Multiple instances of AVAST modules in Taskmgr

[Jaygee]

I have 50 instances of ashMaiSv.exe and 50 instances of ashWebSv.exe listed in Windows Task Manager.  They range in size from 1,272k to 3,052k for ashMaiSv.exe and 1,536k to 3,580k for ashWebSv.exe.  When I first saw them propagating I was worried that they would eventually eat up all the memory and the system would lock up but when the count reached 50 they/it stopped propagating.  BTW there are 4 or 5 different sizes for each of the modules in question.  Does anyone have an idea why this would happen?

Thanks in advance,

Jay Gee

[DavidR]

The installation isn't correct. There should only be one occurrence of the avast processes in task manager, see image.

Have (or did) you another AV installed in this system, if so what was it and how did you get rid of it ?
What other security software do you have installed ?

I would suggest a clean reinstall (answer the other AV question):
Download the latest version of avast http://www.avast.com/eng/download-avast-home.html and save it to your HDD, somewhere you can find it again. Use that when you reinstall. Ensure that you scroll down and select the avast direct download link for the English version and not Cnet as that is for an on-line installation (not what you want to do).

Download the avast! Uninstall Utility, find it here and save it to your HDD.

• 1. Now uninstall (using add remove programs, if you can't do that start from the next step), reboot.
• 2. run the avast! Uninstall Utility, reboot.  If step 1 failed it may be necessary to run this from safe mode, once complete reboot into normal mode.
• 3. install the latest version, reboot.

[Jaygee]

Thanks for the reply.
2 years ago we dropped Norton/Symantec AV and went with Avast.  We used the uninstall that came with Norton.  We have been running Avast since and never had a problem.  We also noticed that in the taskmgr list it says the user is "unknown" for nearly every task.  A few say "System".  I ran a virus scan with Avast of the windows folder and subs and found three modules that were all part of a Trojan according to Avast.  We deleted them and rebooted but still have the multiple instances of the 2 Avast modules. We don;t use Outlook for email so we terminated that in Avast and I thought the ashMaiSv would go away from the task list but it did not.

I will follow your suggestion and I will do a complete scan of the system at boot time to make sure there is no malware around.  Hopefully this will clear up our misfortunes.

Thanks again,

Jay Gee

[micky77]

Download this program,(free) install, update,and run  a quick scan, please copy/paste the results.Thank you http://filehippo.com/download_malwarebytes_anti_malware/

[DavidR]

Whilst it has been a long time since you had Norton/Symantec it may still be worth running this tool. Though it is more for confirmation than anything.

A link worth looking at, which is a program removal tool that can remove the remnants of a number of different Norton Programs:
Removing your Norton program using SymNRT

Deletion isn't really a good first option (you have none left), 'first do no harm' don't delete, send virus to the chest and investigate.
There is no rush to delete anything from the chest, a protected area where it can do no harm. Anything that you send to the chest you should leave there for a few weeks. If after that time you have suffered no adverse effects from moving these to the chest, scan them again (inside the chest) and if they are still detected as viruses, delete them.

Run MBAM as suggested and post the results.

[Lisandro]

Can you try an installation from the scratch?

1. Uninstall avast from Control Panel first.
2. Boot.
3. Download the latest version of Avast Uninstall and use it for complete uninstallation. If, for any reason, you can't run it, try booting in Safe Mode and doing it from there.
4. Boot.
5. Download, save and install the latest avast! version. It will be good to accept the boot time scanning on next boot.
6. Boot.
7. Check and post the results.

[Jaygee]

I am going to go through the recommendations today but I first checked the Taskmgr list and found that the 50 instances are still there but the sizes have changed.  Today the ashMaiSv is ranging from 360k to 620k and ashWebSv is ranging from 376k to 648k; much smaller than 2 days ago.  No one has rebooted in between times and system seems stable.

Will post results later.

[DavidR]

Sizes aren't going to remain the same as it is based on working memory, which is obviously going to change.

[Jaygee]

I finished the recommended steps and just rebooted about 10 min ago.  So far I only have 18 instances (just checked again after starting IE8 and it is now up to 23 instances of each module, ashMaiSv and ashWebSv.)  I guess the problem is not solved and the number of instances will continue to increase.  Hopefully it will stop at 50 again.  The memory usage is higher again; ashMaiSv is 3044k to 3100k and ashWebSv is 3516k to 3556k.  (Just for grins I just checked again and while typing the above the count has increased to 29.) 

[Jaygee]

By the way, during the boottime scan there was one module infected.


Initialization of Chest files
------------------------------------------------------------------------------------------
Program will try to load all Chest files from the following server: (null)
FileID: 0000000001  Original file name: C:\Documents and Settings\Aloha\Local Settings\Temporary Internet Files\Content.IE5\K59KSU0F\antvrs.exe  File category: 1
FileID: 0000000002  Original file name: C:\WINDOWS\system32\kernel32.dll  File category: 0
FileID: 0000000003  Original file name: C:\WINDOWS\system32\winsock.dll  File category: 0
FileID: 0000000004  Original file name: C:\WINDOWS\system32\wsock32.dll  File category: 0
------------------------------------------------------------------------------------------
Action was completed successfully!

Explorer is showing all hidden and system files yet C:\Documents and Settings\Aloha\Local Settings\Temporary Internet Files

Does not appear when I open explorer.  It only shoes "Application Data" and "Temp" under Local Settings.

Any thoughts??

Thanks in advance

Jay Gee

[Jaygee]

It is now 45-50 minutes later and the count has reached 50 and holding.  I am curious (yet grateful) as to why the count stops at 50 instances for each module.  If I wanted to shut down each of these modules under normal circumstances (ie only one of each) where would I go in AVAST to do that?

I am also looking to solve another "problem?"
In taskmgr the "User Name" is "unknown" for all but a couple of tasks that say "SYSTEM"

I have searched Google and everything that is even close is from 2005 and before and doesn't exactly match my problem.

Thanks for any insights anyone can pass on.

Jay Gee

[micky77]

Have you run the program I suggested earlier ?
antvrs.exe is from AV2008 a nasty bit of work.I assume you have already removed this program

[Jaygee]

To All,

Here are the results of the MBAM scan.  YES it did find some remnants of the AV2008 that we fought a while back.

If this virus/trojan/malware is so old why doesn't AVAST find it?

========================================================================
Malwarebytes' Anti-Malware 1.38
Database version: 2379
Windows 5.1.2600 Service Pack 3

7/6/2009 9:56:30 AM
mbam-log-2009-07-06 (09-56-18).txt

Scan type: Quick Scan
Objects scanned: 123691
Time elapsed: 10 minute(s), 46 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 2
Folders Infected: 1
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

Folders Infected:
c:\documents and settings\Aloha\Application Data\AntiVirus (Rogue.AntiVirus2008) -> No action taken.

Files Infected:
c:\documents and settings\Aloha\application data\antivirus\antvrs.exe (Rogue.AntiVirus2008) -> No action taken.
C:\WINDOWS\system32\win32.exe (Backdoor.Bot) -> No action taken.
C:\WINDOWS\system32\iaxcfg32.dll (Trojan.Agent) -> No action taken.
==============================================================


Maybe the newest version of AVAST will catch more!

Thanks for your help.  At this point I haven't removed the selected items.  I will do so and reboot to see how we make out.

.
.

[DavidR]

Yes you should run MBAM again and allow it to remove them.

However, before you do send samples to avast to improve detection.

Send the sample to virus@avast.com zipped and password protected with the password in email body, a link to this topic might help and undetected malware in the subject.
 
Or you can also add the file to the User Files (File, Add) section of the avast chest (if it isn't already there) where it can do no harm and send it from there. A copy of the file/s will remain in the original location, so you will need to take further action and can remove/rename that.
 
Send it from the User Files section of the chest (select the file, right click, email to Alwil Software). It will be uploaded (not actually emailed) to avast when the next avast auto (or manual) update is done.

[Jaygee]

Sorry.
I already removed the items and re-booted before I saw your latest post.
Still getting multiple instances of ashMaiSv and ashWebSv
Any additional ideas will be much appreciated.

Thanks,

Jay Gee