Identical issue here with a client’s notebook using a paid subscription of Avast Internet Security after recent Windows build update. Brand new high end ASUS GL752VW system. I’ve been managing their systems for quite some time now as well as a few custom built systems I’ve made. This issue has only occurred on the newer ASUS notebook; obviously a conflict. Windows 10 Build 14393.10 (AE) results in “SYSTEM_THREAD_EXCEPTION_NOT_HANDLED” BSOD on each boot. Removing the Avast asw*.sys files from \Windows\System32\Drivers results in system booting successfully. Updated BIOS, Onboard GPU, Dedicated GPU, Audio, LAN, WAN, Motherboard Chipset, Bluetooth, SATA drivers, etc and Avast still causes a BSOD reboot loop of death. Removed from client’s PC for now until this is resolved.
Unfortunately, I deleted all the crash dumps prior to seeing this thread; however, I did debug a couple. Sadly, debugging the dumps did not narrow down the conflict with Avast’s driver files. Here are the results:
BugCheck 7E, {ffffffffc000001d, fffff80309dd2109, ffffa38111673518, ffffa38111672d40}
Probably caused by : ntkrnlmp.exe ( nt!SwapContext+a9 )
Followup: MachineOwner
6: kd> !analyze -v
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc000001d, The exception code that was not handled
Arg2: fffff80309dd2109, The address that the exception occurred at
Arg3: ffffa38111673518, Exception Record Address
Arg4: ffffa38111672d40, Context Record Address
Debugging Details:
DUMP_CLASS: 1
DUMP_QUALIFIER: 401
BUILD_VERSION_STRING: 14393.0.amd64fre.rs1_release.160715-1616
DUMP_TYPE: 1
BUGCHECK_P1: ffffffffc000001d
BUGCHECK_P2: fffff80309dd2109
BUGCHECK_P3: ffffa38111673518
BUGCHECK_P4: ffffa38111672d40
EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION} Illegal Instruction An attempt was made to execute an illegal instruction.
FAULTING_IP:
nt!SwapContext+a9
fffff803`09dd2109 0fc729 xsaves [rcx]
EXCEPTION_RECORD: ffffa38111673518 – (.exr 0xffffa38111673518)
ExceptionAddress: fffff80309dd2109 (nt!SwapContext+0x00000000000000a9)
ExceptionCode: c000001d (Illegal instruction)
ExceptionFlags: 00000000
NumberParameters: 0
CONTEXT: ffffa38111672d40 – (.cxr 0xffffa38111672d40)
rax=000000000000001c rbx=ffffa38111280180 rcx=ffffa38111673c40
rdx=0000000000000000 rsi=ffffa3811128ccc0 rdi=ffffe100edc0a040
rip=fffff80309dd2109 rsp=ffffa38111673750 rbp=000000edbd9bbfff
r8=0000000000000003 r9=0000000000000028 r10=0000000000000001
r11=00000000000003f8 r12=00000000000003f8 r13=0000000000000001
r14=ffffe100edc0a048 r15=0000000000000000
iopl=0 nv up ei pl zr na po cy
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00210247
nt!SwapContext+0xa9:
fffff803`09dd2109 0fc729 xsaves [rcx]
Resetting default scope
CPU_COUNT: 8
CPU_MHZ: a20
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 5e
CPU_STEPPING: 3
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: AV
PROCESS_NAME: System
CURRENT_IRQL: 2
ERROR_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION} Illegal Instruction An attempt was made to execute an illegal instruction.
EXCEPTION_CODE_STR: c000001d
ANALYSIS_SESSION_HOST: TBO
ANALYSIS_SESSION_TIME: 08-03-2016 04:27:45.0753
ANALYSIS_VERSION: 10.0.10586.567 amd64fre
BAD_STACK_POINTER: ffffa38111673750
LAST_CONTROL_TRANSFER: from fffff80309dd1da6 to fffff80309dd2109
FAILED_INSTRUCTION_ADDRESS:
nt!SwapContext+a9
fffff803`09dd2109 0fc729 xsaves [rcx]
STACK_TEXT:
ffffa38111673750 fffff803
09dd1da6 : ffffe100e8fe6060 fffff803
09ca207a ffffe100ea700000 00000000
00269faf : nt!SwapContext+0xa9
ffffa38111673790 fffff803
09cbccdc : 0000000000000000 00000000
00000001 0000000000000502 fffff803
09d1c897 : nt!KiSwapContext+0x76
ffffa381116738d0 fffff803
09ce9288 : ffffe100edc0a040 fffff803
00000000 ffffe100edc0a048 fffff803
09ce9bba : nt!KiSwapThread+0x17c
ffffa38111673980 fffff803
0a0ac684 : ffffe100edc0a600 00000000
00000000 0000000000000000 ffffe100
edc0a040 : nt!KeTerminateThread+0x17c
ffffa38111673a10 fffff803
0a0c2c56 : ffffe10000000000 ffffe100
edc0a040 0000000000000000 ffffe100
e8ea7040 : nt!PspExitThread+0x328
ffffa38111673b50 fffff803
09d1f4bd : ffffe100edc0a040 00000000
00000080 fffff80ade12e590 ffffe100
edc0a040 : nt!PspTerminateThreadByPointer+0x96
ffffa38111673b90 fffff803
09dd2456 : fffff80309fc5180 ffffe100
edc0a040 fffff80309d1f47c 00000000
00000000 : nt!PspSystemThreadStartup+0x41
ffffa38111673be0 00000000
00000000 : ffffa38111674000 ffffa381
1166d000 0000000000000000 00000000
00000000 : nt!KiStartSystemThread+0x16
THREAD_SHA1_HASH_MOD_FUNC: ea0e8700cafffeab3340e261e2240411c3be9ab4
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 98688cedda0ef7027ba1a79a4d0e8683c39508a6
THREAD_SHA1_HASH_MOD: cb5f414824c2521bcc505eaa03e92fa10922dad8
FOLLOWUP_IP:
nt!SwapContext+a9
fffff803`09dd2109 0fc729 xsaves [rcx]
FAULT_INSTR_CODE: eb29c70f
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!SwapContext+a9
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 578998f1
IMAGE_VERSION: 10.0.14393.0
STACK_COMMAND: .cxr 0xffffa38111672d40 ; kb
BUCKET_ID_FUNC_OFFSET: a9
FAILURE_BUCKET_ID: AV_STACKPTR_ERROR_BAD_IP_nt!SwapContext
BUCKET_ID: AV_STACKPTR_ERROR_BAD_IP_nt!SwapContext
PRIMARY_PROBLEM_CLASS: AV_STACKPTR_ERROR_BAD_IP_nt!SwapContext
TARGET_TIME: 2016-08-03T08:01:00.000Z
OSBUILD: 14393
OSSERVICEPACK: 0
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2016-07-15 22:16:17
BUILDDATESTAMP_STR: 160715-1616
BUILDLAB_STR: rs1_release
BUILDOSVER_STR: 10.0.14393.0.amd64fre.rs1_release.160715-1616
ANALYSIS_SESSION_ELAPSED_TIME: ae2
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:av_stackptr_error_bad_ip_nt!swapcontext
FAILURE_ID_HASH: {79bc9c3c-9f59-2583-44ac-cf3dcaa205fc}
Followup: MachineOwner
6: kd> !analyze -v
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc000001d, The exception code that was not handled
Arg2: fffff80309dd2109, The address that the exception occurred at
Arg3: ffffa38111673518, Exception Record Address
Arg4: ffffa38111672d40, Context Record Address
Debugging Details:
DUMP_CLASS: 1
DUMP_QUALIFIER: 401
BUILD_VERSION_STRING: 14393.0.amd64fre.rs1_release.160715-1616
DUMP_TYPE: 1
BUGCHECK_P1: ffffffffc000001d
BUGCHECK_P2: fffff80309dd2109
BUGCHECK_P3: ffffa38111673518
BUGCHECK_P4: ffffa38111672d40
EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION} Illegal Instruction An attempt was made to execute an illegal instruction.
FAULTING_IP:
nt!SwapContext+a9
fffff803`09dd2109 0fc729 xsaves [rcx]
EXCEPTION_RECORD: ffffa38111673518 – (.exr 0xffffa38111673518)
ExceptionAddress: fffff80309dd2109 (nt!SwapContext+0x00000000000000a9)
ExceptionCode: c000001d (Illegal instruction)
ExceptionFlags: 00000000
NumberParameters: 0
CONTEXT: ffffa38111672d40 – (.cxr 0xffffa38111672d40)
rax=000000000000001c rbx=ffffa38111280180 rcx=ffffa38111673c40
rdx=0000000000000000 rsi=ffffa3811128ccc0 rdi=ffffe100edc0a040
rip=fffff80309dd2109 rsp=ffffa38111673750 rbp=000000edbd9bbfff
r8=0000000000000003 r9=0000000000000028 r10=0000000000000001
r11=00000000000003f8 r12=00000000000003f8 r13=0000000000000001
r14=ffffe100edc0a048 r15=0000000000000000
iopl=0 nv up ei pl zr na po cy
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00210247
nt!SwapContext+0xa9:
fffff803`09dd2109 0fc729 xsaves [rcx]
Resetting default scope
CPU_COUNT: 8
CPU_MHZ: a20
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 5e
CPU_STEPPING: 3
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: AV
PROCESS_NAME: System
CURRENT_IRQL: 2
ERROR_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION} Illegal Instruction An attempt was made to execute an illegal instruction.
EXCEPTION_CODE_STR: c000001d
ANALYSIS_SESSION_HOST: TBO
ANALYSIS_SESSION_TIME: 08-03-2016 04:29:08.0146
ANALYSIS_VERSION: 10.0.10586.567 amd64fre
BAD_STACK_POINTER: ffffa38111673750
LAST_CONTROL_TRANSFER: from fffff80309dd1da6 to fffff80309dd2109
FAILED_INSTRUCTION_ADDRESS:
nt!SwapContext+a9
fffff803`09dd2109 0fc729 xsaves [rcx]
STACK_TEXT:
ffffa38111673750 fffff803
09dd1da6 : ffffe100e8fe6060 fffff803
09ca207a ffffe100ea700000 00000000
00269faf : nt!SwapContext+0xa9
ffffa38111673790 fffff803
09cbccdc : 0000000000000000 00000000
00000001 0000000000000502 fffff803
09d1c897 : nt!KiSwapContext+0x76
ffffa381116738d0 fffff803
09ce9288 : ffffe100edc0a040 fffff803
00000000 ffffe100edc0a048 fffff803
09ce9bba : nt!KiSwapThread+0x17c
ffffa38111673980 fffff803
0a0ac684 : ffffe100edc0a600 00000000
00000000 0000000000000000 ffffe100
edc0a040 : nt!KeTerminateThread+0x17c
ffffa38111673a10 fffff803
0a0c2c56 : ffffe10000000000 ffffe100
edc0a040 0000000000000000 ffffe100
e8ea7040 : nt!PspExitThread+0x328
ffffa38111673b50 fffff803
09d1f4bd : ffffe100edc0a040 00000000
00000080 fffff80ade12e590 ffffe100
edc0a040 : nt!PspTerminateThreadByPointer+0x96
ffffa38111673b90 fffff803
09dd2456 : fffff80309fc5180 ffffe100
edc0a040 fffff80309d1f47c 00000000
00000000 : nt!PspSystemThreadStartup+0x41
ffffa38111673be0 00000000
00000000 : ffffa38111674000 ffffa381
1166d000 0000000000000000 00000000
00000000 : nt!KiStartSystemThread+0x16
THREAD_SHA1_HASH_MOD_FUNC: ea0e8700cafffeab3340e261e2240411c3be9ab4
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 98688cedda0ef7027ba1a79a4d0e8683c39508a6
THREAD_SHA1_HASH_MOD: cb5f414824c2521bcc505eaa03e92fa10922dad8
FOLLOWUP_IP:
nt!SwapContext+a9
fffff803`09dd2109 0fc729 xsaves [rcx]
FAULT_INSTR_CODE: eb29c70f
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!SwapContext+a9
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 578998f1
IMAGE_VERSION: 10.0.14393.0
STACK_COMMAND: .cxr 0xffffa38111672d40 ; kb
BUCKET_ID_FUNC_OFFSET: a9
FAILURE_BUCKET_ID: AV_STACKPTR_ERROR_BAD_IP_nt!SwapContext
BUCKET_ID: AV_STACKPTR_ERROR_BAD_IP_nt!SwapContext
PRIMARY_PROBLEM_CLASS: AV_STACKPTR_ERROR_BAD_IP_nt!SwapContext
TARGET_TIME: 2016-08-03T08:01:00.000Z
OSBUILD: 14393
OSSERVICEPACK: 0
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2016-07-15 22:16:17
BUILDDATESTAMP_STR: 160715-1616
BUILDLAB_STR: rs1_release
BUILDOSVER_STR: 10.0.14393.0.amd64fre.rs1_release.160715-1616
ANALYSIS_SESSION_ELAPSED_TIME: b02
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:av_stackptr_error_bad_ip_nt!swapcontext
FAILURE_ID_HASH: {79bc9c3c-9f59-2583-44ac-cf3dcaa205fc}