ashwebsv.exe stays connected to websites after browser is closed?

[Vlk]

I'm a bit confused - is this all about the connections in the TIME_WAIT and CLOSE_WAIT states?

In any case, I'd recommend the OP to update to the latest avast program version (4.8.1335) and post a new capture from port explorer.

Thanks
Vlk

[billman1037]

I'm a bit confused - is this all about the connections in the TIME_WAIT and CLOSE_WAIT states?

In any case, I'd recommend the OP to update to the latest avast program version (4.8.1335) and post a new capture from port explorer.

Thanks
Vlk

I updated to avast program version (4.8.1335)...and no go

It's random IP addresses that are listening through ashwebsv.exe...I really don't think it has anything to do with one particular IP because as I remember from the past several days it has been various ones.  I could be here forever trying to list each one cause it's different everytime.

Thats part of the problem TIME_WAIT and CLOSE_WAIT states because they never close.  The main problem is having open ports as you can see port 80 through ashwebsv.exe.

As stated before, normal behavior on all programs is once they are closed the connections are closed.

Here is another capture:

[billman1037]

also, that screen capture was an hour after I had already closed firefox.

[alanrf]

billman1037,

in the address bar of Firefox can you please enter:

about:config

and then tell us the value of your Firefox setting network.http.keep-alive.timeout?

[billman1037]

Firefox setting network.http.keep-alive.timeout is the default setting as with my other pc.  I have not touched that.

I spoke wrong earlier that it's not a particular ip...cause i think that could be the problem.  Though it's probably many ip's (ones that avast considers harmful). 

I went to Facebook, closed firefox , and everything closed in ashwebsv.exe except one instance of 127.0.0.1 which is normal cause I have it running.

Now, as far as Ebay and certain other sites (I don't remember the ones from the past several days).  I'm thinking for some reason ashwebsv.exe gets stuck on a particular ip for example the 2 shown earlier:
209.62.180.191 (Double Click) and 66.235.132.145 (stat.esomniture.com)

....and when I close out firefox, ashwebsv.exe will sit on the IP it considers trouble and won't close.  Unless I terminate the webshield and start it again.

[alanrf]

Ah,

now I think that we may really be getting somewhere ...

Is Facebook something that you tend to keep open all the time?

[alanrf]

Vlk

I'm a bit confused - is this all about the connections in the TIME_WAIT and CLOSE_WAIT states?

Yes, you are confused and no it has nothing whatsoever to do with those states. 

I hope that I may be right in saying as Agatha Christie's great creation, Hercule Poirot, might ... "the little grey cells ... they work ... and they tell me the answer".

But we shall all have to be gathered in the cabin or the drawing room for the revelation (or to put it another way ... give me time to marshall my thoughts and put it in a way that might make some sense).

[billman1037]

The problem is not my web browser.  Once that is closed it is closed.  It is ashwebsv.exe that continues to stay open even after firefox closes.  If you look at my logs, you can see that there is no instance of firefox because it was closed.

However, you can see ashwebsv.exe in the logs because it continues to remain open to the previous IP's that I was previously viewing with firefox.

ashwebsv.exe will continue to remain open until I terminate it by terminating the web shield and restarting it again.  I left ashwebsv.exe alone for over 24hours after I had closed firefox (as per my intial post) and it never closed itself.

[alanrf]

billman1037 ,

thanks for your speculation ... but you, noticeably, failed to answer my question ... please answer it.

I went to Facebook, closed firefox , and everything closed in ashwebsv.exe except one instance of 127.0.0.1 which is normal cause I have it running.

As I asked you before ...

Is Facebook something that you tend to keep open all the time?

[billman1037]

billman1037 ,

thanks for your speculation ... but you, noticeably, failed to answer my question ... please answer it.

I went to Facebook, closed firefox , and everything closed in ashwebsv.exe except one instance of 127.0.0.1 which is normal cause I have it running.

As I asked you before ...

Is Facebook something that you tend to keep open all the time?

NO....Sorry, I thought that was obvious from my previous explanation.  Since I said that firefox was closed.

[alanrf]

I went to Facebook, closed firefox , and everything closed in ashwebsv.exe except one instance of 127.0.0.1 which is normal cause I have it running

.

Can you explain this post then please?

[billman1037]

Ok...I am not sure where you are going with this.

I was naming an example of an instance where ashwebsv.exe did work properly.  That is when I used firefox to go to the site facebook.com.  Then I closed firefox and ashwebsv.exe closed properly.  The way it should.

Now as far as everthing I have described before..that would be my problem.

[alanrf]

Let's be clear please ...

you have told us that there are ashWebSv.exe connections that have been maintained for many hours (to quote you more than 24 hours) ... so one has to presume it is not hard to reproduce these conditions and then, after a visit to Facebook, all these long lived connections disappeared?

If I have mis-quoted you please accept my apology and correct the mis-interpretation I have.

I am trying my best to understand this problem and, if in my power, to reproduce it and support you ... so I seek your help. 

[billman1037]

I think I have made myself very clear in the previous posts.

but I will try again.  There are some instances where ashwebsv.exe does work correctly and others where it does not.

Now, if I go to ebay and click around in the site yes the problem will be replicated.  However, some sites do work correctly as per my example with facebook.com.

You should be able to see the problem in the logs that were posted.

[billman1037]

do you have diamondcs port explorer? or some sort of port scanner?