Avast downloading 96mb of data in four hour session online

[edante]

Hi there,
After six years of using Avast without any problems, I've just been notified that I've exceeded my broadband usage (2GB) for last month (usually don't make it past 1GB) - and it seems Avast may be the reason. I installed Online Armour's firewall and discovered that Avast (most recent version) has been downloading at least 50mb in each three or four hour session online. I kept an eye on it today and in a four hour session, it downloaded 96mb (not kb) of data. My partner uses Avast on his laptop and in the same time period, his version download 7mb.

I've uninstalled Avast and installed the latest version, but have set the updates to 'ask when available' to set some sort of control on Avast's contact with the net.

Can anyone advise on a reason/solution for this issue? I've run a thorough virus/malware check (using TrendMicro, Superantispyware, Malwarebytes, RUBotted and Spybot as well as Avast) twice in the last month, without finding anything.
Would appreciate any suggestions from users or Avast folks - this is terrific software and I would hate to stop using it.
Many thanks,
Elizabeth

PC spec
Dell Dimension 2400
Intel Pentium 4 CPU 2.80GHz
2.79GHz, 1.00GB of RAM
Windows XP Home Edition, SP3

[DavidR]

To start with avast doesn't download anything for itself, other than updates (which are measured in KBs not MBs) and there is no way this would amount to 96MB in 4 hours.

Anything that you browse is scanned by avast's web shield or download using P2P, etc. and I believe this is what you are seeing reported by online armour. Check what it says was downloaded by your browser or P2P applications.

[edante]

Hi David, thanks so much for coming back to me so quickly!

The size of the download doesn't match up with what I was using today (Firefox, Flock and TweetDeck and 2 x 5mins YouTube videos) - no music (no Spotify) or other downloads and I don't use any P2P (that I'm aware!). My only thought is a Windows update, which didn't show up in Online Armor's list (although it did list a connection to a Microsoft IP when I logged on this afternoon). Would Avast be monitoring my combined internet usage and listing it as one 'downloaded' session? If so, the individual listings in Online Armor don't add up to anywhere near 96mb, they'd be flat out making 15mb.

My Windows update review doesn't list anything for today (last update on 8 Dec) and I usually see it updating in the task bar, so I'm still at a bit of a loss as to why it's listing such a large download. I also have a broadband usage monitor installed, which is matching the download listed in Online Armour, so something is definitely downloading to my PC and Avast is the only thing counting it.

Is there any way to view what Avast is/has been monitoring during a session? I would like to think that if it was something suspicious, Avast would flag it!

I realise this may not be an Avast question any more, so thanks for your help so far!
Elizabeth

[DavidR]

avast would intercept inbound port 80 HTTP traffic so it is scanned in the proxy before being saved to your browser cache, so a) it doesn't initiate the connection and b) this would be a single input to your system. e.g. browser > web shield intercept > internet > web shield > browser.

So the only thing that I can thing of is that online armor is double counting, that of the actual traffic down from the internet and the localhost (your system) traffic through the web shield proxy to the browser cache.

Other than that I have no other idea how OA arrives at its figures as I have never used that firewall.

Suspect traffic would no doubt be scanned by avast's web shield and if malicious alert.

[edante]

Thanks again David, I think you might be right about double-counting, OA does list localhost connections for both Firefox and Avast, as well as 'country' listings for connections to the net and in my session this evening, the Avast download count is roughly double what all the other connections added together are.

Still doesn't explain the 96mb this afternoon, but I think we're beyond the realms of blaming Avast now!#

Thanks again, very much, for your help (and so fast!), if I find out anything related (or indeed what it is), I'll post what I find.
Much appreciated,
Elizabeth

[DavidR]

No problem, glad I could help.

Welcome to the forums.

[MikeBCda]

One other suggestion is to see what your ISP shows as broadband usage, especially if it's broken down into separate download and upload figures.  You did mention surpassing (according to them) your 2GB limit, but how's that look in terms of downloads vs. uploads?

On my own account, there's a "soft cap" of 60 GB/month, of which I typically use 2 to 2.5 ... I've never set up anything on my web-page allowance (20 megs, if I remember correctly), and I'm sure if I had then I'd be looking at much higher usage (if anyone was interested in looking at it, of course   ).  

Typically, depending on what I'm doing, uploads are in the range of 10 to 25 pct of downloads.  I was surprised that the uploads are that high, but a tech-support rep reminded me that routing requests and the like typically account for a major part of that.