AvIsaHlp.dll Keeps Crashing IIS Since Yesterday

[hismightiness]

Our web server just began to "randomly" crash beginning yesterday morning. I noticed that my other machines were "asking" to upgrade the newest AVAST version to be installed, but this server apparently already updated. (It's at version 4.8, on a 64-bit Windows 2003 server.)

Avast basically crashes IIS by inserting the following file into the list of ISAPI filters:

C:\Program Files\Alwil Software\Avast4\AvIsaHlp.dll

My event log entries are as follows:

Code: [Select]

Event Type: Error
Event Source: W3SVC-WP
Event Category: None
Event ID: 2268
Date: 12/8/2008
Time: 11:02:04 AM
User: N/A
Computer: MYSERVERNAME
Description:
Could not load all ISAPI filters for site/service.  Therefore startup aborted.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 7f 00 00 00


Event Type: Error
Event Source: W3SVC-WP
Event Category: None
Event ID: 2214
Date: 12/8/2008
Time: 11:02:04 AM
User: N/A
Computer: MYSERVERNAME
Description:
The HTTP Filter DLL C:\Program Files\Alwil Software\Avast4\AvIsaHlp.dll failed to load.  The data is the error.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 7f 00 00 00
This creates a Service Unavailable message on our web server, by crashing all of the App Pools.  It looks like the specified file is not 64-bit compatible even though the AVAST version is.

No matter how many times I remove it, my web server will be crashed again a few hours later, as the AVAST filter is found reapplied in IIS. I have the ISA protection "terminated" even before this began to happen (approximately 36 hours ago). 

Any ideas?

[Vlk]

Hi,

and welcome to the avast forums.

From your message, I don't quite understand if you have ISA Server installed on your system or not. If you do, which version is it (2000/2004/2006)?

If you don't, you should uninstall the avast ISA Server plugin (it will obviously not operate correctly if the underlying subsystem is not present).

To do that, go to Control Panel, Add/Remove Programs, avast! antivirus, Change/Remove, Change, and untick the box that says "ISA Server plugin".


BTW do you have any idea what was the trigger for this problem? I mean, was it e.g. after you updated avast to the latest version?


Thanks
Vlk