After I ran a boot time scan of Avast I got a Stop c000021a error and I cannot boot into windows XP. I might be able to fix it if I knew what avast actually did. Does avast keep a log of its boot time scan somewhere? What files it modified? Which ones it deleted? Etc.
Yes, it should be at C:\ProgramData\AVAST Software\Avast\log (Windows 7).
Unless you configured automatic removal of detected files, the boot-time scanner would ask you before any action… so did you get any detection, and did you choose to remove the file(s) in question?
I did chose to delete the files in question. That was my stupid move. I have a program that can find deleted files and restore them. I think I can do this successfuly unless avast somehow deletes them in a way to prevent that from happening. I just need a log of the deleted files. One of the files I got prompted before deleting and it was in the windows/system32 folder. I normally would have not deleted it, but the extension on it was .tmp so I assumed it was a temporary file and lower risk. This is windows XP and not Windows 7. Where is the path for the boot time scan under XP? Is it in the same place?
c:\Documents and Settings\All Users\Application Data\AVAST Software\Avast\report\aswBoot.txt
(if the avast! installation was updated from avast! 5, the “AVAST Software” part may actually be “ALWIL Software”)
Thank you. I will try this later tonite and give you an update if this solved my problem or not.
So far I have not been able to get it back to life even after copying over a new winlogon.exe, msgina.dll and some other files associated with it. (I made backups so I can always roll back).
If not, then hopefully I can bring it back with a repair win xp installation.
No luck. I restored trzAF.tmp to C:\Windows\System32
The rest of the files deleted where in the java folder and in the temporary internet files folder so I don’t believe they are related.
Any other ideas on how I can bring this computer back to life?
Does Avast ever modify the registy?
A trzXXXX file is already an avast-created file, possibly by the usual Windows scan… so there’s no point in putting it back ino the system folder, it’s not the original name. Can you check the file’s properties (version info) - what it really is?
Btw, avast! shouldn’t allow you to remove e.g. Winlogon.exe, even if infected.
Winlogon.exe was not deleted nor was msgina.dll nor was csrss.exe. I just copied over new ones thinking they were damaged, but I have reverted back to the ones originally there. If trzAF.tmp is something created by Avast, then it was probably not the boot time scan that broke things. I ran a quick scan before a boot time scan and it found 3 files that I also deleted. Is there a log for those 3 files as well? I looked at the properties for trzAF.tmp and nothing to give me a clue what it did.
So I did a repair install and same error, which is surprising. Any chance that installing avast caused this error or maybe a failed service pack install?
Reports for on-demand scans are created if you enable that… I’m afraid it’s not on by default.
I’m not sure how many files you moved to Chest previously (i.e. how big the index is going to be), but you can check the Chest index in
c:\Documents and Settings\All Users\Application Data\AVAST Software\Avast\chest\index.xml
I’d say near the end of the file, you should find the files that were moved to the Chest recently (which is what I would associate the trzXXX.tmp file with) - even though if the .tmp file was left there, it could also mean that moving the file into Chest somehow failed, so the record might not be there.