aswSP.sys BSOD

Avast Free Antivirus / Premium Security
1

Hi,

there was a thread from me about a BSOD condition caused by aswSP.sys, where pk replied to and where I informed about a second user with a new BSOD conidition (Minidump uploaded to the FTP). The thread now disappeared. Is it possible that it has been deleted by accident? I searched for my own posts as well as pk’s post but it is gone, no traces of it.

2

Since the last thread completly disappeared, but pk already confirmed that the first Minidump has arrived by FTP, I am attaching the second one here, also related to the aswSP.sys.

3

Did this BSOD create a memory.dmp file as that would contain more information, as it is a kernel dump ?
If so that should be uploaded to the avast ftp location.

Of course your Startup and Recovery settings would have to have been set to generate a kernel dump.

4

Hi DavidR,

as far as I know there wasn’t a memory dump. If it is necessary for solving the issue I can ask the user to do so.

5

You only get the memory.dmp (in c:\windows) if you have enabled the kernel memory dump, see image, whilst this is for XP you should be able to find the setting in your OS.

It may not be necessary, if it were pk would probably have asked for it.

6

avast! (Free 6.0.1203) has BSODed my PC (32-bit WinXP Pro 2002 SP3) twice today, the second time reproducing the first one exactly:

  • avast! service: Stopped (I just haven’t checked this with the service running)
  • avast! GUI: running in the tray (and displaying a red-white X-sign)
  • Microsoft Visual C++ 2008 Express Edition (Version 9.0.30729.1 SP): loading a minidump project (of an unrelated executable)
  • Windows symbols: downloaded locally (just in case it matters)

At some point, BSOD happens; its minidumps attached.

7

Trying to attach a zip file simply by changing the file type doesn’t work as it will be saved as a text file destroying the zip file. Renaming it back to a zip file type and trying to unzip it just give an error, see image1.

So it has to be uploaded to avast for analysis:
~~~~

  • Upload any minidump or memory.dmp files, zipped to reduce size. Give the zip file you are uploading a unique name (e.g. forumusername-mem-dump.zip, etc), so they can identify it. It might not be a bad idea to create a text file (readme.txt) with any relevant information, avast topic URL, user name, etc. etc. in the zip file. Not to mention posting the name of the file you uploaded in the topic acts as another searchable reference.

Upload the zip file to the ftp server ftp://ftp.avast.com/incoming:

  • Using Internet Explorer, Connect to the link and drag the file into the Right pane and drop it, that starts the upload, you don’t have read access to this folder.
    Or
  • Upload it using the Run command-line in Windows: Windows Key + R (to get the run box), copy and paste this [nobbc]explorer ftp://ftp.avast.com/incoming[/nobbc] and drag the file into the window, from another explorer window.

####
Excuse if I’m teaching your granny to suck eggs:

  • First you have to create your zip file with the unique name, containing the dump files and the readme.txt file, before you even consider connection to the ftp location [nobbc]explorer ftp://ftp.avast.com/incoming[/nobbc]. You do not have read permissions on the [nobbc]explorer ftp://ftp.avast.com/incoming[/nobbc] location, so you won’t see it has been uploaded.

Now you make your first windows explorer connection to the ftp link [nobbc]explorer ftp://ftp.avast.com/incoming[/nobbc], now open another explorer window where you locate your unique zip file containing the dump and readme.txt files; drag and drop that file into the other explorer window (right hand side), no need to click enter or any other action.

8

Thank you for bringing this to my attention. I’ve uploaded the file named awsSP.sys_BSOD_msg677147.zip with a Readme.txt inside containing my initial post text and its link.

What else can I do to help the avast! team solve this?

PS
I’d like to clarify the steps to reproduce a bit: MSVC9 was actually starting my minidump project (and loading modules’ symbols) when BSODs happened.

9

You’re welcome.
If they need any information aside from the dump files and what you placed in the readme.txt file, they should be able to contact via the forum topic, etc.

10

Hi,

thanks for the tip DavidR, didn’t know that, since I barely attach files. Usually I point our users to the FTP as well. I will upload the dump to the FTP then.

11

No problem, glad I could help.

12

Attachment test.

PS
ZIP masked as GIF is OK. :wink:

13

It isn’t a case of trying to get around the restriction on what files can be attached, but of getting the dump files to those who can analyse it.

So there is little point in attaching it in the forums as we who are asking for it to be uploaded to the avast FTP location aren’t avast employees, so we can’t analyse it. This is why we are asking for it to be uploaded.

So if you can follow the instructions in my Reply #6 above.

14

Sure, I’ve done that already and I’ll do it in an unfortunate occasion I need to submit any other errors.

15

Maybe the forum guys should make a sticked topic requesting people their dumps/minidumps, unifying the root files. Until now the files are aswSP.sys and aswSnx.sys causing the BSODs.

16

Thanks for detailed description - I was able to simulate this bsod and fixed it (it’s maybe only XP thing…)

17

Anyway, seems the correction will only be available in next program version. Am I right?

18

@ pk
I don’t see this on the patches page pk, will this be added ?
Or more important is there a scheduled/estimated release date for the next 6.0.x program update ?

19

I believe i just uploaded a minidump to the ftp site… sorry if I sent it twice, I had trouble setting-up the ftp connection.

20

You do not need Windows Defender on XP Pro.