I have a customer's Laptop here, It's Pentium-III with Windows XP Home running on it.
They have Avast! installed on-it and the anomaly exists with this here setup. I've uninstalled Avast! and re-booted and ran the Avast! Clean-up utility, and re-booted again before re-installing the latest official Avast! package.
I've noticed right from the very beginning of the Windows session, avast! Web Shield, four instances of it shown in Windows Task Manager. These instances are rapidly taking up more and more memory and continues on. After watching for many, many minutes I then see avast.setup appearing and shortly afterwards three more instances of Web Shield appears in Task Manager. avast.setup instantly easts up much memory and continues to increase, avast.setup disappears and re-appears and disappears several times. avast.setup always shows to be cycling through a-lot of CPU, finally long after, like about almost 16 or so minutes later some Web Shield instances disappears. Around 19minutes in, avast.setup is disappeared for a minute or two and Web Shield is down to one instance and then disappears. Avast! now informs me of the updated definitions. And now things seems more responsive, but there isn't an instance running of Web Shield. I went into the Avast! 'On-Access Protection Control', and view the state of Avast! Web Shield in the list of 'Installed providers', and the information shown ... Web Shield Version 4.8-1335, Scanned count 0, Run time 20:23+. The Start button was disabled, Pause and Terminate buttons were active and Web Shield set for Sensitivity level - 'Normal'. Web Shield entry in the list of 'Installed providers' was the usual bolded self. And now when I rebooted into Windows and visiting Windows Task Manager doesn't reveal multiple instances of Web Shield, .. even after doing some browsing.
At this point it's almost seemed like some sort of internal conflict with avast automatic updater and Web Shield. I decided to simply uninstall Avast, re-boot and re-install Avast and to finish it off, I edited the <avast>\data\avast4.ini file to include the Web Shield logging entry and re-boot again.
Upon re-boot it was instant, four ashWebSv.exe instances appears, behaving the identical way as before, with basically everything staying the same until the final stages where it drops to one instance of ashWebSv.exe and remains active. When Avast automatically updates the definitions, I re-boot and when back into Windows things are running smoothly and speedy as if nothing has ever happened with Avast!.
... Now I do remember seeing avast.setup in Windows Task Manager when they experienced major computer slow downs and Avast! had several instances of Web Shield running. I cannot tell you though if every single customer who had Avast! and the Avast! Web Shield anomaly had avast.setup showing in Windows Task Manager.
And by the way, terminating Web Shield after the final stage, and visiting <avast>\data\ folder, both files avast4.ini and ashwebsv.ws were 0bytes for filesize ... I guess there's no point in e-mailing these files then?
Regards,
Phant0m``