Avast and XP Shutdown

Hi,

I have just started using Avast Home version 4.6.691 as the Norton subscription was about due and as they say a change is as good as a rest.

I use a Dell Dimension 8300 - Pentium 4 3Ghz running XP Pro.

After installing Avast home I adjusted one of my settings as suggested in the bleepingcomputer.com tutorial increasing the On-Access Scanner - Resident Protection from Standard to High. This adjustment caused me no end of problems during shutdown. The computer would just hang on “Saving your Settings”. It was only after uninstalling and re-installing Avast that I realised that this was the problem. To prove it I reset the Resident Protection to High and yes the same problem. Restoring it back to Standard and no problem. I read in the beta postings of a similar problem which appeared to have been fixed. Am I the first with this problem on this version or is there something on my machine that is likely to cause conflict with Avast…especially during shutdown.

Any advice or thoughts would be much appreciated.

pc_rose ???

Hi pc_rose,

Norton sometimes leaves behind components which can interfer with avast!

I recommend:

uninstalling avast!

Checking that Norton has gone completely. (See Spyros’ page here:
http://spyros.atspace.com/uninstall.html

Edit: A reboot might be good here.

Run TuneUp Utilities to check for any registry problems:
http://www.tune-up.com/

Reinstall avast! and see how you go.

Check the link relevant to your version of NAV.
The NAV 2003 removal tool can be downloaded here: ftp://ftp.symantec.com/misc/consumer/Rnav2003.exe
Manual Removal NAV 2004 - Manual Removal NAV 2004
Manual Removal NAV 2003 or earlier - Manual Removal NAV 2003 or earlier
Another link worth looking at which is a program removal tool that can remove a number of different Norton Programs:
Removing your Norton program using SymNRT

Thanks David. There was nobody around so I tried to be helpful. I know you and Tech usually help anybody with this sort of problem. I hope my advice wasn’t too off the mark.

No problem, Frank any help is always appreciated and Spyros’s uninstall page will probably contain all the links.

However, I just found that last link today, a multi Norton program uninstaller tool that could be very useful. Not that I will ever have to use it ;D

:slight_smile: DavidR :

  Your last link seems to be the same as the "More info"
  link on the spyros site quoted by Frank. I used the
  SymNRT when I uninstalled my NAV 2004 and I still
  found numerous files & folders and registry entries
  after its use, which I elected to remove for a
  COMPLETE uninstallation.

It certainly does, it has been some time since I paid a visit to the uninstall page at Spyros’s site.

Hello all
I have the same problem that Pc_Rose
So , I try your answers tonight.
I had the norton systemworks 2003 or 2002 on the pc of my father.
And it arrives to end of validity.So I replace it by your antivirus Avast.
(I have put it on my notebook since one year).
But I have blue screen when I use internet explorer or firefox…

I tell you tonight after remove all bad files norton…

It is also good idea to run some regcleaner after uninstall.

Switched to Avast! from Norton System Works and ran the removal tools. Last Microsoft updates did not run because the BITS would not start. Norton is very nasty to remove. Found this link which references the solution posted in Microsoft forum. Registering these services worked for me.

regsvr32 oleaut32.dll
regsvr32 jscript.dll
regsvr32 vbscript.dll
regsvr32 msxml.dll
regsvr32 softpub.dll
regsvr32 wintrust.dll
regsvr32 initpki.dll
regsvr32 cryptdlg.dll

http://castlecops.com/modules.php?name=Forums&file=viewtopic&t=131527&start=0&postdays=0&postorder=asc&highlight=

Thanks

I have use the uninstall program from norton gived by David (for nav 2003)

and desactive the services said by blarson

and now it’s working ^^

Welcome to the forums.

Just to be sure, can you post the contents of these Windows Registry keys in your system?

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\VirtualDeviceDrivers\VDD
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\VirtualDeviceDrivers\VDD
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\VirtualDeviceDrivers\VDD
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\VirtualDeviceDrivers\VDD
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Control\VirtualDeviceDrivers\VDD

Is there any s32evnt1.dll in registry keys?

Hi,

Thanks to all those people kind enough to reply to my problem posted. I had already used the SYMNRT program in removing the copy of Systemworks that I had on my system. And I had used a variety of registry cleaners to remove other traces of Norton from my system. I have tried blarson’s registering of the dll’s. The only interesting affect was the registering of initpki.dll which appeared to actually be doing something! On increasing Resident Protection from Normal to High the system still failed during “Saving your Settings”.

In response to Tech’s post. I have listed below the contents of the named registry keys:-

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\VirtualDeviceDrivers\VDD - C:\Program Files\Alwil Software\Avast4\aswMonVd.dll

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\VirtualDeviceDrivers\VDD - C:\PROGRA~1\Symantec\S32EVNT1.DLL

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\VirtualDeviceDrivers\VDD - C:\Program Files\Alwil Software\Avast4\aswMonVd.dll

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003 - C:\Program Files\Alwil Software\Avast4\aswMonVd.dll

\Control\VirtualDeviceDrivers\VDD
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Control\VirtualDeviceDrivers\VDD - I don’t have a ControlSet004 key!

Now this does look interesting as I appear to have a reference to a Symantec Program in ControlSet001. What should it contain?

I also did a search of the registry for other reference of S32evnt1.dll as suggested but no others were found.

I also did a complete search of my hard drive only to find a copy of the S32evnt1.dll in my C:\I386 folder. Presumably, it is unlikely to be of any harm in there.

Any suggestions for my next course of action.

pc_rose

Symantec for sure…, if you delete this entry, will avast! driver “be created” from nothing there?
This key could be preventing avast! to write on this key.

Strange, maybe when you restore your system the file could be restored too…
Can you rename that file? Is it from Symantec of from Microsoft?

What do you mean by “Saving your settings”, the windows shutdown screen?

Hi Tech,

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\VirtualDeviceDrivers\\VDD - C:\PROGRA~1\Symantec\S32EVNT1.DLL

Symantec for sure…, if you delete this entry, will avast! driver “be created” from nothing there?
This key could be preventing avast! to write on this key.

Tried deleting the keyed entry but it made no difference - still problems during shutdown. The key was not re-created by Avast so I set it up to look like the other values in the other controlsets which contained the key:-

C:\Program Files\Alwil Software\Avast4\aswMonVd.dll

This still had no affect when I set resident protection to high same problem during shut down gets as far as “Saving Your Settings”.

I also did a complete search of my hard drive only to find a copy of the S32evnt1.dll in my C:\I386 folder. Presumably, it is unlikely to be of any harm in there.

Strange, maybe when you restore your system the file could be restored too…
Can you rename that file? Is it from Symantec of from Microsoft?

The answer to this question is the file is Symantec. It is possible that the file was part of the OEM installation. It should not be a problem providing as you say I don’t attempt a repair install or re-install XP from scratch.

What do you mean by "Saving your settings", the windows shutdown screen?

Yes it is the “Saving your settings” message that appears during XP shutdown.

I have discovered numerous other Symantec keys still in my registry so I am attempting to remove them to see whether this will make any difference.

It is strange though that this problem only manifests itself when resident protection is switched to high.

pc_rose

Once you have removed the remnants of NAV from your registry (either manually or with the links in replies #1 and #2), I suggest you uninstall avast (see below), boot and install avast again.

It may be worth downloading the Avast Uninstall Utility, find it here and run that after you use the regular add remove programs uninstall.

pc_rose:

The computer would just hang on "Saving your Settings"

I know just what you’re talking about; don’t you just hate it when that happens?! There is a simple remedy though, but first some housekeeping chores …

FreewheelinFrank:

Norton sometimes leaves behind components...

“Sometimes” is being very diplomatic and kind. I can see that your moniker “Freewheelin” can’t be wholly true (in the negative sense anyway), because in my long experience it is ALWAYS! Repeat, ALWAYS!! It’s one of my biggest disappointments with Norton Antivirus (NAV)/Internet Security (NIS). I had been a longtime fan up until the past several years. But alas, I simply got tired of every time I had to fix a glitch involving one of these two packages, and after accomplishing every initial steps quick-fix remedy suggested per their knowledge-base, it would NEVER suffice and inevitably having to employ the last resort … the dreaded UN-install and RE-install! Their stuff has slowly and progressively reached a point of complexity and bloat beyond what their program development staff can handle. This is readily apparent, and I can safely say this because otherwise it would be more steadily reliable (not that it doesn’t perform adequately … when it’s functioning!). Therefore, I now neither use, nor recommend NAV/NIS. I do though have no gripe with Norton SystemWorks (NSW) – less the Antivirus – there are a few decent tools in there that are worthy.

Now that I’m off that soapbox (and believe me, it’s not the first time!), FreewheelinFrank and DavidR’s posts are on target. If you discover the appropriate Symantec program/batch removal tool (e.g., Rnav2003.exe, etc.) doesn’t completely swab your deck of unwanted remnants, you’ll have to take the <gulp!> MANUAL route. Find on the Symantec website the appropriate “How to MANUALLY remove …” checklist, then THOROUGHLY accomplish it.

The “S32EVNT1.DLL” is the “Symantec Event Library”, and I’m fairly certain a necessary component of LiveUpdate.
Do you currently have ANY other DESIRED Symantec products installed on your system [e.g., NIS, NSW, Norton Utilities, etc.]? If so, you still need that booger. If not, be sure to also uninstall (if applicable) LiveReg and LiveUpdate as they are now unwanted chaff. However, I suspect this portion of my advice is not applicable since you stated:

I also did a complete search of my hard drive only to find a copy of the S32evnt1.dll in my C:\I386 folder. Presumably, it is unlikely to be of any harm in there.

If you still had LiveReg/LiveUpdate installed, you would find it in your %SYSTEMROOT% (i.e., C:\WINDOWS\system32.…) and/or %PROGRAMFILES% Symantec installation folder (i.e., C:\Program Files\Symantec.…).
In fact, you’re right. It is going to do NO harm there and you may opt to manually delete it if you choose. However, that is an odd place for it to be, but there are any number of (non-suspect) means by which it was placed there … but be-that-as-it-may.

Having said all that, does it hang indefinitely or only for a few/several minutes? I suspect you may have encountered the “Saving your Settings” hang at Windows user logoff before. It’s just this time it is involving your recent Avast install and Symantec uninstall. Regardless, it is by no means an uncommon problem. It is typically caused by certain application(s) not letting go of the user’s portion of the registry. In this case, you will see entries in your Windows (Application) Event Log [Start > Run… > eventvwr.msc] with the Source of Userenv and Event ID of 1517 and/or 1524.

Fortunately, there’s an easy-peasy fix. It’s a handy little Windows service tool called “User Profile Hive Cleanup Service” that will monitor for all such events and safely release the registry logjam. It’s a tool EVERY (repeat EVERY) NT class (2000/XP/2003) system should have installed. It’s published by Microsoft no less and can be reviewed here…

http://www.microsoft.com/downloads/details.aspx?FamilyID=1b286e6d-8912-4e18-b570-42470e2f3582&DisplayLang=en

and downloaded here…

http://download.microsoft.com/download/a/8/7/a87b3d05-cd04-4743-a23b-b16645e075ac/UPHClean-Setup.msi

HTH … Craig

Parting Shot: I’ve just installed Avast myself and been running it through its paces. So far, I have to say … I am sincerely floored! Only been using for a day or two, but it is without a doubt one of the most impressive pieces of freeware I’ve seen in a looong time. Capable and extremely comprehensive; a beautiful user interface; easy and uneventful install routine; very light footprint on system resources (hell, non-existent compared to Norton); and an active user forum. Barring any unforeseen & undesirable gotcha’s, I’d have to say it’s a definite keeper, and maybe worthy of a best-in-class distinction … its day-to-day performance over the near term will tell soon enough. I now wish I’d taken it for a test spin before now (as I’ve been saying I’ll get around to for a long time).

You Avast folks keep up the great work!