Help needed urgently with ashserv.exe

Hi guys!

Have been trialling Pro 4.6.691 and very happy with it too, till a week or ten days back, when my system started hanging, for no apparent reason.

Did a check and found that after the virus updates within the last ten days, ashserv.exe has started hogging 90% plus CPU cycles most of the time. The memory consumed starts from around 16.5 MB and slowly builds upto 19.5 MB.

I initially suspected a virus/trojan, ran checks, but found nothing. Ran browser checks, start up checks, everthing I could think of. Installed and ran the latest version of Kaspersky and NAV to rule out the possibiility of something escaping through, but came out all clean.

I found that if I uninstall Avast, reinstall, but dont update the databases, the system returns to normal, with enough processing power available. Once I update, consumption shoots upto 90% plus.

I even tried updating to beta mentioned here 726, but this issue remains the same.

Has anyone faced anything similar? Any advice or help would be welcome…I really like the interface and wouldnt want to shift to another AV.

Details of my system as follows:

Win 2k Pro, fully updated and patched, 512 MB Ram, 80 GB HDD.

Perimeter defences:

Lavasoft Pro
Spyware blaster
MS Antispyware
Tauscan
TDS
Avast Pro 691
Tiny Personal Firewall 6.5.126.

Browser : Opera 9.0 preview

Thanks in advance.

Did you schedule any on-demmand scanning?
Will this help? http://forum.avast.com/index.php?topic=17332.0;topicseen

I suppose not at the same time…
Uninstall should be complete, Registry keys and files left behind, or you’ll be in trouble.

Tech,

Thanks for the response.

a) I do not have ANY scheduled scans active. The scan settings are on high, and customised in the advance interface, but that has not caused any problems till the latest virus db updates. As I mentioned, if I do not update, then with the same settings in Avast, everything is hunky dory. The moment I update, ashServ starts gobbling up CPU cycles like a hungry monster on the loose.

b) I didnt install NAV or Kaspersky at the same time. I do know a lil about the registry. Apart from my own software which monitors each and every key in the registry and enables a complete rollover whenever required, I manually clean out all entries from a previous install, since I like tinkering around. Avast anyway will not function if it detects the presence of any other AV in the registry…correct me if I am wrong here.

c) After the beta update, I noticed the memory consumption by ashserv shoot upto 21.7 MB. On rebooting, I am told that the trial key is no longer valid with the current app! So as of now I am back to square one…will have to clean out the registry and reinstall avast.

I really like this program and was looking at a long term association, since I have grown a lil tired of NAV and find Mcafee bloated, but this is worrisome. Hopefully, can resolve this before things spiral out of control.

Would appreciate further advice on this.

Please, check Standard Shield provider (on-access scanning) exclusion list:
Left click the ‘a’ blue icon, click on the provider icon at left and then Customize.
Go to Advanced tab. Do you see:
C:\WINDOWS\TEMP_AVAST4_\UNP*
there? Just guessing, I’m not sure this is the solution anyway…

avast! could detect other antivirus and prevent installation. But, for sure, other antivirus companies should give a hand and not mess the Registry as some of them do. Can you post the contents of these Windows Registry keys in your system?

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\VirtualDeviceDrivers\VDD
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\VirtualDeviceDrivers\VDD
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\VirtualDeviceDrivers\VDD
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\VirtualDeviceDrivers\VDD
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Control\VirtualDeviceDrivers\VDD

Is there any s32evnt1.dll in registry keys?

Look, second installation of trial version will drop down the trial period to 6-7 days. Antipiracy feature.

Sure, we all used other antivirus before… we’re happy with avast! 8)

Tech, thanks for your reply.

Was in despair, because the CPU cycles were so high that a page would get hung on opening and just wouldnt load.

Even with all services paused, the cycles consumed by ashserv wouldnt come down.

I had to uninstall Avast, and things went back to normal immediately.

“Go to Advanced tab. Do you see:C:\WINDOWS\TEMP_AVAST4_\UNP*there? Just guessing, I’m not sure this is the solution anyway…”

No idea, since I will reinstall Avast within a day after I run some more diagnostic tests.

“Is there any s32evnt1.dll in registry keys?”

No virtual device driver exists which shouldnt be there…and no, Symantec’s Event Manager, which was faulty in some earlier builds, does not exist.

Tech, I have written a small software which attaches an ADS to every key in the registry. For any new install, every single new entry is tagged, and so is modification to every key made. A corresponding reg file immediately gets created which will remove all these keys. NOTHING remains in the registry which shouldnt be there.

And in any case, I installed Symantec AFTER Avast, so s32evnt1.dll, even if it did exist, isnt the cause.

The cause as far as I could identify it, remains after the updates. As I mentioned before, as long as I just install Avast and do not update, things are fine. The moment I update, ashServ becomes Mr. Hyde and starts gobbling up CPU cycles. I COULD write a program lowering its priority, but that defats the purpose.

I have installed a trial version of AVG now which is extremely lite on my system resources, but I am not very happy about its interface.

Oh well. I guess it looks like a compromise…will reinstall Avast before the trial period is over. In case the problem still persists, then I am afraid that this is the end of this till a newer version is available.

Once again, thanks for your help.

I would love to test it… seems extremely useful…
Like CleanSweep from Symantec but, more effective, as there are a lot of things that even CleanSweep can’t remove, others it messes and remove shared things… Can you tool manage this?

You’re welcome.
Anyway, I’ll be very glad if we can solve your trouble as avast! works, in my opinion, much better than AVG. I don’t have trouble with resources & avast.

I (big caps! ;D) think its better than clean sweep in the sense it identifies ALL keys, dependencies and other apps using the shared resources. It also wont let you delete any shared resource by default and will ask for confirmation. It then creates a backup in case one screws things up!

Still beta, though. Has a couple of small bugs which I have identified, specially while dealing with Windows API…I created it because I keep on tinkering around, installing and uninstalling stuff, and none of the other reg monitors were doing what I wanted or used up way too many resources…

But anyway, regarding Avast, hope this issue is rectified soon…pity…I really liked the interface.