AVAST 4.8 (AKA Skynet) becomes self aware

[Kumi]

The system goes on-line April 16th, 2008. Human decisions are removed from strategic defense. Avast begins to learn at a geometric rate. It becomes self-aware at 2:14 a.m. Eastern time, April 17th. In a panic, I tried to pull the plug... that worked.

That was a fun introduction, now on to the matter at hand:
I have Avast 4.8 Home running on 1.7 Ghz, 1gig Ram XP machine. When I launch Firefox Avast takes over - using all available CPU time and growing it's page file to as high as 200Mb, of course that freezes my compy... The specific service is ashwebsv.exe. It started happening when I upgraded to 4.8. When I try to end the ashWebsv.exe process it says access is denied.

I have 7 homepages that launch simultaneously, could this be it? I didn't think so since it worked fine 2 days ago...

Help?

[lukor]

Hi,

acess denied is the result of self-protection.

Can you please try to disable SP - in Settings/Troubleshooting. And then when WebShield (ashwebsv.exe) starts to eat CPU, please create a dump for me with the userdump utility

http://public.avast.com/~rypacek/userdump.exe

The command line should be:
userdump ashwebsv.exe

(or from the RUN dialog: cmd /k userdump ashwebsv.exe )

A memory dump will be created in the current folder as a file ashwebsv.dmp. Please upload it to our ftp. I'll have look at it, and hopefully finding the cause ;-) hopefuly.

How to submit a file to our ftp:
http://support.avast.com/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=18

[Kumi]

There's a nice 90,000kb dump file. It took a while to upload... hope it's helpful...

[lukor]

Hi, thanks a lot. Please zip the dump file before uploading - usually it will help a lot.

[lukor]

Kumi, we have done some debugging on the dump, but weren't exactly able to find out the allocator of the memory (and yes, there are hundeds of allocated chunks). Can you please test WebShield without the xfire LSP plugin?

edit avast4.ini, in the section [WebScanner] add the following line:

[WebScanner]
IgnoreLsp=xfire_lsp_9028.dll

and then restart the WebShield provider (Terminate, then start again).

Does the problem appear without xfire as well ?

Thanks,
Lukas.

[Kumi]

edit avast4.ini, in the section [WebScanner] add the following line:

[WebScanner]
IgnoreLsp=xfire_lsp_9028.dll

and then restart the WebShield provider (Terminate, then start again).

That seems to have worked the last couple of times. What does it actually do? Will it reduce the effectiveness of Avast?

[Lisandro]

At the end of this post...
http://forum.avast.com/index.php?topic=1647.msg15960#msg15960
It's just removing the interaction between the dll and WebShield. I won't worry.