ashserv.exe

General Topics
1

Is anyone experiencing this…ashserv trying to access the internet?

For the last 2 days it’s been popping up steady. I haven’t updated the program recently (version in signsture is wrong), none of the other avast components have ben flagged by the firewall as new/changed.

from the firewall log

"Application has changed since the last time you opened it, process id: 4294939799
Filename: C:\Program Files\Alwil Software\Avast4\ASHSERV.EXE
The change was denied by user

---- Modules changed: 1 ----
C:\Program Files\Alwil Software\Avast4\ASHSERV.EXE
---- New modules: 0 ----
"
It is trying to contact an avast server 74.54.60.242 Any reason?

I checked the file at virustotal, only one, Ikarus didn’t like it. I think we went through this before and ikarus was the only one that found anything. Well. it would seem they’ve changed their mind in the last 4 hours. No detection now.

File size: 132472 bytes
MD5: 47df7f40f77fce0a134021c6bf0ff52a
SHA1: 4fb40f2dfaecfcf1078f099098ac97971e02bc08

2

C:\Program Files\Alwil Software\Avast4\ashServ.exe (avast! antivirus service) doesn’t need rights to connect. Although, ashServ.exe sends ping packets to find out if the Internet connection is alive. You can turn this off by checking the “My computer is permanently connected to the Internet” box in the avast Program Settings > Update (Connections) page.

3

Hi Tech

Strange thing is, ashserv has always been blocked in the firewall and the always connected box has been and was checked.

That’s why I tested the file. Yesterday, it stopped asking. I removed it from the firewall, blocked it when it asked, unchecked then re-checked the connection box.

Like I mentioned, none of the other avast modules have been flagged as changed, so I don’t think a program update was the cause.

4

Are you using the beta version?
Which firewall do you have now? Sygate is quite old and have glitches as you may already know…

5

No, not beta.

4.7.1043.

Sygate might be old but works with no problems, for me. :wink: It let’s me know who’s coming and going.

6

Maybe you can created a dump. To create the dump, download and run http://public.avast.com/~vlk/hangrep.exe . In the list of processes select ashServ.exe and use the Save button. This generates a file which you can either send to his email address vlk (at) avast.com (if it’s smaller than e.g. 1 MB, ZIPed), or upload to ftp://ftp.avast.com/incoming

The command-line version http://public.avast.com/~vlk/userdump.exe . The syntax is
userdump.exe ashServ.exe c:\ashServ.dmp

Also, check the folder \data\log
Are there any files called unpXXXX there (where XXXX is a random number)?
If so, send them to vlk (at) avast.com
They may contain more information about the problem (maybe a link to this thread).

Vlk explains how to create a dump file here: http://forum.avast.com/index.php?topic=22636.msg187340#msg187340 and here: http://forum.avast.com/index.php?topic=23283.msg193594#msg193594 :wink: