« previous next »
Pages: [1] 2   Go Down

Author Topic: BSOD at every shutdown  (Read 9548 times)

0 Members and 1 Guest are viewing this topic.

REDACTED

  • Guest
BSOD at every shutdown
« on: March 26, 2015, 09:04:26 AM »
Hi,

almost everytime i shutdown my computer i get bsod as follow:

032615-10654-01.dmp   25/03/2015 19:21:22   SYSTEM_THREAD_EXCEPTION_NOT_HANDLED   0x1000007e   ffffffff`c0000005   fffff880`01077402   fffff880`084f7788   fffff880`084f6fe0   aswMonFlt.sys   aswMonFlt.sys+3873   avast! File System Minifilter for Windows 2003/Vista   Avast Antivirus   Avast Software s.r.o.   10.2.2215.880   x64   fltmgr.sys+d402               C:\Windows\Minidump\032615-10654-01.dmp   8   15   7601   292.440   26/03/2015 08:51:42   

any ideas?

thanks
Logged

Offline CSEngineer

  • Newbie
  • *
  • Posts: 6
Re: BSOD at every shutdown
« Reply #1 on: March 29, 2015, 04:42:22 AM »
I have a similar problem, but I've pinned it down so I can reproduce it about 80% of the time.  Windows 8.1 gives a BSOD consistently when I dismount a TrueCrypt file container.  Also happens much more infrequent when I remove a USB flashdrive.  Started having this problem after the latest Avast update, never had it with previous versions.  Debug follows:

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff802ca74d596, The address that the exception occurred at
Arg3: ffffd00194f36978, Exception Record Address
Arg4: ffffd00194f36180, Context Record Address

Debugging Details:
------------------


DUMP_FILE_ATTRIBUTES: 0x8
  Kernel Generated Triage Dump

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!ExfReleaseRundownProtection+6
fffff802`ca74d596 488b09          mov     rcx,qword ptr [rcx]

EXCEPTION_RECORD:  ffffd00194f36978 -- (.exr 0xffffd00194f36978)
ExceptionAddress: fffff802ca74d596 (nt!ExfReleaseRundownProtection+0x0000000000000006)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 0000000000000008
Attempt to read from address 0000000000000008

CONTEXT:  ffffd00194f36180 -- (.cxr 0xffffd00194f36180;r)
rax=00000000c0000022 rbx=0000000000000007 rcx=0000000000000008
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000001
rip=fffff802ca74d596 rsp=ffffd00194f36bb8 rbp=ffffc00160db2be0
 r8=0000000000000008  r9=ffffd00194f36a40 r10=fffff802ca95ae80
r11=ffffd00194f36b00 r12=ffffe0012069c000 r13=0000000000000000
r14=ffffc0015290cbe0 r15=ffffe0012062dcf0
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0000  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
nt!ExfReleaseRundownProtection+0x6:
fffff802`ca74d596 488b09          mov     rcx,qword ptr [rcx] ds:002b:00000000`00000008=????????????????
Last set context:
rax=00000000c0000022 rbx=0000000000000007 rcx=0000000000000008
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000001
rip=fffff802ca74d596 rsp=ffffd00194f36bb8 rbp=ffffc00160db2be0
 r8=0000000000000008  r9=ffffd00194f36a40 r10=fffff802ca95ae80
r11=ffffd00194f36b00 r12=ffffe0012069c000 r13=0000000000000000
r14=ffffc0015290cbe0 r15=ffffe0012062dcf0
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0000  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
nt!ExfReleaseRundownProtection+0x6:
fffff802`ca74d596 488b09          mov     rcx,qword ptr [rcx] ds:002b:00000000`00000008=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000000000008

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff802ca9d5138
unable to get nt!MmNonPagedPoolStart
unable to get nt!MmSizeOfNonPagedPoolInBytes
 0000000000000008 

FOLLOWUP_IP: 
aswMonFlt+60e6
fffff801`00ba60e6 ??              ???

BUGCHECK_STR:  AV

DEFAULT_BUCKET_ID:  NULL_CLASS_PTR_DEREFERENCE

ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) amd64fre

LAST_CONTROL_TRANSFER:  from fffff80100ba60e6 to fffff802ca74d596

STACK_TEXT:  
ffffd001`94f36bb8 fffff801`00ba60e6 : 00000000`00000001 fffff801`00bac830 00000000`a8d683c3 00000000`00001b8d : nt!ExfReleaseRundownProtection+0x6
ffffd001`94f36bc0 00000000`00000001 : fffff801`00bac830 00000000`a8d683c3 00000000`00001b8d ffffd001`94f36c68 : aswMonFlt+0x60e6
ffffd001`94f36bc8 fffff801`00bac830 : 00000000`a8d683c3 00000000`00001b8d ffffd001`94f36c68 ffffd001`94f36ca0 : 0x1
ffffd001`94f36bd0 00000000`a8d683c3 : 00000000`00001b8d ffffd001`94f36c68 ffffd001`94f36ca0 00000000`00000000 : aswMonFlt+0xc830
ffffd001`94f36bd8 00000000`00001b8d : ffffd001`94f36c68 ffffd001`94f36ca0 00000000`00000000 00000000`00000000 : 0xa8d683c3
ffffd001`94f36be0 ffffd001`94f36c68 : ffffd001`94f36ca0 00000000`00000000 00000000`00000000 ffffe001`00000007 : 0x1b8d
ffffd001`94f36be8 ffffd001`94f36ca0 : 00000000`00000000 00000000`00000000 ffffe001`00000007 ffffd001`00000001 : 0xffffd001`94f36c68
ffffd001`94f36bf0 00000000`00000000 : 00000000`00000000 ffffe001`00000007 ffffd001`00000001 ffffe001`00000020 : 0xffffd001`94f36ca0


SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  aswMonFlt+60e6

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: aswMonFlt

IMAGE_NAME:  aswMonFlt.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  54f45429

STACK_COMMAND:  .cxr 0xffffd00194f36180 ; kb

FAILURE_BUCKET_ID:  AV_aswMonFlt+60e6

BUCKET_ID:  AV_aswMonFlt+60e6

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:av_aswmonflt+60e6

FAILURE_ID_HASH:  {b2b6d12b-9d74-103e-1256-3bd74dcb76c3}

Followup: MachineOwner
---------

0: kd> lmvm aswMonFlt
start             end                 module name
fffff801`00ba0000 fffff801`00bc3000   aswMonFlt T (no symbols)           
    Loaded symbol image file: aswMonFlt.sys
    Image path: aswMonFlt.sys
    Image name: aswMonFlt.sys
    Timestamp:        Mon Mar 02 06:14:33 2015 (54F45429)
    CheckSum:         0001FE48
    ImageSize:        00023000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
Logged

Offline Rednose

  • Pirate Party Member
  • Avast Überevangelist
  • Massive Poster
  • *****
  • Posts: 3739
  • Bits of Freedom : https://www.bof.nl
    • Nederlandstalig Avast! forum
Re: BSOD at every shutdown
« Reply #2 on: March 29, 2015, 05:24:45 AM »
Hi guys :)

Can you please follow this procedure : https://www.avast.com/en-eu/faq.php?article=AVKB33#idt_01

- In step 5 select "Full dumps",.
- Don't make a ticket, but post the Support Package File ID in your next reply.

Greetz, Red.


EDIT : Modified procedure.
« Last Edit: April 03, 2015, 02:01:36 PM by Rednose »
Logged
OS: Win 10 / iOS 17 / Debian 12 / Tails 5
Real Time: Avast Premium Security
On Demand: Malwarebytes
VPN: NordVPN ( NordLynx ) with Threat Protection ( Lite )

Offline Eddy

  • Avast Evangelist
  • Maybe Bot
  • ***
  • Posts: 31079
  • Watching (over?) you
    • Malware removal, Biljart and other things.
Re: BSOD at every shutdown
« Reply #3 on: March 29, 2015, 10:30:02 AM »
There are several issues know after upgrading to the latest version.
Many are solved when you do a clean installation.
Logged

Offline CSEngineer

  • Newbie
  • *
  • Posts: 6
Re: BSOD at every shutdown
« Reply #4 on: March 30, 2015, 06:14:05 AM »
Reinstall was no help.

I submitted a ticket and a "full dump" as suggested to Avast.  I'll update when I get a response.
Logged

REDACTED

  • Guest
Re: BSOD at every shutdown
« Reply #5 on: March 31, 2015, 09:56:52 AM »
Hello and greetings!

I have the same problems: Bluescreens / BSOD on shutdown, SYSTEM_THREAD_EXCEPTION_NOT_HANDLED
With WinDbg it can be traced down to aswMonFlt.sys. I also use TrueCrypt.

Also same as with CSEngineer: nt!ExfReleaseRundownProtection+0x7  ???

Are there any news to this topic?
Logged

Offline Asyn

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 76037
    • >>> Avast Forum - Deutschsprachiger Bereich <<<
Re: BSOD at every shutdown
« Reply #6 on: March 31, 2015, 10:58:43 AM »
See: Reply #2
Logged
W8.1 [x64] - Avast Free AV 23.3.8047.BC [UI.757] - Firefox ESR 102.9 [NS/uBO/PB] - Thunderbird 102.9.1
Avast-Tools: Secure Browser 109.0 - Cleanup 23.1 - SecureLine 5.18 - DriverUpdater 23.1 - CCleaner 6.01
Avast Wissenswertes (Downloads, Anleitungen & Infos): https://forum.avast.com/index.php?topic=60523.0

Offline Endt

  • Avast team
  • Full Member
  • *
  • Posts: 141
Re: BSOD at every shutdown
« Reply #7 on: March 31, 2015, 11:15:54 AM »
Hello CSEngineer,

We got your support package and we will have a closer look on your issue.

Thanks,
B.
Logged

Offline Endt

  • Avast team
  • Full Member
  • *
  • Posts: 141
Re: BSOD at every shutdown
« Reply #8 on: March 31, 2015, 12:31:01 PM »
Hi all,

thanks for the report. The problem with Truecrypt and generally with aswMonFlt.sys is issued now, we should be able to fix it in next SP the latest.

Cheers,
B.
Logged

Offline bob3160

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 48567
  • 64 Years of Happiness
    • bob3160 Protecting Yourself, Your Computer and, Your Identity
Re: BSOD at every shutdown
« Reply #9 on: March 31, 2015, 01:37:42 PM »
Quote from: Endt on March 31, 2015, 12:31:01 PM
Hi all,

thanks for the report. The problem with Truecrypt and generally with aswMonFlt.sys is issued now, we should be able to fix it in next SP the latest.

Cheers,
B.
Any expected release date for that next Service Pack ???
Logged
Free Security Seminar: https://bit.ly/bobg2023  -  Important: http://www.organdonor.gov/ -- My Web Site: http://bob3160.strikingly.com/ - Win 11 Pro v22H2 64bit, 16 Gig Ram, 1TB SSD, Avast Free 23.5.6066, How to Successfully Install Avast http://goo.gl/VLXde -  Repair & Clean Install https://goo.gl/t7aJGq -- My Online Activity https://bit.ly/BobGInternet

REDACTED

  • Guest
Re: BSOD at every shutdown
« Reply #10 on: March 31, 2015, 04:46:06 PM »
I also uploaded a "full dump". Hope this helps.  :)

But as every shutdown has a chance of loosing data from disk ( I already lost some files - dont know what damage is done without notice... )
I have the same question as bob3160:

When is the Service Pack scheduled?
« Last Edit: March 31, 2015, 04:49:59 PM by TheMidgeG »
Logged

Offline Endt

  • Avast team
  • Full Member
  • *
  • Posts: 141
Re: BSOD at every shutdown
« Reply #11 on: March 31, 2015, 06:04:12 PM »
Hello and thanks,

next time, you don't have to make a ticket at support but post the package id here (you have to tick the option to send it to avast), also in your package is MEMOMRY.dmp missing (it's logical when it has only 14MB - maybe your windows are not configured to create full dumps). And the last thing, if it's about the same issue it isn't necessary to upload GBs of data ;-)

Again thanks for your report,
B.
Logged

REDACTED

  • Guest
Re: BSOD at every shutdown
« Reply #12 on: March 31, 2015, 08:15:30 PM »
Hello,

so the "full dump" was just a dump.  Let me know if it helps to create and send a MEMOMRY.dmp. 
Regarding the size, it might be a bit tricky to upload - and take lots of time and traffic here...

Have a nice day.  :)

Logged

REDACTED

  • Guest
Re: BSOD at every shutdown
« Reply #13 on: April 03, 2015, 01:22:55 PM »
Having the same problem.....any due date for the next service pack available/estimated?  :-\
Logged

Offline Rednose

  • Pirate Party Member
  • Avast Überevangelist
  • Massive Poster
  • *****
  • Posts: 3739
  • Bits of Freedom : https://www.bof.nl
    • Nederlandstalig Avast! forum
Re: BSOD at every shutdown
« Reply #14 on: April 03, 2015, 02:04:43 PM »
Quote from: JoergO on April 03, 2015, 01:22:55 PM
Having the same problem.....any due date for the next service pack available/estimated?  :-\

Hi JoergO, welcome to the forum :)

You are using TrueCript ? I that case you have nothing to do.
If you are not using TrueCript, follow the procedure from Reply #2, and start a new topic.

We don't know anything about the next service pack yet.

Greetz, Red.

Logged
OS: Win 10 / iOS 17 / Debian 12 / Tails 5
Real Time: Avast Premium Security
On Demand: Malwarebytes
VPN: NordVPN ( NordLynx ) with Threat Protection ( Lite )
Pages: [1] 2   Go Up
« previous next »