This content has been marked as final. Show 45 replies
Without an analysis on the full memory dump, it's very difficult to know why you're getting a blue screen.
Have you opened a new SR with support and submitted the memory dump?
I know this is an old post, but how is HIPS 6.1 going in terms of blue screens?
We have about 20 testers, and one blue screen so far. The user did not capture the debug info so we don't know if it is McAfe related. We have his computer in full mem dump mode should it happen again.
Computer is an IBM T60
This is the first bluescreen I've heard of regarding 6.1.
When resreaching the computer, I found out the user was using the Cisco VPN.
When I researched McAfee's site, I found a doucment that list supported VPN products.
McAfee recommends Cisco VPN 4.8.00.0440 or later. We were running 4.6.00.0045 on this host.
The user has upgraded and will test again. Meanwhile support is aware of this issue and is verifying whether of not the bluescreen was called by the Cisco VPN client.
We've had several PCs with blue screens since deploying HIPS. The blue screen is most apparent when connecting via VPN. The problem persists with both Cisco VPN client 4.6 and 4.8.
Whats the fix for this!?!?
Have you tried turning off Cisco's Stateful Firewall feature in the client?
We have the same issue. Sending mem dumps to support.
I'll have to try that, thanks!
VPN stateful firewall is not on
My company has engaged both McAfee and Cisco to solve the blue screen issue but I do have a work around.
The Cisco VPN client comes bundled with the Zone Alarm firewall. There is a conflict with HIPS and the Zone Alarm FW driver vsdatant.sys.
The funny thing is that Zone Alarm is a CheckPoint product who is a competitor of Cisco.
I simply removed the driver/firewall component from the VPN client and rebooted. No more blue screens. Also, the firewall menu option in the client is now gone as well.
I do not know of any large enterprises that would use the Cisco unmanaged firewall in the VPN client in lieu of products like McAfee, ISS, etc. You cannot configure the FW in any way so I do not see the point. What is worse, if your laptop is in a Starbuck's using 802.11, you have no firewall protection unless you are on VPN.
The following section provides instructions for disabling the Cisco VPN Client Firewall component. This will resolve conflicts and subsequent Blue Screen crashes.
1 Open the Device Management console (Control Panel > Administrative Tools * > Computer Management > Device Manager node)
* If this icon is not visible, select the Switch to Classic View option in the left pane of the Control Panel window.
2 From the drop down menu select View > Show hidden devices
3 Expand the Non-Plug and Play Drivers node and scroll down to the vsdatant device.
4 Right click on vsdatant and select uninstall. If prompted, click OK to remove the device. You will need to restart Windows for the changes to take effect, however it should auto reboot after removing the device.