Freezes with Definitions Update

[Tom McCune]

Having enjoyed use of Advast (home) on my Desktops (Win98SE; WinXP Pro, FAT32), I tried it on my laptop (
WinXP Pro, NTFS).  All is fine, except that immediately after any update of virus definitions, the laptop freezes and I have to use the power button to shut down.  I tried switching the laptop account to an admin account, and going to manual updates only, but this has no effect on the problem.  Is there a way to resolve this?

[Lisandro]

Having enjoyed use of Advast (home) on my Desktops (Win98SE; WinXP Pro, FAT32), I tried it on my laptop (
WinXP Pro, NTFS).  All is fine, except that immediately after any update of virus definitions, the laptop freezes and I have to use the power button to shut down.  I tried switching the laptop account to an admin account, and going to manual updates only, but this has no effect on the problem.  Is there a way to resolve this?

How did you connect to the Internet?
Is it correctly set into the avast! options (dial-up or DSL)?
Are you registered in the avast! site (correct Registration key)?
Does this occur with any other site?

[Tom McCune]

"How did you connect to the Internet?"

All three machines connect via router to cable modem connection; the laptop via a wireless access point.

"Is it correctly set into the avast! options (dial-up or DSL)?"

Actually, there was not a check mark for either option, but since Avast has no problem identifying the need for updating, and does the download okay, I don't think that is the problem.  Regardless, I've now placed the check for always connected (for the laptop).

"Are you registered in the avast! site (correct Registration key)?"

Yes.

"Does this occur with any other site?"

All works fine, except that after virus defintions are downloaded, there is a sudden freeze.  They are updated - currently dated 2/20/04.  After doing a reboot, all is again fine until the next update is done.
   

[Lisandro]

Sorry if I can't help you more... But, I suggest you choose one of the two options for connection. Are you updating from an admin account?

[Vlk]

Tom, during the last year, I've heard about only a couple of people with the same problem. Unfortunately, they were not enough computer-educated to be of much help when trying to solve it (to put it diplomatically).

Given your home network setup (DSL + WiFi) - of which configuration is not a piece of cake - I suspect you might be the first who could provide us with some real help

Here's the plan: we'll wait for the next update; when the computer locks up, we'll invoke a blue scree which will cause the OS to create a crash dump file. You'll then ZIP that file and put it on a web/ftp folder so that I'll be able to download it and analyze it.

Sounds good?

If so, we need to do the following changes:
1. Open Control Panel -> System -> Advanced -> Startup and Recovery ->Settings -> Write Debugging Information and select 'Complete Memory Dump'.

2. Open the registry editor, navigate yourself to
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\i8042prt\Parameters
and there create a REG_DWORD-typed value named CrashOnCtrlScroll, and set it equal to 1 (or any nonzero value).

3. Reboot the machine.

4. Wait for the lock up to occur

5. When the machine is in stalled state, hold down the rightmost CTRL key, and press the SCROLL LOCK key twice. This will cause a machine to 'blue-screen' and dump of memory will start.

6. After the machine restarts, ZIP the file \Windows\memory.dmp and put it somewhere I can download it. It will be pretty large - namely, it's size will be equal to the size of your RAM (you should make sure there's enough free space on the system disk).


That's about it
If you don't want to do this, just tell - I promise, I won't be mad

Thanks
Vlk

[RejZoR]

Just a recommendation,use 7-zip for compressing this dump file. 7-zip has much better compression rate than any other archiver.
It will be much easier to upload/download smaller file
www.7-zip.org

[Tom McCune]

I can do this.  My questions:

If doing this right after booting, it seems like there should be no real personal information in the dump?  Or is there risk I should be aware of?  To be on the safer side, could I email the URL of the file, instead of posting it?

I have 512 MB of RAM.  Using WinZip 8.1 SR-1, will this compress small enough to upload to my site that has a maximum allowed space of 200 MB?

[RejZoR]

Deflate is somehow the weakest compression methode.
LZMA (7-zip) or RAR (WinRAR) compression would probably shrink it enough. Or simply split into 5 or 10 parts and upload each next after Vlk downloads previous part (my bad english heh). Or create FTP server. This would be a direct upload to Vlk.

[igor]

I believe that there shouldn't be much personal information in the file. In any case, e-mail or Private Message is definitelly OK - there is certainly no need to post the URL here!

I would guess it will compress under 200MB - but it's just my opinion. As suggested, you may try WinRAR - it should have slightly better compression ratio.

[Tom McCune]

I have my site hosted at pair.com.  I just looked again at the limits.  Mine is actually 100 MB, but that seems to be a daily average, rather than an actual maximum allowed at any one time.  So, I'm guessing that I could actually upload the whole compressed file, have it downloaded, and then delete it.  I'll post at their news server for confirmation.

[igor]

Should there be any problem about it, I think we could find some other way (ftp server).

[Vlk]

Let's discuss the means of transfering the file once we've got it. I believe there will be no problem with that.

If doing this right after booting, it seems like there should be no real personal information in the dump?  Or is there risk I should be aware of?  

Well, the dump file indeed CAN contain some personal information - it's a complete copy of the whole memory at the time of crash. On the other hand, I really don't have any interest in the contents of the file besides the state of the avast components.

To be on the safer side, could I email the URL of the file, instead of posting it?

Absolutely, actually that's what I meant. I'd never suggest posting the link publicly.


One extra note: the success of this whole procedure is not guaranteed. I.e. I cannot guarantee that with the dump file, we'll be able to solve the problem. But there's a fair chance it'll help us better understand what's going on...


Well actually... do you know that we don't have to wait till the next update? We can generate the same situation on your machine artifically. I can send you and older VPS file that you'd place to the avast folder, forcing the updater to redownload and reinstall the latest one...

What do you say?


Thanks
Vlk

[Tom McCune]

I'll be glad to do it either way.  

I got feedback that I should be able do the upload to my site, but however the file is delivered should be fine.  Doing the freeze and dump immediately after a reboot should leave the file pretty free of passwords, etc.  It seems the least I can do for the cause (this free AV software).  

[Vlk]

OK, thanks. You can do it this way:

1. Download the file http://cat.asw.cz/~vlk/400.vps and put it to the <avast>\data\ folder (overwrite existing)

2. Open the file <avast>\setup\setup.ini, and in the [Parts] section, there should be a line saying this

part.vps=vps-40200

Change this line to read

part.vps=vps-30906

3. Delete the files <avast>\setup\vps*.vpu (there should be 2 of those)

4. Restart the machine.

After the restart, you should be notified that a virus database update is available (provided you've set the updating to 'Ask' instead of 'Automatic')

After the machine freezes, follow the procedure described in my earlier post (double-press Scroll-Lock while holding the right Ctrl key down, invoking a BSOD).

Thanks
Vlk

[Tom McCune]

I've done all the above, and got the update.  This did lead to the freeze, but it is not a total freeze.  I can move the cursor around, but not do anything else.  Trying the start menu, or launching an application does nothing.  Trying to open a text file on the desktop results it the icon being selected, and an hour glass, but nothing else.  
After a few minutes, I tried to induce the BSOD and dump, but nothing happened.  After rebooting, as expected, there was no memory dump.