25-hour cycle for "The avast! Antivirus service terminated unexpectedly" ?!?

[glnz]

Like others here, Windows Event Manager shows me this about once a day now:

The avast! Antivirus service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 5000 milliseconds: Restart the service.

Now, here's what's weird - this is occurring on a 25-hour cycle, exactly. 

Here's when this has appeared recently - copied from Event Manager:

9/2/2012      6:02:08 AM
9/1/2012      5:02:08 AM
8/31/2012    4:02:09 AM
8/30/2012    3:02:09 AM
8/29/2012    2:02:09 AM

and so on.

WHAT IS THIS?  A MALWARE THAT IS CYCLING ONE HOUR LATER EACH DAY WAITING TO CATCH ME DOING SOMETHING?

What do you all suggest I do?

I have WinXPPro SP3 on a Dell Optiplex 755 hooked up to Verizon DSL. 
I love and use Avast Free 7.0.1466
I also have Ad-Aware Free 9.6.0 and of course Windows Malicious Program Removal Tool MRT.exe that I believe runs on reboot.
In my Scheduled Tasks, the Ad-Aware is set to update itself at 6:05am every day.
Also, in Scheduled Tasks, my Spybot S&D updates itself at 5:00am every day and re-Immunizes itself at 5:29am every day.
Only the Ad-Aware is constantly running - the Spybot S&D does not run except once a month I do a manual scan.  TeaTimer is NOT on.

What do y'all think?

[CraigB]

Get rid of Ad-Aware and SpyBot ( "note" you said spybot is not on but it updates and re-immunises every day ) these will be your problem, you can use Malwarebytes instead - much better program

[glnz]

Craig - I've been using all for years - this is a new phenomenon.  What explains the 25-hour pattern?

OK - I'll turn off Ad-Aware and reboot.  Let's see whether I get the Avast turned off message at 7:02am.

[CraigB]

Also if Spybot is updating and immunising every day then that means TeaTimer is on, both the programs you have there are quite outdated in there detection capabilities which is why i suggeted using Malwarebytes as it is far superiour in detection and removal.

[glnz]

Craig - TeaTimer is not on - just checked.  My Task Schedule updates for Spybot are my own creation.  Spybot does nothing unless I run it or update+Immunize it manually. 

But before I start shutting off programs that seem to have kept me safe so far, please advise why you think the Avast shutoff is occurring on precisely a 25-hour schedule.  Isn't that a clue?

[CraigB]

Craig - TeaTimer is not on - just checked.  My Task Schedule updates for Spybot are my own creation.  Spybot does nothing unless I run it or update+Immunize it manually. 

But before I start shutting off programs that seem to have kept me safe so far, please advise why you think the Avast shutoff is occurring on precisely a 25-hour schedule.  Isn't that a clue?

The 25 hour thing doesn't tell me much as i haven't got a clue what on your system may be cycling every 25 hours, most problems that happen with avast always tend to be related to other security software so that is why i mentioned removing those two especially when there are better programs as mentioned that work great with avast.

[CharleyO]

***

If you have not yet, run a boot time scan with avast and report anything found.


***

[Theo Peterbroers]

Could it be, you run a task every hour, 24 hours a day, that makes 24 runs?

Should be 23 times, since 24:00h = 00.00h. You don't want to schedule that twice.

And then, why would avast terminate? And you'd have clashes 24 hours apart.


Sorry, nonsense. Start counting at 1.00h, last run at 24.00h is 24 runs.
Yet I still think there is some interval where the end of a period coincides with the start of the next.

Maybe same problem: http://social.technet.microsoft.com/Forums/en/winservergen/thread/13b6a6f4-8f6d-4c67-8f85-25c6da3480df (and that's a third EDIT)

EDIT 4 Look at that:
http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/schtasks.mspx?mfr=true "Hourly: modifier 1-23"

Seems they count 0-based.

[Gopher John]

Craig - TeaTimer is not on - just checked.  My Task Schedule updates for Spybot are my own creation.  Spybot does nothing unless I run it or update+Immunize it manually.

SpyBot Search & Destroy issues updates once a week.  There is no need to check for updates and re-immunize daily.  http://www.safer-networking.org/about/updates/

[glnz]

To all - First, thanks for taking an interest.  I hope we'll find the answer.

Second, even though I turned Ad-Aware off
(by disabling the service called Lavasoft Ad-Aware Service "C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe" AND by unchecking the startup C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe)
and rebooted at 1am last night, the problem has occurred again, 25 hours after the last time.

Today, 9/3/2012, at 7:02:08 AM (which is 25 hours after last time), there is again this Event Manager entry:  "The avast! Antivirus service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 5000 milliseconds: Restart the service."

By the way, just to be clear, Avast Free is running (both AvastSvc.exe and avastUI.exe).  Event Manager shows it restarting five second later at 7:02:13 AM.  The issue is that Avast stops for the 5-second period noted in Event Manager.

And, yes, I have re-checked both my Wndows Task Manager and CodeStuff Starter, and Ad-Aware is NOT running.

Kwartet has made an interesting observation.  What he describes seems to be occurring for Google Update Service (gupdate).  Every 25 hours, Event Manager shows three messages:
"The Google Update Service (gupdate) service was successfully sent a start control."
"The Google Update Service (gupdate) service entered the running state."
"The Google Update Service (gupdate) service entered the stopped state."
The Scheduled Tasks Properties for this activity are "Every 1 hour(s) from 1:08pm for 24 hours every day, starting 7/11/12".  In Advanced, it's set to Repeat Task Every 1 hours with a Duration of 24 hours.  But in Event Manager, it is running once every 25 hours.

However, please note that the above three entries regarding Google Update Service (gupdate) occur and finish 54 minutes BEFORE the 5-second Avast shutdown.  My guess is they have nothing to do with each other.  Also, there are no other Event Manager entries near the Avast shutdown.

Well, something is causing the 5-second Avast shutdown every 25 hours.  I see nothing in my Scheduled Tasks that would do this, and Ad-aware was off this morning.  Any ideas?

Thanks.

[igor]

Do you have any unpXXXXXX files (with corresponding timestamps most likely) in C:\Documents and Settings\All Users\Application Data\AVAST Software\Avast\log ?

[glnz]

Igor - yes I do.

(By the way, the location in XP is "C:\Documents and Settings\All Users\Application Data\Alwil Software\Avast5\log".)

I have a file called  unp207922365.tmp.mdmp  created at the same time as the shutdown.  It's rather large - 553KB.  What should I do with it?

Also, error.log has entries that correspond with each of these events.  The last two sets are the following:

Sun Sep 02 06:02:07 2012
 -> topLevelExceptionFilter addr=7855b6df code=c0000005
Sun Sep 02 06:02:07 2012
 -> Calling generateExceptionReport
Sun Sep 02 06:02:07 2012
 -> Returning EXCEPTION_CONTINUE_SEARCH.

Sun Sep 02 06:02:08 2012
 -> topLevelExceptionFilter addr=7855b6df code=c0000005
Sun Sep 02 06:02:08 2012
 -> Returning EXCEPTION_CONTINUE_SEARCH.

Mon Sep 03 07:02:06 2012
 -> topLevelExceptionFilter addr=7855b6df code=c0000005
Mon Sep 03 07:02:06 2012
 -> Calling generateExceptionReport
Mon Sep 03 07:02:07 2012
 -> Returning EXCEPTION_CONTINUE_SEARCH.

Mon Sep 03 07:02:08 2012
 -> topLevelExceptionFilter addr=7855b6df code=c0000005
Mon Sep 03 07:02:08 2012
 -> Returning EXCEPTION_CONTINUE_SEARCH.

What next?  Thanks.

[igor]

OK, if you have avast! installed since version 5 and updated ever since, you'll have Alwil Software, not Avast Software.
Can you please upload the file to ftp://ftp.avast.com/incoming ?

[glnz]

Igor - I've never uploaded to an ftp site before.  How do I do that?  Thanks.

[igor]

You can open the mentioned URL in Windows Explorer (not Internet Explorer) - and then drag&drop the file onto the lower pane.