Avast 5 just killed my Win XP pro dual boot config

Avast Free Antivirus / Premium Security
1

After dealing with network problems all week while setting up a new server and avast not doing what it is suppose to (allowing connection to my subnet) I gave it a go on installing avast 5 on my main workhorse. I have a dual boot setup (with ubuntu as another option.)

After uninstalling avast 4 - rebooting - installing 5 (xxx.499) with entering the license file key it asked me to reboot, which I did.

:-X :-[ :stuck_out_tongue: ::slight_smile: ??? :‘( :’( :‘( :’( :cry:

Capital F this – can’t even do a safe mode boot
nor a “last known good config boot!”

I will see what I can do with the info here:
http://forum.avast.com/index.php?topic=58029.0

Did not help much - but gave me some ideas.
Booting in Ubuntu I removed the folder in C:\Program Files\Alwil Software\Avast5 and also C:\Program Files\Alwil Software\Avast4 (funny that this was still around?!?!)

Now I need to find what BAT file to pull from the ini boot… any suggestions ?

2

these are the last entries in the WindowsUpdate.log file inside windows folder

2010-04-11 19:42:09:546 960 e70 Agent *********

2010-04-11 19:42:09:546 960 e70 Agent ** END ** Agent: Finding updates [CallerId = AutomaticUpdates]

2010-04-11 19:42:09:546 960 e70 Agent *************

2010-04-11 19:42:09:578 960 ed8 AU >>## RESUMED ## AU: Search for updates [CallId = {3E8E4438-9133-42C5-9206-1478FF891F3E}]

2010-04-11 19:42:09:578 960 ed8 AU # 0 updates detected

2010-04-11 19:42:09:578 960 ed8 AU #########

2010-04-11 19:42:09:578 960 ed8 AU ## END ## AU: Search for updates [CallId = {3E8E4438-9133-42C5-9206-1478FF891F3E}]

2010-04-11 19:42:09:578 960 ed8 AU #############

2010-04-11 19:42:09:578 960 ed8 AU Featured notifications is disabled.

2010-04-11 19:42:09:578 960 ed8 AU Setting AU scheduled install time to 2010-04-12 19:00:00

2010-04-11 19:42:09:578 960 e70 Report REPORT EVENT: {ECF7A339-5D87-46A3-8929-F75ECDC9DE23} 2010-04-11 19:41:54:843-0700 1 202 102 {00000000-0000-0000-0000-000000000000} 0 0 AutomaticUpdates Success Content Install Reboot completed.

2010-04-11 19:43:41:421 960 538 AU ########### AU: Uninitializing Automatic Updates ###########

2010-04-11 19:43:41:500 960 538 Service *********

2010-04-11 19:43:41:500 960 538 Service ** END ** Service: Service exit [Exit code = 0x240001]

2010-04-11 19:43:41:500 960 538 Service *************

3

setupapi.log

[2010/04/11 19:43:02 3740.33 Driver Install]

#-019 Searching for hardware ID(s): sw_aswndis

#-198 Command line processed: “C:\Documents and Settings\2\Local Settings\Temp_av_sfx.tm~a03724\avast.setup” /sfx /sfxstorage “C:\Documents and Settings\2\Local Settings\Temp_av_sfx.tm~a03724” /srcpath “C:\Documents and Settings\2\Desktop” /sfxname “setup_ais”

#I022 Found “sw_aswNdis” in C:\WINDOWS\inf\oem58.inf; Device: “avast! Firewall NDIS Filter Driver”; Driver: “avast! Firewall NDIS Filter Driver”; Provider: “ALWIL Software”; Mfg: “ALWIL Software”; Section name: “aswNdis.ndi”.

#I023 Actual install section: [aswNdis.ndi]. Rank: 0x00000000. Effective driver date: 08/14/2009.

#I393 Modified INF cache “C:\WINDOWS\inf\INFCACHE.1”.

#I063 Selected driver installs from section [aswNdis.ndi] in “c:\windows\inf\oem58.inf”.

#I320 Class GUID of device remains: {4D36E974-E325-11CE-BFC1-08002BE10318}.

#I060 Set selected driver.

#I058 Selected best compatible driver.

[2010/04/11 19:43:02 3740.37]

#-198 Command line processed: “C:\Documents and Settings\2\Local Settings\Temp_av_sfx.tm~a03724\avast.setup” /sfx /sfxstorage “C:\Documents and Settings\2\Local Settings\Temp_av_sfx.tm~a03724” /srcpath “C:\Documents and Settings\2\Desktop” /sfxname “setup_ais”

#W383 “drvindex.PNF” migrate: PNF Language = 0807, Thread = 0409.

[2010/04/11 19:43:03 3740.40 Driver Install]

#-019 Searching for hardware ID(s): sw_aswndismp

#-198 Command line processed: “C:\Documents and Settings\2\Local Settings\Temp_av_sfx.tm~a03724\avast.setup” /sfx /sfxstorage “C:\Documents and Settings\2\Local Settings\Temp_av_sfx.tm~a03724” /srcpath “C:\Documents and Settings\2\Desktop” /sfxname “setup_ais”

#I022 Found “sw_aswNdisMP” in C:\WINDOWS\inf\oem40.inf; Device: “avast! Firewall NDIS Filter Miniport”; Driver: “avast! Firewall NDIS Filter Miniport”; Provider: “ALWIL Software”; Mfg: “ALWIL Software”; Section name: “aswNdisMP.ndi”.

#I023 Actual install section: [aswNdisMP.ndi]. Rank: 0x00000000. Effective driver date: 08/14/2009.

#I063 Selected driver installs from section [aswNdisMP.ndi] in “c:\windows\inf\oem40.inf”.

#I320 Class GUID of device remains: {4D36E972-E325-11CE-BFC1-08002BE10318}.

#I060 Set selected driver.

#I058 Selected best compatible driver.

[2010/04/11 19:43:03 3740.43 Driver Install]

#-019 Searching for hardware ID(s): sw_aswndismp

#-198 Command line processed: “C:\Documents and Settings\2\Local Settings\Temp_av_sfx.tm~a03724\avast.setup” /sfx /sfxstorage “C:\Documents and Settings\2\Local Settings\Temp_av_sfx.tm~a03724” /srcpath “C:\Documents and Settings\2\Desktop” /sfxname “setup_ais”

#I022 Found “sw_aswNdisMP” in c:\windows\inf\oem40.inf; Device: “avast! Firewall NDIS Filter Miniport”; Driver: “avast! Firewall NDIS Filter Miniport”; Provider: “ALWIL Software”; Mfg: “ALWIL Software”; Section name: “aswNdisMP.ndi”.

#I023 Actual install section: [aswNdisMP.ndi]. Rank: 0x00000000. Effective driver date: 08/14/2009.

#I063 Selected driver installs from section [aswNdisMP.ndi] in “c:\windows\inf\oem40.inf”.

#I320 Class GUID of device remains: {4D36E972-E325-11CE-BFC1-08002BE10318}.

#I060 Set selected driver.

#I058 Selected best compatible driver.

#-166 Device install function: DIF_INSTALLDEVICEFILES.

#I124 Doing copy-only install of “ROOT\SW_ASWNDISMP\0000”.

#-166 Device install function: DIF_REGISTER_COINSTALLERS.

#I056 Coinstallers registered.

#-166 Device install function: DIF_INSTALLINTERFACES.

#-011 Installing section [aswNdisMP.ndi.Interfaces] from “c:\windows\inf\oem40.inf”.

#I054 Interfaces installed.

#-166 Device install function: DIF_INSTALLDEVICE.

#I123 Doing full install of “ROOT\SW_ASWNDISMP\0000”.

#I121 Device install of “ROOT\SW_ASWNDISMP\0000” finished successfully.

[2010/04/11 19:43:04 3740.75 Driver Install]

#-019 Searching for hardware ID(s): sw_aswndismp

#-198 Command line processed: “C:\Documents and Settings\2\Local Settings\Temp_av_sfx.tm~a03724\avast.setup” /sfx /sfxstorage “C:\Documents and Settings\2\Local Settings\Temp_av_sfx.tm~a03724” /srcpath “C:\Documents and Settings\2\Desktop” /sfxname “setup_ais”

#I022 Found “sw_aswNdisMP” in C:\WINDOWS\inf\oem40.inf; Device: “avast! Firewall NDIS Filter Miniport”; Driver: “avast! Firewall NDIS Filter Miniport”; Provider: “ALWIL Software”; Mfg: “ALWIL Software”; Section name: “aswNdisMP.ndi”.

#I023 Actual install section: [aswNdisMP.ndi]. Rank: 0x00000000. Effective driver date: 08/14/2009.

#I063 Selected driver installs from section [aswNdisMP.ndi] in “c:\windows\inf\oem40.inf”.

#I320 Class GUID of device remains: {4D36E972-E325-11CE-BFC1-08002BE10318}.

#I060 Set selected driver.

#I058 Selected best compatible driver.

#-166 Device install function: DIF_INSTALLDEVICEFILES.

#I124 Doing copy-only install of “ROOT\SW_ASWNDISMP\0002”.

#-166 Device install function: DIF_REGISTER_COINSTALLERS.

#I056 Coinstallers registered.

#-166 Device install function: DIF_INSTALLINTERFACES.

#-011 Installing section [aswNdisMP.ndi.Interfaces] from “c:\windows\inf\oem40.inf”.

#I054 Interfaces installed.

#-166 Device install function: DIF_INSTALLDEVICE.

#I123 Doing full install of “ROOT\SW_ASWNDISMP\0002”.

#I121 Device install of “ROOT\SW_ASWNDISMP\0002” finished successfully.

#-166 Device install function: DIF_PROPERTYCHANGE.

#I292 Changing device properties of “ROOT\SW_ASWNDISMP\0002”.

#I306 DICS_START: Device has been started.

[2010/04/11 19:43:04 3740.73 Driver Install]

#-019 Searching for hardware ID(s): sw_aswndismp

#-198 Command line processed: “C:\Documents and Settings\2\Local Settings\Temp_av_sfx.tm~a03724\avast.setup” /sfx /sfxstorage “C:\Documents and Settings\2\Local Settings\Temp_av_sfx.tm~a03724” /srcpath “C:\Documents and Settings\2\Desktop” /sfxname “setup_ais”

#I022 Found “sw_aswNdisMP” in C:\WINDOWS\inf\oem40.inf; Device: “avast! Firewall NDIS Filter Miniport”; Driver: “avast! Firewall NDIS Filter Miniport”; Provider: “ALWIL Software”; Mfg: “ALWIL Software”; Section name: “aswNdisMP.ndi”.

#I023 Actual install section: [aswNdisMP.ndi]. Rank: 0x00000000. Effective driver date: 08/14/2009.

#I063 Selected driver installs from section [aswNdisMP.ndi] in “c:\windows\inf\oem40.inf”.

#I320 Class GUID of device remains: {4D36E972-E325-11CE-BFC1-08002BE10318}.

#I060 Set selected driver.

#I058 Selected best compatible driver.

#-166 Device install function: DIF_INSTALLDEVICEFILES.

#I124 Doing copy-only install of “ROOT\SW_ASWNDISMP\0001”.

#-166 Device install function: DIF_REGISTER_COINSTALLERS.

#I056 Coinstallers registered.

#-166 Device install function: DIF_INSTALLINTERFACES.

4

part 2

#-011 Installing section [aswNdisMP.ndi.Interfaces] from “c:\windows\inf\oem40.inf”.

#I054 Interfaces installed.

#-166 Device install function: DIF_INSTALLDEVICE.

#I123 Doing full install of “ROOT\SW_ASWNDISMP\0001”.

#I121 Device install of “ROOT\SW_ASWNDISMP\0001” finished successfully.

#-166 Device install function: DIF_PROPERTYCHANGE.

#I292 Changing device properties of “ROOT\SW_ASWNDISMP\0001”.

#I306 DICS_START: Device has been started.

[2010/04/11 19:43:05 3740.79 Driver Install]

#-019 Searching for hardware ID(s): sw_aswndismp

#-198 Command line processed: “C:\Documents and Settings\2\Local Settings\Temp_av_sfx.tm~a03724\avast.setup” /sfx /sfxstorage “C:\Documents and Settings\2\Local Settings\Temp_av_sfx.tm~a03724” /srcpath “C:\Documents and Settings\2\Desktop” /sfxname “setup_ais”

#I022 Found “sw_aswNdisMP” in C:\WINDOWS\inf\oem40.inf; Device: “avast! Firewall NDIS Filter Miniport”; Driver: “avast! Firewall NDIS Filter Miniport”; Provider: “ALWIL Software”; Mfg: “ALWIL Software”; Section name: “aswNdisMP.ndi”.

#I023 Actual install section: [aswNdisMP.ndi]. Rank: 0x00000000. Effective driver date: 08/14/2009.

#I063 Selected driver installs from section [aswNdisMP.ndi] in “c:\windows\inf\oem40.inf”.

#I320 Class GUID of device remains: {4D36E972-E325-11CE-BFC1-08002BE10318}.

#I060 Set selected driver.

#I058 Selected best compatible driver.

#-166 Device install function: DIF_INSTALLDEVICEFILES.

#I124 Doing copy-only install of “ROOT\SW_ASWNDISMP\0004”.

#-166 Device install function: DIF_REGISTER_COINSTALLERS.

#I056 Coinstallers registered.

#-166 Device install function: DIF_INSTALLINTERFACES.

#-011 Installing section [aswNdisMP.ndi.Interfaces] from “c:\windows\inf\oem40.inf”.

#I054 Interfaces installed.

#-166 Device install function: DIF_INSTALLDEVICE.

#I123 Doing full install of “ROOT\SW_ASWNDISMP\0004”.

#I121 Device install of “ROOT\SW_ASWNDISMP\0004” finished successfully.

#-166 Device install function: DIF_PROPERTYCHANGE.

#I292 Changing device properties of “ROOT\SW_ASWNDISMP\0004”.

#I306 DICS_START: Device has been started.

[2010/04/11 19:43:05 3740.77 Driver Install]

#-019 Searching for hardware ID(s): sw_aswndismp

#-198 Command line processed: “C:\Documents and Settings\2\Local Settings\Temp_av_sfx.tm~a03724\avast.setup” /sfx /sfxstorage “C:\Documents and Settings\2\Local Settings\Temp_av_sfx.tm~a03724” /srcpath “C:\Documents and Settings\2\Desktop” /sfxname “setup_ais”

#I022 Found “sw_aswNdisMP” in C:\WINDOWS\inf\oem40.inf; Device: “avast! Firewall NDIS Filter Miniport”; Driver: “avast! Firewall NDIS Filter Miniport”; Provider: “ALWIL Software”; Mfg: “ALWIL Software”; Section name: “aswNdisMP.ndi”.

#I023 Actual install section: [aswNdisMP.ndi]. Rank: 0x00000000. Effective driver date: 08/14/2009.

#I063 Selected driver installs from section [aswNdisMP.ndi] in “c:\windows\inf\oem40.inf”.

#I320 Class GUID of device remains: {4D36E972-E325-11CE-BFC1-08002BE10318}.

#I060 Set selected driver.

#I058 Selected best compatible driver.

#-166 Device install function: DIF_INSTALLDEVICEFILES.

#I124 Doing copy-only install of “ROOT\SW_ASWNDISMP\0003”.

#-166 Device install function: DIF_REGISTER_COINSTALLERS.

#I056 Coinstallers registered.

#-166 Device install function: DIF_INSTALLINTERFACES.

#-011 Installing section [aswNdisMP.ndi.Interfaces] from “c:\windows\inf\oem40.inf”.

#I054 Interfaces installed.

#-166 Device install function: DIF_INSTALLDEVICE.

#I123 Doing full install of “ROOT\SW_ASWNDISMP\0003”.

#I121 Device install of “ROOT\SW_ASWNDISMP\0003” finished successfully.

#-166 Device install function: DIF_PROPERTYCHANGE.

#I292 Changing device properties of “ROOT\SW_ASWNDISMP\0003”.

#I306 DICS_START: Device has been started.

[2010/04/11 19:43:06 3740.89]

#-198 Command line processed: “C:\Documents and Settings\2\Local Settings\Temp_av_sfx.tm~a03724\avast.setup” /sfx /sfxstorage “C:\Documents and Settings\2\Local Settings\Temp_av_sfx.tm~a03724” /srcpath “C:\Documents and Settings\2\Desktop” /sfxname “setup_ais”

#-166 Device install function: DIF_PROPERTYCHANGE.

#I292 Changing device properties of “ROOT\SW_ASWNDISMP\0000”.

#I306 DICS_START: Device has been started.

5

Hi Nat1,

what exactly are you trying to achieve? Uninstalling avast from ubuntu? Avast has several boot time drivers and in Windows XP when a boot time driver is missing it is a big trouble (a BSOD if I am not mistaken - they fixed/changed this in Vista)

L.

6

Yes - I am trying to boot Win XP.

After having installed avast 5 it is not booting any more.

So now I am trying to remove avast from within Ubuntu as this is the only thing I can do. ???

7

Hmmm… seems you’ll mess the installation… avast should be removed at Safe Mode at least…
avast isn’t load at safe mode, so other antivirus or security program is blocking the correct Windows working.

8

@ the OP: there are other options than posting with big red and bold capital letters ::slight_smile: one of them would be to learn how to use your XP CD if you got one >>> repair options there. This will destroy your GRUB from Ubuntu but you can restore it later once XP launches again. Try things before screaming like a slain goat ;D, and don’t waste your time reading Windows files from Linux :smiley:

9

If you have deleted/remove any boot drivers (e.g. from Ubuntu) from the Windows\System32\drivers folder - you are probably done (with your PC unbootable), unless you manage to edit the system HIVE and remove the boot drivers from System\CCS\Services..

10

Thanks for the ideas and input - and sorry for the red, I am a graphics person…

I found this - this is what I am experiencing - a hang on safe mode boot http://www.aitechsolutions.net/mupdotsysXPhang.html

My Mup.sys file is missing ?!? in the windows/system32/drivers/ folder

Orange is nice too …

11

Thanks lukor - I am not too sure I understand - you want me to remove ALL boot drivers?

I found this in the config.nt file
device=C:\Program Files\Alwil Software\Avast5\aswmonds.sys

Is this what you are suggesting? Thanks.

I am now working through this http://www.aitechsolutions.net/winxpnoboot.html

12

Not exactly, nat1, in fact, quite the opposite. Once you remove (delete from disk) any boot driver, windows XP treat this situation as if the operating system is unbootable (since boot required driver is missing) and stops the booting with BSOD. So you must be sure not to remove the sys files from the disk until they are uninstalled (removed) from the registry.

We are talking about C:\Windows\System32\Drivers\ folder, the one you are mentioning in config.nt is just for the DOS emulation and does not have any importance during system boot.

So if you know that some driver required during boot (be it mup.sys or other) is missing from your disk, (windows\system32\drivers folder) I recommed copying it back from your installation CD. You might also try the recovery option on the Windows XP instaltion CD, it works quite often as well.

13

I got it to where Ubunto is now also down … (I am using MirrorFolder as Raid-1 and had Ubuntu installed only off of the C drive … unplugging drives is not the way to do things)

After that I got a

Windows could not start because the following files are missing or corrupt: \system32\ntoskrnl.exe. Please re-install a copy of the above file.

Not too good.

You might also try the recovery option on the Windows XP instaltion CD, it works quite often as well.
Yes - this is the next thing I will be trying to get to work. My problem is that my WinXP disk has no SCSI drivers on it, so booting from it requires having a floppy drive ... lol No floppy on my computer! So this http://news.softpedia.com/news/Install-Windows-XP-On-SATA-Without-a-Floppy-F6-47807.shtml is what I am doing the NLite part is coming along.

UPDATE: Yes - I am now able to R (recover) windows. (hopefully this will all work well)

14

I know I advised it (XP repair options) but be aware that you will lose access to ubuntu if you chose to do that, as GRUB will be overwritten with XP bootloader. No big deal if you know how to restore it (GRUB) from a live CD…

15

Avast is all I have installed “I used to have Norton - but that is LONG gone an off my system”

I am hoping that at this point MirrorFolder http://www.techsoftpl.com/backup/ had nothing to do with interfering the avast 5 installation.

16

You’re up late :wink:

Reinstalling GRUB will be the least of my worries if only I can get win back to boot.

17

Using the above method “Performing a manual restore of the windows xp registry” finally got me back into Win. (I did not loose my GRUB install)

My problem is now that I can only boot from my Win CD!!! Removing the Win CD will prompt me with:

Windows could not start because the following files are missing or corrupt: \system32\ntoskrnl.exe. Please re-install a copy of the above file.

I did try this but this is also not helping …
http://www.youtube.com/watch?v=j69K9H87j2s

I do have 3 SCSI drives - maybe I need to remove drive D, (C is mirrored to Q with MirrorFolder)

I am afraid to install avast 5 at this point!

any suggestions are welcome …

18

I had to remove the D drive but lost GRUB doing so – oh well
I also lost my MirrorFolder setup - oh well … can live with that for now.

The question is now - does avast 5 support such a thing as MirrorFolder?

19

try to catch a Windows LiveCD and boot with it…

then locate the file “aswNdis2.sys” and rename it to "“aswNdis2.sys.old”
boot your system in safe mode, uninstall avast 5 security suite and then boot back in normal mode…
I’ve been experiencing BSOD from XP Pro & Win7 Ultimate 64x…
If you re-install Avast Security Suite, just disable the firewall and you will not have any single problem…

I already made a post here : http://forum.avast.com/index.php?topic=58029.0 but unfortunatelty Awill team did post any solution(s) to this problem.

I bought security suite just because of the firewall part so i’m kindda pissed, hope they fix that soon.

Yves

20

HELLO ywdt - you are not the only one that is pissed! I bought 5 licenses that are good for 3 years!!!

Today I was humming along and feeling lucky having my system back, and decided to take the chance to install avast 5 internet sec… I was just about to click the install button as I discovered that all my shortcuts on my desktop are NOT coming from my C drive ???, but are coming from my Q drive!?! I checked what drive is my computer running from - and sure enough my system drive is “Q” !?! So I shot the system down and unplugged drive Q. At reboot it found GRUB again (I thought I lost it) and started normally! So now I have 1 drive - the C drive, which is a SCSI (all my drives are SCSI drives - including my DVD-Drive) and all is working (no avast running at this point!)

SO to be double sure I uninstalled avast 4 again - rebooted - uninstalled avast 5 - rebooted - and installed avast 5.

and sure enough I am back where I left off yesterday morning! - I will see what ywdt has to offer, but at this point I am sooo pissed that the am considering to remove avast all together for good! There is no “I am sorry” from their side - and here we are Betta besting at our own dime! This is not right.