Author Topic: Memory leak: ashWebSv.exe bloats to over 70MB (up to 120MB)  (Read 13028 times)

0 Members and 1 Guest are viewing this topic.

Offline VanguardLH

  • Jr. Member
  • **
  • Posts: 98
Memory leak: ashWebSv.exe bloats to over 70MB (up to 120MB)
« on: March 25, 2009, 06:08:12 AM »
Windows XP Professional SP-3
Internet Explorer 8
Avast! 4.8.1335 Home Edition
Windows Defender
Windows Firewall

After web browsing for awhile, I happen to notice that ashWebSv.exe had mushroomed to 72M - and that's even after Internet Explorer was closed!  There were no instances of iexplore.exe in memory and yet Avast's Web Shield was eating up over 70MB of memory. 

As a test, I load 24 web pages into Internet Explorer.  I watched ashWebSv.exe grow from 72MB to 122MB and the handle count go from 133 to 1201.  I exited Internet Explorer and ashWebSv.exe dropped back down to 72MB (not immediately but within several seconds) and its handle count went down to 133.

So ashWebSv.exe is retaining a large amount of physical memory even after the web browser has exited (there are no instances of iexplore.exe in memory).  The only way to get the Web Shield to relinquish the memory is to terminate that shield and restart it.  When the Web Shield first starts up, it consumes 1.7MB of memory and 92 handles.  I load the same 24 pages and ashWebSv's memory footprint grows to 48MB.  I unload those pages and reload them and ashWebSv grows to 72MB.  I do it again and memory goes up to 118MB.  These are the *same* web pages getting reloaded each time.  I then exit the web browser and ashWebSv.exe drops to only 72MB - and it stays there until the Web Shield gets terminated and restarted.

In the first place, why is the Web Shield eating up such a huge amount of memory?  Once it scans a web page, it's done.  If the user unloads a web page (navigates elsewhere in the same tab, closes the tab, or exits the web browser), obviously the Web Shield doesn't need to retain any information for a web page that is no longer displayed.  And, in the second place, why isn't the Web Shield releasing all that memory, especially after the web browser has exited?

--- UPDATE ---

I happened upon the "intelligent stream scanning" option.  It's help description says:

Use intelligent stream scanning. This option specifies how the downloaded files are scanned. If this option is enabled, the files being downloaded are scanned almost in real time. The pieces of data are scanned as soon as they arrive - and the next parts are downloaded only when the previous parts are verified to be virus-free. If you turn off this option, the whole files will be downloaded to a temporary folder first, and scanned by avast! afterwards (and if no virus is detected, they are passed on to the web browser that requested them).

So it would seem that enabling this option would keep response in the web browser as speedy as possible.  Obviously every user wants their security product to inflict as little lag as possible.  This option is enabled by default when Avast is installed.

I disabled this option and did the same test as before and got:

- No web browser loaded.  Terminate and restart Web Shield.
    Memory = 4.6MB (bigger than before for its initial size)
- Load the web browser and open the same 24 web pages.
    Memory = 46MB (rather large but perhaps dependent on the sizes of files retrieved for web page)
- Unload the 24 web pages in tabs.  Web browser still loaded.
    Memory = 46MB (does not relinquish memory although pages no longer displayed)
- Exit web browser.
    Memory = 9.6MB (not quite down to its initial size)

So there is less memory consumption but there is still a problem.  The memory is NOT getting relinquished when the web page is *done* being rendered (and after Avast should have already completed scanning all the files for the web page).  When the web page is unloaded (i.e., the tab is closed), Avast is still not relinquishing its memory.  Only until the web browser is exited does the Web Shield relinquish most of its memory.

This was a short test.  I did not check what happens to ashWebSv's memory footprint over time as the web browser is left open while continuously navigating to various sites throughout the entire day.  I also leave my computer powered up 24x7.  Sometimes I leave the browser open when I leave the computer (I do have to sleep, ya know) because I need to continue from where I was when I return.

So my choices are to leave "intelligent stream scanning" enabled in trying to eliminate lag in response when visiting numerous web sites along with letting the Web Shield consume *and* retain a large amount of physical memory, or I can disable this option and suffer slower response in the web browser to get the Web Shield to relinquish its memory but only after exiting from the web browser.

This is not a new problem, folks.  Users have reported here this problem going back over 3 years.  Has development on the Web Shield component gone stagnant in subsequent versions of Avast?
« Last Edit: March 25, 2009, 06:47:02 AM by VanguardLH »

Offline Vladimyr

  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 1639
  • Super(massive black hole) Poster
Re: Memory leak: ashWebSv.exe bloats to over 70MB (up to 120MB)
« Reply #1 on: March 25, 2009, 06:36:41 AM »
Strange  ???


I also have XP SP3 & Windows Firewall but not Windows Defender.
I've had 10 x  FF 3.0.7 tabs open all day (and now opened 2 x IE 8 RC1 - just because you mentioned it  ;) )

Checked Task Manager, 'Mem Usage' 2,988K, 'Peak Mem Usage' 47,896K (see attachment).


Are you getting slow performance from your PC?
Which utility indicates 70MB?
« Last Edit: March 25, 2009, 06:44:13 AM by Vladimyr »
There is a way that seems right to a man,
       but in the end it leads to death
.” - Proverbs 16:25

Offline VanguardLH

  • Jr. Member
  • **
  • Posts: 98
Re: Memory leak: ashWebSv.exe bloats to over 70MB (up to 120MB)
« Reply #2 on: March 25, 2009, 06:57:44 AM »
2 tabs may not be a sufficient test.  Memory consumption goes up with the number of concurrently loaded pages and the size of the content on those pages (i.e., all the files that get downloaded to your host to render that page).  Memory consumption was determined by looking in Task Manager's Processes tab.  I wasn't watching total memory consumption or anything else in the Performance tab.  I was only focused on the memory footprint for the over-sized ashWebSv.exe process. 

My host is not slow but then the problem is with the Web Shield, not with the Standard Shield.  I have not yet performed a performance test to determine by how much the Web Shield will delay delivery of the web page content before the web browser is allowed to render it.

With "intelligent stream scanning" enabled, the memory footprint is almost twice the size than when this option is disabled regarding what ashWebSv.exe drops back down to as its mimimum memory consumption (i.e., where it floats back down to and hovers there after unloading all web pages).  Whether 72Mb or 46MB, either is too large for holding onto memory for objects (files from the web page) that have already completed getting scanned by Avast - and is definitely too large when the web page isn't even loaded anymore.

I should not have to terminate and restart the Web Shield to recapture disused allocated memory (when the "intelligent stream scanning" option is enabled) or have to wait until the web browser gets exited to reclaim that memory (when the option is disabled).  The Web Shield is hanging onto memory that it no longer needs.  The objects have been scanned.  That scanning is done.  So release the memory buffers used to hold the content of those objects when they are no longer being scanned. 

Garbage collection [for memory] should not have to wait until the Web Shield gets restarted or until the web browser is exited.
« Last Edit: March 25, 2009, 06:59:15 AM by VanguardLH »

Offline Vladimyr

  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 1639
  • Super(massive black hole) Poster
Re: Memory leak: ashWebSv.exe bloats to over 70MB (up to 120MB)
« Reply #3 on: March 25, 2009, 07:06:43 AM »
Yes, I know others have reported this sort of thing before. (I feel sort-of happy to be left out). 
There is a way that seems right to a man,
       but in the end it leads to death
.” - Proverbs 16:25

Offline alanrf

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 3866
  • Just an avast user
Re: Memory leak: ashWebSv.exe bloats to over 70MB (up to 120MB)
« Reply #4 on: March 25, 2009, 07:14:30 AM »
The Webshield is, quite simply, standing in the place your browser would occupy if you were not using avast.  I think I must agree there is an extra overhead because avast is standing in for the browser before it passes off the same overhead you are causing to the browser itself.  

What it really means is that what is happening is your browsing choice and your wish to be protected.   There will be no avast overhead if you do not want the protection provided by avast.   Please understand that the the "overhead" you are seeing from avast is a storage to storage connection from avast to your browser (about the fastest connection your computer can make and the most easily handled by your operating system).  

If you would like a more detailed discussion on this then I am happy to continue.  If you wish to pursue your own theories then you are also welcome.  

Offline VanguardLH

  • Jr. Member
  • **
  • Posts: 98
Re: Memory leak: ashWebSv.exe bloats to over 70MB (up to 120MB)
« Reply #5 on: March 25, 2009, 07:46:04 AM »
I did a crude timing test on page load times under the following setups:
- Same set of 24 web sites, each opened in a tab inside the same instance of IE.
- Use the Networking tab in Task Manager to guage when there was traffic.
- Set polling rate to high (each horizontal increment in graph is 3 seconds).

I then repeatedly loaded the web page set and would count the number of horizontal increments in the graph.  I wanted to measure when there was network traffic to show the pages were loading and not include any setup time in IE for creating the tabs.  I then check the total page load time (as seen in the network graph to let me know when the pages actually started loading and when they were done loading) under the following scenarios:

- Web Shield = not running.
- Web Shield = running, intelligent stream scanning = disabled.
- Web Shield = running, intelligent stream scanning = enabled.

The total page load time was within 2 to 3 seconds of each other for all these tests.  So close that I'd say there was no impact from Web Shield on page load time, and there was no further impact by having the intelligent option enabled or disabled.

So I am impressed with the lack of performance hit in page load times when Web Shield is inuse.
But I am depressed at the lingering memory consumption.

The result was there was very little difference in the page load times

Offline VanguardLH

  • Jr. Member
  • **
  • Posts: 98
Re: Memory leak: ashWebSv.exe bloats to over 70MB (up to 120MB)
« Reply #6 on: March 25, 2009, 07:58:36 AM »
The Webshield is, quite simply, standing in the place your browser would occupy if you were not using avast.  I think I must agree there is an extra overhead because avast is standing in for the browser before it passes off the same overhead you are causing to the browser itself.  

What it really means is that what is happening is your browsing choice and your wish to be protected.   There will be no avast overhead if you do not want the protection provided by avast.   Please understand that the the "overhead" you are seeing from avast is a storage to storage connection from avast to your browser (about the fastest connection your computer can make and the most easily handled by your operating system).  

If you would like a more detailed discussion on this then I am happy to continue.  If you wish to pursue your own theories then you are also welcome.  

But unlike a web browser, Web Shield does not have to hold onto those memory objects as does a web browser because Avast isn't displaying the web page.  It just scans it.  Once an object (file) is scanned, just what more is Avast going to do about the object that has already been deposited on my host and which Avast did not alert was a problem?

You might be right in what you say.  I noticed the handle count for ashWebSv.exe goes way up when I load the page set used in my test.  The handle count went from 720 (in the first test, 133 in later tests) to 1201.  However, that handle count ALSO went back down to 133 but the memory consumption remained.  So unlike a web browser, Avast is keeping the memory allocated although the handles to the objects no longer exist.  That constitutes a memory leak.

Before: 72MB, 720 handles
During: 120MB, 1201 handles
After: 72MB, 133 handles

So Avast is dropping the handles for the objects it has completed its scanning but doesn't release the memory used to process the objects to which those handles were assigned.  Also, when the web browser has been exited, Avast still doesn't release that memory (when the intelligent streaming scan option is enabled).

I have come across a few other security programs that don't work well with Avast's Web Shield, like Threatfire.  Stopping Avast's Web Shield resolved the conflict.  So there is something odd in how the Web Shield operates. 

Very definitely I would like to know more.  It's possible some of it could be beyond my understanding but I can always do some research to see what I can figure out later.  There's been a lot of guessing in prior posts (and here) about why ashWebSv.exe eats up (and keeps like a chipmunk storing in its cheeks) the memory for which the related web pages have already been unloaded or even after exit of the web browser.  I'm definitely curious.  One of the big reasons why I keep coming back to Avast after trialing other products is the Web Shield protection (which has alerted me a few times about malicious content) and its URL blocking (so I don't need an over-sized firewall just for that).

« Last Edit: March 25, 2009, 08:02:47 AM by VanguardLH »

Offline alanrf

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 3866
  • Just an avast user
Re: Memory leak: ashWebSv.exe bloats to over 70MB (up to 120MB)
« Reply #7 on: March 25, 2009, 09:12:48 AM »
At the most simple level, were your theory true, then avast would continue to consume the highest level of memory ever reached.  This is demonstrably not the case ... the (ashWebSv.exe) avast memory use can and does decline ... is this not something you are able to observe?   
« Last Edit: March 25, 2009, 09:19:52 AM by alanrf »

Offline alanrf

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 3866
  • Just an avast user
Re: Memory leak: ashWebSv.exe bloats to over 70MB (up to 120MB)
« Reply #8 on: March 25, 2009, 09:36:33 AM »
Just a for example ... yes, I use Firefox not IE ...

Offline VanguardLH

  • Jr. Member
  • **
  • Posts: 98
Re: Memory leak: ashWebSv.exe bloats to over 70MB (up to 120MB)
« Reply #9 on: March 25, 2009, 09:58:20 AM »
As noted, ashWebSv.exe continues to consume ever more memory as more web pages are traversed.  It far outstrips what the web browser itself consumes.  When the web pages are unloaded, yes, memory consumption will fall but not back to the same level as before the web pages were loaded.  With the intelligent streaming scan option enabled, and once past 72 megabytes, memory consumed above that will get released and ashWebSv.exe falls back but only to 72 megabytes, not the 2 to 6 megabytes it had before all the web pages were loaded.  Memory goes up but only falls back down so far and which is still quite high.  With intelligent streaming scan disabled, memory will fall back close to the level before the web pages were loaded but only AFTER the web browser gets exited.

Code: [Select]
intelligent streaming scan = enabled

2-4MB ---(load pages)---> 72MB ---(load pages)---> ??MB
                                                     |
                            .----(unload pages)------'
                            |
                            '-----(load pages)---> ??MB
                                                     |
                            .----(unload pages)------'
                            |
                      (EXIT BROWSER)
                            |
                            V
                           72MB


intelligent streaming scan = disabled

2-4MB ---(load pages)---> 46MB ---(load pages)---> ??MB
                                                     |
                            .----(unload pages)------'
                            |
                            '-----(load pages)---> ??MB
                                                     |
                            .----(unload pages)------'
                            |
                      (EXIT BROWSER)
                            |
    9MB <-------------------'

While there is some fluctuation in the threshold values, the above is what I'm seeing regarding the lack of releasing memory.  When I start testing, ashWebSv.exe might be consuming anywhere from 1.7MB to 6MB.  The "72MB" threshold may be anywhere from 70-80MB.  The "46MB" threshold is about 42-48MB.  Tomorrow and with a different set of test pages, those thresholds might change.  The point is that memory does not get recovered after web pages are done downloading, after web pages are unloaded, and also after the web browser has been exited (when the intelligent option is enabled).

These are NOT peak memory usage values.  I don't have that column shown in the Processes tab of Task Manager.  This is the real memory consumption, the one shown in the Mem Usage column.  I haven't bothered to look at what is the pagefile consumption (Virtual Memory Size column) because I didn't happen to be showing that one when I did the testing.

Offline Vladimyr

  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 1639
  • Super(massive black hole) Poster
Re: Memory leak: ashWebSv.exe bloats to over 70MB (up to 120MB)
« Reply #10 on: March 25, 2009, 02:29:53 PM »
I'm out of touch with IE having not used it much since the release of FF 1.5 but I remember that earlier versions effectively "cached" everything in "Temporary Internet Files". Could it be something to do with differences in the way FF and IE store and render content?
There is a way that seems right to a man,
       but in the end it leads to death
.” - Proverbs 16:25

Offline VanguardLH

  • Jr. Member
  • **
  • Posts: 98
Re: Memory leak: ashWebSv.exe bloats to over 70MB (up to 120MB)
« Reply #11 on: March 25, 2009, 08:13:42 PM »
I've never found much detailed information regarding the Web Shield component other than at http://support.avast.com/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=19 which says:

Starting from the version 4.6. avast! comes with a new on-access scanning provider - Web Shield.
It is able to monitor and filter all HTTP traffic coming from the Web sites on the Internet. It’s implemented as a HTTP proxy running on your PC.
Connections from your Web browser are redirected to the Web Shield module. Web Shield in turn connects to the requested web server and while downloading the content it scans it for viruses and Trojans. Only the clean data is delivered to the browser, every malware is stopped before it gets saved on your PC.


Okay, but I doubt other HTTP proxies hang onto memory for buffering the web page content after it has been delivered to the web browser - unless Web Shield was behaving like a caching HTTP proxy.  But why?  How often do users hit the Refresh button?  When they do refresh, there is still network traffic to re-retrieve that web page so there appears no caching effect in Web Shield.  If Web Shield is doing any caching, it is doing a poor job (but, at least for me, thankfully it has [almost] no impact on web page load time from the web server).

Any users here of Proximitron, CC Proxy Server, or another HTTP proxy?  Does it consume gobs of memory as you continually retrieve more web pages, keep that memory after delivering that web content, keep it after the web page is no longer loaded in the web browser, and keep it after the web browser has exited?

Sidebar: I also found http://support.avast.com/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=22 which mentions some configuration of the Web Shield as a transparent proxy.  It listens on port 12080.  Sure enough, I saw that when using SysInternal's TCPview.
« Last Edit: March 25, 2009, 08:19:25 PM by VanguardLH »

Offline Mr.Agent

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 2769
  • Proud to be an avast! user.
Re: Memory leak: ashWebSv.exe bloats to over 70MB (up to 120MB)
« Reply #12 on: March 25, 2009, 08:18:57 PM »
I got Vista instead of your xp and all thing you said i didnt got any problem with that ! Its strange your thing ! Maybe a cause of a malware right ?

Offline VanguardLH

  • Jr. Member
  • **
  • Posts: 98
Re: Memory leak: ashWebSv.exe bloats to over 70MB (up to 120MB)
« Reply #13 on: March 25, 2009, 08:28:22 PM »
I got Vista instead of your xp and all thing you said i didnt got any problem with that ! Its strange your thing ! Maybe a cause of a malware right ?
Then it's been malware-caused for a very long time and afflicted other posters that have posted this same problem going back to Jan 2006 and ever since version 4.6.  Plus that wouldn't bode well of Avast's detection of the interferring pest if it has been going on that long.
« Last Edit: March 25, 2009, 08:29:56 PM by VanguardLH »

Offline Mr.Agent

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 2769
  • Proud to be an avast! user.
Re: Memory leak: ashWebSv.exe bloats to over 70MB (up to 120MB)
« Reply #14 on: March 25, 2009, 08:34:32 PM »
I just sayed like that but well im not sure he should contact a informatician or avast support for more info :)