BSOD Stop 0x0000008E with aswFsblk.sys

[WhiteD]

Hello everyone,

I have a problem with my computer.
Sometimes, my computer displays the Windows' BSOD before rebooting.
Here some informations about the system error :

===
STOP : 0x0000008E (0xc0000005, 0xF79D8577, 0xF77A3884, 0x00000000)

aswfsblk.sys - Address F79D8577
base at F79D4000 - DateStamp 492AEE01
===

I have the minidump file if you want me to upload it (I use Filezilla Client).

Thank you for reading me, I hope you will help me finding the solution.

[Lisandro]

Check the folder <avast>\data\log
Are there any files called unpXXXX (where XXXX is a random number) or *.mdmp there?
If so, send them to vlk (at) avast.com
They may contain more information about the problem (maybe a link to this thread).

Also, please, go to folder \windows\minidump and send the newest (recent) .mdmp files for analysis. There is also C:\Windows\Memory.dmp file.
Better if you can compress (zip) them and add some information about the BSOD and the link for this thread. 

Send an email to: vlk (at) avast.com
Or upload it to this anonymous ftp server: ftp://ftp.asw.cz/incoming

Control Panel > System > Advanced > Initialization & restoring Settings > Choose the dump options (removing the autorestart in case of failure)

Besides Google also you can use:
MS knowledgebase: http://support.microsoft.com/search/?adv=1
Free memory tester (Run it overnight): http://www.memtest86.com/
XP error explanations: http://www.xptuneup.com/xptuneup_stopmessages.htm

[igor]

Yes, please upload the minidump to ftp://ftp.avast.com, or send it to Vlk's e-mail.
Thanks.

[WhiteD]

There is neither unpXXXX (or .mdmp) file in \data\log nor \windows\Memory.dmp file
I sent a mail with the \windows\minidump file and a link to this thread

[pk]

WhiteD: thanks for your dump! We've analyze your dump, but we're not quite sure what caused the problem - would it be possible to generate a kernel memory dump instead of minidump and next time when it'd happen, ZIP \Windows\memory.dmp file and upload it to ftp://ftp.avast.com/incoming ? (note that you won't have READ access to the ftp erver, just write - so you won't even be able to see what you've just uploaded). Thanks!

[WhiteD]

Ok but how can i do that kind of dump ?
Now, I have no Memory.dmp file in Windows folder

[pk]

Unfortunately, you have to wait for another BSOD, next time, \Windows\memory.dmp file will be created instead of minidump file. This file will contain much more information than minidump, so we can find the problem easily.

[igor]

You have to configure Windows to create this kind of dump first:
My Computer / Properties / Advanced / Startup and Recovery - Settings
- and select "Kernel memory dump " in the section Write debugging information.

I'm not sure if the change takes effect immediatelly, so I'd suggest to restart the computer first.

[WhiteD]

Ok, thank you for your answer.
See you soon

[WhiteD]

Hello !
I have just uploaded "WhiteD-MEMORY.zip" file in the incoming folder of the FTP.
I hope this will help you.

[pk]

Thanks for your dump.
Looking at your dump, it looks like the Windows internal memory structures were damaged - it might seem like you have a rootkit in your system .

Please follow these steps (for x86 machines only) to download our fixed driver:
1) Stop avast self defense (avast settings -> Troubleshooting page)
2) Copy the following files http://public.avast.com/~kurtin/public/flt_05/i386/aswFsBlk.sys and http://public.avast.com/~kurtin/public/flt_05/i386/aswFsBlk.sys.sum to \Windows\System32\Drivers and \Program Files\ALWIL Software\Avast\setup\inf folders (overwrite existing)
3) Re-enable avast self defense
4) Restart the computer

If you see another BSOD, please zip & upload your memory.dmp file on our ftp.

[WhiteD]

It is strange that i could have a rootkit in my computer because i have just formatted it.
Because formatting kills everything in the Windows file, doesn't it ?

[pk]

Well, fix the driver and we'll see what happen.

[WhiteD]

Ok i copied the two files in the two folders.
We'll see if it happens again.
Thank you for your help.

[WhiteD]

So, There is no BSOD caused by aswFsblk.sys since I fixed it.
We can say it's resolved thank you very much !