Posts made by Timur Born

For comparison, KTS 21.3 showing the AVP entries in the middle of the context-menu (above WinRar):

Uninstalled, reinstalled.

What traces would help document the missing context-menu?

You already got traces and animated GIFs for the same issues during the KES beta. I got no feedback for the traces I sent in, but especially the high load and lag of the maximized reports window should be easily reproducable.

Reproduction steps:

Actual result: Automatic analysis is enabled, no option for disabling seems to be present?

Expected Result: Settings/options for disabling automatic analysis should exist and easily accessible via above field/button.

Reproduction steps: Open AVP UI. Look at Database Update field.

Actual result: Update circle keeps permanently spinning even when no updates are available.

Expected Result: Static image.

Turns out that this was not happening due to a restart. Instead I get the message popup every time I restart Windows. According to AVP's log it could not start Safe Browsing properly yesterday, but for today nothing is seen in the log. There also is no error in Windows' application log.

I send you two reports via the popup today, one including OS information and one including AVP logs, except for the complete dump (which does not explain what is included).

Reproduction steps: Restart Windows (11)

Actual result: AVP pops up a message about failing to start properly last time and offers to send in a crash report. Nothing unusual seems to be found in AVP or Windows logs.

Expected Result: No error message.

Reproduction steps: Run a selective scan of the C drive. Observe AVP CPU threads.

Actual result: Only about 4 out of 24 logical CPU threads/cores used. There are more threads created, but these do not process any files for the selective scan (4.16% = 1 core maxed out).

Expected Result: All 24 logical cores used, or at least the 12 physical cores (depending on SMT/Hyperthreading use).

Reproduction steps: Click the following field/button (Quick Scan field of Home screen) while another scan is already active.

Actual result: Quick Scan is started on top of the already running scan Full Scan.

Expected Result: Quick Scan not being started on top of the already running Full Scan.

Reproduction steps: Right-click on a folder.

Actual result: No context-menu entry for AVP.

Expected Result: Context-menu entry for AVP (either classic W10 menu or new W11 menu, preferably both).

Actual result:

Expected Result:

Of course, some space and graphics should be used for design, but the current implementation is wasting so much space for literally "nothing" inside a fixed size window. Now we need to scroll for nearly everything.

Reproduction steps: Open Reports or Manage Applications window, maximize to full screen, scroll or move/hover mouse. This is on Windows 11, but looks similar to my former issue report of KES Beta running on W10.

Actual result: High CPU load by AVPUI.EXE (one CPU core maxed, another core loaded 50%).

Expected Result: Low CPU load by AVPUI.EXE.

Extra note: The initial scan window right after installation also causes AVPUI.EXE to load one CPU core to about 50% (or about half of AVP.EXE, which only seems to use a single-core in this scan). This seems quite high for doing little more than animating a single progress bar.

Furthermore memory consumption of AVPUI.EXE seems excessively high during a normal "Full Scan". Even worse, when the UI window is closed then memory consumption initially drops, but only after some time and then it builds up again even while the window is still closed.

(4.16% = 1 CPU core maxed out of 24 logical cores)

UI load while moving mouse in Manage Applications window: https://imgur.com/xw8STmD

UI load during initial (post-setup) scan: https://imgur.com/FJ5KCLA

UI memory during Scan All with window open: https://imgur.com/UArvsgp

UI memory during Scan all with window closed (keeps going up and down): https://imgur.com/E8nSfov

I installed "Plus" over a present installation of KTS and my 2 year licence key was properly replaced with a new 80 days key while all my old settings were kept intact. (Lead to my first BSOD on this W11 setup, though.)

I reproduced this using Windows Defender. It seems that saving the AV cache files in ProgramData is mostly responsible for the increase of used up System Restore space. So the first scan sees the largest increase and consecutive scans show less increase and less SYSTEM write operations.

Test using DisableLastAccess seem to indicate that growth and writes are higher when last access times are enabled. It also seems that not only are some folder access times not updates, but also some file access times. This needs more testing, though.

And then there is still the case where I saw AVP.exe write to scanned folders directly. This does not happen every time and I have to catch it again.

Apart from all that highest drive utilization seem to happen when AVP writes its tempio files. It would be interesting to see what happens if AVP would write all its temp files and preliminary cache files to appdata/local/temp or Windows/temp and only copy finished cache files over to ProgramData.

Reproduction steps: Start a scan, minimize AVPUI.

Actual result: Progress bar on Taskbar icon is not updated while AVPUI is minimized.

Expected Result: Progress bar keeps updating while minimized.

No idea if this even qualifies as a bug or not?!

I am currently testing DisableLastAccess enabled and disabled. Things are not so easily reproducible with this one.

I wonder if "tempio" being in ProgramData instead of Appdata or Windows/temp might also have an impact? Not sure.

I mentioned this in another post, but I think it is worth its own case. Writing "last accessed" time information to all files scanned might be part of the cause of this issue.

Reproduction steps: Run a full scan (iSwift/iChecker disabled for better reproducibility) of the system with Windows System Restore enabled.

Actual result: During the scan Windows keeps writing new data to System Volume Information and MFT, mostly in many small bits instead of single large ones. As a consequence drive utilization is increased during scan (sometimes affecting scan performance) and System Restore is filled up with likely unnecessary data.

Before scan:

After scan = over 1 gb extra data written to disk just by scanning via KES:

This also happens when KES trace file is disabled and also seems to happen while no temporary files are written to ProgramData by KES (scanning inside of archives).

Expected Result: No write operations to scanned folders. Other AV solutions also offer an option to have AV scans not change "last accessed" times on files, which makes a lot of sense.

1) Does "example.com" without mask do anything then?

2) The browser plugin was not installed.

The original issue of KES scanning slower than KIS was solved by disabling the trace files. So there is nothing more to analyze or is there?

KES/KIS only using a limited number of CPU threads/cores seems to be a deliberate choice by your developers. You would have to ask your developers if this is by design or maybe a bug. Additional threads are used for real-time scans so overall KES is capable of using more, it just does not do so for on-demand scans.