Avast! Antivirus BSOD Issue

Avast Free Antivirus / Premium Security
1

BSOD cannot be an issue for a security program and if it is, it means that its “developers” have no idea of what they are dealing with because of no understanding of the basic principle of security: to preserve the system and Avast antivirus is the only product on the market which has very serious BSOD issue.

BSOD while openning a Webpage.

Mini073111-01.dmp

==================================================
Dump File : Mini073111-01.dmp
Crash Time : 7/31/2011 10:03:17
Bug Check String : INVALID_PROCESS_DETACH_ATTEMPT
Bug Check Code : 0x00000006
Parameter 1 : 0x00000000
Parameter 2 : 0x00000000
Parameter 3 : 0x00000000
Parameter 4 : 0x00000000
Caused By Driver : aswSnx.SYS
Caused By Address : aswSnx.SYS+376c1
File Description : avast! Virtualization Driver
Product Name : avast! Antivirus System
Company : AVAST Software
File Version : 6.0.1203.0
Processor : 32-bit
Computer Name :
Full Path : C:\WINDOWS\minidump\Mini073111-01.dmp

==================================================
Filename : aswMon2.SYS
Address In Stack : aswMon2.SYS+3900
From Address : 0xa8dd5000
To Address : 0xa8debf80
Size : 0x00016f80
Time Stamp : 0x4e11a56e
Time String : 7/4/2011 14:35:10
Product Name : avast! Antivirus System
File Description : avast! File System Filter Driver for Windows XP
File Version : 6.0.1203.0
Company : AVAST Software
Full Path : C:\WINDOWS\system32\drivers\aswMon2.SYS

==================================================
Filename : aswSnx.SYS
Address In Stack : aswSnx.SYS+376c1
From Address : 0xa90d4000
To Address : 0xa9144000
Size : 0x00070000
Time Stamp : 0x4e11a5ca
Time String : 7/4/2011 14:36:42
Product Name : avast! Antivirus System
File Description : avast! Virtualization Driver
File Version : 6.0.1203.0
Company : AVAST Software
Full Path : C:\WINDOWS\system32\drivers\aswSnx.SYS

==================================================
Filename : aswSP.SYS
Address In Stack : aswSP.SYS+f682
From Address : 0xa9144000
To Address : 0xa918d900
Size : 0x00049900
Time Stamp : 0x4e11a5be
Time String : 7/4/2011 14:36:30
Product Name : avast! Antivirus System
File Description : avast! self protection module
File Version : 6.0.1203.0
Company : AVAST Software
Full Path : C:\WINDOWS\system32\drivers\aswSP.SYS

==================================================
Filename : ntoskrnl.exe
Address In Stack : ntoskrnl.exe+6068d
From Address : 0x804d7000
To Address : 0x80700000
Size : 0x00229000
Time Stamp : 0x4d00dcb6
Time String : 12/9/2010 16:42:14
Product Name : Microsoft® Windows® Operating System
File Description : NT Kernel & System
File Version : 5.1.2600.6055 (xpsp_sp3_gdr.101209-1647)
Company : Microsoft Corporation
Full Path : C:\WINDOWS\system32\ntoskrnl.exe

System Info:

Windows XP SP3 (fully updated)
Internet Explorer 8 (fully updated)
Avast! Free Antivirus 6.0.1203.0 (fully updated)
PC Tools Firewall Plus 7.0.0.123

Thanks :-[

2

Please, go to folder C:\windows\minidump and send the newest (recent) .mdmp files for analysis.
Better if you can compress (zip) them and add some information about the BSOD and the link for this thread.
Upload it to this anonymous ftp server: ftp.avast.com/incoming/

3

In addition to uploading the dump, you need to post here the (unique) filename of your zip. If you don’t post it here, it won’t be read by the devs.

The ftp uploading location is write-only, so after you upload the zip, you won’t see it there. Only an Avast Team member can, and that would only happen if you post here the needed details.

4

It isn’t that it won’t be read, more that no one will know who it is associated with, so won’t be able to respond if required.

So when uploading any minidump or memory.dmp files, zipped to reduce size. Give the zip file you are uploading a unique name (e.g. forumusername-mem-dump.zip, etc), so they can identify it. It might not be a bad idea to create a text file (readme.txt) with any relevant information, avast topic URL, user name, etc. etc. in the zip file. Not to mention posting the name of the file you uploaded in the topic acts as another searchable reference.

  • Memory dump locations, Mini Dump files in, C:\Windows\Minidump\ - Full Kernel dump file, C:\windows\memory.dmp

Upload the zip file to the ftp server ftp://ftp.avast.com/incoming:

  • Using Internet Explorer, Connect to the link and drag the file into the Right pane and drop it, that starts the upload, you don’t have read access to this folder.
    Or

  • Upload it using the Run command-line in Windows: Windows Key + R (to get the run box), copy and paste this [nobbc]explorer ftp://ftp.avast.com/incoming[/nobbc] and drag the file into the window, from another explorer window.

  • First you have to create your zip file with the unique name, containing the dump files and the readme.txt file, before you even consider connection to the ftp location [nobbc]explorer ftp://ftp.avast.com/incoming[/nobbc]. You do not have read permissions on the [nobbc]explorer ftp://ftp.avast.com/incoming[/nobbc] location, so you won’t see it has been uploaded.

Now you make your first windows explorer connection to the ftp link [nobbc]explorer ftp://ftp.avast.com/incoming[/nobbc], now open another explorer window where you locate your unique zip file containing the dump and readme.txt files; drag and drop that file into the other explorer window (right hand side), no need to click enter or any other action.

5

AFAI understand, in theory the uploading ftp site is not checked “proactively” by Avast Team members. “In theory”, they don’t take out “each and any” file uploaded there.

Now, whether the actual “practice” may be “proactive” or not, from the point of view of the final common user the recommendations are the same and still valid.

The user should send the dump file, together with a simple text file with details, specially with a link to the specific topic, both inside a zip (or 7z or any popular) archive. Once the archive is sent, the user should come back to the specific topic and post the unique file name (something like username-date-1.zip).

So, all the details mentioned are correct and appropriate. In case of BSODs, these files are needed and welcome by the devs.

6

There are a lot more uploads going on than there were previously, so it is more likely to be monitored.

In the past it was only at the request of one of the avast team that uploads happened and was essentially only monitored by those expecting it.

So I think it is now monitored on a more frequent basis.

7

The same Avast file is causing a Bluescreen. I see no answers on this thread - can someone from Avast advise if your avast! Virtualization Driver is going to be corrected? I’m using the latest program version 7.0.1426.

I uploaded file name Avast_Virt_Driver_Bluescreen.txt to the Incoming ftp folder. I’d really appreciate some help.

The bluescreen happens when I open a .ppt file (PowerPoint Presentation).

Here is the text file:
Dump File : Mini031012-02.dmp
Crash Time : 3/10/2012 1:43:20 PM
Bug Check String : KERNEL_MODE_EXCEPTION_NOT_HANDLED
Bug Check Code : 0x1000008e
Parameter 1 : 0xc0000005
Parameter 2 : 0x82ce6150
Parameter 3 : 0xb7b30bf8
Parameter 4 : 0x00000000
Caused By Driver : aswSnx.SYS
Caused By Address : aswSnx.SYS+3203d
File Description : avast! Virtualization Driver
Product Name : avast! Antivirus System
Company : AVAST Software
File Version : 7.0.1407.0
Processor : 32-bit
Computer Name :
Full Path : C:\Windows\minidump\Mini031012-02.dmp
Processors Count : 3
Major Version : 15
Minor Version : 6002

John

8

Two things, this is an old topic so the file is likely to have been updated and you don’t have the latest avast version, 7.0.1426.

So I would suggest that you use the avastUI, Maintenance, Program Update to get the latest version and run it for a while and see if the problem is replicated. If it is, then create your own new topic.

9

Roger that. Regards.

10

You’re welcome, hopefully the latest version will have resolved this.