Blue Screen caused by avastsvc.exe v.2014.9.0.2018

Avast Free Antivirus / Premium Security
21

Thanks for that. Let’s hope that support can pull one out of the bag. I sure hope they don’t make me wait another week before replying otherwise I might end up removing it again. I can hold on for a few days but I can’t live with it for too much longer.

I am running MBAM pro alongside. I did have the new v2.0 of MBAM but downgraded it it to 1.75 as I thought it could be that. I do have all the usual exclusions in avast and MBAM to not interfere with each other too.

Apart from that its fairly standard.

It’s quite an old motherboard (GA-MA770-UD3 v2.0) and I was half suspecting that (as its not officially supported on Windows 8 (or 8.1)) that it would be that but I am not convinced (as you say it seems to be an avast thing as I tried Avira with no problems and I was running Windows 8.1 with the last version of Avast with no problem). I did also recently install Windows 8.1 update 1 (spring update) which I guess could be a cause.

Cheers,
Paul

22

One more thing please. I noticed your Avast symptoms changed (from BSOD to freeze) after installing and then uninstalling Avira so is there any chance Avira left some remnants behind that is now affect the latter Avast installation? If you think this is a possibility, you might want to try and clean Avira out completely before attempting another Avast install. Unfortunately, I am not familiar with Avira but I do know they have a clean uninstall methodology available that includes an Avira-specific registry cleaner and maybe another Avira utility as well. Just more food for thought.

23

Hi,

Actually I did have a mixture of freezes and BSOD’s prior so I don’t think its that. I did do a full ininstall and reboot beofre putting Avast back on too. Someting that might help other though.

I saw this while googl-ing: http://msdn.microsoft.com/en-us/library/ff545499.aspx

I’m going to give this a go so if I get a system freeze next time I can force a BSOD - assuming the system is not so far gone it won’t work. Ill let you know…

Cheers,
Paul

24

Hi again Paul,

I have the latest version of Avast running on Windows 8.1 Update 1 without issue; however, Avast is the only AV solution running on my rig. Also, my hardware is quite new and all components are compatible with 8.1. Your issue becomes more interesting as you provide additional information. Here’s hoping Avast support can logically “pull a rabbit out of a hat for you!”

25

I hope so too.

btw. That manual crash msdn article does work - not sure the dump it creates would be of much use though (going beyond my level of expertise here). It creates a dump like the following - btw. I did this manually initiated crash when the system was all good and dandy so if I have a freeze and do this then maybe it will mean more. I guess the field “PROCESS_NAME” will hold the runaway process that causes the lock-up. In the case below it is coincidentally filled with “mbamservice.ex” but remember the system was working fine when I did this test - I expect mbam was just doing its thing at the time. I will now try to bring about a real freeze…

** Example of a forced memory dump using technique in http://msdn.microsoft.com/en-us/library/ff545499(v=vs.85).aspx **

Microsoft (R) Windows Debugger Version 6.3.9600.17029 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\052214-22484-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred SRVC:\symbolshttp://msdl.microsoft.com/download/symbols
Symbol search path is: SRVC:\symbolshttp://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 8 Kernel Version 9600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 9600.17085.amd64fre.winblue_gdr.140330-1035
Machine Name:
Kernel base = 0xfffff80281871000 PsLoadedModuleList = 0xfffff80281b3b2d0
Debug session time: Thu May 22 16:13:39.222 2014 (UTC + 1:00)
System Uptime: 0 days 0:01:02.976
Loading Kernel Symbols
.

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

…
…
…
Loading User Symbols
Loading unloaded module list
…

  •                                                                         *

  •                    Bugcheck Analysis                                    *

  •                                                                         *

Use !analyze -v to get detailed debugging information.

BugCheck E2, {0, 0, 0, 0}

Probably caused by : Unknown_Image ( ANALYSIS_INCONCLUSIVE )

Followup: MachineOwner

3: kd> !analyze -v

  •                                                                         *

  •                    Bugcheck Analysis                                    *

  •                                                                         *

MANUALLY_INITIATED_CRASH (e2)
The user manually initiated this crash dump.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000

Debugging Details:

DUMP_FILE_ATTRIBUTES: 0x8
Kernel Generated Triage Dump

BUGCHECK_STR: MANUALLY_INITIATED_CRASH

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

PROCESS_NAME: mbamservice.ex

CURRENT_IRQL: a

ANALYSIS_VERSION: 6.3.9600.17029 (debuggers(dbg).140219-1702) amd64fre

LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff802819c4fa0

STACK_TEXT:
ffffd0015d7f9ea8 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!KeBugCheckEx

STACK_COMMAND: kb

SYMBOL_NAME: ANALYSIS_INCONCLUSIVE

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: Unknown_Module

IMAGE_NAME: Unknown_Image

DEBUG_FLR_IMAGE_TIMESTAMP: 0

IMAGE_VERSION:

BUCKET_ID: ZEROED_STACK

FAILURE_BUCKET_ID: ZEROED_STACK

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:zeroed_stack

FAILURE_ID_HASH: {4af92c9d-8968-8d00-06f5-868dfba32e9a}

Followup: MachineOwner

26

If Avast support doesn’t resolve your issue and you still have the BSOD dumps available (or can generate some new ones), I would recommend you go here and seek assistance:

http://www.eightforums.com/bsod-crashes-debugging/

Follow the BSOD posting instructions which includes the need to download/run a special tool for collecting all necessary pre-analysis data. The resident Guru there is nicknamed Usasma. His real name is John Carrona and he is a Microsoft MVP who specializes in BSOD analyzation. I have watched him for years and his talents are amazing. IMHO, he has no equal in this area. Take a peek over there and you’ll see what I mean.

27

Nice one. I will give Avast support a few days to make a start and if no joy I will go over to Usasma and post a log there. Thanks for the tip. Most appreciated.

Paul

28

Sounds like a plan to me. Here is a link to Usasma’s website just in case you are interested in how he approaches BSOD analyzation in general.

http://www.carrona.org/howidoit.html

He takes many things into consideration and I believe he has automated much of this process (but not all). BTW, if you decide to go over there, tell John that “my2cents” said hello! I am also registered over there (as my2cents) and have worked through many Win 8 issues as well:

http://www.eightforums.com/member.php?u=28534

However, when it comes to BSODs, John is the man!