure they had the latest service pack or security updates. I personally got hit by blaster a very long time ago when I went on-line (windows update) to get XP SP1 and that happened within minutes.

There is also the DCOM exploit, still doing the rounds and the firewall should ordinarily catch that but you only need do a search for that and you will find lots of cases where the avast network shield blocked DCOM exploits. This is done by automated bots generating random IP addresses to hope that there is a computer that is vulnerable on the other end. Whilst the DCOM exploit requires your OS is out of date, there are similar automated attacks using random IP address generators.

So there you have a very short summary in why simply visiting trusted sites is no guarantee. Your system your choice, I done trying to convince you.

[nomad47]

DavidR,

Your advice is very much appreciated. My understanding of how malware works is vague, at best, and you have clarified the issue for me succinctly. I just didn't know what else to do. The laptop in question sits on our coffee table and is used only when we're watching TV, in case I need to access the net while I'm watching a movie. (Usually, the Internet Movie Database). The constant clicking of the hard drive when my laptop wasn't supposed to be doing anything at all was driving me nuts.

I have run several anti-virus and spyware scans, and they found nothing. I just didn't know what else to do. Short of a format/restore, I didn't know what else to do to isolate the problem. Shutting down Avast was my last desperate hope. I realized that I was taking a risk, but I judged that risk to be acceptable at the time, for I was fresh out of options. I was prepared for a potential infection, followed by a backup/restore. There is nothing of importance on that particular computer. (I have five others in the house).

Based on your advice, I will install another anti-virus in it and see what happens. Again, your feedback is very much appreciated, and not taken lightly.

Thank you for all your trouble.

Regards,

nomad47

P.S. I did as you suggested, and had the Task Manager running, to see what that culprit might be. I did see the hard drive activate the other evening, and the culprit at that particular moment turned out to be Word 6.0. It is not the only culprit, however, as I have had the problem when Word was not running. I can't imagine why Word 6.0 would be accessing the hard drive like that, since I had auto-save shut down.