Watchdog_Violation

Thepowerwithin

New Member
Messages
4
I really could use some help. I've having a very frustrating time finding out what the problem is with my computer.


I'm not an expert at computers, but I looked in debugging and found a Wiatrace.log(no idea what that is). I thought that was the first step in solving my problem.



---



Okay,after some tinkering I managed to find a dmp file and I used OSR to analyze it. Hopefully someone will now what's going on.



Here's the complete OSR report:

Crash Dump Analysis provided by OSR Open Systems Resources, Inc. (OSR) Online Crash Dump Analysis Service See OSR Online - The Home Page for Windows Driver Developers for more information Windows 8 Kernel Version 9200 MP (8 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Built by: 9200.16496.amd64fre.win8_gdr.130108-1504 Machine Name: Kernel base = 0xfffff801`3d407000 PsLoadedModuleList = 0xfffff801`3d6d0a80 Debug session time: Sat Mar 16 16:38:57.431 2013 (UTC - 4:00) System Uptime: 0 days 19:02:30.331 ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* DPC_WATCHDOG_VIOLATION (133) The DPC watchdog detected a prolonged run time at an IRQL of DISPATCH_LEVEL or above. Arguments: Arg1: 0000000000000001, The system cumulatively spent an extended period of time at DISPATCH_LEVEL or above. The offending component can usually be identified with a stack trace. Arg2: 0000000000000780, The watchdog period. Arg3: 0000000000000000 Arg4: 0000000000000000 Debugging Details: ------------------ TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2 DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT BUGCHECK_STR: 0x133 PROCESS_NAME: System CURRENT_IRQL: d LAST_CONTROL_TRANSFER: from fffff8013d5da747 to fffff8013d481040 STACK_TEXT: fffff880`042442a8 fffff801`3d5da747 : 00000000`00000133 00000000`00000001 00000000`00000780 00000000`00000000 : nt!KeBugCheckEx fffff880`042442b0 fffff801`3d4acf06 : fffff880`04244360 00000000`0042f195 fffff880`04244430 fffff780`00000320 : nt! ?? ::FNODOBFM::`string'+0x13cdc fffff880`04244330 fffff801`3db71eca : 00000000`00000034 00000000`0000b490 fffffa80`06e8d3c0 fffffa80`0dea10f0 : nt!KeUpdateTime+0x41b fffff880`04244520 fffff801`3d47a4de : 0000009f`9b2e81e9 00000000`76e9ea09 fffffa80`06e008f0 fffff880`03bf2780 : hal!HalpTimerClockInterrupt+0x86 fffff880`04244550 fffff801`3d470900 : 00000000`00000000 00000000`00000000 fffffa80`0782a640 fffffa80`1018a000 : nt!KiInterruptDispatchLBControl+0x1ce fffff880`042446e0 fffff801`3d4ad315 : 00000000`00000002 ffff91de`bda1296d 00000000`00000001 fffff880`02305320 : nt!KxWaitForSpinLockAndAcquire+0x20 fffff880`04244710 fffff880`029485e0 : 00000cda`5e1864a4 fffff880`0200d4fa fffffa80`0dea1001 fffff880`02026902 : nt!KeAcquireSpinLockRaiseToDpc+0x35 fffff880`04244740 00000cda`5e1864a4 : fffff880`0200d4fa fffffa80`0dea1001 fffff880`02026902 00000000`0000010c : aswnet+0x15e0 fffff880`04244748 fffff880`0200d4fa : fffffa80`0dea1001 fffff880`02026902 00000000`0000010c fffff880`0296ff92 : 0xcda`5e1864a4 fffff880`04244750 fffff880`02035c9e : 00000000`00000034 fffffa80`0000010c fffffa80`0dea10f0 00000000`00000034 : NETIO!KfdAleAcquireEndpointContextFromFlow+0x11a fffff880`042447c0 fffff880`02035db6 : 00000000`00000000 00000000`00000001 fffffa80`0f3b62d0 fffff880`0296ff00 : NETIO!WfpNotifyFlowContextDelete+0x56 fffff880`042447f0 fffff880`026f70a6 : 00000000`00000000 fffffa80`07caba90 00000000`00000000 fffff880`0200ff02 : NETIO!WfpRemoveContextFromFlow+0xf2 fffff880`04244860 fffff880`0296f415 : 00000000`00000000 fffff880`06e53c25 fffffa80`07a3f660 fffffa80`07a3f660 : fwpkclnt!FwpsFlowRemoveContext0+0xe fffff880`04244890 00000000`00000000 : fffff880`06e53c25 fffffa80`07a3f660 fffffa80`07a3f660 fffffa80`071cfa01 : aswnet+0x28415 STACK_COMMAND: kb FOLLOWUP_IP: aswnet+15e0 fffff880`029485e0 ?? ??? SYMBOL_STACK_INDEX: 7 SYMBOL_NAME: aswnet+15e0 FOLLOWUP_NAME: MachineOwner MODULE_NAME: aswnet IMAGE_NAME: aswnet.sys DEBUG_FLR_IMAGE_TIMESTAMP: 50963fa9 FAILURE_BUCKET_ID: X64_0x133_aswnet+15e0 BUCKET_ID: X64_0x133_aswnet+15e0 Followup: MachineOwner --------- This free analysis is provided by OSR Open Systems Resources, Inc.
Want a deeper understanding of crash dump analysis? Check out our Windows Kernel Debugging and Crash Dump Analysis Seminar (opens in new tab/window)
[h=4]
collapse.gif
Crash Code Links[/h]
Unknown Bugcheck Code
[h=4]
expand.gif
Loaded Module List[/h] [h=4]
expand.gif
Raw Stack Contents[/h] [h=4]
expand.gif
Dump Header Information[/h] [h=4]
expand.gif
Strings[/h]
 
Last edited:

My Computer

System One

  • OS
    Microsoft
    Computer type
    PC/Desktop
    Graphics Card(s)
    NVIDIA GeForce GT 630M
    Browser
    Firefox
    Antivirus
    Kasperasky
Caused by Avast! Firewall Core Driver. Please uninstall it, enable windows defender and report if the system is stable.

Code:
********************************************************************************                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************


Use !analyze -v to get detailed debugging information.


BugCheck 133, {1, 780, 0, 0}


*** WARNING: Unable to verify timestamp for aswnet.sys
*** ERROR: Module load completed but symbols could not be loaded for aswnet.sys
Probably caused by : aswnet.sys ( aswnet+15e0 )


Followup: MachineOwner
---------


4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************


DPC_WATCHDOG_VIOLATION (133)
The DPC watchdog detected a prolonged run time at an IRQL of DISPATCH_LEVEL
or above.
Arguments:
Arg1: 0000000000000001, The system cumulatively spent an extended period of time at
    DISPATCH_LEVEL or above. The offending component can usually be
    identified with a stack trace.
Arg2: 0000000000000780, The watchdog period.
Arg3: 0000000000000000
Arg4: 0000000000000000


Debugging Details:
------------------




DPC_TIMEOUT_TYPE:  DPC_QUEUE_EXECUTION_TIMEOUT_EXCEEDED


CUSTOMER_CRASH_COUNT:  1


DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT


BUGCHECK_STR:  0x133


PROCESS_NAME:  System


CURRENT_IRQL:  d


LAST_CONTROL_TRANSFER:  from fffff8013d5da747 to fffff8013d481040


STACK_TEXT:  
fffff880`042442a8 fffff801`3d5da747 : 00000000`00000133 00000000`00000001 00000000`00000780 00000000`00000000 : nt!KeBugCheckEx
fffff880`042442b0 fffff801`3d4acf06 : fffff880`04244360 00000000`0042f195 fffff880`04244430 fffff780`00000320 : nt! ?? ::FNODOBFM::`string'+0x13cdc
fffff880`04244330 fffff801`3db71eca : 00000000`00000034 00000000`0000b490 fffffa80`06e8d3c0 fffffa80`0dea10f0 : nt!KeUpdateTime+0x41b
fffff880`04244520 fffff801`3d47a4de : 0000009f`9b2e81e9 00000000`76e9ea09 fffffa80`06e008f0 fffff880`03bf2780 : hal!HalpTimerClockInterrupt+0x86
fffff880`04244550 fffff801`3d470900 : 00000000`00000000 00000000`00000000 fffffa80`0782a640 fffffa80`1018a000 : nt!KiInterruptDispatchLBControl+0x1ce
fffff880`042446e0 fffff801`3d4ad315 : 00000000`00000002 ffff91de`bda1296d 00000000`00000001 fffff880`02305320 : nt!KxWaitForSpinLockAndAcquire+0x20
fffff880`04244710 fffff880`029485e0 : 00000cda`5e1864a4 fffff880`0200d4fa fffffa80`0dea1001 fffff880`02026902 : nt!KeAcquireSpinLockRaiseToDpc+0x35
fffff880`04244740 00000cda`5e1864a4 : fffff880`0200d4fa fffffa80`0dea1001 fffff880`02026902 00000000`0000010c : aswnet+0x15e0
fffff880`04244748 fffff880`0200d4fa : fffffa80`0dea1001 fffff880`02026902 00000000`0000010c fffff880`0296ff92 : 0x00000cda`5e1864a4
fffff880`04244750 fffff880`02035c9e : 00000000`00000034 fffffa80`0000010c fffffa80`0dea10f0 00000000`00000034 : NETIO!KfdAleAcquireEndpointContextFromFlow+0x11a
fffff880`042447c0 fffff880`02035db6 : 00000000`00000000 00000000`00000001 fffffa80`0f3b62d0 fffff880`0296ff00 : NETIO!WfpNotifyFlowContextDelete+0x56
fffff880`042447f0 fffff880`026f70a6 : 00000000`00000000 fffffa80`07caba90 00000000`00000000 fffff880`0200ff02 : NETIO!WfpRemoveContextFromFlow+0xf2
fffff880`04244860 fffff880`0296f415 : 00000000`00000000 fffff880`06e53c25 fffffa80`07a3f660 fffffa80`07a3f660 : fwpkclnt!FwpsFlowRemoveContext0+0xe
fffff880`04244890 00000000`00000000 : fffff880`06e53c25 fffffa80`07a3f660 fffffa80`07a3f660 fffffa80`071cfa01 : aswnet+0x28415




STACK_COMMAND:  kb


FOLLOWUP_IP: 
aswnet+15e0
fffff880`029485e0 ??              ???


SYMBOL_STACK_INDEX:  7


SYMBOL_NAME:  aswnet+15e0


FOLLOWUP_NAME:  MachineOwner


MODULE_NAME: aswnet


IMAGE_NAME:  aswnet.sys


DEBUG_FLR_IMAGE_TIMESTAMP:  50963fa9


FAILURE_BUCKET_ID:  0x133_ISR_aswnet+15e0


BUCKET_ID:  0x133_ISR_aswnet+15e0


Followup: MachineOwner
---------


4: kd> lmvm aswnet
start             end                 module name
fffff880`02947000 fffff880`029bc000   aswnet   T (no symbols)           
    Loaded symbol image file: aswnet.sys
    Image path: \SystemRoot\System32\Drivers\aswnet.sys
    Image name: aswnet.sys
    Timestamp:        Sun Nov 04 16:12:57 2012 (50963FA9)
    CheckSum:         0007BB8D
    ImageSize:        00075000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
 

My Computer

System One

  • OS
    Windows 7 Home Premium 64 Bit
    Computer type
    PC/Desktop
I installed Avast a while ago and tried uninstalling it with Avast's tool.

Looks like Avast is still lurking on my computer. Do you know how I would pry out find that firecore driver?


----

Update, I took the path you included in your comment and browsed through my system 32. It took me a while but, I found 2 AWS.sys files one titled as dvr2 and an entire folder(I didn't examine the contents I just took it straight off).

It's quite mysterious because I had to turn on view hidden files.

I still don't know if it's completely gone.
 
Last edited:

My Computer

System One

  • OS
    Microsoft
    Computer type
    PC/Desktop
    Graphics Card(s)
    NVIDIA GeForce GT 630M
    Browser
    Firefox
    Antivirus
    Kasperasky
I downloaded the program you recommended and I found spyware on my computer. I.e Incredibar, Incredimail ect, I also removed some junk files, but I can find no trace of avast.
 

My Computer

System One

  • OS
    Microsoft
    Computer type
    PC/Desktop
    Graphics Card(s)
    NVIDIA GeForce GT 630M
    Browser
    Firefox
    Antivirus
    Kasperasky
Okay, Revo didn't cut it for me.


I opened my registry editor and I spent an hour searching for Avast keys and I am fully confident I got every last one. I even managed to find the firecore driver spoken about.
 

My Computer

System One

  • OS
    Microsoft
    Computer type
    PC/Desktop
    Graphics Card(s)
    NVIDIA GeForce GT 630M
    Browser
    Firefox
    Antivirus
    Kasperasky
Back
Top