Hi,
Since several weeks, ashServ.exe freezes my system about two minutes every 10-15 minutes by saturating my CPU. This does not happen if I disable the Standard Shield. I have used Avast for at least five years without such a problem.
Every shield is at the normal sensitivity.
I have the WinXPSp2 regularly updated, my CPU is the Athlon 64 3000+, with 1Go RAM.
I use mainly FireFox as a browser.
Among the programs which run and might interfere with Avast! (but none is new on my system): Sygate Personal Firewall, Spyware Doctor, WinPatrol, PeerGuardian, ProtoWall, Copernic Desktop Research, Google DeskTop. I have also installed the free version of BitDefender (without shield function), that is closed most of the time. I have disabled the MS firewall.
I run a virus scan everyday without opening the archives (either with Avast! or with BitDefender) and a complete scan at least every week. I did not find an important virus since I encountered my problem the Standard Shield.
How can I detect which program interferes with Avast? Or is there a possibility to reduce its sensitivity without risk?
Thank you in advance for your help.
Is the avast icon rotating ?
Well what is it scanning, enable ‘Show detailed info on performed actions’ see image ?
http://img.photobucket.com/albums/v325/for-dwr/ShowDetailedAction.jpg
Also do the same for Internet Mail, you could be sending out spam.
http://img.photobucket.com/albums/v325/for-dwr/showdetailedmail.jpg
Please check the folder \data\log
Are there any files called unpXXXX there (where XXXX is a random number)?
If so, send them to vlk (at) avast.com
They may contain more information about the problem (maybe a link to this thread).
To create the dump, download and run http://public.avast.com/~vlk/hangrep.exe . In the list of processes select Outlook.exe and use the Save button. This generates a file which you can either send to my email address (if it’s smaller than e.g. 1 MB, ZIPed), or upload to ftp://ftp.avast.com/incoming .
The syntax is
userdump.exe ashServ.exe c:\ashServ.dmp
(producing dump file in the root of C:\ drive)
Tech,
I have sent you the rar archive of the TWO dmp files created by hangrep.exe and the rar archive of the unpXXXXX files found in the C:\Program Files\Alwil Software\Avast4\DATA\log folder.
However I think that I have found the source of my problem by following DavidR’advice of enabling ‘Show detailed info on performed actions’ of Standard Shield and Internet Mail.
Since then, I got the freeze three times when Avast was scanning a specific operation of a Firefox extension: Wizz RSS (http://www.wizzcomputers.com/Welcome.php) was checking my watched feeds for new news articles (for podcasting). I had programmed this watch every ten minutes: this is well correlated with the freezes of my system. BTW, I know that PeerGuardian blocks the address of some podcast site which I watch.
I will obviously alert the author of Wizz RSS (and choose a longer delay between the podcast watches). Do you think that I should give him a specific technical information?
Thank you for your help.
Update
The freeze is directly correlated with the scan by Avast of the file C:\Documents and Settings{NNN}\Application Data\Mozilla\Firefox\Profiles\k5z8qs2k.default\wizzrss\Log.html, which logs the checks of the watched feeds since several months, with the hyperlinks to the sites.
I have never had with such a podcasting tool.
I will try to delete this file to see what happens.
Update 2
I have deleted the file C:\Documents and Settings{NNN}\Application Data\Mozilla\Firefox\Profiles\k5z8qs2k.default\wizzrss\Log.html, after having closed FireFox.
After having re-launched FireFox, Wizz RSS has created a new Log.html, much lighter (13ko instead of 9.800 ko). and I have no more problem either if I check for new podcasts or if I open this file directly.
It seems that Avast saturated my CPU only because there was too many hyperlinks to scan in the old “wizzrss\Log.html”. I understand now why there was an option to delete the log.
Thank you for your help.
If you are getting this kind of activity on a log file (though it is an html format file) I would say you probably have the sensitivity set to High, Normal is the default and a good compromise between performance and protection.
You could also exclude it from scans, Standard Shield, Customize, Advanced and Add the path I suggest you use the *wildcards * or it will be a very long path, e.g. C:*\Firefox\Profiles*\wizzrss\Log.html
I have now added this path. Thank you again for your help DavidR.
No problem, a belated welcome to the forums.
With it being an html document there is a theoretical risk of code being executed, I guess you have to trust your rss client.
I agree with you and I intend to draw Wizz RSS attention to this issue. However, I will continue to use it because it’s a rather good tool … when it does not produce the freeze of my system!
Perhaps there is a way if changing the interval to check if there are any rss updates.
I have now understood that you think that it’s rather dangerous to exclude this file from the Avast scan.
Therefore, the best solution is to regularly (e.g.: daily or weekly) delete the log since:
- I can do this directly from The Wizz RSS toolbar
- this file does not provoke any problem when it is small enough.
However, I agree with you that a 10 minutes delay may seems rather frenetic. By setting a one hour delay, I will reduce the size growth of this file by 5/6.
Yes there is a risk in excluding any file that can run code. Whilst I don’t use rss and don’t know what the format of this html file is it is possible to have an iFrame run an external executable file, etc. That risk is limited in the fact that it is only the wizz rss client that should be modifying it, but there is still a risk.
The thing that was concerning you more was the frequency and the duration of the scan (due to size), so increasing the interval if possible and periodically delete the log would probably be the best option, rather than exclusion.
Hello!
I had a similar problem with my laptop and Avast home edition istalled on it. The ashServ.exe caused the computer to freeze for several minutes by useing all the prosessor capasity.
I located the problem by tips on this page to sertain html file. My laptop is IBM TP T30 and with the latest upgrades installed avast started to jamm on one file located at C:\Program Files\ThinkPad\Yhteysapuohjelmat\AccConnAdvanced.html. By excludeing that file from Avast scans solved the problem.
Thanks for the help on this topic!
No problem, glad we could help.
At least we have a new forum member who uses the search function, there really is a lot of information on the forums.
Stick around and browse the forums, especially the sticky topics at the top of each of the forums, not to mention the avast Help file. They provide a wealth of information to help you get the best from avast.
Welcome to the forums.