Immunet 7.3.2 ClamAV Internet Usage

[RockMaster92]

Can someone explain why the ClamAV.exe will use so much internet on my laptop? When I disable ClamAV in Immunet settings it will no longer use intense internet (ClamAV is disabled) and Immunet runs perfectly on my laptop with Comodo Internet Security. I find that ClamAV.exe can hog my internet when I'm doing things like watching youtube videos. See attached image for refference.

Thank you,

 

 

[ritchie58]

Bandwidth usage does increase when ClamAV is attempting to connect to the server to download/install new defs. That's normal behavior. That should only be a temporary thing however. Lasting only from mere seconds to maybe a minute or so normally.

I would conjecture that ClamAV is scanning temp files associated with the video files as they're being downloaded for malicious content.

If ClamAV is causing what you think is unnecessary system usage my recommendation at this point in time would be to simply turn off the ClamAV module & updates for it in Settings.

Personally speaking, I don't even use the ClamAV module since I have Immunet configured as a companion AV. I use just the ETHOS/SPERO cloud detection trees. Plus, as with the last build there have been reports of update issues with Clam with this build too.

Cheers, Ritchie...

[RockMaster92]

So I disabled "Allow Deflection Updates" for ClamAV. If I manually update ClamAV every few days will this still keep the deflection updated. I started to notice that ClamAV will update to 15% fail, then try and hit 27% and fail, etc. So I take it ClamAV is trying to update in the background multiple times and failing and I'm only noticing it when I watch videos and it slows my internet. Anyway, I just want to know if I can do manual updates and leave "Allow Deflection Updates" disabled for continence?

Edited November 22, 2020 by RockMaster92

[ritchie58]

Like I mentioned in the last thread there are unresolved update issues with ClamAV with this build too. No doubt the updates failing is associated with that on-going bug.

You'll obviously not be automatically getting the newest definition files (when it's working correctly), other than that I don't see any reason why you couldn't leave that setting normally turned off & update manually when you want to.

Just go into Settings and turn on "Allow Definition Updates" -> click "Apply" -> click "Close" -> click the" Update Now" tab.

Don't forget to click on "Apply" every time you turn on or off that setting.

Good idea to attempt to update ClamAV before running a scan with Immunet perhaps.

If you use that approach don't turn off the ETHOS/SPERO cloud engines! Always leave those turned on wold be my recommendation to everyone!

[zombunny2]

ClamAV eats a lot of CPU, especially if you have "scan on install" combined with "blocking mode" turned on. This will slow your machine so the best thing to do is only enable ClamAV if you are using Immunet as your sole AV.

As ClamAV is signature-based, it should display no network-usage at all, unless updating (or attempting to update). Your high network usage can only therefore be coming from checking task-manager while ClamAV is attempting to perform an update.

You are likely seeing ClamAV attempting a lot of updates because it keeps failing, so therefore stays "out of date", and therefore keeps trying again. There is a bug in the latest version(s?) of Immunet, where ClamAV updates keep failing.

I have noticed that any installations I've performed "the proper way" (by downloading from the Immunet web site) display this problem, whereas when I installed using Chocolatey it didn't. I'm not sure if it's coincidence or if it's something to do with the Chocolatey install process, for instance the commandline-arguments that Chocolatey passes to installers. If you want to try this, uninstall Immunet first, selecting "no" to the "keep settings" dialog, to make sure none of the old configuration remains. YMMV.