Avast WEBforum
Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: taffy44 on January 26, 2010, 02:27:22 PM
-
I thought that everything was working fine with Avast 5, until I tried to do a 'Full system scan'.
I had performed a 'quick scan' without any problems, but when I came to do a full scan Avast froze after about 1 minute, having checked only 77,500 files and 12.06GB of data. The icon in the system tray had a red x on it and I could not do anything with the program. The only way out was to manually shut down my computer.
I tried a full system scan again and it stopped at exactly the same place again and once again I had to manually shut down my computer.
By a process of elimination, by using the 'create custom scan' feature and scanning each individual area of a Full system scan (All harddisks, Rootkits, Autostart programs and memory) I have found out that Avast 5 will not (or cannot) scan the memory on my computer. When I set a custom scan to scan memory only, the timer starts ticking away, zero files are being scanned and then Avast freezes and a red x is seen in the system tray icon. I am able to do a 'full scan' without scanning memory by using custom scan and everything works ok.
I realise that this is a trivial problem compared to what other users are having to put up with, but can anyone offer an explanation as to what is wrong?
I installed Avast 5 by first uninstalling Avast 4.8 with 'Add or remove programs' in Safe Mode and also used the Avast uninstall utility before performing a clean install of Avast 5. I have also tried doing a 'repair' but to no avail. I am running Windows 7 64-bit, if that helps.
-
Did you have any other antivirus on the computer before putting on Avast 5?
-
Only Avast 4.8, and I did a clean uninstall of that version before installing Avast 5.
-
Having oceans of trouble with avast 5. Reverting back to Avast 4.8 as i am writing this message. As this was a good antivirus and gave me no trouble!
-
Apart from the problem of not scanning memory, I am having no other problems with Avast 5 so far (touch wood). So, I think I will persevere with this version for now and see how it goes ;)
-
What area exactly did you put into the custom scan? "Memory" or "Auto-start programs"?
Actually, the Full system scan uses a slightly different internal area - you can get it if you type QuickStartupMem into the "Areas to scan" box.
So, I assume the avast! service crashes when you start such a scan - i.e. the AvastSvc.exe process disappears. Do you have any unpXXXXXX files in
C:\ProgramData\ALWIL Software\Avast5\Log
folder? They could tell us what happened (if the corresponding dump was created during the crash).
Thanks.
-
What area exactly did you put into the custom scan? "Memory" or "Auto-start programs"?
Both (individually). It was able to scan 'Auto-start programs' but would not scan 'Memory' without crashing.
Do you have any unpXXXXXX files in
C:\ProgramData\ALWIL Software\Avast5\Log
folder? They could tell us what happened (if the corresponding dump was created during the crash).
Thanks.
Yes, I have 2...
unp78770045.tmp.mdmp
unp157615041.tmp.mdmp
-
Can you please upload them to
ftp://ftp.avast.com/incomingThanks.
-
Can you please upload them to
ftp://ftp.avast.com/incomingThanks.
How do I do that, exactly ???
All I see, when I enter the link into my browser address bar is a website with a box with the address in it and the words "Name, size, date modified" inside it. That's all, nothing else. How do I upload the files to this page??
-
Hi taffy44,
As far as I'm aware, you simply have to open the link, and drop the file in the window of the browser (it may have to be Internet Explorer IIRC)
I think you(we) have write only access, so you wont be able to see that the file is there, you will probably need confirmation that it is there...
On a side note, this could do with updating to show how to do it : http://support.avast.com/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=18
-Scott-
-
I'm afraid those 2 dumps correspond to crashes of avast! UI, not avast! service (which means the dumps were probably not created when the service crashed).
If there anything related in Windows Event Log?
It's probably doesn't matter - but how much RAM do you have in your machine?
-
If there anything related in Windows Event Log?
All I could find in the Windows Event log is the following...
Under the heading 'System' it says...
"The Avast! Antivirus service terminated unexpectedly."
Under the heading 'Application' it says...
Application error :-
Faulting application name: AvastUI.exe, version:5.0.377.0, time stamp: 0x4b559ce0
Faulting module name: ntdll.dll, version: 6.1.7600.16385, time stamp: 0x4a5bdb3b
Exception code: 0xc0000005
Fault offset: 0x000843b7
Faulting process id: 0x978
Faulting application start time: 0x01ca9e780745fda0
Faulting application path: C:\Program Files\Alwil Software\Avast5\AvastUI.exe
Faulting module path: C:\Windows\SysWOW64\ntdll.dll
Report Id: 2382cb40-0a72-11df-8cbe-001731f64e90
It's probably doesn't matter - but how much RAM do you have in your machine?
3GB of RAM. (OS is Windows 7 64-bit, processor is AMD Athlon 64 X2 5,200+)
P.S I tried typing 'QuickStartupMem' into the "Areas to scan" box of a custom scan and when I hit the 'start' button Avast crashed (red x on system tray icon).
Thanks for continuing to help me with this problem, it is much appreciated
-
OK, please do the following:
- open the Task Manager
- watch the processes AvastUi.exe and AvastSvc.exe
- start the scan (e.g. with the 'QuickStartupMem' area)
Am I right that AvastSvc.exe disappears?
-
Yes, you are right. AvastSvc.exe immediately disappears
-
But no record about that disappearance (i.e. crash) in Windows Event log?
-
I'd need to see a dump - to find out why it crashes. I'm not sure if it will work, but if possible, could you please try the following?
1. Disable avast! self defense (avast! settings / troubleshooting)
2. Download ProcDump from here: http://technet.microsoft.com/cs-cz/sysinternals/dd996900(en-us).aspx
3. Extract it somewhere, and run the following command from the command line:
procdump .exe -e -ma AvastSvc.exe
4. Now run the scan that will crash the process
Hopefully, the dump (called AvastSvc.dmp) will be created... if yes, please compress it and upload it to ftp://ftp.avast.com/incoming
-
Sorry for taking so long to reply, I have been working all day.
I disabled avast! self defense, downloaded Procdump and extracted it to my desktop. The only problem now though is that it won't open up for me. I press 'run' and the command line box opens up for a split second and then closes. Am I doing something wrong ???
-
It's a command-line tool - so if you simply start it, it probably just complains that you didn't supply any command-line arguments and exits (which closes the console).
I'd suggest to extract procdump somewhere else (C:\Procdump folder, for example - you can delete it later)
Then press Win+R and enter (or copy&paste): c:\Procdump\procdump .exe -e -ma AvastSvc.exe
Or, another possibility - you can rightclick on the procdump you have on desktop and select "Create shortcut". Another shortcut to that tool appears; rightclick on it, choose Properties and append the command line switches to the "Target". This shortcut should then work as expected.
-
Okay, I followed your last instructions to the letter then attempted a scan which crashed the process. Am I expected to see this AvastSvc.dmp in the same place as the mini dumps i.e.."C:\ProgramData\ALWIL Software\Avast5\Log"? If so, then it is not there.
-
No, not there.
I'd guess in the same folder as ProcDump.exe. If not, I'd look into the folder where AvastSvc.exe is located (i.e. avast! installation folder).
-
No, it's not in either of those locations :(
-
OK, what if you try again, and specify an additional command-line argument - the dump file location. For example:
c:\Procdump\procdump .exe -e -ma AvastSvc.exe C:\AvastSvc.dmp
(now I assume that your account has rights to write to C:\).
-
Yes, I do have rights to write to C:\
I'm still not getting any sign of the dump.
Can I just confirm one thing with you...
When I type c:\Procdump\procdump .exe -e -ma AvastSvc.exe into the 'run' box and press enter, should the command line console open up or is it normal for it to still open and close quickly, because that is what is happening and it is not giving me enough time to read what is written inside it.
-
It should stay open - until the dump is written.
Damn, there shouldn't be the space between "procdump" and ".exe", of course... don't know how it got there.
-
Okay, I got rid of the gap between procdump and .exe and tried running it again. It still opened and closed quickly but this time I was able to read what it said inside the console...
" Error opening AvastSvc.exe (3836)
Access is denied "
-
Did you disable avast! self-defense first?
Furthermore - are you logged-on as an administrator? (If not, it might be necessary to use "Run as" to start procdump that way)
-
Okay, I decide to take drastic action...
I re-installed Windows 7 (I'd only had it since Christmas, so there wasn't too much to back-up) and unplugged most of the hardware connected to my pc. I re-installed Avast 5 and everything is working fine now, brilliant!! :D
Therefore, it means that something on my computer, either software or hardware, was obviously conflicting with the Avast memory scan.
I will spend the next few days gradually re-installing all the software and hardware that I had on my pc prior to the Windows 7 re-install and will attempt a memory scan after each install until I hopefully find the culprit. I will then report back with my findings, in case someone else has the same problems that I had.
In the meantime, I would like to thank everyone who offered help, especially Igor, for your time and patience.
-
Well, that's a pity... this way we won't find out if there's a bug in the engine... :-\
-
Update...
By re-installing all the programs on my pc and testing the memory scan with Avast 5 after each program, I have discovered that it was Webroot's SpySweeper, latest version(6.1.0.145), that was causing Avast to crash when attempting a memory scan. I uninstalled SpySweeper and the memory was scanned without any problems.
My subscription to SpySweeper runs out in a couple of months and I had already decided not to renew it due to having 4 other antispyware programs installed (SuperAntiSpyware, Malwarebytes, Adaware and Windows Defender), so I have left it uninstalled.
If you want me to re-install it to do tests, let me know.
P.S It is the basic version of SpySweeper, just anti spyware and not antivirus, and I had the real time protection disabled. Only used it as an on-demand scanner.