1195 should resolve the issue.
Thanks for that suggestion. I’ll be happy to update to 4.8.1195 if it has now been officially released. That can just be updated via the interface in the installed version as long as the self-defense is turned off?
Did anyone else have an issue about not being able to run scans as a local user under XP Pro SP2? I was just surprised to not see it mentioned anywhere, and there apparently was some difference of opinion even in this thread about whether administrator privileges were required or not. So even if the new build resolves the issues, for learning purposes. I’d still be curious to know what caused the issue with Ashavast stalling.
Thanks again!
You don’t need to turn anything off (self-defense) to perform the program update.
Just click Updating → Program Update and you should be all set.
Thanks
Vlk
Ok, great. Thanks Vik. That sounds like it should be painless enough!
By chance, do you happen to have any further insight about the privilege issue? Will someone still look over the dmp file to let us know if it might be caused by an unforseen conflict with something else…(fingers crossed)?
I just updated to build 4.8.1195, however the problem has persisted.
Scans still cannot be run as a local user under XP Pro SP2.
So could the technicians kindly look over the dump file previously provided (blue2_Ashavast.exe.dmp) so we can determine what is causing the Ashavast.exe process to stall when the desktop icon is clicked as a local user, maxing out the CPU at 100% when it does.
Thank you!
Unfortunately, the dump is of no use as the processing is taking place in kernel mode (which is not included in the dump).
The only way to properly analyze the problem is to create a full dump of the system when the problem is simulated.
The procedure is described here: http://support.avast.com/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=71
BTW one thing to check: when you right click the shortcut (the icon) that you use to launch avast, select Properties and go to the Compatibility page, isn’t the “Run this program in compatibility mode” box checked?.
Thanks
Vlk
Ok, thanks for that quick reply, Vik. Once I have access to the machine this afternoon I’ll check if compatibility mode is enabled.
But I’m tempted to remove it completely, along with the skins that were installed, and then just reinstall the new build alone (no skins, and not updating the build). Perhaps that will be a quicker way to resolve the privilege issue.
Would you suggest Add/Remove, then using the aswclear.exe utility to be sure it’s been fully removed?
Thanks again.
It won’t hurt. 
No luck.
I uninstalled Avast. Rebooted. Then ran the aswclear.exe utility. Rebooted. Used CCCleaner to remove any registry references to Avast. Then regedit to manually search the registry to be sure no remnants were left. Then re-installed the new build without any skins. And the issue persists.
As administrator everything works as it should. But as a local user, only the context scan and the system tray functions work. The desktop or start menu shortcut to Avast (ashavast.exe) will not open, freezes the CPU at 99%, and because the process can’t be killed, the only solution is a reboot. (Not very practical.)
Before the reboot occurs, there is an indication that Active Skin Helper cannot shut down. Perhaps this is a natural outcome of the stalled process.
When I check the security settings of the actual Avast.exe file, it indicates Read as well as Read and Execute for ALL USERS.
When I check the Properties / Compatibility of Avast.exe, the “Run this program in compatibility mode” box is NOT checked. Were you suggesting that it should be as the program is running on XP Pro SP2, and not a previous OS.
If I use the “Run As” administrator command on the local user desktop icon, it will open perfectly. So it surely seems to me that this is a privilege related issue.
Are there any known conflicts that would cause such an issue, and don’t the Avast techs have any idea of what to look at as there are NO system anomalies aside from this local user issue after installing Avast?
Any further word on this?
In addition to the questions in my previous post, does ashavast.exe invoke certain DLLS that require escalated privileges to run? Since I installed Avast on a friend’s machine and have everything pretty well locked down, perhaps it invokes something that is prevented from running.
Since it happens when no other application is running, does not happen with the Avast system tray functions, does not happen with the Avast context menu functions, does not happen on an administrator account, and ONLY happens on a local user account, I would think that pretty well limits where the issue might be coming from. What Ashavast functions could require escalated privileges to run?
I’d just hesitate installing this on any other friends’ systems, if I can’t get any closer to understanding this after several days of removal, system cleaning, and re-installation with an updated build have apparently done nothing. Thanks.
Well, as I said in Reply #25, the only “scientific” method to understand what’s going on would be to have a full dump.
Do you think you could try getting us one?
Thanks
Vlk
Yes, I did read over that procedure, but since it involved modifying someone else’s registry and then intentionally blue-screening their machine, I wanted to do a little digging first before going that route. (Am I correct in assuming that this key could be added and then removed without ill effect?)
I’ve gone through quite a number of steps already (removal, system cleaning, installation of new build, checking event viewer, checking Avast FAQs, providing a dump of the stalled process, etc.) as they’ve been suggested, and they lead no closer to figuring about what might be happening. I initially was told that Ashavast requires admin privileges to run, and that was later corrected. So I’d still like to have some idea about:
-
What does the Ashavast executable require to run?
-
When the process is stalled, I have to kill Active Skin Helper to shut down. Is this an outcome of the stalled process or the problem?
-
When I check the security settings of the actual Avast.exe file, it indicates Read as well as Read and Execute for ALL USERS. Is that correct and is there any other file whose privileges I should be checking?
-
Why would running functions as a local user via the System Tray work but the same functions not work via Ashavast.exe? Logic says it’s not the function causing the issue, but something else.
-
Are there any known conflicts with other applications?
Any answers your technical team would have would be appreciated. I have the sneaking suspicion that even when a full system dump is created, there won’t be a definitive answer…
Since I am a user of WinXP Pro as well I thought I would see if I can reproduce the problem too.
I created a limited user account. I logged on as that limited user account.
I created a shortcut for ashAvast.exe on the desktop.
I start avast from the shorcut on the desktop, avast starts immediately, completes a memory scan and the simple user interface opens, I can run scans, change the avast skin etc. I can also perform all those tasks by right clicking the systray icon and starting avast from the menu.
When I logoff it shuts down the limited user session normally.
Is there some condition I have missed?
No, Alanrf, I don’t think you’ve missed anything, and thanks for trying this.
I installed this on a friend’s machine, so I don’t have continual access. As administrator, I can run everything in Avast without problem (both the previous build and the current release). As a limited user, I can run everything from the system tray EXCEPT “Start Avast! Antivirus”. That simply starts the process Ashavast.exe, which remains constant at 100% CPU. When I try, I cannot terminate the process. So I have no choice but reboot.
When I click on the Avast desktop icon as a limited user (The program installs it by default as a desktop icon for all users which lead me to believe that limited users should have privileges to run it.), it opens the Ashavst.exe process which stalls exactly as when run from the system tray.
If I use “Run as” administrator while on the limited user account, it runs perfectly. So this suggests to me that it is “simply” a permission issue of some kind, NOT a functional issue. It will run but only if it has admin privileges.
I understand that you are away from the system but can you recall if you have avast set to perform the memory scan on starting avast or have you turned that off?
In other words is it the memory scan that appears to stall or the opening of the avast simple user interface?
My reason for asking is that I did (some time back) encounter a condition where the memory scan would complete and the opening of the simple user interface would stall.
Good thought. I had initially set it with memory scan on startup, but tried it with memory scan turned off as well. It made no difference. When I click the desktop icon, it simply doesn’t open. It just starts the Ashavast.exe process which is clearly stalled.
If I then try to terminate that process in task manager, I then get a “Unable to Terminate Process. Access is Denied” message. I find that odd, since if I started the process as a limited user and it did not run, why would I be denied access to terminate it? That again leads me to think this is a privilege related issue of some kind.
It’s running under XP Pro SP2, with Kerio 2.15 firewall, Spybot Search & Destroy (NO Resident Teatimer enabled), and Spyware Blaster. There aren’t a lot of startup process running aside from various Thinkpad related ones and Acronis True Image.
The process termination “access denied” is almost certainly coming from the new self-protection feature of avast 4.8.
About the only difference in configuration between me and the problem system is that I just run with the Windows XP firewall.
One oddity I notice in the skins management makes suggest that next time you have access to this system it might be worth un-checking “Enable skins for Simple User Interface” in the avast Program Settings before logging on the limited user and seeing if that makes any difference.
Well, blue2 previously sent me a dump of the stuck ashAvast.exe process, and it was clear that it was dumped during a normal request to read a registry value. I reckon it must be blocked (or, ‘spinned’, as CPU usage is high) from the other side of the mirror, i.e. from the kernel mode. That’s why I said I’d need a full dump to analyse the problem.
One more thing you could try: in Task Manager, Performance page, open the View menu and check “Show kernel times”. This will add a new red line to the chart, indicating the CPU time spent in the kernel mode. If you then simulate the problem, does the red line also go to 100%? (proving that the “fun” is taking place in kernel mode, instead of the ashServ.exe process itself).
Thanks
Vlk
I’ve been able to access the system again. As one of the first tests I did, I un-checked “Enable skins for Simple User Interface”, as well as the memory startup test, the Explorer skin setting, etc. It made no difference.
While Ashavast.exe seems to keep CPU at 100% (a straight green line), the Kernel process (red line) is high, but not at 100%:
As there are a good 5 or 6 threads on the top page of this forum from people reporting issues with the latest Avast build causing 100% CPU usage, is it possible that this new build is not as stable as reported, at least for some users? I realize that these may all be different issues, but I’ve rarely encountered stalled AV processes before (usually activation, conflicts or slow scanning issues, all of which Avast seems to do well).
I personally use a different AV and have experience with several others. Is it possible that the self defense module or the completeness of the product (e.g. rootkit scanning) is creating unreliability on some systems?
I will try to get access to the machine again tonight and create a complete dump. But I hope that after doing so, some answers and a solution will result, as I’ve invested more time on this than on any other installation.