BlueScreen after connecting to company network

[usasma]

Don't forget to disable the Driver Verifier when done - it'll cause system issues if left running.

Good luck!

 

[Thomas R]

already done

 

[Thomas R]

Well, it wasn't that simple. I had more crashes at work this afternoon.
And still the problem is only with connection to the network at work - at home I still have no crashes.

Some crashes happened after launching the Windows Media Player and one other moments after I launched the XP Mode - with WMP 11 open. But not all crashes were directly correlated to WMP.
Now I know that the SigmaTel audio driver has a problem but there simply isn't a better driver available - over at Dell Community several people are complaining about that outdated driver but it seems Dell has stopped development of new drivers for the M6300.
Anyway I don't think this is strictly a driver problem.

I'm rather thinking this has something to do with the network itself.

Is there any way monitor and record anything that comes in or goes out over the network connection to see if there is a common trigger?

 

[torrentg]

You still have vsdatant.sys on the system.

Download my attachment. Then merge it by extracting and double-clicking on it. Tell it yes when it asks.

Then boot into safe mode and delete vsdatant.sys from C:\Windows\System32\drivers (or x64 equivalent - I never used x64 so I don't know.)

and also delete the ZoneLabs folder in C:\Windows\System32 (or x64 equivalent - I never used x64 so I don't know.)

Then reboot to normal mode and make sure vsdatant.sys is gone from the system.


_________________________


You still also have these drivers that it would be best to update (if you tried already, look at others first):

SynTP SynTP.sys Fri Oct 26 16:58:42 2007
rimmpx64 rimmpx64.sys Sun Mar 18 23:09:34 2007
rimspx64 rimspx64.sys Tue Feb 27 02:10:37 2007
stwrt64 stwrt64.sys Thu Sep 13 11:30:19 2007
nvlddmkm nvlddmkm.sys Wed May 07 20:14:57 2008 <<< video card driver - visit www.nvidia.com for latest
rixdpx64 rixdpx64.sys Mon Mar 26 06:48:23 2007
VSTAZL6 VSTAZL6.SYS Wed Oct 15 20:53:42 2008
VSTCNXT6 VSTCNXT6.SYS Wed Oct 15 20:52:22 2008
VSTDPV6 VSTDPV6.SYS Wed Oct 15 20:57:45 2008

_____________________________________


If you're unsure about things and what to do, a clean install would probably be best. If you have some degree of confidence with this, as my guess here, you could probably repair this install though.


___________________________


You can use Wireshark to monitor packets.

 

[Thomas R]

Yes - I already re-installed a freshly downloaded version of ZoneAlarm and this new copy of vsdatant.sys has passed the Verifier test.

But hardware drivers are a problem since Dell has only XP and Vista drivers for the Precision M6300 series notebooks and the newest are from 2008 while many are even from 2007. And it doesn't look like they are planning to release Windows 7 drivers for any but their current systems (NO - Dell is not getting me to buy a new notebook just because they don't release Windows 7 drivers for my current one - then I rather buy a MAC)

The Nvidia driver has passed the Verifier test as have most of the other drivers that show up in the Verifier list.

Only 2 have crashed the system during the Verifier test:

• stwrt64.sys (SigmaTel C-Major Audio)
• SynTP.sys (Synaptics TouchPad)

The audio driver had caused some warnings (Windows reported that it stopped working).
But the TouchPad seems to work without problems.
I can't see why these drivers should behave differently at home and at work.
The only difference is in the network - router vs. domain server.

 

[torrentg]

Hmm ya I dunno about why. But the crashes are happening still because of ZA. Other users have had exact same experience as you and they eventually completely uninstalled ZA to alleviate issues.

It's probably a configuration issue.

 

[Thomas R]

In that case ZoneAlarm has to go.
Has anybody experience with Microsoft Security Essentials? Is that any good?

Btw. your zagone.rar contained only a largely empty registry file - is there something missing or is that all?

 

[torrentg]

In that case ZoneAlarm has to go.
Has anybody experience with Microsoft Security Essentials? Is that any good?

Btw. your zagone.rar contained only a largely empty registry file - is there something missing or is that all?

No, nothing missing. If you look inside as before, those - symbols delete the keys. It's good to do to remove ZA from the registry, after uninstall.

MSE should be very good based only on the fact that it's designed by same company as OS is. I can't see going wrong with that.

Good luck and enjoy. If there are any further issues, let us know.

 

[Thomas R]

It seems ZoneAlarm Extreme Security de-installs pretty clean. At least I could find only one registry entry afterwards:
[-HKEY_LOCAL_MACHINE\Software\CheckPoint]
HU100 REG_BINARY
I left that one alone for now.

And in Program Files there is only an empty CheckPoint folder left.
All other files and registry entries are gone without any additional steps.

 

[torrentg]

Yeah. They've gotten much better over time with that.

I have that reg file because I beta test all the time with their software. In the past, you had to clear everything off to install a new beta. They've even gotten better with things and now you can upgrade from beta to beta, no problem. So it's cool in that respect.

 

[Thomas R]

Seems to work fine now - finally!

The last crash I had this morning - before removing ZoneAlarm - was again clearly caused by ZoneAlarm:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck C4, {91, 2, fffff80002e56c40, 0}
Unable to load image \SystemRoot\system32\DRIVERS\vsdatant.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for vsdatant.sys
*** ERROR: Module load completed but symbols could not be loaded for vsdatant.sys
Probably caused by : vsdatant.sys ( vsdatant+1864d )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught.  This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 0000000000000091, A driver switched stacks using a method that is not supported by
 the operating system. The only supported way to extend a kernel
 mode stack is by using KeExpandKernelStackAndCallout.
Arg2: 0000000000000002
Arg3: fffff80002e56c40
Arg4: 0000000000000000
Debugging Details:
------------------
 
BUGCHECK_STR:  0xc4_91
CUSTOMER_CRASH_COUNT:  1
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  System
CURRENT_IRQL:  2
LAST_CONTROL_TRANSFER:  from fffff80002d3650d to fffff80002ccff00
STACK_TEXT:  
fffff800`00b9be58 fffff800`02d3650d : 00000000`000000c4 00000000`00000091 00000000`00000002 fffff800`02e56c40 : nt!KeBugCheckEx
fffff800`00b9be60 fffff880`016750e2 : fffff880`016755e0 fffff800`00b9bf70 fffff800`00b9c102 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x1e38d
fffff800`00b9bf40 fffff880`015600eb : fffffa80`09baa800 00000000`00000000 fffffa80`07de31a0 fffffa80`07de31a0 : tcpip!FlReceiveNetBufferListChain+0xb2
fffff800`00b9bfb0 fffff880`01529fc6 : e000000c`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ndis!ndisMIndicateNetBufferListsToOpen+0xdb
fffff800`00b9c020 fffff880`014aca24 : fffffa80`07de31a0 00000000`00000002 00000000`00000001 00000000`00000000 : ndis!ndisMDispatchReceiveNetBufferLists+0x1d6
fffff800`00b9c4a0 fffff880`014ac9e9 : fffffa80`09ba8010 00000000`00000001 00000000`00000001 fffff880`02bc93f2 : ndis!ndisMTopReceiveNetBufferLists+0x24
fffff800`00b9c4e0 fffff880`014ac980 : fffff880`02be05c0 00000000`00000000 ffff0080`02723019 00000000`00000000 : ndis!ndisFilterIndicateReceiveNetBufferLists+0x29
fffff800`00b9c520 fffff880`02c7664d : fffffa80`09ba3010 00000000`00000000 00000000`00000001 fffffa80`06b20e30 : ndis!NdisFIndicateReceiveNetBufferLists+0x50
fffff800`00b9c560 fffffa80`09ba3010 : 00000000`00000000 00000000`00000001 fffffa80`06b20e30 00000000`00000000 : vsdatant+0x1864d
fffff800`00b9c568 00000000`00000000 : 00000000`00000001 fffffa80`06b20e30 00000000`00000000 fffff880`060a7048 : 0xfffffa80`09ba3010
 
STACK_COMMAND:  kb
FOLLOWUP_IP: 
vsdatant+1864d
fffff880`02c7664d ??              ???
SYMBOL_STACK_INDEX:  8
SYMBOL_NAME:  vsdatant+1864d
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: vsdatant
IMAGE_NAME:  vsdatant.sys
DEBUG_FLR_IMAGE_TIMESTAMP:  4ad981d5
FAILURE_BUCKET_ID:  X64_0xc4_91_vsdatant+1864d
BUCKET_ID:  X64_0xc4_91_vsdatant+1864d
Followup: MachineOwner
---------
0: kd> lmvm vsdatant
start             end                 module name
fffff880`02c5e000 fffff880`02cee000   vsdatant T (no symbols)           
    Loaded symbol image file: vsdatant.sys
    Image path: \SystemRoot\system32\DRIVERS\vsdatant.sys
    Image name: vsdatant.sys
    Timestamp:        Sat Oct 17 01:35:33 2009 (4AD981D5)
    CheckSum:         0006D11C
    ImageSize:        00090000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

 

[torrentg]

Awesome. That's good to see that problems seem solved.

 

[Thomas R]

Haven't had a single crash since I uninstalled ZoneAlarm.
So I think this issue is solved

 

[recordsj]

Are you still error free since your last posting back on 15-dec-09?
I have zone alarm internet security running on a dell m6400 windows 7 64bit and having the same issue.

I assume you still don't have ZA installed? If you are not using ZA what alternative did you go to?

 

[Thomas R]

No. The tech guys from ZoneAlarm wanted me to run a diagnostic program but even that wouldn't work.
Since then I'm using Microsoft Essentials and no problems since.

 

[recordsj]

I researching the issue, I found out that computers running Norton have the same problem and Norton has told them to disable netbios over TCP/IP. I have done this last week and haven't had a BSOD crash since then (I am still using zome alarm internet security with out any issues).

 

[jashanprt]

help

having same problem can u hel me too torrentg