Author Topic: BSOD Session5-inialization-failed- BPP 6.0.1373 - affecting all XP clients  (Read 5301 times)

0 Members and 1 Guest are viewing this topic.

Offline 1tb

  • Jr. Member
  • **
  • Posts: 71
I'm trying to sell avast BPP to a new client to replace Trend Micro SMB. Their server is SBS2003 and all workstations all same hardware - DELL Vostro 2GB RAM- all low spec- all XPSP3. After uninstalling Trend client then pushing BPP out from SBS2003 (successfully to 9 out of 10 pc's) we are over the course of the next days seeing all workstations randomly experiencing BSOD. Session5-inialization-failed 0x000000071 (0x00000000, 0x00000000, 0x00000000, 0x00000000).
Once it happens, if we try Safe Mode, or Enabling Boot Logging- CHKDSK runs (can't stop it- keyboard unresponsive and cannot skip it) but on restart after running CHKDSK okay, we see same BSOD over and over (boot-loop). The only solution to get out of the boot loop is 'Last Known Good Configuration'.

These PC's are all  and all exhibiting this random behaviour after installing avast BPP 6.0.1373 (120520-1): over the last few days. I've uninstalled BPP client on one of them and it now works flawlessly all day. The others intermittently still chuck a BSOD at random times(1 to 3 times a day).

The thing they all have in common is that at some stage of their lives, they all had AVG Free followed by Trend Micro SMB. Other than that they all run pretty much the same software and obviously have the same driver support (same mobo + chipset).

Initially I tried to blame hardware but as it is happening on all workstations I'm afraid I find that improbable.

Event log error from one of the pc's: The computer has rebooted from a bugcheck.  The bugcheck was: 0x100000d1 (0x00690050, 0x00000002, 0x00000000, 0xb9e8d49a). A dump was saved in: C:\WINDOWS\Minidump\Mini052112-01.dmp.

I have attached two minidumps from two separate pc's that this happened on at almost the exact same time this morning. (extension renamed .log for posting)

Can one of the avast guru's please take a look at the dumps as I am all out of ideas and only 22 days left in the trial to make the sale!  Thanks.
« Last Edit: May 21, 2012, 01:48:40 PM by 1tb »

Offline giogio

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 4088
Hi,
I've checked the two minidumps and it's seems caused by the driver iaStor.sys.. also involves usbport.sys. (see image attached)
Reading minidumps it's seems not caused by avast.. but I'm not sure at 100% !
Prior to do other things, can you try to update Intel Matrix Storage Manager driver on one machine? Or try to go on windows update website to see if there's an optional hardware update for your pc?

If you think it depends by the old installed antivirus try to go here
http://singularlabs.com/uninstallers/security-software/
and download and run the properly AV uninstall tool.
« Last Edit: May 21, 2012, 06:54:55 PM by giogio »
Prima di scrivere sul forum per favore leggi le istruzioni qui https://forum.avast.com/index.php?topic=144453.0
Non inviatemi MP per supporto,grazie-No support PM please
Home: E8400-4GB RAM-500GB HDD-Win10.0.15063x64-Avast! Free 17.3.2291-CryptoPrevent-MBAM 2.2free-Chrome 57(uBlock origin)-TB52
Work: i5-2400-4GB RAM-500GB HDD-Win 7sp1x64-Avast!Business Security 12.3.2515,     
Cloud Console 2.18
-FF52-TB52

Offline avast@@dvantage77.com

  • J.R. Guthrie - avast! Sales and Support Specialist
  • Avast Reseller
  • Advanced Poster
  • *
  • Posts: 736
  • the only avast! Distributor & Platinum Reseller
    • Advantage Micro Corporation
Dear 1tb,

I am an Intel Premier Provider, and I know avast! is compatible with the IAstor driver.  I believe that you are dealing with leftovers from preious antivirus installs.  I have consistantly battled these issues, even long before my avast! venture in Feb 2003.  I know this is a pain, but here is my document on how WE solve this issue:

When all else fails, discovery and removal of antivirus leftovers!


02-16-2012
By J.R. Guthrie

Antivirus software is the most invasive application we will ever install on our systems.  Even when the products are properly removed by “Add/Remove Programs”, pieces of code are ALWAYS left behind, and these leftovers can and do conflict with the current antivirus products installed in your system.  This situation has occurred throughout my entire career, and is effected by most antivirus vendors (Symantec, Norton, and McAfee just to tag a few.)  These symptoms range from no Internet access, system errors, revolving “boot looping”, and the dreaded Microsoft BSOD (blue screen of death)  Windows XP appears to be much more susceptible to trouble when upgrading your antivirus.  Where Windows 7 will let avast! 6 install over avast! 4 with almost never an issue (but highly NOT recommended)
 
 
 
Recovery from the A/V process gone awry:
 
 
 
It’s easy to know what antivirus software has been on your computer when you are the guy that loaded it.  What about when you inherit system support on computers that you do not know what was installed prior.  This is where the discovery and removal process for anti-virus leftovers will save you time and grief in getting systems back to par!
 
This particular process is specific to avast! 6 upgrading over an avast! 4 or avast! 5 installation, however it also applies to other antivirus vendors as well. I have been through this process, removing avast! 4.8, then removing avast! 6 with the uninstaller, and then having to use the removal tool for other A/V vendors that had previously been installed. If you look in your “Program Files” directory, you can find leftover directories of every antivirus / program that was loaded on the system. Microsoft leaves these directories in case you use the “system restore” function, where you go back in time to when one of these programs was still installed and functional.  This prevents a system restore from crashing your system due to missing directories / programs.  Once identified, I used those vendors uninstallers, and have had sporadic success. The last resort is: “WHEN ALL ELSE FAILS” procedure at the end of this article.  Hopefully you won’t have to go there. Here is a most comprehensive list of uninstallers at SingularLabs.  Almost every A/V is here:
 
http://singularlabs.com/uninstallers/security-software/
 
 
 
This REMOVAL process is specific to avast! 6 upgrading over an avast! 4 or avast! 5 installation (also use when upgrading avast! Free to avast! Pro)
 
1)            Remove all avast!  versions as well as any other A/V programs from add/remove programs in control panel.
 
2)            Download the latest version of avast! Uninstall Utility (aswclear.exe) and save it on your desktop.
 
http://files.avast.com/files/eng/aswclear.exe
 
3)            Start Windows in Safe Mode (F8 key before Windows splash screen on a reboot)
 
4)            Open (execute) the uninstall utility aswclear.exe
 
5)            Choose which version of avast! to uninstall. This process will be repeated for each avast! version (4, 5, and 6)  So let’s assume we had all 3 versions of avast! installed at some point. So we choose version 4.8 and proceed.
 
6)            If you installed avast! in a different folder than the default, browse for it. (Note: Be careful! The content of any folder you choose will be deleted!)
 
7)          Click REMOVE, close aswclear, and open aswclear, and remove avast! 5, and repeat this process for all versions of avast
 
8)          Restart your computer
 
The “WHEN ALL ELSE FAILS” procedure to “scrape” all of avast! remnants from a computer system (AKA Pete Scrape) using the avast! example:
 
1) Add remove programs, remove avast!, restart.
 
2) Go to safe mode, use avast! removal tool, select avast! version #, restart, and repeat for every avast version ever loaded on that system
 
3) In Local disk C:, ProgramFiles, delete “avast” and “Alwil” directories if there. Look here for the other A/V vendors, that you will also have to deal with on a similar basis
 
4) In C:\Windows\temp, remove all.
 
5) Start, run, type “%temp%” and remove all.
 
6) Do a Windows search on all hard disks for instances of “avast” and “Alwil” and delete all.
 
7) Start, run, type “regedit” (Windows key + R). Under Hkey, current user, software, and remove “avast” and “Alwil”, then under Hkey, local machine, software,  and remove “avast” and “Alwil” (This is specific to Windows XP)
 
Use CCleaner to remove the rest of any avast! orphaned registry remnants, and restart.
 
9) Install avast! and reboot!
 
10) Usually, good luck at this point.  And you can substitute other manufacturers products into this script.  Remember, registry hacking is always risky, so always have a backup before you proceed.  It’s kinda like the acknowledgement checkbox in LSPfix, “I know what I’m doing, or, I like to reinstall my operating system”
 
J.R.  Guthrie
Sincerely,
 
J.R. "AutoSandbox Guy" Guthrie

"At this point in time, the Internet should be regarded as an Enemy Weapons System!"

Offline 1tb

  • Jr. Member
  • **
  • Posts: 71
Thank you to both replies. Before I installed avast I did run Trend uninstall from control panel (but not a cleaner), however I did download and run the AVG removal tool. Even after this ran I still see hidden $AVG folder. Also noted that avast BPP 6.0.1373 detects tmtdi.sys as a rootkit on one of the pc's but fails to remove/quarantine it. I think this is a leftover Trend driver, but maybe it is an infected driver/rootkit?

I'll try http://singularlabs.com/uninstallers/security-software/ first, then I'll update iastor.sys (intel drivers). Then uninstall (aswclear.exe) avast, then push install out again. Trouble is just finding a window when it doesn't affect the business. (a busy Medical practice).


Offline avast@@dvantage77.com

  • J.R. Guthrie - avast! Sales and Support Specialist
  • Avast Reseller
  • Advanced Poster
  • *
  • Posts: 736
  • the only avast! Distributor & Platinum Reseller
    • Advantage Micro Corporation
I believe that the "tmtdi.sys" is the Trend Micro firewall file.  So, your assuption is correct, we are dealing with leftovers. You may need to apply the "when all else failes" and substitute Trend for avast! in the search criteria.
Sincerely,
 
J.R. "AutoSandbox Guy" Guthrie

"At this point in time, the Internet should be regarded as an Enemy Weapons System!"

tmdrake

  • Guest
Delt with this problem all of last week....now to upgrade to 7.x.

Offline avast@@dvantage77.com

  • J.R. Guthrie - avast! Sales and Support Specialist
  • Avast Reseller
  • Advanced Poster
  • *
  • Posts: 736
  • the only avast! Distributor & Platinum Reseller
    • Advantage Micro Corporation
Everything is online as of today, all avast! version 7 Endpoint Protection products!
Sincerely,
 
J.R. "AutoSandbox Guy" Guthrie

"At this point in time, the Internet should be regarded as an Enemy Weapons System!"