Custom scan memory leak?

[YarrMateys]

Hi all, I'm new to this forum. Just got Avast Free.
So I decided that a "quick scan" that takes over an hour (because it scans the whole hard drive) doesn't work for me, I created my own custom scan.

I have it set to scan operating memory and autostarts only. Scan priority is at normal.
So here's the issue: when I run this scan, my total system's total memory usage slowly rises to double (30% to 70%, or about 750MB more used) and stays there. I don't know if the built-in "quick" scan does this, as I never have the time to let it finish.

And in Task Manager all the avast processes look to have entirely normal mem usage after a scan. In fact, the highest usage process is svchost.exe, at about 150 to 200MB. Honestly, I'm not sure the Task Manager is telling the truth about memory usage.

I just know that this ludicrous memory usage happens when I run that avast scan.

System info: Core 2 Duo 2.4GHz, 4GB RAM, avast Free 6.0.1289, Win 7 Pro x64, also running Comodo Firewall (no AV, even Defense+ disabled).

I really like avast, but I can't continue using it if it doubles my RAM usage in a scan.

[DavidR]

Well the Quick scan doesn't scan the whole drive. If you haven't partitioned the Drive you will only have C:\ (the system drive) not all files will be scanned in the Quick scan, only those which are at risk of infection (.exe, .dll, etc.) and those which present an immediate risk if infected (executables). Inert files (archives) and those not an immediate risk, (text files, etc.) won't be scanned. Did you change any of the Quick scan settings (Sensitivity or Performance sections), like the Packers, e.g. All packers (Archives), which would increase scan duration and memory use as it unpacks these archives to be scanned ?

svchost.exe isn't an avast file but a system file (service host), so you actually need to find what processes are using this occurrence of svchost. I use a little tool called SvcHostAnalyzer.exe. The avast scanning control is avastSvc.exe.

[igor]

There's no memory leak there; what you see is "normal".
Windows memory manager keeps only certain parts of running files in memory - the unused rest is either forgotten (and reloaded from disk if needed), or backed up in the swap file (and reloaded from there if needed).
The memory scan touches all the memory of all the running processes, thus forcing Windows to reload all the "forgotten" blocks of data from the swap file. When you look at the Task Manager, it appears as if new memory was being allocated, but it's not the case, it's only been summoned back from where it's been put aside previously.

After some time, Windows memory manager should "forget" those unused blocks again, so the memory usage will lower again.
So it's not a bug, it's simply how things work. The only "solution" is not to use the memory scan (it's not very useful anyway, I'm afraid, most detections are prepared for files).

[YarrMateys]

@DavidR
I left all the settings in Performance and Sensitivity alone, as in whatever the default is for new custom scans.

And if avast only scans .exe, .dll, and other files like those, then I must have a lot of them. I'm assuming the boot time scan also behaves like that, as I allowed one of those to complete and it took one hour and 43 minutes.

Also, @igor, thank you for the memory explanation. I won't use the memory scan anymore. I wonder how Norton scanned memory without Windows reloading the "forgotten data"?

Anyway, is there even a purpose to running a file system scan with the real-time shields?
Should I just, for example, schedule a monthly boot scan and leave it at that?

[DavidR]

My question was more related to your Quick scan settings as an hour is very long. You didn't say if you only have the one partition C:\, if so then everything I mentioned previously would be scanned. So depending on just how much data is on that c:\ partition (?) would dictate how long it is likely to take.

I have 4 partitions on my primary hard drive the C:\ drive contains only windows XP Pro OS and installed Programs, my data is on another partition, media files and images on another and backups on the last partition. I have a second hard disk that I store my Drive/Partition backup images on. My Quick Scan take a few minutes as I keep the C:\ partition cr*p free.

The boot-time scan is going to more thorough as by default that scans all archives and also scans for PUPs.

[Pondus]

Hi all, I'm new to this forum. Just got Avast Free.

I wonder how Norton scanned memory without Windows reloading the "forgotten data"?

have you uninstalled Norton before you installed avast ?
did you run a removal tool to clear any leftovers ?

run and reboot - Uninstallers for Security Software
http://thewebatom.net/uninstallers/security-software/

[Nesivos]

If you are seeing the rise in memory usage in a svchost file while avast! scans and are using Windows 7 my guess is that the rise in memory usage is from Windows Defender.   You can try disabling Windows Defender or maybe just turning off its real-time scanning capability in Windows Defender and see if that reduces the memory usage when you are scanning with avast!

Sometimes a anti-malware program will be more active while another anti-malware program is running.

[YarrMateys]

My hard drive has two partitions, C and D. C is the system drive, with 88GB of data total. D is a 12GB recovery partition. Now, I also have MS Office, Visual Studio Pro, Matlab, and Mathematica installed, and they have a lot of executable files in them.

Also, to those who were asking, before I installed Avast, I made *very* sure that Norton 2012 and Windows Defender were cleanly removed / fully disabled. Avast is my *only* AV/antimalware with any real-time functionality.