Avast WEBforum
Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: Turnip on March 02, 2020, 12:33:51 PM
-
Turned on computer.
Windows Defender turned on. Getting warning no virus protection.
Had to go into Windows Security Protection Areas Virus and Threat protection. To manually turn off.
Then Reboot computer.
Windows 10 pro version 1909 build 18363.693
Avast Premier version 20.1.2397 (build 20.1.5069.537)
I Have had this occur now 3 times in the last week.
-
Hi,
thanks for report. Can you please provide a support package? It is generated by Avast support tool: https://support.avast.com/en-in/article/33/
Thank you
-
Thanks for your response
I have tried three times to send report but(cannot generate a support file, error code 12002
-
Thank you, this is a upload error. We are experiencing some network issues right now. Can you please just attach wsc.log and avastsvc.log into this thread. These files are in "C:\ProgramData\AVAST Software\Avast\log" folder.
-
Hi
This is where my ignorance is showing, when I try to send attach, i get file in use or being used by another process. :-[
-
You should be able to copy these log files using windows explorer into temporary and attach them from the temporary location. You can also try this: the support package was generated by the support tool. Only its upload has failed. So it should be present in "c:\Users\user_name\AppData\Local\AvastSupport". You can attach the support package into this thread.
-
I copy and paste to desktop okay, I can send wsc.log as attachment.
Can not send avastsvc.log is to large.
-
OK, so attach wsc.log for now.
-
Here it is
-
Thank you, this was very useful. The problem seems to be caused by fact, that AvastSvc.exe (AV service) is not reporting its status into WSC at all. Can you please provide also AvastSvc.log. You can zip the file using windows explorer (right click context menu) -> (Send to) -> (Compressed (zipped) folder). Then try to attach the resulting zipped file.
-
Wouldn,t allow zip folder.
For some reason I am able to send AvastSvc file. Don't Figure ???
-
I took notice of Task manager today.
Exactly same as reported here.
https://forum.avast.com/index.php?topic=232589.0 (https://forum.avast.com/index.php?topic=232589.0)
Seems like hit and miss, for me sometimes boot up without Windows Defender starting other times Windows Defender Starts.
-
From AvastSvc.log, I can see that first attempt to start the AvastSvc service failed completely. Not sure why, but StartServiceCtrlDispatcher() API is failing in your case. With error code ERROR_FAILED_SERVICE_CONTROLLER_CONNECT.
-
Thanks for the update.
Anything I can do on my end to assist.
-
Looking at your task manager image, I see MBAM tray icon and the antimalware service executable running. Is the MBAM Pro resident version that you have installed ?
I just wonder if there isn't some sort of conflict here which could cause the AvastSvc service to fail. Could be clutching at straws here but you could try disabling the resident scanning of MBAM for a while (several restarts) and see if on your restarts Avast runs (not windows defender) without error.
-
Thanks DavidR
I used to have pro, but went back to using the free version about a month ago.
I did check settings in Malwarebytes, was set to start with windows. Now disabled.
I shut the computer down and restarted antimalware service executable still showed up, but Avast loaded a lot faster then before.
It is about 50% of the time Windows defender turns on, kind of hit and miss.
-
AvastSvc.exe service has also very slow startup on your computer. There is almost 1 minute delay during initialization of AvastSvc. Can you please use Process monitor (https://docs.microsoft.com/en-us/sysinternals/downloads/procmon) to create boot log file?
- Execute procmon.exe as an administrator
- Select Options->Enable Bootlogging in application menu
- Restart your computer
- Execute procmon.exe again and save resulting boot log files
- Upload files to our FTP server: https://support.avast.com/en-us/article/160/
Thank you
-
When you say restart or is it shutdown and reboot
Do i need to check mark in Generate Thread profiling events See Attachment
-
Ran procmon.exe as an administrator and Enable Bootlogging
Restarted computer
Execute procmon.exe saved bog log files.
Downloaded 7-Zip created the compressed archive.
Downloaded WinSCP all seemed to go okay.
But at last step I get an error
-
Hi, you need to switch to "incoming" directory on the FTP server.
-
Hi Turnip,
yes enable thread profiling events please, use the "every second" option. Also, please follow Asyn's advice and upload the files into "Incoming" FTP folder.
Thanks
-
Hi Turnip,
yes enable thread profiling events please, use the "every second" option. Also, please follow Asyn's advice and upload the files into "Incoming" FTP folder.
Thanks
HI Spec8472
Have sent.
Hi, you need to switch to "incoming" directory on the FTP server.
Thanks Asyn much appreciated.
-
You're welcome.
-
Hi Turnip,
thanks for the boot log. I have checked it and it is clear now that the delay is caused by huge kernel CI (code integrity) processing, which is triggered, when process AvastSvc.exe tries to load a .dll. The .dll has an embedded signature, but system is trying to parse all system catalogs (.cat) file to validate the signature of the .dll file, which is strange. There might be a problem with authenticode signatures of some .dll files.
-
Hi Spec8472
How do I go about checking signatures of dll files.
I ran sfc/scannow Windows resource protection did not find any integrity violations.
-
No need to check integrity of system files. The problem is with load of our language base.dll. I am able to reproduce the issue now. Thank you.
-
Cheers Thanks :)