aswSP.SYS BSOD on XP Pro SP3

[sky101]

Windows XP Pro SP3 got a blue screen of death with ASWSP.SYS which is Avast system file.
Had to reboot the machine but don't know if it will come back or not.
Could someone take a look to see if there is a way to fix it? So it'll not happen again.
Here's what was in the Minidump file:

WRITE_ADDRESS:  96073454

CURRENT_IRQL:  2

FAULTING_IP:
nt!MiCompleteProtoPteFault+f6
804e9eb1 897904          mov     dword ptr [ecx+4],edi

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

LAST_CONTROL_TRANSFER:  from f72e66af to 804e9eb1

STACK_TEXT: 
f796ca14 f72e66af 86197238 f796ca70 f796ca48 nt!MiCompleteProtoPteFault+0xf6
f796ca24 f731f242 86197238 86f92558 e14fad20 Ntfs!NtfsFreeEresource+0x6b
f796ca48 f72e6587 862155e8 f796ca70 f796ca7b Ntfs!NtfsDeleteFcb+0x4e
f796ca94 f7307e7c 862155e8 86f923f8 e418c4b8 Ntfs!NtfsTeardownFromLcb+0x1fd
f796caec f72e27a4 862155e8 e418c580 e418c718 Ntfs!NtfsTeardownStructures+0x125
f796cb18 f73056b5 862155e8 0118c580 e418c718 Ntfs!NtfsDecrementCloseCounts+0x9e
f796cb9c f7305454 862155e8 e418c580 e418c4b8 Ntfs!NtfsCommonClose+0x398
f796cc3c edcd739d 86f92318 86069a70 86becc70 Ntfs!NtfsFsdClose+0x21f
WARNING: Stack unwind information not available. Following frames may be wrong.
f796cc54 804e13eb 86f92318 86069a70 86f94300 aswSP+0x1f39d
f796cc54 868fe380 86f92318 86069a70 86f94300 nt!KiTrap0D+0x4a5
86069c24 00000000 00000000 00000000 00000000 0x868fe380


STACK_COMMAND:  kb

FOLLOWUP_IP:
aswSP+1f39d
edcd739d ??             

SYMBOL_STACK_INDEX:  8

SYMBOL_NAME:  aswSP+1f39d

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: aswSP

IMAGE_NAME:  aswSP.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  4e41ea3a

FAILURE_BUCKET_ID:  0xA_aswSP+1f39d

BUCKET_ID:  0xA_aswSP+1f39d

Followup: MachineOwner

[DavidR]

Try the latest beta 6.0.1279 as that resolved a number of these problems, http://forum.avast.com/index.php?topic=83583.0, without having to resort to the limited patches.

A clean reinstall may be best.

[sky101]

Thanks for the respond!
We're using Avast Business Protection SP1 - there isn't a newer version available.
We can't push the update to machines thru the console yet.

[DavidR]

OK, hopefully one of the moderators for this forum can pick up on this.

[lukas.hasik]

is the version of BP clients 6.0.1253?

[sky101]

is the version of BP clients 6.0.1253?

Yep

[wimmme]

Just to help or for documentation, I had the same issue.
Deployment of the latest version failing on XP SP3 -> BSOD.
Removing of Avast Network edition 4.8 did not help, same result.

Installing the same version when installing it manually from http://server/Avast/Install.aspx?prod=BPP with the same users as for deployment worked lie a charm. So the error should be in the deployment, not in the package i guess...

[lukas.hasik]

@wimme - would it e possible to get some dumps from the BSOD?
Or what are steps to reproduce - remote deployment of BP to WinXP_SP3 with avast 4.8 (PRO/managed?)

[wimmme]

Here are the dump files.

Just a regular XP Pro SP3 English with Avast 4.8 Netclient/managed client. (SBS Suite client)
Was the current version of avast BP client (6.0.1253).
Another pc with the same config 5 days later with BPP client (new correct license file): same issue.
Hope this helps


Wim

EDIT: shame upload of zip(x) is not allowed ! Here are the minidumps: http://xtensodownloads.be/XtensoTeam/Eupenw/Minidump.zipx

[DavidR]

You can also upload to avast:
- Upload any minidump or memory.dmp files, zipped to reduce size.  Give the zip file you are uploading a unique name (e.g. forumusername-mem-dump.zip, etc), so they can identify it. It might not be a bad idea to create a text file (readme.txt) with any relevant information, avast topic URL, user name, etc. etc. in the zip file. Not to mention posting the name of the file you uploaded in the topic acts as another searchable reference.

Upload the zip file to the ftp server ftp://ftp.avast.com/incoming:
- Using Internet Explorer, Connect to the link and drag the file into the Right pane and drop it, that starts the upload, you don't have read access to this folder.
Or
- Upload it using the Run command-line in Windows: Windows Key + R (to get the run box), copy and paste this explorer ftp://ftp.avast.com/incoming and drag the file into the window, from another explorer window.

####
Excuse me if I'm teaching your granny to suck eggs:
- First you have to create your zip file with the unique name, containing the dump files and the readme.txt file, before you even consider connection to the ftp location explorer ftp://ftp.avast.com/incoming. You do not have read permissions on the explorer ftp://ftp.avast.com/incoming location, so you won't see it has been uploaded.

Now you make your first windows explorer connection to the ftp link explorer ftp://ftp.avast.com/incoming, now open another explorer window where you locate your unique zip file containing the dump and readme.txt files; drag and drop that file into the other explorer window (right hand side), no need to click enter or any other action.

[wimmme]

ok, tnx for the explanation - which was indeed not needed, can learn you a bit about ftp  - but maybe interesting for the next time or for other users.
I guess no further action needed from me, the link i supplied does work too ...

[DavidR]

Yes the link does to job, but it may wait a while before lukas.hasik gets back to the forum to see it.

[sky101]

when will there be an update from Avast to fix this BSOD? we have 3 more computers that got the same BSOD.