AVG 9 and BSODs

[solitaire89]

Having great fun here... We moved to AVG 9 just before Christmas, and as soon as we installed it, we started getting blue screens left, right and center. The stop code isn't particularly helpful...

 

0x40000080

 

and although the location is always slightly different, the last part is always the same:

 

0x00000001

 

Before, it was just 1 machine at a time, but this morning I've lost 5 in our suite of 20 machines (all are running XP Pro). Any ideas? I phoned AVG, and was told to just to uninstall it to fix the problem (great, so I'd have no a/v?! AND when we've just paid for it and all?! ). Out of interest I tried the freebe version to see if that made any difference... Nope, still blue screens. Oh, the evilness...

[pwds]

How are your machines built and imaged and have you slipstreamed them in any way? Might be worth applying updates one (or a group at a time) and seeing if you can induce failure that way.

 

Do you have WSUS? Might be worth temporarily disabling it until you can rule out Windows updates. I feel a machine without malware protection is at greater risk than one not up to the minute with patches.

 

Might also be worth checking AVG website for updates and/or KBs for the product.

 

IIRC AVG 8.5 broke the internet where the firewall was installed following M$ DNS update to fix a critical vulnerability there.

[ahuxham]

Install "WhoCrashed" wait for a BSOD, reboot, check logs and find detailed information on what cause everything.

[cookie_monster]

This probably won't help but we had similar issues with NOD32 V4 and they recommended following the Microsoft AV exclusion recomendations. Once we did this things seemed to stabalise.

 

Virus scanning recommendations for computers that are running Windows Server 2008 R2, Windows Server 2008, Windows Server 2003, Windows 2000, Windows XP, Windows Vista, or Windows 7

[solitaire89]

How are your machines built and imaged and have you slipstreamed them in any way? Might be worth applying updates one (or a group at a time) and seeing if you can induce failure that way.

 

Do you have WSUS? Might be worth temporarily disabling it until you can rule out Windows updates. I feel a machine without malware protection is at greater risk than one not up to the minute with patches.

 

Might also be worth checking AVG website for updates and/or KBs for the product.

 

IIRC AVG 8.5 broke the internet where the firewall was installed following M$ DNS update to fix a critical vulnerability there.

 

We have so few machines here that they're all done "by hand", i.e. no imaging/slip-streaming here. (That's another long story - I'm just the technician, not the network manager. As someone said, I'm not paid to have an opinion).

 

I hadn't thought of Win updates being the issue... that's next then. I agree about the malware protection priority!

 

AVG don't have anything that I haven't already applied - and like I say, if I call them, their response is just to not use it

 

Install "WhoCrashed"

 

Not heard of that one, thanks

 

This probably won't help but we had similar issues with NOD32 V4 and they recommended following the Microsoft AV exclusion recomendations. Once we did this things seemed to stabalise.

 

Virus scanning recommendations for computers that are running Windows Server 2008 R2, Windows Server 2008, Windows Server 2003, Windows 2000, Windows XP, Windows Vista, or Windows 7

 

Any suggestions are greatly appreciated I'm willing to try anything, even gin. No, especially gin!

[Michael]

What were you running before moving to AVG9? And are you 100% sure all components of the old AV product are uninstalled?

 

I highly doubt it's to do with Windows Updates as many people use the product which is free at home. It'll be a driver or another application, something along these lines.

[solitaire89]

What were you running before moving to AVG9? And are you 100% sure all components of the old AV product are uninstalled?

 

I highly doubt it's to do with Windows Updates as many people use the product which is free at home. It'll be a driver or another application, something along these lines.

 

All of the old AV has gone, for def... I'm still looking for a link with a driver/app.

 

Though, it has to be said, that, seeing as the school is closing in 10 mins, I'm not busting a gut right now. I'll deal with it properly when we get back Is that bad of me? I'll call it research time at home! Obviously I'm very grateful for the help still

[Michael]

Realistically 10 minutes isn't enough time so I wouldn't blame you. I would be tempted to take a copy/image of the existing hard drive, install Windows as new, then drivers, then AVG 9 and test. If it's OK proceed to install applications one by one until it fails. It sounds long winded but without experimenting I can't see how else you can identify the problem.

[solitaire89]

Realistically 10 minutes isn't enough time so I wouldn't blame you. I would be tempted to take a copy/image of the existing hard drive, install Windows as new, then drivers, then AVG 9 and test. If it's OK proceed to install applications one by one until it fails. It sounds long winded but without experimenting I can't see how else you can identify the problem.

 

I feared that was where I was heading. Damn you AVG, why couldn't the powers that be have chosen Kaspersky! Thanks for your help though

[ahuxham]

I feared that was where I was heading. Damn you AVG, why couldn't the powers that be have chosen Kaspersky! Thanks for your help though

 

Just get WhoCrashed to give you adequate information as to the problem and resolve that problem from there, it may be software thats interfering with AVG, first step is to find out whats causing the problems without the long way around of new install and testing every application.

[solitaire89]

Quick update - we now seem to be coming back up to speed here, despite the snow still falling!! I've used the WhoCrashed (thanks ahuxham!), and it's showing up as the driver for the network adaptor. I'm just going to try updating the drivers off the intel site, and then we start round 2!!

[DMcCoy]

Quick update - we now seem to be coming back up to speed here, despite the snow still falling!! I've used the WhoCrashed (thanks ahuxham!), and it's showing up as the driver for the network adaptor. I'm just going to try updating the drivers off the intel site, and then we start round 2!!

 

It may well be spurious, as AVG probably has an NDIS network driver that intercepts the traffic. You may find just disabling web/firewall in AVG will stop the crashing.

[solitaire89]

It may well be spurious, as AVG probably has an NDIS network driver that intercepts the traffic. You may find just disabling web/firewall in AVG will stop the crashing.

 

wish I'd read this before attempting updating drivers... now I've lost one of the adaptors altogether! Will try disabling things on one of the ones that still thinks it has a network adaptor!! Thanks!

[ahuxham]

What a prat I am. Right, WhoCrashed worked as expected (I didn't doubt it at all) and has shown that its a NDIS driver, which sounds perfectly right, thanks for highlighting that DMcCoy.

 

Then I re-read the whole Thread and noticed the original Stop message, and just remembered something.

 

The 0x40000080 message looked very familiar, and I remembered I got this question wrong in my MCP 70-290 exam. I had never covered it in material or practice exams and kicked up stink about it, how am I supposed to know about something which isn't being taught.

 

Anywho, the question related to Windows XP being unable to boot and the stop message being around 0x40000080, and the correct answer was NDIS Drivers...

 

At least you found WhoCrashed, such an invaluable tool to have.

 

[DMcCoy]

I may have spent a number of days getting to know Kaspersky and it's very own drivers and filesystem filters quite well

 

They even decided that the driver I told them was broken was in fact broken. Wasn't the NDIS one on this particular AV, it was the file/registry filter.

[solitaire89]

Ok, network adaptor driver sorted, and I think you're right. AVG must have a NDIS driver, I've found people who have problems uninstalling AVG 9 as it fails to uninstall said driver. I can't see it though, it's not like KAV that shows it in the network connection properties... However, I don't really want to disable the web/firewall componants as that's a whopping great gap in protection. So, I suppose the big question is... where do I go from here?!

[DMcCoy]

I see people on the AVG forum are having the same issues with the Intel drivers. Do they crash after sleeping/hibernating? I had the same problem with realteks BSODing when waking up with Vista (only a driver issue not AV).

 

AVG Forums - Blue Screen - AVG 9 Upgrade

 

As it doesn't happen without AV then it's probably caused by AVG, but the driver that can't cope is the intel one. I think updating the driver may be the only possible workaround/solution for the moment.

[solitaire89]

I see people on the AVG forum are having the same issues with the Intel drivers. Do they crash after sleeping/hibernating? I had the same problem with realteks BSODing when waking up with Vista (only a driver issue not AV).

 

AVG Forums - Blue Screen - AVG 9 Upgrade

 

As it doesn't happen without AV then it's probably caused by AVG, but the driver that can't cope is the intel one. I think updating the driver may be the only possible workaround/solution for the moment.

 

I hadn't seen that thread on the AVG forum (haven't looked since it was posted ). It is only machines with the AV that are affected, so I'll see how the one that's now got the up to date intel drivers on fares. As to whether they go after sleeping, I can't answer - the teacher doesn't seem to think it's of any importance to note what happens before they go . I'll post when I've got an answer to that - I figure it could be useful to someone.

 

Thank you for all of your help, it's been great

[steve_nfi]

Firstly thanks for posting this. It couldn't have come a better time.

I've had a laptop brought in today (only 3 months old) getting a B.S.O.D.

Read this with it's solutions, especially Whocrashed (great bit of software), and have found that all the B.S.O.D's are down to a Realtek network driver.

So Secondly thanks to everyone who have contributed to this.

[solitaire89]

Firstly thanks for posting this. It couldn't have come a better time.

I've had a laptop brought in today (only 3 months old) getting a B.S.O.D.

Read this with it's solutions, especially Whocrashed (great bit of software), and have found that all the B.S.O.D's are down to a Realtek network driver.

So Secondly thanks to everyone who have contributed to this.

 

Glad that it was of help to someone else too, and glad it's not just me with evil blue screen-ness

[solitaire89]

Just wanted to post a final update on this one, so it can be put to bed properly, and so that if anyone else comes across a similar issue, they'll have all the relevant info - updating the Intel driver appears to have fixed the problem. We've had no blue screens at all since the updates! So, thanks once again to everyone who helped.