SecureAPlus Slow on Windows 10 Enterprise 2019 LTSC

[Anthony Royer]

Hi,

I am using a VM (VMware Workstation Pro) with Windows 10 Enterprise 2019 LTSC.

I installed SecureAPlus 5.1.0 with the AVIRA plugin.

Cepedant I find SecureAPlus very very slow, when I do an EICAR test on the site of Kaspe ... (ZIP x1), SecureAPlus does not react at all. I have the time to decompress the ZIP and execute the .exe file and nothing happens ... And only after at least 1 minute of waiting, SecureAPlus notifies me of a threat.

Is this problem because of the VM or this specific version of Windows?

I hope this will help you.

[hendy]

We don't detect compressed file, but if you extract the file, it should be detected.

If you encounter slow detection, it may be due to the slow response of our cloud engine (depending on the internet speed).
You can try to turn off the real-time scanning from Universal AV.

[Anthony Royer]

Thank you for your reply.
What I do not understand is that I have a good internet connection and that the EICAR.exe file has been uncompressed on the desktop. I was able to double click on it and execute it without detection of SecureAPlus and without blocking by the Whitelist while Eicar is not approved.

[Anthony Royer]

Hi,

I have just done a new test.

I just installed the latest version of Windows 10 Pro 1809 on a physical machine (not virtualized).

I directly installed SecureAPlus 5.1.0 without ClamAV. I then activated my Premium + AVIRA license to install the AVIRA update.

I restarted my computer, I let the initial scan finish to establish the Whitelist.

And I oddly the same report, I download the file Level1.zip (https://support.kaspersky.com/fr/viruses/avtest), I decompress eicar.exe on the desktop, SecureAPlus detects nothing.

It takes a good 30 seconds to get a reaction.

What I do not understand is that I have AVIRA in offline + APEX and so I should have an immediate detection.

Note that about 6 months ago, with AVIRA (without APEX coup), I had never encountered this problem.

Thank you in advance for your help, it is rather a problem.

[hendy]

Hi,

For your latest test, did you try to disable Universal AV real-time scanning?
The slowness may be caused by our server side response, not from your side, but we still don't know whether it is because of the geo-location, or any other reason. If the speed improve after you disable the Universal AV real-time scanning, we may have to check on our server. We will see on how to improve this from our server side.
If you only use Avira + APEX, without Universal AV, it is supposed to be fast.

[Anthony Royer]

Thank you for your advice, I confirm that actually deactivating the real-time scan of Universal AV, no problem At the moment of decompression, I instantaneously the pop-up that opens with the engine AVIRA and APEX .

This confirms a problem with Universal AV (for information, I live in France and I have a connection of about 40mb/s downstream and 10mb/s up, which is very acceptable).

I still find the strange principle, if Universal AV has difficulties, it impacts offline detection. Do you think you can adopt a different alternative on this subject?

For example, if your Universal AV servers are under maintenance, AVIRA and APEX must be very responsive and not like now.

In any case, I hope I have been able to help you.

[Anthony Royer]

Incidentally, I forgot, there is a bug also with the daily limit of upload that I can not change. When I want to pass the bar of "1Go" to "Unlimited", Windows ask me to accept the administrator permission, I validate with the button "Yes" and I have a 50 error code.

[hendy]

Thank you very much for reporting the bug to us. Here is the fix for the error code 50:
https://secureaplus.secureage.com/betadownload/FixedSecureAPlusService_v5.1.0.1.exe

[Anthony Royer]

Super thanks for the patch, error 50 is fixed

I still have the problem with Universal AV cons, which makes AVIRA and APEX ineffective for several seconds, it's rather dangerous I hope you will come to the problem.

[Anthony Royer]

Hi,

Have you located a possible problem related to my description? If you need more information, I remain at your disposal to help you

[hendy]

Hi,

Thank you very much for your willingness to help us in troubleshooting the issue.
Our team is still trying to figure out from our server side.
We will let you know if we need more information, or probably need your help to check again after we make the changes.

[hendy]

We have fixed the issue from our server side. The response should be faster now. You can try again.

[Anthony Royer]

Hello,

I confirm that I have no problem

You confirm me that if for example your servers are in maintenance or idle, the antivirus offline will take precedence over notifications to no longer have this latency? (APEX and / or AVIRA)

Thank you for your work !

[hendy]

If the real-time scanning for Universal AV is enabled, if there is any latency on the server, it will still effect to the notification. It will take longer for the notification to show because it will be waiting to combine the scan result with the server. We have tried to improve the code on our server side, so this issue should be solved.

[Anthony Royer]

Thank you for the explanation but I find it strange. Actually today it works perfectly. But if tomorrow you have a problem on your servers (which is not impossible), it will slow down enormously see prevent the notification window to open to report a threat.

Will not it be wiser to prioritize offline AV?

Example:

An incoming threat is detected (by the offline AV) via a download on Chrome. Even if Universal AV is not ready to give its result, the threat pop-up should open directly and in this same pop-up, that there is a loading message to inform that Universal AV is being verified. Actually this problem will be in the case of a server problem, but having an offline license AVIRA the latter is very effective on detection by signature and I find it a shame to impact its performance.

The advantage of this solution is that it is completely transparent to the user, it does not need to inquire about the state of the servers or to disable the Universal AV scan in the settings.

I hope I managed to make myself understood and that it will help you.