[6.0.1044] Avast Running a Full System scan automatically and loops

[DavidR]

As the title says, this has been happening for a while today and it is cycling over and again, confirmed in log file, image1.

At first I though what is this Bing Bong sound every now and then, I didn't twig what it was eventually I got fed up and did some rooting around. I checked the task manager and avastSvc.exe was running at 40-50% (image2) whilst it wasn't having a major impact on what I was doing.

The avast tray icon wasn't rotating and on activity in any of the avast shields. So I opened up the Scan computer interface and say that a Full System scan was running. Now I have a scheduled scan set for the 1st of the month, so it shouldn't be that. But that was it as soon as I opened the section the scan in progress window was displayed.

Scratching my head, checked that the system date was correct 29/3/2011 and time correct.

Stopping the scan was no good, it just started another one and another one and another one ad-infinitum. Pausing the scan was the only option left that didn't regenerate the scan. Though even with the scan paused avastSvc.exe is still eating around 40% of CPU, so I don't know if there might just be another one running in the background again. The time I have been gathering the information, images, etc. and scan should have completed, but no bing bong sound indicating completion, so perhaps no other scan running.

####
There have been some reports of high avastSvc.exe CPU in the forums and they have been unable to find the cause and ended going back to the 6.0.1000 stable build, perhaps this is what is/was going on with their systems.

Unfortunately this is on my XP system so I can't try the Create Dump file.

~~~~
Just checked my win7 netbook and the same thing is going on with the full system scan cycling again and again. I have just created an AvastSvc.Dmp file (185,995B) from the win7 task manager and will be uploaded to the FTP location as DavidRAvastSvc.7z (39,868KB)

@@@@
Well try a reboot and see what happens, rather do that than stopping the avastSvc service.

[Nesivos]

On a Full System scan what happens to the scheduled Full System Scan when you have the scheduled scan set for the 29th, 30th or 31st of the month and the month has fewer days in it than the scheduled scan date; e.g Feb?

Does Avast just skip that scan for Feb?

[DavidR]

I have my scan set for the 1st of the month (at 1am, me and my computer is normally up at that time) always one of those, so I haven't got a clue what it would do or anyone would be daft enough to schedule it for the 31st. Aside from that nothing to do with this topic, so lets not stray off-topic.

~~~~
Back to my dilemma, reboot didn't do any good as son as the system was up the scan was off and running again.

I couldn't stop the scan and get into the settings (it was too quick in starting another scan) and check the settings.

In the end I had to go into avast5.ini and cut the full system scan out of the tasks. Rebooted and no scan, checked the Scan Computer settings and had a weird ? scan name, presumably because I hacked out the scan details and failed to remove the associated Task ID.

Act in haste, repent at leisure, could just have changed the SchedulerEnabled=1 to SchedulerEnabled=0 and that would have killed the scheduled scan. This is what I did on the win7 netbook after the above fiasco and rebooted and no scan.

####
Well now to the next part of the saga for some reason I can't upload the ftp://ftp.avast.com/incoming location with FireFTP or with IE drag and drop. So I have tried connecting vis windows explorer and dragging and dropping the file into the window, that appears to have worked but there is no confirmation that it has.

So I will leave my system on for a while to ensure the DavidRAvastSvc.7z (39,868KB) file has enough time to upload.

It's now a little after 4:45am a bit past my bed time

[jimmyclack]

I have the same problem - only started last night!  I have XP SP3 and use Firefox 4!  I seem to remember getting a message from Firefox telling it couldn't update (or couldn't check for updates - I'm not sure which!)

Ever since Avast keeps running scans one after another and is swallowing my CPU!!  Please Help!!

[DavidR]

It has nothing to do with your browser, but the most important part of the issue is what avast version are you using ?
e.g. the regular release 6.0.1000 or one of the pre-release versions like 6.0.1044 referred to in the Topics Subject ?

[mtheetje]

Same problem here, endless loop of full system scan (not planned today) with release 6.0.1000 on Windows Vista, using >50% of CPU.
What I also notice there is no 'settings' button for that scan, which perhaps indeed is because it starts scanning again so quickly after 'stop'

[DavidR]

You can't get to the settings, whilst a scan is running, even paused you can't change the settings.

There was too little time between me Stopping the scan, clicking OK to expand the more details link to get into the settings to uncheck the Scheduled option.

Now I edited the avast5.ini file as outlined above, but that if you mess up could be curtains if you stuff up. 

Finding the actual scheduled scan isn't too difficult find the one with "ScanAreas=AllHarddisks;*RTK-QUICK;QuickStartupMem" (without the quotes), that is/should be the one for the Full System Scan. Confirm that it also has SchedulerEnabled=1 (scheduled) and that should be changed to SchedulerEnabled=0 (not scheduled).

That when rebooted should hopefully stop this scan.

You could also try booting into safe mode, avast doesn't run in safe mode, so you should be able to start avast manually, to do a scan, that should allow you to access the Scan Computer interface and open the Full System scan, more details, Scheduling and uncheck the 'Schedule this scan.' OK those changes, but don't complete the scan.

Boot into normal mode and see if that has resolved the scheduled scanning and looping, this is safer than modifying the avast5.ini file.

[kbav]

I had the same thing happen last night; Full system scan scheduled to run monthly and started at midnight and kept running over and over (according to logs).  I was finally able to get it to stop long enough to access the settings and turn off the scheduled full system scan.  Using version 6.0.1000 on XP SP3.

[mtheetje]

I had the same thing happen last night; Full system scan scheduled to run monthly and started at midnight and kept running over and over (according to logs).  I was finally able to get it to stop long enough to access the settings and turn off the scheduled full system scan.  Using version 6.0.1000 on XP SP3.

Thanks, I just did the same, what a relief!

[DavidR]

I had the same thing happen last night; Full system scan scheduled to run monthly and started at midnight and kept running over and over (according to logs).  I was finally able to get it to stop long enough to access the settings and turn off the scheduled full system scan.  Using version 6.0.1000 on XP SP3.

It's hard to say what might have triggered it, if it were in the code of 6.0.1000 and later builds, then I would have expected it to happen to many more people (and seen it in the forums) as 6.0.1000 was released a little over a month ago.

Then it would be how many have a monthly scheduled Full System scan enabled and why it didn't happen at the last month

I wonder if there have been any change in the engines in the 110328-0 or 110328-1 virus definitions & engine updates that might have triggered this. But that is doubtful as that surely wouldn't effect any scheduling.

I hope that the information I have provided here and the avastsvc.dmp file I uploaded will help to get to the bottom of it, now it is a bit of a waiting game for the developers to intervene.

[igor]

I can't imagine how a virus database update could change the behavior of the scheduler... the scheduler is fully in the program, no parts in the engine.
I can, however, imagine a problem in the scanning engine that would make the scan loop on a particular file?

Unfortunately, I don't see any file called David* on the ftp (except for DavidR_MEMORY, but it's from January 31st).

[kbav]

I had the same thing happen last night; Full system scan scheduled to run monthly and started at midnight and kept running over and over (according to logs).  I was finally able to get it to stop long enough to access the settings and turn off the scheduled full system scan.  Using version 6.0.1000 on XP SP3.

a little more information: the full system scan was scheduled Monthly with a Launch Time of 0:0 and a Launch day of "1".  According to the scan logs, there was a full system scan on 3/1/2011 starting at 12:00:00AM and the next scan (when problems started) was 3/29/2011 starting at 12:00:00 AM.  This scan was then repeated throughout the night until I was able to turn off the scheduled scan.  It seems that it shouldn't have started another full system scan 4/1/2011.

[kbav]

I can't imagine how a virus database update could change the behavior of the scheduler... the scheduler is fully in the program, no parts in the engine.
I can, however, imagine a problem in the scanning engine that would make the scan loop on a particular file?

Unfortunately, I don't see any file called David* on the ftp (except for DavidR_MEMORY, but it's from January 31st).

My scans did not seem to loop on a file.  Each scan completed (~ 1hr 20 min each) and then another scan started immediately (I have 8 entries for full systems scans in the scan log for today)

[igor]

Hmm... maybe the scheduler got crazy from the DST time change last weekend?
So what are the common variables?
- all were "monthly" schedules for the 1st day of the month, or some were different?
- was it always the full system scan? (even though I don't think this is relevant)
- was your computer turned on during the DST change? was it turned off ever since that?
- all were avast! 6?

[DavidR]

I can't imagine how a virus database update could change the behavior of the scheduler... the scheduler is fully in the program, no parts in the engine.
I can, however, imagine a problem in the scanning engine that would make the scan loop on a particular file?

Unfortunately, I don't see any file called David* on the ftp (except for DavidR_MEMORY, but it's from January 31st).

Neither can imagine it could be that but nothing else has essentially changed. It was just that this appears to be across all 6.0.10xx builds not just the pre-release builds.

I will try and find the file again upload the file again and upload it, but right now I can't find it. So I don't know if I used the old memory dump 7z file as the container, but I may simply have sent the wrong file and I can't find the original.

OK found the original and will try to upload again, it is 80,440KB.

Common variables:
1. Yes
2. Yes - my Quick scan is weekly on a Sunday at 00:15
3. Yes - My XP system was certainly on and possibly the win7 netbook when DST occurred, Sunday 27th at 1am.
4. Yes, both were on 6.0.1044.