Blue Screen caused by avastsvc.exe v.2014.9.0.2018

[plsrepli]

At this point your issue could very well be caused by any of the previous suggestions (ie, old hardware, outdated drivers, mobo BIOS or chipset compatibility issues, etc) so I will just reinforce a few of the previous suggestions:

If you are running a desktop, and you don't need hibernation or fast startup, you can kill two birds with one stone by deleting your hibernation file completely. To do this, simply open an elevated command prompt and type/enter: powercfg /h off

The above will disable hibernation and automatically untick "fast startup enabled."

If for some reason, the above doesn't help and/or you decide you need both again, simply enter this message: powercfg /h on

BTW, doing the above has no affect on your rig's ability to invoke "sleep." That should still work as designed.


Good luck to you.

plsrepli

[smipx013]

Many thanks,

Problem is that I like and use hibernation every day and really want to keep it.  I like to have 0 watts when I shutdown (but retain the ability to be able to continue where I left off).

Avast was removed and the problem went away and has not happened again for a week. Wouldn't this suggest it was more likely a software or filter driver issue (i.e. Avast) rather than a hardware issue or system drive problem?  I guess that's probably too simplistic as cause and effect are not necessarily the same thing (i.e. something else might be broken and Avast is causing it to manifest itself)

Anyway - I have changed my mind - I think I was being a bit unfair to Avast and a bit impatient (as I have used avast for many years for free and been happy with it.  I just removed avira and put avast back on and I will see if I get the problems come back.  If they do I will send the information requested by support and see if we can't get to the bottom of it. 

Bottom line though - If its a choice between Avast and Hibernation then Hibernation will win for me.  I know many people don't like it but - up until now it has been fine for me and I find it very useful.

Cheers,
Paul

 
 

[smipx013]

Well,

Within 30 minutes of reinstalling Avast I got a system freeze.  Had to hard reset the machine.  No minidump and nothing in the system or application logs to suggest an issue.

The problem I have here is that support have asked for the minidump from before (now not necessarily relevant) and I have nothing to provide them from this system freeze.

I ran avira for 1 week with probably 20 or more hibernation cycles and not a single freeze or BSOD.  As soon as I put avast back on the system freezes. 

I will update my support ticket with the relevant information and let's see if it can be fixed.  The ticket is #DKB-937-93744 just in case there's an avast support person following this.

Cheers,
Paul

[smipx013]

support ticked duly updated.

[plsrepli]

Good luck with your issue. It sure sounds like it might be an Avast compatibility issue of some sort because of you testing with another AV solution; however, I hope you also provided your system specs because many are running your version of Windows without issues so there is something uniquely different about your situation. Now, it may boil down to be a software compatibility conflict (with some other resident program) that only effects Avast for some reason but you might also want to check your event viewer for time-coincident events with that freeze because not all freezes generate a BSOD. Good luck to you.

[smipx013]

Thanks for that.  Let's hope that support can pull one out of the bag.  I sure hope they don't make me wait another week before replying otherwise I might end up removing it again.  I can hold on for a few days but I can't live with it for too much longer.

I am running MBAM pro alongside.  I did have the new v2.0 of MBAM but downgraded it it to 1.75 as I thought it could be that.  I do have all the usual exclusions in avast and MBAM to not interfere with each other too.

Apart from that its fairly standard.

It's quite an old motherboard (GA-MA770-UD3 v2.0) and I was half suspecting that (as its not officially supported on Windows 8 (or 8.1)) that it would be that but I am not convinced (as you say it seems to be an avast thing as I tried Avira with no problems and I was running Windows 8.1 with the last version of Avast with no problem).  I did also recently install Windows 8.1 update 1 (spring update) which I guess could be a cause.

Cheers,
Paul

[plsrepli]

One more thing please. I noticed your Avast symptoms changed (from BSOD to freeze) after installing and then uninstalling Avira so is there any chance Avira left some remnants behind that is now affect the latter Avast installation? If you think this is a possibility, you might want to try and clean Avira out completely before attempting another Avast install. Unfortunately, I am not familiar with Avira but I do know they have a clean uninstall methodology available that includes an Avira-specific registry cleaner and maybe another Avira utility as well. Just more food for thought.

[smipx013]

Hi,

Actually I did have a mixture of freezes and BSOD's prior so I don't think its that.  I did do a full ininstall and reboot beofre putting Avast back on too.  Someting that might help other though.

I saw this while googl-ing:  http://msdn.microsoft.com/en-us/library/ff545499.aspx

I'm going to give this a go so if I get a system freeze next time I can force a BSOD  - assuming the system is not so far gone it won't work.  Ill let you know....

Cheers,
Paul

[plsrepli]

Thanks for that.  Let's hope that support can pull one out of the bag.  I sure hope they don't make me wait another week before replying otherwise I might end up removing it again.  I can hold on for a few days but I can't live with it for too much longer.

I am running MBAM pro alongside.  I did have the new v2.0 of MBAM but downgraded it it to 1.75 as I thought it could be that.  I do have all the usual exclusions in avast and MBAM to not interfere with each other too.

Apart from that its fairly standard.

It's quite an old motherboard (GA-MA770-UD3 v2.0) and I was half suspecting that (as its not officially supported on Windows 8 (or 8.1)) that it would be that but I am not convinced (as you say it seems to be an avast thing as I tried Avira with no problems and I was running Windows 8.1 with the last version of Avast with no problem).  I did also recently install Windows 8.1 update 1 (spring update) which I guess could be a cause.

Cheers,
Paul

Hi again Paul,

I have the latest version of Avast running on Windows 8.1 Update 1 without issue; however, Avast is the only AV solution running on my rig. Also, my hardware is quite new and all components are compatible with 8.1. Your issue becomes more interesting as you provide additional information. Here's hoping Avast support can logically "pull a rabbit out of a hat for you!"

[smipx013]

I hope so too.

btw.  That manual crash msdn article does work - not sure the dump it creates would be of much use though (going beyond my level of expertise here).  It creates a dump like the following - btw. I did this manually initiated crash when the system was all good and dandy so if I have a freeze and do this then maybe it will mean more. I guess the field "PROCESS_NAME" will hold the runaway process that causes the lock-up. In the case below it is coincidentally filled with "mbamservice.ex" but remember the system was working fine when I did this test - I expect mbam was just doing its thing at the time.  I will now try to bring about a real freeze........

**  Example of a forced memory dump using technique in http://msdn.microsoft.com/en-us/library/ff545499(v=vs.85).aspx **

Microsoft (R) Windows Debugger Version 6.3.9600.17029 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\052214-22484-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available


************* Symbol Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       SRV*C:\symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*C:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 8 Kernel Version 9600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 9600.17085.amd64fre.winblue_gdr.140330-1035
Machine Name:
Kernel base = 0xfffff802`81871000 PsLoadedModuleList = 0xfffff802`81b3b2d0
Debug session time: Thu May 22 16:13:39.222 2014 (UTC + 1:00)
System Uptime: 0 days 0:01:02.976
Loading Kernel Symbols
.

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

..............................................................
................................................................
...............................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck E2, {0, 0, 0, 0}

Probably caused by : Unknown_Image ( ANALYSIS_INCONCLUSIVE )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MANUALLY_INITIATED_CRASH (e2)
The user manually initiated this crash dump.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000

Debugging Details:
------------------


DUMP_FILE_ATTRIBUTES: 0x8
  Kernel Generated Triage Dump

BUGCHECK_STR:  MANUALLY_INITIATED_CRASH

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT

PROCESS_NAME:  mbamservice.ex

CURRENT_IRQL:  a

ANALYSIS_VERSION: 6.3.9600.17029 (debuggers(dbg).140219-1702) amd64fre

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff802819c4fa0

STACK_TEXT: 
ffffd001`5d7f9ea8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx


STACK_COMMAND:  kb

SYMBOL_NAME:  ANALYSIS_INCONCLUSIVE

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Unknown_Module

IMAGE_NAME:  Unknown_Image

DEBUG_FLR_IMAGE_TIMESTAMP:  0

IMAGE_VERSION: 

BUCKET_ID:  ZEROED_STACK

FAILURE_BUCKET_ID:  ZEROED_STACK

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:zeroed_stack

FAILURE_ID_HASH:  {4af92c9d-8968-8d00-06f5-868dfba32e9a}

Followup: MachineOwner

[plsrepli]

If Avast support doesn't resolve your issue and you still have the BSOD dumps available (or can generate some new ones), I would recommend you go here and seek assistance:

http://www.eightforums.com/bsod-crashes-debugging/

Follow the BSOD posting instructions which includes the need to download/run a special tool for collecting all necessary pre-analysis data. The resident Guru there is nicknamed Usasma. His real name is John Carrona and he is a Microsoft MVP who specializes in BSOD analyzation. I have watched him for years and his talents are amazing. IMHO, he has no equal in this area. Take a peek over there and you'll see what I mean.

[smipx013]

Nice one.  I will give Avast support a few days to make a start and if no joy I will go over to Usasma and post a log there.  Thanks for the tip.  Most appreciated.

Paul

[plsrepli]

Nice one.  I will give Avast support a few days to make a start and if no joy I will go over to Usasma and post a log there.  Thanks for the tip.  Most appreciated.

Paul

Sounds like a plan to me. Here is a link to Usasma's website just in case you are interested in how he approaches BSOD analyzation in general.

http://www.carrona.org/howidoit.html

He takes many things into consideration and I believe he has automated much of this process (but not all). BTW, if you decide to go over there, tell John that "my2cents" said hello! I am also registered over there (as my2cents) and have worked through many Win 8 issues as well:

http://www.eightforums.com/member.php?u=28534

However, when it comes to BSODs, John is the man!