AvastSvc.exe handle leak: Avast 6.0.1367

[donb6806]

AvastSvc.exe on my XP/sp3 desktop system currently has over 130K handles.

This appears to be similar to the handle leak reported in AvastNet.exe (see: http://forum.avast.com/index.php?topic=90156.msg717270#msg717270)

I am attaching the properties window from Process Explorer.

[igor]

Can you please dump the process (e.g. from Process Explorer itself) and upload the dump to ftp://ftp.avast.com/incoming ?
Thanks.

[Broken Hope]

Similar issue is happening on Windows 7 x64 too, the dump file appears to be huge though so not really wanting to upload it anywhere..

[DavidR]

The dump file should be able to be zipped, this should cut the size considerably, what size is it after zipping (7zip gives good compression) ?

[Broken Hope]

Around 80MB after zipping the dump file.

[Broken Hope]

Okay, I've uploaded the dump file.

[Broken Hope]

Actually thought I'd uploaded it, but it doesn't seem to complete the upload :/

[DavidR]

Did you give the upload a unique name, so they can identify it as yours ?

I also tend to create a text file (readme.txt) with any relevant information, avast topic URL, user name, etc. etc. in the zip file. Not to mention posting the name of the file you uploaded in the topic acts as another searchable reference.


You don't have read access on the incoming folder, so you won't see it there. Only if you uploaded it using an FTP program/process would you get confirmation that it was uploaded successfully.

[donb6806]

I am still trying to get a process dump.  When I tried ProcDump it froze my system and I had to reboot. 

I hope Broken Hope's dump shows something useful (it looks like the same symptom).

[bezerk]

I have the same handle leak problem myself.  Win7 Home premium 64-bit fully updated and using the free version of Avast 6.0.1367. Presently AvastSvc.exe (32-bit) is using a massive 138932 handles! Number two in line concerning handle usage is "System" with 4363.

Could the leak come from one or more 3rd party components Avast is using? Like SQLite, HTMLaylout, libPNG, UPX, Zlib etc...
  
EDIT:
Using Services to stop and then restart "avast! Antivirus" a.k.a. AvastSvc.exe - note that for security reasons I disconnect/connect my UTP cable during this operation - which btw only takes a few seconds, results in a handle count of a much more reasonable 900!

[DavidR]

No one can speculate, which is why the dump files (if they can be initiated) are requested.

[donb6806]

A newer version of Process Explorer allowed the process dump!

The number of handles is now much lower, but rapidly increasing.

The first dump had over 3K handles.

The second dump has over 12K handles (less than 6 hours later).

The FTP transfer is currently in progress.

The name of the file is:  AvastSvc_HandleDumps.7z

[Broken Hope]

Up to over 100k handles now, not sure how something like this gets past testing, especially since it doesn't seem just limited to this process either judging by the other thread.

[LairdDrambeg]

Is this issue now being addressed or is a Full(?) Dump file still required?  Incidentally when the Handle Count got up to 58,000 on my WinXP/SP3 system with 1GB memory, the network server stopped working and I got a System Event ID 2020 from Source Srv with "The server was unable to allocate from the system paged pool because the pool was empty."

When I look at the AvastSvc.exe handles with Process Explorer I see that there are multiple occurrences of the same handles, in particular the "defs" files, e.g., F:\Program Files\Alwil Software\Avast5\defs\11122102\s_idx.map as well as handles for the previous version of the "defs", e.g. F:\Program Files\Alwil Software\Avast5\defs\11122101\s_idx.map.  Perhaps there's a clue here?

[igor]

I believe the problem has been found, thanks for the dumps.