well support tool made the files and confirmed that they had been sent, they will be still on my computer, albeit appended possibly
i tried to run a full vurus scan again this am, about 75% complete crashed computer this was logged as "1132 shutdown was unexpected"
looking at system event log round that time i saw " %1!s! Update Service (avast)!s! Update Service (avast)!s! Update Service (avast)!s! Update Service (avast) service entered the running state" logged at 11.31.34 event id 7036 source was Service Control Manager
opening details produces
EventData
param1 %1!s! Update Service (avast)
param2 running
610076006100730074002F0034000000
--------------------------------------------------------------------------------
Binary data:
In Words
0000: 00760061 00730061 002F0074 00000034
In Bytes
0000: 61 00 76 00 61 00 73 00 a.v.a.s.
0008: 74 00 2F 00 34 00 00 00 t./.4...
any use, or red herring?
the xml option is
- <Event xmlns="
http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
<EventID Qualifiers="16384">7036</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime="2018-07-09T10:31:34.830747500Z" />
<EventRecordID>1358485</EventRecordID>
<Correlation />
<Execution ProcessID="492" ThreadID="4008" />
<Channel>System</Channel>
<Computer>DELL-PC</Computer>
<Security />
</System>
- <EventData>
<Data Name="param1">%1!s! Update Service (avast)</Data>
<Data Name="param2">running</Data>
<Binary>610076006100730074002F0034000000</Binary>
</EventData>
</Event>