avast4 collide with ext2ifs

[abcxyz]

The patch worked nice for the BSOD, but I still have a minor issue remaining:
I have multiple ext2/3 partitions and not all of them are mapped to a drive by Ext2IFS (for example: my linux /boot partition remains hidden).
But now, whenever I reboot my system, all my ext2/3 partitions are mapped automatically...
I can remove them manually in the Ext2IFS tool once I'm logged in, but they are mapped again to a drive next time I boot.

Uninstalling Avast stops this behaviour.

Any ideas?

[Vlk]

Hmm.

With all respect, I don't see a way how this could be caused by avast.
The BSOD was indeed caused by an interesting bug in aswSP.sys, but this sounds like a completely unrelated problem.

Maybe you could try to get in touch with the ext2fsd author and ask him about his opinion?


Thanks
Vlk

[nvb]

I can remove them manually in the Ext2IFS tool once I'm logged in, but they are mapped again to a drive next time I boot.

You have updated the IFS-driver to 1.11?
I have the same Problems since i had updated to this release, the author of it will fix this in another minor-release.

[abcxyz]

Thanks! It looks like I only have the problem when both Avast and IFS-driver v1.11 are installed.
Downgrading IFS-driver to version v1.10c solves it for me!

[Noishe]

Any chance of getting the details of this bug? I'm always interested in windows internals, if you could post the logic error that was producing the bug, I'd appriciate that.

Thanks

[Vlk]

More or less, it was like this:

One of the NT API calls (I think it was ZwQueryInformationProcess), when called on a file that was residing on an ext2fs volume, returns a UNICODE_STRING that had all its fields (Size, MaximumSize and Buffer set to zero/NULL) while the function still returned STATUS_SUCCESS.

In aswSP.sys, in case of returned STATUS_SUCCESS, we were touching the Buffer pointer value without first checking the Size field.

Bang....! 

[David R]

I'm kind of wondering what the status of this bug is.

Had BSOD hit me on Oct 16, while it was related to Avast and Ext2IFS (1.10c), the system would only crash during particular Windows XP updates.  I guess I shouldn't have allowed the updates, cause I didn't have any trouble before.  Took awhile to figure out as I had to come up to speed on reading minidumps.  Then search the internet for aswsp.sys references.

Intial events didn't go well for me as the restore points were currupted at the disk level, clearing all my history.  Then found many windows applications didn't work when the system came back (truncated this's and that's).  Did a Window's repair install.  Then preceeded to reload individual updates skipping updates that crashed the system.  I include them here for the benefit of others searching the internet. 

Not in any particular order, KB935448, KB890830, KB922582, KB900725, KB913580, KB951066,
KB954211, KB950974, KB952954, and the best for last WMP11

My personel workaround was to unload the Ext2IFS driver then the remaining updates installed without a problem.

I guess I'm wondering was there an issue with the Ext2IFS driver and will Avast's daily updates look after the patch for me?  Also if my system seemed quite happy until I did some updates (I think there was 17 outstanding), what was it that the updates did that provoked Avast and Ext2IFS to collide?

David R