BSOD fingering AVAST as probable cause

Avast Free Antivirus / Premium Security
1

:o Had this for a while now - seems to be most common when i’m using my work’s JAVA based front end for remote working

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRVc:\symbolshttp://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.090206-1234
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Fri Jul 31 10:07:20.390 2009 (GMT+1)
System Uptime: 0 days 0:47:06.083
Loading Kernel Symbols
…
…
…
Loading User Symbols

Loading unloaded module list
…

  •                                                                         *

  •                    Bugcheck Analysis                                    *

  •                                                                         *

Use !analyze -v to get detailed debugging information.

BugCheck C5, {4, 2, 1, 8054b1fa}

*** ERROR: Module load completed but symbols could not be loaded for aswSP.SYS
Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+1f4 )

Followup: Pool_corruption

This is from this morning - normally windbg fingers aswSP.sys as the probable cause.

Is there somewhere I can upload a kernel memory dump for you guys? I’d like to get to the bottom of this and obviously i lack the debug symbols for AVAST :wink:

Many thanks for your help!

2

I don’t know much about debugging tools, but I can tell you that the file aswSP.sys is the Avast self protection module.
You could try disabling it (Right click tray icon>program settings>troubleshooting) and then try the dump file thing.
Sorry to be so ignorant.

3

Sorry for the troubles.
Please upload the kernel dump (compressed, with a unique name) to ftp://ftp.avast.com/incoming (write-only access).

Thanks
Vlk

4

Hey thanks for your help - ok i’m uploading it now filename is “MEMORY_dangel_fri_32st.rar” should take about 20 mins.

Edit: sorry slow transfer speeds - check in 10 mins and it’ll definitely be done.

I’ve disabled the self-protection as per previous post and i’ll see if i can cause another BSOD (it’s pretty consistant) post modification.

5

Well so far no BSOD with self-protection off - will continue to use my JAVA client (netilla) for a few hours…

6

So should i just disable self protection forever? :frowning:

7

It shouldn’t be the case… Hope Vlk could troubleshoot this in another way.

8

Well nothing happened so i decided to install a new operating system - Windows 7 - which hasn’t yet had this problem. Shame AVAST won’t get fixed but meh…