[SOLVED ?] Multiples copies of Avastsvc in "Suspended" mode!?!

Avast Free Antivirus / Premium Security
1

Hello experts,

Using Avast Free (v.12.3.2280) on an x64 Windows 10 machine.
Turns out that since a few weeks, Avast notifies me that I am not protected because avastsvc is not active…Fixing it restores the situation for a while, but looking at the Task Manager I can see (for example just right now) 7 copies of Avastsvc in a Suspended state and one service actually active…
Anybody able to explain what’s going on here?

Thanks and best regards

Phil

2

Perform a repair of avast.
If that doesn’t solve it, perform a clean installation of avast.

3

Thx…

I did try to completely uninstall Avast, clean up the registry and reinstall…Same issue…
Will try again…

Phil

4

Hi, can you please provide dump of a suspended instance of AvastSvc.exe.

  1. Disable Avast self defense in troubleshooting settings
  2. Use Task manager to create process dump (context menu of selected process)
5

Hi,

Thx for the reply…Did create a dump, but unfortunately the zipped dump file is 124 Mb…
Any email address where I could send it?

Thanks

Phil

6

Hi Phil, give it a unique name and upload it here: ftp://ftp.avast.com/incoming/
Post the name of the uploaded file here afterwards.

7

Thx for helping out on this.

File uploaded as Crashing_AvastSvc_Philippe.zip. Hope you get it ok.

Checked yesterday a bit more what happens…
From what I can figure, Avastsvc crashes, an event is added to Event Viewer and a new copy is spawned…

Cheers

Phil

8

You’re welcome Phil, now it’s up to Spec to check/fix it…

Cheers,
Asyn

9

Hi again,

FWIW, avastsvc crashed again today at 12:32 am, generating now the 2nd suspended avassvc and the 3rd total.

Here’s the eventviewer xml code:

Nom du journal :Application
Source : Application Error
Date : 27/09/2016 12:32:51
ID de l’événement :1000
Catégorie de la tâche :(100)
Niveau : Erreur
Mots clés : Classique
Utilisateur : N/A
Ordinateur : PC-PHIL
Description :
Nom de l’application défaillante AvastSvc.exe, version : 12.3.3154.0, horodatage : 0x57b5c39d
Nom du module défaillant : ntdll.dll, version : 10.0.14393.103, horodatage : 0x57b7e09e
Code d’exception : 0xc0000374
Décalage d’erreur : 0x000d9841
ID du processus défaillant : 0x2e0
Heure de début de l’application défaillante : 0x01d217e15658c7db
Chemin d’accès de l’application défaillante : C:\Program Files\AVAST Software\Avast\AvastSvc.exe
Chemin d’accès du module défaillant: C:\WINDOWS\SYSTEM32\ntdll.dll
ID de rapport : 6e886f05-6cda-4c7d-bad1-24ee46f58320
Nom complet du package défaillant :
ID de l’application relative au package défaillant :
XML de l’événement :



1000
2
100
0x80000000000000

31024
Application
PC-PHIL



AvastSvc.exe
12.3.3154.0
57b5c39d
ntdll.dll
10.0.14393.103
57b7e09e
c0000374
000d9841
2e0
01d217e15658c7db
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\WINDOWS\SYSTEM32\ntdll.dll
6e886f05-6cda-4c7d-bad1-24ee46f58320





Also, if it may help, since these issues started showing up, the tray icon is fixed and no longer like an animated one, whatever this means…

Cheers

Phil

10

And this one in the System Journal of the Event Viewer:
Sorry for the French text in there, but it basically says that il shut down in an unexpected way and that the attempted fix will be to restart the service…

Phil

Nom du journal :System
Source : Service Control Manager
Date : 27/09/2016 12:32:51
ID de l’événement :7031
Catégorie de la tâche :Aucun
Niveau : Erreur
Mots clés : Classique
Utilisateur : N/A
Ordinateur : PC-PHIL
Description :
Le service Avast Antivirus s’est terminé de manière inattendue. Ceci s’est produit 1 fois. L’action corrective suivante va être effectuée dans 5000 millisecondes : Redémarrer le service.
XML de l’événement :



7031
0
2
0
0
0x8080000000000000

4270


System
PC-PHIL



Avast Antivirus
1
5000
1
Redémarrer le service
610076006100730074002100200041006E0074006900760069007200750073000000

11

For Icon Animation to work:

http://screencast-o-matic.com/screenshots/u/Lh/1474987376642-68513.png

12

:slight_smile: That’s what is set…But id doesn’t animate…
No big deal anyway…

13

Hello again experts,

Any news from the “multiple-suspended-copies-of-AvastSvc” battlefront?
Thx

Phil

14

Try a repair of Avast:
Control Panel> Program and Features (Add/remove program)>Select Avast> Select Repair. Reboot when completed
https://www.avast.com/faq.php?article=AVKB204

15

:slight_smile: :slight_smile: Was not particularly talking about the icon stuff which is a detail, but more about the fact that I still see a random number of AvastSvc copies in a suspended state (4 right now) and for which I submitted a dump…
No repair/reinstall does help in any way…

Cheers

Phil

16

FWIW, there has been a so-called “Windows Cumulative Update” a couple days ago and, since then, the issue seems to have evaporated…
Maybe Avast vapor pressure was good enough but it looks like the suspended copies of AvastSvc can no longer be seen here…

Cheers

Phil

17

Sounds good, thanks for the feedback.

18

Well, it looks like I may have come to conclusions a bit too quickly…
Suspended copies show up again…

Now, if it may help in this debate, I did not completely wait for the boot process to complete today before checking : I plugged in an external drive before the end of the boot process and now I see 3 copies of which 2 are suspended…

Cheers

Phil

19

Some more interesting observations about this strange behavior:

  1. Each time there is a system change and a reboot required, there is ONLY ONE copy of AvastSvc running just fine.
  2. Whenever there is no change and, say, a regular shutdown/restart, those multiple copies show up, just like if the shutdown did not completely stop the service and left it in a weird state.

FWIW

Philippe

20

Back to my original post:

Anybody home? Any progress made? Any hints from the Avast wizards?
Problem still ythere: today: 5 AvastSvc copies and “System Not protected” message when checking Avast…

Should I move away from Avast for another protection after all these years?

Thanks

Philippe