ashWebSv.exe maxing out. 100 % cpu usage

Avast Free Antivirus / Premium Security
1

I know why it is doing this. The question is can I stop it.

Here is the deal.
WinXp pro
Using Veoh software for downloading.

I believe the VeohClient.exe software is similar to P2P software.
Any way Avast is scanning the download this taking place from the VeohClient.exe and since this is more less a continuous process, the AshwebSv.exe is running continuously.

The type of file being downloaded is a flv file. Is there any way that I can stop it scanning this type of file?

I know Avast is trying to protect me but I scan all downloads any before using .
I see in the Avast program setting there is a place for exeptions but it calls for a URL to be placed into the first part, the trouble is I do not know what the URL is because the VeohClient is a separate program running and does not provide this type of information.

Any help here?
I am attempting to enage the log capacity of Avast. If I get it working I will post it back here.

2

If the avast4.uni file is configurated as this:

OptIn=1
OptinProcess=VeohClient.exe

The WebShield won’t scan VeohClient actions…

Activate logging in WebShield:

  1. Edit \data\avast4.ini file
  2. Find the section [WebScanner]
  3. Add the line:
    EnableLogging=1
  4. Restart Web Shield in XP (terminate and start again) or whole PC in case of Win98
  5. Browse (trying to access some webpages)

The log file are \data\log\ashwebsv.log and ashwebsv.ws.
They would be accessible when WebShield is terminated again.
Post them here or send by mail to rypacek (at) asw.cz
After that, disable the logging to avoid a big log file.

3

Did you make a typing error in your reply.

[b]If the avast4.uni file is configurated as this:

OptIn=1
OptinProcess=VeohClient.exe[/b]

Did you mean to type avast4.ini instead of avast4.uni ? If correct any particural place that I should place the command in the file?

4

Yes… a typo. Sorry.

Yes, sorry for the less specific information. In the [WebScanner] section.
See http://forum.avast.com/index.php?topic=1647.msg15960#msg15960

5

Tech, what you’re saying is incorrect, the OPPOSITE is true!

What you suggested is to add veohclient.exe to the list of scanned processes… By default, only the well known browsers are scanned (“opt-in”) :wink:

Anyway, gondorrf, is the avast tray icon rotating while the ashWebSv CPU usage is high?

Thanks
Vlk

6

To Vlk’
You asked if the tray A icon is spinning at high cpu usage, yes it is spinning consistently while the download is taking place. I have verified the Avast usage throught the Task Manager (WinXp) that shows high cpu usage.
Currently I have no download taking place so the cpu usage is 2-3% when downloading 90-100% usage.

Second point if the advice about the Opt-in is wrong what is the correct advice?
What should it be then?

OptOut=1
OptinProcess=VeohClient.exe

Would it be the above??

One last point what did you mean by the following:
By default, only the well known browsers are scanned (“opt-in”) .

Does browser = Firefox, Internet Explorer??

7
Does browser = Firefox, Internet Explorer??

Basically, yes (+ a couple of others such as Opera).

Anyway, if the icon is spinning, you can easily find out WHICH file is being scanned, and by WHICH provider. Simply click the icon, select “Details” and investigate which provider’s “scanned count” value is increasing. Plus, the “last scanned” value tells you the file that’s currently being scanned.

Thanks
Vlk

8

Oh yeah… sorry again… what’s happening with me today…!
I’ll stop posting for a while and take a breath…
The correct will be into [WebScanner] section of avast4.ini file the line:
IgnoreProcess=VeohClient.exe

9

Hi, either the OptIn=1 then only specified processes are scanned, that means only those on the line
OptinProcess=

or, OptIn=0, then all processes are being scanned by WebShield but those that are excluded on the line
IgnoreProcess=

Under normal configuration VeohClient.exe’s connections are NOT scanned by WebShield.

10

Gondorff are you using the latest version (4.7.986)? We have made a few fixes in the webshield code dealing with AJAX POSTs requests in the latest version. I can see from the log, that AJAX is involved.

11

To lukor,

Your comments on
OptIn=0, then all processes are being scanned by WebShield but those that are excluded on the line
IgnoreProcess=

I have the following
[WebScanner]
IgnoreProcess=VeohClient.exe

So Avast should be ignoring Veohclient but does not seem to be doing this. Do I need to put the direct path to the item?
Such as C:\Program Files\Veoh Networks\Veoh\ veohclient.exe .

Your comments on
Under normal configuration VeohClient.exe’s connections are NOT scanned by WebShield.

So if they are not being scanned then what is being scanned continuously?

You asked if I am using the latest version (4.7.986) Yes, I am.

12

No. It’s the process name not the executable path.
CTRL+ATL+DEL will give you the name of the running process of that executable.

If you open the residents (providers) control, what is being scanned by WebShield precisely?

13

Sorry I have been busy doing other thing.
Yes using latest version. May 2007 4.7.1.001

You asked what is being scanned.
I am using a program from Veoh and I am downloading videos. What is being scanned is the individual pieces that make up the video.
The pieces are being placed into a temporary folder from which went the download is completed the pieces will be assembled into the full video.

An example would be
E:\Veoh\videotemp

Then inside the folder would be pieces of the video
Example:
video.avi.piece01
.
.
.
video.avi.piece400

I tried to add the item to the
Standard Shield
Custom
Customize
Advance
E:\Veoh**.avi.piece*

But this did not work. The Avast still continued to scan the pieces and eat up the cpu power.

Is there a way of shutting off the scan of this particular type file with the extension " *avi.piece01— *avi.piece# " ?

14

Maybe you should try E:\Veoh*.*
But take care what you’re downloading…

Can you send the samples to virus@avast.com and help to improve detection?
You can zip and password the files… Inform a link to this thread and the password used.
You can send the files to Chest and, from there, resend to Alwil for analysis.
Thanks.

15

Ok, I have seem to solve the problem.
Solution :

.piece

This eliminates the scanning of the individual pieces.

This has dropped the cpu usage down to about 30%, it is still scanning the completed AVI file but not the individual pieces.

I very much like to send a sample however it will not allow me to copy any of the files while the program is running and once it completes a video it deletes the files completely. I will try to send a piece file next time I close the program and shut down but for right know I have downloads occurring.

As being careful about downloads I scan all downloads before I use them.

16

Can’t you ‘copy’ the pieces and ‘paste’ them into another folder and, from there, zip and send the file for analysis?

If the program allows to configure an ‘antivirus’ option to scan after the download is finished, use:
C:\Program Files\Alwil Software\Avast4\ashQuick.exe