ashwebsv.exe keeps crashing out...

Avast Free Antivirus / Premium Security
1

Having to edit in a note:

I’m having trouble finding a way to copy all of the task manager processes. I though the included list was all of the Task Manager processes but it isn’t I need to get back to this post as soon as I’ve found a way to copy all of the processes without having to manually type them.

My system is newly built, Avast was the first AV installed. I have uninstalled it twice and have removed all traces of it but it keep crashing ashwebsv.exe. There is another Avast process that crashes…at least in the first installation… as well but since the latest install of Avast it hasn’t announced itself yet.

Thanks for any help

My system:

WinXP Home w/SP2
MSI P6N SLI-FI mobo (not using SLI)
P4 650 CPU (vcore set to 0.0500 >)
3GB Corsair XMS2 Twinx2 DDR2-667 high speed memory (2-512MB and 2-1GB modules)
2 - 160GB WD 7200RPM SATA 3Gb/s hdds in RAID 0
1 - EVGA 7800GT CO VGA card 256MB DDR3 memory
Corsair HX620W PSU (+3.3@24A,+5V@30A,+12V1@18A,+12V2@18A,+12V3@18A,- 12V@0.8A,+5VSB@3A)
1 - Lite-On DVD±RW LiteScribe drive
Standard floppy drive
1 - 130mm case fan, 3 pin connected to mobo
1 - 120mm case fan, molex connected to PSU and single yellow wire sensor lead connected to mobo.

System idle temps:

BIOS hardware monitor:

CPU = 35
System = 26

MSI in-Windows utility:

CPU = 23 - 24 average
System = 26 avarage

PSU BIOS volts:

vcore = 1.4v
3.3v. = 3.424v.
5v. = 4.961v.
12v. = 12.144
5vsb = 5.112

BIOS values:

CPU voltage = 0.0500>
Memory = 1.9

Northbridge = 1.25 (currently set to 1.4)
Southbridge = 1.50 (currently set to 1.6)
FSB VTT = 0%

My programs installed:

WindowsXP Home w/SP2 all the latest updates

Ulitities and protection:

CCleaner 1.38
Internet Download Manager 5.09
Ad-Aware 1.06
SpyBot Search & Destroy 1.4
Spyware Blaster 3.5.1
WinPatrol 9.7.4.0
ZoneAlarm Firewall 7.0.302.000

Browsers and Mail:

Mozilla Firefox 2.0.0.3
Mozilla Thunderbird version 2 beta 2

There are other programs installed but aren’t active like these programs are and thus should not cause the ashwebsv.exe crash.

2

What happens when it crashes, are there any errors displayed ?
If post the full error message or post a screenshot.

Are there any windows even viewer entries associated with this ?
Look in the Application, System and Antivirus sections, if so can you copy and paste the text.

Often it is the faulting module that is the problem rather than the application.

3

I’m currently investigating a System error about the DCOM but the Help tool is telling me to go to a file in the Regedit, an HKCR/clsid…file but I’m not able to locate it because the Un-Help tool isn’t telling me where its at. It just says to go to it.

4

Do you have any Idea what this is asking of me? I understand part of it but it asks me to locate a file with a “Friendly name”. I have no clue what it is asking.

Details
Product: Windows Operating System
ID: 10016
Source: DCOM
Version: 5.2
Symbolic Name: EVENT_COM_ACCESS_DENIED_IN_SERVER_ACTIVATION_OR_LAUNCH_PERMISSION
Message: The %1 permission settings do not grant %2 %3 permission for the COM Server application with CLSID %4 to the user %5%6 SID (%7). This security permission can be modified using the Component Services administrative tool.

%1 = machine-default, application-specific; %2 = local, remote; %3 = launch, activation; %4 = ; %5 = /; %6 = .

Explanation
A program, the Clsid displayed in the message, tried to start the DCOM server by using the DCOM infrastructure. Based on the security ID (SID), this user does not have the necessary permissions to start the DCOM server.

User Action
Verify that the user has the appropriate permissions to start the DCOM server.

To assign permissions

Using Regedit, navigate to the following registry value
HKCR\Clsid\clsid value\localserver32
The clsid value is the information displayed in the message.
In the right pane, double-click Default. The Edit String dialog box is displayed. Leave this dialog box open.
Click Start, and then click Control Panel.
Double-click Administrative Tools, and then double-click Component Services.
In the Component Services snap-in, expand Computers, expand My Computer, and double-click DCOM Config.
In the right pane, locate the program by using its friendly name.
Right-click the program name, and then select Properties.
On the Security tab, in the Launch and Activation Permissions group box, select Customize, and then click Edit.
Add the user to the permissions list, and give the user the appropriate permissions.

This is the part that has me stumpped:

“In the right pane, locate the program by using its friendly name.
Right-click the program name, and then select Properties.”

5

I didn’t see anything in Anyivirus in the event viewer. I saw a bucket-load of DCOM errors in the System part of the event viewer.

6

You have to look for errors that are about ashWebSv.exe at or about the time when the crash happens, they are most likely to be in the System or Application section.

Again what happens when it crashes, freeze, can’t browse, etc. ?

I’m sorry I have no idea what the DCOM error is about and I’m not sure it is related as there doesn’t seem to be a dependency on DCOM in the avast! Web Scanner service. It is only dependent on avast! Antivirus, which in turn isn’t dependent on DCOM either.

All I can suggest on the DCOM is googling any unique element in the error message, such as http://www.google.com/search?q=EVENT_COM_ACCESS_DENIED_IN_SERVER_ACTIVATION_OR_LAUNCH_PERMISSION

7

Nothing happens. A “Crash” message box…the one that simply says the particular program needs to close…appears on the screen and asks do I want to send this error to somewhere I can’t remember. I click yes, it checks off three things then closes.

The system doesn’t run any differently, no slowing down or anything.

8

The only thing I need to do is understand this…and thanks for your help, BTW:

“In the right pane, locate the program by using its friendly name.”

And I finally figured out how to copy the error event:

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10016
Date: 3/26/2007
Time: 6:55:49 PM
User: NT AUTHORITY\LOCAL SERVICE
Computer: MYFIRSTMSISYS
Description:
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID
{BC866CF2-5486-41F7-B46B-9AA49CF3EBB1}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19).

9

Sorry the ‘canned’ answer, but, sometimes, is useful to activate logging in WebShield:

  1. Edit \data\avast4.ini file
  2. Find the section [WebScanner]
  3. Add the line:
    EnableLogging=1
  4. Restart Web Shield in XP (terminate and start again) or whole PC in case of Win98
  5. Browse (trying to access some webpages)

The log file are \data\log\ashwebsv.log and ashwebsv.ws.
They would be accessible when WebShield is terminated again.
Post them here or send by mail to rypacek (at) asw.cz
After that, disable the logging to avoid a big log file.

10

I apologize for my ignorance but am I supposed to go somewhere in Windows looking for something?

I don’t understand this:

“1. Edit \data\avast4.ini file”

Am I supposed to locate this? If so, where would it be? It isn’t in “Programs files” under Alwil. There is a “DATA” there but inside of it there is no .ini files.

11

OK, I found Avast4.ini through the Windows search function. I couldn’t find it directly in the Avast program file. I added “Enablelogging=1” to the “Webscanner” entry. I shut down “Webscanner” by stopping “On-access protection” in the icon at the notification area and then restarted "On-access protection.

12

What do I do next?

13

What do I do next?

14

What do I do next?

15

#5 in tech’s post…browse. The log file will not be available until webshield is terminated.

16

here is a fault:

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 3/27/2007
Time: 12:21:04 AM
User: N/A
Computer: MYFIRSTMSISYS
Description:
Faulting application ashWebSv.exe, version 4.7.936.0, faulting module ntdll.dll, version 5.1.2600.2180, fault address 0x00018fea.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 61 73 68 ure ash
0018: 57 65 62 53 76 2e 65 78 WebSv.ex
0020: 65 20 34 2e 37 2e 39 33 e 4.7.93
0028: 36 2e 30 20 69 6e 20 6e 6.0 in n
0030: 74 64 6c 6c 2e 64 6c 6c tdll.dll
0038: 20 35 2e 31 2e 32 36 30 5.1.260
0040: 30 2e 32 31 38 30 20 61 0.2180 a
0048: 74 20 6f 66 66 73 65 74 t offset
0050: 20 30 30 30 31 38 66 65 00018fe
0058: 61 a

Now, if you require I be a rocket scientist, you require too much. I’m an ordinary person trying to resolve an issue so that I may be able to once again browse the web on my PC.

You know…stuff like…important business, financial etc.

17

MartyLK, I’m not sure, but maybe you should generate a dump file…
To create the dump, download and run http://public.avast.com/~vlk/hangrep.exe . In the list of processes select ashWebSv.exe and use the Save button. This generates a file which you can either send to his email address vlk (at) avast.com (if it’s smaller than e.g. 1 MB, ZIPed), or upload to ftp://ftp.avast.com/incoming

The command-line version http://public.avast.com/~vlk/userdump.exe . The syntax is
userdump.exe ashWebSv.exe c:\ashWebSv.dmp
(producing dump file in the root of C:\ drive)

Also, check the folder \data\log
Are there any files called unpXXXX there (where XXXX is a random number)?
If so, send them to vlk (at) avast.com
They may contain more information about the problem (maybe a link to this thread).

18

MartyLK,
You said ashwebsv.exe is crashing. You should see a dialog similar to the one I attach. Please click on the circled places and send me the files from the dialog marked with number 3. If the files are too big to be attached into an email message, please upload them zipped to our FTP server and send me an email under which name I can find them there.

For details on uploading to the avast FTP, please see here:

http://support.avast.com/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=18

http://public.avast.com/~rypacek/support/crashdump_save.png

Please note: I do NOT require you to be a rocket scientist.

You know...stuff like...important business, financial etc.

Also note that avast! Home is for personal non commercial, non business use only.

PS: click on my name for the email address.