Slowdown When Running Programs for First Time

Hi all!

Being a recent convert to WRSA Essentials from Prevx, I have noticed on both my desktop and my wife's laptop a dramatic slowdown when opening some programs for the first time after installing WRSA. In some cases the computer becomes unresponsive for up to a minute or more. Subsequent access to these same programs doesn't appear to be affected.

Am I right in assuming this is caused by one of WRSA's Shields examining the new program before allowing access? If so, how much of a delay is considered normal? We also have pretty slow upload speeds here (.43 Mbps), so could this be contributing to the slowdown?

 

Save the logs and look for "Monitoring..." lines for the program you were running. Got big numbers on them?

 

Thanks for the suggestion Techfox1976, but the programs are not recorded as being monitored.

I have also traced CPU usage whilst opening new programs and it hasn't gone over 40%, so the system's CPU is not overloading. It is also not locking up completely as the mouse can still be used. It just appears the system is waiting before actually running the program.

The wife (who is less patient than me ) just keeps clicking the icon when something doesn't start instantly, and eventually ends up with a dozen instances of the same program running

 

Please contact WSA support so they can have a look at your logs and sort this out for you: http://www.webrootanywhere.com/support Awhile back I heard that there were issues with EMET and WSA.

Thanks,

TH

 

Interestingly enough, if there are no Monitoring lines occurring, chances are the first thing support will tell you to do is Shut Down WSA (Right-Click on the system tray icon) and see if the problem persists. I've seen serious slowdowns when there is monitoring at level 9 and sometimes at level 8, but when there is no monitoring going on, normally it won't slow down.

If it does persist when WSA is shut down, it's not WSA doing it. If it stops, then they'll have you disable shields one at a time to figure out which shield is causing the slowdown. The ID shield is a possible one for example.

 

The wife's laptop doesn't have EMET, SRP, max UAC etc. it's a very standard setup and she is still experiencing the slowdown. In fact last night I started the Toshiba Service Station program and nothing at all happened. I waited some minutes and assumed it just wasn't working and opened another program to test. At least 5 minutes later the Service Station program suddenly appeared!

 

I've tried disabling the behaviour shield and various other settings with no success. Trouble is unless I install more software I'm running out of new programs to test! This slowdown only occurs the first time something is run. After that the same program starts normally.

 

If you trust the application, you could try disabling the Realtime Shield, installing the program, and then running a scan with WSA, then re-enabling the shield. That will prevent any slowdown during execution.

 

Thanks for your interest and the suggestion, but the slowdown occurs when EXISTING programs are run for the first time. Even items from the Windows Control Panel or programs like Regedit.exe take an age to open.

I've tried disabling shields one at a time and changed the options for CPU and resource usage within WRSA, all to no effect. This exact behaviour is occurring on two different computers, the only thing they share is the internet connection via a router and even then, one is a wired connection and the other wireless. Both computers were previously running Prevx, but it was removed before WRSA installation. I'm struggling to find any other similarities.

I read on the Webroot Forum that the update to 8.0.1.143 was expected to help another user who was having slowdown and lock up problems. I've just been upgraded this morning so I will see if that helps. Now I just have to find something I can run which I haven't already used. I will probably have to re-install WRSA and start again - which may well fix the problem anyway

 

WSA really slow down my Computer if i have the computer a lots of time ON , when shutting down and ON the computer is fast but by when i do a lots of Internet Activity like surf , watch videos etc start to use more and more CPU Usage(not WSA Process but the computer but i think this is a WSA issue since started to happen when i started to use it formatted a lots of time and install WSA same issue) , when i want to play my games i have to shut down the computer and ON the computer , i started to think it was my Processor but when i changed WSA to NAV that problem don`t exist anymore can Webroot plz fix this problem??

 

I'm sorry to report the new version of WSA has made no difference. For example, I tried double clicking a picture, thereby invoking the built-in Windows Photo Viewer, and it took around 8 seconds to open. I could see the "authenticating files" splash screen so obviously WSA didn't trust it. However now it has been used once, Photo Viewer opens pictures instantly.

Maybe something went haywire in the initial learning scan, but it seems too co-incidental to have occurred on two different machines? I'm reluctant to re-install as this might mean I have to open every program on my PC again in order to get them "recognised". I will send a scan log to support and see what they say.

 

The tricky thing is that most people do not have this slowdown at all. So while it might be related to WSA in a way, it also has to be related to your unique computer setup and thus an odd interaction. It's a matter of figuring out what's interacting. :\

 

Yes I know, but because it is happening on two entirely different computers, running different hardware and software, I wanted some feedback to see if others were experiencing slowdowns, and if so - how much of a slowdown to expect. As no-one else has responded with a similar situation I have to assume that this is confined to just the two computers under this roof. I must be the unluckiest WSA owner alive

 

If WSA is new on your computer it may be that WSA is getting to know your system and scanning things as they open. After a while that seemed to go away for me. Still if I open a folder full of family pictures it can take up to 10 seconds to open as WSA scans the contents. Hope this helps...

 

I have noticed this happening recently (with 8.0.1.143) over the past couple of days.

It`s not all programs, just some and occasionally....but I`ve never seen it happen before.

 

Thanks for the replies.

I'm sure this is the case as subsequent access to the program is always instant. WSA is behaving the same as Prevx and scanning unknown executables (though I still contend Windows components shouldn't be unknown), however when Prevx did this it happened MUCH quicker, any delay was usually measured in seconds and not minutes.

I really want to love this program and recommend it to other family members, but if this is expected behaviour then I cannot. Maybe a dialog box explaining why program access has been delayed may help inexperienced users understand what is happening. However, I still find it difficult to believe the behaviour I'm seeing is normal. I will continue to try and find an answer

 

It is not normal. In fact, even "seconds" isn't normal. Definitely doesn't happen here.

When a main scan occurs, the item is determined as Good, Bad, or Unknown. If it is Good, then it should/will not normally be scanned on start other than to hash it and verify that it has not changed. This is a process duration along the lines of milliseconds.

What I was getting at when I suggested "Unique to your computers" is that you should look to see what specifically is different about your computers. Something has to be the same between the two, but different from other peoples' computers. If you save the logs (Not just going to the directory and loading them) and there are no lines indicating "Monitoring", then it shouldn't even be slowing down once.

 

Do you have anything other than your listed programs installed in realtime?

 

No other realtime programs of any kind on my main desktop PC, except Intel Rapid Storage Technology (non-RAID). I like to keep a lean, mean machine. The wife's laptop is standard out of the box with a number of Toshiba apps, but no other realtime security.

I don't use SRP, EMET, max UAC etc. on the laptop, but as a troubleshooting exercise I still tried running the desktop without the additional system hardening. I have also tried removing both machines from Windows Homegroup as well as un-installing/re-installing WSA on both of them.

The only similarity I can think of between the two machines, apart from accessing the same router, is they both run separate admin and user accounts.

If I can make a comparison with Prevx, when Prevx scanned unknown executables they were scanned quickly one after another. WSA seems to slowly scan each executable with a significant delay between the appearance of each file scan splash screen. Regular scheduled scans complete in around 50 seconds, it is the on-the-fly scans that appear to be running slowly.

Hope this helps!

 

In case anyone is interested, I'm still jumping through the standard hoops placed before me by Webroot Support ie. collect and send logs, run Windows Disk Checker, uninstall/re-install etc. Things I've already done but I do them again just in case.

With all the re-installs I've done I may be identifying a pattern. So far the first few programs I run after a re-install open with little delay, but the more programs I try to test, the slower things seem to become. In addition, some programs which previously took a long time to open, open quickly immediately after a re-install, but conversly some programs which opened quickly before, will take longer. An example I just experienced involved Windows Wordpad. In previous installs it opened fine, but in the current install the first time I tried to open it took nearly 30 seconds

I don't feel I am really getting anywhere with Support as they just seem to be reading off a standard troubleshooting list. I do credit them for being quick with their replies though. Joe doesn't seem to be chiming in with any ideas either - and if he doesn't know what's happening then I don't think anyone will

 

You can ask them to do a Remote Session where they connect to your system and then they can run there diagnostics and see for themselves?

TH

 

A remote session might be the best approach here, but I could take a look at your scan logs if you PM me your email address. I don't have any other insight at the moment as we haven't seen this from any other user.

 

Thanks Joe. PM sent.

Regards

Jeff

 

Just thought I'd post an update on what is happening.

Joe suggested I disable the "Store Execution History Details" setting and it did reduce the time taken to open programs somewhat, but didn't eliminate the slowdowns completely.

I decided to run a full scan yesterday to see if that would force WSA into recognising all my installed programs. I then chose to save the scan log and WSA proceeded to scan Notepad.Exe twice before finally allowing the log file to open some 20 seconds later The more I try to figure out what is going on, the more confusing the behaviour seems to become. I must have accessed Notepad.Exe at least 20 times prior to this with no problem

I have decided for the time being to see if I can live with the issue, as in all other respects WSA runs fine. I would also like to say that Webroot Support were always prompt with their replies to my messages and have offered to try and sort things out over the phone. Due to the time difference and my work commitments I am unable to do so at the moment but may take them up on the offer later. Joe, I may also take you up on the offer of a remote session when I become available.

Thanks for listening!!

 

I know I said I would live with it for a while, but I just can't leave it alone! I think I've narrowed down the cause of my slowdowns. I discovered the problem occurs only after logging off one user and logging on as another.

I've also found an easier way to check for slowdowns - right click scanning of files. When turning on the computer and logging on for the first time, right-click scans occur instantly. However after logging off and logging on again as a new user, a right click scan is slow. There is a delay of 10 - 20 seconds before WSA starts scanning, after which the scan completes normally. The slowdown remains until another restart has occurred.

I've confirmed this behaviour on both the desktop and laptop. Can anyone else who runs multiple accounts in Windows 7 duplicate this?