Memory leak: ashWebSv.exe bloats to over 70MB (up to 120MB)

[alanrf]

I have been browsing on this Win XP Pro SP3 system for the last three plus hours ... I also  have the same options selected in the Webshield as you.

See below my current task manager display.  What I am doing wrong that I do not see the "bloat" you report?

I would really like to try to reproduce the problem you are reporting.



 

[VanguardLH]

Was that with the "intelligent streaming scan" option enabled or disabled?

Was Internet Explorer still loaded or already exited when you show that memory value?
UPDATE: Oops, didn't see firefox.exe (FF) was loaded.  I only use iexplore.exe (IE).

How many web pages did you ever have at a maximum that were concurrently open in tabs?  In my test, I went up to 24 (just because I had a favorites group with that many).  Actually I got up to 42 concurrently loaded tabs but that was I doing an overview trying to find the cause rather than when I decided to test with the same suite of web sites with various config settings in Avast's Web Shield when it was running and also terminated.  I don't know what Firefox has.  Plus you need to do the test with Internet Explorer since that the web browser under test when ashWebSv.exe was noticed to retain memory.  If there is a difference in how ashWebSv.exe handles its memory management between Firefox and Internet Explorer, and since the problem (here) is with Internet Explorer, you could be masking out the problem by not using the web browser with which ashWebSv.exe has problems.  I haven't tested with FireFox.

Create a favorites test group in IE.  The group that I used had the following web sites within it (4 were removed since testing because they no longer exist, like CastleCops):
http://www.wilderssecurity.com/forumdisplay.php?f=65
http://forums.altiris.com/default.aspx
http://forum.avast.com/
http://www.daemon-tools.cc/dtcc/announcements.php
http://boards.diynetwork.com/
http://www.dslreports.com/
http://dvdshrink.org/forum/viewforum.php?f=1
http://www.fatwallet.com/
http://forums.fedoraforum.org/index.php?
http://groups.google.com/group/Google-Groups-Guide
http://community.mcafee.com/
http://www.wilderssecurity.com/forumdisplay.php?f=100
http://forums.spybot.info/
http://forum.spamcop.net/forums/
http://www.spampalforums.org/phpBB2/index.php
http://forum.storagecraft.com/Community/forums/
http://www.bbs.legacycentral.org/
http://forums.truecrypt.org/index.php
http://communities.vmware.com/
http://groups.yahoo.com/

Open Task Manager and show its Processes tab.  Sort the list by process name (so it doesn't jump around as CPU usage and memory consumption vary).  Highlight the ashWebSv.exe process to watch it.  With no web browser loaded, check the memory consumption by ashWebSv.exe.  In the first round of testing, have the "intelligent streaming scan" option enabled.

Load the web browser but not to any page (i.e., use about:blank or about:tabs).

After creating the favorites group with all these shortcuts, click on the group and click the right-arrow for that group which then loads all shortcuts within a group.  This will concurrently load the 20 web sites, each into its own tab.  Wait until all tabs load their pages.  You can use the Performance tab in Task Manager to see when network traffic ceases.  Look at the memory used by ashWebSv.exe. 

Right-click on the first tab (about:blank or about:tabs) and select to Close Other Tabs.  You're left with just the blank tab.  Look at the memory used by ashWebSv.exe.

Again click on the arrow for the group to have all web pages within it load into separate tabs.  Check the memory used by ashWebSv.exe.

Right-click on the blank tab, Close Other tabs, and check the memory used by ashWebSv.exe.  Load all the web pages for the group in separate tabs and check the memory used by ashWebSv.exe.  Do this as many times as you want to monitor any memory growth by ashWebSv.exe, if it returns to its prior memory footprint when no pages are loaded, and if there appears to be some threshold to which memory is released but doesn't go all the way back down to its prior value when you first opened the web browser (with only a blank tab). 

This testing has you check the memory footprint with pages loaded and with them removed.  However, after you see the network traffic has ceased, another test would be to see if the memory gets released immediately thereafter since obviously there is no more traffic going throught Avast's HTTP proxy (Web Shield).

After bouncing around by loading a bunch of web pages and unloading them, and repeating this cycle for, say, 10 times, how much memory is used by ashWebSv.exe?  With the web browser still loaded but displaying only a blank tab, does it ever return to it memory footprint when the browser was first opened (with a blank tab)?  Does the memory footprint change (reduce) after you unload the web browser?

Then redo the testing with "intelligent streaming scan" disabled.

[alanrf]

I will work through the test you propose.  However, please be aware that avast has no real awareness of the browser your system uses.  I do not want to mislead anyone here (for most users with default settings) avast scans only the http accesses of a list of processes that the avast team deems should be intercepted (including most well known browsers).  To the very best of my knowledge beyond that all http accesses are treated, irrespective of source, identically.  So, there should be no difference between my Firefox and your IE.

Further to that and it may - or not- have some impact, I have an option set in my avast4.ini that tells avast that I wish to override the avast team's decision on which processes' http accesses to intercept to say that I want all http accesses, irrespective of their process origin, scanned by avast.

[Lito]

I've been noticing the same thing randomly in the past days. My ashwebsv.exe process is using 70 MB of memory with no browsers open, only XChat and Miranda running.



As I said, it happens completely random, I cannot tell the steps to reproduce this behaviour. If I terminate the process it goes back to normal (iexplore running because I was writing this post ):



Win XP SP3 here with the "intelligent stream scanning" option enabled.

[lukor]

Hello guys,

thanks for your systematic approach to this issue, especially thanks to Vanguard.

Is however a little bit complicated to make any judgements based solely on the very vague and unclear definition of what exactly do those columns in Task Manager mean. Furthermore the meaning of the memory related columns has changed between XP and Vista. I suggest using "Process Explorer" for comparing actual memory usage of ashWebSv.exe process.

The "private bytes" is the column that interests us most!

In the Task manager the "Mem Usage" column shows just the working set of the process at the specific time. This can be lowered artificially (the process itself can ask the OS the be swapped to the page file - if it wants to please users and spin the disk a bit). This value can also lower down when other memory hungry apps need the memory and causing all other process to be swapped out -- this does not mean that WebShield (or other process) would be releasing any memory during that operation. This value also includes shared memory between processes and memory mapped files, so actually I don't know how to seriously interpret its meaning.

Here is how it looks on my system after several weeks of running. You can see the number from process explorer and task manager differ quite a bit.

Lukas

EDIT: you can also use tcpview to spot the exact time when Internet Explorer closes the connections with WebShield. I have tried your test, open all tabs and closing them - remaining with just on "about:blank" tab, but still IE keeps the connections alive for some time -- to save the possible overhead of reconnecting them again in the future (in the optimistic guess that you might revisit the same hosts again). For me it takes about 10 minutes until all connections are closed. Then the memory returns back to the same value (26.4 on different system - XP). See pic. No futher change when the browser is finally closed.

[lukor]

Vanguard,
when playing with the "Process Explorer" you might also post here the list of loaded DLLs in the WebShield's process. I might be known for hating LSP DLL's inside WebShied since they might be allocating memory (besides other things I hate as well  ).

L.