Stop 0x00000050 in aswmon2.sys

Earlier today I installed an additional 2 gigabytes of RAM in my computer. Taking it from 2Gb to 3.5Gb. Immediately after I did this I got a BSOD.

Anyways,I went to safe mode, uninstalled avast, restarted, and reinstalled avast after the restart, so far things seem okay, but there hasn’t really been enough time for me to be certain.

I am pretty sure it is not some error in the RAM because after the first BSOD I ran memtest long enough for it to check the RAM all the way through twice, that turned up no errors.

I think I have encountered errors like this in the past, when I have changed teh hardware, but I had not seen this forum so I did not know to try going to safe mode, unistall, etc.

Here is the output of windbg when it is used on the dump.

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: f2f718bc, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 804e8da4, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 00000002, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS:  f2f718bc 

FAULTING_IP: 
nt!MmOutPageKernelStack+169
804e8da4 ??              ???

MM_INTERNAL_CODE:  2

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0x50

LAST_CONTROL_TRANSFER:  from 80529170 to 8053767a

STACK_TEXT:  
b39388cc 80529170 00000050 f2f718bc 00000000 nt!MiRemoveUnusedSegments+0x3e3
b393891c 804e0944 00000000 f2f718bc 00000000 nt!GUID_DOCK_INTERFACE+0x234
b3938934 804e8da4 badb0d00 00000001 002e0000 nt!Dr_kitb_a+0x7
b39389b4 804f8978 c0c0003c 00000000 c62e2000 nt!MmOutPageKernelStack+0x169
b3938a38 804f8562 c62e2000 065cd73c 00000000 nt!KeStartThread+0x76
b3938ac8 80514474 8a214358 065cd73c b3938afc nt!KeTerminateThread+0x9f
b3938b4c b8788846 8a2bfbb0 002e2000 00000904 nt!RtlpStatusTable+0x5bc
b3938bb4 f7a32018 8a2bfbb0 b3938c24 00001000 Ntfs!NtfsCopyWriteA+0x23d
b3938be8 f7a3db99 00000004 00000000 b3938c1c fltmgr!FltpPerformFastIoCall+0x230
b3938c3c b3b41a8b 8a2bfbb0 b3938cd4 00001000 fltmgr!FltpFastIoWrite+0xa9
WARNING: Stack unwind information not available. Following frames may be wrong.
b3938c90 8057f8d5 8a2bfbb0 b3938cd4 00001000 aswMon2+0x6a8b
b3938d38 804dd99f 00000448 00000000 00000000 nt!ObQueryNameString+0x4cf
b3938d4c 046ffa68 065cd040 00001000 00000000 nt!ZwSetSystemPowerState+0xf
b3938d64 7c90e514 badb0d00 046ffa30 00000000 0x46ffa68
b3938d68 badb0d00 046ffa30 00000000 00000000 0x7c90e514
b3938d6c 046ffa30 00000000 00000000 00000000 0xbadb0d00
b3938d70 00000000 00000000 00000000 00000000 0x46ffa30


STACK_COMMAND:  kb

FOLLOWUP_IP: 
aswMon2+6a8b
b3b41a8b ??              ???

SYMBOL_STACK_INDEX:  a

SYMBOL_NAME:  aswMon2+6a8b

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: aswMon2

IMAGE_NAME:  aswMon2.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  4a8147fe

FAILURE_BUCKET_ID:  0x50_aswMon2+6a8b

BUCKET_ID:  0x50_aswMon2+6a8b

Please, go to folder \windows\minidump and send the newest (recent) .mdmp files for analysis. There is also C:\Windows\Memory.dmp file.
Better if you can compress (zip) them and add some information about the BSOD and the link for this thread. :wink:

Send an email to: vlk (at) avast.com
Or upload it to this anonymous ftp server: ftp://ftp.asw.cz/incoming

Besides Google also you can use:
MS knowledgebase: http://support.microsoft.com/search/?adv=1
Free memory tester (Run it overnight): http://www.memtest86.com/
XP error explanations: http://www.xptuneup.com/xptuneup_stopmessages.htm
BSODs: http://www.techmetica.com/howto/descriptions-and-fixes-of-blue-screen-of-death-bsod-crash-errors/

I uploaded the dump with the name submitted_by_jtm21.dmp .

Thank you for the links, but as I said before I ran memtest on my machine when I got the BSOD. It went through its full battery of tests twice. With four gigs of RAM, on my machine it can only get through the RAM 4 times overnight. Either way there is no error in the hardware. But, the rest of these links could be useful in the future, thank you.

Hello jtm21, looking at your minidump, BSOD was caused by invalid system memory address during writing I/O. Our driver (aswMon2.sys) doesn’t filter write I/Os, it just passes these requests down to the kernel. So, it still appears to be the RAM problem. I’d suggest you to give memtest86 tool (www.memtest86.com) another try. Have you checked CPU temp? Are you sure the 2nd mem module is compatible with your motherboard or with the 1st mem module?

btw, corrected windbg output:

b39388cc 80529170 00000050 f2f718bc 00000000 nt!KeBugCheckEx+0x1b
b393891c 804e0944 00000000 f2f718bc 00000000 nt!MmAccessFault+0x77e
b393891c 804e8da4 00000000 f2f718bc 00000000 nt!KiTrap0E+0xd0
b39389b4 804f8978 c0c0003c 00000000 c62e2000 nt!MiLocateAndReserveWsle+0x51
b3938a38 804f8562 c62e2000 065cd73c 00000000 nt!MmCopyToCachedPage+0x7bd
b3938ac8 80514474 8a214358 065cd73c b3938afc nt!CcMapAndCopy+0x1af
b3938b4c b8788846 8a2bfbb0 002e2000 00000904 nt!CcFastCopyWrite+0x230
b3938bb4 f7a32018 8a2bfbb0 b3938c24 00001000 Ntfs!NtfsCopyWriteA+0x23d
b3938be8 f7a3db99 00000004 00000000 b3938c1c fltmgr!FltpPerformFastIoCall+0x230
b3938c3c b3b41a8b 8a2bfbb0 b3938cd4 00001000 fltmgr!FltpFastIoWrite+0xa9
b3938c90 8057f8d5 8a2bfbb0 b3938cd4 00001000 aswMon2!AvMonFastIoWrite+0x99
b3938d38 804dd99f 00000448 00000000 00000000 nt!NtWriteFile+0x30b
b3938d38 7c90e514 00000448 00000000 00000000 nt!KiFastCallEntry+0xfc

I have run memtest repeatedly, it shows no errors. The RAM modules I inserted are exactly the same as those that were already in there. I will accept that the error must be further up than avast.

Is there any way to get the symbols for avast so that Windbg can produce correct output?

Sorry, but we don’t provide public/private avast symbols; to see nt kernel stack, just press Ctrl+S from WinDbg, insert [b]srvc:\symbolshttp://msdl.microsoft.com/download/symbols[/b], check Reload and click OK.

If you have more minidumps, you can upload them on our ftp server and I’ll look at them. However, I’m quite sure, all other BSODs will be somehow memory (or hw) related…