0x000000C4 because of Avast!

Avast Free Antivirus / Premium Security
1

Hello… I recently was sick of McAfee Security Center slowing my computer to a crawl so I uninstalled everything related to McAfee other than the firewall which I like and doesnt slow me down. I installed Avast 4.8 Home (free) and was very happy cause once I restarted the computer was running like a champ with both running. Then I realized EVERYTIME I shutdown my computer, I get a BSOD with the code 0x000000C4, 0x0000003C… everytime it is the same and only when windows is shutting down. I think this is related to drivers but I now know for a fact that it is related to Avast since I tried everything to fix it, couldnt, then uninstalled Avast and the problem stopped… I reinstalled and problem came back… I am considering switching to AVG but I would like some quick input on why this is happening or what I can do to fix it.

Pentium 3.0 core 2 duo
4 GB ddr2 800 RAM
Windows XP
Nvidia 9400 gt

Thanks

2

Ensure that all remnants of McAfee have been completely removed:

2007 version - http://download.mcafee.com/products/licensed/cust_support_patches/MCPR.exe

Also see - How do I uninstall SecurityCenter? http://ts.mcafeehelp.com/faq3.asp?docid=71525

The BSOD, normally has a Stop error code before the () Bracketed information, what was that (if that was it, see below) ?

See http://support.microsoft.com/kb/325672, whilst this mentions Norton (did you ever have that installed ?) it is likely that the same could happen if the McAfee uninstall left remnants.

3

The stop code before the brackets is 0x000000c4. The deadlock thing is something that keeps coming up in my research but I really dont understand how verifier.exe works (I mean how to use it in lamens terms.)

I still have Security Center installed for the firewall protection. Security Center 9.15 and firewall version 10.15 is installed. If this is what is causing the problem with Avast and I run the uninstaller for mcAfee, then can I install Avast and reinstall the firewall after or will they just not work together no matter what? I need an outbound firewall and I like McAfee’s.

If I CAN use McAfee firewall and you are referring to running the program to look for remanents of McAfee virus scan to remove the problem… that would be better just specify please. I have never had Norton installed also. Thx

4

Can you upload (a few of) the corresponding minidump files (should be created in Windows\Minidump folder) to

ftp://ftp.avast.com/incoming

?

5

First I will say do as Igor suggests to upload the minidumps if they are present.

I don’t know if in using the McAfee tool it would be that selective, I think it would be an all or nothing affair. I also don’t know if the McAfee Security Center is able to do a custom install where you only install the Firewall element. I have never used any of the McAfee products, so it is more of playing devils advocate than speaking from personal experience.

So in the same sort of thing I don’t know if it has a selective uninstall or if you just disabled the other parts or if they were truly removed.

For the time being until you upload those minidump files I would hold off on the use of the removal tool. I don’t know if there is much mileage looking at the MS KB article again, particularly the Resolution section and see if there any McAfee drivers that you can try and verify to see if it is that.

6

Ok I uploaded about 4 of them there but I am not sure how you get them from there. I have never done this before so bare with me :confused:

7

Well, I didnt get this post in time and I ran the removal tool… the strange thing was that in DOS it went through removing a bunch of registry entries etc that were not there and I assumed my firewall would be removed… it said it needed to reboot and I allowed it to… when reboot was done my firewall is still here so I am not sure what, if anything, it did LOL. I uploaded the dump files but I am not sure if I did it right so you guys can look at them since i have never done it before… let me know if there is another step in the process. I tried installing AVG and was told that the installation failed because it was unable to write an entry to my registry (access denied.) So I am back to Avast.

8

OK, as I said I don’t know how smart the removal tool is, if it can detect that the elements remaining ‘installed’ are OK and only the registry entries for other uninstalled entries are cleaned. As you say it removed a number of registry entries, so hopefully it might have got rid of a troublesome entry.

I will leave the ftp checking to Alwil staff like Igor.

Having tried to install AVG and that failed I don’t know if there could be a similar issue with remnants - - AVG8.x Remover, download tool from here, http://www.avg.com/download-tools there is a 32bit and 64 bit windows version, ensure you use the correct one.

9

I’ll try that… while I am waiting for someone to look at the .dmp files… I downloaded windows debugger and I saw that it said the problem is being caused by aswsp.sys which is an Avast driver file. Maybe this might help somewhat to figure out the problem.

Below is what the debugger says when I open the dump files… I dont know what it means that the symbols are wrong but here it is.

Loading Dump File [C:\WINDOWS\Minidump\Mini010110-07.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: *** Invalid ***

  • Symbol loading may be unreliable without a symbol search path. *
  • Use .symfix to have the debugger choose a symbol path. *
  • After setting your symbol path, use .reload to refresh symbol locations. *

Executable search path is:

  • Symbols can not be loaded because symbol path is not initialized. *
  •                                                               *
  • The Symbol Path can be set by: *
  • using the _NT_SYMBOL_PATH environment variable. *
  • using the -y <symbol_path> argument when starting the debugger. *
  • using .sympath and .sympath+ *

Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Fri Jan 1 12:21:50.750 2010 (GMT-5)
System Uptime: 0 days 0:03:35.453

  • Symbols can not be loaded because symbol path is not initialized. *
  •                                                               *
  • The Symbol Path can be set by: *
  • using the _NT_SYMBOL_PATH environment variable. *
  • using the -y <symbol_path> argument when starting the debugger. *
  • using .sympath and .sympath+ *

Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
…
…

  • Symbols can not be loaded because symbol path is not initialized. *
  •                                                               *
  • The Symbol Path can be set by: *
  • using the _NT_SYMBOL_PATH environment variable. *
  • using the -y <symbol_path> argument when starting the debugger. *
  • using .sympath and .sympath+ *
  • Symbols can not be loaded because symbol path is not initialized. *
  •                                                               *
  • The Symbol Path can be set by: *
  • using the _NT_SYMBOL_PATH environment variable. *
  • using the -y <symbol_path> argument when starting the debugger. *
  • using .sympath and .sympath+ *

ADDITIONAL_DEBUG_TEXT:
Use ‘!findthebuild’ command to search for the target build information.
If the build information is available, run ‘!findthebuild -s ; .reload’ to set symbol path and load symbols.

MODULE_NAME: aswSP

FAULTING_MODULE: 804d7000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 4aaf72a1

BUGCHECK_STR: 0xc4_3c

CUSTOMER_CRASH_COUNT: 7

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

LAST_CONTROL_TRANSFER: from 8065979c to 804f9f43

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
b6eaed00 8065979c 000000c4 0000003c 00000098 nt+0x22f43
b6eaed20 a9a6484a 00000098 00000000 00000000 nt+0x18279c
b6eaed48 a9a666c6 00000098 0071fcd4 b6eaed64 aswSP+0x684a
b6eaed58 8054162c 00000098 0071fcd4 7c90e514 aswSP+0x86c6
b6eaed64 7c90e514 badb0d00 0071fcd0 00000000 nt+0x6a62c
b6eaed68 badb0d00 0071fcd0 00000000 00000000 0x7c90e514
b6eaed6c 0071fcd0 00000000 00000000 00000000 0xbadb0d00
b6eaed70 00000000 00000000 00000000 00000000 0x71fcd0

STACK_COMMAND: kb

FOLLOWUP_IP:
aswSP+684a
a9a6484a ?? ???

SYMBOL_STACK_INDEX: 2

SYMBOL_NAME: aswSP+684a

FOLLOWUP_NAME: MachineOwner

IMAGE_NAME: aswSP.SYS

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner

10

Effectively you can’t debug it as the avast symbols aren’t available to you. So I also don’t know how that effects the overall debug results.

The aswSp.sys is the avast Self-Defence module and will be one of the last avast processes to close, so would still be loaded in memory.

11

Hi All, I read treacotton’s problem and it is the exact problem I have on my PC every time I shut windows down I get a blue screen with Error code 000000c4, parameter1 0000003c, parameter2 00000078, parameter3 00000000, parameter4 00000000.
if I understood correctly the problem is caused by aswsp.sys which is an Avast driver file.
I wanted to know if someone found any solution to this problem?
thanks,

12

Those who had BSODs, please send me a couple of the latests minidumps (\Windows\Minidump folder) to kurtin@avast.com, thanks.
Also you should use build 874, because some BSODs were fixed in it.

13

###

The one important thing, 0xC4 error is caused by driver verifier (e.g. internal Windows checking tool). It seems it’s actived in your system which slows your computer! It should be used only by developers, there’s no reason to be active for the regular users.

  1. verifier.exe => Display existing settings (what drivers names do you see in the right panel??)
  2. verifier.exe => Delete existing settings (and reboot)

however, please send me still those minidumps as stated in the upper post, thanks!