The computer has rebooted from a bugcheck. The bugcheck was: 0x100000d1

[Nykolaj1979]

Hi all,

If somebody could help me regarding these blue screens that I recive on a Fujitsu Siemens Laptop by having the Cisco VPN Client version 4.8 installed on it.

I've noticed some strange WinXP behavior since the installation has been done.

In some cases after I start the program "C:\Program Files\Cisco Systems\VPN Client\vpngui.exe"
the Laptop on which I'm working on turns to a blue screen and it's rebooting after that by it self.


In Event Viewer I've noticed the following information/error messages:

Before reboot, error message:
=============================
The IPSEC Services service terminated with the following error:
Only one usage of each socket address (protocol/network address/port) is normally permitted.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.



And after reboot, information message:
=======================================
The computer has rebooted from a bugcheck.
The bugcheck was: 0x100000d1 (0x00000015, 0x00000002, 0x00000000, 0xf7b724b9). A dump was saved in: C:\WINNT\Minidump\Mini111706-01.dmp.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

By using the Dump Check for the Mini*.dmp files I receive the output which can be also seen in the attached file.

I saw that in the output is poiting also to the CISCO System VPN adapter CVirtA.sys.


The computer which I'm using it has a WIN XP CAT System installed.

By trying to analyze the Crash Mini Dump files with the WinDbg Tool the following module is shown: MODULE_NAME: dne2000 IMAGE_NAME: dne2000.sys
Bug check Analysis -> DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)

Here are the steps - which lead to this error:
1) Connect to VPN
2) After connection has been established, in 5~30 minutes I noticed that OS crashes if in this period of time remote testing is used.
3) I receive the blue screen stating that maybe "dne2000.sys" as the likely problem and the crash is a DRIVER_IRQL_NOT_LESS_OR_EQUAL error.

Can you help me further regarding this problem ?

Thank you,
Nicky

 

[peterdiva]

There might be a conflict with Zonealarm. Update Zonealarm and see what happens.

Also, is there a firewall componet to Trend Micro AV? The info on tm_cfw.sys is that it's a firewall file.

 

[Nykolaj1979]

Fw

Yes...I have the Windows Firewall On (I did not change that setting),...but yes also the Trend Micro PFW was On.

I've managed to modify the registry key name
HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\PFW\AllowConfigPFW from value 0 to 1.
I've noticed that this behavior of blue screen when I'm using the Cisco VPN
Client did not reapear since then.

Can you give me some more infos about this ?
Why could this conflict happen ?

Thanks,
Nicky

 

[peterdiva]

You should only have one firewall running. Did modifying the registry key mentioned disable the Trend Micro firewall?

If you still have Zonealarm installed then you should turn the Windows firewall off. Zonealarm is better as it notifies you of programs that try to connect to the Internet.

 

[Nykolaj1979]

okay...you mean is not Trend Micro PFW the problem ?

Yes, by modifying the registry key mentioned the disable/enable button apears wich in normal cases is there, but i'm having a corporate specific installation, and so that's why I need this trick

That's why we do not have Zonealarm installed

But I found this on the internet in the mean time :

CSCse31161

After a vpn session is connected between 30 seconds and one hour, a blue screen of death occurs. The conditions are as follows:

–A Microsoft OS is installed with the Cisco vpn client and Trend Micro Office Scan version 7.3.
–The Trend Micro FW is activated (the VPN build in FW is deactivated)
–The vpn client is launched and the session gets connected.

Release Notes for VPN Client, Release 4.8
http://www.cisco.com/en/US/products/sw/secursw/ps2308/prod_release_note09186a00806eb4ed.html


Seems to be more or less the same behavior, I think

Nicky


PS : What I quite do to understand is:

what does mean the VPN build in FW is deactivated....is the PFW or another module of Trend Micro AV ?