WXP completely hangs at startup

[Mongobär]

Hi there,

I got huge problems with my Avast 4.7 home and have no idea what to do more now.

The system I'm using is an IBM Thinkpad X41 (type: 2525-65G) with an Centrino 1.5GHz CPU, XP SP 2 english and 1GB of RAM

When the system boots, I can log on, see the desktop with all icons and the taskbar and then after some seconds the system freezes. When I move the mouse over the taskbar I can only see the egg timer. This situation does not change, even not after waiting 15 minutes or longer.
The system can only be re-animated then by killing the explorer.exe in task-manager and manually restarting it. But then of course some taskbar-applications are not running. Sometimes this happens 3 times in a series, sometimes it boots up 5 times normaly and then hangs once again. After uninstalling Avast, tha system runs fine (but without any protection).

I already re-installed the system from scratch yesterday, downloaded the newest drivers from IBM/Lenovo and installed all recommended XP-Updates ... but the problem is still the same. There's no error message in the eventvwr or any other obvious irregularity.
There's also not much software installed on the notebook. Only some common things like Office 2003, Adobe 8, FreepdfXP and some little tools (Desktop-Calendar, Thinkpad Battery Maximizer, Thinkpad Harddisk Protection, some other Thinkpad tools) but no other security or protection software. I also already cleaned up the bootup processes and services.

I'm really sad about this because I really like Avast and used it on an X40 before and never had any problems. The installation was quite the same but with even much more programs installed.

Please, please help.

Many thanks in advance.
Uli

[Lisandro]

How is your set to receive Windows Updates?
If you disable the automatic updates and set to manual, will it help?

[Mongobär]

The set is to "Notify me when updates are ready to download ...". At the moment all updates are installed. Just checked the update-page yesterday.

Is this OK, too or do you mean to disable automatic updating?

[Mongobär]

I've set the Avast-Logging-mode to "Debugging" now. After rebooting it just had a "hang-up" again.

The last entry in the Antivirus-part of eventvwr before breaking down is "Leaving aswServ::Init...". Maybe this helps.

[Lisandro]

Is this OK, too or do you mean to disable automatic updating?

Just to test, and then you could revert to automatic back.

The last entry in the Antivirus-part of eventvwr before breaking down is "Leaving aswServ::Init...". Maybe this helps.

Please, post the last 100-150 lines of the logs:
C:\Program Files\Alwil Software\Avast4\DATA\log\Debug.log
C:\Program Files\Alwil Software\Avast4\DATA\log\Error.log

[Mongobär]

Switching Automatic Updates off did not solve the problem.

Here is the (whole) content of the debug.log:

18.07.2007   16:49:49   1184770189   SYSTEM   1924   Fixing startup entries... 
18.07.2007   16:49:49   1184770189   SYSTEM   1924   Starting InetWD... 
18.07.2007   16:49:49   1184770189   SYSTEM   1924   Starting IdleUI and integrity thread... 
18.07.2007   16:49:49   1184770189   SYSTEM   1924   Starting window thread... 
18.07.2007   16:49:49   1184770189   SYSTEM   1924   Starting TCP daemon thread... 
18.07.2007   16:49:49   1184770189   SYSTEM   1924   Leaving aswServ::Init... 
18.07.2007   17:11:56   1184771516   SYSTEM   2012   Fixing startup entries... 
18.07.2007   17:11:56   1184771516   SYSTEM   2012   Starting InetWD... 
18.07.2007   17:11:56   1184771516   SYSTEM   2012   Starting IdleUI and integrity thread... 
18.07.2007   17:11:56   1184771516   SYSTEM   2012   Starting window thread... 
18.07.2007   17:11:56   1184771516   SYSTEM   2012   Starting TCP daemon thread... 
18.07.2007   17:11:56   1184771516   SYSTEM   2012   Leaving aswServ::Init... 
18.07.2007   17:14:32   1184771672   SYSTEM   1944   Fixing startup entries... 
18.07.2007   17:14:32   1184771672   SYSTEM   1944   Starting InetWD... 
18.07.2007   17:14:32   1184771672   SYSTEM   1944   Starting IdleUI and integrity thread... 
18.07.2007   17:14:32   1184771672   SYSTEM   1944   Starting window thread... 
18.07.2007   17:14:32   1184771672   SYSTEM   1944   Starting TCP daemon thread... 
18.07.2007   17:14:32   1184771672   SYSTEM   1944   Leaving aswServ::Init... 
18.07.2007   17:26:16   1184772376   SYSTEM   1932   Fixing startup entries... 
18.07.2007   17:26:16   1184772376   SYSTEM   1932   Starting InetWD... 
18.07.2007   17:26:16   1184772376   SYSTEM   1932   Starting IdleUI and integrity thread... 
18.07.2007   17:26:16   1184772376   SYSTEM   1932   Starting window thread... 
18.07.2007   17:26:16   1184772376   SYSTEM   1932   Starting TCP daemon thread... 
18.07.2007   17:26:16   1184772376   SYSTEM   1932   Leaving aswServ::Init... 
18.07.2007   17:28:18   1184772498   SYSTEM   1928   Fixing startup entries... 
18.07.2007   17:28:18   1184772498   SYSTEM   1928   Starting InetWD... 
18.07.2007   17:28:18   1184772498   SYSTEM   1928   Starting IdleUI and integrity thread... 
18.07.2007   17:28:18   1184772498   SYSTEM   1928   Starting window thread... 
18.07.2007   17:28:18   1184772498   SYSTEM   1928   Starting TCP daemon thread... 
18.07.2007   17:28:18   1184772498   SYSTEM   1928   Leaving aswServ::Init... 
18.07.2007   18:18:58   1184775538   SYSTEM   1104   Fixing startup entries... 
18.07.2007   18:18:58   1184775538   SYSTEM   1104   Starting InetWD... 
18.07.2007   18:18:58   1184775538   SYSTEM   1104   Starting IdleUI and integrity thread... 
18.07.2007   18:18:58   1184775538   SYSTEM   1104   Starting window thread... 
18.07.2007   18:18:58   1184775538   SYSTEM   1104   Starting TCP daemon thread... 
18.07.2007   18:18:58   1184775538   SYSTEM   1104   Leaving aswServ::Init... 

A file called error.log does not exist in this folder. Just

info.log
setup.log
nshield.log
warning.log
aswMaiSv.log

Cheers
Uli

[Lisandro]

18.07.2007   17:11:56   1184771516   SYSTEM   2012   Fixing startup entries... 

Some other application is messing with avast installation.
What other security based software do you have that might block new startup entries, e.g. Spybot S&D (TeaTimer), AdAware (AdWatch), SpySweeper, Spyware Doctor (StartUpGuard), PrevX, WinPatrol, ProcessGuard, etc.?

[Mongobär]

Actually no other security software is installed beside Avast. I ran XP-Antispy once after installing but nothing else.

I made a screenshot from the starting processes at logon (from Sysinternals "Autoruns"). The other file (AutoRuns.txt) is an export from Autoruns showing all processes starting on boot.

P.S.: The entry "BLOG" is a thinkpad tool (BatLogex.dll ... sounds like battery-stuff).

[Mongobär]

... and the textfile. Sorry, looks quite weird but imported into Excel it makes more sense.

[Lisandro]

What is ThinkVantage Active Protection System?
What is Fingerprint Laucher?

[Mongobär]

Active Protection System is a harddisk-protection-utility from IBM/Lenovo. It prevents the HDD from headcrashes (mechanically).

Fingerprint Launcher is also Lenovo tool. It belongs to the integrated Fingerprint-Reader (to log on with a fingerprint instead of typing a password).

[Lisandro]

Please, go to folder \windows\minidump and send the newest (recent) .mdmp files for analysis.
Better if you can compress (zip) them and add some information about the BSOD and the link for this thread. 

Send an email to any of these addresses:
vlk (at) avast.com
rypacek (at) asw.cz

Or upload to the any of these anonymous ftp servers:
ftp://ftp.asw.cz/incoming
ftp://www2.asw.cz/incoming

Other way is manually generate the dump. When the machine is in stalled state, hold down the rightmost CTRL key, and press the SCROLL LOCK key twice. This will cause a machine to 'blue-screen' and dump of memory will start.

[Mongobär]

Hi Tech,

Bob Marley would sing "no bluescreen, no dump" 

There's no BS when the systems hangs and so I don't have any dumps.

My "only" problem is, that the whole desktop-area (incl. taskbar and trayicon-area) is freezing sometimes. When this happens, I'm still able switch to the taskmgr by pressing Ctrl-Alt-Del. And there I kill the explorer.exe and restart it manually. Then I'm able to work on "normally". Unfortunately this behaviour is not reproducible and happens just sporadically.

But I've got a suspect now. I think, the Active Desktop Calender (ADC.exe) might be the problem. I prevented it from starting automatically and was able to boot the device 9 times in a series without any problems. After enabling autostart for this application again, it startet 5 times normally and then froze at the 6th try. I'll try to exclude the file from on-access-scanning now and will write what happens. A strange thing is, that I used this software on my old X40 before, also with Avast 4.7 and never had any problems. Strange world.

Will keep you informed
Uli

[Lisandro]

There's no BS when the systems hangs and so I don't have any dumps.

So, generate it manually as I've posted before.

My "only" problem is, that the whole desktop-area (incl. taskbar and trayicon-area) is freezing sometimes. When this happens, I'm still able switch to the taskmgr by pressing Ctrl-Alt-Del. And there I kill the explorer.exe and restart it manually. Then I'm able to work on "normally". Unfortunately this behaviour is not reproducible and happens just sporadically.

Freezing problems are one of the most difficult to solve... could be a lot of things... we can only help with guesses.

But I've got a suspect now. I think, the Active Desktop Calender (ADC.exe) might be the problem. I prevented it from starting automatically and was able to boot the device 9 times in a series without any problems. After enabling autostart for this application again, it startet 5 times normally and then froze at the 6th try. I'll try to exclude the file from on-access-scanning now and will write what happens. A strange thing is, that I used this software on my old X40 before, also with Avast 4.7 and never had any problems. Strange world. Will keep you informed

There are other Calendar tools (free) and, maybe, it won't be a big problem change this application. I don't know what you feel regarding to it.

[Mongobär]

So, generate it manually as I've posted before.

Oh, I tried to but nothing happend. But I just read that I have to create a regkey prior (HKEY_LOCAL_MACHINE\System\ CurrentControlSet\Services\i8042prt\Parameters, find or create a DWORD value named CrashOnCtrlScroll. Double-click on the value and set its data to 1. ). Will try that again. *edit: worked !

Freezing problems are one of the most difficult to solve... could be a lot of things... we can only help with guesses.

You can't imagine how much I know that 

There are other Calendar tools (free) and, maybe, it won't be a big problem change this application. I don't know what you feel regarding to it.

Sure, would be a solution but I have quite a lot entries in the current one. I'll try to exclude the ADC.exe from scanning first and will see what happens. If this does not work, there's also a newer version of ADC available. Or I try to start the ADC delayed by script.