SPF BSOD

csc-Don Walker, please upgrade to version 1845 of SPF from http://go.sunbeltsoftware.com/?linkid...
I would like to know if the bluescreen still happens.

PSB - What antivirus program are you running?

To the two of you, I would also like to know what operating systems you are using.

Thanks,
Dodi
Software Test Lead

Dodi: AVG8 on WinXP Pro SP3

Thanks for the reply, PSB, I hate playing the software blame game, but I did receive several crash dumps from users running SPF and an older version of AVG 8.0 while I was running the beta. I'm curious to know what build of AVG you have installed.

Thanks :)

I originally posted this over in the Vipre beta forum when it started happening. I am running XP pro SP3 and Vipre. For what it is worth, the only unusual thing in my TCP stack is a copy of the Cisco VPN client - it was not active at the time.

The earlier Stops tended to happen with the machine idle except for Outlook polling for email accounts. This time I had three or four IE7 sessions up.

For me this started with the SP3 install, I think.

I did upgrade to the latest version after my initial post.

If this goes as before, I will get the next crash in about 2 days.

AVG 8.0.138
I do have OpenVPN installed as well, but the problem presented itself even when it wasn't installed.
I have activated crashdump uploading.
Thing is windows shows SbFw.sys as the erroneous driver.
Even after I disabled HIPS, why would SbFw.sys still be active?
Moreover I do not believe AVG is the issue here because I have another pc running AVG and Sunbelt's Personal Firewall with absolutely no bluescreen issues.
Also XP SP3, also latest version of AVG, also latest version of SPF.
I don't see how this is a problem on my pc, and not the other one.

If possible, could you both activate detailed/advanced logging for the drivers so that in the event the BSOD happens again, I could track down what is happening at the driver level.

When/if the BSOD happens, email support@sunbelt-software.com with the subject For Dodi. Just make sure to include your screen name some where in the post.

I need details on how to set logging levels. Is that in event monitor or process monitor?

Within the SPF application, click on the Logs and Alerts tab, then click on Settings. Towards the bottom, you will see the additional logging feature, above "boot logging".

Thanks :)

Dodi,
Sent an email about the bluescreen and another one with more detailed information.
Please reply ASAP.
Thanks in advance.

PSB,

Sorry about the delay. Tech support did not notify me of the email. I have received both emails now, and have downloaded the crash dumps. I will be in touch with you directly at the email address you initially contacted us from.

EDIT: It appears the crash dump is corrupted and can not be decompressed.

Thanks,
Dodi

Dodi: I see
In that case I think I'll reupload then.
Any particular places where it is preferred?
Rapidshare, megaupload, etc ?

MegaUpload is fine, or you can FTP it to

ftp://ftp.sunbelt-software.com in the supportlogs folder

Dodi

I am uploading them to the ftp under supportlogs/PSB.
Please note that without permission to modify the crashdump.rar I cannot resume, and thus I am forced to upload it as crashdump2.rar.
I am using rar this time because it seems that tar.gz may not work very well for you(that is the default sunbelt created file.)
I am also uploading the files separately. Please note that I am on an unstable connection and as such may not be able to upload all files successfully unless I am given resume capabilities.
I would rather have ftp to megaupload because I know smartftp is more stable than firefox/ie when uploading files. Opera too.
At the moment it seems that everything is messed up, postponing uploads for a bit

No worries. I also sent you an email with my contact information. Did you receive that?

No, however I did receive the email about the ticket number.

uploaded, they are in supportlogs/PSB.
Check crashdump2.rar
the rest are files that either are properly uploaded or failed due to a timeout or something, and cannot be resumed.

I got the logs :) Thanks!
A couple of things I would like you to try:
1. Disable logging of unopened ports
2. Permit Low threats from NIPS
3. Disable uTorrent from running temporarily.

The crash is caused by something that uTorrent.exe is doing to the firewall. I'm not sure if its the amount of connections that you are having, or what, but it appears uTorrent is the source of the crash.

I just wanted to follow up with this to see if by stopping uTorrent, the crashes discontinue.

Thanks,
Dodi

Dodi -
FYI, I am not using uTorrent here. You must have fixed most of the problems with the 1839 release. I think I had two crashes between late July and last week - none since 1845 went in (and I was on vacation for a lot of that time.)

Do you want me to set the crash dump set to "full" or will "mini" do?

I am using another pc with practically the same setup, Dodi.
Even with utorrent that pc does not crash.

csc-DON WALKER - If you can, a full dump would be better. Glad to see 1845 is working well.

PSB - If you get another crash please send it in. I would like to eliminate uTorrent from the picture, as it is what the crash dump is telling me is the cause. If I can get a crash dump with a clearer picture as to what is causing the crash, I can further diagnose the issue.

I could enable a crashdump that includes the entire windows memory dump rather than the kernel dump, but it would be above 1GB.
I don't believe I'll be able to upload this successfully unless I am given resuming rights over the ftp.
Furthermore, I did not perform any of those steps aside from disabling logging on unopened ports, which I enabled because I saw fullscreens and hence did so at my own discretion.
As for HIPS, I recently enabled it.
I am glad to say that with these steps taken(utorrent not turned off) I have yet to encounter a bluescreen but I cannot say that another will not happen.
I will keep vigil on the matter and update you if it happens.
For now I'm just happy things work, heheh.
Thanks, Dodi.

When the full dump is created, it will be compressed, greatly reducing the size.
That being said, I am glad that things seem to be normal for now.
Please feel free to create a new post in the event things go wrong, or email support@sunbelt-software.com

All the best,
Dodi

We will have a new release of SPF shortly (it is being tested at the moment) that fixes another possible bsod situation. There was a race condition that has been addressed.

Dodi

Good day Dodi, it's been a while.
I have encountered this problem again.
still on 1845, seems like theres no update yet.
I used utorrent(I have been using it for half a month without issues, and previously I stopped using it for a month or so. Didn't encounter it. Then I used it for a half month and it happened once, this leads me to think that the issue is not due to utorrent but due to something related to networking that happens when utorrent(I use utorrent along with openvpn) is turned on.
I will upload a .rar of the crashdump soon.

This time I encountered the same problem, but uTorrent wasn't running.
Neither was VPN. I awoke to see that my system had a BSOD caused by SbFw.sys and this really bothers me.
I have emailed Dodi and there has been no reply, even though I have uploaded a new crashdump and emailed the details to him/her.
I am still using 4.6.1845(I read the bit about sunbelt producing an update, something that has not come to fruition even today.)
I tried updating but I only see detection rules(IDSrules) update which does not encompass SbFw.sys. What's disappointing that there has been no reply to this issue even though it has almost been a month.
This is not a case-closed issue, Dodi.
I said I would update whenever I encountered the issue again, and I have.
This lack of service is just disheartening...
Or should I open another report? I think I just will

Just remember, I have another pc running with the same software(AVG8, latest, SPF, also latest. Please do not play the blame the software game when it works there, on the same OS, WinXP SP3.)
At any rate, if anyone cares in this report, I am going to e-mail the url containing the crashdump again.
Cross posting this to another report as well, because it seems that apathy has stained this one.

For me I get a BSOD when I start to play flash content. Same sbfw.sys is to blame.

All,

We will be releasing to the public build 4.6.1861 which resolves any outstanding bluescreens tomorrow (Monday).

KP, the BSOD with flash content should be fixed for you, too. I'm not sure if any of you are running Google Chrome, but we have addressed multiple fixes for Chrome as well.

Thanks,
Dodi

All,

We have released build 4.6.1861 to the public. You can download it via SPF by clicking on the Update button, or by visiting the link below:

http://PSC.sunbelt-software.com/SPURS...

Please let us know if you continue to encounter blue screens.

All the best,
Dodi

Hi, I'm running SPF v4.6.1861 on Vista SP1 with AVG v8.0.238. I'm getting a blue screen in a roundabout kind of way...

Normally when I'm finished with my laptop I close the lid which puts it to sleep and then after a certain amount of time it goes into hibernation. Twice recently though when I come back the laptop is still powered up but with a blank screen and powers off instantly when I press the off button. When it restarts it tells me it has recovered from a blue screen error and windbg is pointing at sbfw.sys (SbFw+158fc).

I had a look in the error logs and there's nothing obvious there. I've uploaded the minidump from the crash; will this be enough or do you need a full dump?

http://www.mediafire.com/?sharekey=78...

Cheers,
Jon

Hello Long Jon, Thank you for posting your question.
We will take a look at this minidump file and let you know what we find sometime soon.

Thanks,
Peter

Long Jon, it seems to be caused by a file named NETw4v32.sys which appears to be from the Intel wireless adapter driver. We suggest you update that driver and see if that resolves the crash message.

Please let us know if you have any questions.

Hi Peter,

It turns out a recent update for the wireless driver solved one problem I was having (drop outs) but caused another! Anyway shortly after this they released another one which seems to be working fine for me.

Thanks for your help,
Jon

Long Jon, Glad to hear you were able to get it working.
If you run into any other problems or have any questions please let me know.
Thanks,
Peter