avast at startup despite deinstallation

Avast Free Antivirus / Premium Security
1

I’ve got an annoying problem. Some days ago I decided to test the latest avast free home edition as a parallel on demand scanner, the on access component wasn’t active, days later I removed it from my harddisk via control panel. But a something seems not to be removed from my system. At every every restart, between the Windows XP boot screen and the logon screen, the avast boot time scanner is there and says “launching not found error…continue booting”. How I have to remove this? I’v tried an reinstall and then the uninstallation tool. Nothing happens, problem still exists. I’v searched for remained files after deinstallation and found:
c:\windwos\system32\aswBoot.exe

and

C:\WINDOWS\system32\drivers\aswRdr.sys

and here a part of the registry:

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_ASWMON2]
“NextInstance”=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_ASWMON2\0000]
“Service”=“aswMon2”
“Legacy”=dword:00000001
“ConfigFlags”=dword:00000000
“Class”=“LegacyDriver”
“ClassGUID”=“{8ECC055D-047F-11D1-A537-0000F8753ED1}”
“DeviceDesc”=“avast! Standard Shield Support”

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_ASWRDR]
“NextInstance”=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_ASWRDR\0000]
“Service”=“aswRdr”
“Legacy”=dword:00000001
“ConfigFlags”=dword:00000000
“Class”=“LegacyDriver”
“ClassGUID”=“{8ECC055D-047F-11D1-A537-0000F8753ED1}”
“DeviceDesc”=“aswRdr”
“Capabilities”=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_ASWRDR\0000\Control]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_ASWTDI]
“NextInstance”=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_ASWTDI\0000]
“Service”=“aswTdi”
“Legacy”=dword:00000001
“ConfigFlags”=dword:00000000
“Class”=“LegacyDriver”
“ClassGUID”=“{8ECC055D-047F-11D1-A537-0000F8753ED1}”
“DeviceDesc”=“avast! Network Shield Support”
“Capabilities”=dword:00000000

Maybe, these things are responsible for this boot thingie, but I’m not sure, if I can delete this without any changes on an specific system file.

My system specification:
Athlon XP 2400+
Windows XP SP2
Antivir and the Antivir Guard as background scanner

Any idea how to fix my problem?

~Eyghon~

2

avast is not a good background scanner. On contrary, AVG, AntiVir, BitDefender (free), ClamWin are good
Maybe you have to uninstall avast:

  1. Uninstall avast from Control Panel first.
  2. Boot
  3. Use Avast Uninstall for complete uninstallation (read http://www.avast.com/eng/avast_uninstall_util.html)
  4. Boot

Is it possible, I don’t remember, not installing the resident of AntiVir and not only disabling it?

3

Did you uninstall avast! from an administrator account? The files you are referring to are normally deleted during uninstallation - but a restricted user might not have the necessary rights.

I’d suggest not to mess with these legacy registry entries - they are created by Windows and they are also deleted by Windows when appropriate.

4

I did the installation and uninstallation from an administrator account.
Followed the four steps posted by Tech and my problem still exists. Tried the Avast Uninstall from the safe mode too but nothing happened.

@Tech:
Yes, it is possible, you just have to choose the user defined installation.

~Eyghon~

5

Well, you can simply delete the aswBoot.exe file.

6

Yeah, thats it. Problem seems to solved now. Before I openend a new thread I had the idea with removing aswboot.exe but hesitated, because this is a file in the system32-folder and its more safe to ask someone before delete something. Thanks :slight_smile:

Now I know the procedure of deinstallation so I can do a re-test of avast. g

~Eyghon~

7

Well, it’s really not a common procedure - normally, this file is deleted automatically. No idea why it was left on your computer…

8

Are there more than one administrator account (user with Administrator rights)?

9

If you also have file C:\aswBoot.log, please send it to me.

10

Yes, my user account has admin rights too (I know, its risky…)

@vojtech:
I’ve just send you a mail with the awsboot.log

~Eyghon~

11

Thank you. The launching registry record of boot-time scan was not deleted because the letter case got itself (!?) changed. It will be solved in next version. You can manually delete the aswboot.exe line from registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute. But it is now harmless when the file aswboot.exe is deleted.

Anyway, it does not answer the question why the files were not deleted during the uninstall.