avast was recommended to me by quite a few techies. However, since I installed it two months ago, my laptop, a Dell Inspiron 1525 which runs on Vista, has been blue screening.
Event manager has given the following error messages:
The computer has rebooted from a bugcheck. The bugcheck was: 0x0000008e (0xc0000005, 0x005a0053, 0x949dac50, 0x00000000). A dump was saved in: C:\Windows\MEMORY.DMP.
The computer has rebooted from a bugcheck. The bugcheck was: 0x000000d1 (0x0032003b, 0x00000002, 0x00000001, 0x8d3721b9). A dump was saved in: C:\Windows\MEMORY.DMP.
The computer has rebooted from a bugcheck. The bugcheck was: 0x000000d1 (0x00000015, 0x00000002, 0x00000001, 0x8d7521b9). A dump was saved in: C:\Windows\MEMORY.DMP.
I’ve also noticed messages about:
driver irql not less or equal
fault page in nonpaged area
aswSP.sys
I’ve asked on various techie forums for help and they said aswSP.sys is an avast driver.
I am using the free version and it’s 110528-1.
Please can you give me some advice. Also, I’m not very tech savvy, so please explain as if speaking to a child!!
If you need any more info, please let me know.
Thank you.
The aswSP.sys is the avast self protection driver.
Upload any minidump or memory.dmp files (only the latest memory.dmp file), zipped to reduce size. Give the zip file you are uploading a unique name (e.g. m0unds-mem-dump.zip, etc), so they can identify it. It might not be a bad idea to create a text file (readme.txt) with any relevant information, avast topic, user name, etc. etc. in the zip file.
Using Internet Explorer, Connect to the link and drag the file into the Right pane and drop it, that starts the upload, you don’t have read access to this folder.
Or
Upload it using the Run command-line in Windows: Windows Key + R (to get the run box), copy and paste this
explorer ftp://ftp.avast.com/incoming
and drag the file into the window, from another explorer window.
Have (or did) you another Anti-Virus installed in this system, if so what was it and how did you get rid of it ?
Thanks for your quick response David. It’s just this minute BSOD again :-[.
The anti-virus I used to use was Anti-Vir and AVG ver8.5. I removed AVG using AVG removal tool, then checked with Appremover to confirm it had been removed. Avira AntiVir I removed with Appremover.
If you have notepad, you use that to use as a text editor and enter the suggested information. When you have done that, just save it and give it the name ReadMe.txt done.
You need to have a zip (archiving program), if you have got one then some will allow you to open the archive and either select add or drag and drop the readme.txt file into the zip archive.
If you haven’t got one, I use 7zip, which is fairly easy to use, www.7-zip.org, it is a free application.
I’ve just uploaded the zip file. I called it Elle8 m0unds-mem-dump.zip and I think the readme.txt dragged into it fine.
I’ve done the Anti-Vir registry cleaner and there were some items left. I deleted most of them, but five items failed to delete:
H_KEY_LOCAL\MACHINE\SYSTEM\CONTROLSET001\SERVICES\avast! ANTIVIR
H_KEY_LOCAL\MACHINE\SYSTEM\CONTROLSET002\SERVICES\avast! ANTIVIR
H_KEY_LOCAL\MACHINE\SYSTEM\CONTROLSET003\SERVICES\avast! ANTIVIR
H_KEY_LOCAL\MACHINE\SYSTEM\CONTROLSET004\SERVICES\avast! ANTIVIR
H_KEY_LOCAL\MACHINE\SYSTEM\Services\avast! ANTIVIR
Well since those are avast antivir [us] the US bit being dropped off the end, all very confusing, but they are protected by the avast self-defence module and windows shouldn’t allow them to be deleted since they are in use.
Nothing odd, just an unfortunate coincidence that the full registry key has been concatenated dropping the most important part the last two digits US so it looks like ANTIVIR (the alternate name of avira) and not ANTIVIRUS.
Unless you actually use an ftp program (rather than my suggested options), you won’t know as you don’t have read permission on the avast.com/incoming folder. With an ftp program, they usually report successful completion of the upload.
If they did receive it and you gave the link to the topic, generally they will get back to you in the topic.
I’ve just done a HiJack this and uploaded it here too in case there’s anything of interest.
Thanks:
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 15:47:47, on 29/05/2011
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.19048)
Boot mode: Normal
That’s why I mentioned it in the initial instructions on readme.txt contents, or they are unlikely to know who it is from or how to respond. I will highlight that in future so it is clearer.
I missed your HJT log last time round, but to be honest, it is a bit of a busted flush as it hasn’t been updated in a very long time and malware has progressed into areas that it doesn’t even look. A security application has to be up to date or it is worthless.
Didn’t see anything obvious in it, but you appear to have remnants of AVG:
O20 - AppInit_DLLs: AVGRSSTX.DLL
This could be a contributory factor in a BSOD (conflict, etc.) so you could elect to fix this in HJT. Or run their removal tool.
Ensure that all remnants of AVG are gone - AVG8.x (or higher) Remover, download tool from here, http://www.avg.com/download-tools there is a 32bit and 64 bit windows version, ensure you use the correct one.