I have this problem, which has been nagging me for a while now (at least a year of upgrades, so it isn’t something recently added). Currently I’m running Avast 4.8 Home Edition, build Jul2008 (4.8.1229), with VPS 081109-0. It’s running on an HP laptop, with WinXP SP3. I am using the old and trusty Sygate Personal Firewall 5.6 (but disabling it doesn’t change the situation).
After a random time that I’m running the computer, suddenly tabs in firefox will stop working (as will IE), and the only apparent culprit is ashwebsv.exe using 50% (dual core CPU) of my cpu.
It isn’t possible to terminate it from the On Access Center, and trying to kill the process from the windows Task Manager results in an “access is denied” message. Stopping the mail service from services.msc results in it telling me there was a problem, and after trying that the service is stuck in the “stopping” state. (but still uses same amount of cpu).
I’ve checked other threads about it, but couldn’t find anything exactly the same… There are no dump files in the avast log directory and no special messages in the logs that I can see.
Using Process Explorer, I’ve looked at the process while it is stuck, before and after trying to kill it, and it stays the same. The most interesting thing to look at is the thread section, where it shows about 20 “!endthread+0x.3e” threads (which aren’t using cpu), and 1 thread called “!CryptVerifySignatureW+0x17” using all the cpu of the process…
Could somebody help me understand what’s going on and finding a fix for it? Also - I saw a mention somewhere of maybe running the ashwebsv under another using than SYSTEM, so killing it will be an option instead of rebooting the computer… Any help with that?
Can you please post the list of DLLs loaded into the process?
(i.e. the contents of Process Explorer’s lower pane when ashWebSv.exe is highlighted in the upper pane, and the lower pane is configured to show DLLs [View → Lower Pane View → DLLs]).
The process related to web shield is using all CPU…even if the network cable is not connected. It affects web browsers, and the user cannot kill the process until you do a “Program Setup\Troubleshoot\Stop self defense”
I’m having this problem on a Compaq Presario (old machine) that I’ve recently installed with XP pro SP3 and avast home edition.
I’ve used Avast for looong time now, without problem and with no infections!!!
I usually run iSafer Firewall, and they are running fine on a more recent machine I’m writting from.
The web shield process is using lot of CPU and blocks IE or Firefox browsing.
I’m using 4.8.1229 on both machines. One got the problem, the other does not. Both are SP3
Let me know if there’s anything else you need.
PS: If a forum mod. can link the posts all together … that would be great.
PS2: If users can do search before posting… that would avoid topics to be repeated
PS3: THANKS FOR AVAST PRODUCT!
As far as I can tell those other threads aren’t exactly the same.
Yes, they all have high cpu use of the webshield, but having searched before I started this thread,
I couldn’t find anyone having problems with the Web Shield entering the “stopping” state and getting
stuck there…
Vlk - do you have any idea what this “CryptVerifySignature” thread is doing?
Yep, fair enough. Other topics were not realted to the fact the service remains in stopping step.
My opinion is you’ve been a step forward than other topics with the ashwebsv.exe process. However, the original problem look to be the same… this ashwebsv.exe runs with a large amount of CPU…for nothing. It did not do before, but now it does. And it affects web browser (and boviously systems).
What’s your current problem now and what do you what to achieve?
On my side, i agree to say that if you have a firewall, you do not specialy need this Avast antivirus part.
You’re right to say that SYSTEM user is the one mentionned at the process level. To kill it with another user, without having to restart in safe mode, you need to stop self defense first.
My plan is to build a machine for someone who needs it, and without enough knowledge to do such action everytime the process goes mad. That’s why I would like to understand or at least help the Avast team to fix it.
Hope you wil find in these few lines, comments and explanations, that make you sure I do not want to put your post down for any reason.
Let me know Kalimero if there’s anything else I can do to help you in your situation.
Cheers
Hi, the stack does not make any sense, so most probably the “CryptVerifySignature” is not doing anything - Process Explorer must have guessed it wrong.
Ok, so what can we do from here? Should I post a dump of the process? Or use some other program
to look at the process when it starts to get mad?
milouzer, I don’t think a firewall does what the Web Scanner can do… If you try to download a virus
for example the Web Scanner will stop the connection, while the firewall will usually let you download
the file since it doesn’t (normally) compare it to virus definitions… Right now I’m hoping we find what
goes wrong inside the process and maybe even find a fix for it… Otherwise I’ll just live with it for now…