BSOD caused by aswSnx.SYS

[hany3]

I've installed avast Antivirus 6.0.1091 free
and i enabled the windows driver verifier for all avast drivers cause i had some crash problems with the past avast versions
then after i restarted the pc , i got blue screen from the avast virtualization driver aswSnx.SYS
and i had the same issue with the previous avast versions caused by the same driver
i have only the file shield on all other shields are off

minidump file attached

http://www.mediafire.com/?7er1rqqjwrd1fd3

system xp sp3
core2duo 2.66
2 gb ram
firefox 4.0

http://img220.imageshack.us/i/24039726.jpg

[Hermite15]

nice post for a first post ... okay the driver you mention, and involved, is the virtualization module driver... we need an Avast team member to post here... in the meantime you can always disable auto-sandbox... not sure this will help as the driver will keep loading and there's no way to disable it from the setup uninstall/change process... just the manual virtualization and the SafeZone part can be removed from AIS, while there's nothing to remove the auto-sandbox, present in all versions.

ps: I'll pm the guy in charge of this part of the software)

[hany3]

thanks for reply Logos
actually i may be new to the forum but i was a beta tester for some softwares previously so may be i have the sense of how to report a bug
and as u said i hope some member of the avast developing team to comment on that serious bug
and thanks also for ur advice , but i donno if disabling the autosandbox feature will prevent the virtualization driver loading

[Hermite15]

it won't... (prevent it...)

[Vlk]

Hi hany3,

thanks for the report as well as for the dump. Unfortunately, however strange it may sound, I have to say that this is a false positive from the Driver Verifier (or, more accurately, Driver Verifier overreacting in this specific case). I don't know your proficiency level with computers but if you're interested, I can describe what's going on in a bit more detail.

This is actually a problem in DV that we're well aware of, and which we have discussed for a few times with the DV team in Redmond. However, probably because of the questionable nature of what we're doing, they never seemed particularly interested in fixing this problem.

Thanks
Vlk

[hany3]

thank you very much Vlk for clearing things up
and despite being a cardiologist , i have a good computer knowledge as i said , so i got what u said thought i hope either u or the DV team fix this false conflict , and sure i'm interested to know in more details that issue as many avast fans may experience the same issue and will be useful to know what's actually going on

off topic
when i open any folder have many exe's present like a game folder the windows explorer takes many seconds "6 seconds average" to load and every time i open such kind of folders i got the same slow loading
i think avast causes that kind of windows explorer hanging this problem suddenly disappear when i uncheck "scan when executing"

such problem wasn't in the 1st versions of avast 5.0 become obvious in later versions of avast 5 and avast 6
ans it was the main reason why i switched to avira

any solution to this problem without having to uncheck the "scan program when executing " in expert settings in the realtime shield ?
thanks in advance

[Hermite15]

off topic
when i open any folder have many exe's present like a game folder the windows explorer takes many seconds "6 seconds average" to load and every time i open such kind of folders i got the same slow loading
i think avast causes that kind of windows explorer hanging this problem suddenly disappear when i uncheck "scan when executing"

such problem wasn't in the 1st versions of avast 5.0 become obvious in later versions of avast 5 and avast 6
ans it was the main reason why i switched to avira

any solution to this problem without having to uncheck the "scan program when executing " in expert settings in the realtime shield ?
thanks in advance

may be start a new thread about that ... might not be as simple as that to solve the issue

[pk]

thank you very much Vlk for clearing things up
and despite being a cardiologist , i have a good computer knowledge as i said , so i got what u said thought i hope either u or the DV team fix this false conflict , and sure i'm interested to know in more details that issue as many avast fans may experience the same issue and will be useful to know what's actually going on

DV team will not fix it -- but I understand them, it makes sense.

This "problem" affects only XP users - we hook NtClose (aka CloseHandle) function. It's a general stub for closing file/registry/events/... and we translate handle to object (without knowing what's handle type). Windows (without DV) will use the right object type, but it bugchecks with DV (because we didn't use the right object type).

There's a solution - we could use NtQueryObject + ZwAllocateVirtualMemory + NtQueryObject to get handle's object type, but do that for every closing only because of DV? No way...

[RB123]

thank you very much Vlk for clearing things up
and despite being a cardiologist , i have a good computer knowledge as i said , so i got what u said thought i hope either u or the DV team fix this false conflict , and sure i'm interested to know in more details that issue as many avast fans may experience the same issue and will be useful to know what's actually going on

DV team will not fix it -- but I understand them, it makes sense.

This "problem" affects only XP users - we hook NtClose (aka CloseHandle) function. It's a general stub for closing file/registry/events/... and we translate handle to object (without knowing what's handle type). Windows (without DV) will use the right object type, but it bugchecks with DV (because we didn't use the right object type).

There's a solution - we could use NtQueryObject + ZwAllocateVirtualMemory + NtQueryObject to get handle's object type, but do that for every closing only because of DV? No way...

I have gotten this too, even with the other 6.0 versions. In the meantime, what are we suppose to do to avoid this?

[Vlk]

I have gotten this too, even with the other 6.0 versions. In the meantime, what are we suppose to do to avoid this?

Not enable Driver Verifier on aswSnx.sys and aswSP.sys?

[RB123]

I have gotten this too, even with the other 6.0 versions. In the meantime, what are we suppose to do to avoid this?

Not enable Driver Verifier on aswSnx.sys and aswSP.sys?

On aswSP.sys How do I do that on Vista?

[Hermite15]

I have gotten this too, even with the other 6.0 versions. In the meantime, what are we suppose to do to avoid this?

Not enable Driver Verifier on aswSnx.sys and aswSP.sys?

On aswSP.sys How do I do that on Vista?

you don't >>> you're currently posting in a thread strictly related to the impact of the driver verifier - when activated - in Windows XP. So if you have no idea how to deactivate it in Vista, that already means that you didn't install/activate it in the first place.

[RB123]

I have gotten this too, even with the other 6.0 versions. In the meantime, what are we suppose to do to avoid this?

Not enable Driver Verifier on aswSnx.sys and aswSP.sys?

On aswSP.sys How do I do that on Vista?

you don't >>> you're currently posting in a thread strictly related to the impact of the driver verifier - when activated - in Windows XP. So if you have no idea how to deactivate it in Vista, that already means that you didn't install/activate it in the first place.

Wasn't it enabled to show the BSOD in the first place?

[Hermite15]

I have gotten this too, even with the other 6.0 versions. In the meantime, what are we suppose to do to avoid this?

Not enable Driver Verifier on aswSnx.sys and aswSP.sys?

On aswSP.sys How do I do that on Vista?

you don't >>> you're currently posting in a thread strictly related to the impact of the driver verifier - when activated - in Windows XP. So if you have no idea how to deactivate it in Vista, that already means that you didn't install/activate it in the first place.

Wasn't it enabled to show the BSOD in the first place?

no,
...besides, did you ever do that?

Enabling Driver Verifier
You can enable Driver Verifier by using Verifier.exe. Verifier.exe is included with every copy of Windows and automatically installed into the System32 folder. Verifier.exe has both command-line and graphical user interface (GUI) interfaces, so you can specify drivers and appropriate levels of verification. You can also see Driver Verifier statistics in real time. For additional information, refer to the "Driver Verifier Manager" section of this article.

[pk]

@RB123, what's your exact problem with avast? I'm sorry, but it's not clear from your answers here. Did you get a BSOD or something else? Thanks.