Blue screen of death: aswSP.sys

[Elle8]

Hello there

avast was recommended to me by quite a few techies. However, since I installed it two months ago, my laptop, a Dell Inspiron 1525 which runs on Vista, has been blue screening.

Event manager has given the following error messages:
The computer has rebooted from a bugcheck.  The bugcheck was: 0x0000008e (0xc0000005, 0x005a0053, 0x949dac50, 0x00000000). A dump was saved in: C:\Windows\MEMORY.DMP.

The computer has rebooted from a bugcheck.  The bugcheck was: 0x000000d1 (0x0032003b, 0x00000002, 0x00000001, 0x8d3721b9). A dump was saved in: C:\Windows\MEMORY.DMP.

The computer has rebooted from a bugcheck.  The bugcheck was: 0x000000d1 (0x00000015, 0x00000002, 0x00000001, 0x8d7521b9). A dump was saved in: C:\Windows\MEMORY.DMP.

I've also noticed messages about:
driver irql not less or equal
fault page in nonpaged area
aswSP.sys

I've asked on various techie forums for help and they said aswSP.sys is an avast driver.

I am using the free version and it's 110528-1.

Please can you give me some advice. Also, I’m not very tech savvy, so please explain as if speaking to a child!!

If you need any more info, please let me know.
Thank you.

[DavidR]

The aswSP.sys is the avast self protection driver.

- Upload any minidump or memory.dmp files (only the latest memory.dmp file), zipped to reduce size.  Give the zip file you are uploading a unique name (e.g. m0unds-mem-dump.zip, etc), so they can identify it. It might not be a bad idea to create a text file (readme.txt) with any relevant information, avast topic, user name, etc. etc. in the zip file.

Upload the zip file to the ftp server ftp://ftp.avast.com/incoming:
- Using Internet Explorer, Connect to the link and drag the file into the Right pane and drop it, that starts the upload, you don't have read access to this folder.

Or

- Upload it using the Run command-line in Windows: Windows Key + R (to get the run box), copy and paste this

Code: [Select]

explorer ftp://ftp.avast.com/incoming and drag the file into the window, from another explorer window.

####
Have (or did) you another Anti-Virus installed in this system, if so what was it and how did you get rid of it ?

[Elle8]

Thanks for your quick response David. It's just this minute BSOD again .

The anti-virus I used to use was Anti-Vir and AVG ver8.5. I removed AVG using AVG removal tool, then checked with Appremover to confirm it had been removed. Avira AntiVir I removed with Appremover.

I will attempt to follow your other instructions.

Thank you.

[Elle8]

Hello again

How do I create a readme text and zip it with the file please?

Thanks.

[DavidR]

You're welcome.

Check this out for avira removal - Avira AntiVir Uninstall Package & RegistryCleaner (choose appropriate version): http://www.avira.com/en/support/support_downloads.html, Avira RegistryCleaner. http://www.avira.com/en/support-download-avira-registrycleaner

[DavidR]

Hello again

How do I create a readme text and zip it with the file please?

Thanks.

If you have notepad, you use that to use as a text editor and enter the suggested information. When you have done that, just save it and give it the name ReadMe.txt done.

You need to have a zip (archiving program), if you have got one then some will allow you to open the archive and either select add or drag and drop the readme.txt file into the zip archive.

If you haven't got one, I use 7zip, which is fairly easy to use, www.7-zip.org, it is a free application.

[Elle8]

Wow. Thanks for the quick response again DavidR.

I've just uploaded the zip file. I called it Elle8 m0unds-mem-dump.zip and I think the readme.txt dragged into it fine.

I've done the Anti-Vir registry cleaner and there were some items left. I deleted most of them, but five items failed to delete:
H_KEY_LOCAL\MACHINE\SYSTEM\CONTROLSET001\SERVICES\avast! ANTIVIR
H_KEY_LOCAL\MACHINE\SYSTEM\CONTROLSET002\SERVICES\avast! ANTIVIR
H_KEY_LOCAL\MACHINE\SYSTEM\CONTROLSET003\SERVICES\avast! ANTIVIR
H_KEY_LOCAL\MACHINE\SYSTEM\CONTROLSET004\SERVICES\avast! ANTIVIR
H_KEY_LOCAL\MACHINE\SYSTEM\Services\avast! ANTIVIR


Thanks.

[DavidR]

Well since those are avast antivir [us] the US bit being dropped off the end, all very confusing, but they are protected by the avast self-defence module and windows shouldn't allow them to be deleted since they are in use.

[Elle8]

How strange that they are in use. I have not used AntiVir for months.

[DavidR]

They aren't avira but avast! antivirus, reread my last post and below, bold to show they are avast! registry keys and not avira.

H_KEY_LOCAL\MACHINE\SYSTEM\CONTROLSET001\SERVICES\avast! ANTIVIR

[Elle8]

Ah sorry... should have gone to Specsavers.
That is odd then! I am confused!

[DavidR]

Nothing odd, just an unfortunate coincidence that the full registry key has been concatenated dropping the most important part the last two digits US so it looks like ANTIVIR (the alternate name of avira) and not ANTIVIRUS.

[Elle8]

Ah I see.

Re my FTP upload, how will I know if I've uploaded it correctly and if it's been read please?

Thanks.

[DavidR]

Unless you actually use an ftp program (rather than my suggested options), you won't know as you don't have read permission on the avast.com/incoming folder. With an ftp program, they usually report successful completion of the upload.

If they did receive it and you gave the link to the topic, generally they will get back to you in the topic.

[Elle8]

Oh dear, I'm not sure I linked to the topic correctly, I've resent.

Thanks and sorry about that.