After updating to 4.8.1335@Vista on access scanner DOES NOT WORKS!!

[Sebo.PL]

After updating by update manager and rebooting I've noticed that on access scanner is turned off. When I tried to turn it on it just doesn't started and when I started the on access scanner management console there appearers the dialogue with the information that

AAVM subsystem has detected the RCP error.
The operation could not be completed.
See FAQ for more info...

First of all, there is no solution in this FAQ for Microsoft Windows Vista Business. Anyway I've tried to apply proposed solution considering known differences between those operating systems.
I started from updating the OS but there was no important updates remaining because I've got automatic update turned on. Anyway I've also installed other available updates.
After restarting the system on access scanner still wasn't turned on and the problem persisted.
So I checked the state of avast! Antivirus service and it was stopped but set to start automatically. Trying to start it by hand didn't help. There appeared the dialogue saying:

Services
The Windows system can not start avast! Antivirus service at the localhost.
Error 1068: Starting the service of dependence or group has failed.

I have also tried to repair avast installation using Change/Remove and even tried uninstalling the antivirus completely and installing it from a fresh setup file downloaded from avast.com (and digitally signed by ALWIL Software).
And nothing changed.
On access scanner still is off and I don't know if the only way to have an antivirus on my computer is to change avast to something else.

[Vlk]

Please check the Windows Event log. I suppose there's be some red entries from the Service Control Manager, detailing which dependency service failed to start.

Thanks
Vlk

[Sebo.PL]

I've got something like this:

Event[46508]:
  Log Name: System
  Source: Service Control Manager
  Date: 2009-02-07T11:43:21.000
  Event ID: 7000
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: zeeet9
  Description:
Unable to run aswMonFlt service with the following error:
Access denied.

Event[46509]:
  Log Name: System
  Source: Service Control Manager
  Date: 2009-02-07T11:43:21.000
  Event ID: 7001
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: zeeet9
  Description:
The avast! Antivirus service depends on the aswMonFlt service, which failed to start because the following error:
Access denied.

Anyone knows what is the name of aswMonFlt service??

[RodBarnes]

BTW: The support and KB pages just come up blank when I attempt to view them.  What is going on there.?

I am having the same issue.  I am running Vista 64 SP1.  Everything was working fine until the most recent update 4.8.1335 which was updated yesterday.

The first time, it BSOD with SYSTEM_LEVEL_EXCEPTION.  When I rebooted, Vista reported that the problem was my antivirus software.  The next time (today), I wasn't there when it happened but when I woke up the computer it showed Avast turned off.

The icon in the tray continues to show off symbol.  I have rebooted twice, and tried and update, all with the same problem.

Right-clicking the icon and selecting, "Start On-access Protection" does nothing.

Right-clicking the icon and selecting "On-access Protection Control", displays:
avast!: The AAVM subsystem detected a RPC error.
The operation could not be completed.
Read more about this problem in FAQ...

In the "Windows Security Center", clicking the [Turn on] button next to "Virus protection" displays:
avast!: Unknown error.
Program cannot activate resident part (Standard Shield provider not found.)

System event log shows this for the shutdown today.
The previous system shutdown at 5:55:42 PM on 2/7/2009 was unexpected.

This is the list of entries in the "Antivirus" section of "Applications and Services Log" for today and yesterday:

(Info) 2/6/2009 7:03:01AM -- There is a new version of the program available on the Internet. 

(Error) 2/6/2009 10:01:44 AM -- AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of D:\Originals\coast2-1.jpg failed, 00000017.

(Warning) 2/6/2009 10:01:44 AM -- AAVM - scanning warning: x_AavmCheckFileDirectEx [UNI]: D:\Originals\coast2-1.jpg (D:\Originals\coast2-1.jpg) returning error, 00000017.

(Info) 2/6/2009 12:53:54 PM -- There is a new version of the program available on the Internet. 

(Info) 2/7/2009 3:40:42AM -- The virus database (VPS 090207-0) was automatically updated.

(Info) 2/7/2009 5:59:37PM -- AAVM: VPS load failed, trying to get a fresh copy... 

(Error) 2/7/2009 5:59:43 PM -- AAVM - initialization error: AavmStart: avworkInitialize failed, 0000A438. 


I restarted the service "avast! Antivirus" and that seemed to clear things up.  But I am not confident it will remain that way since a reboot (twice) did not restart that service.
Please advise.

[Sebo.PL]

I can't find any entries similar to that listed by RodBarnes. Anyway I can't even run Event Log cause the error:

MMC can not create the snap in.
The snap in could be not installed correctly.
Class ID:
FX:{b05566ad-fe9c-4363-be05-7a4cbb7cb510}

Fortunately I still can list the events using windows shell command:

Code: [Select]

c:\Windows\system32> wevtutil qe ...I've got Windows Vista Business 32bit and restarting the avast! Antivirus service does not cleared anything.
And avast! on access scanner @ my computer still does not works

[Phant0m``]

I experience no problems, been using the update since it first went official. Running Vista x64.

Sebo.PL, regarding your problem.

There seems to be a few different reasons why you may experience this problem, the most common seems to be the existence of a file "eventvwr.exe.config" in the :\WINDOWS\System32 directory and deleting or renaming it seems to be the cure.

Another possibility could be with the registry permissions for HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MMC\SnapIns\FX:{b05566ad-fe9c-4363-be0
5-7a4cbb7cb510}, might want to try resetting it, or make sure you have full control with Domain User and System.

And yet another possibility could be related file or files being corrupted, eventcls.dll, eventvwr.exe, eventvwr.msc ...  In this case using the System file checker tool would correct this - http://support.microsoft.com/kb/936212


There's more, but I don't want to overwhelm you all at once... Let me know if you need further assistance.


Regards,
Phant0m``

[Sebo.PL]

The most common seems to be the existence of a file "eventvwr.exe.config" in the :\WINDOWS\System32 directory.

There is no such file or any similar.

Another possibility could be with the registry permissions for HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MMC\SnapIns\FX:{b05566ad-fe9c-4363-be05-7a4cbb7cb510}, might want to try resetting it, or make sure you have full control with Domain User and System.

The permissions for that registry key and all subkeys and values are inherited from HKEY_LOCAL_MACHINE\SOFTWARE and set to:

Users:	Code: [Select] Query Value; Enumerate Subkeys; Notify; Read Control.	This key and subkeys
Administrators:	Code: [Select] Full Control; Query Value; Set Value; Create Subkey; Enumerate Subkeys; Notify; Create Link; Delete; Write DAC; Write Owner; Read Control.	This key and subkeys
SYSTEM:	Code: [Select] Full Control; Query Value; Set Value; Create Subkey; Enumerate Subkeys; Notify; Create Link; Delete; Write DAC; Write Owner; Read Control.	This key and subkeys
CREATOR-OWNER:	Code: [Select] Full Control; Query Value; Set Value; Create Subkey; Enumerate Subkeys; Notify; Create Link; Delete; Write DAC; Write Owner; Read Control.	Subkeys

And yet another possibility could be related file or files being corrupted, eventcls.dll, eventvwr.exe, eventvwr.msc ...  In this case using the System file checker tool would correct this - http://support.microsoft.com/kb/936212

I've run System file checker and it has detected some corrupted files but none of those you've listed.

Code: [Select]

Microsoft Windows [Version 6.0.6000]
Copyright (c) 2006 Microsoft Corporation. All rights reserved.

C:\Windows\system32>sfc /scannow

Starting to scan the system. This process may take some time.

Beginning verification phase of the scanning system.
Verification completed in 100%. The function of the Windows Protection has found corrupted files but can not fix some of them.
Details can be found in the CBS.Log file windir\Logs\CBS\CBS.log. For example
C:\Windows\Logs\CBS\CBS.log

C:\Windows\system32>Anyway I can't even find a clear list of the corrupted files in the CBS.log file but I've searched its content for 'event' phrase and there was no such with current timestamp.
There are only some lines like this:

Code: [Select]

2009-02-06 15:03:30, Info                  CSI    0000245c Performing 1 operations; 1 are not lock/unlock and follow:
  StageFile (2): flags: 8 app: (null) comp: Microsoft-Windows-WCFCoreComp.Resources, Version = 6.0.6000.16730, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture = [l:10{5}]"pl-pl", VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral file: [ml:54{27},l:52{26}]"ServiceModelEvents.dll.mui" srcfile: @0x61569c4Anyway 2009-02-06 seems to be a few days ago

And avast! on access scanner @ my computer still does not works

[Sebo.PL]

It seems I have to try some other AV