BSOD ntfs.sys (Ntfs+0x5A88)

unkka89 · 06 Jul 2015

System Information (local)
--------------------------------------------------------------------------------

computer name: UNKKA-PC
windows version: Windows 7 Service Pack 1, 6.1, build: 7601
windows dir: C:\Windows
Hardware: ASUSTeK Computer INC., M4A87TD/USB3
CPU: AuthenticAMD AMD Phenom(tm) II X6 1055T Processor AMD586, level: 16
6 logical processors, active mask: 63
RAM: 4293058560 total

--------------------------------------------------------------------------------
Crash Dump Analysis
--------------------------------------------------------------------------------

Crash dump directory: C:\Windows\Minidump

Crash dumps are enabled on your computer.

On Tue 30.6.2015 4:23:51 GMT your computer crashed
crash dump file: C:\Windows\Minidump\063015-37128-01.dmp
This was probably caused by the following module: ntfs.sys (Ntfs+0x5A88)
Bugcheck code: 0x24 (0x1904FB, 0xFFFFF88009570288, 0xFFFFF8800956FAE0, 0xFFFFF80002ECF4D4)
Error: NTFS_FILE_SYSTEM
file path: C:\Windows\system32\drivers\ntfs.sys
product: Microsoft® Windows® -käyttöjärjestelmä
company: Microsoft Corporation
description: NT File System Driver
Bug check description: This indicates a problem occurred in the NTFS file system.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.

On Tue 30.6.2015 4:23:51 GMT your computer crashed
crash dump file: C:\Windows\memory.dmp
This was probably caused by the following module: ntfs.sys (Ntfs+0x5A88)
Bugcheck code: 0x24 (0x1904FB, 0xFFFFF88009570288, 0xFFFFF8800956FAE0, 0xFFFFF80002ECF4D4)
Error: NTFS_FILE_SYSTEM
file path: C:\Windows\system32\drivers\ntfs.sys
product: Microsoft® Windows® -käyttöjärjestelmä
company: Microsoft Corporation
description: NT File System Driver
Bug check description: This indicates a problem occurred in the NTFS file system.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.

**cluberti** · 06 Jul 2015

It's hard to read the root cause from this minidump, but the driver here appears to be one of Avast's binaries (aswSP.sys):

Code:

2: kd> !thread
GetPointerFromAddress: unable to read from fffff80002f00000
THREAD fffffa8005110b60  Cid 0004.01a0  Teb: 0000000000000000 Win32Thread: 0000000000000000 RUNNING on processor 2
IRP List:
    Unable to read nt!_IRP @ fffffa800745f750
Not impersonating
GetUlongFromAddress: unable to read from fffff80002e3dba4
Owning Process            fffffa8003b55040       Image:         System
Attached Process          N/A            Image:         N/A
fffff78000000000: Unable to get shared data
Wait Start TickCount      3420420      
Context Switch Count      20003          IdealProcessor: 2             
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
UserTime                  00:00:00.000
KernelTime                00:00:00.000
Win32 Start Address aswSP (0xfffff88004574e6c)
Stack Init fffff88003ba1db0 Current fffff88003ba17e0
Base fffff88003ba2000 Limit fffff88003b9c000 Call 0
Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5
Child-SP          RetAddr           : Args to Child                                                           : Call Site
fffff880`03b9ffc8 fffff880`0124fa88 : 00000000`00000024 00000000`001904fb fffff880`03ba0fa8 fffff880`03ba0800 : nt!KeBugCheckEx
fffff880`03b9ffd0 fffff880`0133e3e7 : fffff880`0129a7dc fffff880`03ba1370 fffff880`03ba1370 00000000`00000000 : Ntfs! ?? ::FNODOBFM::`string'+0x2b49
fffff880`03ba0010 fffff800`02cfb4ec : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs! ?? ::NNGAKEGL::`string'+0x83b8
fffff880`03ba0050 fffff800`02cfaf6d : fffff880`0129a7d0 fffff880`03ba1370 00000000`00000000 fffff880`0124a000 : nt!_C_specific_handler+0x8c
fffff880`03ba00c0 fffff800`02cf9d45 : fffff880`0129a7d0 fffff880`03ba0138 fffff880`03ba0fa8 fffff880`0124a000 : nt!RtlpExecuteHandlerForException+0xd
fffff880`03ba00f0 fffff800`02d0adc1 : fffff880`03ba0fa8 fffff880`03ba0800 fffff880`00000000 00000000`00000038 : nt!RtlDispatchException+0x415
fffff880`03ba07d0 fffff800`02ccecc2 : fffff880`03ba0fa8 00000000`00000000 fffff880`03ba1050 00000000`00000000 : nt!KiDispatchException+0x135
fffff880`03ba0e70 fffff800`02ccd5ca : fffffa80`0745f750 fffff800`02ce12fc 00000000`00000000 fffffa80`050a0d00 : nt!KiExceptionDispatch+0xc2
fffff880`03ba1050 fffff880`012583f5 : fffff880`012d791d fffff8a0`02b06140 fffff880`012579bb fffff880`03ba1410 : nt!KiGeneralProtectionFault+0x10a (TrapFrame @ fffff880`03ba1050)
fffff880`03ba11e8 fffff880`012d791d : fffff8a0`02b06140 fffff880`012579bb fffff880`03ba1410 fffffa80`0745f750 : Ntfs!memcpy+0x1e5
fffff880`03ba11f0 fffff880`012d8ea1 : fffff880`03ba1410 fffff880`03ba1620 fffff880`03ba1410 fffff8a0`039e2100 : Ntfs!NtfsQueryNameInfo+0x135
fffff880`03ba1290 fffff880`012d7346 : fffff880`03ba1410 fffffa80`0745f750 fffff880`000001a0 fffffa80`000001dc : Ntfs!NtfsCommonQueryInformation+0x621
fffff880`03ba1370 fffff880`012d7b14 : fffff880`03ba1410 fffffa80`0745f750 fffffa80`0745faf0 00000000`00000000 : Ntfs!NtfsFsdDispatchSwitch+0x106
fffff880`03ba13f0 fffff880`010dcbcf : fffff880`03ba1690 fffff880`010dd329 fffff880`03ba1600 00000000`00010205 : Ntfs!NtfsFsdDispatchWait+0x14
fffff880`03ba15e0 fffff880`010db6df : fffffa80`04afdde0 fffffa80`04afdde0 fffffa80`04afdd00 fffffa80`0745f750 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`03ba1670 fffff800`02f7cc0a : fffffa80`0745f750 fffff8a0`0a77a010 fffffa80`04afdde0 fffffa80`07470a60 : fltmgr!FltpDispatch+0xcf
fffff880`03ba16d0 fffff800`02fae8df : 00000000`00000004 00000000`00000000 fffff8a0`0a77a010 00000000`000007ff : nt!IopGetFileInformation+0xc6
fffff880`03ba1750 fffff800`02faeec2 : fffffa80`07470a60 00001f80`00000200 00000000`00000000 fffff880`03ba1aa0 : nt!IopQueryNameInternal+0x19f
fffff880`03ba17f0 fffff800`02fa72d0 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IopQueryName+0x26
fffff880`03ba1840 fffff800`02faee8e : fffffa80`07470a60 fffff880`03ba1aa0 00000000`00000218 fffff880`03ba1a38 : nt!ObpQueryNameString+0xb0
fffff880`03ba1940 fffff880`04574698 : fffffa80`07080f78 fffff800`02cd22a4 fffff880`00000001 fffff800`02cd22a4 : nt!ObQueryNameString+0xe
fffff880`03ba1980 fffffa80`07080f78 : fffff800`02cd22a4 fffff880`00000001 fffff800`02cd22a4 00000000`00000002 : aswSP+0x17698
fffff880`03ba1988 fffff800`02cd22a4 : fffff880`00000001 fffff800`02cd22a4 00000000`00000002 00000000`00000000 : 0xfffffa80`07080f78
fffff880`03ba1990 fffff880`083cf6a0 : ffff0101`00000000 00000000`00000001 fffffa80`05110c68 fffff800`02cd3eaa : nt!SwapContext_PatchXSave+0xa3
fffff880`03ba19d0 ffff0101`00000000 : 00000000`00000001 fffffa80`05110c68 fffff800`02cd3eaa fffff880`00000000 : 0xfffff880`083cf6a0
fffff880`03ba19d8 00000000`00000001 : fffffa80`05110c68 fffff800`02cd3eaa fffff880`00000000 fffff800`02cef1e4 : 0xffff0101`00000000
fffff880`03ba19e0 fffffa80`05110c68 : fffff800`02cd3eaa fffff880`00000000 fffff800`02cef1e4 00000000`00000000 : 0x1
fffff880`03ba19e8 fffff800`02cd3eaa : fffff880`00000000 fffff800`02cef1e4 00000000`00000000 00000000`00000000 : 0xfffffa80`05110c68
fffff880`03ba19f0 fffff880`04579727 : 00000000`00000001 fffff880`03ba1cf0 ffff0000`07e1dadf 00000000`00000000 : nt!KeWaitForMultipleObjects+0x272
fffff880`03ba1cb0 00000000`00000001 : fffff880`03ba1cf0 ffff0000`07e1dadf 00000000`00000000 fffff880`02f67fc0 : aswSP+0x1c727
fffff880`03ba1cb8 fffff880`03ba1cf0 : ffff0000`07e1dadf 00000000`00000000 fffff880`02f67fc0 00000000`00000000 : 0x1
fffff880`03ba1cc0 ffff0000`07e1dadf : 00000000`00000000 fffff880`02f67fc0 00000000`00000000 fffff880`04574e6c : 0xfffff880`03ba1cf0
fffff880`03ba1cc8 00000000`00000000 : fffff880`02f67fc0 00000000`00000000 fffff880`04574e6c 00000000`00000000 : 0xffff0000`07e1dadf

2: kd> lmvm aswSP
start             end                 module name
fffff880`0455d000 fffff880`045d0000   aswSP    T (no symbols)           
    Loaded symbol image file: aswSP.sys
    Image path: \SystemRoot\system32\drivers\aswSP.sys
    Image name: aswSP.sys
    Timestamp:        Tue Apr 21 06:16:09 2015 (55364D99)
    CheckSum:         000701B9
    ImageSize:        00073000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

unkka89 · 07 Jul 2015

how it can be? i have uninstalled avast and now i have comodo internet security, what i should do then? update aswSP.sys? if must then how? and thank for reply for this post :)

**cluberti** · 07 Jul 2015

If an antivirus vendor has a "clean up" utility above and beyond the uninstaller.... don't use that program.

With that said, Avast does have such a program, so you might want to give it a try:
https://www.avast.com/uninstall-utility