Author Topic: aswSP.SYS causing fatal system error, automatic restart loop  (Read 4822 times)

0 Members and 1 Guest are viewing this topic.

Noishe

  • Guest
aswSP.SYS causing fatal system error, automatic restart loop
« on: October 17, 2008, 05:02:36 PM »
aswSP.SYS is consistently causing an error which results in an automatic reboot. Inorder to stop it, I need to do a system restore to the 13th. Windows Debugging tools indicates the following error. I've attached some of the the mini dump files so that you can load them in your debugger and hopefully find the location of the fault in your source code. They've been renamed from *.dmp to *.txt since your bulleten board is disallowing dmp files to be attached. Which is really stupid and irritating, for the record.

If you need full dump files instead of mini dump files, tell me. I've told windows to use full dumps from now on. Soon as something in your program updates, I have no idea what, it will start rebooting again and I'll have to do another system restore.

Date Progression:
13th, everything works.

15th, lots of restarts, starts in the middle of the night. Possibly due to windows automatic update updating something and now there's an incompatability somewhere. do a system restore to 13th.

16th, everything fine.

17th, same as 15th.


On both the 15th and 17th, at 3:00 in the morning, which is when my automatic updates happen, crashes started happening. System restore starts going nuts and creates a restore point for every restart with the name "Software Distribution Service 3.0"

I'm running service pack 2. As of right now, windows update center indicates I have these updates available,

Code: [Select]
Windows Malicious Software Removal Tool - October 2008 (KB890830)
Download size: 0 KB , 0 minutes  (Downloaded; ready to install) 
After the download, this tool runs one time to check your computer for infection by specific, prevalent malicious software (including Blaster, Sasser, and Mydoom) and helps remove any infection that is found. If an infection is found, the tool will display a status report the next time that you start your computer. A new version of the tool will be offered every month. If you want to manually run the tool on your computer, you can download a copy from the Microsoft Download Center, or you can run an online version from microsoft.com. This tool is not a replacement for an antivirus product. To help protect your computer, you should use an antivirus product.  Details...
Don't show this update again
 
Security Update for Windows XP (KB954211)
Download size: 0 KB , 0 minutes  (Downloaded; ready to install) 
A security issue has been identified that could allow an authenticated local attacker to compromise your Microsoft Windows-based system and gain control over it. You can help protect your computer by installing this update from Microsoft. After you install this item, you may have to restart your computer.  Details...
Don't show this update again
 
Cumulative Security Update for ActiveX Killbits for Windows XP (KB956391)
Download size: 0 KB , 0 minutes  (Downloaded; ready to install) 
Security issues have been identified in ActiveX controls that could allow an attacker to compromise a system that is running Microsoft Internet Explorer and gain control over it. You can help protect your computer by installing this update from Microsoft. After you install this item, you may have to restart your computer.  Details...
Don't show this update again
 
Security Update for Windows XP (KB956803)
Download size: 0 KB , 0 minutes  (Downloaded; ready to install) 
A security issue has been identified that could allow an authenticated local attacker to compromise your Microsoft Windows-based system and gain control over it. You can help protect your computer by installing this update from Microsoft. After you install this item, you may have to restart your computer.  Details...
Don't show this update again
 
Security Update for Windows XP (KB956841)
Download size: 0 KB , 0 minutes  (Downloaded; ready to install) 
A security issue has been identified that could allow an authenticated local attacker to compromise your Microsoft Windows-based system and gain control over it. You can help protect your computer by installing this update from Microsoft. After you install this item, you may have to restart your computer.  Details...
Don't show this update again
 
Security Update for Windows XP (KB957095)
Download size: 0 KB , 0 minutes  (Downloaded; ready to install) 
A security issue has been identified that could allow an authenticated remote attacker to compromise your Microsoft Windows-based system and gain control over it. You can help protect your computer by installing this update from Microsoft. After you install this item, you may have to restart your computer.  Details...
Don't show this update again
 
Cumulative Security Update for Internet Explorer 7 for Windows XP (KB956390)
Download size: 0 KB , 0 minutes  (Downloaded; ready to install) 
Security issues have been identified that could allow an attacker to compromise a system that is running Microsoft Internet Explorer and gain control over it. You can help protect your system by installing this update from Microsoft. After you install this item, you may have to restart your computer.  Details...
Don't show this update again
 
Windows Genuine Advantage Notification (KB905474)

Here's the bug check analysis from the windwos debugging tools

Code: [Select]
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BAD_POOL_CALLER (c2)
The current thread is making a bad pool request.  Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 00000007, Attempt to free pool which was already freed
Arg2: 00000cd4, (reserved)
Arg3: 04030202, Memory contents of the pool block
Arg4: e33619d0, Address of the block of pool being deallocated

Debugging Details:
------------------
POOL_ADDRESS:  e33619d0
FREED_POOL_TAG:  pSsA
BUGCHECK_STR:  0xc2_7_pSsA
CUSTOMER_CRASH_COUNT:  45
DEFAULT_BUCKET_ID:  COMMON_SYSTEM_FAULT
PROCESS_NAME:  mrtstub.exe
LAST_CONTROL_TRANSFER:  from 80544086 to 804f8c3f
STACK_TEXT: 
acd22b68 80544086 000000c2 00000007 00000cd4 nt!KeBugCheckEx+0x1b
acd22bb8 add61a0a e33619d0 00000000 805597e4 nt!ExFreePoolWithTag+0x2a0
WARNING: Stack unwind information not available. Following frames may be wrong.
acd22be4 805c51c0 000020ec 00000a68 acd22cdc aswSP+0x5a0a
acd22c04 80638884 e33d1478 00000a68 acd22cdc nt!PsCallImageNotifyRoutines+0x36
acd22d08 805c4f71 7c810685 00000000 00000000 nt!DbgkCreateThread+0xa2
acd22d50 80541362 00000000 7c810685 00000001 nt!PspUserThreadStartup+0x9d
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

STACK_COMMAND:  kb
FOLLOWUP_IP:
aswSP+5a0a
add61a0a ??              ???
SYMBOL_STACK_INDEX:  2
SYMBOL_NAME:  aswSP+5a0a
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: aswSP
IMAGE_NAME:  aswSP.SYS
DEBUG_FLR_IMAGE_TIMESTAMP:  4881fba3
FAILURE_BUCKET_ID:  0xc2_7_pSsA_aswSP+5a0a
BUCKET_ID:  0xc2_7_pSsA_aswSP+5a0a
Followup: MachineOwner
---------

I don't have time right now, but I will be attempting to find out which update(s) specificly is(are) causing avast to crash.

Thanks  :)

P.S. Only one dump file. Your bulleten board software SUCKS.
Maximum attachment size allowed: 200 KB, per post: 4 would indicate to be that I have 4 attachments of 200 kb each. Nope, it's 200kb total, so you're only getting ONE dump file. ALSO, when clicking submit, the edit box for the post is grayed out. If there is an error, I'm returned to a greyed out edit box so I can't change the post without creating a brand new post and copy pasting. ALSO, I can't remove an attachment file once it's in place. >:( >:( >:( :'(

Offline Vlk

  • Avast CEO
  • Serious Graphoman
  • *
  • Posts: 11658
  • Please don't send me IM's. Email only. Thx.
    • ALWIL Software
Re: aswSP.SYS causing fatal system error, automatic restart loop
« Reply #1 on: October 17, 2008, 05:14:15 PM »
This is a known bug in the current release version of avast.
Here's a patch that's supposed to solve the issue:
http://forum.avast.com/index.php?topic=37520.msg318566#msg318566


BTW I suppose you're also using ext2fs...


Cheers
Vlk
If at first you don't succeed, then skydiving's not for you.

Noishe

  • Guest
Re: aswSP.SYS causing fatal system error, automatic restart loop
« Reply #2 on: October 17, 2008, 05:19:22 PM »
Indeed, I am using ext2fs. Thank you for the quick reply and the patch. I'll apply it and see what happens.  :D

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11849
    • AVAST Software
Re: aswSP.SYS causing fatal system error, automatic restart loop
« Reply #3 on: October 17, 2008, 05:20:36 PM »
You can also install the latest beta:
http://forum.avast.com/index.php?topic=39392.0
The fix is included there.