SBAMSvc crashes and apparently causes "logon process has failed ..." problem

Thanks for the response. I guess, in all my words above, I did not mention that this doesn't happen *every* time I enter then leave full screen mode. It's intermittent and the only commonality I can find so far is leaving full screen mode. Are you suggesting that when I know I'm going to enter full screen that I disable active protection?

Hey Sam B,

Yes, just disable the Active protection prior to entering full screen mode. For troubleshooting purposes I want to see if the active protection is conflicting.

You can also trying leaving the active protection ON, and just turning off "Check Files when they are opened or copied", and let me know if that has any effect, as well.

Open VIPRE,
Go to FILE > SETTINGS,
Select the Active Protection tab,
Uncheck "Check Files when they are opened or copied",
Click APPLY.

Thanks,
Tim

I have the same problem. I am running the business 64 bit edition of Vista. This error also occurs for me after the computer has been locked but idle for some time

Hi Alastair,

We'd like to get some logs from your installation of VIPRE.

1. First open VIPRE by double clicking on the VIPRE icon in the System tray (Down by the time on your computer)

2. Click on the word “Help” then “About”

3. Then click on the button labeled “Support tools” then “Run Diagnostics”

4. Make sure that all the boxes are checked and click “ok”

5. Once this starts, it will take a couple minutes while the utility gathers information. It will create a file on your desktop called “Sunbelt VIPRE Antivirus + Antispyware Diagnostics.rar”

6. After that file appears, run the following utility: http://tinyurl.com/dmwhmc

You will be asked for your support ticket number. Enter: 001-00-279778

Please contact our support team at support@sunbelt-software.com with the logs and we will have someone work directly with you.

Thanks,
~Tim

Tim,

OK, I will try disabling active protection sometime. Frankly, I've been avoiding using applications in full screen mode ... and to clarify, I do not mean a maximized window, I mean when an application displaces the Windows desktop and takes over the full monitor.

(When the badness involving an SBAMsvc crash happens and forces me to power-down in order to restart, it tends to cause my ICH9-based RAID1 subsystem to perform a validation on the array after reboot. This takes a couple hours and makes the machine quite slow during the process, which is intolerable during my workday. It was just such an event ... in the middle of watching a full-screened WebEx ... that caused me to seriously research what was going on.)

For your information, I already run with "Check files when they are opened or copied" disabled ... this is based on issues I've had with that setting being enabled with past versions of Vipre. Also fyi, I'm running 32-bit Vista Home Premium.

I've spent a lot of time looking at my event logs and researching the informational and error messages that occur around the time of the problem. The only actual error in any log I can find is the SBAMsvc crash; everything else is informational.

I notice that the SBAMsvc is not set to automatically restart if it crashes ... is changing that worthy of consideration? What happens to a running system if that service crashes or stops responding?

--
Sam

Hey Sam B,

When the VIPRE service crashes it shouldn't crash/lock up the system. Generally the VIPRE icon in the system tray will turn red and wait for the service to restart. Due to it being a conflict it's having with another application it's more then likely causing the CPU to spike and the system to become non-responsive.

Setting the service to automatically restart after a crash may not be advisable seeing how it shouldn't be crashing in the first place and if we make it restart it can cause more problems then we want.

I'd like to go ahead and get some logs from your installation of VIPRE, as well.

1. First open VIPRE by double clicking on the VIPRE icon in the System tray (Down by the time on your computer)

2. Click on the word “Help” then “About”

3. Then click on the button labeled “Support tools” then “Run Diagnostics”

4. Make sure that all the boxes are checked and click “ok”

5. Once this starts, it will take a couple minutes while the utility gathers information. It will create a file on your desktop called “Sunbelt VIPRE Antivirus + Antispyware Diagnostics.rar”

6. After that file appears, run the following utility: http://tinyurl.com/dmwhmc

You will be asked for your support ticket number. Enter: 001-00-279415

Please contact our support team at support@sunbelt-software.com with the logs and we will have someone work directly with you.

I apologize for the inconveniences this has caused.

Thanks,
~Tim

Hi -
I'm encountering this too on an X64 Vista Business workstation (SP1).

The tray icon does not turn red as expected after the crash. Instead, I get the exact same symptoms as described above (slow system and the "logon process has failed to create the security option dialog" message when I press ctrl-alt-delete). The only way out is to turn the power off.

This seems to happen to me most when using Visual Studio 2008 as well as Remote Desktop connection running.

Hi JohnB,
I apologize for the inconveniences this has caused. Let's do an uninstall/reinstall of VIPRE.

Please use the instructions below to remove your copy of VIPRE and install a clean copy.
1.Click 'start', and click 'control panels.'

2. Double Click on 'Add or Remove Programs.'

(VISTA: Double click 'Programs and features.')

3. Please look for VIPRE.'

4. Click 'Change'.

5. You will receive a prompt that asks you 'Remove All Items'. Please choose 'Yes' and click 'next.'

6. Please follow the rest of the prompts until you are able to click 'Finish.'

7. You will be asked to restart your computer, please do so.

Reinstall:
1. Click on the following link to install VIPRE http://www.sunbelt-software.com/suppo...

2. Your web browser will ask you “Do you want to run or save this file?” Please Click Save. Save this file to the desktop.

3. A box will appear that asks you where you want save. Look for the save in field and then click on it. Look for the desktop and then click on it. Then click save.

4. When it is done downloading, you will receive another box that asks “do you if you want to run this file?” Choose yes.

5. You will receive an internet explorer warning. It says “Do you want to run this software?” Click run.

If you have any further problems please feel free to contact our support team at support@sunbelt-software.com or by Phone at 1-877-673-1153 M-F 9am-6pm EST and we will have someone work directly with you.

Thanks,
~Tim

Hello Tim,

The trouble re-occurred again today. It was unrelated to having an application in "full screen" mode; sorry, but that was apparently an improper conclusion. At 2:58pm my event log reported the error:

Faulting application SBAMSvc.exe, version 3.1.2710.0, time stamp 0x49bfc54f, faulting module ntdll.dll, version 6.0.6001.18000, time stamp 0x4791a7a6, exception code 0xc0000005, fault offset 0x00065a20, process id 0x1314, application start time 0x01c9ac1c3631a46a.

Even though the application I was using was not immediately impacted, I immediately noticed a visual symptom. An instant messaging program had attempted to open a window but appeared to only partly succeed: the taskbar took a very long time to update and the flash (to orange and back) of the IM window's taskbar item was extremely slow. I hit Save in my app and decided to try to do a restart in the hopes of getting a clean shutdown. It's notable that my application seemed unaffected (at least for the moment).

I was careful to avoid ctrl-alt-del. I clicked the Windows Start button; after 15-30 seconds the menu appeared. I navigated to the "Restart" option ... each popup nav occuring after a 20-40 second delay. At 3:05pm the system event documenting that I initiated a restart was recorded. At 3:26pm the event log service was stopped and at 3:28pm the first event of the restart was recorded. It took my system over 20 minutes to shut down while suffering from this problem; it was painful to watch. A variety of logged events (both application and system) were recorded during that 20 minutes documenting failed service shutdowns and forced termination of hung processes.

I was happy that a clean shutdown was possible as this certainly saved a great deal subsequent time. I think rapidly recognizing the visual symptoms (that "it's happened again"), avoiding ctrl-alt-del, and being very patient was critical to that clean shutdown.

Because the problem manifested itself within seconds of the SBAMSvc fault and because I know for certain that no changes have been made to my system since the last Vipre update, I still seriously suspect Vipre is at fault. Since I'm apparently unable to get to Process Explorer (and honestly I didn't even try this time), I cannot tell you anything about the state of memory, processor utilization, active processes, or your service. The disk activity sounded reasonably "normal" ... it was not doing excessive I/O. But as you can tell, the system was absolutely crawling.

I've followed your instructions and sent support the logs you requested. I did this immediately following this most recent trouble. I really hope you guys can find something ...

--
Sam

@TimN:
I did the full reinstall last night. I will let you know how things go.

I've fished through the Application Log, and what is interesting is that all the crashes happen in early/mid afternoon. They've pretty much happened once a day since 3/22. The Vipre process never crashed before that on this box:

Days/times (US Eastern):
3/22 13:39:57
3/23 15:07:47
3/24 13:15:44
3/25 15:09:42

Could there be an issue applying def updates?

@Sam B
Interesting idea about the network usage. Can't say what I was doing each & every time these crashes happened (especially on the Sunday one).

Hey guys,

If you're still experiencing these symptoms after an uninstall/reinstall then we'll need to get logs from you, and we'll also need crash dump logs.

We are currently working on reproducing this error on our test machines.

Please email us regarding this issue so I can send instructions for getting crash dumps. In the subject line you can put "ATTN:TimN"

Thank you,
Tim

Hey All,

In the interest of full disclosure, I should note I have not yet performed a complete de-install and re-install. I will do that later this evening.

I have, however, been running Vipre with Active Protection disabled ... and the SBAMSvc just crashed. At the time, I was not doing anything significant on my system (Word, Outlook, and a couple IM windows). This time, however, it did not put my system into super-slow mode. Rather, two things happened: the Vipre tray icon turned red and the built-in Vista problem reporting kicked into action. I allowed problem reporting to "send information to Microsoft" and it promptly informed me I should "Download updates for VIPRE 3.1 Beta 6" with a link to the Sunbelt website.

One theory I draw from this is whatever causes the SBAMSvc to crash exists regardless of the Active Protection setting. However, if Active Protection is enabled, the impact of the crash is debilitating to Windows.

I'll continue to update this thread as events unfold. (I'll consider a crash-free week after a reinstall to be an event.)

--
Sam

Computer crashed again. I wasn't even using it at the time!

I can confirm a link on my machine with today's def update. According to Vipre's system history, Def #5062 was applied at 6:34:26 (pm), and the service crashed at 6:34:56.

Hello JohnB

Please contact our support dept directly and we can get some logs and see what may be causing this.

Regards,

Perry

email: support@sunbeltsoftware.com
Voice: 1-877-673-1153 Ext 500

@PerryB
I've just sent an email to Support. Thanks.

Thanks for the logs guys!

We will be researching this issue and we'll let you know what we find.

If you have any other problems please feel free to contact our support team at support@sunbelt-software.com or by Phone at 1-877-673-1153 M-F 9am-6pm EST and we will have someone work directly with you.

Thanks,
~Tim

Unfortunately, the complete re-install did not solve the problem; I have since seen SBAMSvc crash. I'm continuing to run with Active Protection turned off and will install the debugger to capture a crash dump at the first opportunity.

Update: I was away from my desk last week so did not use my computer (it was powered off). Since returning and starting the machine, Vipre has crashed once. I continue to run with Active Protection turned off and the crashes do no significant harm. (Windows problem reporting still suggests I "update Vipre" whenever it crashes.) I have not yet installed the debugger as requested by Sunbelt to capture a crash dump. I have, however, audited all my device drivers to assure I was up to date and discovered my Ethernet and Video drivers had been updated. I've installed those newer drivers and while I don't think that will impact anything, you never know. If I see another Vipre crash I'll pursue installing the debugger. (I guess I keep hoping that Sunbelt will find the problem ... because clearly there's something nasty hidden in there somewhere ... and post that they have a fix.)

Thanks Sam
It seems we are in the same boat. I use Google quite a lot in the mornings for stock market stuff and have found that same symptom, it happens when updating Vipre starts up.
The browser freezes or goes into some incredibly long cycle of some sort making nothing work properly.
If I try to close the browser window IE7, it could take five minutes or more to close then the screen goes dark and the message comes on.
Then there are the times everything totally freezes and nothing except trying to run the Task manager to End Task and restart IE7.
However, that doesn't work all the time either. Black screen doesn't appear instantly upon trying the Task Manager, but it does after a lag period.
The the error message regarding the Login security option failed appears.
I have had to power off to reset everything. This has seemed to be my only out.
I did the complete uninstall. I have the latest up to date drivers for the video card, as that was being accused of having a problem too. It doesn't though.
It all seems to do with this latest update of Vipre.
Before the reinstall I even swapped video cards, taking out the higher quality PCI card and going back to the board integrated graphics set and reinstalling and updating the drivers for that to see if the problem would go away. It didn't.
I thought the dissappearance of the Vipre icon in the system tray after the reinstall was completed was a sign of things to come. Oddly, after the first crash after the complete uninstall/reinstall, where I had to power off again, then the icon reappeared.
Hope they come up with a fix too. I haven't turned Active Protection off to see if that solves any problems. Isn't that one of the reasons I bought the program to have Active protection?

Hi guys,

We are currently researching this issue. We are still collecting logs. If you have not sent logs in please follow these instructions below.

We have not received any crash dump logs, yet. So, if you are having a problem with VIPRE crashing please send me an email for instructions on how to do so. You can put (attn. TimN) in the subject line.

1. First open VIPRE by double clicking on the VIPRE icon in the System tray (Down by the time on your computer)

2. Click on the word “Help” then “About”

3. Then click on the button labeled “Support tools” then “Run Diagnostics”

4. Make sure that all the boxes are checked and click “ok”

5. Once this starts, it will take a couple minutes while the utility gathers information. It will create a file on your desktop called “Sunbelt VIPRE Antivirus + Antispyware Diagnostics.rar”

6. After that file appears, run the following utility: http://tinyurl.com/dmwhmc

If you have any other problems please feel free to contact our support team at support@sunbelt-software.com or by Phone at 1-877-673-1153 M-F 9am-6pm EST and we will have someone work directly with you.

Thanks,
~Tim

OK well time to load up the debugger I guess. Crashed tonight again (still have Active Protection off, so crash recovery is not so painful) and this follows my updating my video and network drivers to the latest (both dated in mid-March). I am beginning to suspect that it has something to do with updating virus signatures. Although I cannot be certain, it seems like when it crashes its right on or near the time it was applying an update.

Hi Sam B,

Thank you for that information. Unfortunately, we have not been able to reproduce this error in house. Getting us a crash dump would be most helpful.

There are many possible causes that can be causing the "logon process has failed to create the security option dialog." error. This seems to be Vista related, as well. Considering we have not seen this occur on any other operating systems.
Please refer to the links below where others have experienced this same issue.
http://www.vistax64.com/vista-performance-maintenance/125112-failure-security-options-logon-process-has-failed-create-dial.html
http://forums.techarena.in/windows-vista-performance/902592.htm
http://forums.techarena.in/vista-security/771124.htm
http://forums.techarena.in/windows-vista-performance/698718.htm
http://forums.techarena.in/vista-administration/925323.htm

I apologize for the inconveniences this has caused. We will continue to research the issue and look forward to receiving the crash dump file from you.

Thank you,
Tim

Hey Tim,

I followed those links you provided; thanks, I did not locate all of those during my initial search regarding the "login process failed" problem. I did notice a mention of "Intel Matrix Storage" drivers in at least one of the threads. My machine (a Gateway with an Intel MB) uses those drivers. I located the most recent Chipset and Storage drivers and have installed those. (If the problem is someplace else but precipitated by Vipre, I'm all for fixing/updating whatever software it takes.)

I did install the debugger per your instructions via email. Can you tell me ... do I need to re-execute the "cscript" command in step 5 after every reboot or is it "sticky?"

I appreciate your assistance. If the service crashes again and produces a crash dump, I will certainly forward it to you. (I can always hope the Intel driver updates helped!)

--
Sam

Hi Sam B,

The command to hook the debugger, step 5, is not sticky. You will need to rerun the command after a system reboot or if the service is interrupted for any other reason.

~Tim

Well, this continues to be a problem for me although the frequency of the crashes has decreased. I am still running with Active Protection turned off. I've had some troubles getting a crash dump and I've just sent support a note seeking their counsel.

Sam B,

Thanks for letting us know. You should hear back from support soon.

I have gone back to the previous version of vipre, bit slower at scanning but so far no crashes and logon box issues. What I don;t get about sunbelt is that they don't think it is vipre. Several other people have the same issue. I know that my problems started when I installed the latest version and have now gone away after installing an older version.

alastair,

We are still investigating the cause of this.

Also we will no longer be moderating this forum, please post any future questions or comments on http://supportforums.sunbeltsoftware....

Thanks,
Peter