Blue Screen - Bad Pool Header caused by AvastSvc.exe

[wuemura]

There is not much to say about it, the computer after the last update enter in a blue screen. There is a decoded minidump attached to this message.

Program Version: 7.0.1407
Virus Definition: 120301-0

[igor]

Please upload the original minidump to ftp://ftp.avast.com/incoming

[wuemura]

Please upload the original minidump to ftp://ftp.avast.com/incoming

How I do that if the server keep closing the connection?

[igor]

That's the first time I hear about anything like that.
What do you use to upload it?

[wuemura]

Windows ftp command prompt.

Code: [Select]

C:\>ftp ftp.avast.com
Connected to ftp.avast.com.
220 Welcome on ftp.avast.com.
User (ftp.avast.com:(none)): anonymous
331 Please specify the password.
Password:
230 Login successful.
ftp> cd incoming
250 Directory successfully changed.
ftp> binary
200 Switching to Binary mode.
ftp> send 030112-94411-01.7z
Connection terminated by remote host.
Anyway,

Here is the minidump.
http://www.4shared.com/archive/XQL_fhZF/030112-94411-01.html

[lukor]

Windows ftp command prompt.

Code: [Select]

C:\>ftp ftp.avast.com
Connected to ftp.avast.com.
220 Welcome on ftp.avast.com.
User (ftp.avast.com:(none)): anonymous
331 Please specify the password.
Password:
230 Login successful.
ftp> cd incoming
250 Directory successfully changed.
ftp> binary
200 Switching to Binary mode.
ftp> send 030112-94411-01.7z
Connection terminated by remote host.

Maybe passive mode should be better. Don't know your network config.

[wuemura]

Maybe passive mode should be better. Don't know your network config.

Passive mode is not compatible with ftp command line. 
I've uploaded the file using the windows explorer, the file name is 030112-94411-01.7z

[lukor]

BAD_POOL_HEADER is a kernel mode crash, caused by some driver, not a user-mode service (like avastsvc.exe). In this case cmdhlp.sys is on top - which I believe belongs to Comodo. I can see aswtdi.sys in the stack, which is part of avast, but this is way deep, so before digging into it more deeply we might want to know what the crashing driver owner says about that.

[wuemura]

Strange.
The system crashed soon after the avast update, I have the comodo firewall installed here and it never gave me any problem.
Also, it detects that AvastSvc.exe is the process that use a lot of my network resources.


Again, this started after the last avast update.

[Asyn]

Also, it detects that AvastSvc.exe is the process that use a lot of my network resources.

That's normal, as it acts like a local proxy.

[wuemura]

But the time I took that screenshot the system was idle.

[Asyn]

But the time I took that screenshot the system was idle.

It's just a stat.