setupeng.exe keeps crashing!

Avast Free Antivirus / Premium Security
1

Hi,

OS: WinXP SP3 32bit.

A few days ago, avast’s autoupdate feature would crash (access violation), so I uninstalled it with aswClear, then tried installing a fresh copy of avast by downloading:

File: E:\setupeng.exe
Size: 39658008 bytes
File Version: 4.8.1356.0
Modified: Thursday, 5 November 2009, 10:44:38 AM
MD5: AFB62BD0F5D08EA2624E83C8B6056B4E
SHA1: FE5FB4F06F6521DB66EECBEB2A3B215D21D0EC09
CRC32: 736BE152

And when I run it, I get an Access Violation:

http://img214.imageshack.us/img214/1783/av1o.png

http://img510.imageshack.us/img510/6163/av2.png

And here’s info from DrWatson (with identifying info edited out):


Application exception occurred:
        App: <unknown> (pid=2392)
        When: 1/11/2009 @ 12:24:22.718
        Exception number: c0000005 (access violation)

*----> System Information <----*
        Terminal Session Id: 0
        Number of Processors: 4
        Processor Type: x86 Family 6 Model 23 Stepping 7
        Windows Version: 5.1
        Current Build: 2600
        Service Pack: 3
        Current Type: Multiprocessor Free

*----> Task List <----*
   0 System Process
   4 System
 580 smss.exe
 852 csrss.exe
 876 winlogon.exe
 920 services.exe
 932 lsass.exe
1092 nvsvc32.exe
1128 svchost.exe
1196 svchost.exe
1308 svchost.exe
1468 svchost.exe
1544 svchost.exe
1680 spoolsv.exe
 356 Explorer.EXE
 856 svchost.exe
1156 httpd.exe
1264 AdskScSrv.exe
1444 jqs.exe
1456 RTHDCPL.EXE
1568 MA_CMIDI_Inst.exe
1352 jusched.exe
1784 NokiaMServer.exe
1844 mysqld-nt.exe
1924 NMSAccessU.exe
1936 PnkBstrA.exe
1984 StarWindServiceAE.exe
2008 svchost.exe
2032 Wacom_Tablet.exe
 704 ipoint.exe
 740 Wacom_TabletUser.exe
 768 RUNDLL32.EXE
 804 Reader_sl.exe
 984 cmd.exe
3288 Wacom_Tablet.exe
3212 ctfmon.exe
3228 httpd.exe
3596 wuauclt.exe
3648 dpupdchk.exe
3788 ApacheMonitor.exe
3816 NVInstEnabler.exe
1180 wmiprvse.exe
2120 alg.exe
2292 wscntfy.exe
3156 ServiceLayer.exe
3204 NclUSBSrv.exe
3880 NclRSSrv.exe
2596 regedit.exe
2140 setupeng (1).exe
2392 avast.setup
2356 drwtsn32.exe

*----> Module List <----*
(0000000000400000 - 000000000066f000: C:\DOCUME~1\Foo\LOCALS~1\Temp\_av_sfx.tm~a02144\avast.setup
(000000005ad70000 - 000000005ada8000: C:\WINDOWS\system32\uxtheme.dll
(0000000071aa0000 - 0000000071aa8000: C:\WINDOWS\system32\WS2HELP.dll
(0000000071ab0000 - 0000000071ac7000: C:\WINDOWS\system32\WS2_32.dll
(0000000071ad0000 - 0000000071ad9000: C:\WINDOWS\system32\WSOCK32.dll
(0000000071bf0000 - 0000000071c03000: C:\WINDOWS\system32\SAMLIB.dll
(00000000732e0000 - 00000000732e5000: C:\WINDOWS\system32\RICHED32.DLL
(0000000074720000 - 000000007476c000: C:\WINDOWS\system32\MSCTF.dll
(0000000074e30000 - 0000000074e9d000: C:\WINDOWS\system32\RICHED20.dll
(0000000076390000 - 00000000763ad000: C:\WINDOWS\system32\IMM32.DLL
(0000000076f60000 - 0000000076f8c000: C:\WINDOWS\system32\WLDAP32.dll
(0000000077120000 - 00000000771ab000: C:\WINDOWS\system32\OLEAUT32.dll
(00000000773d0000 - 00000000774d3000: C:\WINDOWS\WinSxS\X86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\COMCTL32.dll
(00000000774e0000 - 000000007761d000: C:\WINDOWS\system32\ole32.dll
(0000000077690000 - 00000000776b1000: C:\WINDOWS\system32\NTMARTA.DLL
(0000000077b40000 - 0000000077b62000: C:\WINDOWS\system32\Apphelp.dll
(0000000077c00000 - 0000000077c08000: C:\WINDOWS\system32\VERSION.dll
(0000000077c10000 - 0000000077c68000: C:\WINDOWS\system32\msvcrt.dll
(0000000077dd0000 - 0000000077e6b000: C:\WINDOWS\system32\ADVAPI32.dll
(0000000077e70000 - 0000000077f02000: C:\WINDOWS\system32\RPCRT4.dll
(0000000077f10000 - 0000000077f59000: C:\WINDOWS\system32\GDI32.dll
(0000000077f60000 - 0000000077fd6000: C:\WINDOWS\system32\SHLWAPI.dll
(0000000077fe0000 - 0000000077ff1000: C:\WINDOWS\system32\Secur32.dll
(000000007c800000 - 000000007c8f6000: C:\WINDOWS\system32\kernel32.dll
(000000007c900000 - 000000007c9b2000: C:\WINDOWS\system32\ntdll.dll
(000000007c9c0000 - 000000007d1d7000: C:\WINDOWS\system32\SHELL32.dll
(000000007e410000 - 000000007e4a1000: C:\WINDOWS\system32\USER32.dll

*----> State Dump for Thread Id 0x81c <----*

eax=00000004 ebx=00000000 ecx=0016e848 edx=0001aae8 esi=00137868 edi=00000000
eip=77693477 esp=001377a0 ebp=001377a0 iopl=0         nv up ei pl nz na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202

*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\system32\NTMARTA.DLL - 
function: NTMARTA!AccRewriteSetNamedRights
        77693467 90               nop
        77693468 90               nop
        77693469 90               nop
        7769346a 90               nop
        7769346b 8bff             mov     edi,edi
        7769346d 55               push    ebp
        7769346e 8bec             mov     ebp,esp
        77693470 8b4508           mov     eax,[ebp+0x8]
        77693473 85c0             test    eax,eax
        77693475 7422            jz NTMARTA!AccRewriteSetNamedRights+0x24c (77693499)
FAULT ->77693477 833800           cmp   dword ptr [eax],0x0 ds:0023:00000004=????????
        7769347a 741d            jz NTMARTA!AccRewriteSetNamedRights+0x24c (77693499)
        7769347c ff7510           push    dword ptr [ebp+0x10]
        7769347f ff750c           push    dword ptr [ebp+0xc]
        77693482 ff7008           push    dword ptr [eax+0x8]
        77693485 ff15ec106977     call    dword ptr [NTMARTA+0x10ec (776910ec)]
        7769348b 85c0             test    eax,eax
        7769348d 0f84970b0000    je NTMARTA!AccRewriteSetNamedRights+0xddd (7769402a)
        77693493 33c0             xor     eax,eax
        77693495 5d               pop     ebp
        77693496 c20c00           ret     0xc

*----> Stack Back Trace <----*
WARNING: Stack unwind information not available. Following frames may be wrong.
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\system32\ADVAPI32.dll - 
*** WARNING: Unable to verify checksum for C:\DOCUME~1\Foo\LOCALS~1\Temp\_av_sfx.tm~a02144\avast.setup
*** ERROR: Module load completed but symbols could not be loaded for C:\DOCUME~1\Foo\LOCALS~1\Temp\_av_sfx.tm~a02144\avast.setup
ChildEBP RetAddr  Args to Child              
001377a0 77698d64 00000004 0016e848 001378f8 NTMARTA!AccRewriteSetNamedRights+0x22a
001377dc 776947f2 00000004 0016e348 001630c0 NTMARTA!AccFreeIndexArray+0x732
00137834 776948ef 0016dd18 00000004 00000004 NTMARTA!AccRewriteSetNamedRights+0x15a5
001378dc 77df0d43 00168910 00000004 00000000 NTMARTA!AccRewriteSetNamedRights+0x16a2
0013790c 77e21962 00168910 00000001 00000004 ADVAPI32!SetNamedSecurityInfoW+0x4e
00137934 00415594 00168910 00000001 00000004 ADVAPI32!SetNamedSecurityInfoA+0x32
001379b8 004155fc 003e3ee8 00000001 00000000 avast+0x15594
00137a24 004405b9 7c80b741 00000000 7ffdc000 avast+0x155fc
00137ab8 00000000 00000000 00000000 00000000 avast+0x405b9

*----> Raw Stack Dump <----*
00000000001377a0  dc 77 13 00 64 8d 69 77 - 04 00 00 00 48 e8 16 00  .w..d.iw....H...
00000000001377b0  f8 78 13 00 68 78 13 00 - 00 00 00 00 08 00 00 00  .x..hx..........
00000000001377c0  00 00 00 00 01 00 00 00 - 00 00 00 00 00 00 00 00  ................
00000000001377d0  48 e8 16 00 b8 e1 16 00 - a0 e1 16 00 34 78 13 00  H...........4x..
00000000001377e0  f2 47 69 77 04 00 00 00 - 48 e3 16 00 c0 30 16 00  .Giw....H....0..
00000000001377f0  00 00 00 00 10 07 00 00 - 04 00 00 00 ac 78 13 00  .............x..
0000000000137800  01 00 00 00 01 00 00 00 - 04 00 00 00 08 00 00 00  ................
0000000000137810  01 00 00 00 00 00 00 00 - 01 00 00 00 30 dd 16 00  ............0...
0000000000137820  08 de 16 00 10 07 00 00 - 00 00 00 00 48 e3 16 00  ............H...
0000000000137830  c0 30 16 00 dc 78 13 00 - ef 48 69 77 18 dd 16 00  .0...x...Hiw....
0000000000137840  04 00 00 00 04 00 00 00 - ac 78 13 00 01 00 00 00  .........x......
0000000000137850  01 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
0000000000137860  00 00 00 00 00 00 00 00 - 3e 59 69 77 38 23 69 77  ........>Yiw8#iw
0000000000137870  80 5d 69 77 30 5c 69 77 - 69 24 69 77 bf 27 69 77  .]iw0\iwi$iw.'iw
0000000000137880  b0 28 69 77 54 26 69 77 - d1 23 69 77 b1 24 69 77  .(iwT&iw.#iw.$iw
0000000000137890  ff 33 69 77 6b 34 69 77 - d4 5a 69 77 2f 5b 69 77  .3iwk4iw.Ziw/[iw
00000000001378a0  39 5b 69 77 18 00 00 00 - 03 00 00 00 89 00 12 00  9[iw............
00000000001378b0  16 01 12 00 a0 00 12 00 - ff 01 1f 00 00 00 00 00  ................
00000000001378c0  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
00000000001378d0  04 00 00 00 01 00 00 00 - 18 dd 16 00 0c 79 13 00  .............y..

I can no longer install Avast on this system, after many years of using it.

It works fine on my Vista machine though (which I rarely use though).

2

Read the instructions, download and burn (maybe from another computer), finally use one of this rescue CD’s:

  1. Dr. Web
  2. Avira
  3. BitDefender
  4. Kaspersky
  5. F-Secure

I think something is fishy and preventing avast for correct installation.
Do you use any other antivirus?

3

What specifically should I use in one of those rescue CDs?

I only now installed AVG antivirus just be safe, but those errors occured when I had no other antivirus product installed!

4

Well, if your computer is clean, I’ll suggest you try to download avast again… but now that you have AVG, don’t install two antivirus at the same time.

5

I’m not sure if it’s clean. I did some scanning with avg but it didn’t really find anything serious.

I can uninstall AVG, I prefer avast. I tried redownloading avast, but still no luck.

Maybe I didn’t do a clean uninstall? Because I get a svchost.exe crashing when I boot the machine and login. I used aswClear a few times to try and remove it.

6

Oh, my, god.

This post helped me:

http://www.annoyances.org/exec/forum/winxp/1059955345?s

I have no idea how or why, but it seems my ntmarta.dll is also corrupted!

File: C:\WINDOWS\system32\ntmarta.dll
Size: 118784 bytes
File Version: 5.1.2600.5512 (xpsp.080413-2113)
Modified: Monday, 14 April 2008, 5:42:04 AM
MD5: 02B15C46B1F90949BE98AC7C67680FCC
SHA1: 9F7B71ACABB0E85085A2AD80944081D963948DA9
CRC32: 052A03FE

File: C:\WINDOWS\ServicePackFiles\i386\ntmarta.dll
Size: 118784 bytes
File Version: 5.1.2600.5512 (xpsp.080413-2113)
Modified: Monday, 14 April 2008, 5:42:04 AM
MD5: 549290DBC280C887681D7652978DBBE0
SHA1: 7E2EA4D88645138E5EDB646157FD702C347BB53A
CRC32: 35FC486D

I replaced it with the one in ServicePackFiles\ and it now loads the avast setup!

Before it was crashing in the ntmarta.dll module!

Notice how all the hashes are different for the ntmarta files, but they have the same version resource and same bytesize!