Whenever I open Internet Explorer 6 or Firefox 1.5 (and run Sysinternals Tcpview or do a netstat -an command), I see numerous instances of ashwebsv.exe run, and sometimes it can be up to 20. After several seconds the state switches from listening to time wait, and then the ports close. Is this normal?
avast works by intercepting not programs but standard ways of accessing the internet.
Every single browser you can choose from is just a different interface behind which all of them issue http transactions. avast works by not caring about which browser you use but by intercepting the http transactions they all issue to get your web pages displayed.
To get the pages displayed to you may require the browser to run multiple connections at the same time to retrieve all the different parts that make up a page, the images, the text, the advertisements etc.
http transactions make calls to port 80. Remember what that really means … it has nothing whatsoever to do with port 80 on your system. It means that your system is making a connection to port 80 on all those different web servers out there, the port on which they are waiting for a connection to be made. avast intercepts all the calls to those servers. avast routes those calls to an internal port on your system … (or localhost for short) port 12080 at which avast (ashWebSv.exe) is waiting to take control of the call. avast (ashWebSv.exe) then sends the call to the webserver and receives the output back which it then scans to ensure it is ok before passsing it back to your browser and your browser had no idea that avast intercepted its activity.
That is why TcpView is showing that the connections being used have been initiated by ashWevSv.exe (it does not mean there are multiple instances of the process). The listening is waiting for the response from the remote web server … the timewait is the connection cleanup/ending.
You will see exactly the same thing happening but with your browser name instead of ashWebSv if you turn off the Web Shield.
TCPConflicts, it is exactly as alanrf said. As you probably already know, TCPView shows all opened connections for each process, and one process may have (and usually does have) more than one connection at a time - that is what you see. For showing which processes are running and how many instances of each executable, I suggest some tool for showing running processes. (eg. Taskmanager)