Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: xenopii on January 07, 2006, 04:13:52 PM

Title: Avast conflict causing Windows Explorer crashes?
Post by: xenopii on January 07, 2006, 04:13:52 PM
Hi. I installed Avast 4 Home a few days ago, and I LOVE WebShield! But that same day, Windows Explorer started crashing on my system. ("Windows Explorer has encountered a problem and must shut down...") I've uninstalled Avast, and reinstalled AVG, but the problem persisted. Then, through reading this forum and doing some checking, I discovered that not only in the Avast screensaver still selectable (although I can't find the file, itself), but aswBoot.exe and aswRdr.sys were still on my computer, too. I've deleted aswBoot.exe, as another thread on this forum has indicated it was safe to do so, but have left aswRdr.sys in place until I get confirmation that it, too, is safe to delete. Windows Explorer still crashes.

A little background: I've been using Windows XP for all of two months. The computer I bought came with Norton Internet Security installed. When it gave me problems, I switched to AVG, then the recent WMF exploit prompted me to switch to Avast. I uninstalled each AV program, and restarted, before installing another, but I did so through Add/Remove Programs and looking for leftover folders in Programs and in Application Data, not through editing the registry (which sounds fairly intimidating) or through any special removal tools (which I've only become aware of since my Windows Explorer problem began). Is there any possibility that leftover bits of Norton or AVG could have conflicted with Avast and produced these crashes? My system ran very smoothly before Avast was installed, and I'm at a loss for any other way that the problem could have started.

I really don't want to have to resort to system restore. I've emailed Avast support, but haven't heard back yet. Any advice you could provide would be appreciated.
Title: Re: Avast conflict causing Windows Explorer crashes?
Post by: Lisandro on January 07, 2006, 05:44:22 PM
Hi. I installed Avast 4 Home a few days ago, and I LOVE WebShield! But that same day, Windows Explorer started crashing on my system. ("Windows Explorer has encountered a problem and must shut down...") I've uninstalled Avast, and reinstalled AVG, but the problem persisted.
So, it does not seem to be avast related...

Then, through reading this forum and doing some checking, I discovered that not only in the Avast screensaver still selectable (although I can't find the file, itself), but aswBoot.exe and aswRdr.sys were still on my computer, too. I've deleted aswBoot.exe, as another thread on this forum has indicated it was safe to do so, but have left aswRdr.sys in place until I get confirmation that it, too, is safe to delete. Windows Explorer still crashes.
How do you uninstall avast? Through Control Panel > Add/Remove programs?

A little background: I've been using Windows XP for all of two months. The computer I bought came with Norton Internet Security installed. When it gave me problems, I switched to AVG, then the recent WMF exploit prompted me to switch to Avast. I uninstalled each AV program, and restarted, before installing another, but I did so through Add/Remove Programs and looking for leftover folders in Programs and in Application Data, not through editing the registry (which sounds fairly intimidating) or through any special removal tools (which I've only become aware of since my Windows Explorer problem began). Is there any possibility that leftover bits of Norton or AVG could have conflicted with Avast and produced these crashes? My system ran very smoothly before Avast was installed, and I'm at a loss for any other way that the problem could have started.
In fact, I see no reason to change from AVG to avast just because WMF exploit...
Well, you seem to change of antivirus very often and files / registry keys could have been left behind.
Did you have Norton Antivirus or only the firewall (NIS)?
AVG should bring no problem on uninstalling (anyway, some registry will be left behind). NAV is problematic: http://www.claymania.com/av-uninstall.html.
See: http://forum.avast.com/index.php?topic=12169.0
Manual Removal NAV 2004 (http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2004020909040706?Open&src=&docid=2001092114452606&nsf=nav.nsf&view=docid&dtype=&prod=&ver=&osv=&osv_lvl=)
Manual Removal NAV 2003 or earlier (http://service1.symantec.com/SUPPORT/nav.nsf/docid/2001092114452606)
Manual Removal NAV 2005 (http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2005033108162039)
Title: Re: Avast conflict causing Windows Explorer crashes?
Post by: DavidR on January 07, 2006, 05:49:29 PM
Norton gets into absolutly everywhere and may have left some remnants when you uninstalled it.

A link worth looking at which is a program removal tool, which can remove the remnants of a number of different Norton Programs:
Removing your Norton program using SymNRT (http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2005033108162039?Open&src=&docid=2001092114452606&nsf=nav.nsf&view=docid&dtype=&prod=&ver=&osv=&osv_lvl=)
Title: Re: Avast conflict causing Windows Explorer crashes?
Post by: xenopii on January 07, 2006, 06:37:01 PM
Thanks! I've run SymNRT with no problems, opened My Computer and navigated through my Programs folder a bit without crashing. I'm hoping it fixed the problem.

Tech: I uninstalled Avast through Control Panel>Add Remove Programs, then deleted the folder that was left behind in the Programs folder. After I realized that it didn't solve the problem, I tried to run Avast's uninstall tool, but it asked me to locate the Avast folder, and since I'd already deleted it, I couldn't do that. (In my defense, I've run Mac OS 9 for the past five years. Deleting applications under that system was a lot less complicated than it seems to be on Windows XP.)

I'm not certain, at this point, if I had Norton AV or just the firewall. I do know that NIS was there. I replaced it at the suggestion of the tech guy from my ISP, because I was having trouble connecting to the internet. I removed whatever I could find in Programs and in Application Data that said Norton or Symantec, first through Add/Remove Programs, then by looking through the folders.

As an aside, I switched to Avast from AVG after reading about how Avast missed only one variant of the WMF exploit, while AVG missed 59. It seemed like a really good idea, at the time, and I'd like to try it again, if I can get this problem cleared up.

Last question: Is it safe to manually delete aswRdr.sys from c\windows\system32\drivers?
Title: Re: Avast conflict causing Windows Explorer crashes?
Post by: DavidR on January 07, 2006, 07:01:26 PM
If you have removed avast, then manually deleting aswRdr.sys wouldn't hurt. However, removing a file from a windows system folder would likely result in a copy of it being saved by system restore.

Leaving it there and reinstalling avast (now you have run the NAV removal tool) should also be OK.
Title: Re: Avast conflict causing Windows Explorer crashes?
Post by: Lisandro on January 07, 2006, 07:05:17 PM
Tech: I uninstalled Avast through Control Panel>Add Remove Programs, then deleted the folder that was left behind in the Programs folder. After I realized that it didn't solve the problem, I tried to run Avast's uninstall tool, but it asked me to locate the Avast folder, and since I'd already deleted it, I couldn't do that.
Create an empty folder and redirect it to there.
The folder and the registry keys will be deleted.

I'm not certain, at this point, if I had Norton AV or just the firewall.
Check these registry keys and post the contents here:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\VirtualDeviceDrivers\\VDD
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\VirtualDeviceDrivers\\VDD

Last question: Is it safe to manually delete aswRdr.sys from c\windows\system32\drivers?
Can you first search your registry and see if you have any key related or redirected to aswRdr.sys ?
Title: Re: Avast conflict causing Windows Explorer crashes?
Post by: xenopii on January 07, 2006, 09:53:05 PM
Searching the registry for aswRdr.sys returned nothing.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\VitraulDeviceDrivers\\VDD and HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\VurtualDeviceDrivers\\VDD both say the same thing: REG_MULTI_SZ. (Assuming that I did this correctly, and that that is what you're looking for.)

I created an empty folder and pointed aswclear to it, then restarted after it finished. I still have aswRdr.sys in c:\windows\system32\drivers, however. I plan to manually delete that, restart again, and see if that finally fixes it. (Windows Explorer crashed again after my last post.)

Even if this doesn't correct the problem, I appreciate the help.
Title: Re: Avast conflict causing Windows Explorer crashes?
Post by: Lisandro on January 07, 2006, 10:00:59 PM
And that that is what you're looking for.
No, I was asking about the content, drivers, of the VDD value. Look at the picture.
Do you have Symantec\S32EVNT1.DLL listed there?

I plan to manually delete that, restart again, and see if that finally fixes it. (Windows Explorer crashed again after my last post.)
Do not delete, better move the file to your desktop just to be sure.
Title: Re: Avast conflict causing Windows Explorer crashes?
Post by: xenopii on January 08, 2006, 12:12:45 AM
Are you using a third-party app? I've right-clicked, double-clicked, and hunted through the menu with VDD selected, and I can't get a window like that to come up in RegEdit. I've also spent hours Googling to try to find out how to do it, but I haven't found much there, either. Here's what I can tell you: In the window with VirtualDeviceDrivers highlighted on the left, the right pane looks like this:

NameValueData
(default)REG_SZ(value not set)
VDDREG_MULTI_SZ

This applies in both CurrentControlSet and ControlSet001. I browsed through the Software subkey while I had RegEdit open, and noticed that the Data columns in some of those subkeys looked more like the information you asked for (C:\ addresses). The data fields for the VDDs are blank. In any case, I'm hoping this answers the question.

Thanks for the heads-up on not deleting aswRdr.
Title: Re: Avast conflict causing Windows Explorer crashes?
Post by: Dwarden on January 08, 2006, 12:17:56 AM
just curious ... installed latest DivX / Xvid at same time ? :)
Title: Re: Avast conflict causing Windows Explorer crashes?
Post by: xenopii on January 08, 2006, 02:14:35 AM
just curious ... installed latest DivX / Xvid at same time ? :)

Neither, unless both codecs come with Irfanview, which I'm currently suspicious of (along with Microsoft AntiSpyware, the Royale theme, and one wallpaper that doesn't show in the wallpaper-changing preview thingie) due to both the timing of this whole mess and my increasingly-painful lack of tech-savvy.
Title: Re: Avast conflict causing Windows Explorer crashes?
Post by: Lisandro on January 08, 2006, 02:50:56 AM
The data fields for the VDDs are blank.
Please, go there and delete the value if it is blank.
Maybe it's not blank... Two groups of zeros... I'm not sure, just a guess...

Check all related Windows Registry keys:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\VirtualDeviceDrivers\\VDD
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\VirtualDeviceDrivers\\VDD
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\VirtualDeviceDrivers\\VDD
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\VirtualDeviceDrivers\\VDD
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Control\VirtualDeviceDrivers\\VDD

How to NOT solve the problem: http://forum.avast.com/index.php?topic=259.msg3478#msg3478

How to SOLVE it: http://forum.avast.com/index.php?topic=738.msg3628#msg3628

I was introducing my 1st post here in avast! forums with a similar problem:
http://forum.avast.com/index.php?topic=707.msg3417#msg3417

Last thing, I use Registrar Lite (http://www.resplendence.com/reglite)  :)
Title: Re: Avast conflict causing Windows Explorer crashes?
Post by: xenopii on January 08, 2006, 04:34:51 AM
Here's what exported from RegEdit:

Key Name:          HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\VirtualDeviceDrivers
Class Name:        <NO CLASS>
Last Write Time:   1/5/2006 - 4:20 PM
Value 0
  Name:            VDD
  Type:            REG_MULTI_SZ
  Data:           

Key Name:          HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\VirtualDeviceDrivers
Class Name:        <NO CLASS>
Last Write Time:   1/5/2006 - 4:20 PM
Value 0
  Name:            VDD
  Type:            REG_MULTI_SZ
  Data:           

Key Name:          HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\VirtualDeviceDrivers
Class Name:        <NO CLASS>
Last Write Time:   1/5/2006 - 4:20 PM
Value 0
  Name:            VDD
  Type:            REG_MULTI_SZ
  Data:           


Apparently, I have no ControlSet002 or 004. 1/5/2006 was the day that I switched back from Avast to AVG. So... Delete them? Or try another method to make sure they don't have the string, 0, 0, string, 0, string, 0, 0 problem?


Title: Re: Avast conflict causing Windows Explorer crashes?
Post by: Lisandro on January 08, 2006, 01:09:01 PM
Apparently, I have no ControlSet002 or 004. 1/5/2006 was the day that I switched back from Avast to AVG. So... Delete them? Or try another method to make sure they don't have the string, 0, 0, string, 0, string, 0, 0 problem?
Most probably the three keys are empty as the first one should be from Symantec avoiding the last ones to be added.
In your case you have nothing... really don't seem to be the problem.

Are you sure you're using the last avast version to install? 4.6.744

Three posts that could help:

There is an updated copy of the aswrdr.sys driver. Till the new version is ready, you can download it from here:
http://www2.asw.cz/~rypacek/aswrdr691.zip
 
The zip file contains two files, aswrdr.sys and aswrdr.sum. Copy both these files into C:\windows\system32\drivers\ folder and also into C:\Program Files\Alwil Software\Avast4\Setup\INF\. You will have to restart the PC in order for changes to take place. The "aswrdr.sys" is the updated copy of the driver, the "aswrdr.sum" is there to prevent avast! automatic updates to replace the file with the official version 4.6.691. When we release this fix with new avast! version, the update program will automatically replace both these files (the aswrdr.sum will be deleted).

Please send a couple of (newest) files from the \windows\minidump folder to rypacek@avast.com.

As you figured, all outound HTTP connections are "routed" thru ashWebSv.exe. This is called "transparent proxying". There are no registry keys used to configure this. The magic is done by a kernel-mode avast component (a device driver) called  aswRdr.sys. Previous versions of avast had the same functionality (for the purpose of mail scanning) implemented inside aswTdi.sys which is now being used solely for the Network Shield.
Title: Re: Avast conflict causing Windows Explorer crashes?
Post by: xenopii on January 08, 2006, 03:54:04 PM

Are you sure you're using the last avast version to install? 4.6.744

Yes. I downloaded (from the Avast website) on January 4th, and the last revision was December 20th.

I haven't had a crash since 11:59 yesterday morning, and it's 8:30am, now. Maybe cleaning up from both NIS and Avast installations fixed it? I want to wait a couple of days to be sure (since the problem has been intermittent), then try to re-install Avast. Thanks to you guys, if the problem re-occurs after re-installation, I know how to properly uninstall.

Tech: Thanks for prodding me to peek at the registry. I'm prone to installing and uninstalling a lot of programs, so I'm sure the registry is something I need to look at from time to time.
Title: Re: Avast conflict causing Windows Explorer crashes?
Post by: igor on January 08, 2006, 11:19:52 PM
If you get another crash, please post some more details about the problem (from the error window - at least the faulting module and address).
Title: Re: Avast conflict causing Windows Explorer crashes?
Post by: xenopii on January 09, 2006, 03:14:47 PM
In my error logs, the first problem was Avast-related:

"Faulting application ashsimp2.exe, version 4.6.739.0, faulting module unknown,
version 0.0.0.0, fault address 0x64b861df."

The next one was at Fault bucket 253480604.

Most of the crashes that happened after that were in explorer.exe:

"Faulting application explorer.exe, version 6.0.2900.2180, faulting module ntdll.dll,
version 5.1.2600.2180, fault address 0x000111de." (The .dll on these varies, but ntdll.dll is the most frequent one.)

When trying to debug the Windows Explorer crashes, I would also get these:

"Faulting application drwtsn32.exe, version 5.1.2600.0, faulting module dbghelp.dll,  version 5.1.2600.2180, fault address 0x0001295d."

And there was also one at Fault bucket 00733296.

Eventually, errors like this started coming up:

"Acrobat IE Helper: Expolrer.EXE - Application Error: The instruction at "0x5ad94d42" referenced memory at "0x3443464d." The memory could not be read."

I gave up on small fixes yesterday. I tried system restore, and rolled it back to the day before the problems started. Explorer still crashed, so last night, I called HP tech support. They had me run scannow, which also didn't correct it, then chkdsk. They said that if chkdsk didn't fix it, the next step is re-installing the system. At this point, I'm just waiting to see if the problem persists.
Title: Re: Avast conflict causing Windows Explorer crashes?
Post by: Lisandro on January 09, 2006, 09:04:09 PM
Did you install any other antivirus or security program in your computer?
PrevX, ProcessGuard, WinPatrol, etc.?


Expolrer.EXE
Is this a typo or it's really expolrer.exe and not explorer.exe.
Expolrer.exe: http://www.google.com/search?sourceid=navclient&ie=UTF-8&q=expolrer%2Eexe
Title: Re: Avast conflict causing Windows Explorer crashes?
Post by: xenopii on January 09, 2006, 11:05:15 PM
Re: Security programs: The system came with NIS. I switched to AVG the next day. I've used Spybot Search & Destroy for a few weeks (on-demand only; no TeaTimer), and added the Microsoft AntiSpyware Beta a few days before switching from AVG to Avast. I'm using the firewall that came with XP. I haven't worked up to installing anything that seems too complicated.

Re: Expolrer.exe: Yeah, that's a typo. (Those, I'm good at.) It should say explorer.exe.
Title: Re: Avast conflict causing Windows Explorer crashes?
Post by: Lisandro on January 10, 2006, 01:51:25 AM
Please, go to folder \windows\minidump and send the newest (recent) .mdmp files for analysis.
Better if you can compress (zip) them and add some information about the BSOD and the link for this thread.  ;)

Send an email to any of these addresses:
vlk (at) avast.com
rypacek (at) asw.cz

Please, show a link to this thread.
Title: Re: Avast conflict causing Windows Explorer crashes?
Post by: xenopii on January 10, 2006, 02:18:11 AM
Sorry, Tech, but I don't have a \windows\minidump folder.  ???  Nothing turns up in SuperFinder, either, whether I search for the minidump folder or for .mdmp files.
Title: Re: Avast conflict causing Windows Explorer crashes?
Post by: Lisandro on January 10, 2006, 03:32:26 AM
Sorry, Tech, but I don't have a \windows\minidump folder.  ???  Nothing turns up in SuperFinder, either, whether I search for the minidump folder or for .mdmp files.
Any info in the avast logs?
Any dump file in these folders? C:\...\Avast4\Data\Log or C:\...\Avast4\Setup
Anything into Windows Events?
Title: Re: Avast conflict causing Windows Explorer crashes?
Post by: xenopii on January 10, 2006, 04:58:28 AM
I no longer have any Avast folders on my system. I deleted them when I uninstalled Avast (unless they are somewhere other than the Programs folder? Search returns nothing.) I sent a list of error descriptions to Avast support before I posted here, and someone emailed me back, today, stating that he wasn't sure if the problem was brought on by Avast and giving me instructions about how to do a repair using the Windows CD. I've also posted some of those errors here. This is the info on what is left in my error log. All of these, however, are from the past few days:


Error   1/9/2006   9:27:30 PM   Application Error   None    1000   
Faulting application explorer.exe, version 6.0.2900.2180, faulting module ntdll.dll, version 5.1.2600.2180, fault address 0x000106c3.

Error   1/9/2006   9:10:15 PM Application Error    None   1000   
Faulting application explorer.exe, version 6.0.2900.2180, faulting module ntdll.dll, version 5.1.2600.2180, fault address 0x000111de.

Error   1/8/2006   8:17:04 PM Application Error    None   1000   
Faulting application explorer.exe, version 6.0.2900.2180, faulting module ntdll.dll, version 5.1.2600.2180, fault address 0x000106c3.

Error   1/8/2006   7:27:38 PM Application Error  None   1000   
Faulting application explorer.exe, version 6.0.2900.2180, faulting module ntdll.dll, version 5.1.2600.2180, fault address 0x0002ae22.

Error   1/8/2006   5:38:34 PM Application Error  None   1000   
Faulting application explorer.exe, version 6.0.2900.2180, faulting module ntshrui.dll, version 5.1.2600.2180, fault address 0x000020ba.

Error   1/8/2006   4:47:40 PM Application Error  (100)   1000   
Faulting application drwtsn32.exe, version 5.1.2600.0, faulting module dbghelp.dll, version 5.1.2600.2180, fault address 0x0001295d.

Error   1/8/2006   11:28:45 AM  Application Error (100)   1000   
Faulting application drwtsn32.exe, version 5.1.2600.0, faulting module dbghelp.dll, version 5.1.2600.2180, fault address 0x0001295d.

Error   1/8/2006   11:28:36 AM  Application Error  None   1000   
Faulting application explorer.exe, version 6.0.2900.2180, faulting module ntdll.dll, version 5.1.2600.2180, fault address 0x0001220d.

Error   1/7/2006   11:59:04 AM  Application Error  None   1000   
Faulting application explorer.exe, version 6.0.2900.2180, faulting module ntshrui.dll, version 5.1.2600.2180, fault address 0x0000162f.

Error   1/7/2006   11:53:38 AM  Application Error  (100)   1000   
Faulting application drwtsn32.exe, version 5.1.2600.0, faulting module dbghelp.dll, version 5.1.2600.2180, fault address 0x0001295d.

Error   1/7/2006   11:53:27 AM   Application Error  None   1000   
Faulting application explorer.exe, version 6.0.2900.2180, faulting module ntdll.dll, version 5.1.2600.2180, fault address 0x00011f52.

Error   1/7/2006   8:19:13 AM  Application Error  None   1000   
Faulting application explorer.exe, version 6.0.2900.2180, faulting module ntdll.dll, version 5.1.2600.2180, fault address 0x0002ae22.

Error   1/6/2006   7:03:38 PM  Application Error  (100)   1000   
Faulting application drwtsn32.exe, version 5.1.2600.0, faulting module dbghelp.dll, version 5.1.2600.2180, fault address 0x0001295d.

Error   1/6/2006   6:46:12 PM  Application Error  None   1000   
Faulting application explorer.exe, version 6.0.2900.2180, faulting module ntdll.dll, version 5.1.2600.2180, fault address 0x000111de.

Error   1/6/2006   1:17:06 PM   Application Error  (100)   1000   
Faulting application drwtsn32.exe, version 5.1.2600.0, faulting module dbghelp.dll, version 5.1.2600.2180, fault address 0x0001295d.

Error   1/6/2006   1:16:56 PM  Application Error  None   1000   
Faulting application explorer.exe, version 6.0.2900.2180, faulting module uxtheme.dll, version 6.0.2900.2180, fault address 0x00002d80.

I'll email the guy who answered me today, with this info and a link to this thread. I still think it's suspicious that the problems began not long after installing Avast, but I don't see how that trigger could still be effecting my system after the system restore (to before I installed Avast) and the chkdsk repair. Again, I appreciate the help, and your patience. Sorry I don't understand  more about what I need to do.
Title: Re: Avast conflict causing Windows Explorer crashes?
Post by: Vlk on January 10, 2006, 09:09:25 AM
When Explorer crashes, you're given the chance to send the error information to Microsoft, right? Are you doing this? Because in some cases, it tells you the source of the problem (if known) after submitting the info.


If not, please start the "drwtsn32" program (just type drwtsn32 in the Run dialog), confirm with OK.
When Explorer crashes, a dump file should get generated (its path is visible in the DrWtsn32 GUI). Please send me that file for analysis.

Thanks
Vlk
Title: Re: Avast conflict causing Windows Explorer crashes?
Post by: cowland on March 03, 2006, 09:44:52 AM
I just got hit with the same problem 3 days ago after an Avast update.  I've never had another anti-virus program except Avast Home on this machine, and Windows Firewall as the only firewall.  So no nasty Norton problems - I learned that lesson years ago.  When I have the Avast On-Access Scanner on, it crashes IE, Netscape, and Opera within 2-3 web pages.  When I turn it off, I can surf forever without a problem.  Any ideas?

I'm attaching my latest drwtsn32.log file in case that helps.

Thanks for any help I can get - I don't want to have to go to some other anti-virus program!!!