Should 14 copies of ashwebsv.exe be running?

[system]

My connection was slow, so I checked to see what was connecting/running and there were 14 instances of ahwebsv.exe running, apparently simultaneously, and connected to different destination ports.

Shouldn’t one be enough?

[Lisandro]

There are 14 points of connection… not 14 instances of ashwebsv.exe running…
Each application, each webpage, each tab… could have a HTTP traffic and, then, one point of connection is established.

Which Internet programs are you running?

[system]

Either Thunderbird or Firefox, sometimes both. I don’t use IE unless I have to.
There may or may not be more than one tab open in Firefox. At this moment, I have 3 tabs open plus Thunderbird and 11 “points of connection.”

[Lisandro]

@demetermaid post:3

11 “points of connection.”

Which program are you using to check this?

[system]

I am running Comodo firewall and looking under Activity.

Is there some other way?

[Lisandro]

@demetermaid post:5

I am running Comodo firewall and looking under Activity.

Ok.

@demetermaid post:5

Is there some other way?

Sure. I was thinking you’re using TCPView (http://www.microsoft.com/technet/sysinternals/Networking/TcpView.mspx).

[DavidR]

@demetermaid post:1

My connection was slow, so I checked to see what was connecting/running and there were 14 instances of ahwebsv.exe running, apparently simultaneously, and connected to different destination ports.

Shouldn’t one be enough?

For the correct instances of ashWebSv.exe running you should check the Task Manager.

My firewall also show multiple occurrences of both firefox and ashWebSv.exe, but what you have to remember is that is tracking connection activity, open ports, etc. and not running processes.

[RejZoR]

ashwebsv.exe should always be just 1 instance in task manager regardless of how many browsers you’re running or how many tabs are opened. Unless he was checking it with some TCP/IP tool (not disclosed by him), there you may see several connections proxy-ed through ashwebsv.exe…

[DavidR]

That is why I said demetermaid should check Task Manager as there should only be one instance.

demetermaid said “I am running Comodo firewall and looking under Activity,” so that is what is being used to check, which is why I mentioned what my firewall shows.

[Lisandro]

@DavidR post:7

For the correct instances of ashWebSv.exe running you should check the Task Manager.
My firewall also show multiple occurrences of both firefox and ashWebSv.exe, but what you have to remember is that is tracking connection activity, open ports, etc. and not running processes.

@RejZoR post:8

ashwebsv.exe should always be just 1 instance in task manager regardless of how many browsers you’re running or how many tabs are opened. Unless he was checking it with some TCP/IP tool (not disclosed by him), there you may see several connections proxy-ed through ashwebsv.exe…

I think we all three are talking the same… I mean, we agree each other.

[system]

You were right, the problem is back… >:(
The computer is running slowly, internet too and those strange mails sent :

http://perso.orange.fr/reynes/avast.jpg

Any idea how to destroy this trojan ?

[alanrf]

mreynes,

I do not see what your problem has to do with this thread.

It will be easier to assist you if you stay in the thread where you were already being helped with this problem.

[Lisandro]

@mreynes post:11

The computer is running slowly, internet too and those strange mails sent :

Please, don’t post twice the same, just double the effort of helping.
Follow http://forum.avast.com/index.php?topic=25120.0