Boot-time scan - odd errors in aswboot.log

Avast Free Antivirus / Premium Security
1

For the second time in a week, a Boot-Time scan shows odd error messages in the aswboot.log report. The “Scan Histories” show nothing bad was found, but I am concerned about the error messages. What should I do next?

This is on an XP machine with 4GB RAM - been a good machine for a long time. I have Avast version 12.3.2280 (build 12.3.3154.21).

Here’s what it says in aswboot.log:

CmdLine - quick aswBoot.exe /A:"C:" /A:"*STARTUP" /L:"1033" /heur:80 /RA:fix /pup /archives /IA:0 /KBD:2 /dir:"C:\Program Files\AVAST Software\Avast" CmdLine end SafeBoot: 0 CreateKbThread new CKbBuffer CKbBuffer::Init CKbBuffer::Init end NtCreateEvent(g_hStopEvent) dep_osBeginThread - KbThread CreateKbThread end NtInitializeRegistry KbThread start ReadRegistry DATA=C:\Documents and Settings\All Users\Application Data\AVAST Software\Avast PROG=C:\Program Files\AVAST Software\Avast BUILD=2280 Microsoft Windows XP Service Pack 3 SystemRoot=C:\WINDOWS TEMP=C:\WINDOWS\TEMP TMP=C:\WINDOWS\TEMP ReadRegistry end CreateTemp CreateTemp end aswcmnbDllMain cmnbInit aswEnginDllMain(DLL_PROCESS_ATTACH) InitLog InitLog end CmdLine - full aswBoot.exe /A:"C:" /A:"*STARTUP" /L:"1033" /heur:80 /RA:fix /pup /archives /IA:0 /KBD:2 /dir:"C:\Program Files\AVAST Software\Avast" CmdLine end Program folder: C:\Program Files\AVAST Software\Avast Engine folder: C:\Program Files\AVAST Software\Avast\defs\16102900 Base addr: 1200000 TimeStamp: 580afd1a Unschedule 00,00,61,00,73,00,77,00,42,00,6F,00,6F,00,74,00, 2E,00,65,00,78,00,65,00,20,00,2F,00,41,00,3A,00, 22,00,43,00,3A,00,22,00,20,00,2F,00,41,00,3A,00, 22,00,2A,00,53,00,54,00,41,00,52,00,54,00,55,00, 50,00,22,00,20,00,2F,00,4C,00,3A,00,22,00,31,00, 30,00,33,00,33,00,22,00,20,00,2F,00,68,00,65,00, 75,00,72,00,3A,00,38,00,30,00,20,00,2F,00,52,00, 41,00,3A,00,66,00,69,00,78,00,20,00,2F,00,70,00, 75,00,70,00,20,00,2F,00,61,00,72,00,63,00,68,00, 69,00,76,00,65,00,73,00,20,00,2F,00,49,00,41,00, 3A,00,30,00,20,00,2F,00,4B,00,42,00,44,00,3A,00, 32,00,20,00,2F,00,64,00,69,00,72,00,3A,00,22,00, 43,00,3A,00,5C,00,50,00,72,00,6F,00,67,00,72,00, 61,00,6D,00,20,00,46,00,69,00,6C,00,65,00,73,00, 5C,00,41,00,56,00,41,00,53,00,54,00,20,00,53,00, 6F,00,66,00,74,00,77,00,61,00,72,00,65,00,5C,00, 41,00,76,00,61,00,73,00,74,00,22,00,00,00,00,00,

Unschedule end
LoadResources
LoadResources end
InitReport
InitReport end
New global exclusions:
NtSetEvent(g_hInitEvent) - 1
InitKeyboard
CPU: Phys(2), Log(2), Aff(2), Feat(000000040000003f)
g_dwKbdNum: 2
FreeMemory: 3187568640
\Device\KeyboardClass0 succeeded
avworkInitialize
\Device\KeyboardClass1 failed: 0xC0000034
\Device\KeyboardClass1 failed: 0xC0000034
FreeMemory: 3175866368
\Device\KeyboardClass1 failed: 0xC0000034
\Device\KeyboardClass1 failed: 0xC0000034
\Device\KeyboardClass1 failed: 0xC0000034
\Device\KeyboardClass1 failed: 0xC0000034
\Device\KeyboardClass1 failed: 0xC0000034
\Device\KeyboardClass1 failed: 0xC0000034
\Device\KeyboardClass1 failed: 0xC0000034
\Device\KeyboardClass1 failed: 0xC0000034
\Device\KeyboardClass1 failed: 0xC0000034
\Device\KeyboardClass1 failed: 0xC0000034
\Device\KeyboardClass1 failed: 0xC0000034
\Device\KeyboardClass1 failed: 0xC0000034
\Device\KeyboardClass1 failed: 0xC0000034
\Device\KeyboardClass1 failed: 0xC0000034
\Device\KeyboardClass1 failed: 0xC0000034
\Device\KeyboardClass1 failed: 0xC0000034
\Device\KeyboardClass1 failed: 0xC0000034
\Device\KeyboardClass1 failed: 0xC0000034
\Device\KeyboardClass1 failed: 0xC0000034
\Device\KeyboardClass1 failed: 0xC0000034
\Device\KeyboardClass1 failed: 0xC0000034
\Device\KeyboardClass1 failed: 0xC0000034
\Device\KeyboardClass1 failed: 0xC0000034
\Device\KeyboardClass1 failed: 0xC0000034
\Device\KeyboardClass1 failed: 0xC0000034
\Device\KeyboardClass1 failed: 0xC0000034
\Device\KeyboardClass1 failed: 0xC0000034
\Device\KeyboardClass1 succeeded
\Device\KeyboardClass2 failed: 0xC0000034
\Device\KeyboardClass3 failed: 0xC0000034
\Device\KeyboardClass4 failed: 0xC0000034
s_dwKbdClassCnt: 2
InitKeyboard end
NtSetEvent(g_hInitEvent) - 2
GetKey
CKbBuffer::Wait
CKbBuffer::Get
CKbBuffer::Get end
CKbBuffer::Wait end
ProcessArea
Loading raw access support
avfilesScanAdd *RAW:C: [Fs: 000700ff, NTFS; Dev: 07, 00000020]
avfilesScanAdd *STARTUP
avfilesScanRealMulti begin
GetErrorText
GetErrorText
GetErrorText
GetErrorText
GetErrorText
GetErrorText
GetErrorText
GetErrorText
GetErrorText
GetErrorText
GetErrorText
GetErrorText
GetErrorText
GetErrorText
GetErrorText
GetErrorText
avfilesScanRealMulti finished
Runtime: 6958688ms
avworkClose
TerminateKbThread
GetKey end (?/00)
CloseKeyboard
CloseKeyboard end
KbThread stop
CKbBuffer::~CKbBuffer
CKbBuffer::~CKbBuffer end
aswEnginDllMain(DLL_PROCESS_DETACH)
cmnbFree
FreeResources
CloseReport
CloseLog

Thanks.

2

No need to be concerned, there’s nothing wrong about it.

3

Why are you running a boot time scan ?
There is no need for it unless it is really needed to remove malware.

4

Igor - Right now, when an Avast user starts a Boot-Time Scan, the light-blue screen says to look in aswboot.log for the results. Well, now, that’s wrong. Now, the results are only in the “Scan History” link on the normal Open Avast window. You might want to update your boot-time light-blue screen to say so.

Eddy - I keep this old XP computer updated using the POS hack. Good so far over the last two years plus. However, the last three ± months, this PC has frozen, sometimes as often as once per day. Then, maybe two weeks ago, I got two spam emails in my Outlook Express Inbox that would re-appear after I deleted them. (I finally succeeded in deleting them.) Finally, last week, there were two BSODs. So, I thought I’d better check. The only reason I ran two boot-time scans is that I didn’t know where to look for the results after the first one - I thought the aswboot.log results in my first post above meant the scan didn’t have clean results. I now know both scans were clean.

I’ve also run a memtest and the Dell Diagnostics (which can be accessed after booting with F12), and they say my RAM and CPU are also OK. It might be my replacement hard drive – a year ago, I replaced my failing WD Velociraptor with a Seagate Momentus XT hybrid HD-SSD that we had from another PC. Maybe its feature of switching files in and out of its SSD portion ain’t so great.

Well, since the memtest and Dell diagnostics a few days ago, I haven’t had another freeze or BSOD, but it’s still too soon to tell.

5

What light-blue screen? Would you have a screenshot? I admit I really don’t know what you’re referring to…
Thanks.

6

I think the OP is talking about the boot-time scan which has a Blue background, which is rather limited when you are running it before windows has fully started.

7

Actually, I’m right and wrong.
There is a file called aswboot.txt in a slightly different folder, and it shows me that both recent scans were clear. (Couldn’t Avast make it easier to get to this?)
However, it’s also true that the easiest way to see the results after the boot-time scan and reboot is to click on “Show History” in the Avast app screen.

Question - how is the boot-time scan less than the full scan while still in Windows? Doesn’t the boot-time scan check more things more easily?

8

Hi ginz :slight_smile:

About the Boot-time scan :

It scans for known types of malware and removes threats before the operating system and other services are running. This is an advantage because certain files cannot be removed while the operating system is running.

https://www.avast.com/en-eu/faq.php?article=AVKB132

Greetz, Red.