Screen freezes after boot-time scan

Avast Free Antivirus / Premium Security
1

I’ve run the boot-time scan a number of times and each time it freezes and won’t allow me to make any changes.
Below are the messages I’m getting. Am I unable to make changes because more than a trojan is showing up and the program is unable to handle that? On problem involved a Maxtor backup (which is my external hard drive) and I deleted that backup. Another involved a small program that I had moved to my external hard drive “Bad Copy” that was corrupt, and I just deleted the program. I assume I can also delete the Maxtor (my external hard drive) backup for Musicmatch also, but I haven’t. Can I just go into my system volume files and remove the first two corrupt files, which would leave only the spyware file, run the boot-time scan and see if it will be able to remove that?

  1. System volume information_restore {B3768 0B2- BA0A -4E5D- BF30- 83E 44C58 8624}\RP331\A0059788.exe|>wiseE0011.bin error4214 {installer is corrupt

  2. System volume information_restore {B3768 0B2- BA0A -4E5D- BF30- 83E 44C58 8624}\RP331\A0059810.exe error 42145 {installer is corrupt

  3. Maxtor backup\D3P48H41\C\Program files\Musicmatch\Musicmatch update\MMJB.castanet\undo\10/10/82/>wise011.bin error 42145 {corrupt}

  4. System volume information_restore {B3768 0B2- BA0A -4E5D- BF30- 83E 44C58 8624}\RP331\A0065408.msi|>css can.exe is infected win32:spyware - gen [SPY]

Many thanks!

2

So you got the actions menu (delete, move to chest, repair etc.) and the keyboard is not working ?

3

I believe I had the problem described by pussykatt, above. Installation went fine (uninstalled 4.8 first), restarted, did a Full Scan which discovered 4 iFrame files in Temporary Internet Files, it moved them to the chest, recommended a Boot Scan. I did the Boot Scan, went back after a while and the screen displayed the scan results (black screen) with the same iFrame problem, and offered several Press x options at the bottom. The keyboard would not initiate any actions, nor would control-alt delete, so i did a power off restart which came up with a Windows cannot start, recommend Auto Repair. I did that, and there was no solution after several minutes, so I did another restart and all seems fine. The 4 files are gone, I did not delete them. Nothing is logged in Event Viewer since Windows had not started. Windows 7, 3 GB RAM, nothing else installed but standard MS fare (Defender and Firewall).

4

Hello,
please post the log file C:\ProgramData\Alwil Software\Avast5\log\aswBoot.log

5

I’d like to post the file but the BSOD problem became so prevalent in web surfing that I had to completely uninstall and revert to 4.8. I had not tried another boot scan. W7 32 bit, Dell Quadcore, 3 GB RAM. Windows firewall, Defender. Uninstalled 4 prior to 5 install. The BSOD seemed related to IE 8 surfing, but the blue screen disappeared before I could read it all. The beginning talked about corrupted drivers. I see in the blog that a new release is coming but the problem was too frequent to work with.

6

I’m sorry to say I don’t have this file. I tried looking for it in Program Files\Alwil\Avast5, but that is as far as I got. I also did a search, but didn’t find C:\ProgramData. Can I find the log elsewhere?

7

It’s in the “C:\Documents and Settings\All Users\Application Data\Alwil Software\Avast5\log” directory.

8

Thanks very much…here it is…

CmdLine - quick
aswBoot.exe /A:“" /A:“C:” /L:“1033” /heur:80 /pup /archives /IA:0 /KBD:2 /dir:“C:\Program Files\Alwil Software\Avast5”
CmdLine end
SafeBoot: 0
CreateKbThread
new CKbBuffer
CKbBuffer::Init
CKbBuffer::Init end
NtCreateEvent(g_hStopEvent)
dep_osBeginThread - KbThread
CreateKbThread end
NtInitializeRegistry
KbThread start
ReadRegistry
DATA=C:\Documents and Settings\All Users\Application Data\Alwil Software\Avast5
PROG=C:\Program Files\Alwil Software\Avast5
BUILD=377
Microsoft Windows XP Service Pack 3
SystemRoot=C:\WINDOWS
TEMP=C:\WINDOWS\TEMP
TMP=C:\WINDOWS\TEMP
ReadRegistry end
CreateTemp
CreateTemp end
aswcmnbDllMain
cmnbInit
aswEnginDllMain(DLL_PROCESS_ATTACH)
InitLog
InitLog end
CmdLine - full
aswBoot.exe /A:"” /A:“C:” /L:“1033” /heur:80 /pup /archives /IA:0 /KBD:2 /dir:“C:\Program Files\Alwil Software\Avast5”
CmdLine end
Unschedule
61,00,75,00,74,00,6F,00,63,00,68,00,65,00,63,00,
6B,00,20,00,61,00,75,00,74,00,6F,00,63,00,68,00,
6B,00,20,00,2A,00,00,00,61,00,73,00,77,00,42,00,
6F,00,6F,00,74,00,2E,00,65,00,78,00,65,00,20,00,
2F,00,41,00,3A,00,22,00,2A,00,22,00,20,00,2F,00,
41,00,3A,00,22,00,43,00,3A,00,22,00,20,00,2F,00,
4C,00,3A,00,22,00,31,00,30,00,33,00,33,00,22,00,
20,00,2F,00,68,00,65,00,75,00,72,00,3A,00,38,00,
30,00,20,00,2F,00,70,00,75,00,70,00,20,00,2F,00,
61,00,72,00,63,00,68,00,69,00,76,00,65,00,73,00,
20,00,2F,00,49,00,41,00,3A,00,30,00,20,00,2F,00,
4B,00,42,00,44,00,3A,00,32,00,20,00,2F,00,64,00,
69,00,72,00,3A,00,22,00,43,00,3A,00,5C,00,50,00,
72,00,6F,00,67,00,72,00,61,00,6D,00,20,00,46,00,
69,00,6C,00,65,00,73,00,5C,00,41,00,6C,00,77,00,
69,00,6C,00,20,00,53,00,6F,00,66,00,74,00,77,00,
61,00,72,00,65,00,5C,00,41,00,76,00,61,00,73,00,
74,00,35,00,22,00,00,00,00,00,
Unschedule end
LoadResources
LoadResources end
InitReport
InitReport end
NtSetEvent(g_hInitEvent) - 1
InitKeyboard
g_dwKbdNum: 2
\Device\KeyboardClass1 failed: 0xC0000034
CPU: Phys(1), Log(1), Aff(1), Feat(0000000f)
FreeMemory: 564047872
avworkInitialize
\Device\KeyboardClass1 failed: 0xC0000034
FreeMemory: 563478528
\Device\KeyboardClass1 failed: 0xC0000034
\Device\KeyboardClass1 failed: 0xC0000034
\Device\KeyboardClass1 failed: 0xC0000034
\Device\KeyboardClass1 failed: 0xC0000034
\Device\KeyboardClass1 failed: 0xC0000034
\Device\KeyboardClass1 failed: 0xC0000034
\Device\KeyboardClass1 failed: 0xC0000034
\Device\KeyboardClass1 failed: 0xC0000034
\Device\KeyboardClass1 failed: 0xC0000034
\Device\KeyboardClass1 failed: 0xC0000034
\Device\KeyboardClass1 failed: 0xC0000034
\Device\KeyboardClass1 failed: 0xC0000034
\Device\KeyboardClass1 failed: 0xC0000034
\Device\KeyboardClass1 failed: 0xC0000034
\Device\KeyboardClass1 failed: 0xC0000043
s_dwKbdClassCnt: 1
InitKeyboard end
NtSetEvent(g_hInitEvent) - 2
GetKey
CKbBuffer::Wait
CKbBuffer::Get
CKbBuffer::Get end
CKbBuffer::Wait end
ProcessArea
avfilesScanAdd *MBR0
avfilesScanAdd *BOOTC:
Loading raw access support
avfilesScanAdd *RAW:C:\ [Fs: 000500ff, NTFS; Dev: 07, 00000020]
avfilesScanAdd *BOOTF:
avfilesScanAdd *RAW:F:\ [Fs: 000500ff, NTFS; Dev: 07, 00000020]
avfilesScanRealMulti begin
GetErrorText
GetErrorText

9

Thank you for the log. We will provide a fix the next week.

10

I have solved my trojan problem, but when running a boot-time scan I am still experiencing the first 2 problems.

  1. System volume information_restore {B3768 0B2- BA0A -4E5D- BF30- 83E 44C58 8624}\RP331\A0059788.exe|>wiseE0011.bin error4214 {installer is corrupt

  2. System volume information_restore {B3768 0B2- BA0A -4E5D- BF30- 83E 44C58 8624}\RP331\A0059810.exe error 42145 {installer is corrupt

I there any way to correct this?

11

There’s nothing to correct - just ignore these warnings.

12

I have no problem now ignoring them, but when I did have a spyware, and the boot-time scan found it, I was unable to remove it due to these to items. As I said in my initial post, after the scan, the screen froze due to these items and I was unable to make the needed changes (delete, move to chest…etc.) and had to reboot my machine manually.

Thanks!