I have for the last three years been a supporter of Avast. I have recommended several friends, colleagues and even a few of my customers to use the pro version. Unfortunately I am now having big problems on my own system. ashserve.exe is more often than not running at 100% CPU usage.
I am running Win 2k sp4 fully patched on a Dell Optiplex PII 650 with 512 Mb RAM and have recently noticed a big drop in speed. My natural reaction was to assume Virus or Spyware issues however I have now scanned through all my files with Ad-Aware, MS Anti- Spyware, Spybot SD and Spyware doctor and I am confident I am clean. When I look in Task Manager I find the culprit appears to be Avast!. Ashserv.exe is mainly running at 100% and causing me big problems.
Is this normal?
I am aware my system is not the worlds fastest however this CPU load seems abnormally heavy and has not been a problem until recently.
If ashServ.exe is using a lot of CPU, it must be scanning something. Open the on-access protection window (click on the avast! tray icon), select the Standard Shield provider and check the “Last scanned” item (when ashServ.exe is using the CPU, I mean). What does it show?
Some application is obviously heavily writing into the log file. avast!, having the sensitivity set to High (i.e. all created/modified files are scanned), has to rescan the file on every write - which make take a lot of time if the log file is big.
The solution (appart from limiting the logging somehow) would be to put the log file into the list of Standard Shield exclusions (so that it won’t be scanned anymore).
Jeruvy, you didn’t really supply much useful information.
If ashServ.exe is using the CPU, it means that it’s scanning something. So, first you need to find out what is being scanned. You can do that, for example, by opening the On-access protection window (click on the avast! tray icon), select the particular resident providers (Standard Shield is the most likely guess) and watch the “Last scanned” item at the moment of the high CPU usage. You should be able to say what avast! is scanning.
Or, you can turn on the option “Show detailed info on performed action” in the resident providers.
Well that is the facts as I’ve seen them. I have not spent any further time troubleshooting this, nor do I plan to.
WHY after killing serv, does websrv kick in to 100%? your going to tell me that it was scanning a file on my system, and then once dead turned over to another exe to continue? Someone should explain this behaviour to me so I can understand it better.
As for watching what file it’s scanning, I beleive I stated clearly above that I watched it scan several files, yet still cause saturation of cpu cycles.
The FACT that this has all happened recently and on two production AND a test box indicates your program no longer likes my builds. If that is a fact, then I will delete AVAST and move to Trend-Micro as they offer the best value for the number of boxes I have.
I was concerned over the number of updates I was receiving and unless someone can offer a better conclusion, my determination of the problem is the updates have destabilized on my systems. This is not a ONE PC deal, it is affecting ALL machines I install it on.
If you’d like better information then empower me to provide it. A debug version or some such tool may be of assistance, or you could improve your statement by clearly defining what information you seek.
I have no idea. Killing ashServ.exe, however, is certainly not a correct method, so I don’t really find it relevant. If you stopped Standard Shield provider from the user interface, for example (which should reduce the CPU usage, I guess) and ashWebSv.exe starts eating CPU - then it would be something worth investigating.
If you saw scanning setup.ovr, it means that an update (check) was started - but I don’t believe this was a continuous process.
Recently, we’ve seen some programs performing heavy writing to their log files (one of them was some HP software I believe) - which causes Standard Shield to take a lot of CPU (when rescanning the log). Such a behavior, however, should be clearly visible in the “Last scanned” item.
Actually, it doesn’t necessarily have to be the Standard Shield provider… maybe it could be some other as well. The only way to find out is turning them off temporarily to see if it helps.
As for watching what file it's scanning, I beleive I stated clearly above that I watched it scan several files, yet still ...
Yes, but what are the names or extensions of some of those files? This info could be an excellent clue in what is causing the problem. These kinds of problems require more specfic info than the general info you have given so far. :
No one here can help solve the problem if you are not willing to have it solved. ???
The problem occurred on my PC also. I investigated the problem and it appeared as if ashServ.exe was periodically taking high percentages of CPU.
Then I started Process Explorer (http://www.sysinternals.com/Utilities/ProcessExplorer.html). It has two special processes it shows, one of which is hardware interrupts. And much to my surprise, it was not ashServ.exe that was the culprit: it was hardware interrupts!! I killed the ashxxx processes and the hardware interrupt bursts stopped.
Just to complete this: ashServ was not scanning any file when this occurred.
There is definitely something wrong with the last update. ???
Is the on-access scanner (or Standard Shield provider) sensitivity set to Normal or High. I recommend AGAINST setting it to High unless there’s a specific reason for it, and you know what you are doing…
So, again, the “Interrupts” process is showing high CPU usage, unless you kill ashServ.exe?
Is this reproducible? (I mean, does it happen all the time?)
