Resolved: Blue Screen While Installation Finishes

[silverfish85]

Hi everyone,

I recently tried to update to the latest version of Avast, version 7.0.1466, and my installation always gets interrupted by a blue screen of death. The only way I can get back into Windows is if I restart in safe mode and uninstall Avast (using the cleaner utility). Subsequent attempts to install fresh also results in the BSOD. I do not have any other anti virus products installed. This has left me without any anti virus installed on my machine.

I am running Windows 7 32-bit OS. I have pasted the output from the minidump below:

Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\100412-242503-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16988.x86fre.win7_gdr.120401-1505
Machine Name:
Kernel base = 0x83619000 PsLoadedModuleList = 0x83761810
Debug session time: Thu Oct  4 00:28:17.163 2012 (UTC - 7:00)
System Uptime: 0 days 0:04:38.318
Loading Kernel Symbols
...............................................................
................................................................
...............................................
Loading User Symbols
Loading unloaded module list
.....
Unable to load image \SystemRoot\System32\Drivers\aswSP.SYS, Win32 error 0n2
*** WARNING: Unable to verify timestamp for aswSP.SYS
*** ERROR: Module load completed but symbols could not be loaded for aswSP.SYS
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {c0000005, ab90ad85, 8b9c2a14, 8b9c25f0}

Probably caused by : hardware ( aswSP+4ad85 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: ab90ad85, The address that the exception occurred at
Arg3: 8b9c2a14, Exception Record Address
Arg4: 8b9c25f0, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:
aswSP+4ad85
ab90ad85 0000            add     byte ptr [eax],al

EXCEPTION_RECORD:  8b9c2a14 -- (.exr 0xffffffff8b9c2a14)
ExceptionAddress: ab90ad85 (aswSP+0x0004ad85)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000001
   Parameter[1]: 00000000
Attempt to write to address 00000000

CONTEXT:  8b9c25f0 -- (.cxr 0xffffffff8b9c25f0)
eax=00000000 ebx=00000000 ecx=836d06e4 edx=8b9c298c esi=85aec8a0 edi=85914000
eip=ab90ad85 esp=8b9c2adc ebp=8b9c2cbc iopl=0         nv up ei pl zr na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010246
aswSP+0x4ad85:
ab90ad85 0000            add     byte ptr [eax],al          ds:0023:00000000=??
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  NULL_DEREFERENCE

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  00000001

EXCEPTION_PARAMETER2:  00000000

WRITE_ADDRESS: GetPointerFromAddress: unable to read from 83781718
Unable to read MiSystemVaType memory at 83761160
 00000000

FOLLOWUP_IP:
aswSP+4ad85
ab90ad85 0000            add     byte ptr [eax],al

BUGCHECK_STR:  0x7E

MISALIGNED_IP:
aswSP+4ad85
ab90ad85 0000            add     byte ptr [eax],al

LAST_CONTROL_TRANSFER:  from 837ba533 to ab90ad85

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
8b9c2cbc 837ba533 00000001 00000000 8b9c2ce4 aswSP+0x4ad85
8b9c2d00 8368707b a4cabcd0 00000000 856df368 nt!IopLoadUnloadDriver+0x70
8b9c2d50 83827ad1 00000001 9487270b 00000000 nt!ExpWorkerThread+0x10d
8b9c2d90 836d9239 83686f6e 00000001 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  aswSP+4ad85

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  hardware

DEBUG_FLR_IMAGE_TIMESTAMP:  0

STACK_COMMAND:  .cxr 0xffffffff8b9c25f0 ; kb

MODULE_NAME: hardware

FAILURE_BUCKET_ID:  IP_MISALIGNED_aswSP.SYS

BUCKET_ID:  IP_MISALIGNED_aswSP.SYS

Followup: MachineOwner
---------

[silverfish85]

Has anyone had a chance to look at this? Or at least give me some ideas on how I can fix this?

Thanks!

[mikaelrask]

hey and welcome to the forum.

I suggest you try a clean installation from scratch that usually solves the problem.

download the latest version of avast from avast.com

run the uninstall toll for avast reboot your system.

install the new version you downloaded.

http://www.avast.com/en-se/free-antivirus-download - link to avast program

http://www.avast.com/en-se/uninstall-utility - link to uninstall tool.

[silverfish85]

Thanks for your suppport mikaelrask. I've tried clean installations using the method you instructed many times. I always get the BSOD when the installer reaches the stage where it says Finishing Setup...

[silverfish85]

After analyzing a full memory dump and going through the drivers I had loaded, I found that I had the remnant of a tool by Symantec still installed on my system. The tool is called FixTDSS.exe and the driver is called FixTDSS.sys. After removing the driver from my machine, avast installed with no problem. Below are the steps I used to identify and fix the issue:

With memory dump loaded, used the function !vm in WnDbg to see a summary of what was loaded in memory.
I realize now I would have seen the driver running if I ran "sc query type= kernel" to get a list of all kernel drivers

To remove I ran "sc delete FixTDSS" and after reboot, deleted the driver file which was here: \SystemRoot\system32\drivers\FixTDSS.sys

[Asyn]

You could also recheck with the tool from here: http://singularlabs.com/uninstallers/security-software/