I opened a support ticket immediately with this one, because it’s a pretty urgent problem (seems to have caused our primary server in a business LAN to need an ungraceful shutdown during business hours, with potential data loss), but I haven’t received any reply from support in over 24 hours so I will post here also:
AMS is installed on a computer running Windows Server 2003 R2 SP1, Enterprise Edition, call it server A. The managed client on server A stopped communicating with AMS shortly after its nightly scheduled on-demand scan started, two nights ago. Meanwhile the managed client on server B (Windows Server 2003 SP1, Standard Edition), which is our “primary” domain controller and main application & file server, also stopped communicating with AMS, at about the same time.
On both machines, a logged-in console session was active and when we connected to it we found the following pop-up, labeled “Microsoft Visual C++ Runtime Library”:
Runtime Error!
Program: D:\Program Files\Alwil Software\Avast4\AvastAgent.exe
This application has requested the Runtime to terminate it in an unusual way. Please contact the application’s support team for more information.
[OK]
We clicked “OK” on server B and then manually instructed the managed client on that server to do an iAVS update. At this point the console started to become unresponsive.
Meanwhile several of our XP machines (I think 5 of them) also were having trouble. Like the servers, they had not contacted the AMS since shortly after their nightly on-demand scan started. We could not even log into these computers. The log-in process would start and then appear to hang at a blue screen (not blue-screen-of-death, just the default background blue of XP), or in some cases they would “hang” after the user’s desktop wallpaper appeared.
In all cases we could use pslist from sysinternals to remotely view the processes running on the XP clients, and no process seemed to be running abnormally. CPU would bounce between 99% and 100% idle, and as far as we could tell, no process was eating huge amounts of memory. I assume that AvAgent.exe hit the runtime error on the XP machines also, because these machines were not communicating with AMS. But we can’t know for sure because there was no active session logged-in to these machines, that we could just connect to. And the runtime error does not seem to leave any trace of itself in the Windows event logs, or in avast’s internal logs, either on the clients or on the AMS.
Meanwhile our 20 other XP machines were doing just fine. Eventually people started having trouble opening shared files on server B, though, and since we couldn’t get into its console we had to force it to shut down by physically powering it off. The windows “shutdown” tool did not work from a remote computer. :-\
Just wondering if anyone else has seen this or if anyone at Avast can recommend troubleshooting tips. The AvAgent.exe on server A is still in the state we found it in yesterday morning, with the Runtime error popped-up on the screen. I used userdump.exe to take a process dump (which seems to have failed, at least partially) and I put a zipped copy of the dump in ftp.avast.com/incoming. The file is named after the support request I opened yesterday. I’m happy to do any other debugging/troubleshooting that’s required.
We are running ADNM 4.7.608 and AMS v4.7. The managed client installed on the two servers is 4.7.700.0, but the client installed on most of the XP machines that were having trouble is 4.7.599.0 (one of them is running 4.7.700.0, though).
Thanks in advance for any help.