System Hangs - avast! on-access scanner window shows (Not Responding)

[DavidR]

System hangs - standard shield paused to run a third party on-demand scan, on completion tried to resume standard shield and the system hangs.

From what I initially thought to be a problem with the AVG Anti-Spyware, that seemed to also be replicated when I reverted to the Ewido incarnation. Now I find that the problem also happens after a scan with Spybot S&D and also after a scan with AdAware. It now seems that the problem is in fact with avast 4.7.892, perhaps this is somehow associated with avast's self protection if enabled in this version ?

As many of you will know I always pause standard shield before doing a scan with any other on-demand scanner and I have been experiencing problems in that my system would hang and the avast! on-access provider window eventually showed (Not Responding).

The sequence,
1. Pause Standard Shield.
2. Windows Security Center pop-up about pause.
3. start on-demand scan, AVGAS or Ewido or Spybot or AdAware.
4. complete scan and close on-demand scan program.
5. click Continue on Standard Shield (or right click avast icon, Resume provider and select Standard Shield).
6. Blue and Yellow information pop-up shows starting standard shied or words to that effect.
7. Nothing else happens and standard shield effectively hangs.
8. Whilst the mouse pointer works, I can't get the Task Manager loaded to kill the non-responding process. So my only option is a Power shutdown (press power button for 5 seconds to get as tidy a shutdown as possible).

There are no errors or warnings in the Windows Event Log, there are no entries in the avast Log Viewer, Errors, Warning or Notice sections. My logging in program settings is on Notice. I will change this to debug and see if it reveals any information if and when it happens again.
I have been able to replicate this with monotonous regularity following the above sequence.
My system spec, etc. is in my signature.

[DavidR]

Update, ran another scan following the same sequence above and the same problem occurred. I made one change in that I started Task Manager to see if I could see if the adaware process ended after the scan (it did) and see if I couldn't kill the process not responding.

No change other than as well as the avast! on-access scanner window (not responding) the same was true of the Task manager window, effectively every thing other than the mouse pointer wasn't responding.

Same result in avast Log Viewer nothing in Error, Warning, Notice or Info relating to this occurrence/issue.

Nothing in Setup and Update relating to this lock-up at 23:00 ish, but a lot of stuff from this mornings boot. This 'Failed fixing security' also seems to be a regular occurrence at start-up

06/10/2006 13:42    package        ArePartsInstallable: 1
06/10/2006 13:42    package        vps: updated [064004]
06/10/2006 13:42    file        Fix security on: D:\Program Files\Alwil Software\Avast4\*.*
06/10/2006 13:42    file        Fix security on: D:\Program Files\Alwil Software\Avast4\images\*.*
06/10/2006 13:42    file        Failed fixing security on: D:\Program Files\Alwil Software\Avast4\images\background.bmp, error 0x0000007A
06/10/2006 13:42    file        Failed fixing security on: D:\Program Files\Alwil Software\Avast4\images\chest.gif, error 0x0000007A
06/10/2006 13:42    file        Failed fixing security on: D:\Program Files\Alwil Software\Avast4\images\lense.gif, error 0x0000007A
06/10/2006 13:42    file        Failed fixing security on: D:\Program Files\Alwil Software\Avast4\images\oranz.gif, error 0x0000007A
06/10/2006 13:42    file        Failed fixing security on: D:\Program Files\Alwil Software\Avast4\images\resident.gif, error 0x0000007A
06/10/2006 13:42    file        Failed fixing security on: D:\Program Files\Alwil Software\Avast4\images\setting.gif, error 0x0000007A
06/10/2006 13:42    file        Failed fixing security on: D:\Program Files\Alwil Software\Avast4\images\slogan.gif, error 0x0000007A
06/10/2006 13:42    file        Failed fixing security on: D:\Program Files\Alwil Software\Avast4\images\spacer.gif, error 0x0000007A
06/10/2006 13:42    file        Failed fixing security on: D:\Program Files\Alwil Software\Avast4\images\update.gif, error 0x0000007A

So another replicable lock-up but no meaningful/useful data to try and identify the cause.

[DavidR]

Is anyone else experiencing this problem and can they replicate it, or am I on my one with this problem ?

[Lisandro]

As I've posted here (http://forum.avast.com/index.php?topic=23937.msg197637#msg197637), I won't be able to replicate as I won't install AVG Antispyware right now.
Maybe it will be usefull to know and check if both Ewido and AVG Antispyware did not left legacy keys behind. Maybe check:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\VirtualDeviceDrivers\\VDD
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ etc. etc. keys

Ewido used to post a key at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
AVG could have done the same...

[DavidR]

I was thinking about replicating it with AVGAS specifically but, any of the 4 programs that I have been able to replicate it with Ewido 4.0, AVGAS, Spybot S&D and AdAware. Every time after resuming Standard Shield after a scan from any of them my system hung.

[Spiritsongs]

   Hi David :

     Have you checked your drivers !? A seemingly
     knowledgeable person on another site recommended :
     http://driveragent.com ; however, if any are "out-of-date"
     he recommends doing a "google search" on what that site
     recommends as possible replacements .

     P.S. Have now upgraded to 4.7.892; even managed to
     update Ad-Aware yesterday and ran an Ad-Aware scan
     without any problems.

[DavidR]

I XP Pro SP2 fully up to date as is other security based software and nothing changed other than (in order), the last Windows Security Updates, update to 4.7.892, Firewall update to version 4.0, installed avgas, which uninstalled ewido. Then I first started to experience the problem with standard shield handing when trying to resume, a problem that is now manifest after any other on-demand scanner on my system runs.

I will look at the driveragent site out of curiosity than hope that it may find anything.

I have no problem running the scans, just restarting standard shied after it was paused to run the on-demand scan.

[DavidR]

Update checked out driveragent site only 4 drivers reported as bad (and that is debatable what they mean by bad).

1. My Nvidia 6600GT video driver I know is not the latest driver but as they say if it is working don't change your video driver and this doesn't seem to have anything to do with video drivers otherwise the screen would freeze including the mouse pointer, this isn't the case.
2. IDE ATA/ATAPI controllers, Via Bus Master IDE Controller, no change and unrelated I believe.
3. My wireless Optical Mouse driver, again unrelated.
4. Network adapters, Realtec RTL8139/810X Family Fast Ethernet NIC. Motherboard driver and I don't use an Ethernet connection and this is disabled in the BIOS, so again totally unrelated.
I get the impression that because of what was marked as BAD, that this is a hook to get you to purchase a Download subscription. Yes the drivers could be updated but none of them I would consider critical and certainly not BAD.

[oldman]

David

I had a similar problem a few months ago. I was on version 817, avast kept udating to 844. It was after this update that the problem of restarting the providers occurred.

I reverted back to 817, the problem went away. However, the program updated itself again(Iwas told this was due to 817 being too old). Problem reoccured.

I uninstalled and installed 844 from scratch, rather than update. No more problem.

My conclusion was something went wrong in he update. I don't know how you got to your current version, maybe the same thing happened?

Just a thought.

[bob3160]

Any thoughts on this from Alwil

[DavidR]

Update:
1. I did an avast! Repair, no change still hangs. Gave in trying to find the problem in this existing set-up.
2. Downloaded 4.7.892 setupeng file, Uninstalled, reboot, Installed (opted not to do boot scan), rebooted.
3. Boom, avast didn't start, good old Red Circle on avast icon. AAVM subsytem detected and RPC error when cilcking avast icon.
4. Gave up again and decided to restore last weeks drive image, prior to any of these issues appeared.
5. Guess what, yes, you guessed it, the problem still exists.

The only common denominator is, 4.7.892. No trace of avgas only ewido 4.0 as the trial I did with avgas was after the last weeks drive image (so no trace of the flip flop between ewido, avgas, ewido). After two and a half years trouble free use of avast this is to say the least a pain in the @#*!.

So yes as Bob mentions it would be nice if Alwil got involved and ran some tests to see if they can replicate this or offer some suggestions how I might help track it down.

[tls]

I had not experienced this problem, although I have run scans with Ewido, Spybot and AdAware: but I became curious after reading this thread.  So I paused Standard Shield and scanned with Ewido, resulting in the same sequence as in the original post by DavidR.

I normally "Stop On-Access Protection" when doing such scans, because the red circle is a reminder to my college-age daughter to start it again if she happens to use my computer while I am busy elsewhere.  (I realize simply pausing standard shield would be better, but since my internet connection is dial-up, I am connected only when I need to be, and not while running any scan.)   

[DavidR]

Sorry to hear that it effects you in the same way, but at least I'm not alone in this issue. I think there is one more for certain experiencing this, if only others would test it.

I too am on dial-up, but rather than stop all protection I have only ever paused standard shield for other scans.

Did some tests, running an AdAware scan with standard shield running results in 1,606 files being scanned by avast.

[tls]

I don't know if this information would be of any help, but neither my mother's WinME computer (avast! home, Outpost 3.5, Spybot, AdAware, A-squared) nor my daughter's Win98SE (avast! home, Outpost free, Spybot, AdAware, A-squared) has this problem.  Both have avast! version 4.7.892. 

[DavidR]

I had wondered with Outpost Pro 4.0 entering the equation with enhanced anti-leak functionality might have had any possible impact and I couldn't see it. Not to mention you are experiencing the problem with Outpost 3.5 and 4.7.892.

I never experienced any problem with avast (or anything else for that matter my system has been very stable) with outpost 3.5 but then again I didn't have 4.7.892.