Problems with Avast and Vista Business

[Newbie_Man]

My computer has been freezing/locking up every 30 minutes or so.  Task manager shows a CPU spike with the avast antivirus process (CPU usage went from ~5% to 100% almost instantly).  It appears to be from the on-access scanning, as ending the process turned that off.  Unfortunately, I can't get the on-access scan to turn back on.  I now get the following message: The AAVM subsystem detected a RPC error.

My stats:

Avast version 4.7 Home Edition (Build 4.7.1074, Xtreme toolkit version 1.9.4.0, ActiveSkin version 4.2.7.3)

Windows Vista Business 32-bit (odd, I know)
Athlon 64 X2 5000+
2GB RAM (speed/brand unknown)

Anything else needed in order to troubleshoot/fix this problem?

[Vlk]

Please see here: http://forum.avast.com/index.php?topic=31185.msg259127#msg259127
Your problem seems to be related.

Thanks
Vlk

[Newbie_Man]

Please see here: http://forum.avast.com/index.php?topic=31185.msg259127#msg259127
Your problem seems to be related.

Thanks
Vlk

One problem: I can't get the on-access scan to turn back on, as I keep getting that RPC error whenever I try to do anything.  Since that seems to be causing the freeze, should I reinstall? 

[Newbie_Man]

Sorry for the double-post, but I have a question regarding forcing a memory dump.

The instructions state: Open regedit, go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i8042prt\Parameters and add a new DWORD value called "CrashOnCtrlScroll" (no quotation marks). Make its value 1 (one).

I've been able to add a DWORD to the right place, but I can't seem to make its value 1.  Everything I try results in regedit telling me: invalid DWORD (32-bit) value.

[Vlk]

One problem: I can't get the on-access scan to turn back on, as I keep getting that RPC error whenever I try to do anything.

Have you tried to restart the machine?

I've been able to add a DWORD to the right place, but I can't seem to make its value 1.  Everything I try results in regedit telling me: invalid DWORD (32-bit) value.

You're saying you can't double-click it and set its value?

Thanks
Vlk

[Lisandro]

Just some questions...
Do you have any other antivirus installed in your system? Did you have in the past?

[Newbie_Man]

One problem: I can't get the on-access scan to turn back on, as I keep getting that RPC error whenever I try to do anything.

Have you tried to restart the machine?

I've been able to add a DWORD to the right place, but I can't seem to make its value 1.  Everything I try results in regedit telling me: invalid DWORD (32-bit) value.

You're saying you can't double-click it and set its value?

Thanks
Vlk

I'm at work now, so I won't be able to play with it for another few hours, but here's what I did do:

I didn't do a complete reboot of the machine.  I thought logging off would suffice.  I did turn off my PC before leaving to go to work (I wasn't going to leave it running while the antivirus wasn't opperational), so I'll restart it right away when I get back home.

I don't recall double-clicking the registry value.  Instead, I right-clicked, then selected something along the lines of 'Add new binary value" from the context menu.

To answer Tech's question, I've never had another antivirus installed on my PC.

With any luck, I'll be able to FTP a memory dump between 3:00 PM and 3:30 PM Eastern time.  Should I send anything else with that?

[Vlk]

I didn't do a complete reboot of the machine.  I thought logging off would suffice

Logging on and off wouldn't usually help. It's better to restart the machine.

I don't recall double-clicking the registry value.  Instead, I right-clicked, then selected something along the lines of 'Add new binary value" from the context menu.

Binary value? That's not correct - you were supposed to create a "DWORD (32bit) Value". If you have already created a value of type "binary", delete it and create one with DWORD type.

With any luck, I'll be able to FTP a memory dump between 3:00 PM and 3:30 PM Eastern time.  Should I send anything else with that?

Not really... just make sure to compress the dump file before submitting it - this will cut its size (and the time needed to upload it) by 70+ percent.

Cheers
Vlk

[Newbie_Man]

I didn't do a complete reboot of the machine.  I thought logging off would suffice

Logging on and off wouldn't usually help. It's better to restart the machine.

I don't recall double-clicking the registry value.  Instead, I right-clicked, then selected something along the lines of 'Add new binary value" from the context menu.

Binary value? That's not correct - you were supposed to create a "DWORD (32bit) Value". If you have already created a value of type "binary", delete it and create one with DWORD type.

With any luck, I'll be able to FTP a memory dump between 3:00 PM and 3:30 PM Eastern time.  Should I send anything else with that?

Not really... just make sure to compress the dump file before submitting it - this will cut its size (and the time needed to upload it) by 70+ percent.

Cheers
Vlk

How important is a unique name?  Would something like vistabiz.dmp suffice?

[igor]

Sure, it's OK (the main thing is not to left the default memory.dmp, because it might already be present on the FTP from somebody else).
As Vlk said, however, it's recommended to compress it with ZIP, RAR, or similar tool - to make it significantly smaller.

[DavidR]

If you used your forum user name Newbie_Man.dmp (zip/rar) it is easier Vlk to find the relevant topic also.

[Newbie_Man]

Sorry for the delay in my response.

It finally froze on me again just a few minutes ago.  Unfortunately, it wouldn't let me force a memory dump, despite following the instructions on how to do it to the letter.  Instead, the computer just stayed frozen.  Any ideas?

[igor]

Does the magic shortcut (the one invoking the bluescreen and dumping the memory) work for you at all? (when the computer isn't frozen)

[Newbie_Man]

Does the magic shortcut (the one invoking the bluescreen and dumping the memory) work for you at all? (when the computer isn't frozen)

Apologies for the delay in response.

I can manually bluescreen when the computer isn't frozen.  But it still won't work when it is frozen (as I verified this morning when my computer locked up on me once again).