Problems with new install of avast on workstation

[ttucker]

I have the educational version of avast. The server is up and running. I recently rebuilt several windows 7 (64bit) workstations, and after I install avast endpoint protection, on reboot, I get a rundll32.exe error (event 1000), every time someone logs in the machine.

These are new builds of windows 7.

here is the error in full

Faulting application name: rundll32.exe, version: 6.1.7600.16385, time stamp: 0x4a5bc637
Faulting module name: MSVCR90.dll, version: 9.0.30729.6161, time stamp: 0x4dace5b9
Exception code: 0xc0000417
Fault offset: 0x000311d9
Faulting process id: 0xab0
Faulting application start time: 0x01d0b8cfa5af2121
Faulting application path: C:\Windows\SysWOW64\rundll32.exe
Faulting module path: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\MSVCR90.dll
Report Id: efedb0c8-24c2-11e5-9354-b8ac6f9077d0

Anyone have any suggestions?

[Eddy]

Did you install all updates for W7 before installing avast ?

[ttucker]

Yes, I installed all updates, Microsoft Office 2010, Adobe Première Pro 6, with updates

[Eddy]

Those are applications, not updates for the OS.
So, did you installed the updates for W7 before installing avast ?

[ttucker]

Yes, all updates that windows said it needed. I included the software that I have also installed in case it mattered.

[.: Mac :.]

Hi Tucker,

Just as a test, Make a group in your console, and set all shields to disabled for this group except the basic file system shield. If the error goes away, enable the shields one by one until you see the one that causes the error.

Could be that its avast, or avast interfering with another application that causes the error. Not much detail to go on yet...

FYI - Be sure to make the change from the AEA/ASOA console, as if you change the shield settings on the client it will just be overwritten by the console at the next refresh interval

Cheers,
Mac

[ttucker]

Ok, it gets more interesting.   I went to the console, disabled all shields and get the following error on the workstation.

There was a problem starting c:\program files\avast software\avast business\ashMaiSv.dll

Access is denied.

Then I re-enabled the file shield only and still get this error, and this error stays until I uninstall and reinstall avast

[REDACTED]

This is interesting.
Are you sure there is no other software installed on the machines besides Adobe Premiere Pro and Microsoft Office 2010? I have windows 7 machines (64-bit) with both of those applications and avast is running great on them. It sounds like there is another 3rd party application that is using some windows .dll files and avast isn't liking it.

Try installing avast! and adding a global exclusion of C:\* to the settings. If you reboot and windows boots fine without the error, then the above may be the case. This obviously is not a fix, but a step in finding the culprit.

Have you tried rebuilding your installation file in AEA? Maybe your installer is corrupted?

[ttucker]

I finally tracked it down to Thunderbird. When Mozilla Thunderbird is installed, the rundll32.exe error occurs. I do not have a fix for this. Any suggestions?

[Eddy]

- Delete Thunderbird
- Delete leftover folders/files manually
- Reboot
- Cleanup the registry
- Reboot
- Install Thunderbird

See if that is solving it.

[ttucker]

Tried that. Even tried a clean machine that never had thunderbird. When I installed thunderbird and rebooted, the error came back.

[ttucker]

Ok, after some more experimentation, I have tracked it to the following:

I have installed a basic setup, all  updates, joined to the domain.

I then push my antivirus (avast for education)

then I reboot the machine, and login.

If Thunderbird is installed on the machine, I get an error on login

Faulting application name: rundll32.exe, version: 6.1.7600.16385, time stamp: 0x4a5bc637
Faulting module name: MSVCR90.dll, version: 9.0.30729.6161, time stamp: 0x4dace5b9
Exception code: 0xc0000417
Fault offset: 0x000311d9
Faulting process id: 0xab0
Faulting application start time: 0x01d0b8cfa5af2121
Faulting application path: C:\Windows\SysWOW64\rundll32.exe
Faulting module path: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\MSVCR90.dll
Report Id: efedb0c8-24c2-11e5-9354-b8ac6f9077d0


If thunderbird is not installed, I do not get the error.

If I remove thunderbird, I do not get the error.

If roaming profiles are set for a user, or gpedit is set to only allow local profiles, I only get the error  on the first login for a user... I don't get it on subsequent logons.

Any suggestions? I don't want local profiles for lab machines, or roaming profiles for students...