Avast WEBforum
Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: glnz on September 03, 2012, 04:29:23 AM
-
Like others here, Windows Event Manager shows me this about once a day now:
The avast! Antivirus service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.
Now, here's what's weird - this is occurring on a 25-hour cycle, exactly.
Here's when this has appeared recently - copied from Event Manager:
9/2/2012 6:02:08 AM
9/1/2012 5:02:08 AM
8/31/2012 4:02:09 AM
8/30/2012 3:02:09 AM
8/29/2012 2:02:09 AM
and so on.
WHAT IS THIS? A MALWARE THAT IS CYCLING ONE HOUR LATER EACH DAY WAITING TO CATCH ME DOING SOMETHING?
What do you all suggest I do?
I have WinXPPro SP3 on a Dell Optiplex 755 hooked up to Verizon DSL.
I love and use Avast Free 7.0.1466
I also have Ad-Aware Free 9.6.0 and of course Windows Malicious Program Removal Tool MRT.exe that I believe runs on reboot.
In my Scheduled Tasks, the Ad-Aware is set to update itself at 6:05am every day.
Also, in Scheduled Tasks, my Spybot S&D updates itself at 5:00am every day and re-Immunizes itself at 5:29am every day.
Only the Ad-Aware is constantly running - the Spybot S&D does not run except once a month I do a manual scan. TeaTimer is NOT on.
What do y'all think?
-
Get rid of Ad-Aware and SpyBot ( "note" you said spybot is not on but it updates and re-immunises every day ??? ) these will be your problem, you can use Malwarebytes instead - much better program :)
-
Craig - I've been using all for years - this is a new phenomenon. What explains the 25-hour pattern?
OK - I'll turn off Ad-Aware and reboot. Let's see whether I get the Avast turned off message at 7:02am.
-
Also if Spybot is updating and immunising every day then that means TeaTimer is on, both the programs you have there are quite outdated in there detection capabilities which is why i suggeted using Malwarebytes as it is far superiour in detection and removal.
-
Craig - TeaTimer is not on - just checked. My Task Schedule updates for Spybot are my own creation. Spybot does nothing unless I run it or update+Immunize it manually.
But before I start shutting off programs that seem to have kept me safe so far, please advise why you think the Avast shutoff is occurring on precisely a 25-hour schedule. Isn't that a clue?
-
Craig - TeaTimer is not on - just checked. My Task Schedule updates for Spybot are my own creation. Spybot does nothing unless I run it or update+Immunize it manually.
But before I start shutting off programs that seem to have kept me safe so far, please advise why you think the Avast shutoff is occurring on precisely a 25-hour schedule. Isn't that a clue?
The 25 hour thing doesn't tell me much as i haven't got a clue what on your system may be cycling every 25 hours, most problems that happen with avast always tend to be related to other security software so that is why i mentioned removing those two especially when there are better programs as mentioned that work great with avast.
-
***
If you have not yet, run a boot time scan with avast and report anything found.
***
-
Could it be, you run a task every hour, 24 hours a day, that makes 24 runs?
Should be 23 times, since 24:00h = 00.00h. You don't want to schedule that twice.
And then, why would avast terminate? And you'd have clashes 24 hours apart.
Sorry, nonsense. Start counting at 1.00h, last run at 24.00h is 24 runs.
Yet I still think there is some interval where the end of a period coincides with the start of the next.
Maybe same problem: http://social.technet.microsoft.com/Forums/en/winservergen/thread/13b6a6f4-8f6d-4c67-8f85-25c6da3480df (and that's a third EDIT)
EDIT 4 Look at that:
http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/schtasks.mspx?mfr=true "Hourly: modifier 1-23"
Seems they count 0-based.
-
Craig - TeaTimer is not on - just checked. My Task Schedule updates for Spybot are my own creation. Spybot does nothing unless I run it or update+Immunize it manually.
SpyBot Search & Destroy issues updates once a week. There is no need to check for updates and re-immunize daily. http://www.safer-networking.org/about/updates/ (http://www.safer-networking.org/about/updates/)
-
To all - First, thanks for taking an interest. I hope we'll find the answer.
Second, even though I turned Ad-Aware off
(by disabling the service called Lavasoft Ad-Aware Service "C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe" AND by unchecking the startup C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe)
and rebooted at 1am last night, the problem has occurred again, 25 hours after the last time.
Today, 9/3/2012, at 7:02:08 AM (which is 25 hours after last time), there is again this Event Manager entry: "The avast! Antivirus service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service."
By the way, just to be clear, Avast Free is running (both AvastSvc.exe and avastUI.exe). Event Manager shows it restarting five second later at 7:02:13 AM. The issue is that Avast stops for the 5-second period noted in Event Manager.
And, yes, I have re-checked both my Wndows Task Manager and CodeStuff Starter, and Ad-Aware is NOT running.
Kwartet has made an interesting observation. What he describes seems to be occurring for Google Update Service (gupdate). Every 25 hours, Event Manager shows three messages:
"The Google Update Service (gupdate) service was successfully sent a start control."
"The Google Update Service (gupdate) service entered the running state."
"The Google Update Service (gupdate) service entered the stopped state."
The Scheduled Tasks Properties for this activity are "Every 1 hour(s) from 1:08pm for 24 hours every day, starting 7/11/12". In Advanced, it's set to Repeat Task Every 1 hours with a Duration of 24 hours. But in Event Manager, it is running once every 25 hours.
However, please note that the above three entries regarding Google Update Service (gupdate) occur and finish 54 minutes BEFORE the 5-second Avast shutdown. My guess is they have nothing to do with each other. Also, there are no other Event Manager entries near the Avast shutdown.
Well, something is causing the 5-second Avast shutdown every 25 hours. I see nothing in my Scheduled Tasks that would do this, and Ad-aware was off this morning. Any ideas?
Thanks.
-
Do you have any unpXXXXXX files (with corresponding timestamps most likely) in C:\Documents and Settings\All Users\Application Data\AVAST Software\Avast\log ?
-
Igor - yes I do.
(By the way, the location in XP is "C:\Documents and Settings\All Users\Application Data\Alwil Software\Avast5\log".)
I have a file called unp207922365.tmp.mdmp created at the same time as the shutdown. It's rather large - 553KB. What should I do with it?
Also, error.log has entries that correspond with each of these events. The last two sets are the following:
Sun Sep 02 06:02:07 2012
-> topLevelExceptionFilter addr=7855b6df code=c0000005
Sun Sep 02 06:02:07 2012
-> Calling generateExceptionReport
Sun Sep 02 06:02:07 2012
-> Returning EXCEPTION_CONTINUE_SEARCH.
Sun Sep 02 06:02:08 2012
-> topLevelExceptionFilter addr=7855b6df code=c0000005
Sun Sep 02 06:02:08 2012
-> Returning EXCEPTION_CONTINUE_SEARCH.
Mon Sep 03 07:02:06 2012
-> topLevelExceptionFilter addr=7855b6df code=c0000005
Mon Sep 03 07:02:06 2012
-> Calling generateExceptionReport
Mon Sep 03 07:02:07 2012
-> Returning EXCEPTION_CONTINUE_SEARCH.
Mon Sep 03 07:02:08 2012
-> topLevelExceptionFilter addr=7855b6df code=c0000005
Mon Sep 03 07:02:08 2012
-> Returning EXCEPTION_CONTINUE_SEARCH.
What next? Thanks.
-
OK, if you have avast! installed since version 5 and updated ever since, you'll have Alwil Software, not Avast Software.
Can you please upload the file to ftp://ftp.avast.com/incoming (ftp://ftp.avast.com/incoming) ?
-
Igor - I've never uploaded to an ftp site before. How do I do that? Thanks.
-
You can open the mentioned URL in Windows Explorer (not Internet Explorer) - and then drag&drop the file onto the lower pane.
-
Igor: Done, I think. Thanks. Very interested to know what you find.
-
I opened a support ticket with the same problem back in May. Avast responded:
We have received and acknowledge your issue. Now we will analyze whether there is anything related to avast! that we could change, and if so we will provide a work-around or fix it in a future release. We will monitor how often this issue appears in our customer base and the impact on our market. If you have any additional information about the issue please let us know because it could shed more light on the issue and help us to solve it or identify the cause more quickly. Thank you for helping us to improve avast!
This was from 2nd level technical support ::)
I hope that the OP has better luck than I did.
-
Dear HorseFly: A few questions:
1) Did you have a precise 25-hour repeat cycle like me?
2) Did you check your Scheduled Tasks for anything possibly related? (But in my case there is nothing obvious anyway.)
3) Did you have any possibly conflicting programs like Ad-Aware? (But in my case I have already proven there's no conflict between Avast and Ad-Aware, at least not with my old, non-updated version of Ad-Aware.)
4) Did you check the error log and did you look for any unpXXXXXXXX.tmp.mdmp files, as Igor asked me to do?
5) Did you send anything to Avast's ftp site for analysis?
6) Are you still getting the 5-second shutoff?
What a way to spend Labor Day !!
-
Dear HorseFly: A few questions:
1) Did you have a precise 25-hour repeat cycle like me?
2) Did you check your Scheduled Tasks for anything possibly related? (But in my case there is nothing obvious anyway.)
3) Did you have any possibly conflicting programs like Ad-Aware? (But in my case I have already proven there's no conflict between Avast and Ad-Aware, at least not with my old, non-updated version of Ad-Aware.)
4) Did you check the error log and did you look for any unpXXXXXXXX.tmp.mdmp files, as Igor asked me to do?
5) Did you send anything to Avast's ftp site for analysis?
6) Are you still getting the 5-second shutoff?
What a way to spend Labor Day !!
0. My handle isn't HorseFly ???
1. Yes
2. Yes, nothing related
3. No
4. Yes, bunches of them
5. Yes, several times
6. Yes
BTW I'm running Windows 7 x64 SP1 and I've had this problem since the first version 7 release. I never had Avast! installed before that.
Also, if you take a look through the dump files you'll find that Avast! is hitting a null pointer in its own code IIRC.
-
Dear Igor - This problem might be an embarrassment to Avast - especially if Avast cannot find the cause - but a 5-second shutdown can be deadly. Five seconds is all the Russian mafia needs to ruin our lives. Please level with us - what is going on here? I, too, have posted about this before. When will there be a solution to this issue? Surely, the 25-hour cycle must be a good clue. Kwartet's observation above - and what I found for my settings for Google Update - must help you find why Avast is stumbling on precisely a 25-hour schedule. Where is your Sherlock Holmes?
Dear Flying Hoarse: What means "Avast! is hitting a null pointer in its own code IIRC"? If you have a moment, please explain for a non-tech such as myself.
Thanks to you both.
PS - Just completed a FULL scan by MalwareBytes - zero problems.
-
I checked the dump and I think I found a problem.
Could you please test a modified version of one avast! module to see if it makes any difference (that is, if the periodic crashing stops)?
To replace the module, the following needs to be done:
1. Download this archive (http://public.avast.com/supp/fix25.zip)
2. Disable avast! self-defense (by unchecking: Settings / Troubleshooting / Enable avast! self-defense module)
3. Navigate to avast! installation folder (by default, C:\Program Files\Avast Software\Avast) - e.g. in Windows Explorer, or any other file manager
4. Rename the file ashServ.dll to something else (e.g. ashServ2.dll)
5. Extract the content of the archive, downloaded in step 1, into the installation folder
6. Restart the avast! Antivirus service (or simply restart the machine)
7. Reenable the self-defense
Thanks!
-
@igor
Thanks for the patch. I have it installed and will let you know how it goes in a day or so... ;)
-
OK, Igor - trying it. The zip archive also included a file called ashServ.dll.sum , which I also extracted to C:\Program Files\Alwil Software\Avast5. Correct? Thanks.
-
Yes, that's OK.
-
Thanks. By the way, is there a way to test that Avast is working with the new dll file? Is there a fake virus web page we can point to to see if Avast reacts? Or an email site that will send a fake virus for the same reason?
-
Eicar testfile is intended for this sort of thing http://eicar.org/86-0-Intended-use.html
-
Igor - success so far. No shutdown message at 9:02 am. If you don't hear further from me here, that will be good news.
Just out of curiosity, what did you find and fix?
Thanks.
-
@ Igor
I have not had a recurrence of the problem since installing your patch. :D
Thank you for doing what Avast level 2 technical support couldn't.
-
OK, good to know - thanks!
The bug I found was connected to the CreditAlert feature (and probably bound to a specific proxy setting). I didn't really investigate the prerequisites, just fixed something that seemed to cause a crash.
The fix will be included in the next program update, of course.
-
Igor - yes - I turned credit alert on fairly recently. (I'm not sure it's doing anything because I never see alerts, but who knows.)
Still looking good here. Thanks!
(Well, no more 25 hours. Looks like I lose that extra hour of sleep.)