BSODs, Crashes, and Freezes

This Article Applies to:

Microsoft Windows Operating Systems

General BSODs and Crashes

If you encounter a BSOD or system crash you believe is caused by Avast drivers or services (for example, if the BSOD screen displays an Avast driver), we require a full or kernel memory dump to analyze the issue. See Creating Memory Dumps on Windows for details on creating this dump file. Gather the file from C:\Windows\memory.dmp and send it to Business Technical Support for analysis.

Workaround

If the system can boot, you can uninstall Avast components depending on which driver was indicated as the cause.

Avast Drivers

On-Premise Console

Service	.exe	Notes/use	Service name
Avast Business Management Console	C:\Program Files\Avast Software\ManagementConsole\console\bin\AvastMCService.exe	Main On-Premise Console service	AvastMC
Avast Business Management Console PostgreSQL	C:\Program Files\Avast Software\Management Console\PostgreSQL\bin\pg_ctl.exe	PostgreSQL service used for On-Premise Console database	AvastMCPostgreSQL

Antivirus

Service	.exe	Driver	Notes/use	Service name
Avast Antivirus	C:\Program Files\Avast Software\Avast\AvastSvc.exe	C:\Windows\System32\drivers\aswmonflt.sys	Core Avast Antivirus service	“avast! Antivirus”
Avast Firewall Service	C:\Program Files\Avast Software\Avast\afwServ.exe	C:\Windows\System32\drivers\aswNetHub.sys C:\Windows\System32\drivers\aswNdis.sys (Legacy OS)	Firewall service	“avast! Firewall”
aswblDSAgent	C:\Program Files\Avast Software\Avast\aswidsagent.exe	C:\Windows\System32\drivers\aswbidsdriver.sys C:\Windows\System32\drivers\aswbidsh.sys	Behavior Shield, Browser Shield (ex Password Protection), Ransomware Shield services	aswblDSAgent
Avast Tools	C:\Program Files\Avast Software\Avast\aswToolsSvc.exe		Avast Tools (non-Antivirus): Browser Cleanup, Software Updater	“avast! Tools”
AvastWscReporter	C:\Program Files\AVAST Software\Avast\wsc_proxy.exe		Windows Security Center reporting service	AvastWSCReporter
Not listed in services.msc
aswArPot		C:\Windows\System32\drivers\aswArPot.sys	Anti-Rootkit service	aswArPot
aswbuniv		C:\Windows\System32\drivers\aswbuniv.sys	Universal driver	aswbuniv
aswElam		C:\Windows\System32\drivers\aswElam.sys	Early Launch AntiMalware driver — starting Avast driver before others	aswElam
aswKbd		C:\Windows\System32\drivers\aswKbd.sys	Keyboard filter driver — obsolete	aswKbd
aswRdr		C:\Windows\System32\drivers\aswRdr2.sys C:\Windows\System32\drivers\aswRdr.sys (legacy OS)	Redirect driver — Mail Shield, Web Shield, SecureDNS	aswRdr
aswRvrt		C:\Windows\System32\drivers\aswRvrt.sys	Revert driver — used for performing filesystem/registry pending operations during boot phase	aswRvrt
aswSnx		C:\Windows\System32\drivers\aswSnx.sys	Virtualization drive — Hardware-assisted virtualization, Sandbox, CyberCapture/DeepScreen	aswSnx
aswSP		C:\Windows\System32\drivers\aswSP.sys	Self-defense driver	aswSP
aswStm		C:\Windows\System32\drivers\aswStm.sys C:\Windows\System32\drivers\aswStmXP.sys (legacy OS)	Stream filter — Web Shield, SecureDNS	aswStm
aswVmm		C:\Windows\System32\drivers\aswVmm.sys	VM Monitor — hypervisor for virtual use of components	aswVmm

Business Agent

Service	.exe	Driver	Notes/use	Service name
Avast Business - ClientManager	C:\Program Files (x86)\AVAST Software\Business Agent\ClientManager.exe		Main connection to Business Hub for online/offline status and NOS connections	ClientManager
Avast Business Console Client	C:\Program Files\Avast Software\Avast\bcc.exe		Communication between bcc	aswbcc
Avast Business Console Client Antivirus Service	C:\Program Files\Avast Software\Avast\bccavsvc.exe		Communication between bcc and Antivirus	“Avast Business Console Client Antivirus Service”
Avast Business - AvastAvWrapper (legacy OS/agent versions)	C:\Program Files (x86)\AVAST Software\Business Agent\AvWrapper.exe		Communication between agent and Antivirus	AvastAvWrapper
aswDevFit		C:\Windows\system32\drivers\aswDevFlt.sys	USB Protection driver	aswDevFlt

VPN

Service	.exe	Driver	Notes/use	Service name
Avast SecureLine VPN	C:\Program Files\AVAST Software\SecureLine VPN\VpnSvc.exe	All below	SecureLine VPN service	SecureLine
Not listed in services.msc
aswTap		C:\Windows\System32\drivers\aswTap.sys		aswTap
aswVpnRdr		C:\Windows\System32\drivers\aswVpnRdr.sys		aswVpnRdr
aswWintun		C:\Windows\System32\drivers\aswWintun.sys		aswWintun

Cloud Backup

Service	.exe	Driver	Notes/use	Service name
Avast Business Cloud Backup Service	C:\Program Files (x86)\AVAST Business Cloud Backup\SAgent.service.exe		Cloud Backup service	sagentservice

If the system cannot boot, access the disk outside of Windows via Recovery Options/Bootable Media and rename the Avast drivers (above), then reboot the system to verify if it can boot. While in this state, you can also copy the memory dumps if present.

System Freeze

Different to an actual crash, if your device freezes you must manually create a memory dump (for example, using the keyboard CTRL + scroll method). If the system freezes after an Avast installation or update, or you suspect Avast is the cause of the freeze, Business Support will require further information.

Troubleshooting

The steps here are intended to determine what is causing the issue, rather than providing a permanent fix.

Disable all non-Avast and non-Microsoft applications from MSConfig and reboot the system. Then verify if there is any change in behavior, as another application could be causing the issue
Open the Avast Business client and check if disabling any specific component or feature will resolve the issue
Uninstall components from the policy (if managed) or locally from the device (if unmanaged)
Reboot the system
Verify if the issue is resolved

Gathering Dump Files

Use the details in Generating Kernel Memory Dumps on Windows to enable the keyboard dump method. Then, once the system freeze issue occurs or is induced, create the dump.

System Freeze During Login

If the system freezes during login, access the disk outside of Windows via Recovery Options/Bootable Media and rename the Avast drivers (see the Avast Drivers section above), then reboot the system to verify if it can boot. While in this state, you can also copy the memory dumps if present.