BSOD at every shutdown

CSEngineer · 2015-03-29T02:42:22.000Z

I have a similar problem, but I’ve pinned it down so I can reproduce it about 80% of the time. Windows 8.1 gives a BSOD consistently when I dismount a TrueCrypt file container. Also happens much more infrequent when I remove a USB flashdrive. Started having this problem after the latest Avast update, never had it with previous versions. Debug follows:

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff802ca74d596, The address that the exception occurred at
Arg3: ffffd00194f36978, Exception Record Address
Arg4: ffffd00194f36180, Context Record Address

Debugging Details:
------------------


DUMP_FILE_ATTRIBUTES: 0x8
  Kernel Generated Triage Dump

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!ExfReleaseRundownProtection+6
fffff802`ca74d596 488b09          mov     rcx,qword ptr [rcx]

EXCEPTION_RECORD:  ffffd00194f36978 -- (.exr 0xffffd00194f36978)
ExceptionAddress: fffff802ca74d596 (nt!ExfReleaseRundownProtection+0x0000000000000006)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 0000000000000008
Attempt to read from address 0000000000000008

CONTEXT:  ffffd00194f36180 -- (.cxr 0xffffd00194f36180;r)
rax=00000000c0000022 rbx=0000000000000007 rcx=0000000000000008
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000001
rip=fffff802ca74d596 rsp=ffffd00194f36bb8 rbp=ffffc00160db2be0
 r8=0000000000000008  r9=ffffd00194f36a40 r10=fffff802ca95ae80
r11=ffffd00194f36b00 r12=ffffe0012069c000 r13=0000000000000000
r14=ffffc0015290cbe0 r15=ffffe0012062dcf0
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0000  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
nt!ExfReleaseRundownProtection+0x6:
fffff802`ca74d596 488b09          mov     rcx,qword ptr [rcx] ds:002b:00000000`00000008=????????????????
Last set context:
rax=00000000c0000022 rbx=0000000000000007 rcx=0000000000000008
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000001
rip=fffff802ca74d596 rsp=ffffd00194f36bb8 rbp=ffffc00160db2be0
 r8=0000000000000008  r9=ffffd00194f36a40 r10=fffff802ca95ae80
r11=ffffd00194f36b00 r12=ffffe0012069c000 r13=0000000000000000
r14=ffffc0015290cbe0 r15=ffffe0012062dcf0
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0000  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
nt!ExfReleaseRundownProtection+0x6:
fffff802`ca74d596 488b09          mov     rcx,qword ptr [rcx] ds:002b:00000000`00000008=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000000000008

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff802ca9d5138
unable to get nt!MmNonPagedPoolStart
unable to get nt!MmSizeOfNonPagedPoolInBytes
 0000000000000008 

FOLLOWUP_IP: 
aswMonFlt+60e6
fffff801`00ba60e6 ??              ???

BUGCHECK_STR:  AV

DEFAULT_BUCKET_ID:  NULL_CLASS_PTR_DEREFERENCE

ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) amd64fre

LAST_CONTROL_TRANSFER:  from fffff80100ba60e6 to fffff802ca74d596

STACK_TEXT:  
ffffd001`94f36bb8 fffff801`00ba60e6 : 00000000`00000001 fffff801`00bac830 00000000`a8d683c3 00000000`00001b8d : nt!ExfReleaseRundownProtection+0x6
ffffd001`94f36bc0 00000000`00000001 : fffff801`00bac830 00000000`a8d683c3 00000000`00001b8d ffffd001`94f36c68 : aswMonFlt+0x60e6
ffffd001`94f36bc8 fffff801`00bac830 : 00000000`a8d683c3 00000000`00001b8d ffffd001`94f36c68 ffffd001`94f36ca0 : 0x1
ffffd001`94f36bd0 00000000`a8d683c3 : 00000000`00001b8d ffffd001`94f36c68 ffffd001`94f36ca0 00000000`00000000 : aswMonFlt+0xc830
ffffd001`94f36bd8 00000000`00001b8d : ffffd001`94f36c68 ffffd001`94f36ca0 00000000`00000000 00000000`00000000 : 0xa8d683c3
ffffd001`94f36be0 ffffd001`94f36c68 : ffffd001`94f36ca0 00000000`00000000 00000000`00000000 ffffe001`00000007 : 0x1b8d
ffffd001`94f36be8 ffffd001`94f36ca0 : 00000000`00000000 00000000`00000000 ffffe001`00000007 ffffd001`00000001 : 0xffffd001`94f36c68
ffffd001`94f36bf0 00000000`00000000 : 00000000`00000000 ffffe001`00000007 ffffd001`00000001 ffffe001`00000020 : 0xffffd001`94f36ca0


SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  aswMonFlt+60e6

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: aswMonFlt

IMAGE_NAME:  aswMonFlt.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  54f45429

STACK_COMMAND:  .cxr 0xffffd00194f36180 ; kb

FAILURE_BUCKET_ID:  AV_aswMonFlt+60e6

BUCKET_ID:  AV_aswMonFlt+60e6

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:av_aswmonflt+60e6

FAILURE_ID_HASH:  {b2b6d12b-9d74-103e-1256-3bd74dcb76c3}

Followup: MachineOwner
---------

0: kd> lmvm aswMonFlt
start             end                 module name
fffff801`00ba0000 fffff801`00bc3000   aswMonFlt T (no symbols)           
    Loaded symbol image file: aswMonFlt.sys
    Image path: aswMonFlt.sys
    Image name: aswMonFlt.sys
    Timestamp:        Mon Mar 02 06:14:33 2015 (54F45429)
    CheckSum:         0001FE48
    ImageSize:        00023000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Rednose · 2015-03-29T03:24:45.000Z

Hi guys

Can you please follow this procedure : https://www.avast.com/en-eu/faq.php?article=AVKB33#idt_01

In step 5 select “Full dumps”,.
Don’t make a ticket, but post the Support Package File ID in your next reply.

Greetz, Red.

EDIT : Modified procedure.

Eddy · 2015-03-29T08:30:02.000Z

There are several issues know after upgrading to the latest version.
Many are solved when you do a clean installation.

CSEngineer · 2015-03-30T04:14:05.000Z

Reinstall was no help.

I submitted a ticket and a “full dump” as suggested to Avast. I’ll update when I get a response.

system · 2015-03-31T07:56:52.000Z

Hello and greetings!

I have the same problems: Bluescreens / BSOD on shutdown, SYSTEM_THREAD_EXCEPTION_NOT_HANDLED
With WinDbg it can be traced down to aswMonFlt.sys. I also use TrueCrypt.

Also same as with CSEngineer: nt!ExfReleaseRundownProtection+0x7 ???

Are there any news to this topic?

Asyn · 2015-03-31T08:58:43.000Z

See: Reply #2

Endt · 2015-03-31T09:15:54.000Z

Hello CSEngineer,

We got your support package and we will have a closer look on your issue.

Thanks,
B.

Endt · 2015-03-31T10:31:01.000Z

Hi all,

thanks for the report. The problem with Truecrypt and generally with aswMonFlt.sys is issued now, we should be able to fix it in next SP the latest.

Cheers,
B.

bob3160 · 2015-03-31T11:37:42.000Z

Endt post:9:

Hi all,

thanks for the report. The problem with Truecrypt and generally with aswMonFlt.sys is issued now, we should be able to fix it in next SP the latest.

Cheers,
B.

Any expected release date for that next Service Pack ???

system · 2015-03-31T14:46:06.000Z

I also uploaded a “full dump”. Hope this helps.

But as every shutdown has a chance of loosing data from disk ( I already lost some files - dont know what damage is done without notice… )
I have the same question as bob3160:

When is the Service Pack scheduled?

Endt · 2015-03-31T16:04:12.000Z

Hello and thanks,

next time, you don’t have to make a ticket at support but post the package id here (you have to tick the option to send it to avast), also in your package is MEMOMRY.dmp missing (it’s logical when it has only 14MB - maybe your windows are not configured to create full dumps). And the last thing, if it’s about the same issue it isn’t necessary to upload GBs of data

Again thanks for your report,
B.

system · 2015-03-31T18:15:30.000Z

Hello,

so the “full dump” was just a dump. Let me know if it helps to create and send a MEMOMRY.dmp.
Regarding the size, it might be a bit tricky to upload - and take lots of time and traffic here…

Have a nice day.

system · 2015-04-03T11:22:55.000Z

Having the same problem…any due date for the next service pack available/estimated? :-\

Rednose · 2015-04-03T12:04:43.000Z

JoergO post:14:

Having the same problem…any due date for the next service pack available/estimated? :-\

Hi JoergO, welcome to the forum

You are using TrueCript ? I that case you have nothing to do.
If you are not using TrueCript, follow the procedure from Reply #2, and start a new topic.

We don’t know anything about the next service pack yet.

Greetz, Red.

system · 2015-04-17T17:04:40.000Z

Hello,

Since two weeks passed since the last message - are there any updates on this topic for us?

Have a nice weekend,
Florian

essexboy · 2015-04-17T17:09:01.000Z

TheMidgeG post:16:

Hello,

Since two weeks passed since the last message - are there any updates on this topic for us?

Have a nice weekend,
Florian

The beta is being tested now

system · 2015-04-17T17:10:15.000Z

Thanks for the quick answer!

essexboy · 2015-04-17T17:12:09.000Z

https://forum.avast.com/index.php?topic=169573.0

CSEngineer · 2015-04-30T02:35:03.000Z

Avast client just updated to 2015.10.2.2218. I’ll update in a few days on whether that corrects the problem.

CSEngineer · 2015-05-19T05:01:02.000Z

Oops, more than a few days, but at least I can say it is thoroughly tested now. I have not seen the issue since updating to the latest version about 3 weeks ago. I call the issue solved.

Announcements