Windows XP Professional SP-3
Internet Explorer 8
Avast! 4.8.1335 Home Edition
Windows Defender
Windows Firewall

After web browsing for awhile, I happen to notice that ashWebSv.exe had mushroomed to 72M - and that’s even after Internet Explorer was closed! There were no instances of iexplore.exe in memory and yet Avast’s Web Shield was eating up over 70MB of memory.

As a test, I load 24 web pages into Internet Explorer. I watched ashWebSv.exe grow from 72MB to 122MB and the handle count go from 133 to 1201. I exited Internet Explorer and ashWebSv.exe dropped back down to 72MB (not immediately but within several seconds) and its handle count went down to 133.

So ashWebSv.exe is retaining a large amount of physical memory even after the web browser has exited (there are no instances of iexplore.exe in memory). The only way to get the Web Shield to relinquish the memory is to terminate that shield and restart it. When the Web Shield first starts up, it consumes 1.7MB of memory and 92 handles. I load the same 24 pages and ashWebSv’s memory footprint grows to 48MB. I unload those pages and reload them and ashWebSv grows to 72MB. I do it again and memory goes up to 118MB. These are the same web pages getting reloaded each time. I then exit the web browser and ashWebSv.exe drops to only 72MB - and it stays there until the Web Shield gets terminated and restarted.

In the first place, why is the Web Shield eating up such a huge amount of memory? Once it scans a web page, it’s done. If the user unloads a web page (navigates elsewhere in the same tab, closes the tab, or exits the web browser), obviously the Web Shield doesn’t need to retain any information for a web page that is no longer displayed. And, in the second place, why isn’t the Web Shield releasing all that memory, especially after the web browser has exited?

— UPDATE —

I happened upon the “intelligent stream scanning” option. It’s help description says:

Use intelligent stream scanning. This option specifies how the downloaded files are scanned. If this option is enabled, the files being downloaded are scanned almost in real time. The pieces of data are scanned as soon as they arrive - and the next parts are downloaded only when the previous parts are verified to be virus-free. If you turn off this option, the whole files will be downloaded to a temporary folder first, and scanned by avast! afterwards (and if no virus is detected, they are passed on to the web browser that requested them).

So it would seem that enabling this option would keep response in the web browser as speedy as possible. Obviously every user wants their security product to inflict as little lag as possible. This option is enabled by default when Avast is installed.

I disabled this option and did the same test as before and got:

• No web browser loaded. Terminate and restart Web Shield.
  Memory = 4.6MB (bigger than before for its initial size)
• Load the web browser and open the same 24 web pages.
  Memory = 46MB (rather large but perhaps dependent on the sizes of files retrieved for web page)
• Unload the 24 web pages in tabs. Web browser still loaded.
  Memory = 46MB (does not relinquish memory although pages no longer displayed)
• Exit web browser.
  Memory = 9.6MB (not quite down to its initial size)

So there is less memory consumption but there is still a problem. The memory is NOT getting relinquished when the web page is done being rendered (and after Avast should have already completed scanning all the files for the web page). When the web page is unloaded (i.e., the tab is closed), Avast is still not relinquishing its memory. Only until the web browser is exited does the Web Shield relinquish most of its memory.

This was a short test. I did not check what happens to ashWebSv’s memory footprint over time as the web browser is left open while continuously navigating to various sites throughout the entire day. I also leave my computer powered up 24x7. Sometimes I leave the browser open when I leave the computer (I do have to sleep, ya know) because I need to continue from where I was when I return.

So my choices are to leave “intelligent stream scanning” enabled in trying to eliminate lag in response when visiting numerous web sites along with letting the Web Shield consume and retain a large amount of physical memory, or I can disable this option and suffer slower response in the web browser to get the Web Shield to relinquish its memory but only after exiting from the web browser.

This is not a new problem, folks. Users have reported here this problem going back over 3 years. Has development on the Web Shield component gone stagnant in subsequent versions of Avast?

Strange ???

I also have XP SP3 & Windows Firewall but not Windows Defender.
I’ve had 10 x FF 3.0.7 tabs open all day (and now opened 2 x IE 8 RC1 - just because you mentioned it )

Checked Task Manager, ‘Mem Usage’ 2,988K, ‘Peak Mem Usage’ 47,896K (see attachment).

Are you getting slow performance from your PC?
Which utility indicates 70MB?

2 tabs may not be a sufficient test. Memory consumption goes up with the number of concurrently loaded pages and the size of the content on those pages (i.e., all the files that get downloaded to your host to render that page). Memory consumption was determined by looking in Task Manager’s Processes tab. I wasn’t watching total memory consumption or anything else in the Performance tab. I was only focused on the memory footprint for the over-sized ashWebSv.exe process.

My host is not slow but then the problem is with the Web Shield, not with the Standard Shield. I have not yet performed a performance test to determine by how much the Web Shield will delay delivery of the web page content before the web browser is allowed to render it.

With “intelligent stream scanning” enabled, the memory footprint is almost twice the size than when this option is disabled regarding what ashWebSv.exe drops back down to as its mimimum memory consumption (i.e., where it floats back down to and hovers there after unloading all web pages). Whether 72Mb or 46MB, either is too large for holding onto memory for objects (files from the web page) that have already completed getting scanned by Avast - and is definitely too large when the web page isn’t even loaded anymore.

I should not have to terminate and restart the Web Shield to recapture disused allocated memory (when the “intelligent stream scanning” option is enabled) or have to wait until the web browser gets exited to reclaim that memory (when the option is disabled). The Web Shield is hanging onto memory that it no longer needs. The objects have been scanned. That scanning is done. So release the memory buffers used to hold the content of those objects when they are no longer being scanned.

Garbage collection [for memory] should not have to wait until the Web Shield gets restarted or until the web browser is exited.

Yes, I know others have reported this sort of thing before. (I feel sort-of happy to be left out).

The Webshield is, quite simply, standing in the place your browser would occupy if you were not using avast. I think I must agree there is an extra overhead because avast is standing in for the browser before it passes off the same overhead you are causing to the browser itself.

What it really means is that what is happening is your browsing choice and your wish to be protected. There will be no avast overhead if you do not want the protection provided by avast. Please understand that the the “overhead” you are seeing from avast is a storage to storage connection from avast to your browser (about the fastest connection your computer can make and the most easily handled by your operating system).

If you would like a more detailed discussion on this then I am happy to continue. If you wish to pursue your own theories then you are also welcome.

I did a crude timing test on page load times under the following setups:

• Same set of 24 web sites, each opened in a tab inside the same instance of IE.
• Use the Networking tab in Task Manager to guage when there was traffic.
• Set polling rate to high (each horizontal increment in graph is 3 seconds).

I then repeatedly loaded the web page set and would count the number of horizontal increments in the graph. I wanted to measure when there was network traffic to show the pages were loading and not include any setup time in IE for creating the tabs. I then check the total page load time (as seen in the network graph to let me know when the pages actually started loading and when they were done loading) under the following scenarios:

• Web Shield = not running.
• Web Shield = running, intelligent stream scanning = disabled.
• Web Shield = running, intelligent stream scanning = enabled.

The total page load time was within 2 to 3 seconds of each other for all these tests. So close that I’d say there was no impact from Web Shield on page load time, and there was no further impact by having the intelligent option enabled or disabled.

So I am impressed with the lack of performance hit in page load times when Web Shield is inuse.
But I am depressed at the lingering memory consumption.

The result was there was very little difference in the page load times

But unlike a web browser, Web Shield does not have to hold onto those memory objects as does a web browser because Avast isn’t displaying the web page. It just scans it. Once an object (file) is scanned, just what more is Avast going to do about the object that has already been deposited on my host and which Avast did not alert was a problem?

You might be right in what you say. I noticed the handle count for ashWebSv.exe goes way up when I load the page set used in my test. The handle count went from 720 (in the first test, 133 in later tests) to 1201. However, that handle count ALSO went back down to 133 but the memory consumption remained. So unlike a web browser, Avast is keeping the memory allocated although the handles to the objects no longer exist. That constitutes a memory leak.

Before: 72MB, 720 handles
During: 120MB, 1201 handles
After: 72MB, 133 handles

So Avast is dropping the handles for the objects it has completed its scanning but doesn’t release the memory used to process the objects to which those handles were assigned. Also, when the web browser has been exited, Avast still doesn’t release that memory (when the intelligent streaming scan option is enabled).

I have come across a few other security programs that don’t work well with Avast’s Web Shield, like Threatfire. Stopping Avast’s Web Shield resolved the conflict. So there is something odd in how the Web Shield operates.

Very definitely I would like to know more. It’s possible some of it could be beyond my understanding but I can always do some research to see what I can figure out later. There’s been a lot of guessing in prior posts (and here) about why ashWebSv.exe eats up (and keeps like a chipmunk storing in its cheeks) the memory for which the related web pages have already been unloaded or even after exit of the web browser. I’m definitely curious. One of the big reasons why I keep coming back to Avast after trialing other products is the Web Shield protection (which has alerted me a few times about malicious content) and its URL blocking (so I don’t need an over-sized firewall just for that).

At the most simple level, were your theory true, then avast would continue to consume the highest level of memory ever reached. This is demonstrably not the case … the (ashWebSv.exe) avast memory use can and does decline … is this not something you are able to observe?

Just a for example … yes, I use Firefox not IE …

As noted, ashWebSv.exe continues to consume ever more memory as more web pages are traversed. It far outstrips what the web browser itself consumes. When the web pages are unloaded, yes, memory consumption will fall but not back to the same level as before the web pages were loaded. With the intelligent streaming scan option enabled, and once past 72 megabytes, memory consumed above that will get released and ashWebSv.exe falls back but only to 72 megabytes, not the 2 to 6 megabytes it had before all the web pages were loaded. Memory goes up but only falls back down so far and which is still quite high. With intelligent streaming scan disabled, memory will fall back close to the level before the web pages were loaded but only AFTER the web browser gets exited.

intelligent streaming scan = enabled

2-4MB ---(load pages)---> 72MB ---(load pages)---> ??MB
                                                     |
                            .----(unload pages)------'
                            |
                            '-----(load pages)---> ??MB
                                                     |
                            .----(unload pages)------'
                            |
                      (EXIT BROWSER)
                            |
                            V
                           72MB


intelligent streaming scan = disabled

2-4MB ---(load pages)---> 46MB ---(load pages)---> ??MB
                                                     |
                            .----(unload pages)------'
                            |
                            '-----(load pages)---> ??MB
                                                     |
                            .----(unload pages)------'
                            |
                      (EXIT BROWSER)
                            |
    9MB <-------------------'

While there is some fluctuation in the threshold values, the above is what I’m seeing regarding the lack of releasing memory. When I start testing, ashWebSv.exe might be consuming anywhere from 1.7MB to 6MB. The “72MB” threshold may be anywhere from 70-80MB. The “46MB” threshold is about 42-48MB. Tomorrow and with a different set of test pages, those thresholds might change. The point is that memory does not get recovered after web pages are done downloading, after web pages are unloaded, and also after the web browser has been exited (when the intelligent option is enabled).

These are NOT peak memory usage values. I don’t have that column shown in the Processes tab of Task Manager. This is the real memory consumption, the one shown in the Mem Usage column. I haven’t bothered to look at what is the pagefile consumption (Virtual Memory Size column) because I didn’t happen to be showing that one when I did the testing.

I’m out of touch with IE having not used it much since the release of FF 1.5 but I remember that earlier versions effectively “cached” everything in “Temporary Internet Files”. Could it be something to do with differences in the way FF and IE store and render content?

I’ve never found much detailed information regarding the Web Shield component other than at http://support.avast.com/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=19 which says:

Starting from the version 4.6. avast! comes with a new on-access scanning provider - Web Shield.
It is able to monitor and filter all HTTP traffic coming from the Web sites on the Internet. It’s implemented as a HTTP proxy running on your PC.
Connections from your Web browser are redirected to the Web Shield module. Web Shield in turn connects to the requested web server and while downloading the content it scans it for viruses and Trojans. Only the clean data is delivered to the browser, every malware is stopped before it gets saved on your PC.

Okay, but I doubt other HTTP proxies hang onto memory for buffering the web page content after it has been delivered to the web browser - unless Web Shield was behaving like a caching HTTP proxy. But why? How often do users hit the Refresh button? When they do refresh, there is still network traffic to re-retrieve that web page so there appears no caching effect in Web Shield. If Web Shield is doing any caching, it is doing a poor job (but, at least for me, thankfully it has [almost] no impact on web page load time from the web server).

Any users here of Proximitron, CC Proxy Server, or another HTTP proxy? Does it consume gobs of memory as you continually retrieve more web pages, keep that memory after delivering that web content, keep it after the web page is no longer loaded in the web browser, and keep it after the web browser has exited?

Sidebar: I also found http://support.avast.com/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=22 which mentions some configuration of the Web Shield as a transparent proxy. It listens on port 12080. Sure enough, I saw that when using SysInternal’s TCPview.

I got Vista instead of your xp and all thing you said i didnt got any problem with that ! Its strange your thing ! Maybe a cause of a malware right ?

Then it’s been malware-caused for a very long time and afflicted other posters that have posted this same problem going back to Jan 2006 and ever since version 4.6. Plus that wouldn’t bode well of Avast’s detection of the interferring pest if it has been going on that long.

I just sayed like that but well im not sure he should contact a informatician or avast support for more info

I have been browsing on this Win XP Pro SP3 system for the last three plus hours … I also have the same options selected in the Webshield as you.

See below my current task manager display. What I am doing wrong that I do not see the “bloat” you report?

I would really like to try to reproduce the problem you are reporting.

Was that with the “intelligent streaming scan” option enabled or disabled?

Was Internet Explorer still loaded or already exited when you show that memory value?
UPDATE: Oops, didn’t see firefox.exe (FF) was loaded. I only use iexplore.exe (IE).

How many web pages did you ever have at a maximum that were concurrently open in tabs? In my test, I went up to 24 (just because I had a favorites group with that many). Actually I got up to 42 concurrently loaded tabs but that was I doing an overview trying to find the cause rather than when I decided to test with the same suite of web sites with various config settings in Avast’s Web Shield when it was running and also terminated. I don’t know what Firefox has. Plus you need to do the test with Internet Explorer since that the web browser under test when ashWebSv.exe was noticed to retain memory. If there is a difference in how ashWebSv.exe handles its memory management between Firefox and Internet Explorer, and since the problem (here) is with Internet Explorer, you could be masking out the problem by not using the web browser with which ashWebSv.exe has problems. I haven’t tested with FireFox.

Create a favorites test group in IE. The group that I used had the following web sites within it (4 were removed since testing because they no longer exist, like CastleCops):
http://www.wilderssecurity.com/forumdisplay.php?f=65
http://forums.altiris.com/default.aspx
http://forum.avast.com/
http://www.daemon-tools.cc/dtcc/announcements.php
http://boards.diynetwork.com/
http://www.dslreports.com/
http://dvdshrink.org/forum/viewforum.php?f=1
http://www.fatwallet.com/
http://forums.fedoraforum.org/index.php?
http://groups.google.com/group/Google-Groups-Guide
http://community.mcafee.com/
http://www.wilderssecurity.com/forumdisplay.php?f=100
http://forums.spybot.info/
http://forum.spamcop.net/forums/
http://www.spampalforums.org/phpBB2/index.php
http://forum.storagecraft.com/Community/forums/
http://www.bbs.legacycentral.org/
http://forums.truecrypt.org/index.php
http://communities.vmware.com/
http://groups.yahoo.com/

Open Task Manager and show its Processes tab. Sort the list by process name (so it doesn’t jump around as CPU usage and memory consumption vary). Highlight the ashWebSv.exe process to watch it. With no web browser loaded, check the memory consumption by ashWebSv.exe. In the first round of testing, have the “intelligent streaming scan” option enabled.

Load the web browser but not to any page (i.e., use about:blank or about:tabs).

After creating the favorites group with all these shortcuts, click on the group and click the right-arrow for that group which then loads all shortcuts within a group. This will concurrently load the 20 web sites, each into its own tab. Wait until all tabs load their pages. You can use the Performance tab in Task Manager to see when network traffic ceases. Look at the memory used by ashWebSv.exe.

Right-click on the first tab (about:blank or about:tabs) and select to Close Other Tabs. You’re left with just the blank tab. Look at the memory used by ashWebSv.exe.

Again click on the arrow for the group to have all web pages within it load into separate tabs. Check the memory used by ashWebSv.exe.

Right-click on the blank tab, Close Other tabs, and check the memory used by ashWebSv.exe. Load all the web pages for the group in separate tabs and check the memory used by ashWebSv.exe. Do this as many times as you want to monitor any memory growth by ashWebSv.exe, if it returns to its prior memory footprint when no pages are loaded, and if there appears to be some threshold to which memory is released but doesn’t go all the way back down to its prior value when you first opened the web browser (with only a blank tab).

This testing has you check the memory footprint with pages loaded and with them removed. However, after you see the network traffic has ceased, another test would be to see if the memory gets released immediately thereafter since obviously there is no more traffic going throught Avast’s HTTP proxy (Web Shield).

After bouncing around by loading a bunch of web pages and unloading them, and repeating this cycle for, say, 10 times, how much memory is used by ashWebSv.exe? With the web browser still loaded but displaying only a blank tab, does it ever return to it memory footprint when the browser was first opened (with a blank tab)? Does the memory footprint change (reduce) after you unload the web browser?

Then redo the testing with “intelligent streaming scan” disabled.

I will work through the test you propose. However, please be aware that avast has no real awareness of the browser your system uses. I do not want to mislead anyone here (for most users with default settings) avast scans only the http accesses of a list of processes that the avast team deems should be intercepted (including most well known browsers). To the very best of my knowledge beyond that all http accesses are treated, irrespective of source, identically. So, there should be no difference between my Firefox and your IE.

Further to that and it may - or not- have some impact, I have an option set in my avast4.ini that tells avast that I wish to override the avast team’s decision on which processes’ http accesses to intercept to say that I want all http accesses, irrespective of their process origin, scanned by avast.

I’ve been noticing the same thing randomly in the past days. My ashwebsv.exe process is using 70 MB of memory with no browsers open, only XChat and Miranda running.

http://pic.leech.it/t/89a7d/7eb472e2ashwebsv.png

As I said, it happens completely random, I cannot tell the steps to reproduce this behaviour. If I terminate the process it goes back to normal (iexplore running because I was writing this post ):

http://pic.leech.it/t/10228/7e7cf3cashwebsv2.png

Win XP SP3 here with the “intelligent stream scanning” option enabled.

Hello guys,

thanks for your systematic approach to this issue, especially thanks to Vanguard.

Is however a little bit complicated to make any judgements based solely on the very vague and unclear definition of what exactly do those columns in Task Manager mean. Furthermore the meaning of the memory related columns has changed between XP and Vista. I suggest using “Process Explorer” for comparing actual memory usage of ashWebSv.exe process.

The “private bytes” is the column that interests us most!

In the Task manager the “Mem Usage” column shows just the working set of the process at the specific time. This can be lowered artificially (the process itself can ask the OS the be swapped to the page file - if it wants to please users and spin the disk a bit). This value can also lower down when other memory hungry apps need the memory and causing all other process to be swapped out – this does not mean that WebShield (or other process) would be releasing any memory during that operation. This value also includes shared memory between processes and memory mapped files, so actually I don’t know how to seriously interpret its meaning.

Here is how it looks on my system after several weeks of running. You can see the number from process explorer and task manager differ quite a bit.

Lukas

EDIT: you can also use tcpview to spot the exact time when Internet Explorer closes the connections with WebShield. I have tried your test, open all tabs and closing them - remaining with just on “about:blank” tab, but still IE keeps the connections alive for some time – to save the possible overhead of reconnecting them again in the future (in the optimistic guess that you might revisit the same hosts again). For me it takes about 10 minutes until all connections are closed. Then the memory returns back to the same value (26.4 on different system - XP). See pic. No futher change when the browser is finally closed.