Author Topic: Avast sandbox BSOD  (Read 2060 times)

0 Members and 1 Guest are viewing this topic.

REDACTED

  • Guest
Avast sandbox BSOD
« on: May 04, 2018, 01:20:00 PM »
I'm a developer working in Python, which often causes Avast's 15 second sandbox (free version) to scan some of my package entrypoints. An entrypoint is an .exe file python/setuptools creates to enable users to start a specific script from the commandline. This is normally ok, and can be canceled when I know I trust it, but there is a special case that causes the sandbox to BSOD Windows: If the entry point calls Python's standard library functions for opening a browser to a specific URL (in a new thread), then a new tab will be opened in my already open instance of Firefox. Upon completion (or close to completion) of the sandbox scan, a blue screen will appear, and the OS will restart.

The python code in question:
Code: [Select]
import webbrowser
import threading

browser = webbrowser.get()

def launch_browser():
    browser.open(url, new=2)

threading.Thread(target=launch_browser).start()

I can submit a minidump, but an initial analysis says that it is firefox.exe that is the failing process, but aswSnx.sys is also involved. EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

REDACTED

  • Guest
Re: Avast sandbox BSOD
« Reply #1 on: May 04, 2018, 01:21:42 PM »
Other relevant info:
Windows version: 10.0.16299.371 (WinBuild.160101.0800)
Avast version: 18.3.3860.316
Firefox version: 59.0.3

REDACTED

  • Guest
Re: Avast sandbox BSOD
« Reply #2 on: May 04, 2018, 01:25:30 PM »
And to be clear: If I am able to cancel the sandbox scan before the browser url is launched, the BSOD is avoided.

Offline Asyn

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 76037
    • >>>  Avast Forum - Deutschsprachiger Bereich  <<<
Re: Avast sandbox BSOD
« Reply #3 on: May 04, 2018, 01:36:51 PM »
W8.1 [x64] - Avast Free AV 23.3.8047.BC [UI.757] - Firefox ESR 102.9 [NS/uBO/PB] - Thunderbird 102.9.1
Avast-Tools: Secure Browser 109.0 - Cleanup 23.1 - SecureLine 5.18 - DriverUpdater 23.1 - CCleaner 6.01
Avast Wissenswertes (Downloads, Anleitungen & Infos): https://forum.avast.com/index.php?topic=60523.0

Offline Alikhan

  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 2220
Re: Avast sandbox BSOD
« Reply #4 on: May 04, 2018, 01:39:55 PM »
This sounds it is DeepScreen that is causing the issue. You'll need to upload a dump before I can get this escalated to an Avast dev.

You can follow Asyn link to get your files whitelisted so DeepScreen will not scan your entrypoints.
Windows 10 Home 64-bit • Avast Free (latest stable version) •  Malwarebytes 4 Premium (On-Demand) • Windows Firewall Control • Google Chrome • LastPass • CCleaner • O&O ShutUp10 •

REDACTED

  • Guest
Re: Avast sandbox BSOD
« Reply #5 on: May 04, 2018, 03:11:56 PM »
This sounds it is DeepScreen that is causing the issue. You'll need to upload a dump before I can get this escalated to an Avast dev.

What are the routines for uploading the dump? I've seen ftp://ftp.avast.com/incoming/ around in search results before, but I'm not sure what the usage pattern is (filename, how to tie back to discussion here, etc).

Offline Asyn

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 76037
    • >>>  Avast Forum - Deutschsprachiger Bereich  <<<
Re: Avast sandbox BSOD
« Reply #6 on: May 04, 2018, 03:15:38 PM »
What are the routines for uploading the dump? I've seen ftp://ftp.avast.com/incoming/ around in search results before, but I'm not sure what the usage pattern is (filename, how to tie back to discussion here, etc).
Pick a unique name (and post it here), so the devs can find it. Thanks
W8.1 [x64] - Avast Free AV 23.3.8047.BC [UI.757] - Firefox ESR 102.9 [NS/uBO/PB] - Thunderbird 102.9.1
Avast-Tools: Secure Browser 109.0 - Cleanup 23.1 - SecureLine 5.18 - DriverUpdater 23.1 - CCleaner 6.01
Avast Wissenswertes (Downloads, Anleitungen & Infos): https://forum.avast.com/index.php?topic=60523.0

REDACTED

  • Guest
Re: Avast sandbox BSOD
« Reply #7 on: May 04, 2018, 03:37:22 PM »
I uploaded the file according to this guide: https://support.avast.com/en-eu/article/FTP-file-upload
I followed its recommendation of using my email as the filename (but I'd prefer to not post that openly). Hopefully the devs can see my email from my forum profile?

Offline Asyn

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 76037
    • >>>  Avast Forum - Deutschsprachiger Bereich  <<<
Re: Avast sandbox BSOD
« Reply #8 on: May 04, 2018, 03:53:41 PM »
Hopefully the devs can see my email from my forum profile?
Sure.
W8.1 [x64] - Avast Free AV 23.3.8047.BC [UI.757] - Firefox ESR 102.9 [NS/uBO/PB] - Thunderbird 102.9.1
Avast-Tools: Secure Browser 109.0 - Cleanup 23.1 - SecureLine 5.18 - DriverUpdater 23.1 - CCleaner 6.01
Avast Wissenswertes (Downloads, Anleitungen & Infos): https://forum.avast.com/index.php?topic=60523.0

Offline Spec8472

  • Avast team
  • Sr. Member
  • *
  • Posts: 297
Re: Avast sandbox BSOD
« Reply #9 on: May 04, 2018, 06:15:08 PM »
Hi Aboratt, the issue is already fixed internally, thank you for reporting.