Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: roscofil on September 26, 2016, 11:15:25 AM

Title: [SOLVED ?] Multiples copies of Avastsvc in "Suspended" mode!?!
Post by: roscofil on September 26, 2016, 11:15:25 AM
Hello experts,

Using Avast Free (v.12.3.2280) on an x64 Windows 10 machine.
Turns out that since a few weeks, Avast notifies me that I am not protected because avastsvc is not active...Fixing it restores the situation for a while, but looking at the Task Manager I can see (for example just right now) 7 copies of Avastsvc in a Suspended state and one service actually active...
Anybody able to explain what's going on here?

Thanks and best regards

Phil
Title: Re: Multiples copies of Avastsvc in "Suspended" mode!?!
Post by: Eddy on September 26, 2016, 11:17:04 AM
Perform a repair of avast.
If that doesn't solve it, perform a clean installation of avast.
Title: Re: Multiples copies of Avastsvc in "Suspended" mode!?!
Post by: roscofil on September 26, 2016, 11:20:25 AM
Thx...

I did try to completely uninstall Avast, clean up the registry and reinstall...Same issue...
Will try again...

Phil
Title: Re: Multiples copies of Avastsvc in "Suspended" mode!?!
Post by: Spec8472 on September 26, 2016, 11:49:49 AM
Hi, can you please provide dump of a suspended instance of AvastSvc.exe.

1) Disable Avast self defense in troubleshooting settings
2) Use Task manager to create process dump (context menu of selected process)

Thx...

I did try to completely uninstall Avast, clean up the registry and reinstall...Same issue...
Will try again...

Phil
Title: Re: Multiples copies of Avastsvc in "Suspended" mode!?!
Post by: roscofil on September 27, 2016, 09:25:25 AM
Hi,

Thx for the reply...Did create a dump, but unfortunately the zipped dump file is 124 Mb....
Any email address where I could send it?

Thanks

Phil
Title: Re: Multiples copies of Avastsvc in "Suspended" mode!?!
Post by: Asyn on September 27, 2016, 09:30:50 AM
Hi Phil, give it a unique name and upload it here: ftp://ftp.avast.com/incoming/ (ftp://ftp.avast.com/incoming/)
Post the name of the uploaded file here afterwards.
Title: Re: Multiples copies of Avastsvc in "Suspended" mode!?!
Post by: roscofil on September 27, 2016, 10:00:12 AM
Thx for helping out on this.

File uploaded as Crashing_AvastSvc_Philippe.zip. Hope you get it ok.

Checked yesterday a bit more what happens..
From what I can figure, Avastsvc crashes, an event is added to Event Viewer and a new copy is spawned...

Cheers

Phil
Title: Re: Multiples copies of Avastsvc in "Suspended" mode!?!
Post by: Asyn on September 27, 2016, 10:05:07 AM
You're welcome Phil, now it's up to Spec to check/fix it...

Cheers,
Asyn
Title: Re: Multiples copies of Avastsvc in "Suspended" mode!?!
Post by: roscofil on September 27, 2016, 04:32:35 PM
Hi again,

FWIW, avastsvc crashed again today at 12:32 am, generating now the 2nd suspended avassvc and the 3rd total.

Here's the eventviewer xml code:

Nom du journal :Application
Source :       Application Error
Date :         27/09/2016 12:32:51
ID de l’événement :1000
Catégorie de la tâche :(100)
Niveau :       Erreur
Mots clés :    Classique
Utilisateur :  N/A
Ordinateur :   PC-PHIL
Description :
Nom de l’application défaillante AvastSvc.exe, version : 12.3.3154.0, horodatage : 0x57b5c39d
Nom du module défaillant : ntdll.dll, version : 10.0.14393.103, horodatage : 0x57b7e09e
Code d’exception : 0xc0000374
Décalage d’erreur : 0x000d9841
ID du processus défaillant : 0x2e0
Heure de début de l’application défaillante : 0x01d217e15658c7db
Chemin d’accès de l’application défaillante : C:\Program Files\AVAST Software\Avast\AvastSvc.exe
Chemin d’accès du module défaillant: C:\WINDOWS\SYSTEM32\ntdll.dll
ID de rapport : 6e886f05-6cda-4c7d-bad1-24ee46f58320
Nom complet du package défaillant :
ID de l’application relative au package défaillant :
XML de l’événement :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Application Error" />
    <EventID Qualifiers="0">1000</EventID>
    <Level>2</Level>
    <Task>100</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2016-09-27T10:32:51.058356100Z" />
    <EventRecordID>31024</EventRecordID>
    <Channel>Application</Channel>
    <Computer>PC-PHIL</Computer>
    <Security />
  </System>
  <EventData>
    <Data>AvastSvc.exe</Data>
    <Data>12.3.3154.0</Data>
    <Data>57b5c39d</Data>
    <Data>ntdll.dll</Data>
    <Data>10.0.14393.103</Data>
    <Data>57b7e09e</Data>
    <Data>c0000374</Data>
    <Data>000d9841</Data>
    <Data>2e0</Data>
    <Data>01d217e15658c7db</Data>
    <Data>C:\Program Files\AVAST Software\Avast\AvastSvc.exe</Data>
    <Data>C:\WINDOWS\SYSTEM32\ntdll.dll</Data>
    <Data>6e886f05-6cda-4c7d-bad1-24ee46f58320</Data>
    <Data>
    </Data>
    <Data>
    </Data>
  </EventData>
</Event>

Also, if it may help, since these issues started showing up, the tray icon is fixed and no longer like an animated one, whatever this means...

Cheers

Phil
Title: Re: Multiples copies of Avastsvc in "Suspended" mode!?!
Post by: roscofil on September 27, 2016, 04:36:11 PM
And this one in the System Journal of the Event Viewer:
Sorry for the French text in there, but it basically says that il shut down in an unexpected way and that the attempted fix will be to restart the service...

Phil

Nom du journal :System
Source :       Service Control Manager
Date :         27/09/2016 12:32:51
ID de l’événement :7031
Catégorie de la tâche :Aucun
Niveau :       Erreur
Mots clés :    Classique
Utilisateur :  N/A
Ordinateur :   PC-PHIL
Description :
Le service Avast Antivirus s’est terminé de manière inattendue. Ceci s’est produit 1 fois. L’action corrective suivante va être effectuée dans 5000 millisecondes : Redémarrer le service.
XML de l’événement :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="49152">7031</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2016-09-27T10:32:51.728875200Z" />
    <EventRecordID>4270</EventRecordID>
    <Correlation />
    <Execution ProcessID="768" ThreadID="10428" />
    <Channel>System</Channel>
    <Computer>PC-PHIL</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Avast Antivirus</Data>
    <Data Name="param2">1</Data>
    <Data Name="param3">5000</Data>
    <Data Name="param4">1</Data>
    <Data Name="param5">Redémarrer le service</Data>
    <Binary>610076006100730074002100200041006E0074006900760069007200750073000000</Binary>
  </EventData>
</Event>

Title: Re: Multiples copies of Avastsvc in "Suspended" mode!?!
Post by: bob3160 on September 27, 2016, 04:45:01 PM
For Icon Animation to work:
(http://screencast-o-matic.com/screenshots/u/Lh/1474987376642-68513.png)
Title: Re: Multiples copies of Avastsvc in "Suspended" mode!?!
Post by: roscofil on September 27, 2016, 04:49:33 PM
 :) That's what is set...But id doesn't animate....
No big deal anyway....
Title: Re: Multiples copies of Avastsvc in "Suspended" mode!?!
Post by: roscofil on October 12, 2016, 10:11:30 AM
Hello again experts,

Any news from the "multiple-suspended-copies-of-AvastSvc" battlefront?
Thx

Phil
Title: Re: Multiples copies of Avastsvc in "Suspended" mode!?!
Post by: bob3160 on October 12, 2016, 03:25:06 PM
:) That's what is set...But id doesn't animate....
No big deal anyway....
Try a repair of Avast:
Control Panel> Program and Features (Add/remove program)>Select Avast> Select Repair. Reboot when completed
https://www.avast.com/faq.php?article=AVKB204
Title: Re: Multiples copies of Avastsvc in "Suspended" mode!?!
Post by: roscofil on October 12, 2016, 03:47:40 PM
 :) :) Was not particularly talking about the icon stuff which is a detail, but more about the fact that I still see a random number of AvastSvc copies in a suspended state (4 right now) and for which I submitted a dump...
No repair/reinstall does help in any way...

Cheers

Phil
Title: Re: Multiples copies of Avastsvc in "Suspended" mode!?!
Post by: roscofil on October 14, 2016, 09:33:40 AM
... about the fact that I still see a random number of AvastSvc copies in a suspended state (4 right now) and for which I submitted a dump...
No repair/reinstall does help in any way...

FWIW, there has been a so-called "Windows Cumulative Update" a couple days ago and, since then, the issue seems to have evaporated....
Maybe Avast vapor pressure was good enough but it looks like the suspended copies of AvastSvc can no longer be seen here....

Cheers

Phil
Title: Re: [SOLVED ?] Multiples copies of Avastsvc in "Suspended" mode!?!
Post by: Asyn on October 14, 2016, 09:46:15 AM
Sounds good, thanks for the feedback.
Title: Re: Multiples copies of Avastsvc in "Suspended" mode!?!
Post by: roscofil on October 16, 2016, 12:14:19 PM
Well, it looks like I may have come to conclusions a bit too quickly...
Suspended copies show up again...

Now, if it may help in this debate, I did not completely wait for the boot process to complete today before checking : I plugged in an external drive before the end of the boot process and now I see 3 copies of which 2 are suspended..

Cheers

Phil
Title: Re: [SOLVED ?] Multiples copies of Avastsvc in "Suspended" mode!?!
Post by: roscofil on October 20, 2016, 05:02:07 PM
Some more interesting observations about this strange behavior:

1. Each time there is a system change and a reboot required, there is ONLY ONE copy of AvastSvc running just fine.
2. Whenever there is no change and, say, a regular shutdown/restart, those multiple copies show up, just like if the shutdown did not completely stop the service and left it in a weird state.

FWIW

Philippe
Title: Re: [SOLVED ?] Multiples copies of Avastsvc in "Suspended" mode!?!
Post by: roscofil on January 12, 2017, 02:52:17 PM
Back to my original post:

Anybody home? Any progress made? Any hints from the Avast wizards?
Problem still ythere: today: 5 AvastSvc copies and "System Not protected" message when checking Avast...

Should I move away from Avast for another protection after all these years?

Thanks

Philippe
Title: Re: [SOLVED ?] Multiples copies of Avastsvc in "Suspended" mode!?!
Post by: bob3160 on January 12, 2017, 03:20:57 PM
Have you tried doing a clean install of Avast ?
https://goo.gl/4Ptzkf




Title: Re: [SOLVED ?] Multiples copies of Avastsvc in "Suspended" mode!?!
Post by: roscofil on January 12, 2017, 03:44:09 PM
<sigh> Of course I did...Thousand times...Also cleaning the registry after uninstall...</sigh>
Title: Re: [SOLVED ?] Multiples copies of Avastsvc in "Suspended" mode!?!
Post by: bob3160 on January 12, 2017, 03:52:15 PM
Avast notified.
Title: Re: [SOLVED ?] Multiples copies of Avastsvc in "Suspended" mode!?!
Post by: roscofil on January 12, 2017, 04:37:30 PM
Thx!!
I already posted a dump of one of those suspended Avastsvc. Hope it helps...
Cheers

Philippe