Avast 5.0 freezes on boot-time scan

[dlaraH]

Hi !

On w2k Avast 5.0 freezes on boot-time scan (1%) blue screen with "non-page errors" ??!
No viruses or other malfunctions found with any other software !

Any ideas ?

rgds,

dlaraH

[Lisandro]

Can you boot in Safe Mode and uninstall avast?
Which was your old antivirus before avast?

[igor]

Do you have any recent minidumps in C:\Windows\Minidump folder? (or maybe C:\WinNT\Minidump, if that's your Windows folder)
Even though I don't think it has anything to do with the boot-time scanner (it's an ordinary user mode application, i.e. it certainly shouldn't bluescreen the system itself) - they might tell us what's going on.

[dlaraH]

Can you boot in Safe Mode and uninstall avast?
Which was your old antivirus before avast?

Hi !

I could boot in safe-mode and uninstall, if I want.
- would you like to recoommend that ?

First I used Norton several years and thereafter I jumped into Avast 4.0

[dlaraH]

Do you have any recent minidumps in C:\Windows\Minidump folder? (or maybe C:\WinNT\Minidump, if that's your Windows folder)
Even though I don't think it has anything to do with the boot-time scanner (it's an ordinary user mode application, i.e. it certainly shouldn't bluescreen the system itself) - they might tell us what's going on.

Minidump folder is totally empty, ie. 0 bytes !

[Lisandro]

I could boot in safe-mode and uninstall, if I want.
- would you like to recoommend that ?

If you can't boot in other way, that will be the wiser thing to do right now, until you can correctly install it.

First I used Norton several years and thereafter I jumped into Avast 4.0

The Norton Removal Tool uninstalls all Norton 2003-2010 products from your computer.

1) (If possible) Remove Symantec products through Add/Remove programs from Control Panel. Boot.
2) Use Norton Removal Tool for Windows 2000/XP/Vista/7 or Norton Removal Tool for Windows 98/Me. Boot.
3) Install avast! (or repair the installation) and boot.

[dlaraH]

I could boot in safe-mode and uninstall, if I want.
- would you like to recoommend that ?

If you can't boot in other way, that will be the wiser thing to do right now, until you can correctly install it.

I can boot - problem is Freezing during Boot-Time Scan of Avast5.0

First I used Norton several years and thereafter I jumped into Avast 4.0

The Norton Removal Tool uninstalls all Norton 2003-2010 products from your computer.

1) (If possible) Remove Symantec products through Add/Remove programs from Control Panel. Boot.

Already removed succesfully years ago !

2) Use Norton Removal Tool for Windows 2000/XP/Vista/7 or Norton Removal Tool for Windows 98/Me. Boot.
3) Install avast! (or repair the installation) and boot.

Already re-installed twice !

[Lisandro]

Did you use Norton uninstall tool?

[dlaraH]

Did you use Norton uninstall tool?

So far as I remember Yes (99% sure) - that was at least three years ago !
- anyway if I am searching any "Norton", nothing will be found !
- I just rechecked the situation by using Norton Uninstall Tool, which obviously found "something" to remove (some traces of LU(LiveUpdate etc.)
- The GUI of this Tool seemed not familiar to me, so therefore I guess I removed Norton by using in-built Uninstall-feature(which obviously did not remove everything !)
- do you prefer now first to uninstall Avast5.0 and re-install or just try Boot-Time Scan again ?

[dlaraH]

Just rechecked the situation after usising Norton Uninstal Tool and before re-installing AVAST5.0:
- no change => still freezing

Some more info:
- Boot-time-scan starts normally and continues abt. 15 Min, (1%)
- the freezing happens when scanning " My Documents/.../Service Pack 1/Red_cab
=> *** STOP: 0x0000004D (0x0000162FC,0x000162FC,0x00007DE7,0x00000000)
   NO_PAGES_AVAILABLE

What next ?
 

[SafeSurf]

1. How much RAM do you have on your machine?

2. Avast is working fine otherwise? 
3. Have you run an Avast FULL scan?  Clean?  Is there anything in the Virus Chest?

4. What other security software do you currently have on your machine and did you have on your machine in the past other than Norton, including antivirus (AV), firewall (FW), and other security software?  How did you remove them (the vendor's uninstaller tools or some other way)?

5. Please check your computer for malware with Malwarebytes’ Anti-Malware (MBAM).
·   Download free http://www.malwarebytes.org/ for an on-demand scanner.
·   Double Click mbam-setup.exe to install the application.
·   After install, click update so you have latest database before scanning.
·   Under Settings:
o   General: Automatically Save File After Scan Completes is checked off
o   Scanner Settings:  Check all boxes
o   Updater: Download and install update if available is checked off
·   Once the program has loaded, select "Perform FULL Scan", then click Scan.
·   The scan may take some time to finish, so please be patient.
·   When the disinfection scan is complete, a log will appear in Notepad and you may be prompted to Restart. (See Extra Note).
·   Click the “remove selected” button to quarantine anything found.  You will find the infection details under the Quarantine tab.
·   The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
·   Copy & Paste the entire report in your next reply.

Please let me know if you have any questions.  Thank you.

[dlaraH]

1. RAM size is 383 MB
2. AVAST is working perfectly otherwise
3. AVAST full scan has been carried out.Everything clean. Nothing in the Virus Chest
4. Currently IObit Security 360 v1.50; no other FW or AV than Norton installed earlier
5. MBAM installed and used also earlier
.  Now also updated and FULLscanned
.  VOW ! four items found and quarantined & removed !.  See the copy below:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4665

Windows 5.0.2195 Service Pack 4
Internet Explorer 6.0.2800.1106

21.9.2010 21:02:00
mbam-log-2010-09-21 (21-02-00).txt

Scan type: Full scan (C:\|)
Objects scanned: 159861
Time elapsed: 1 hour(s), 47 minute(s), 37 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\Program Files\pdfforge Toolbar\FF\components\pdfforgeToolbarFF.dll (Adware.WidgiToolbar) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Program Files\pdfforge Toolbar\WidgiHelper.exe (Adware.WidgiToolbar) -> Quarantined and deleted successfully.
C:\Program Files\pdfforge Toolbar\FF\components\pdfforgeToolbarFF.dll (Adware.WidgiToolbar) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\Program Files\pdfforge Toolbar\IE\1.1.2\pdfforgeToolbarIE.dll.vir (Adware.WidgiToolbar) -> Quarantined and deleted successfully.

What next ?

Thanks in adwance !

[SafeSurf]

Are all the problems you listed earlier on in the thread resolved now?  Are you able to do an Avast Boot-time scan?  If so, please do one and report the results.

Just to confirm, you did run the Norton removal tool when asked during this thread...correct?

Are you MS (Windows) Updates current?

Make sure you keep your Avast definitions current. 

I'd like to clean your machine and have you to install CCleaner.  It is a freeware system optimization, privacy and cleaning tool.  There is a Slim version available as well at http://www.piriform.com/ccleaner/builds - 4th option down.  It removes unused files (cache, temporary Internet files, etc.) from your system - allowing Windows to run faster and freeing up valuable hard disk space.  It also cleans traces of your online activities such as your Internet history.  Additionally it contains a fully featured registry cleaner - do not use right now.  Just do the cleaner part.

In addition, you should probably put any exe. files, pictures, documents, music onto  USB/flash drives to free up memory.  You really do not have enough memory on your machine and this could be causing some of your Avast problems...but not the malware problems.

After getting back to me on the scan, I'll give you further instructions.  Thank you.

[dlaraH]

The only problem noticed was and still is: Freezing on AVAST 5.0 during Boot-Time-Scan even exactly on the same event now as before:
- the freezing happens when scanning " C:\My Documents\...\Service Pack 1\mFileBagIDE.dll\bag\vc_red.cab
=> *** STOP: 0x0000004D (0x0000162FC,0x000162FC,0x00007DE7,0x00000000)
   NO_PAGES_AVAILABLE

aswBoot.log-file is created as below:

CmdLine - quick
aswBoot.exe /A:"*" /L:"1033" /heur:80 /pup /archives /IA:0 /KBD:1 /dir:"C:\Program Files\Alwil Software\Avast5"
CmdLine end
SafeBoot: 0
CreateKbThread
new CKbBuffer
CKbBuffer::Init
CKbBuffer::Init end
NtCreateEvent(g_hStopEvent)
dep_osBeginThread - KbThread
CreateKbThread end
NtInitializeRegistry
KbThread start
ReadRegistry
DATA=C:\Documents and Settings\All Users\Application Data\Alwil Software\Avast5
PROG=C:\Program Files\Alwil Software\Avast5
BUILD=677
Microsoft Windows 2000 Service Pack 4
SystemRoot=C:\WINNT
TEMP=C:\WINNT\TEMP
TMP=C:\WINNT\TEMP
ReadRegistry end
CreateTemp
CreateTemp end
aswcmnbDllMain
cmnbInit
aswEnginDllMain(DLL_PROCESS_ATTACH)
InitLog
InitLog end
CmdLine - full
aswBoot.exe /A:"*" /L:"1033" /heur:80 /pup /archives /IA:0 /KBD:1 /dir:"C:\Program Files\Alwil Software\Avast5"
CmdLine end
Program folder: C:\Program Files\Alwil Software\Avast5
Engine folder: C:\Program Files\Alwil Software\Avast5\defs\10092200
TimeStamp: 4c8b73cf
Unschedule
61,00,75,00,74,00,6F,00,63,00,68,00,65,00,63,00,
6B,00,20,00,61,00,75,00,74,00,6F,00,63,00,68,00,
6B,00,20,00,2A,00,00,00,73,00,6D,00,72,00,67,00,
64,00,66,00,20,00,43,00,3A,00,5C,00,50,00,72,00,
6F,00,67,00,72,00,61,00,6D,00,20,00,46,00,69,00,
6C,00,65,00,73,00,5C,00,69,00,6F,00,6C,00,6F,00,
5C,00,53,00,79,00,73,00,74,00,65,00,6D,00,20,00,
4D,00,65,00,63,00,68,00,61,00,6E,00,69,00,63,00,
20,00,36,00,22,00,00,00,61,00,73,00,77,00,42,00,
6F,00,6F,00,74,00,2E,00,65,00,78,00,65,00,20,00,
2F,00,41,00,3A,00,22,00,2A,00,22,00,20,00,2F,00,
4C,00,3A,00,22,00,31,00,30,00,33,00,33,00,22,00,
20,00,2F,00,68,00,65,00,75,00,72,00,3A,00,38,00,
30,00,20,00,2F,00,70,00,75,00,70,00,20,00,2F,00,
61,00,72,00,63,00,68,00,69,00,76,00,65,00,73,00,
20,00,2F,00,49,00,41,00,3A,00,30,00,20,00,2F,00,
4B,00,42,00,44,00,3A,00,31,00,20,00,2F,00,64,00,
69,00,72,00,3A,00,22,00,43,00,3A,00,5C,00,50,00,
72,00,6F,00,67,00,72,00,61,00,6D,00,20,00,46,00,
69,00,6C,00,65,00,73,00,5C,00,41,00,6C,00,77,00,
69,00,6C,00,20,00,53,00,6F,00,66,00,74,00,77,00,
61,00,72,00,65,00,5C,00,41,00,76,00,61,00,73,00,
74,00,35,00,22,00,00,00,00,00,
Unschedule end
LoadResources
LoadResources end
InitReport
InitReport end
Global exclusions:
NtSetEvent(g_hInitEvent) - 1
InitKeyboard
g_dwKbdNum: 1
CPU: Phys(1), Log(1), Aff(1), Feat(00000003)
FreeMemory: 319643648
avworkInitialize
s_dwKbdClassCnt: 1
InitKeyboard end
NtSetEvent(g_hInitEvent) - 2
GetKey
FreeMemory: 318955520
CKbBuffer::Wait
CKbBuffer::Get
CKbBuffer::Get end
CKbBuffer::Wait end
ProcessArea
avfilesScanAdd *MBR0
avfilesScanAdd *BOOTC:
Loading raw access support
avfilesScanAdd *RAW:C:\  [Fs: 000700ff, NTFS; Dev: 07, 00000020]
avfilesScanRealMulti begin

aswBoot.txt file is as below:

09/05/2010 18:54
Scan of all local drives


----------------------------------------
09/19/2010 17:20
Scan of all local drives


----------------------------------------
09/22/2010 17:56
Scan of all local drives


MS updates are updated !

Avast updates evere day automatically !

CCleaner used regularly already several years !

PC-load in my opinion is at "reasonable level":
- CPU: < 10%
- Memory: < 60% (normally abt 250 MB free)
- Handles ~ 5500
- Threads ~ 350
- Processes ~ 27
- free hard disk space ~ 5 GB (25%)
So far I understand AVAST Boot Time Scan starts at Booting sequence of the machine and files as pictures, documents, music etc. are not yet in any way "active" or loading the PC, but just laying on the hard disk.

Pls. explain how much free memory AVAST Boot Time Scan requires !

The Malware detected by MBAM was a surprise !
- AVAST Full System Scan and Advanced System Care did not detect them !!?

Further advices are mostly appreciated !

[SafeSurf]

The Malware detected by MBAM was a surprise !
- AVAST Full System Scan and Advanced System Care did not detect them !!?

I did not know that you had Advanced System Care (ASC), which is considered a security software that may conflict with Avast or other security software.  I highly suggest, since you have CCleaner and MBAM, to uninstall ASC to see if this is the cause of your problems (and it will free up a lot of memory).  In addition, some versions of ASC also have an antivirus (AV) in the product and this will definitely conflict with Avast - you cannot run 2 AV's at the same time.  After you uninstall ASC per the vendor's uninstall instructions, reboot twice.  Then use CCleaner and defrag your machine.  Reboot again.

Next, uninstall and do a clean install of Avast and see if this fixes your problem.

To answer your other questions re: how much memory does the Avast Boot scan use?  The boot scan is built into Avast, so you do not need to worry about using additional memory because you are not adding on an additional feature.  The boot scan is a special scan to use to find malware that sometimes can hide in other scans, that is why I suggested you run it since it did not show up on your Full scan but it did with MBAM.