Ashavast.exe - stalls as local user, causes multiple processes, runs CPU to 100%

[blue2]

I've recently installed Avast Home build 4.8.1169. It installed without a problem and seems to run fine with one exception: the Avast icon on the desktop which links to Ashavast.exe CANNOT be run as a local user. So I can't access the program interface, although I can access everything else via the system tray.

If the desktop icon is clicked on multiple times, it will open multiple processes of Ashavast.exe in task manager. When I had three open, the CPU was at 100% without any apparent activity, other than this process being stalled.

As Ashavast.exe can be run as the administrator or via the "Run As" command, it appears to be an issue with permissions and not with the application itself. Just in case, I tried the Repair option in Add/Remove, but that made no difference. So while I can right click and scan a file by the context menu, I can't schedule a scan without administrator permission?

Is this by design, a bug, a permission problem caused by using an optional skin, or something else?

[Lisandro]

ashAvast.exe needs admin rights, or elevation in Vista.
ashQuick.exe (the context menu scanning) doesn't.
It's not a but, it's like it works.
Do you have Vista or XP?

[blue2]

Thanks for that quick reply. Sorry, forgot to mention this was installed under XP Pro SP2, although I understand that SP3 won't be a problem.

I imagined that this might be by design, but could find no mention of it in the help file or through a quick google search. It's possible that I added the desktop link to All Users and the program perhaps defaults only to administrator.

What confused me was why I'd have to be an administrator or use the "Run As' command while a local user to schedule a scan? I wanted to have less knowledgeable members of my family run as local users, and it would still be nice to have them get into the habit of scheduling scans.

P.S. It would also be nice if this is by design, to NOT allow the process to even be opened. I got it up to 5 instances of ashavast.exe and I imagine that one could simply lock up a system by installing the icon on a local user profile that does not have permission to run it.

[Lisandro]

What confused me was why I'd have to be an administrator or use the "Run As' command while a local user to schedule a scan?

In Home version, there isn't a schedule possible... Are you using Windows Scheduler for it and ashquick.exe?
Scheduling is only available in Pro version.

[blue2]

Sorry, by "schedule" I meant to schedule a boot scan, or to run a HDD scan on a habitual basis (not as a formally scheduled task).

I assume one could use the Quick Scan via right click context menu to scan the entire HDD but was not sure if that uses the pre-set default configurations (e.g. scan archives, use heuristics, etc.)

I'll remove the Avast desktop icon from local user profiles because I don't think it's a good idea that it opens a process even though it can't continue without Admin. permission. As I demonstrated, a naive user could easily click on it many times and open up several processes that lock up the CPU, which can't be a good thing.

[igor]

No, ashAvast does not need administrator privileges, and it can be run under restricted user, as far as I know.

Please try to generate the dump of the frozen process (as described e.g. here, just change the process name) and send it to our FTP.
Thanks.

[Lisandro]

Sorry, by "schedule" I meant to schedule a boot scan, or to run a HDD scan on a habitual basis (not as a formally scheduled task).

Common users can't schedule the boot time scanning. But also is not a thing for daily basis...
But I think they can run a scanning into Windows, can't they?

I assume one could use the Quick Scan via right click context menu to scan the entire HDD but was not sure if that uses the pre-set default configurations (e.g. scan archives, use heuristics, etc.)

It's better to use the interface and run the scanning from there.
Although, ashQuick uses the deepest sensitivity, scanning archives.

[blue2]

No, ashAvast does not need administrator privileges, and it can be run under restricted user, as far as I know.

Please try to generate the dump of the frozen process (as described e.g. here, just change the process name) and send it to our FTP.
Thanks.

Well, it seemed odd to me to have an AV that would prevent a local user from running a scan. I could understand why you wouldn't want processes to be killed under a local user account (so malware couldn't turn off AV functionality).

Is the hangrep.exe  a standalone app or does it get installed/removed in Add/Remove programs? Can it be installed AND run under a local user account, since that is where the issue is occurring?

[igor]

It's just a standalone executable, and I don't see a reason why it shouldn't work (to dump executables the current user has started).

You may have to disable avast! self-defence feature from the Administrator account first (avast! settings / Troubleshooting page) - the process couldn't be dumped without it, I guess.
Now, I hope that disabling the self-defense won't "solve" the problem

[blue2]

Yes, it would be funny if that "solved" the problem. One never knows...

I checked the security settings on ahavast.exe and all users have permissions. I then thought I could probably find what DLLs are called and change the permissions on each of these to see which one might be the offending one requiring escalated permission. But messy fixes like that, particularly with an AV program, have the habit of causing unexpected, and usually undesirable, consequences.

Thanks for the suggestions. When I'm in the front of the other machine, I'll run the suggested hang executable and see what it generates.

[blue2]

Sorry for the dealy. Now that I have had access to the friend's machine I installed Avast on, I've created the dump file (ashAvast.exe.dmp) of the Ashavast process that stalls under a local user profile. I even deactivated all skins, but this too makes no difference.

However, following Vik's procedures, I am unable to upload this to your FTP site via your website (I don't use FTP) via drag and drop. Do you have an email or another way to upload this?

Thank you.

[DavidR]

What browser are you using ?
With firefox the drag and drop doesn't seem to work, but with IE or one of the IE clones the drag and drop does seem to work.

[blue2]

Good suggestion. I'll try that right now.

[blue2]

No luck. Tying to drag and drop to your web link using both Firefox and IE 7 results in a dialog box to save the file rather than uploading it to your FTP server via the web.

[DavidR]

Not my site I'm just an avast user like you.

Do you get something like this (my example IE6) when you paste the ftp link ftp://ftp.avast.com/incoming/ into IE7 address bar and click, see image ?

If so dragging the file from its location in windows explorer into the right pane, arrowed, in IE7 and it should upload automatically, you won't be able to see it in the folder that it has been uploaded to as you don't have permissions for that.