aswSP.sys BSOD

[Bunch]

Hello,

I had 3 BSOD related to Avast today, with the latest update:
  Program version: 5.0.677
  Database version: 101105-0
  Windows Version: XP SP3 (2600.xpsp_sp3_gdr.100427-1636).

All of the crashes occurred in aswSP.SYS (aswSP+1183f). The 3 crashed occurred at startup just after Avast has started.

I don't have any other security application installed on this computer, but it has some specific drivers (Sony VAIO TZ31 platform) that started to behave erratically recently, I don't know if it's related. Specifically, the Vaio HotKeys started to not respond to keypresses. Anyway it could be related to the Microsoft security patches installed recently.

I'll join the latest minidump to this post (renamed to .log).

  READ_ADDRESS:  a7296000

  FAULTING_IP:
  aswSP+1183f
  a7ed783f 3a0413          cmp     al,byte ptr [ebx+edx]
  MM_INTERNAL_CODE:  0
  CUSTOMER_CRASH_COUNT:  1
  DEFAULT_BUCKET_ID:  DRIVER_FAULT
  BUGCHECK_STR:  0x50
  PROCESS_NAME:  System
  LAST_CONTROL_TRANSFER:  from a7ed8cfa to a7ed783f

  STACK_TEXT: 
  WARNING: Stack unwind information not available. Following frames may be wrong.
  a7c15d54 a7ed8cfa 86002000 00000001 860020ec aswSP+0x1183f
  a7c15d84 a7ed8ddc 86587000 000000ff 00000001 aswSP+0x12cfa
  a7c15dac 805cff62 00000000 00000000 00000000 aswSP+0x12ddc
  a7c15ddc 8054612e a7ed8d58 00000000 00000000 nt!PspSystemThreadStartup+0x34
  00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

  STACK_COMMAND:  kb
  FOLLOWUP_IP:
  aswSP+1183f
  a7ed783f 3a0413          cmp     al,byte ptr [ebx+edx]

  SYMBOL_STACK_INDEX:  0
  SYMBOL_NAME:  aswSP+1183f
  FOLLOWUP_NAME:  MachineOwner
  MODULE_NAME: aswSP
  IMAGE_NAME:  aswSP.SYS
  DEBUG_FLR_IMAGE_TIMESTAMP:  4c865191
  FAILURE_BUCKET_ID:  0x50_aswSP+1183f
  BUCKET_ID:  0x50_aswSP+1183f

Regards,

    Benoit GARNIER

[Bunch]

Hello,

Do I need to provide anything else to fix this issue?

Regards,

    Benoit GARNIER

[SafeSurf]

Hello Bunch and welcome to the forum.

Please read this link regarding submitting a dump file: http://support.avast.com/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=71.

You do not send the dump files to the forum; they are sent directly to Avast.

It appears that your Avast updates occurred prior to today.

Have you tried an Avast repair to see if this fixes your problem?
- Go to Control Panel > Add/Remove programs > Avast Antivirus.
- Scroll down and choose Repair function in the pop-up window.
- Reboot.

Since your machine is also acting strange, have you scanned your machine for malware?  Since your Avast definitions are not up to date, please check your computer for malware with Malwarebytes’ Anti-Malware (MBAM).
·   Download free http://www.malwarebytes.org/ (the blue button) for an on-demand scanner.
·   Double Click mbam-setup.exe to install the application.
·   After install, click update so you have latest database before scanning.
·   Under Settings:
o   General: Automatically Save File After Scan Completes is checked off
o   Scanner Settings:  Check all boxes
o   Updater: Download and install update if available is checked off
·   Once the program has loaded, select "Perform FULL Scan", then click Scan.
·   The scan may take some time to finish, so please be patient.
·   When the disinfection scan is complete, a log will appear in Notepad and you may be prompted to Restart. (See Extra Note).
·   Click the “remove selected” button to quarantine anything found.  You will find the infection details under the Quarantine tab.
·   The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
·   Copy & Paste the entire report in your next reply.

[Bunch]

Hello,

I'll try everything you wrote, but what made you think my Avast definitions was not up-to-date? I opened the topic on the 5th, with a definition file as of 101105-0. Yes, the update occurred prior to today, but since this update the PC is crashing about one third of the time (at startup only).

More informations tonight as I'll try a malware scan (for the record, I did not find anything strange with HiJackThis, and tested the RAM with memtest86+ for a whole night). The problem with trying to pinpoint the crash is that it's not always reproducible.

Anyway, thank you for your help.

Regards,

[SafeSurf]

You may also want to try the Winsockfix Utility:

Windows XP – http://majorgeeks.com/WinSock_XP_Fix_d4372.html

[Bunch]

Hello,

I've run a full scan with the latest version of MBAM, after having updated to the latest malware definition, and no malwares were found. I did not try to repair Avast at this point.

Then, I tried to reproduce the crash with full memory dumps configured in, but I was not able to do so, even after having restarted around 25 times. I don't understand why the PC doesn't crash anymore. The only things that have changed are the installation of MBAM and the update of the Avast virus definition file to 101108-1.
I will come back if/when the crash occur again.

Should I nevertheless upload the 3 minidumps (generated with the 101105-0 database)?

Regards,

    Benoit GARNIER

[SafeSurf]

The only things that have changed are the installation of MBAM and the update of the Avast virus definition file to 101108-1.

Should I nevertheless upload the 3 minidumps (generated with the 101105-0 database)?

I suspect that one of the Avast updates fixed your problem; sometimes a few mini-fixes happen without us knowing.   I would hold off on doing a mini-dump at this point and do not revert back to an older database.

See how your machine runs over the next 1 - 2 days.  If all goes well and you feel that your issue is resolved/fixed, please go back to the first open post in this topic, click the modify button in that Post and change the title/subject, add [Resolved] to the beginning of the title so this thread can be closed. 

If you feel that you need to re-open this thread because the problem returned, you can state "Reopen" at the beginning of the title/subject and delete "Resolved" to reopen the thread.

Let me know if you have any questions.  Thank you for allowing me to assist you.

[pk]

Then, I tried to reproduce the crash with full memory dumps configured in, but I was not able to do so, even after having restarted around 25 times. I don't understand why the PC doesn't crash anymore. The only things that have changed are the installation of MBAM and the update of the Avast virus definition file to 101108-1.

We've already fixed this bug, you need to wait for the next program update.
Thanks for the first post and minidump.

[Bunch]

Hello,

It seems the bug is still there, even with the 101108-1 database update (and 5.0.677 binaries), as I finally had a BSOD.
I've just uploaded the full memory dump (Bunch-aswSP.sys-BSOD-memory.dmp.zip).
It's the exact same crash as the 3 previous BSODs: PAGE_FAULT_IN_NONPAGED_AREA at aswSP+1183f.

Please note that I've still not tried to do an Avast repair. I'll do it and try to reproduce the crash shortly.

Regards,

    Benoit GARNIER

[SafeSurf]

We've already fixed this bug, you need to wait for the next program update.

Please note that I've still not tried to do an Avast repair. I'll do it and try to reproduce the crash shortly.

See if your problem is resolved with the 101109-1 Avast update or later (depending on your time zone and date).

If this does not resolve your problem, then try the repair.  Hold off on submitting any dump files since Avast is aware of this and they have already put a "fix" on it.  Thank you.