Why are some Avast modules loaded twice?

[system]

Hi,

When examining loaded modules in WinXP Pro System Information I noticed that some Avast modules are loaded twice. aavm4h.dll , ashuint.dll and aswcmnos.dll are some examples. Is this normal?

The attached picture shows how the aavm4h.dll is presented.

Ulf Bjarke

[Lisandro]

Isn’t it just the same but just named twice: one at long path and the other at short path (alwils~1)?

[system]

@Tech post:2

Isn’t it just the same but just named twice: one at long path and the other at short path (alwils~1)?

You tell me I’m no expert on Sysinfo. But hopefully this is just a presentation issue. But if it is, why aren’t all loaded modules shown with both long and short path? ??? So the question remain unanswered.

Ulf B

[Lisandro]

@UlfB post:3

I’m no expert on Sysinfo.

Neither do I…

@UlfB post:3

But hopefully this is just a presentation issue. But if it is, why aren’t all loaded modules shown with both long and short path? ??? So the question remain unanswered.

Yes, it will be good that someone from Alwil team come here to explain.

[igor0]

Maybe it’s reated to the tool used to display this info? What does ProcessExplorer show?

[system]

@igor post:5

Maybe it’s reated to the tool used to display this info? What does ProcessExplorer show?

Maybe it is. You tell me I downloaded ProcessExplorer from Microsoft, but this gave me no overview over loaded modules (dll files). This tools only show running processes and for each process I got a lot of information that I’m not able to understand. Is there another tool available that show loaded modules/dll files?

Ulf B

[igor0]

Select the process you are interested in (e.g. ashServ.exe) and press Ctrl+D; you should see the list of loaded modules in the lower pane.

[system]

Hi again,

I downloaded a tool, What’s running, from Tucows and this was a good one. When I examined the Avast module Aavm4h.dll, this tool clearly show that one instance of this module is used by three processes: ashServ.exe, ashMaiSv.exe and ashWebSv.exe. The other loaded instance is used by two processes: ashDisp.exe and iexplore.exe. So the module is loaded twice it seems, but shared by several processes.

Please correct me if I’m wrong.

Ulf B

[Lisandro]

@UlfB post:6

Maybe it is. You tell me I downloaded ProcessExplorer from Microsoft, but this gave me no overview over loaded modules (dll files).

Yes, it has.
View > Lower Pane View > DLL

Edited: Igor posted a shortcut to it.

[system]

@igor post:7

Select the process you are interested in (e.g. ashServ.exe) and press Ctrl+D; you should see the list of loaded modules in the lower pane.

Thanks, that worked pretty well. But the tool What’s running have a more intuitive interface and seems to be very flexible. Anyway, the question why the same module is instanciated more than once is solved. So MS SysInfo gave the correct information, that is some modules are loaded more than once.

Ulf B