Avast! interferes with Transcode360 (Transcode 360)

[system]

Avast! support team:

First, thanks for creating a product that I feel comfortable installing on all of my relatives machines. Your detection rate, pricing scheme, and quick Vista support… make your antivirus solution one of the best.

That being said, I’d like to report a problem that I’ve been having. For weeks now, I have been trying to get the Windows Vista Media Center to work properly with Transcode360 (also known as Transcode 360), but had been encountering an error on my Xbox360:

---

Video Error
Files needed to display video are not installed or not working correctly. Please restart Windows Media Center or restart the computer.

Essentially, Transcode360 works by reading any video file (like divx/xvid) and re-encodes them into mpeg2 on-the-fly, so that the Xbox360 (which only reads mpeg2) can play your computer’s video file.

There’s even a new version of Transcode360 specifically designed for Vista (announced and available at: http://runtime360.com/2006/12/12/new-blood-and-transcode-360-for-vista-released/) … which still gives me the errors.

IMPORTANT PART: My problem is with Avast!, however. If I have it installed (4.7.892) alongside Windows Vista (RTM), I will receive that Video Error every time I try to use Transcode360 on my XBox360. If I “Stop On-Access Protection”, I STILL get that error. BUT, if I UNINSTALL Avast!, the error goes away completely, and I have no problems playing the videos!

It is worth noting that my Transcode360 research leads me to believe that other AV Vendors (McAfee, Symantec) are also having the same issue with Transcode360, while some are not (Windows OneCare).

But I’m especially stumped that clicking “Stop On-Access Protection” does not fix the problem! I thought that disabled Avast! completely, but somehow it must not be!

I’m working with developers on the Transcode360 side to see if they can figure out the problem as well.

Is this an issue with:

• Transcode360 (which works fine when Avast! is uninstalled)
• Avast! AV code
• or Vista itself

I would appreciate any and all help you could provide. I really don’t want to leave Avast!, but if I cannot figure this out, I will have no choice.

Thanks,
Jacob Klein (JacobKlein)

[Vlk]

During the next week, there will be an announcement about the availability of a pre-release version of the upcoming avast program update. This update, among a number of other things, has a completely revamped device driver for Vista (i.e. the inner workings of the on-access scanner on Vista will change completely). So – I’d suggest to wait for this version, and if the issue prevails even after applying this update, proceed with further investigation…

Thanks
Vlk

[Lisandro]

@Vlk post:2

During the next week, there will be an announcement about the availability of a pre-release version of the upcoming avast program update. This update, among a number of other things, has a completely revamped device driver for Vista (i.e. the inner workings of the on-access scanner on Vista will change completely).

Are any of these updates affect Windows XP or will only apply to Vista?
I suppose there will be an avast program update for all users and not only Vista-ones.

[Vlk]

Yes, you’re right, and it’s actually bringing a number of cool new features…
Stay tuned, it’s coming (soon ;))

[Lisandro]

@Vlk post:4

Stay tuned

It’s not difficult ;D

[Bluesman]

@Vlk post:4

Yes, you’re right, and it’s actually bringing a number of cool new features…
Stay tuned, it’s coming (soon ;))

Sounds great!!

Keep up the good work!

[XMAS]

@Bluesman post:6

@Vlk post:4

Yes, you’re right, and it’s actually bringing a number of cool new features…
Stay tuned, it’s coming (soon ;))

Sounds great!!

Yes, it really sounds great ;D
Another Christmas present for us ;D

[Lisandro]

@Vlk post:2

During the next week, there will be an announcement about the availability of a pre-release version of the upcoming avast program update.

Well… where is it? ;D

[Lisandro]

@Tech post:8

@Vlk post:2

During the next week, there will be an announcement about the availability of a pre-release version of the upcoming avast program update.

Well… where is it? ;D

Bump ;D

[system]

Vlk (et al):

The absolute newest beta version of Avast (v4.7.925 Beta) still does not work with the latest Transcode360 for Vista (v1.6.1 Beta), as I posted at http://forum.avast.com/index.php?topic=25697.msg209951#msg209951

Furthermore, I have tried stopping on-access protection with this new version, and even then I cannot get Transcode360 to work.

The way Media Center works is… I (user: Jacob W. Klein) access Vista from my Xbox360, and Windows logs in another account (Mcx1) who acts as the Media Center Extender to extend the media to the Xbox360.

Is there any way that avast! could be suffering some sort of multiple-user problem, such that stopping on-access protection for one user doesn’t quite do the same thing for all users? Just a thought/hunch, though I’m probably wrong.

The fact of the matter is that this should work without disabling my AntiVirus at all. I hope you can get this fixed - thanks for your time.

Regards - Happy New Year,
Jacob W. Klein

@Vlk post:2

During the next week, there will be an announcement about the availability of a pre-release version of the upcoming avast program update. This update, among a number of other things, has a completely revamped device driver for Vista (i.e. the inner workings of the on-access scanner on Vista will change completely). So – I’d suggest to wait for this version, and if the issue prevails even after applying this update, proceed with further investigation…

Thanks
Vlk

[Vlk]

Please try stopping the “avast! antivirus” service. (Control Panel → Administrative Tools → Services). Does that prevent the problem from happening?

Thanks
Vlk

[system]

Vlk:

I tried that, and it still did not work. This time through, I tried a more exhaustive approach…

Here is what I’ve tried:

• Install avast! v4.7.892, restart, T360 fails.- Disable on-access protection, T360 fails.- Stop all avast! services (main, updater, email, http), T360 fails.

• Update avast! to v4.7.925 Beta, restart, T360 fails.- Disable on-access protection, T360 fails.- Stop all avast! services (main, updater, email, http), T360 fails.

• Uninstall avast!, restart, T360 works.

I hope this is the type of testing you were looking for, but it appears that something is interfering even with on-access disabled and services stopped. Maybe some uber-low-level AntiVirus-device-driver isn’t getting nullified somehow?

Thanks for your help, but we’re still broken. I’m here to try any other suggestions you might have, or any other pre-release hotfixes.

@Vlk post:11

Please try stopping the “avast! antivirus” service. (Control Panel → Administrative Tools → Services). Does that prevent the problem from happening?

Thanks
Vlk

[Vlk]

OK, if you can, please try one more thing:

1. install avast (if not already installed).
2. go to Administrative Tools → Services, and set the startup type of all avast services to MANUAL (mainly the “avast! antivirus” service).
3. restart the computer and see if the problem is still here.

It is true that starting and stopping the service is not 100% equivalent to not starting it at all (the device driver stays loaded) - so this is definitely worth trying…

Thanks
Vlk

[system]

Vlk:

Still no luck. Here’s what I tried (using v4.7.925 Beta):

• Set “avast! Antivirus” and “avast! iAVS4 Control Service (aswUpdSv)” services to MANUAL, restarted, verified mouseover on GUI shows 0/0 services running, T360 fails.- Used msconfig to disable the automatic startup of ashDisp.exe, restarted, verified all avast! services on MANUAL and stopped, verified no ashdisp.exe GUI, T360 fails.

I hope this is what you wanted… any other ideas?

@Vlk post:13

OK, if you can, please try one more thing:

1. install avast (if not already installed).
2. go to Administrative Tools → Services, and set the startup type of all avast services to MANUAL (mainly the “avast! antivirus” service).
3. restart the computer and see if the problem is still here.

It is true that starting and stopping the service is not 100% equivalent to not starting it at all (the device driver stays loaded) - so this is definitely worth trying…

Thanks
Vlk

[Vlk]

OK, let’s go even one step further.

Try disabling the following drivers

aswMonFlt
aswTdi
aswRdr

To do this, open RegEdit, go to HKLM\System\CurrentControlSet\Services<driver-name>

and change the value Start to 3 (which means Disabled). Then restart the machine.

If that doesn’t solve the problem either, it must be some kind of magic ;D

Thanks
Vlk

[system]

Do you like Lucky Charm Bugs? They’re magically delicious! AKA: No luck here either.

Here’s what I tried (using v4.7.925 Beta):

• Set “avast! Antivirus” and “avast! iAVS4 Control Service (aswUpdSv)” services to MANUAL- Used msconfig to disable the automatic startup of ashDisp.exe- Changed: aswMonFlt from 2(Auto) to 3(Manual)- Changed: aswTdi from 1(System) to 3(Manual)- Changed: aswRdr from 1(System) to 3(Manual)- Restarted, verified no gui, verified 4 standard services set on Manual and stopped.- T360 magically fails.

There must be something else down this rabbit hole that’s being missed.

PS: You said 0x03 was Disabled, but actually 0x03 is Manual and 0x04 is Disabled I believe (Researched: http://www.jsifaq.com/SF/Tips/Tip.aspx?id=0324)… Do I need to test that as well?

Kind regards,
Jacob W. Klein

@Vlk post:15

OK, let’s go even one step further.

Try disabling the following drivers

aswMonFlt
aswTdi
aswRdr

To do this, open RegEdit, go to HKLM\System\CurrentControlSet\Services<driver-name>

and change the value Start to 3 (which means Disabled). Then restart the machine.

If that doesn’t solve the problem either, it must be some kind of magic ;D

Thanks
Vlk

[Vlk]

You’re right 3 is Manual 4 is disabled - but still, there shouldn’t be much difference here (even though you could try using 4 to make absolutely sure it’s not the drivers’ fault).

Hmm, so, what now?

So, no, there’s no ash* or asw* processes running, right? (you can use the Processes tab in the Task Manager to verify).

BTW are you using avast Home or Professional?
BTW2 do you have (full) MS Outlook installed on your machine? Which mail client are you using?

Thanks
vlk

[system]

OK, so the rule goes, if you can’t solve the problem after disabling some top layers, see if the problem still exists with all layers disabled, right?

Here’s what I tried (using v4.7.925 Beta):

• Set “avast! Antivirus” and “avast! iAVS4 Control Service (aswUpdSv)” services to DISABLED
• Also set “avast! Mail Scanner” and “avast! Web Scanner” services to DISABLED
• Used msconfig to disable the automatic startup of ashDisp.exe
• Changed: aswMonFlt from 2(Auto) to 4(DISABLED)
• Changed: aswTdi from 1(System) to 4(DISABLED)
• Changed: aswRdr from 1(System) to 4(DISABLED)
• Restarted, verified no gui, verified 4 standard services set to DISABLED and stopped.
• T360 works!

This leads me to conclude that I could conceivably figure out exactly which service or device driver is causing the problem. That being said, I need a break for now, so I’ll look deeper at this hopefully later today.

We haven’t found the problem, but we can find out what service or device driver is causing it, I believe. If I am able to narrow it down that far, will you continue to work (edit code, fix, etc) so that the Transcode 360 community can use your wonderful AV program?

Here are some A’s to your Q’s:

• During previous testing, I was checking task manager also to verify no ash* or asw* processes, even though we both know that those lower level services won’t show up here.
• I am using the Home version on this machine
• I am using Outlook 2007, as part of the Office 2007 System Professional package. I have it set to automatically start via my (local user’s) “Start Menu\Programs\Startup” folder.

More info later… This is encouraging news, no?
Thanks,
Jacob W. Klein

@Vlk post:17

You’re right 3 is Manual 4 is disabled - but still, there shouldn’t be much difference here (even though you could try using 4 to make absolutely sure it’s not the drivers’ fault).

Hmm, so, what now?

So, no, there’s no ash* or asw* processes running, right? (you can use the Processes tab in the Task Manager to verify).

BTW are you using avast Home or Professional?
BTW2 do you have (full) MS Outlook installed on your machine? Which mail client are you using?

Thanks
vlk

[Vlk]

Yes, very interesting indeed…

So, effectively, when the 3 drivers were set to MANUAL it did not work but when you changed them to DISABLED it worked? Hmmm…

I agree that it would be very helpful to find out which of the 3 drivers is responsible for this… My bet would be aswTdi.sys (that’s the “Network Shield” provider in avast) - but only further experiments can tell for sure…

Thanks very much for your help so far,
Vlk

[system]

Further experiments INDEED. Belated Christmas-colored experiments! Copy/paste to notepad if the color is bothersome or irritating

Services: 0=Boot 1=System 2=Auto 3=Manual 4=Disabled
Defaults for low-level-services: aswMonFlt=2, aswRdr=1, aswTdi=1

Here’s what I tried (using v4.7.925 Beta):
Note: The first 8 tests have UI and main services disabled, so just look at the low-driver-level start-numbers
Note: But the 9th test is tricked out for avast! and T360 to work together (ie: temporary workaround fix)

UI Disabled, 4 main services DISABLED, aswMonFlt=4, aswRdr=4, aswTdi=4
T360 works!

UI Disabled, 4 main services DISABLED, aswMonFlt=2, aswRdr=1, aswTdi=1
T360 fails.

UI Disabled, 4 main services DISABLED, aswMonFlt=2, aswRdr=4, aswTdi=4
T360 works!

UI Disabled, 4 main services DISABLED, aswMonFlt=2, aswRdr=1, aswTdi=4
T360 fails.

UI Disabled, 4 main services DISABLED, aswMonFlt=2, aswRdr=4, aswTdi=1
T360 fails.

UI Disabled, 4 main services DISABLED, aswMonFlt=4, aswRdr=1, aswTdi=1
T360 fails.

UI Disabled, 4 main services DISABLED, aswMonFlt=4, aswRdr=1, aswTdi=4
T360 fails.

UI Disabled, 4 main services DISABLED, aswMonFlt=4, aswRdr=4, aswTdi=1
T360 fails.

UI ENABLED, 4 main services DEFAULT (auto-auto-man-man startedx4), aswMonFlt=2, aswRdr=4, aswTdi=4
T360 works! (mouseover UI shows 6/6 running)

I guess my conclusion is that there are problems in BOTH:

• “aswTdi.sys (avast! Network Shield Support, avast! TDI Filter Driver)” and
• “aswRdr.sys (avast! TDI RDR Driver)”

Where do we go from here?