ashserv.exe: Scanning behaviour

[NewAvastUser]

Ashserv.exe takes 10-20% of the CPU when there is no other activity.  Is there a synopsis of the plan that governs the scanning?

Thanks.

[Lisandro]

What is no other activity...? Which other programs are running in background? And services? And indexing?
Are you using the Home or the Pro version?

[DavidR]

Ashserv.exe takes 10-20% of the CPU when there is no other activity.  Is there a synopsis of the plan that governs the scanning?

avast doesn't just up and scan on its own, the ashServ.exe file is the main scanning engine and on an on-access scanner there must be activity to initiate a scan. So something must be running in the background ?

You could temporarily enable the 'Show detailed info on performed actions.' Open the on-access protection screen (left click the avast icon) select the Standard Shield provider > Customize > Advanced tab - 'Show detailed info on performed actions' this option is off by default, this function displays a pop-up list of what is being scanned. Under normal circumstances this would get tiresome very quickly (why it is off by default), but it may help identify what it active and being scanned.

[NewAvastUser]

What is no other activity...? Which other programs are running in background? And services? And indexing?
Are you using the Home or the Pro version?

Apps open are firefox (on a government of Canada weather forecast site, no moving widgets), Thunderbird (checks mail once every 20 min, no activity otherwise), task manager, Kerio Personal firewall, synatptics touchpad, and Palm Desktop.  No indexing.  If I pull up the Services window, the services that I recognize as nonstandard include telnet, cygwin's ssh daemon, vnc server, automatic updates for windows, DNS client, fax service, Check Point SSL network extender.  I'm using home version on Windows 2000.

[NewAvastUser]

avast doesn't just up and scan on its own, the ashServ.exe file is the main scanning engine and on an on-access scanner there must be activity to initiate a scan. So something must be running in the background ?

You could temporarily enable the 'Show detailed info on performed actions.' Open the on-access protection screen (left click the avast icon) select the Standard Shield provider > Customize > Advanced tab - 'Show detailed info on performed actions' this option is off by default, this function displays a pop-up list of what is being scanned. Under normal circumstances this would get tiresome very quickly (why it is off by default), but it may help identify what it active and being scanned.

Wow, thanks.  That's awesome.  I can tell that it scans a js file in the firefox directory for this forum session "(sessionstore").  So not really a surprise there.  Once in a while, it looks at Thunderbird (TB) mailbox summary files (msf) even though TB is never in the foreground.  That could mean that TB is compacting its files regularly, though I don't recall that being an option (much less one that I activated).

[Vlk]

Have you changed the sensitivity of the Standard Shield (or the on-access scanner in general) from Normal to High?
These files aren't supposed to be scanned on-write with the Normal (default) settings.

Thanks
Vlk

[NewAvastUser]

Have you changed the sensitivity of the Standard Shield (or the on-access scanner in general) from Normal to High?
These files aren't supposed to be scanned on-write with the Normal (default) settings.

No, it's still normal.  I never actually delve into the menus and applications available from the "a" ball on the system tray.

I don't think the fireforx sessionstore.js file is for my session with this forum, since it gets scanned regardless of whether I'm on this webpage or not.

The TB file scans seem to be more the except than the norm.

I found that after I enabled the monitoring of what files are scanned, the point response to the touchpad started to slow down.  Soon, it became unresponsive, and I rebooted.  No noticable touchpad problems since.

P.S. Unrelated question: Is there a way cancel a reply being composed and return to reading the thread?

[Lisandro]

P.S. Unrelated question: Is there a way cancel a reply being composed and return to reading the thread?

Doesn't the back button of your browser help?

[NewAvastUser]

P.S. Unrelated question: Is there a way cancel a reply being composed and return to reading the thread?

Doesn't the back button of your browser help?

It does.  I've avoided using that because several login websites I've used get confused by the back button, but this forum seems to respond well.  Thx.

[NewAvastUser]

avast doesn't just up and scan on its own, the ashServ.exe file is the main scanning engine and on an on-access scanner there must be activity to initiate a scan. So something must be running in the background ?

You could temporarily enable the 'Show detailed info on performed actions.' Open the on-access protection screen (left click the avast icon) select the Standard Shield provider > Customize > Advanced tab - 'Show detailed info on performed actions' this option is off by default, this function displays a pop-up list of what is being scanned. Under normal circumstances this would get tiresome very quickly (why it is off by default), but it may help identify what it active and being scanned.

Wow, thanks.  That's awesome.  I can tell that it scans a js file in the firefox directory for this forum session "(sessionstore").  So not really a surprise there.  Once in a while, it looks at Thunderbird (TB) mailbox summary files (msf) even though TB is never in the foreground.  That could mean that TB is compacting its files regularly, though I don't recall that being an option (much less one that I activated).

Is there a log for the scanning of these files that I'm being notified of?  Would allow some kind of forensic look.

[DavidR]

Not by default, which is why I gave the display option.

I know there is a means of logging editing the avasy4.ini, I can't recall it off the top of my head, but I'm not sure if this is only for the web shield and internet mail providers. Tech has info on this.

[Lisandro]

I know there is a means of logging editing the avasy4.ini, I can't recall it off the top of my head, but I'm not sure if this is only for the web shield and internet mail providers. Tech has info on this.

You're right David. Only for that providers, not Standard Shield that I'm aware of.