WXP completely hangs at startup

Hi there,

I got huge problems with my Avast 4.7 home and have no idea what to do more now.

The system I’m using is an IBM Thinkpad X41 (type: 2525-65G) with an Centrino 1.5GHz CPU, XP SP 2 english and 1GB of RAM

When the system boots, I can log on, see the desktop with all icons and the taskbar and then after some seconds the system freezes. When I move the mouse over the taskbar I can only see the egg timer. This situation does not change, even not after waiting 15 minutes or longer.
The system can only be re-animated then by killing the explorer.exe in task-manager and manually restarting it. But then of course some taskbar-applications are not running. Sometimes this happens 3 times in a series, sometimes it boots up 5 times normaly and then hangs once again. After uninstalling Avast, tha system runs fine (but without any protection).

I already re-installed the system from scratch yesterday, downloaded the newest drivers from IBM/Lenovo and installed all recommended XP-Updates … but the problem is still the same. There’s no error message in the eventvwr or any other obvious irregularity.
There’s also not much software installed on the notebook. Only some common things like Office 2003, Adobe 8, FreepdfXP and some little tools (Desktop-Calendar, Thinkpad Battery Maximizer, Thinkpad Harddisk Protection, some other Thinkpad tools) but no other security or protection software. I also already cleaned up the bootup processes and services.

I’m really sad about this because I really like Avast and used it on an X40 before and never had any problems. The installation was quite the same but with even much more programs installed.

Please, please help.

Many thanks in advance.
Uli

How is your set to receive Windows Updates?
If you disable the automatic updates and set to manual, will it help?

The set is to “Notify me when updates are ready to download …”. At the moment all updates are installed. Just checked the update-page yesterday.

Is this OK, too or do you mean to disable automatic updating?

I’ve set the Avast-Logging-mode to “Debugging” now. After rebooting it just had a “hang-up” again.

The last entry in the Antivirus-part of eventvwr before breaking down is “Leaving aswServ::Init…”. Maybe this helps.

Just to test, and then you could revert to automatic back.

Please, post the last 100-150 lines of the logs:
C:\Program Files\Alwil Software\Avast4\DATA\log\Debug.log
C:\Program Files\Alwil Software\Avast4\DATA\log\Error.log

Switching Automatic Updates off did not solve the problem.

Here is the (whole) content of the debug.log:

18.07.2007 16:49:49 1184770189 SYSTEM 1924 Fixing startup entries…
18.07.2007 16:49:49 1184770189 SYSTEM 1924 Starting InetWD…
18.07.2007 16:49:49 1184770189 SYSTEM 1924 Starting IdleUI and integrity thread…
18.07.2007 16:49:49 1184770189 SYSTEM 1924 Starting window thread…
18.07.2007 16:49:49 1184770189 SYSTEM 1924 Starting TCP daemon thread…
18.07.2007 16:49:49 1184770189 SYSTEM 1924 Leaving aswServ::Init…
18.07.2007 17:11:56 1184771516 SYSTEM 2012 Fixing startup entries…
18.07.2007 17:11:56 1184771516 SYSTEM 2012 Starting InetWD…
18.07.2007 17:11:56 1184771516 SYSTEM 2012 Starting IdleUI and integrity thread…
18.07.2007 17:11:56 1184771516 SYSTEM 2012 Starting window thread…
18.07.2007 17:11:56 1184771516 SYSTEM 2012 Starting TCP daemon thread…
18.07.2007 17:11:56 1184771516 SYSTEM 2012 Leaving aswServ::Init…
18.07.2007 17:14:32 1184771672 SYSTEM 1944 Fixing startup entries…
18.07.2007 17:14:32 1184771672 SYSTEM 1944 Starting InetWD…
18.07.2007 17:14:32 1184771672 SYSTEM 1944 Starting IdleUI and integrity thread…
18.07.2007 17:14:32 1184771672 SYSTEM 1944 Starting window thread…
18.07.2007 17:14:32 1184771672 SYSTEM 1944 Starting TCP daemon thread…
18.07.2007 17:14:32 1184771672 SYSTEM 1944 Leaving aswServ::Init…
18.07.2007 17:26:16 1184772376 SYSTEM 1932 Fixing startup entries…
18.07.2007 17:26:16 1184772376 SYSTEM 1932 Starting InetWD…
18.07.2007 17:26:16 1184772376 SYSTEM 1932 Starting IdleUI and integrity thread…
18.07.2007 17:26:16 1184772376 SYSTEM 1932 Starting window thread…
18.07.2007 17:26:16 1184772376 SYSTEM 1932 Starting TCP daemon thread…
18.07.2007 17:26:16 1184772376 SYSTEM 1932 Leaving aswServ::Init…
18.07.2007 17:28:18 1184772498 SYSTEM 1928 Fixing startup entries…
18.07.2007 17:28:18 1184772498 SYSTEM 1928 Starting InetWD…
18.07.2007 17:28:18 1184772498 SYSTEM 1928 Starting IdleUI and integrity thread…
18.07.2007 17:28:18 1184772498 SYSTEM 1928 Starting window thread…
18.07.2007 17:28:18 1184772498 SYSTEM 1928 Starting TCP daemon thread…
18.07.2007 17:28:18 1184772498 SYSTEM 1928 Leaving aswServ::Init…
18.07.2007 18:18:58 1184775538 SYSTEM 1104 Fixing startup entries…
18.07.2007 18:18:58 1184775538 SYSTEM 1104 Starting InetWD…
18.07.2007 18:18:58 1184775538 SYSTEM 1104 Starting IdleUI and integrity thread…
18.07.2007 18:18:58 1184775538 SYSTEM 1104 Starting window thread…
18.07.2007 18:18:58 1184775538 SYSTEM 1104 Starting TCP daemon thread…
18.07.2007 18:18:58 1184775538 SYSTEM 1104 Leaving aswServ::Init…

A file called error.log does not exist in this folder. Just

info.log
setup.log
nshield.log
warning.log
aswMaiSv.log

Cheers
Uli

Some other application is messing with avast installation.
What other security based software do you have that might block new startup entries, e.g. Spybot S&D (TeaTimer), AdAware (AdWatch), SpySweeper, Spyware Doctor (StartUpGuard), PrevX, WinPatrol, ProcessGuard, etc.?

Actually no other security software is installed beside Avast. I ran XP-Antispy once after installing but nothing else.

I made a screenshot from the starting processes at logon (from Sysinternals “Autoruns”). The other file (AutoRuns.txt) is an export from Autoruns showing all processes starting on boot.

P.S.: The entry “BLOG” is a thinkpad tool (BatLogex.dll … sounds like battery-stuff).

… and the textfile. Sorry, looks quite weird but imported into Excel it makes more sense.

What is ThinkVantage Active Protection System?
What is Fingerprint Laucher?

Active Protection System is a harddisk-protection-utility from IBM/Lenovo. It prevents the HDD from headcrashes (mechanically).

Fingerprint Launcher is also Lenovo tool. It belongs to the integrated Fingerprint-Reader (to log on with a fingerprint instead of typing a password).

Please, go to folder \windows\minidump and send the newest (recent) .mdmp files for analysis.
Better if you can compress (zip) them and add some information about the BSOD and the link for this thread. :wink:

Send an email to any of these addresses:
vlk (at) avast.com
rypacek (at) asw.cz

Or upload to the any of these anonymous ftp servers:
ftp://ftp.asw.cz/incoming
ftp://www2.asw.cz/incoming

Other way is manually generate the dump. When the machine is in stalled state, hold down the rightmost CTRL key, and press the SCROLL LOCK key twice. This will cause a machine to ‘blue-screen’ and dump of memory will start.

Hi Tech,

Bob Marley would sing “no bluescreen, no dump” ;D

There’s no BS when the systems hangs and so I don’t have any dumps.

My “only” problem is, that the whole desktop-area (incl. taskbar and trayicon-area) is freezing sometimes. When this happens, I’m still able switch to the taskmgr by pressing Ctrl-Alt-Del. And there I kill the explorer.exe and restart it manually. Then I’m able to work on “normally”. Unfortunately this behaviour is not reproducible and happens just sporadically.

But I’ve got a suspect now. I think, the Active Desktop Calender (ADC.exe) might be the problem. I prevented it from starting automatically and was able to boot the device 9 times in a series without any problems. After enabling autostart for this application again, it startet 5 times normally and then froze at the 6th try. I’ll try to exclude the file from on-access-scanning now and will write what happens. A strange thing is, that I used this software on my old X40 before, also with Avast 4.7 and never had any problems. Strange world.

Will keep you informed
Uli

So, generate it manually as I’ve posted before.

Freezing problems are one of the most difficult to solve… could be a lot of things… we can only help with guesses.

There are other Calendar tools (free) and, maybe, it won’t be a big problem change this application. I don’t know what you feel regarding to it.

So, generate it manually as I've posted before.

Oh, I tried to but nothing happend. But I just read that I have to create a regkey prior (HKEY_LOCAL_MACHINE\System\ CurrentControlSet\Services\i8042prt\Parameters, find or create a DWORD value named CrashOnCtrlScroll. Double-click on the value and set its data to 1. ). Will try that again. *edit: worked !

Freezing problems are one of the most difficult to solve... could be a lot of things... we can only help with guesses.

You can’t imagine how much I know that :wink:

There are other Calendar tools (free) and, maybe, it won't be a big problem change this application. I don't know what you feel regarding to it.

Sure, would be a solution but I have quite a lot entries in the current one. I’ll try to exclude the ADC.exe from scanning first and will see what happens. If this does not work, there’s also a newer version of ADC available. Or I try to start the ADC delayed by script.

Unfortunately no real progress yet.

  1. Excluding the ADC.exe from scanning → did not work
  2. Excluding the whole folder from scanning → did not work
  3. Upating to a newer version of ADC → did not work
  4. starting the application with 10sec delay by vbs-script → works better but also hung once

I’ve uploaded the dump yesterday eve. Maybe you can see sthg. more in there.

Thanks
Uli

The minidump is of no use for a user-initiated blue screen.
We need the full dump.

Details are here: http://support.avast.com/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=71

Thanks
Vlk

Just uploaded the file.

Cheers
Uli

Any news in that case ?

I think Vlk is on holiday, and the FTP upload area isn’t constantly monitored, so I don’t know if it will be noticed immediately and then it will have to be analysed.

Normally if one of the Alwil team request you upload it to the FTP area, they will be checking for it, I don’t know if this will be an issue if Vlk is on holiday.