One of the major features of asp.net is the fact that it is a compiled environment - with all code running inside the CLR (common language runtime) engine. 

Whenever you run an asp.net site - internally there are a large number of compiled components all integrated into the same system that need to be accessed and executed by the system.  Each of these components are either stored in a pre packaged dll files located in the sites bin folder - OR they are compiled at runtime and stored in the asp.net application's local compile cache.

The problem with AVG is however, that it sits and intercepts each and every attempt to access these compiled 'executables'  and because it does not recognize these files signatures - it starts running an heuristic analysis of each file attempting to GUESS whether this file contains a virus or not.
And while AVG is doing this analysis it effectively blocks asp.net from completing its executing of each file.

This does not happen with DRUPAL to the same extent because it runs using php which does not run using compiled code but instead all its code is interpreted lne by line each time a page is requested.  AVG does not see these php script files the same way - it does not see them as an executable that it thinks could contain a virus and hence needs to be checked - it seem them just as text file. 

But it ironically does still have some inpact - and is the main reason for NOT having AVG on any server - it also causes the same sort of problems for a wide variety of other sytems like hight end video and image servers and video editing systems - all of which access lots of files that AVG thinks may contain viruses and hence thru is bad design slows those system to a crawl.

Most other virus systems work in such a way as to not impact on  performance as badly as avg.

Westa