Author Topic: STOP error (BSOD) aswMonFlt.sys (X64_IP_MISALIGNED_aswMonFlt.sys)  (Read 4091 times)

0 Members and 1 Guest are viewing this topic.

something

  • Guest
OS: Windows 7 x64 - current (all updates installed)
Avast! Free Antivirus: 5.0.677 with latest AV definition (101227-0)

Problem: while browsing the Web (normal text + JS content), I experienced a STOP error (aka BSOD).
I am not sure if the problem is caused by Avast! or "hardware" (or OS/device driver).
The computer is connected to network via a WiFi NIC with static IP and no IPv6.


================================================================

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: c:\windows\minidump\
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02e04000 PsLoadedModuleList = 0xfffff800`03041e50
Debug session time: Mon Dec 27 21:39:08.295 2010 (UTC + 8:00)
System Uptime: 4 days 15:52:38.225
Loading Kernel Symbols
...............................................................
................................................................
...........................................
Loading User Symbols

Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 7E, {ffffffffc0000005, fffff88004577210, fffff880047a5a98, fffff880047a5300}

*** ERROR: Module load completed but symbols could not be loaded for aswMonFlt.sys
Probably caused by : hardware ( aswMonFlt+5210 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff88004577210, The address that the exception occurred at
Arg3: fffff880047a5a98, Exception Record Address
Arg4: fffff880047a5300, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:
aswMonFlt+5210
fffff880`04577210 0000            add     byte ptr [rax],al

EXCEPTION_RECORD:  fffff880047a5a98 -- (.exr 0xfffff880047a5a98)
ExceptionAddress: fffff88004577210 (aswMonFlt+0x0000000000005210)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000001
   Parameter[1]: 0000000004384800
Attempt to write to address 0000000004384800

CONTEXT:  fffff880047a5300 -- (.cxr 0xfffff880047a5300)
rax=0000000004384800 rbx=000003a655dcfb00 rcx=00000000000000b4
rdx=0000000000000000 rsi=fffffa80018e2840 rdi=0000000000000001
rip=fffff88004577210 rsp=fffff880047a5cd0 rbp=0000000000000080
 r8=0000000000000000  r9=0000000000000f44 r10=fffff80002e04000
r11=0000000000000000 r12=0000000000000000 r13=fffff88004577528
r14=0000000000000000 r15=fffff880009e8ec0
iopl=0         nv up ei pl nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
aswMonFlt+0x5210:
fffff880`04577210 0000            add     byte ptr [rax],al ds:002b:00000000`04384800=??
Resetting default scope

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000001

EXCEPTION_PARAMETER2:  0000000004384800

WRITE_ADDRESS:  0000000004384800

FOLLOWUP_IP:
aswMonFlt+5210
fffff880`04577210 0000            add     byte ptr [rax],al

BUGCHECK_STR:  0x7E

MISALIGNED_IP:
aswMonFlt+5210
fffff880`04577210 0000            add     byte ptr [rax],al

LAST_CONTROL_TRANSFER:  from fffff88004577576 to fffff88004577210

STACK_TEXT: 
fffff880`047a5cd0 fffff880`04577576 : 000003a6`55dcfb00 00000000`00000080 fffffa80`018e2840 00000000`00000001 : aswMonFlt+0x5210
fffff880`047a5d10 fffff800`03118c06 : 00000000`077665d4 ffffffff`feced300 fffff880`047a5db0 fffffa80`03d41640 : aswMonFlt+0x5576
fffff880`047a5d40 fffff800`02e52c26 : fffff880`009e4180 fffffa80`03d41640 fffff880`009eef40 fffff880`01246a90 : nt!PspSystemThreadStartup+0x5a
fffff880`047a5d80 00000000`00000000 : fffff880`047a6000 fffff880`047a0000 fffff880`047a5a90 00000000`00000000 : nt!KxStartSystemThread+0x16


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  aswMonFlt+5210

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: hardware

IMAGE_NAME:  hardware

DEBUG_FLR_IMAGE_TIMESTAMP:  0

STACK_COMMAND:  .cxr 0xfffff880047a5300 ; kb

FAILURE_BUCKET_ID:  X64_IP_MISALIGNED_aswMonFlt.sys

BUCKET_ID:  X64_IP_MISALIGNED_aswMonFlt.sys

Followup: MachineOwner
---------

Offline pk

  • Avast team
  • Super Poster
  • *
  • Posts: 2084
Re: STOP error (BSOD) aswMonFlt.sys (X64_IP_MISALIGNED_aswMonFlt.sys)
« Reply #1 on: December 27, 2010, 03:25:54 PM »
It's caused by avast - could you please compress (7z/rar) & upload "C:\Windows\MEMORY.DMP" to our ftp?
instructions are here: http://support.avast.com/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=18&nav=0

Thanks.