BlueScreen on WinXP with avast

[Thrash]

Hi.

I installed avast Home Edition for free yesterday and licensed it .... normal way.

Yesterday night all was ok.
Now this morning I had boot my pc and starts Thunderbird and was surfing the web with Firefox and than I got a BlueScreen. Whole PC freeze!
I had to press the restart button.

This appears 3 or 4 times in a few minutes.

And at every crash I had Thunderbird started.
Now I don´t know where the problem is.

I also sent an Info Mail to the Tec Support.
Here are the detalled infos from the Blue Screens:

I was surfing with Mozilla Firefox (1.0.6) and my Email Client
Thunderbird (1.0.6) and Winamp (the lates Version 5.xx) was started.

And then I got a Bluescreen with this information:
- DRIVER_IRQL_NOT_LESS_OR_EQUAL
STOP: 0x000000D1 (0x6D6F632E, 0x00000002, 0x00000000, 0xF09ECB1B)
aswTdi.sys  Adress: F09ECB1B base of F09EA000, DateStamp 42Cf9755

- Then I reboot and a short time later I got this failure:
Driver_Corrupted_MMPool
STOP: 0x000000D0 (0x74616568, 0x00000002, 0x00000001, 0x80549318)

- DRIVER_IRQL_NOT_LESS_OR_EQUAL
STOP: 0x000000D1 (0xFED3E000, 0x00000002, 0x00000001, 0xB0BA2075)
Mailfilt.dll Adress B0BA2075 base at BOBA0000, DateStamp 42a00be3


After the 2nd BlueScreen I add the Mozilla Thunderbird Profile Directory to the exclude list. So that this directory will never be scanned. This Profile-Directory is under: C:\Dokumente und Einstellungen\Ulf\Anwendungsdaten\Thunderbird\Profiles\xxxxxxxx.default
But this doesn´t helped enough, because I got this 3rd BlueScreen.

My Software installed:
- Windows XP Version 5.1 (Build 2600.xpsp_sp2_gdr.050301-1519: Service
Pack 2)
- Avast Antivirus Home Edition Ver. 4.6 Home Edition Build:
Jul2005(4.6.691), registered; last installed update: VPS File from 02.08.05 and Ver 0531-1
- Thunderbird Email Client Ver. 1.0.6 with some extensions (for
example: Enigmail 0.92)
- Firefox Ver. 1.0.6 with a few tabs opened (-> more memory usage).
- Agnitum Outpost Firewall Pro Ver. 2.7.485.5401 (412)


I hope you´ll find the problem. I think it´s something with Thunderbird. At the moment I don´t start Thunderbird and I have no problem!

Thanks!

Greets from Germany


Ps.:
I hope this problem will be solved, I am glat that there is a free version available, but when I can´t check emails I maybe have to deinstall it or have to deactivate it!?
Maybe it is a help for now to deactivate the Internet-Mail Provider. I have paused it at the moment.
If this produce a BlueScreen anyway I can report it here.

[troubleshooting]

Restart the computer before XP loads,while loading(u see a while bar,that time)Goto to safe mode (press F8 key)But u must be admin user or with admin rights to log on,after u log on goto add/remove program and remove avast..

And if there is prob with thunderbird..remove that too...i mean clear all the files and folder of thunderbird..  especially check in documents & setting /ur user name /application data/thunderbird.Delete this too.

After that install avast 1st and installed thunder bird..and see if it's ok now.

Did u install any hadware devices?while avast was there,just asking.

[Vlk]

Can you please send me the contents of your \windows\minidump folder?
By email, please (address is in my profile).

Thanks
Vlk

[Thrash]

Thanks for the fast help!

I have sent you the dump-Files.
It take some minutes to try how I can send you something without producing a bluescreen.
But with offline mode and only(!) send emails it works.

That means, that a Bluescreen not appear by sending and not by connecting to email office (I try it) windows only show a bluescreen when a email is downloading.

after deinstallation of avast it is not fixed.
the problem is already there and I also deactivate the attachment-filter-plug-in from outpost firewall pro 2.7.
But it doesn´t help. My idea: There is maybe a file which was edited or changed by avast and this is the problem ... maybe!?


@troubleshooting
Thanks for the help, but deleting the whole profile directory is a very bad idea!
There are my whole emails ... I have backed it up, but I have already installed thunderbird again (after deinstalling it first) but this doesn´t fix the problem.
But I don´t have delete the profile folder or a part of it.
But (I have some problems with TB and enigmail yesterday and a few month ago, so I know thunderbird) in the profile-directory are only the emails, a few files for settings and alle important files from the extensions and themes.
No important program parts are stored there.


I hope you´ll find the problem.
I think avast is a good program and is good to handle, really!

If I have the time and if I would have a other computer here I think I would do some beta tests.

greets from germany


[edit]
@vlk
I have sent the email with the dump files to Lukas Rypacek, he wrote me an email. I think it was a answer of my message to the Tec Support.

[Lisandro]

The problem is already there and I also deactivate the attachment-filter-plug-in from outpost firewall pro 2.7.

You have the same configuration as me and I have not a conflict between avast!, email programs and the firewall.
Hope the dump files could solve the problem. If you want another kind of help, just ask here in forums 

[Thrash]

Thanks for the help!

Which Outpost Version do you have installed?
I have the 2.7.485.5401 (412) installed and now want to install the latest one: 2.7.492(416).

I have read at the outpost forum, that some other with Virus Programs has Problems after installing Outpost (the other way, but the same constellation).
One wrote that it fixed the problem when you put all virus programm parts to the allowed "hidden processes" in the outpost.

I maybe will try that later.
But I don´t know why the problem already exist after deinstalling avast.

Do you use Mozilla Thunderbird 1.0.6?

I will try again and report later.
Thanks!

[Lisandro]

In fact, it's the computer of a friend of mine... I'll ask him about the versions.
I suppose the last ones from both avast! and Outpost.
Yes, he uses OE, MS Outlook and Thunderbird without problem.
Did you block any process into Outpost? If you disable it, will avast! work?

[lukor]

@vlk
I have sent the email with the dump files to Lukas Rypacek, he wrote me an email. I think it was a answer of my message to the Tec Support.

I can confirm that 


Anyway, just to calm down our avast users a bit: in this particular case it seems the error appears even with avast uninstalled - so despite the fact we are hunting for the cause of this error with Trash, I must incline to the hypothesis that this is crash is not originating from the now uninstalled copy of avast!

[Thrash]

So I´m back again!
I have my beer ... and I send the dump files when I was leaving the pc at 23h ... and when I come back at 00:45 I saw the message that the email is to large to send it.
The server only want 20mb.

But the 100MB(!) dump file (compressed as rar-file to 18mb ... whou! ) is with the email round about 20mb ... to big.

So I now make two parts and send it at the moment.


I don´t know what the problem is.
But it was released definitely by avast. I don´t have this problems before.

And there was this suspicous email from a metalzine from the internet with very(!) much recipients. Round about 100 I think.
Maybe there is the problem?
That there is anywhere something like a bufferoverflow in avast or outpost pro or both or in Thunderbird ... !?

[Thrash]

Look here:
http://forums.mozillazine.org/viewtopic.php?t=296841&highlight=thunderbird+recipients+problem

Maybe the problem is also by thunderbird when there is a email with to many recipients? But I won´t send one, I only have to receive one.

@lukor
Do you need more dump files or can I do a little test?
I want to delete the message with this much recipients from the server (online) and than I will try if the download work.

And a other question to you avast tech guys!
Is there a function in avast that emails with to many recipients (anyway if sending or receive) is not transmitte?
Maybe there is the problems connection to avast?
And maybe also to outpost?

greets

[Lisandro]

Is there a function in avast that emails with to many recipients (anyway if sending or receive) is not transmitte?

Yes, see Heuristic tabs of settings of both Internet Mail provider and MS Outlook pluggin.

[lukor]

Maybe the problem is also by thunderbird when there is a email with to many recipients? But I won´t send one, I only have to receive one.

I will have more info when I'll look at the dump, but I must repeat:

No avast code is executed when avast is NOT installed. And as far as I know avast does not modify any files or settings on the PC that would prevail after the deinstallation.

Yes it might be the very specific mail you have in your mailbox and the outpost MAIL Filter driver, that is STILL INSTALLED, that is causing the problem. Please, do not delete the mail - instead try to save it in its raw form. Perhaps it could be reproduced on other computers as well - with this one mail! So, perhaps at least forwarding to someone else would be a good way to store it.

Have you enabled the verifier as I've suggested? I think we will continue via emails.

Bye for now.
Lukas.

[Thrash]

Yes I have enabled the verifier and sent you the dump file.
But I have deactivate it now how you suggest.

I try to save the email. I can also forward it to you if you want it? The message itself is not interested I think.

If there would be a good way to count the recipients I would do it, but I think there is no. I thinks it´s maybe up to over 100 recipients.

And yes I agress with you that avast is not execute any program or drivers because it´s deinstalled. But avast maybe "helped" to produce the problem the first time.
But I think the problem itself is either by outpost pro 2.7 or by thunderbird 1.0.6

I have report this bug at bugzilla, too: https://bugzilla.mozilla.org/show_bug.cgi?id=303320

And now I try to save this email (if you want it, too you can write me) and than I will delete it to show if that´s the problems source.


@Tech
Thanks. I don´t use Outlook anymore.

If there is also a avast program part which is dependent on the recipients count of the email or the deliverances of the email with many recipients than avast maybe is to change in that case. Such emails maybe produce a bufferoverflow in the system and it´s maybe a bug.



But for all that I think avast is a nice and good program. I see it and I test it and I think it´s a good program!
And thanks for all help and analyzing the problem!


I already wrote it to lukor that I really know that it´s not absolute normal that there is so a good help and support.
I think I will make the name avast for a good memory ...
And I will try it again after save the email (of death ) on a secure place.


Greets!


Ps.:
a other question.
In which language avast is programmed? I think not in Java ...
In c++ or c# ...!? Using the .NET Framework?

[Lisandro]

If there is also a avast program part which is dependent on the recipients count of the email or the deliverances of the email with many recipients than avast maybe is to change in that case. Such emails maybe produce a bufferoverflow in the system and it´s maybe a bug.

Yeah, but remember that the bug could not be directly related to avast! but a 3rd party driver. For instance, PrevX could 'detect' right and wrong buffer overflows and crash the system. Sometimes, I'll say you, is not the antivirus fault but a legit action that other application misunderstand and crash.

[Thrash]

Ok I understand what you mean.
That the failure maybe is not in handling the email in avast itself, it´s more a problem produced in a driver while avast using this driver ... but it´s not absolute a avast driver!


You don´t know in which language avast is programming?
This would be interesting for me ... because I also programs, but more Java ...