afwserv high CPU load

Avast Free Antivirus / Premium Security
1

the CPU load ( > 50% ) happened while I was running an Opera widget
(Unite Media Player), again not the Unite Media Player service, but a
widget that can be run even when Opera is closed. >>>
http://widgets.opera.com/widget/15592/

dump and config files sent to Lukor

2

Hi Logos, would you mind configuring special memory heap options for afwserv.exe, as described in this thread?

http://forum.avast.com/index.php?topic=59441.msg505084#msg505084

3

okay I’ll give it a shot and report back

4

after typing : “pageheap /enable afwserv.exe”, I get this:

Warning: pageheap.exe is running inside WOW64. This scenario can be used to test x86 binaries (running inside WOW64) but not native (IA64) binaries.
5

Thats ok.

6

Is this related to a specific update? Anybody see this before May 24th?

I am running Windows Vista x64 with a Core2 Quad CPU and am finding afwServ.exe is taking up 25% of my CPU load. This is using all of 1 of my cores!

Anybody know if anybody at Avast is working on this?

Jeff

7

yeah I’ve had this once before, so it’s not just the current build. I posted another thread about it several weeks ago.

8

Hi, it seems to be somewhat hard to reproduce. With the pageheap setting it should reproduce sooner, but still it seems we have no dumps available yet.

9

Mine does not crash, so no dumps happen automatically. Is there a way for me to get a dump for you manually?

Jeff

10

Try this:
How to invoke memory dump creation?
http://support.avast.com/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=71

11

Hi, the utility I mentioned above (pageheap) might cause the process to crash sooner. In case the high CPU load is caused by infinite processing of some corrupted structure - we might get a crash instead, at the time the structure is going to be corrupted. Generating process dump in other times unfortunately would not help here.

12

Hi Logos,
would you mind sending (uploading) us the file “Unite Media Player.exe” from Users/…/AppData/Local/Unite Media Player. It is possible we have problems verifying the signature on that file, so it would be helpfull to have the exact same copy you have on your disk.

Thanks,
Lukas.

13

okay…sending it to you by mail.

14

Thanks, Logos, it indeed seems we have some problems on this file. I was able to reproduce it several times, we’ll now try to find the bug. Thanks. L.

15

you’re welcome

16

Hi Logos and others,

we have found a bug, related to this High CPU usage in afwServ (and potentionally also application crashes of the Firewall service). It was related to the code that was responsible for verifying signatures of the running process. This fix was already delivered to you with the latest VPS update (VPS 100531-0).

Thanks a lot for helping us finding this bug.

Since this problem may have been causing memory corruption problems inside afwServ.exe, it might also be responsible for crashes reported previously. I hope that this was the last bug there and that the crashes will not reappear - which would mean there is something more.

Those of you who helped us track the bug by enabled special heap with pageheap.exe tool - please consider disabling the special heap. With special heap enabled the process will certainly consume more memory than needed. You can disable special heap by the following command:

pageheap /disable afwserv.exe

Thanks.
Lukas.

17

thanks for your work Lukas :wink: