Ashserve.exe 100% CPU Usage

[Buggrit]

I have for the last three years been a supporter of Avast.  I have recommended several friends, colleagues and even a few of my customers to use the pro version.  Unfortunately I am now having big problems on my own system.  ashserve.exe is more often than not running at 100% CPU usage.

I am running Win 2k sp4 fully patched on a Dell Optiplex PII 650 with 512 Mb RAM and have recently noticed a big drop in speed.  My natural reaction was to assume Virus or Spyware issues however I have now scanned through all my files with Ad-Aware, MS Anti- Spyware, Spybot SD and Spyware doctor and I am confident I am clean.  When  I look in Task Manager I find the culprit appears to be Avast!.  Ashserv.exe is mainly running at 100% and causing me big problems.

Is this normal?

I am aware my system is not the worlds fastest however this CPU load seems abnormally heavy and has not been a problem until recently.

What can you suggest.

Regards

JB

[igor]

If ashServ.exe is using a lot of CPU, it must be scanning something. Open the on-access protection window (click on the avast! tray icon), select the Standard Shield provider and check the "Last scanned" item (when ashServ.exe is using the CPU, I mean). What does it show?

[Buggrit]

It seems to be split between stub. log (about 80% of the time and Twain001.mtx

No Idea what these are...

JB

[Buggrit]

I've just checked and this logfile seems to contain multiple repeats of the following  entries...

data_src.cpp -- InitInstance

>>>>>>>>>>>> DS_Entry <<<<<<<<<<<<
DG_CONTROL / DAT_IDENTITY / MSG_GET
matds32.cpp -- control = NULL Identity Get - not creating interface
CControlMsg constructor
Got Identity. Calling IdentityMsg
Inside IdentityMsg. Msg = 1
CheckState state:3  range:3..7
pId->Version.Info = April 11, 2000
pId->Manufacturer = Hewlett-Packard Company
pId->ProductFamily = PrecisionScan LTX 1.1
pId->ProductName = HP PrecisionScan LTX 1.1
pId->Id = 0
data_src.cpp -- pSrc = NULL, Deleting control class
CControlMsg destructor
OLECleanup
OLE connection not running, no cleanup
data_src.cpp -- ExitInstance


I don't now if this will help?

JB

[Buggrit]

Update...

I cleared out the stub.log data & saved it to stub.log.old
I then created a blank Stub.log file in it's place.

This seems to have done the trick. but it would be nice to know what the issue first was af all?

JB

[igor]

Some application is obviously heavily writing into the log file. avast!, having the sensitivity set to High (i.e. all created/modified files are scanned), has to rescan the file on every write - which make take a lot of time if the log file is big.
The solution (appart from limiting the logging somehow) would be to put the log file into the list of Standard Shield exclusions (so that it won't be scanned anymore).

[CharleyO]

***

From a Google search ...

http://www.google.com/search?q=HP+PrecisionScan+LTX+1.1&rls=com.microsoft:en-US&ie=UTF-8&oe=UTF-8&startIndex=&startPage=1

... it appears that your HP scanner OR a program for that scanner is what is creating that log and running up your computer's cpu usage.

Have you been scanning a lot lately?   


***

[Jeruvy]

Hello all.

Avast support technicians please note:

I have confirmed this behaviour until today on one PC (of 3 running avast home) now all 3 are exhibiting this behaviour.

I have watched avast scan file after file, but ashServ sits maxing out the cpu.

If I kill this process, then AshWeb kicks into high load.  I kill this I get my PC back.

I too have been a long time user (2+ years), and am about to do a 180 and dump Avast if this problem doesn't go away really fast.

I have sent a email to support earlier today also no response as of yet, but I understand that response is typically slow.

I have seen setup.ovr (sp?) and one other exe that escapes me doing this also for NO APPARENT reason.

My guess is updates have destabilized this program.

[igor]

Jeruvy, you didn't really supply much useful information.
If ashServ.exe is using the CPU, it means that it's scanning something. So, first you need to find out what is being scanned. You can do that, for example, by opening the On-access protection window (click on the avast! tray icon), select the particular resident providers (Standard Shield is the most likely guess) and watch the "Last scanned" item at the moment of the high CPU usage. You should be able to say what avast! is scanning.
Or, you can turn on the option "Show detailed info on performed action" in the resident providers.

[Jeruvy]

Jeruvy, you didn't really supply much useful information.
If ashServ.exe is using the CPU, it means that it's scanning something. So, first you need to find out what is being scanned. You can do that, for example, by opening the On-access protection window (click on the avast! tray icon), select the particular resident providers (Standard Shield is the most likely guess) and watch the "Last scanned" item at the moment of the high CPU usage. You should be able to say what avast! is scanning.
Or, you can turn on the option "Show detailed info on performed action" in the resident providers.

Well that is the facts as I've seen them.   I have not spent any further time troubleshooting this, nor do I plan to. 

WHY after killing serv, does websrv kick in to 100%?  your going to tell me that it was scanning a file on my system, and then once dead turned over to another exe to continue?  Someone should explain this behaviour to me so I can understand it better.

As for watching what file it's scanning, I beleive I stated clearly above that I watched it scan several files, yet still cause saturation of cpu cycles.

The FACT that this has all happened recently and on two production AND a test box indicates your program no longer likes my builds.  If that is a fact, then I will delete AVAST and move to Trend-Micro as they offer the best value for the number of boxes I have.

I was concerned over the number of updates I was receiving and unless someone can offer a better conclusion, my determination of the problem is the updates have destabilized on my systems.  This is not a ONE PC deal, it is affecting ALL machines I install it on.

If you'd like better information then empower me to provide it.  A debug version or some such tool may be of assistance, or you could improve your statement by clearly defining what information you seek.

[igor]

WHY after killing serv, does websrv kick in to 100%?  your going to tell me that it was scanning a file on my system, and then once dead turned over to another exe to continue?  Someone should explain this behaviour to me so I can understand it better.

I have no idea. Killing ashServ.exe, however, is certainly not a correct method, so I don't really find it relevant. If you stopped Standard Shield provider from the user interface, for example (which should reduce the CPU usage, I guess) and ashWebSv.exe starts eating CPU - then it would be something worth investigating.

As for watching what file it's scanning, I beleive I stated clearly above that I watched it scan several files, yet still cause saturation of cpu cycles.

If you saw scanning setup.ovr, it means that an update (check) was started - but I don't believe this was a continuous process.
Recently, we've seen some programs performing heavy writing to their log files (one of them was some HP software I believe) - which causes Standard Shield to take a lot of CPU (when rescanning the log). Such a behavior, however, should be clearly visible in the "Last scanned" item.

Actually, it doesn't necessarily have to be the Standard Shield provider... maybe it could be some other as well. The only way to find out is turning them off temporarily to see if it helps.

[CharleyO]

***
Ouote from Jeruvy:

As for watching what file it's scanning, I beleive I stated clearly above that I watched it scan several files, yet still ...

Yes, but what are the names or extensions of some of those files? This info could be an excellent clue in what is causing the problem. These kinds of problems require more specfic info than the general info you have given so far.   

No one here can help solve the problem if you are not willing to have it solved.   


***

[HeDiBo]

The problem occurred on my PC also. I investigated the problem and it appeared as if ashServ.exe was periodically taking high percentages of CPU.

Then I started Process Explorer (http://www.sysinternals.com/Utilities/ProcessExplorer.html). It has two special processes it shows, one of which is hardware interrupts. And much to my surprise, it was not ashServ.exe that was the culprit: it was hardware interrupts!! I killed the ashxxx processes and the hardware interrupt bursts stopped.

Just to complete this: ashServ was not scanning any file when this occurred.

There is definitely something wrong with the last update.

[Vlk]

Is the on-access scanner (or Standard Shield provider) sensitivity set to Normal or High. I recommend AGAINST setting it to High unless there's a specific reason for it, and you know what you are doing...


Thanks
Vlk

[HeDiBo]

It's set to Normal