avast crash

Avast Free Antivirus / Premium Security
1

i am using avast home and i am very happy with the efficiency and the functionality of the product.
but… starting about two months ago i have a big
problem each time if i execute the scan function (local drives).

i have avast 4.5.561 VPS file 0504.4.28.01.05

the XP:

System Information

Time of this report: 27.01.2005, 08:01:08
Computer name: SN6516287082
Operating System: Microsoft Windows XP Personal (Build 2600) Service Pack 2
Processor: Intel(R) Pentium(R) 4 CPU 2.40GHz, MMX, ~2379Mhz
System memory: 490992 KB (installed), 309012 KB (available), 2097024 KB (virtual)
Language: 0C07-0C07-0C07-0C07 (SLangID, SLCID, ULangID, ULCID), 0407-0407 (SUILang, UU

follows one extract of a crash report.

Fault source

C:\Programme\Alwil Software\Avast4\ashServ.exe caused an Access Violation at location 7c920f29 in module ntdll.dll Reading from location 00000000.

Crash place

  0x7C920EED: FF E9 32 FE FF FF 0F B7 0E 03 C8 81 F9 00 FE 00 00 0F 87 45     ÿé2þÿÿ.·..È.ù.þ...‡E
  0x7C920F01: FD FF FF 80 7D 14 00 0F 85 25 8B 03 00 8A 46 05 24 10 A8 10     ýÿÿ.}...…%‹..ŠF.$.¨.
  0x7C920F15: 88 47 05 0F 85 92 00 00 00 8B 4E 0C 8D 46 08 8B 10 89 4D 0C     .G..…’...‹N..F.‹.‰M.

=> 0x7C920F29: 8B 09 3B 4A 04 89 55 14 0F 85 EA 0F 00 00 3B C8 0F 85 E2 0F ‹.;J.‰U……ê…;È.…â.
0x7C920F3D: 00 00 56 53 E8 4E FC FF FF 8B 45 14 8B 4D 0C 3B C1 89 01 89 …VSèNüÿÿ‹E.‹M.;Á‰.‰
0x7C920F51: 48 04 74 38 8A 46 05 A8 04 0F 85 A9 8B 03 00 0F B7 0E 8B 45 H.t8ŠF.¨……©‹…·.‹E
0x7C920F65: 10 01 08 0F B7 0E 29 4B 28 F6 47 05 10 66 8B 08 66 89 0F 0F …·.)K(öG…f‹.f‰…

  0x7C920EE3: 6A00                    push	0x0
  0x7C920EE5: 8D45D8                  lea	eax, ds:[ebp]+FFFFFFD8
  0x7C920EE8: 50                      push	eax
  0x7C920EE9: E814D2FFFF              call	-FFFFD214
  0x7C920EEE: E932FEFFFF              jmp	-FFFFFE32
  0x7C920EF3: 0FB70E                  movzx	ecx, ds:[esi]
  0x7C920EF6: 03C8                    add	ecx, eax
  0x7C920EF8: 81F900FE0000            cmp	ecx, 0xFE00
  0x7C920EFE: 0F8745FDFFFF            ja	-FFFFFD45
  0x7C920F04: 807D1400                cmp	ds:[ebp]+14, 0x0
  0x7C920F08: 0F85258B0300            jnz	+38B25
  0x7C920F0E: 8A4605                  mov	al, ds:[esi]+05
  0x7C920F11: 2410                    and	al, 0x10
  0x7C920F13: A810                    test	al, 0x10
  0x7C920F15: 884705                  mov	ds:[edi]+05, al
  0x7C920F18: 0F8592000000            jnz	+92
  0x7C920F1E: 8B4E0C                  mov	ecx, ds:[esi]+0C
  0x7C920F21: 8D4608                  lea	eax, ds:[esi]+08
  0x7C920F24: 8B10                    mov	edx, ds:[eax]
  0x7C920F26: 894D0C                  mov	ds:[ebp]+0C, ecx

=> 0x7C920F29: 8B09 mov ecx, ds:[ecx]
0x7C920F2B: 3B4A04 cmp ecx, ds:[edx]+04
0x7C920F2E: 895514 mov ds:[ebp]+14, edx
0x7C920F31: 0F85EA0F0000 jnz +FEA
0x7C920F37: 3BC8 cmp ecx, eax
0x7C920F39: 0F85E20F0000 jnz +FE2
0x7C920F3F: 56 push esi
0x7C920F40: 53 push ebx
0x7C920F41: E84EFCFFFF call -FFFFFC4E
0x7C920F46: 8B4514 mov eax, ds:[ebp]+14
0x7C920F49: 8B4D0C mov ecx, ds:[ebp]+0C
0x7C920F4C: 3BC1 cmp eax, ecx
0x7C920F4E: 8901 mov ds:[ecx], eax
0x7C920F50: 894804 mov ds:[eax]+04, ecx
0x7C920F53: 7438 jz +38
0x7C920F55: 8A4605 mov al, ds:[esi]+05
0x7C920F58: A804 test al, 0x4
0x7C920F5A: 0F85A98B0300 jnz +38BA9
0x7C920F60: 0FB70E movzx ecx, ds:[esi]
0x7C920F63: 8B4510 mov eax, ds:[ebp]+10

Register content

EAX=00160288 EBX=00150000 ECX=00000000 EDX=00170D58 ESI=00160280 EDI=001601F0
EIP=7C920F29 ESP=00B7FDC4 EBP=00B7FDD0 IOPL=0 NV UP EI PL ZR NA PO NC
CS=001B SS=0023 DS=0023 ES=0023 FS=003B GS=0000 FLG=00010246

SymInitialize: -1073741819

Call stack

AddrPC AddrReturn AddrFrame AddrStack Params
7C920F29 7C920D5C 00B7FDD0 00B7FDC4 00150000 00000000 00B7FE88 00000000
7C920F29 ntdll.dll:7C920F29 !
7C920D5C 77E562F9 00B7FEA4 00B7FDC4 00150000 00000000 001601F8 00B7FEC4
7C920D5C ntdll.dll:7C920D5C !
77E562F9 77E562D0 00B7FEB8 00B7FDC4 001601F8 00B7FED4 77E57097 001601F8
77E562F9 RPCRT4.dll:77E562F9 !
77E562D0 77E57097 00B7FEC4 00B7FDC4 001601F8 00000000 00B7FEE4 77E56327
77E562D0 RPCRT4.dll:77E562D0 !
77E57097 77E56327 00B7FED4 00B7FDC4 00000001 00B7FEF8 00B7FF04 7C9111A7
77E57097 RPCRT4.dll:77E57097 !
77E56327 7C9111A7 00B7FEE4 00B7FDC4 77E50000 00000003 00000000 00252118
77E56327 RPCRT4.dll:77E56327 !
7C9111A7 7C929213 00B7FF04 00B7FDC4 77E56284 77E50000 00000003 00000000
7C9111A7 ntdll.dll:7C9111A7 !
7C929213 7C80CCE7 00B7FF7C 00B7FDC4 00000000 0012E5F4 0015FAF8 77DBB1E3
7C929213 ntdll.dll:7C929213 !
7C80CCE7 7C80B511 00B7FFB4 00B7FDC4 00000000 00000000 0012E5F4 0015FAF8
7C80CCE7 kernel32.dll:7C80CCE7 !
7C80B511 00000000 00B7FFEC 00B7FDC4 00000000 00000000 0012E5F4 0015FAF8
7C80B511 kernel32.dll:7C80B511 !

Stack frame

[00B7FDC4]: 00001500 F0011600 00000000 A4FEB700 5C0D927C 00001500 00000000 88FEB700 …ð…¤þ·..’|…þ·.
[00B7FDE4]: 00000000 00000000 F8011600 18212500 0000440A 9404D477 78B3D177 00008500 …ø…!%…D.”.Ôwx³Ñw…….
[00B7FE04]: 73B3D177 39E6D177 28010000 00008500 00000000 00000100 0C000000 7CFDB700 s³Ñw9æÑw(………|ý·.
[00B7FE24]: 00000000 70FE0100 13000000 8CFDB700 FFFFFFFF 80FEB700 18EE917C 7005927C …pþ…Œý·.ÿÿÿÿ.þ·…î‘|p.’|
[00B7FE44]: 90000000 6D05927C 8A21347C 00008500 00000000 8F21347C 00000000 E8638500 …m.’|Š!4|………!4|…èc….
[00B7FE64]: 38232500 4CFEB700 00001500 B8FEB700 0D24347C 5CFEB700 00000000 00000000 8#%.Lþ·…¸þ·…$4|\þ·…
[00B7FE84]: 18020101 12000000 E8FDB700 E8F9B700 6CFFB700 18EE917C 7005927C 01000000 …èý·.èù·.lÿ·…î‘|p.’|…
[00B7FEA4]: B8FEB700 F962E577 00001500 00000000 F8011600 C4FEB700 D062E577 F8011600 ¸þ·.ùbåw…ø…Äþ·.Ðbåwø…
[00B7FEC4]: D4FEB700 9770E577 F8011600 00000000 E4FEB700 2763E577 01000000 F8FEB700 Ôþ·.—påwø…äþ·.'cåw…øþ·.
[00B7FEE4]: 04FFB700 A711917C 0000E577 03000000 00000000 18212500 00000000 60202500 .ÿ·.§.‘|…åw…!%… %. [00B7FF04]: 7CFFB700 1392927C 8462E577 0000E577 03000000 00000000 00000000 00D0FD7F |ÿ·..’’|„båw..åw.............Ðý. [00B7FF24]: F8FA1500 14000000 01000000 00000000 00000000 10000000 14B20100 08000000 øú.......................²...... [00B7FF44]: A0FEB700 805EDB77 94FFB700 18EE917C 60202500 0090FD7F 8462E577 18212500 .þ·..^Ûw”ÿ·..î‘| %…ý.„båw.!%.
[00B7FF64]: 1CFFB700 E8F9B700 A4FFB700 18EE917C 6891927C 01000000 B4FFB700 E7CC807C .ÿ·.èù·.¤ÿ·…î‘|h‘’|…´ÿ·.çÌ.|
[00B7FF84]: 00000000 F4E51200 F8FA1500 E3B1DB77 00D0FD7F 00000000 84FFB700 E8F9B700 …ôå…øú…ã±Ûw.Ðý…„ÿ·.èù·.
[00B7FFA4]: DCFFB700 F399837C 10CD807C FFFFFFFF ECFFB700 11B5807C 00000000 00000000 Üÿ·.ó.ƒ|.Í.|ÿÿÿÿìÿ·…µ.|…
[00B7FFC4]: F4E51200 F8FA1500 00D0FD7F 050000C0 C0FFB700 E8F9B700 FFFFFFFF F399837C ôå…øú…Ðý…ÀÀÿ·.èù·.ÿÿÿÿó.ƒ|
[00B7FFE4]: 18B5807C 00000000 00000000 00000000 79B4DB77 F8FA1500 00000000
error: don’t have read access to the specifies range of memory

2

Have you already tried a repair of Avast?
Have you already removed Avast (uninstall util from the website) and reinstalled?
What else have you tried to solve the problem?
Any other problems with the system?
Anything about it in Avast’s log file? (eg does the crash happen when scanning a certain file/folder?)

3

yes, i did completely de/re-install avast and windows xp plus
service.
it is not possible to see anything on the log because no log
is written after the crash.
other symptoms are:
screen (icons etc…) problems, mouse unusable.
the only way to restart the system is power off/on sequence.

at moment my opinion is that avast ist not the originator of the crash, but each time i start the avast scan program then
i have the problems above…

thank you
pippocavalieri

4

Wait a moment, what exactly do you mean by “each time I start the avast scan”?
How do you start the scan, exactly?
At which stage does the crash occur?
Is it always the same? Is the thing you quoted (the crash report) the attachment that avast wants you to send out?
Do you see any ashServ.exe crashes during system shutdown?

Thanks
Vlk

5

Are you sure you have all drivers installed for your system? (including motherboard drivers)

6

how i start the scan:

i start the scan from the simple user interface clicking
→ local drives → quick scan → start.

at wich stage does the crash occur:

during the scan

it is always the same location.
alwaya access violations on ntdll.dll

about the drivers… i have to check

7

Are you sure the crashlog posted in the first message corresponds to the crash during scan? Each time avast! crashes during the scan, this log is created? (you can check the timestamp)
I mean - this is the crash people usually get during the computer shutdown… strange that it would happen during the normal program runtime as wel.

Additionally - does avast! crash always when scanning the same file/folder? Could there be some “bad” file causing the troubles? (If yes, we’d certainly like to have it).
Do you have scanning of archives turned on? (if yes, does it help when you switch it off?)

8

yes, each time i scan my local folders i have a crash (with/without the archive file option).
the screen becomes destroyed, and the cursor is unusable,
so the result is a compoter crash and the onlx possibility to restart the computer is power off/on.
about the position i am not sure but a have in all cases an
access violation on ntdll.dll.
a boot-time scan terminates normally.
i have checked all files to verify the signature tells that the
liibrary ntvdmd.dll is not correct…
pippocavalieri
.

9

Can you please verify the timestamp of the file?
I mean, after such a crash occurs (and possibly after you restart the computer), check the /Data\Log folder if there’s a new unpXXXXX file there, with its creation time corresponding to the crash.
If yes, does this file also have those RPCRT4.dll lines on stack?
Thanks.

10

ok. i will start a scan now and i will check…

pippocavalieri

11

i am very sorry…
i had a crash but no unpxxxxx was written (and all the old are deleted…)

12

OK. Does the crash always occur at the same file/folder (I mean - does it seem so?), or is it random?

13

my impression is tha the crash accors always on the same folder.
before deinstall/reinstall avast i had a lot of unpxxxxx files
containing the same access violation :

location 7c920f29 in module ntdll.dll Reading from location 00000000.

pippocavalieri

14

Do you think you could try to identify the folder, or even the file inside of the folder?
Either you can turn on the creation of the report file in program options (and let “OK files” to be included there) - the end of the report (after the crash) should be very close to the file we are looking for. Or, you may use the Explorer Extension (if the problem occurs for it, too) and check one folder after another.
Thanks!

15

following your suggestion and performing scans from the explorer extension i had a crash in the folder c:\i386, but
a secon try on the same folder completed normally…
after each crash (destroyed icons, black screen etc) i need
a lot of time to become the pc working…
the report file looks normal (no error informations)

i will continue testing
thank you fo help
pippocavalieri

16

I am now sure:

avast! is NOT the responsible for my system crashes.

The origin, i think, is the motherboard or the video card.

thanks for your support

pippocavalieri