Error with avast! 4.8 [antirootkit-related]

Hello!

I just updated my avast! home version to 4.8 and soon I noticed that there are some error messages in Log viewer:

30.3.2008 9:50:51 SYSTEM 1536 Internal error has occurred in module aswar scan function failed!, function A000010E.
30.3.2008 9:58:02 SYSTEM 1532 Internal error has occurred in module aswar scan function failed!, function A000010E.
30.3.2008 10:04:58 SYSTEM 1528 Internal error has occurred in module aswar scan function failed!, function A000010E.
30.3.2008 10:11:46 SYSTEM 1516 Internal error has occurred in module aswar scan function failed!, function A000010E.
30.3.2008 10:25:39 SYSTEM 1528 Internal error has occurred in module aswar scan function failed!, function A000010E.
30.3.2008 10:49:11 SYSTEM 1528 Internal error has occurred in module aswar scan function failed!, function A000010E.

So it has something to do with a new antirootkit system? Everytime I boot my machine there comes one error message more. I am using Windows XP SP2 home.

EDIT: Little bit more info, when I started to scan hard drive the error also comes:
30.3.2008 11:00:47 Username 2044 Internal error has occurred in module aswar scan function failed!, function A000010E.

yes, aswar is the antirootkit plugin…

Have you tried to repair your installation?

I tried to repair installation but it didn’t help. Same error message still comes to Log viewer after boot.
Any other thoughts?

Hi Doug,

could you please tell me a bit more about your hard drive layout?
E.g. is the system drive “C:” ? Do you have multiple logical disks (partitions)?
Do you have multiple physical disks?

Etc.

BTW the good news is that no matter what the problem is, we will be able to fix it with a regular virus database update (without a real program update). This is because the antirootkit logic is actually inside the virus databse.

Thanks
Vlk

Okay.

I have two hard drives (C and D) and my system drive is C as usual. I dont have any partitions. Well, and my computer file system is FAT 32 if it has some affect this problem.

The FAT32 information may be the clue, actually. We’ll have this tested.

BTW what OS are you using? XP?

:wink:

I have the same problem on my XP Sp2 system (dutch) with avast 4.8.

I have 3 partions. The system drive is C: and uses the NTFS file system.
The other partions also use the NTFS file system.

On my vista laptop everything works just fine :smiley:

I too have this issue, but didn’t see this topic before posting here, http://forum.avast.com/index.php?topic=34213.0.

Win XP Pro SP2, 2 HDDs with c:, d: on drive zero and e:, f: on drive 1 (e: is my DVD) all are FAT32 format.

This one on system boot this morning.
30/03/2008 11:50 SYSTEM 1372 Internal error has occurred in module aswar scan function failed!, function A000010E.

Also, this one, only difference this one is under my UserName and not System.
30/03/2008 12:02 UsrNme 2844 Internal error has occurred in module aswar scan function failed!, function A000010E.

Windows XP Event Viewer entry.
Event Type: Error
Event Source: avast!
Event Category: Client
Event ID: 90
Date: 30/03/2008
Time: 12:02
User: N/A
Computer: PC1
Description:
Internal error has occurred in module aswar scan function failed!, function A000010E.

I checked the event viewer log of a XPSP2 machine but there are no such error messages.

Which section of the event viewer did you check, they are in the anti-virus section (if there are any) and they would also be in the error section of avast’s log viewer. The suspicion from Vlk could be those with FAT32 formatted partition/s, though there was one person reporting this with NTFS, reply #7.

I had already checked there, too. No such error messages.

I forgot to mention it but all the partitions are NTFS.

Hello,

It’s been quite a while since I ever posted here as I’ve had very few Avast problems. Except now. I too have the very same error. So kindly excuse me if I make any mistakes in this posting.

I have XP sp2, 2 drives , one of w/c has 3 partitions .All of these fat32 too.

I also have spywareterminator, comodo firewall, spybot, spyware blaster, and adaware 2007.

Can I or should I get rid of spyware terminator and comodo (change it with another FW that has no hips) since Avast already has some of the protection these offer.

BTW. I also did a clean install of Avast after seeing this error but still it remains.

Thanks

Mangyan

G’Day All,
After an unsatisfactory experience with the 4.8 Beta at beginning of month (IE & OE would not run sandboxed), I reverted to 4.7.
Today I upgraded to the official 4.8,
and sadly have to confirm this problem shown in event Viewer / AntiVirus
“Internal error has occurred in module aswar scan function failed!, function A000010E.”

At boot time, in addition to Windows items, I have WinPatrol 12, Sandboxie 3.24 and Online Armor 2.1.0.119 and of course the Avast AshDisp.exe.

The first boot with Avast! 4.8 produced a blank desktop without any icons at all. After a forced shutdown, and a chkdsk on restart, the tray icons for Avast! and Sandboxie showed Error conditions but OA was OK.
Setting "Delay loading of Avast!.. " didn’t help
but “Disable Rootkit Scan …” did let all applications load properly
including using IE7 and OE sandboxed.

In addition to my profile below I would add that I run multiboot XP Pro SP2 systems on 2 HDDs each with multiple FAT32 partitions.

I am happy to keep using this Avast 4.8 and will await developments, since Vlk expects the bugfix to be possible via a regular virus database update.

Otherwise, congrats to the Avast! team.

Maurice

They will be trying to replicate the fault in the labs, which I think they should be able to do. So hopefully it shouldn’t be long but in the meantime it really isn’t a show stopper.

DavidR,

Sorry but it is a show stopper for me.

At the cold boot this morning (after a chkdsk),
WinPatrol, Sandboxie and Avast! all were hung - but Online Armor seemed OK. Event viewer reported the aswan error, although I had disabled the rootkit startup scan.

Managed to disable Sandboxie at startup - after a forced shutdown, restart produced same problems.
Attempt to get to Avast settings produced a window reporting RPC Error, and FAQ button started IE which was then hung.

Managed to kill WinPatrol in Program Manager,
meanwhile (5mins) somehow Sandboxie and Avast had come good.

Cold restart - Avast Ok this time -

Tried “Delay loading Avast Services …” - reboot - Avast not started.
“The AAVM subsystem reported a RPC Error”

All in all, most unsatisfactory, so its back to Avast! 4.7 for me
at least until Vlk can report success with the fix for the root kit scan.

very dissappointed

Maurice

P.S. On more thing to try - Disable Avast! Raw disk Access at Boot.

I am having many of the same problems. I have three programs in common with you; Avast, WinPatrol, and Online Armour. I am using xp home and am only using one partition (NTFS)
I started a post called trouble with start up with 4.8 before I saw this.

jwa, et al

Update on previous post:-

Disabled “Raw disk access in Avast! boot-time scan”
Re-boot - (chkdsk) - WinPatrol, Avast! and OA all OK.
IE and OE OK in Sandboxie.

Re-enabled “rootkit scan on system startup”
Re-boot - (no chkdsk) - hung with blank desktop until mouse moved then desktop filled - WinPatrol, Avast! and OA all OK.
IE and OE OK in Sandboxie.

So, maybe attention needed to raw disk access at boot-time scan.

In both cases, Sandboxie control was NOT set to start when Windows starts - (starts when needed by IE and OE which are forced processes).

Reset Sandboxie to start when Windows starts.

Will reboot and report back.

Maurice

Hello again,
especially Doug, whose thread we seem to have stolen - sorry!

To update my experiences:
With raw disk access in avast! boot-time scan disabled
and rootkit scan enabled:

Reboot (no chkdsk) - winPatrol, Avast!, Online Armour and Sandboxie Control all have correct icons in Tray and seem OK.
IE and OE ok in Sandbox.

So, in my case at least, the problem lies with the Avast! raw disc access module, although Event viewer / Antivirus continues to report the aswar scan function failure.

For the while, I’ll keep Avast! 4.8 with rootkit scan and raw disk access disabled and await developments.

Hope this helps improve Avast! 4.8

Maurice

In another topic Vlk said that the problem should be solved at last VPS update but unfortunately I still have this problem. Only change is that the error message is little bit different:
2.4.2008 17:13:27 SYSTEM 1520 Internal error has occurred in module aswar scan function failed!, function 00000001.

As you can notice the function is changed.

EDIT: Well, I noticed that when I start On-Demand scan it doesn’t cause error messages anymore so it works little bit better.