Author Topic: ashwebsv.exe stays connected to websites after browser is closed?  (Read 11910 times)

0 Members and 1 Guest are viewing this topic.

billman1037

  • Guest
I noticed on my port explorer, after I close my firefox browser.  ashwebsv.exe will stay connected until I actually go into webshield, terminate it and then restart it again.

I tested this a few times.  Went to some websites, closed firefox and let it sit for over 24hrs. and ashwebsv.exe stayed connected to the sites the entire time.  Any ideas on what is going on??

Online DavidR

  • Avast √úberevangelist
  • Certainly Bot
  • *****
  • Posts: 86683
  • No support PMs thanks
Re: ashwebsv.exe stays connected to websites after browser is closed?
« Reply #1 on: February 05, 2009, 09:32:18 PM »
Does your port explorer go to the lengths to say exactly what this connection is as the web shield is always listening on its localhost port 12080 and not actually connected externally.

See image, example of my firewall used ports and you can see the web shield and the internet mail, note they are listening on the localhost:loopback not physically connected. I am obviously on-line but there still isn't a connection as my activity is static whilst posting this.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 22.5.6015 (build 22.5.7263.730) UI 1.0.711/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline lukor

  • Administrator
  • Super Poster
  • ***
  • Posts: 1884
    • AVAST Software
Re: ashwebsv.exe stays connected to websites after browser is closed?
« Reply #2 on: February 05, 2009, 09:40:59 PM »
Do you have any URLs we can test this on? Does that happen regularly or just from time to time ?

billman1037

  • Guest
Re: ashwebsv.exe stays connected to websites after browser is closed?
« Reply #3 on: February 05, 2009, 10:38:50 PM »
It's not loopback 127.0.0.1  It has the actual ip address and say established.  I just did it with Ebay.  I will do again and see if can post a pic of the activity.

Offline alanrf

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 3866
  • Just an avast user
Re: ashwebsv.exe stays connected to websites after browser is closed?
« Reply #4 on: February 05, 2009, 11:10:28 PM »
I can replicate this to some extent but I should say that I am currently using the avast beta release.

Normal case:

I open Firefox and go to the ebay site.  Using Current Ports I see the connections to ebay from ashWebSv.exe.

I close Firefox - Current Ports shows the connections instantly come down and go to Close Wait state.

Partial replication:

I open Firefox and view the avast site.

I open another instance of Firefox and in that instance of Firefox I go to the ebay site. Using Current Ports I see the connections to ebay from ashWebSv.exe.

I close the instance of Firefox that is viewing the ebay site (the other instance of Firefox viewing the avast site is still open).  In this case the ashWebSv.exe connections to the ebay site are maintained in Established status for a number of minutes (5-10) before they close.  If, during the period, I terminate the instance of Firefox browsing the avast site then all the connections (including the lingering ebay ones) instantly close.       


Offline alanrf

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 3866
  • Just an avast user
Re: ashwebsv.exe stays connected to websites after browser is closed?
« Reply #5 on: February 05, 2009, 11:20:02 PM »
billman1037,

do you use the Firefox Preloader on your system?

The same problem can also be seen if the Firefox Preloader is used.  In this case when the user terminates a Firefox session the Firefox process remains loaded. So in this case:

I open Firefox and go to the ebay site.  Using Current Ports I see the connections to ebay from ashWebSv.exe.

I close Firefox but the ashWebSv.exe connections to the ebay site are maintained in Established status for a number of minutes (5-10) before they close.

Later edit: I just repeated the test and timed the delay in connection termination in my system - it is 4 minutes. 


 
« Last Edit: February 05, 2009, 11:47:18 PM by alanrf »

billman1037

  • Guest
Re: ashwebsv.exe stays connected to websites after browser is closed?
« Reply #6 on: February 05, 2009, 11:32:09 PM »
Nope...I don't use firefox preloader.

billman1037

  • Guest
Re: ashwebsv.exe stays connected to websites after browser is closed?
« Reply #7 on: February 05, 2009, 11:55:10 PM »
Ok no pic..but here is one that has been active for over an hour after shutting down firefox:

209.62.180.191  - which I looked up on coolwhois and shows it to be double click, inc.

billman1037

  • Guest
Re: ashwebsv.exe stays connected to websites after browser is closed?
« Reply #8 on: February 06, 2009, 12:35:04 AM »
Ok...same deal....209.62.180.191 still connected.
« Last Edit: February 06, 2009, 12:49:49 AM by billman1037 »

Offline alanrf

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 3866
  • Just an avast user
Re: ashwebsv.exe stays connected to websites after browser is closed?
« Reply #9 on: February 06, 2009, 01:02:23 AM »
Well no it isn't ... here is the file you just posted and then withdrew from your post ...

Code: [Select]
--------------------------------------------------------------------------------------------------------------------------------------------------
|     NAME     |     CREATION     |  PID | PROTOCOL | LOCAL ADDRESS | LOCAL PORT | REMOTE ADDRESS | REMOTE PORT | PORT STATUS |  SENT   |  RECVD |
--------------------------------------------------------------------------------------------------------------------------------------------------
|  SYSTEM      |        ---       |   4  |    TCP   |    0.0.0.0    |    445     |     0.0.0.0    |    0        |  LISTENING  |   ---   |   ---  |
|  SYSTEM      |        ---       |   4  |    TCP   |  192.168.1.7  |    139     |     0.0.0.0    |    0        |  LISTENING  |   ---   |   ---  |
|  SYSTEM      |        ---       |   4  |    UDP   |  192.168.1.7  |    137     |     *.*.*.*    |    *        |  LISTENING  |   ---   |   ---  |
|  SYSTEM      |        ---       |   4  |    UDP   |    0.0.0.0    |    445     |     *.*.*.*    |    *        |  LISTENING  |   ---   |   ---  |
|  SYSTEM      |        ---       |   4  |    UDP   |  192.168.1.7  |    138     |     *.*.*.*    |    *        |  LISTENING  |   ---   |   ---  |
| alg.exe      | 12:25 05/02/2009 |  240 |    TCP   |   127.0.0.1   |    1025    |     0.0.0.0    |    0        |  LISTENING  |   0/0   |   0/0  |
| lsass.exe    | 12:25 05/02/2009 |  728 |    UDP   |    0.0.0.0    |    500     |     *.*.*.*    |    *        |  LISTENING  |   0/0   |   0/0  |
| lsass.exe    | 12:25 05/02/2009 |  728 |    UDP   |    0.0.0.0    |    4500    |     *.*.*.*    |    *        |  LISTENING  |   0/0   |   0/0  |
| svchost.exe  | 12:25 05/02/2009 |  992 |    UDP   |  192.168.1.7  |    123     |     *.*.*.*    |    *        |  LISTENING  |   0/0   |   0/0  |
| svchost.exe  | 12:25 05/02/2009 |  992 |    UDP   |   127.0.0.1   |    123     |     *.*.*.*    |    *        |  LISTENING  |   0/0   |   0/0  |
| svchost.exe  | 13:39 05/02/2009 | 1040 |    UDP   |    0.0.0.0    |    49659   |     4.2.2.2    |    53       |  LISTENING  |  1/40   |  1/70  |
| svchost.exe  | 15:24 05/02/2009 | 1040 |    UDP   |    0.0.0.0    |    51426   |     4.2.2.2    |    53       |  LISTENING  |  1/36   |  1/76  |
| svchost.exe  | 15:51 05/02/2009 | 1040 |    UDP   |    0.0.0.0    |    57518   |     4.2.2.2    |    53       |  LISTENING  |  1/33   |  1/80  |
| vsmon.exe    | 12:25 05/02/2009 | 1684 |   Other  |    0.0.0.0    |    0       |   192.168.1.1  |    0        |  LISTENING  |  1/40   |   0/0  |
| ashwebsv.exe | 16:35 05/02/2009 | 3364 |    TCP   |   127.0.0.1   |    12080   |     0.0.0.0    |    0        |  LISTENING  |   0/0   |   0/0  |
| ashwebsv.exe | 17:01 05/02/2009 | 3364 |    TCP   |  192.168.1.7  |    3681    |   8.14.104.66  |    80       |  TIME_WAIT  |  1/506  |   1/1  |
| ashwebsv.exe | 17:01 05/02/2009 | 3364 |    TCP   |   127.0.0.1   |    12080   |    127.0.0.1   |    3745     |  TIME_WAIT  | 2/1109  |   1/1  |
| ashwebsv.exe | 17:02 05/02/2009 | 3364 |    TCP   |  192.168.1.7  |    3998    |   8.14.104.67  |    80       |  TIME_WAIT  |  2/957  | 2/1161 |
| ashwebsv.exe | 17:04 05/02/2009 | 3364 |    TCP   |   127.0.0.1   |    12080   |    127.0.0.1   |    4143     |  TIME_WAIT  |  2/374  |   1/1  |
| ashwebsv.exe | 17:05 05/02/2009 | 3364 |    TCP   |  192.168.1.7  |    4252    |  74.125.242.25 |    80       | CLOSE_WAIT  |  1/573  |  1/417 |
| ashwebsv.exe | 17:05 05/02/2009 | 3364 |    TCP   |  192.168.1.7  |    4255    |  76.13.218.11  |    80       | CLOSE_WAIT  |  1/507  |  1/717 |
| ashwebsv.exe | 17:21 05/02/2009 | 3364 |    TCP   |   127.0.0.1   |    12080   |    127.0.0.1   |    1384     |  LISTENING  | 5/1385  |   2/2  |
| ashwebsv.exe | 17:22 05/02/2009 | 3364 |    TCP   |  192.168.1.7  |    1535    | 209.62.180.191 |    80       |  LISTENING  |  1/505  |  1/737 |
| ashwebsv.exe | 17:22 05/02/2009 | 3364 |    TCP   |   127.0.0.1   |    12080   |    127.0.0.1   |    1624     | ESTABLISHED | 3/19900 |   3/3  |
--------------------------------------------------------------------------------------------------------------------------------------------------

If the connection was being maintained then the port status would be ESTABLISHED - it clearly is not.  I am not sure what PORT EXPLORER is reporting here with a LISTENING status.


billman1037

  • Guest
Re: ashwebsv.exe stays connected to websites after browser is closed?
« Reply #10 on: February 06, 2009, 01:24:15 AM »
thanks...I was trying to post my log like you did and screwed it up...that's why it was removed.

Listening is maintaining the connection...if you look at the packet information being transfered, you can see this.


billman1037

  • Guest
Re: ashwebsv.exe stays connected to websites after browser is closed?
« Reply #11 on: February 06, 2009, 01:30:37 AM »
Listening - all TCP sockets that have a status of LISTENING, showing all listening ports.
  Established - all TCP sockets that have a status of ESTABLISHED, showing all current connections.

So, the port is open and not closed.  Normal behavior would be like my firefox connections.  When I close firefox, the connections are closed and you don't see anything in port explorer.  So, still the same problem remains that ashwebsv.exe is not closing.

Offline alanrf

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 3866
  • Just an avast user
Re: ashwebsv.exe stays connected to websites after browser is closed?
« Reply #12 on: February 06, 2009, 01:39:56 AM »
Agreed there is an issue.

The avast team has just issued a new release of the program - as you can see from a few posts down.  I am using that new release.  I rather suspect that someone will suggest that you establish that the problem continues for you with the new release (even though I rather doubt it will change the condition you are seeing). 

You will note from the table you posted that a number of the connections that had been made by avast are in the proper closing status. 

Is there any consistency about the connections that do not close properly (like for doubleclick or for ebay)?

For now I cannot replicate the "LISTENING" issue.

billman1037

  • Guest
Re: ashwebsv.exe stays connected to websites after browser is closed?
« Reply #13 on: February 06, 2009, 02:03:06 AM »
I have had this problem with other sites but I didn't note the particular ip's.  The doubleclick was within Ebay.  I will have to keep note of more instances.

I just updated to the new release.  So, we will see.  I'll post back with more info.

Online DavidR

  • Avast √úberevangelist
  • Certainly Bot
  • *****
  • Posts: 86683
  • No support PMs thanks
Re: ashwebsv.exe stays connected to websites after browser is closed?
« Reply #14 on: February 06, 2009, 02:41:15 AM »
If you are using firefox I would suggest that you use adblock plus and NoScript as that kills the likes of doubleclick.net stone dead.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 22.5.6015 (build 22.5.7263.730) UI 1.0.711/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security