avast! 4 Home v4.8.1282 aswSP.SYS

[Phant0m``]

Hi,

  One of my customers computers is having problems, and it's even with the recent public release v4.8.1282.

Loading Dump File [C:\Users\Phant0m``\Documents\Mini111008-01\Mini111008-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: symsrv*symsrv.dll*C:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp3_gdr.080814-1236
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055b1c0
Debug session time: Mon Nov 10 09:13:36.593 2008 (GMT-4)
System Uptime: 0 days 11:32:04.171
Loading Kernel Symbols
...
Loading User Symbols
Loading unloaded module list
....................................
Unable to load image aswSP.SYS, Win32 error 0n2
*** WARNING: Unable to verify timestamp for aswSP.SYS
*** ERROR: Module load completed but symbols could not be loaded for aswSP.SYS
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 10000050, {fd9e7000, 0, b9e261ed, 0}


Could not read faulting driver name
*** WARNING: Unable to verify timestamp for aswMon2.SYS
*** ERROR: Module load completed but symbols could not be loaded for aswMon2.SYS
*** WARNING: Unable to verify timestamp for X4Ex.Sys
*** ERROR: Module load completed but symbols could not be loaded for X4Ex.Sys
*** WARNING: Unable to verify timestamp for X4HSX32Ex.Sys
*** ERROR: Module load completed but symbols could not be loaded for X4HSX32Ex.Sys
Probably caused by : aswSP.SYS ( aswSP+121ed )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fd9e7000, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: b9e261ed, If non-zero, the instruction address which referenced the bad memory
   address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS:  fd9e7000

FAULTING_IP:
aswSP+121ed
b9e261ed 668b08          mov     cx,word ptr [eax]

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  iexplore.exe

LAST_CONTROL_TRANSFER:  from b9e24332 to b9e261ed

STACK_TEXT: 
WARNING: Stack unwind information not available. Following frames may be wrong.
b3773ab4 b9e24332 fd9e6ee4 0a95edb1 00000000 aswSP+0x121ed
b3773af4 b9e244df 00000006 8238e020 81518328 aswSP+0x10332
b3773b08 804e37f7 8238e020 81518328 81518328 aswSP+0x104df
b3773b18 f8482e9b 8238c318 81518328 82376330 nt!IopfCallDriver+0x31
b3773b3c f848306b b3773b5c 8238c318 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x20b
b3773b74 804e37f7 8238c318 81518328 81518328 fltmgr!FltpDispatch+0x11f
b3773b84 f8482e9b 8219ddf0 81518328 821dfb48 nt!IopfCallDriver+0x31
b3773ba8 f848306b b3773bc8 8219ddf0 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x20b
b3773be0 804e37f7 8219ddf0 81518328 81518524 fltmgr!FltpDispatch+0x11f
b3773bf0 b435e865 8144b188 82321788 81518328 nt!IopfCallDriver+0x31
b3773c14 b435883c 81d04ee0 00518328 804e37f7 aswMon2+0x6865
b3773ce0 b3043d90 000028cc 01dadadc 087746e0 aswMon2+0x83c
b3773d14 bac16a1f 000028cc 01dadadc 087746e0 X4Ex+0x25d90
b3773d48 804de7ec 000028cc 01dadadc 087746e0 X4HSX32Ex+0x1a1f
b3773d48 7c90e4f4 000028cc 01dadadc 087746e0 nt!KiFastCallEntry+0xf8
01dadb20 00000000 00000000 00000000 00000000 0x7c90e4f4


STACK_COMMAND:  kb

FOLLOWUP_IP:
aswSP+121ed
b9e261ed 668b08          mov     cx,word ptr [eax]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  aswSP+121ed

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: aswSP

IMAGE_NAME:  aswSP.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  490f3d15

FAILURE_BUCKET_ID:  0x50_aswSP+121ed

BUCKET_ID:  0x50_aswSP+121ed

Followup: MachineOwner
---------

[igor]

Can you please upload the minidump to ftp://ftp.avast.com/incoming ?
Thanks.

[Phant0m``]

No problem igor, ... done.

[Vlk]

This is a minidump from one of the beta builds.
Does it really occur even in the release build? If so, please post the dump from the release build.

Thanks
Vlk

[Phant0m``]

I'll reproduce the problem and send you the latest minidump file created, but it'll be later on in the day (3-6hrs) when the customer has awaken.

.. sorry for the large delay, but I promise I won't forget yea.

[Phant0m``]

I guess it has a mind of it's own, .. it'll probably take a couple of days for the problem to show, depending on if the problem still exists with the public release. The minidump I sent was from the previous beta release (4.8.1273), if that makes any difference.


Regards,
Phant0m``

[Vlk]

My personal guess is that the crash won't happen anymore with the release build. Let's wait and see though...