webshield: handles leak problem

[Magister]

Hello,

I am running the latest avast4 engine and components, since a few weeks I noticed that there's a leak in webshield, it does not close handle properly. My computer is always on, after a few days I can see with some utilities like "TaskInfo" that the webshield has thousands of handle count, in a few days it can go up as far as 10000, TaskInfo do a warning popup after 20000 total handles and sometimes it reachs it. I have to stop the webshield and then start it again and all the handles taken by the shield dissapear, for a few days...

I am running XPSP2 with latest windows update, microsoft anti spyware beta, microsoft software firewall integrated with SP2.

Is this a confirmed problem?

Thanks!

[igor]

Can you check what kind of handles are they, please?
Sysinternals Process Explorer makes it possible to display the handles for given process. It should be possible to guess which ones are leaked - if there is really a lot of them.
Thanks!

[Magister]

I restarted the webshield, browsed a few time, then in the console the webshield said it had scan 640 objects, and with "TaskInfo" (from http://www.iarsn.com/) it said the webshield had more than 700 handles, but nothing is attached to these handles... If I check icq.exe for instance there's 271 handles and I can clearly see it's some Section, Port, Events, Key, Semaphore, etc, but for the webshield, absolutly nothing, it's like handles are created but not used?

[igor]

Do you mean that when you start Process Explorer and select the Web Shield process (ashWebSv.exe), the lower pane of the window doesn't show anything??
Are you logged on as Administrator?

[lukor]

I'm sorry but I must confirm this a problem. Thank you very much, Magister, for noticing.

Those are Event handles, they are reused (to save the creation) and apparently they are not closed correctly. Hopefully we will find the problem quickly.

thanks again.
Lukas.

[Magister]

*oups* nope I was logged as a normal user!

Code: [Select]

|Handle|  |Type|                 |Refs||Name|

4 :       KeyedEvent            33/30  \KernelObjects\CritSecOutOfMemoryEvent
8 :       Obj Directory         67/30  \KnownDlls
C :       Thread                  7/3  ThID:1504 PID:1500, C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
10 :      Key                     3/1  HKLM
14 :      Obj Directory         35/29  \Windows
18 :      Port                   19/1 
1C :      Section               32/29 
20 :      Event                   4/1 
24 :      WindowStation         65/40  \Windows\WindowStations\WinSta0
28 :      Desktop            2 206/27  \Default
2C :      WindowStation         65/40  \Windows\WindowStations\WinSta0
30 :      Device Obj              3/1  \Device\KsecDD
34 :      Obj Directory        259/30  \BaseNamedObjects
38 :      Semaphore             41/38  \BaseNamedObjects\shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}
3C :      Event                   4/1 
48 :      Key                     3/1  HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9
4C :      Event                   4/1 
50 :      Key                     3/1  HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5
54 :      Event                   3/1 
58 :      Event                   7/4  \BaseNamedObjects\lg671614.mut
5C :      Event                   3/1 
60 :      Event                   3/1 
64 :      Event                   3/1 
68 :      Thread                  7/3  ThID:1504 PID:1500, C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
6C :      IoCompletion            5/2 
70 :      IoCompletion            3/1 
74 :      IoCompletion            5/2 
78 :      Event                   3/1 
80 :      Key                     3/1  HKLM\SYSTEM\ControlSet001\Control\Nls\Locale
84 :      Key                     3/1  HKLM\SYSTEM\ControlSet001\Control\Nls\Locale\Alternate Sorts
88 :      Key                     3/1  HKLM\SYSTEM\ControlSet001\Control\Nls\Language Groups
8C :      Event                   4/1 
90 :      Thread                  5/2  ThID:1516 PID:1500, C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
94 :      Key                     3/1  HKU\.DEFAULT
9C :      Event                   3/1 
A0 :      Port                    3/1 
A4 :      Thread                  8/4  ThID:1520 PID:1500, C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
A8 :      Event                   3/1 
AC :      Event                   3/1 
B0 :      Thread                  8/4  ThID:1520 PID:1500, C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
B4 :      Event                   3/1 
B8 :      Event                   5/1  \BaseNamedObjects\AvWsTrm.evt
BC :      Event                  11/4  \BaseNamedObjects\vpsUpdat.sig
C0 :      Event                   5/1  \BaseNamedObjects\AvWsCfgChg.evt
C4 :      Thread                  8/4  ThID:1520 PID:1500, C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
CC :      Event                   5/1 
D0 :      Device Obj              5/2  \Device\Tcp
D8 :      Semaphore               3/1 
DC :      Semaphore               3/1 
E0 :      Event                   6/2  \BaseNamedObjects\AvResWsConfigEvent
E4 :      Mutant                  4/1  \BaseNamedObjects\oleacc-msaa-loaded
E8 :      Event                   4/1 
EC :      Event                   5/1  \BaseNamedObjects\AvResWsTermEvent
F0 :      Event                   5/2  \BaseNamedObjects\AvWsProvStop
F4 :      Thread                  5/2  ThID:1532 PID:1500, C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
F8 :      Thread                  5/2  ThID:1536 PID:1500, C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
FC :      Section                 5/2  \BaseNamedObjects\defStd.mem
100 :     Section                 5/2  \BaseNamedObjects\iniRecs.mem
104 :     Section                 5/2  \BaseNamedObjects\extDlls.mem
108 :     Thread                  3/1  ThID:1540 (Non existant Thread) PID:1500, C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
10C :     Section                 5/2  \BaseNamedObjects\vpsLoad.mem
110 :     Section                 5/2  \BaseNamedObjects\virNames.mem
114 :     Section                 5/2  \BaseNamedObjects\packType.mem
118 :     Section                 5/2  \BaseNamedObjects\fileType.mem
11C :     Section                 5/2  \BaseNamedObjects\virFlags.mem
120 :     Section                 5/2  \BaseNamedObjects\virURLs.mem
124 :     Section                 5/2  \BaseNamedObjects\virDescs.mem
128 :     Section                 5/2  \BaseNamedObjects\fileID.mem
12C :     Section                 5/2  \BaseNamedObjects\defMacro.mem
130 :     Section                 5/2  \BaseNamedObjects\defPoly.mem
134 :     Device Obj              3/1  \Device\AavmKer4
138 :     Thread                  5/2  ThID:1544 PID:1500, C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
13C :     Section                 5/2  \BaseNamedObjects\defStd1.mem
140 :     Event                   7/2  \BaseNamedObjects\vpsNew.sig
144 :     Thread                  6/3  ThID:1556 PID:1500, C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
14C :     Semaphore              12/1 
150 :     Event                   3/1 
154 :     Event                   4/1 
158 :     Semaphore              12/1 
15C :     Thread                  7/4  ThID:1548 PID:1500, C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
160 :     Thread                  6/3  ThID:1552 PID:1500, C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
164 :     Thread                  6/3  ThID:1560 PID:1500, C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
168 :     Thread                  6/3  ThID:1564 PID:1500, C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
16C :     Thread                  6/3  ThID:1568 PID:1500, C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
170 :     Thread                  7/4  ThID:1572 PID:1500, C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
174 :     Event                   3/1 
178 :     Thread                  6/3  ThID:1584 PID:1500, C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
17C :     Thread                  6/3  ThID:1588 PID:1500, C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
180 :     Thread                  6/3  ThID:1592 PID:1500, C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
184 :     Event                   3/1 
188 :     Thread                  7/4  ThID:1548 PID:1500, C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
18C :     Event                   3/1 
190 :     Device Obj              3/1  \Device\ASWRDR
194 :     Event                   3/1 
198 :     Event                   3/1 
19C :     Event                   3/1 
1A0 :     Thread                  6/3  ThID:1592 PID:1500, C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
1A4 :     Event                   3/1 
...repeat 3000 times...
202C :    Event                   3/1 
2030 :    Event                   3/1 
hope this helps

[Vlk]

The problem should be fixed in the latest beta (see http://forum.avast.com/index.php?topic=14712.0 ) and of course, will be fixed in the upcoming official update as well...

Thanks
Vlk