PC shutdown problems

[salvatore27]

Windows 7, Avast Premium Security
Since I installed the program update on May 4, 2020, the system is very slow when shutting down the PC.
If I go to the Event Viewer / System and look for events that occurred during shutdown, I find an error reporting "Avast Antivirus service was not shut down properly after receiving a system shutdown check".
If, before shutting down the computer, I deactivate the main protections "files, behavior, web, e-mail) until the next restart, then the computer will shut down normally in a few seconds.

[info2433]

I'have  the same problem, and seems to be related with network connection. If all connection are deactivated before, shutdown is realized normally.
The problem occurs during avast service shutdown.

[Asyn]

- Which Avast..? (Free/Pro/IS/Premium)
- Which version/build of Avast..?
- OS..? (32/64 Bit..? - which SP/Build..?)
- Other security related software installed..?
- Which AV(s) did you use before Avast..?

[cc2cc2]

Same issue, take few minutes to shutdown my PC.
W7 x64
Avast Free 20.3.2405 build 20.3.5200.561 (4 May 2020)

[bob3160]

Same issue, take few minutes to shutdown my PC.
W7 x64
Avast Free 20.3.2405 build 20.3.5200.561 (4 May 2020)

It's been reported to Avast.

[TheOwner]

Same for me! I already told this in main thread in 20.3 version but without answer. For me never happened during PC restart, but happen every shutdown. I am also on Win 7 64bit.

[salvatore27]

W7 x64
Avast Premium Security
Update 4/05/2020
Ver 20.3.2405
Buld 20.3.5200.561

[jaroslav.nix]

Thank you for reporting. It might be known bug, which is going to be fixed in the upcoming 20.4. release (internal tracking number AV-22446), but it can be also something new. Could you please try to help us to analyze the issue and install xperf tool. The 64-bit version for Windows 7 can be downloaded from:
http://public.avast.com/~nix/users/xperf/xperf_x64.msi

after installation, please run the tool via command (in elevated command prompt):
"c:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\xbootmgr.exe"  -trace shutdown -numRuns 1 -traceFlags DiagEasy+DISPATCHER+Profile+SYSCALL -stackwalk Profile+CSwitch+ReadyThread

The install folder will probably differ, this is example for Windows 10. This command will reboot you computer twice and create new file with ETL file extension. Please ZIP it and share the file with us via FTP:
https://support.avast.com/en-sg/article/FTP-file-upload

and let us know the uploaded file name. Thank you.

[salvatore27]

Thank you jaroslav.nix, I followed your instructions.
I opened a ticket 10761840 on Avast support and uploaded the ETL file to the Incoming folder.
The file name is 10761840.7z.
I hope the problem will be solved with the next Avast update.

[jaroslav.nix]

Thank you for the log.

I am still not 100% sure its really the same issue as we were able to reproduce locally. Could you please try to install latest beta version of AV 20.4.:
https://forum.avast.com/index.php?topic=234203.0

and let us know if the problem disappear?

If not, please try to disable the Avast self-defence (settings -> trouble shooting) and then try to stop the avast service from elevated CML line via command:
net stop "avast! Antivirus"

wait a bit and if the service is not stopped, please try to create a dump of it via Task manager (right mouse click).  Then please ZIP the dump flle and upload it to the FTP server and again, let us known the file name. Thank you and sorry for inconveniences.

[jaroslav.nix]

Even better would be the full computer memory dump (from the frozen stopping of avast service), because we see some 3rd party drivers (e.g.  McAfee Endpoint Encryption) in the logs, so it might be also connected to some conflict with 2rd party sw. You can let the computer got to BSOD and create the full dump via this procedure:
https://support.avast.com/en-my/article/Windows-complete-memory-dump

[jaroslav.nix]

There is one more/easier way how to stop avast service, you can user this command (again in elevated command prompt):
sc.exe control "avast! antivirus" 255
and if the service won't stop in couple of second (so you induce the same issue as with the shutdown), please create a dum file via command
sc.exe control "avast! antivirus" 254

The dump file fill be located in avast program data directory, e.g.:
"c:\ProgramData\AVAST Software\Avast\log" (on Windows 10, there is "Documents and Settings\..." on Window 7

[bob3160]

@ jaroslav.nix,
Is there also an easy command to restart the service?
Thanks

[jaroslav.nix]

Actually there is not direct command for restart, you would need to do it via combination of commands:
sc.exe control "avast! antivirus" 255 (this command is asynchronous unfortunately)
sc.exe query "avast! antivirus" (and wait till the svc is stopped)
sc.exe start "avast! antivirus" (for new start of the svc)

[jaroslav.nix]

But please keep in mind the stop (command 255) will require user consent dialog, so this can't be easily scripted by "bad guys".