Author Topic: ashserv.exe big cpu occupancy related to ?  (Read 16860 times)

0 Members and 1 Guest are viewing this topic.

Offline pinuccio

  • Jr. Member
  • **
  • Posts: 25
ashserv.exe big cpu occupancy related to ?
« on: May 01, 2008, 04:41:56 PM »
ashserv.exe big cpu occupancy is not related to scanning but as i read here searching for a solution
"The new rootkit scan happens about two minutes after your desktop is up as it needs to compare what windows API shows against what is hidden, so it shouldn't get in the way too much"

i tryed to boot and doing nothing but checking the task manager
infact after two minutes hd started working and ashserv.exe started growing in cpu occupancy so slowing the pc , you can do only soft work until the ashserv stops his work
in my pc xp sp2 2.8hz 1giga ram it takes about 12 minutes for ashserv to stop using the cpu so much , then everything is perfect

i hope this helps to find a way for avast to reduce or eliminate the problem

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 83029
  • No support PMs thanks
Re: ashserv.exe big cpu occupancy related to ?
« Reply #1 on: May 01, 2008, 05:08:32 PM »
The rootkit scan needs to compare two sets of data as you found.

However, I don't notice any impact on my system which is no speed freak. If as you say, you are doing nothing, how does it slow your system.

What you are seeing doesn't seem to be the rootkit scan but something else (as your system is effectively more powerful than mine), so we need to find what else is going on.

Have (or did) you another AV installed in this system, if so what was it and how did you get rid of it ?
What other security based software do you have (especially that which is also running) ?

Is the avast ' a ' icon rotating during this high CPU (what percentage is attributed to ashServ.exe) ?

What sensitivity do you have the Standard Shield on (normal is the default) ?
WinXP ProSP3/ Core2Duo E8300/ 4GB Ram/ avast! free 18.5.2342/ Firefox ESR, uBlock Origin, uMatrix/ MailWasher Pro7.11.0/ DropMyRights/ WinPatrol+/ Drive Image 7.1/ SnagIt 10.0/ avast! mobile security
Windows 10 Home 1909 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 20.2.2401 (build 20.2.5130.570) UI-1.0.505/ WinPatrol+/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro

Offline pinuccio

  • Jr. Member
  • **
  • Posts: 25
Re: ashserv.exe big cpu occupancy related to ?
« Reply #2 on: May 01, 2008, 05:44:02 PM »
i made several tryes , after the ashserv occupancy grows up if i navigate or do other things i notice that the pc is slower

i have no other av or similar programs and only necessary programs running in task manager , explorer , ashdp , cfmon
i had avg 3 years ago ,uninstalled in the classical way

normal or high has no influence  , the icon is not rotating(obvious i'm doing nothing ) ,after two minutes i see the hd working and ashserv starts growing in occupancy

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 83029
  • No support PMs thanks
Re: ashserv.exe big cpu occupancy related to ?
« Reply #3 on: May 01, 2008, 06:22:51 PM »
The reason for asking about the sensitivity is if you had it on High it would be scanning more files. However, if the icon isn't rotating then it may have stalled as the rootkit scan should take seconds rather than minutes.

- Vlk, always says that the guidelines for solving of the problem "ashServ.exe using too much CPU" has always been the same:

1. Check if the avast tray icon is spinning (while CPU usage is high)

2. If it is, click it (wait for the dialog box to open), and check which file is being scanned (the Last Scanned field); the Scanned Count value should be increasing (spinning icon means a scan is in progress)

3. Find out which of the providers is scanning the file (click "Details" button and check out the Last Scanned value for each of the providers). The most common providers that may cause this are Standard Shield, P2P Shield and IM Shield.

Again this may not be to helpful as you say the avast icon isn't rotating, but it is worth checking.

Short of that revealing anything I would suggest a clean reinstall.

Download the latest version of avast http://www.avast.com/eng/download-avast-home.html and save it to your HDD, somewhere you can find it again. Use that when you reinstall.

Download the avast! Uninstall Utility, find it here and save it to your HDD.

Now uninstall (see below) using the Add Remove programs, reboot, run the avast Uninstall Utility, reboot, install the latest version, reboot.

It may be necessary to disable the avast! Self-Defence module (Program Settings, Troubleshooting section) if you are unable to uninstall using the Add Remove Programs before running the Uninstall Utility. Or, boot into safe-mode and start aswClear.exe (the uninstall utility) from there.
WinXP ProSP3/ Core2Duo E8300/ 4GB Ram/ avast! free 18.5.2342/ Firefox ESR, uBlock Origin, uMatrix/ MailWasher Pro7.11.0/ DropMyRights/ WinPatrol+/ Drive Image 7.1/ SnagIt 10.0/ avast! mobile security
Windows 10 Home 1909 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 20.2.2401 (build 20.2.5130.570) UI-1.0.505/ WinPatrol+/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67275
Re: ashserv.exe big cpu occupancy related to ?
« Reply #4 on: May 02, 2008, 03:35:07 AM »
"The new rootkit scan happens about two minutes after your desktop is up as it needs to compare what windows API shows against what is hidden, so it shouldn't get in the way too much"
Where did you read this?
I wish I had a more configurable situation here... can't we delay some minutes?

after two minutes i see the hd working and ashserv starts growing in occupancy
Does an 'i' icon appear? Isn't VRDB set to be generated when the computer is idle?

Besides this, you can follow David's suggestions as well.
The best things in life are free.

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 83029
  • No support PMs thanks
Re: ashserv.exe big cpu occupancy related to ?
« Reply #5 on: May 02, 2008, 02:21:36 PM »
"The new rootkit scan happens about two minutes after your desktop is up as it needs to compare what windows API shows against what is hidden, so it shouldn't get in the way too much"
Where did you read this?

This is something that I said in another topic, and it relates to something either Vlk or Igor said in explanation of the rootkit scan. I can't recall the topic now but I do remember it being stated that it runs after two minutes as there needs to be a delay, otherwise the scan might happen too soon before a rootkit is established so wouldn't appear in the comparison.

I don't know if a value in the avast4.ini file would be a particularly good idea.
1. it would then be possible to start it earlier possibly missing a rootkit not yet established.
2. the longer you delay it the more programs that would be running and some of those might throw up interesting results (not least an alert), by the fact that they are hidden (for legitimate reasons).

I think the Rootkit detection alert needs to be looked at as it isn't too clear if something is a rootkit or just suspicious/hidden. We have already seen this user confusion in the forums.
WinXP ProSP3/ Core2Duo E8300/ 4GB Ram/ avast! free 18.5.2342/ Firefox ESR, uBlock Origin, uMatrix/ MailWasher Pro7.11.0/ DropMyRights/ WinPatrol+/ Drive Image 7.1/ SnagIt 10.0/ avast! mobile security
Windows 10 Home 1909 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 20.2.2401 (build 20.2.5130.570) UI-1.0.505/ WinPatrol+/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67275
Re: ashserv.exe big cpu occupancy related to ?
« Reply #6 on: May 02, 2008, 02:26:32 PM »
I don't know if a value in the avast4.ini file would be a particularly good idea.
Each computer has a different startup profile... stablishing two minutes without a possible change for this is, imho, a big mistake. It will make boot time longer and, in some cases, will mess the boot/login... you can bet it.

I think the Rootkit detection alert needs to be looked at as it isn't too clear if something is a rootkit or just suspicious/hidden. We have already seen this user confusion in the forums.
We'll have new messages in the next program update (I have already translated them).
The best things in life are free.

Offline alanrf

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 3867
  • Just an avast user
Re: ashserv.exe big cpu occupancy related to ?
« Reply #7 on: May 02, 2008, 02:43:25 PM »
Quote
in my pc xp sp2 2.8hz 1giga ram it takes about 12 minutes for ashserv to stop using the cpu so much , then everything is perfect

I have to doubt that this has anything to do with a rootkit scan at all.  If, the information here is anywhere near correct there is some other problem.  I have no issues of this kind (12 minutes!) on my old XP SP2 system (1Ghz and 512Mb). 
« Last Edit: May 02, 2008, 02:48:06 PM by alanrf »

Offline Rumpel

  • Avast Evangelist
  • Advanced Poster
  • ***
  • Posts: 953
  • The poster formerly known as - Rumpelstiltskin®
Re: ashserv.exe big cpu occupancy related to ?
« Reply #8 on: May 02, 2008, 03:03:47 PM »
"The new rootkit scan happens about two minutes after your desktop is up as it needs to compare what windows API shows against what is hidden, so it shouldn't get in the way too much"
Where did you read this?
This is something that I said in another topic, and it relates to something either Vlk or Igor said in explanation of the rootkit scan.
I think you must mean this message.
The rootkit scan runs a few minutes after the desktop loads (it's a rootkit scan - looking for active rootkits (= hidden files, processes, ...); so, there's actually no point in trying to load as soon as possible, because if the rootkit is not yet active - it's not hidden, and it wouldn't get detected, at least not as a rootkit).

The boot-time scanner has also been improved, regarding the detection of hidden files (should the rootkit already be loaded at the time boot-time scanner runs).


Quote
in my pc xp sp2 2.8hz 1giga ram it takes about 12 minutes for ashserv to stop using the cpu so much , then everything is perfect

I have to doubt that this has anything to do with a rootkit scan at all.  If, the information here is anywhere near correct there is some other problem.  I have no issues of this kind (12 minutes!) on my old XP SP2 system (1Ghz and 512Mb). 
We've got a similar system (XPSP2 2.0ghz CPU 1gb memory) here but it takes no more than a few minutes.

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67275
Re: ashserv.exe big cpu occupancy related to ?
« Reply #9 on: May 02, 2008, 03:08:40 PM »
The rootkit scan runs a few minutes after the desktop loads (it's a rootkit scan - looking for active rootkits (= hidden files, processes, ...); so, there's actually no point in trying to load as soon as possible, because if the rootkit is not yet active - it's not hidden, and it wouldn't get detected, at least not as a rootkit).
Igor, can't this be configurated?  :(
The best things in life are free.

Offline alanrf

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 3867
  • Just an avast user
Re: ashserv.exe big cpu occupancy related to ?
« Reply #10 on: May 02, 2008, 03:26:56 PM »
Please don't take this the wrong way Tech ... but what has the timing got to do with this?

Surely the problem here is not the timing of the rootkit scan but what is happening on this system that is taking up so much CPU.  On my systems this scan takes seconds not many minutes.

The user is not going to like the scan at any time if it makes the system so slow. 

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11745
    • AVAST Software
Re: ashserv.exe big cpu occupancy related to ?
« Reply #11 on: May 02, 2008, 05:10:11 PM »
Tech:
[AntiRootkit]
WaitOnStart=time_in_seconds

pinuccio: What if you run
<avast-path>\ashQuick.exe "<RTK>SUPERQUICK"
- how long does the scan take?

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67275
Re: ashserv.exe big cpu occupancy related to ?
« Reply #12 on: May 02, 2008, 05:26:06 PM »
The best things in life are free.

Offline pinuccio

  • Jr. Member
  • **
  • Posts: 25
Re: ashserv.exe big cpu occupancy related to ?
« Reply #13 on: May 02, 2008, 06:26:24 PM »
Tech:
[AntiRootkit]
WaitOnStart=time_in_seconds

pinuccio: What if you run
<avast-path>\ashQuick.exe "<RTK>SUPERQUICK"
- how long does the scan take?


cannot make it work , don't find the route
c:\programmi\ alvill....

Offline pinuccio

  • Jr. Member
  • **
  • Posts: 25
Re: ashserv.exe big cpu occupancy related to ?
« Reply #14 on: May 02, 2008, 06:34:39 PM »
strange
probably i have just realized avast has never scanned my mail in 3 years
i had "outlook-excange" in avast , never seen the icon of mail in work and no written confirmation in mails sent
in the last avast installed there is "internet mail" and now works even with "outlook-excange" terminated , but i use outlook express not mail in internet , with "internet mail" i now see that mails are scanned

"outlook-excange" doesn't work with outlook express ?