Avast WEBforum

Business Products => Archive (Legacy) => Avast Business => Avast Endpoint Protection => Topic started by: mpadams on December 08, 2011, 03:43:50 AM

Title: Possible AvastNet.exe handle leak: Avast 6.0.1373
Post by: mpadams on December 08, 2011, 03:43:50 AM: AvastNet.exe on a Terminal Server host: its currently using 150K of ~200K OS handles. To my understanding, the program is meant to maintain a link to the AV server; could multiple TS logins be impacting it?
Title: Re: Possible AvastNet.exe handle leak: Avast 6.0.1373
Post by: sedina on December 08, 2011, 12:57:53 PM: Hi, could you please find in Process Explorer what handles are currently opened for AvastNet process - files, threads, etc.? If the handle is file, what is the path? thanks, Pavel Sedina
Title: Re: Possible AvastNet.exe handle leak: Avast 6.0.1373
Post by: mpadams on December 08, 2011, 05:12:16 PM: It seems to be spawning multiple threads to the GUI program; I took a screenshot of the behavior, and made a dump file of the process. I did restart the server last night, so its not the exact same instance as before: but you can see its already at 20-30K handles in ~10 hours.

Process dump: http://dl.dropbox.com/u/48565033/AvastNet_dump.7z (http://dl.dropbox.com/u/48565033/AvastNet_dump.7z)
Title: Re: Possible AvastNet.exe handle leak: Avast 6.0.1373
Post by: mpadams on December 09, 2011, 05:34:30 PM: 36 hours since last reboot: AvastNet.exe is up to 45K handles.

Edit: all this talk about handles; I found an article might be useful regarding their purpose.

http://blogs.technet.com/b/markrussinovich/archive/2009/09/29/3283844.aspx (http://blogs.technet.com/b/markrussinovich/archive/2009/09/29/3283844.aspx)
Title: Re: Possible AvastNet.exe handle leak: Avast 6.0.1373
Post by: lukor on December 09, 2011, 07:22:31 PM: Hi, I have prepared a special build of the AvastNet service, which might fix this issue for you. If you would like to test it, please download this zip file:

http://public.avast.com/~rypacek/avast/avastnet.zip (http://public.avast.com/~rypacek/avast/avastnet.zip)

and unpack it into the avast's installation folder (self-defense should be disabled for this operation to succeed).

You would also have to stop the avast net service before overwriting it, and then starting it again. To stop it use:

net stop "avast! Net Client Service"

to start use:

net start "avast! Net Client Service"

Thanks.
Lukas.
Title: Re: Possible AvastNet.exe handle leak: Avast 6.0.1373
Post by: mpadams on December 09, 2011, 07:37:53 PM: Thanks for the fix! :) I've installed it, and gotten initial data. I will monitor as able to see how it impact things.
Title: Re: Possible AvastNet.exe handle leak: Avast 6.0.1373
Post by: mpadams on December 11, 2011, 02:06:00 AM: ~36 hours post-fix install, handle count has incremented very little. No reports of major systems issues. I think its a good fix: thanks again!
Title: Re: Possible AvastNet.exe handle leak: Avast 6.0.1373
Post by: lukor on December 11, 2011, 12:13:34 PM: great. thanks for the report and sorry for the troubles. we will incorporate the fix into the next version.

lukas.
Title: Re: Possible AvastNet.exe handle leak: Avast 6.0.1373
Post by: mpadams on February 02, 2012, 12:00:19 AM: Has this fix been pushed to the new versions yet? I've had several systems revert to using an AvastNet.exe from 12-1.
Title: Re: Possible AvastNet.exe handle leak: Avast 6.0.1373
Post by: lukor on February 02, 2012, 02:15:57 PM: Hi, as far as I know there hasn't been a version update of the Business Protection since 1373. So you still need this patch. (remember to have both files in the program directory, otherwise it will be overwritten - reverted back to original ver. 1373)
Title: Re: Possible AvastNet.exe handle leak: Avast 6.0.1373
Post by: mpadams on February 03, 2012, 05:47:49 AM: Any idea when it will be updated permanently? 32-bit 2008 Server seems to have a better chance of keeping the patched version than x64 2008R2.
Title: Re: Possible AvastNet.exe handle leak: Avast 6.0.1373
Post by: Naza on February 21, 2012, 11:34:09 AM: Hi Guy's

I seem to be still having an issue with this. I installed the patch. However all my VM's seem to blue screen and reboot daily.

Is Avast planning to issue any updates? Should I be somehow rolling back to a old stable version? If so where can I get this from?
Title: Re: Possible AvastNet.exe handle leak: Avast 6.0.1373
Post by: Naza on February 21, 2012, 12:27:44 PM: Hi Guy's

I have provided a copy of my Memory DUMP for you to look at to see if you can see what's going on.

http://dl.dropbox.com/u/63351115/MEMORY.zip
Title: Re: Possible AvastNet.exe handle leak: Avast 6.0.1373
Post by: mpadams on April 18, 2012, 10:07:39 PM: It has been several months since this bug was reported, and fixed by a moderator. That said, no official patch has been forthcoming. Manually updating systems to avoid the bug, is a cumbersome process. Please address: thank you.
Title: Re: Possible AvastNet.exe handle leak: Avast 6.0.1373
Post by: MgnfcntBstrd on June 13, 2012, 09:50:54 PM: 25 days up on a terminal server and AvastNet.exe has 1,276,661 handles.

- Just checked a Hyper-V host, up to 2.4 M handles. As it appears the server is rolling 7.0 across the network automatically now, I guess this'll fix itself?
Title: Re: Possible AvastNet.exe handle leak: Avast 6.0.1373
Post by: mpadams on June 13, 2012, 11:03:31 PM: Yeah, I think 7.0 fixes it. Haven't seen any weird memory leaks, and the updated management service is more responsive.