system
November 15, 2007, 8:54pm
1
Hi everyone,
I don’t know if anyone will be able to help me with this…
Just recently, when scanning with Avast (standard or thorough), the scan hangs/freezes. It’s done it when it reached C\RECYCLER and on Zone Alarm files. If I try to stop the scanner, I get the ‘egg-timer’ and I have to close the interface using the Task Manager. Only Avast is affected, the rest of the PC functions normally.
The only thing I’ve altered on the PC recently is to add a 2nd Harddrive, formatted as a Basic NTFS drive, to be used for storage (no OS). I’ve added no data to the drive yet. Thinking this might be the problem, I disabled the new drive in the bios, and indeed, Avast then functions as normal. Having enabled the new drive again, I find that Avast won’t scan it using the context menu either. It gets to ‘3 files scanned’ and hangs. The only thing in there are a couple of ‘hidden files’, namely RECYCLER (85 bytes) and System Volume Information (‘folder is empty’). In properties, the drive apparently has 65.6MB in it, which made no sense to me (85 bytes + ‘empty’ = 65.6MB???)
Has anyone got any idea where I’ve gone wrong with this drive, and why it’s causing problems for Avast?
Many thanks for any help.
Graham.
(XP Pro, Avast 4.7.1043, 071114-0)
igor0
November 15, 2007, 9:10pm
2
Strange…
When the program is frozen, please try to create a dump. The description is here:http://forum.avast.com/index.php?topic=27240.msg222376#msg222376
For Simple UI it would be:
Thanks.
system
November 16, 2007, 12:21am
3
I’ve tried standard and thorough scans, with and without achive scanning, and the result is the same.
When the program is frozen, please try to create a dump. The description is here:http://forum.avast.com/index.php?topic=27240.msg222376#msg222376
For Simple UI it would be:
I’m sorry, I don’t fully understand how to do this. Is this right:
download and save ‘userdump.exe’
scan with avast until it freezes
once frozen, run the downloaded file.
When you say use the following parameters… (which will be replaced by ‘userdump.exe ashSimpl.exe c:\ashsimple.dmp’ if I’m scanning using the main program and not context)… where do I enter these details?
igor0
November 16, 2007, 12:29am
4
Suppose you save the userdump.exe file into C:C:\userdump.exe ashSimpl.exe c:\ashsimple.dmp
Then, we’d be interested in the c:\ashsimple.dmp file, of course.
system
November 16, 2007, 1:02am
5
Hi Igor,
I’ve created the dmp file and zipped it, but unfortunately, I now find that I don’t know how to upload it to ftp://ftp.avast.com/incoming , sorry! :-[
DavidR
November 16, 2007, 2:25am
6
To Upload them to ftp://ftp.avast.com/incoming - First Connect to the link (just click it in your browser, use IE or clone, might be best I can’t get firefox to work) and drag the zip file from windows explorer into the Right pane and drop it, that starts the upload, you don’t have read access to this folder.
I don’t know what you have called the zip file but it might help to call it say GrahamMemDmp.zip so that it can be identified as coming from you, just in case there happens to be any other ashsimpl.zip uploaded (probably not but a good habit to get into)
system
November 16, 2007, 4:18am
7
GrahamE are you having this problem only with avast! or other software is affected as well?
Please correct me if I’m wrong but usually this type of lockups are related with IRQs & DMAs conflicts.
system
November 16, 2007, 10:47am
8
To Upload them to ftp://ftp.avast.com/incoming - First Connect to the link (just click it in your browser, use IE or clone, might be best I can’t get firefox to work) and drag the zip file from windows explorer into the Right pane and drop it, that starts the upload, you don’t have read access to this folder.
I don’t know what you have called the zip file but it might help to call it say GrahamMemDmp.zip so that it can be identified as coming from you, just in case there happens to be any other ashsimpl.zip uploaded (probably not but a good habit to get into)
Hi David,
My confusion arose because when I clicked on the link, a plain white page with “to view this FTP page in Windows Explorer, click ‘page’ and then ‘open FTP site in Windows Explorer’”. Having done that I was faced with an empty page with no instructions. Your picture was all the explanation I needed, and I’ve uploaded it now (“GrahamE avastdmp.zip”).
Thanks as always, for your help.
system
November 16, 2007, 10:58am
9
As far as I know so far, nothing else is affected. I tried to search for and understand IRQ’s and DMA’s and can’t answer you I’m afraid. I did notice in ‘Disk Management’ that both my existing HDD and the new one are both ‘primary drives’. Is that right?
DavidR
November 16, 2007, 1:43pm
10
Hi David,
Thanks as always, for your help.
Your welcome, hopefully Igor will be able to get on the case now.
igor0
November 16, 2007, 1:52pm
11
There is nothing really suspicious in this dump - avast! seems to be scanning, or in particular opening a file (so the program is actually stuck somewhere in kernel code responsible for file opening - which is an information that is not present in this kind of dump).
To find why it’s stuck in kernel, we would need the kernel dump (“bluescreen”). However, the filename being opened got some hits on google… could you please try to run a rootkit scanner (e.g. GMER ) on your machine?
system
November 16, 2007, 4:11pm
12
There is nothing really suspicious in this dump - avast! seems to be scanning, or in particular opening a file (so the program is actually stuck somewhere in kernel code responsible for file opening - which is an information that is not present in this kind of dump).
To find why it’s stuck in kernel, we would need the kernel dump (“bluescreen”). However, the filename being opened got some hits on google… could you please try to run a rootkit scanner (e.g. GMER ) on your machine?
Igor, I’d already run AVG and Panda anti-rootkit scanners prior to posting on here, and both came up with nothing. I’ve done a scan now with gmer, and it has a long list in it that means nothing to me at all. What do I do, save the log and post it here? Thanks
system
November 16, 2007, 4:19pm
14
GMER 1.0.13.12551 - http://www.gmer.net
---- System - GMER 1.0.13 ----
SSDT ??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys ZwClose
---- Kernel code sections - GMER 1.0.13 ----
.text ntoskrnl.exe!_abnormal_termination + 104 804E2760 12 Bytes [ 70, 42, 91, AA, 20, A5, 91, … ]
---- Kernel IAT/EAT - GMER 1.0.13 ----
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisRegisterProtocol] [AA9189F0] \SystemRoot\System32\vsdatant.sys
system
November 16, 2007, 4:21pm
15
#2
---- Devices - GMER 1.0.13 ----
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE [F74721DE] fltMgr.sys
Device \Driver\Tcpip \Device\Ip IRP_MJ_CREATE [AA925CC0] vsdatant.sys
system
November 16, 2007, 4:24pm
16
#3
Device \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE [AA925CC0] vsdatant.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE [F75178E6] aswTdi.SYS
system
November 16, 2007, 4:25pm
17
#4
AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_CREATE [F75178E6] aswTdi.SYS
Device \Driver\Tcpip \Device\RawIp IRP_MJ_CREATE [AA925CC0] vsdatant.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_CREATE [F75178E6] aswTdi.SYS
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_CREATE [AA925CC0] vsdatant.sys
system
November 16, 2007, 4:25pm
18
#5
AttachedDevice \FileSystem\Fastfat \Fat IRP_MJ_CREATE [F74721DE] fltMgr.sys
---- Registry - GMER 1.0.13 ----
Reg \Registry\USER\S-1-5-21-790525478-2025429265-839522115-1003\Software\Zepter Software\RegLib
---- EOF - GMER 1.0.13 ----
system
November 16, 2007, 4:26pm
19
That’s it. Sorry if there was an easier way to do that !
Vlk
November 16, 2007, 5:26pm
20
I see that you have ZoneAlarm, SpywareTerminator as well as CounterSpy installed on the machine. Maybe they’re just conflicting with each other.
Well, to be 100% sure, I’d actually need to have a lookg at the full dump (not just the process dump you already sent).
For instructions on how to create it and deliver it to us, please see: http://support.avast.com/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=71
Cheers
