BSOD continued...

[Cipro]

New topic carried over from Pre-release Refresh


Quote from: Cipro on Today at 07:43:28 PM
<snip>
I installed 1035 from The 1027 GUI only to be greeted with a BSOD on restart. After trying Windows startup repair and a couple more reboots I uninstalled Avast completely. Then I downloaded the full version 1035, installed it from scratch, and got the same BSOD.

Undaunted, I uninstalled 1035 again, installed 1000,upgraded to 1035 from the 1000 GUI, and got the BSOD again.
<snip>
Any suggestions?

Yes cut out the middle man of installing 6.0.1000 and updating to 6.0.1035 - try a clean install of 6.0.1035 or stick with 6.0.1000. Ideally you should start your own new topic if you need further help so it isn't buried in this topic. Where we can try and help and gather information about your system and previous security applications, etc.

- Download the latest 6.0.1035 pre-release version of avast, from the links at the start of this topic and save it to your HDD, somewhere you can find it again (if you didn't save your last download). Use that when you reinstall.

>>- Download the avast! Uninstall Utility, aswClear5.exe find it here and save it to your HDD (it has uninstall tools for both 5.x and 6.0.x).

    * 1. Now uninstall avast! (using add remove programs, if you can't do that start from the next step), reboot.
    * 2. run the avast! Uninstall Utility from safe mode, first for 5.x if previously installed and then for 6.0, once complete reboot into normal mode.
    * 3. install the latest version, reboot. >>



Thanks for your quick response, DavidR!

Unfortunately, it didn't help -- the BSODs continued. I even tried unchecking all of the MSCONFIG startups (Logitech Set-Point) to no avail.

Since my laptop is configured very similarly to my desktop I decided to update 1027 from the GUI and got the BSOD again. So, I ran the same uninstall/cleanup procedure without success. The good news is that I had saved a copy of 1027 on the laptop and I was able to reinstall it on both the laptop and the desktop. Sanity is restored.

My system setups are quite ordinary so I'm really surprised to be experiencing this issue. Is there anything I can do or submit to help? Thanks!

[DavidR]

What other security applications do you have installed ?

Have (or did) you another Anti-Virus installed in this system, if so what was it and how did you get rid of it ?

There should have been dump files created during the BSOD, if you can send them to avast for analysis.

Upload them to ftp://ftp.avast.com/incoming - Using Internet Explorer, Connect to the link and drag the file into the Right pane and drop it, that starts the upload, you don't have read access to this folder. Give the zip file you are uploading a unique name (Cipro_memory_dmp.zip, etc.), so they can identify it. It might not be a bad idea to create a text file (readme.txt) with any relevant information, this avast topic URL, user name, etc. etc. in the zip file.
How to upload it using the Run command-line in Windows: Windows Key + R (to get the run box), copy and paste this

Code: [Select]

explorer ftp://ftp.avast.com/incoming and drag the file into the window, from another explorer window.

[thisiscool]

maybe the BSOD isn't caused because of AVAST?
one of the main reasons for BSOD are over-heating, usually when you put too much presure on your system, and the cooling-system is stuck from dust,
it may occure.
try to take a vacume cleaner and gentley clean the dust just to make sure
another thing, what other av/firewalls do you have installed on your machine with avast currently to now?
another cause for bsod caused by higher-performence which is required from the system, is the motherboard.
try to check it as well, this was my problem before a lot of years.

that's all what is coming through my mind right now, try the dust thing.

[DavidR]

Lets not start jumping to conclusions here, a program update from one pre-release version to the next one shouldn't place that kind of strain on the system.

I would strongly recommend that you don't use a vacuum cleaner on your system as it is could cause a build up of static electricity and that is the last thing you want on sensitive electronic components.

Overheating rarely causes a BSOD and normally is a Black screen shutdown or a system/video freeze.

[Cipro]

OK, the memory dump with text file has been uploaded.

No other AV's running. Normally, on access the following are running:

Prevx 3
Comodo Firewall with Defense Plus (I disabled the firewall, D+, and sandbox throughout the installation process)
Javacool Spyware Blaster (Doesn't run any executable or process)

One thing we can be sure of is that overheating is not a concern.

Thanks again for your help, David.

For the record this is the hardware:
Desktop: Core2 Quad Q6600, 4GB Ram, ATI HD2600 - 256K Ram
Laptop: Core2 Duo P7450, 4GM Ram, Nvidia GeFore 9600M GT - 512k Ram

Software on both: Windows 7 Ultimate x64, Office 2010 Pro, Avast 6, Prevx 3.05.220, Comodo Firewall w/D+, Firefox 3.6.15 w/NoScript, Google Chrome, Malware Bytes, Super Antispyware, Javacool Spyware Blaster, Secunia PSI, Acronis True Image 2010

[DavidR]

Well No other AVs running isn't the full question as previously installed AVs (?) even if disabled or uninstalled can leave remnants that can have an effect on the next AV.

I don't think it is heat related as my reply to thisiscool states.

There have been some topics/posts related to Acronis True Image and avast, but I can't recall if this is/was linked to BSOD.

Presumably the MBAM and SAS versions are the free versions (on-demand) not Pro (resident) ?
Though a single resident anti-spy/malware application shouldn't conflict with avast, but multiple resident anti-spy/malware applications conflict with each other.

Hopefully one of the avast team can analyse the memory dump and try to identify the cause.

In the meantime try unchecking the avastUI, Real-time Shields, Behaviour Shield, Expert Settings, 'Monitor the system for unauthorised modifications' and see if that makes any difference. Whilst you are there it might be worth changing the Behaviour Shield, Action to take to Ask, that way you should see what it is checking out or finds suspicious.

[Cipro]

No other AVs. Both PCs were reformatted last June and Avast 5/6 are the only AVs they've ever had. MBAM and SAS are both the free on demand versions. I forgot to mention that I ran a full MBAM scan that came up clean.

Unchecking the Behavior Shield options had no effect

I spent much of the day trying everything I could think of. I uninstalled Acronis True Image and Prevx, disabled all startup processes, and stopped and set to manual all of the likely problematic services that the two PCs have in common. Nothing helped.

Finally, I restored everything except Acronis back to the way they were.

One positive: I've became extremely skilled at installing, uninstalling, and running the uninstall tool. There must be worth something.

At this point, I'll just have to hope that the Avast wizards find something in the memory dump. If the problem persists in the final release I'll probably start rebuilding the desktop in the hope of identifying the conflict. That's a daunting prospect.

Thanks for your help, as always.

[DavidR]

You could try first disabling the behaviour shield and install Acronis True Image.

If that doesn't work try uninstalling the behaviour shield element.

From Control Panel, Add Remove Programs (or Uninstall a Program), Avast, Uninstall/Change, select Change and uncheck the Behaviour Shield option, click Next and OK your way out, reboot and see if that resolves it. See image.

[SafeSurf]

The other suggestion I have is if you do reinstall Prevx is to put Prevx as an Exclusion in Avast:

1. Avast GUI > Settings > Exclusions > Add > Browse (find Prevx*) > click OK
2. Avast Real Time Shields > Expert Settings > Exclusions > Add > Browse (find Prevx*) > click OK
2. Avast Behavior Shield > Trusted Processes > Add > Browse (find Prevx*) > click OK

Test and see if you are still having problems.  If needed, add exclusions for Avast in Prevx:

1. In Prevx, leave everything at default (if you use SOL you can probably elevate your settings without problems).  Add Avast to Prevx Detection Overrides:
2. Prevx GUI > Settings > Add Override > (add Avast)

I use both programs without problems/conflicts.

[pk]

@Cipro, thanks for memory dump - the bug was already fixed (see here: http://forum.avast.com/index.php?topic=74304.msg616072;topicseen#msg616072).
Thanks!

[Cipro]

While I was writing my long post detailing my frustrating failure to isolate the BSOD cause, pk's post arrived announcing that it's already been fixed.

As I said before, I had disabled the firewall, Defense plus, and the sandbox but I never considered uninstalling Comodo.

In his linked post pk wrote:

I still add new & new features even between two public builds. In 1035 build I included better win32k.sys & ntdll.dll hooking, however Comodo IS wasn't expected such non-standard hooking variant (in fact, its component guard64.dll corrupted ntdll.dll file which led to wininit.exe crashes). I removed the problematic part, because we won't wait than they'd fix it.

corrupted ntdll.dll? Wow!!

Anyway, I eagerly await the next release and thank you all very much for your help.