[rongill]

blue screen of death after installing zonelabs checkpoint integrity flex with true vector. After I install it i get the BSOD. Here are the minidump files if anyone can help me. Unfortunately I need zonelabs for our cisco vpn client to work.

There are all 6 minidump files

DUMP 1

Microsoft ® Windows Debugger Version 6.11.0001.404 X86
Copyright © Microsoft Corporation. All rights reserved.

Loading Dump File [C:\minidump\Mini041609-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: http://msdl.microsof...ownload/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp.050329-1536
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Thu Apr 16 14:26:52.796 2009 (GMT-7)
System Uptime: 0 days 0:52:02.484
Loading Kernel Symbols
...............................................................
................................................................
.......
Loading User Symbols
Loading unloaded module list
...............
*******************************************************************************

* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {4, 1c, 0, 804f9f5f}

Probably caused by : ntkrpamp.exe ( nt!KeSetEvent+13 )

Followup: MachineOwner

---------

0: kd> !analyze -v
*******************************************************************************

* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000004, memory referenced
Arg2: 0000001c, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 804f9f5f, address which referenced memory

Debugging Details:

------------------

READ_ADDRESS: 00000004

CURRENT_IRQL: 1c

FAULTING_IP:
nt!KeSetEvent+13
804f9f5f 8b7904 mov edi,dword ptr [ecx+4]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: vsmon.exe

LAST_CONTROL_TRANSFER: from 8061bd88 to 804f9f5f

STACK_TEXT:
a2cb4be0 8061bd88 00000000 00000000 00000000 nt!KeSetEvent+0x13
a2cb4ddc 805450de b9d30b85 877d70c0 00000000 nt!CcPfBootWorker+0x4ac
a2cb4de4 877d70c0 00000000 4000027f 02e90000 nt!KiThreadStartup+0x16
WARNING: Frame IP not in any known module. Following frames may be wrong.
a2cb4de8 00000000 4000027f 02e90000 5ad72679 0x877d70c0

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KeSetEvent+13
804f9f5f 8b7904 mov edi,dword ptr [ecx+4]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!KeSetEvent+13

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4249fa54

FAILURE_BUCKET_ID: 0xA_nt!KeSetEvent+13

BUCKET_ID: 0xA_nt!KeSetEvent+13

Followup: MachineOwner

---------

__________________

DUMP 2

Microsoft ® Windows Debugger Version 6.11.0001.404 X86
Copyright © Microsoft Corporation. All rights reserved.

Loading Dump File [C:\minidump\Mini041609-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: http://msdl.microsof...ownload/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp.050329-1536
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Thu Apr 16 14:28:01.484 2009 (GMT-7)
System Uptime: 0 days 0:00:38.183
Loading Kernel Symbols
...............................................................
................................................................
.......
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************

* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {4, 1c, 0, 804f9f5f}

Probably caused by : ntkrpamp.exe ( nt!KeSetEvent+13 )

Followup: MachineOwner

---------

0: kd> !analyze -v
*******************************************************************************

* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000004, memory referenced
Arg2: 0000001c, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 804f9f5f, address which referenced memory

Debugging Details:

------------------

READ_ADDRESS: 00000004

CURRENT_IRQL: 1c

FAULTING_IP:
nt!KeSetEvent+13
804f9f5f 8b7904 mov edi,dword ptr [ecx+4]

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: vsmon.exe

LAST_CONTROL_TRANSFER: from 8061bd88 to 804f9f5f

STACK_TEXT:
ba1f7be0 8061bd88 00000000 00000000 00000000 nt!KeSetEvent+0x13
ba1f7d74 00000000 00000000 00000000 00000000 nt!CcPfBootWorker+0x4ac

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KeSetEvent+13
804f9f5f 8b7904 mov edi,dword ptr [ecx+4]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!KeSetEvent+13

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4249fa54

FAILURE_BUCKET_ID: 0xA_nt!KeSetEvent+13

BUCKET_ID: 0xA_nt!KeSetEvent+13

Followup: MachineOwner

---------

_________________________

DUMP 3

Microsoft ® Windows Debugger Version 6.11.0001.404 X86
Copyright © Microsoft Corporation. All rights reserved.

Loading Dump File [C:\minidump\Mini041609-03.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: http://msdl.microsof...ownload/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp.050329-1536
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Thu Apr 16 14:32:30.984 2009 (GMT-7)
System Uptime: 0 days 0:02:24.664
Loading Kernel Symbols
...............................................................
................................................................
....
Loading User Symbols
Loading unloaded module list
..............
*******************************************************************************

* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {4, 1c, 0, 804f9f5f}

Probably caused by : ntkrpamp.exe ( nt!KeSetEvent+13 )

Followup: MachineOwner

---------

0: kd> !analyze -v
*******************************************************************************

* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000004, memory referenced
Arg2: 0000001c, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 804f9f5f, address which referenced memory

Debugging Details:

------------------

READ_ADDRESS: 00000004

CURRENT_IRQL: 1c

FAULTING_IP:
nt!KeSetEvent+13
804f9f5f 8b7904 mov edi,dword ptr [ecx+4]

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: vsmon.exe

LAST_CONTROL_TRANSFER: from 8061bd88 to 804f9f5f

STACK_TEXT:
a19f5be0 8061bd88 00000000 00000000 00000000 nt!KeSetEvent+0x13
a19f5ddc 805450de b9d30b85 87796bf8 00000000 nt!CcPfBootWorker+0x4ac
a19f5de4 87796bf8 00000000 4000027f 02e90000 nt!KiThreadStartup+0x16
WARNING: Frame IP not in any known module. Following frames may be wrong.
a19f5de8 00000000 4000027f 02e90000 5ad72679 0x87796bf8

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KeSetEvent+13
804f9f5f 8b7904 mov edi,dword ptr [ecx+4]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!KeSetEvent+13

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4249fa54

FAILURE_BUCKET_ID: 0xA_nt!KeSetEvent+13

BUCKET_ID: 0xA_nt!KeSetEvent+13

Followup: MachineOwner

[Advertisements]

______________________

DUMP 4

Microsoft ® Windows Debugger Version 6.11.0001.404 X86
Copyright © Microsoft Corporation. All rights reserved.

Loading Dump File [C:\minidump\Mini041609-04.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: http://msdl.microsof...ownload/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp.050329-1536
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Thu Apr 16 14:35:59.562 2009 (GMT-7)
System Uptime: 0 days 0:01:54.258
Loading Kernel Symbols
...............................................................
................................................................
....
Loading User Symbols
Loading unloaded module list
.............
*******************************************************************************

* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {4, 1c, 0, 804f9f5f}

Probably caused by : ntkrpamp.exe ( nt!KeSetEvent+13 )

Followup: MachineOwner

---------

0: kd> !analyze -v
*******************************************************************************

* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000004, memory referenced
Arg2: 0000001c, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 804f9f5f, address which referenced memory

Debugging Details:

------------------

READ_ADDRESS: 00000004

CURRENT_IRQL: 1c

FAULTING_IP:
nt!KeSetEvent+13
804f9f5f 8b7904 mov edi,dword ptr [ecx+4]

CUSTOMER_CRASH_COUNT: 4

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: vsmon.exe

LAST_CONTROL_TRANSFER: from 8061bd88 to 804f9f5f

STACK_TEXT:
a14b3be0 8061bd88 00000000 00000000 00000000 nt!KeSetEvent+0x13
a14b3ddc 805450de b9d30b85 89894648 00000000 nt!CcPfBootWorker+0x4ac
a14b3de4 89894648 00000000 4000027f 02e90000 nt!KiThreadStartup+0x16
WARNING: Frame IP not in any known module. Following frames may be wrong.
a14b3de8 00000000 4000027f 02e90000 5ad72679 0x89894648

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KeSetEvent+13
804f9f5f 8b7904 mov edi,dword ptr [ecx+4]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!KeSetEvent+13

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4249fa54

FAILURE_BUCKET_ID: 0xA_nt!KeSetEvent+13

BUCKET_ID: 0xA_nt!KeSetEvent+13

Followup: MachineOwner

---------

________________________

DUMP 5

Microsoft ® Windows Debugger Version 6.11.0001.404 X86
Copyright © Microsoft Corporation. All rights reserved.

Loading Dump File [C:\minidump\Mini041609-05.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: http://msdl.microsof...ownload/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp.050329-1536
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Thu Apr 16 14:46:38.734 2009 (GMT-7)
System Uptime: 0 days 0:04:55.430
Loading Kernel Symbols
...............................................................
................................................................
.

Loading User Symbols
Loading unloaded module list
................
*******************************************************************************

* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {4, 1c, 0, 804f9f5f}

Probably caused by : ntkrpamp.exe ( nt!KeSetEvent+13 )

Followup: MachineOwner

---------

0: kd> !analyze -v
*******************************************************************************

* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000004, memory referenced
Arg2: 0000001c, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 804f9f5f, address which referenced memory

Debugging Details:

------------------

READ_ADDRESS: 00000004

CURRENT_IRQL: 1c

FAULTING_IP:
nt!KeSetEvent+13
804f9f5f 8b7904 mov edi,dword ptr [ecx+4]

CUSTOMER_CRASH_COUNT: 5

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: vsmon.exe

LAST_CONTROL_TRANSFER: from 8061bd88 to 804f9f5f

STACK_TEXT:
b1959be0 8061bd88 00000000 00000000 00000000 nt!KeSetEvent+0x13
b1959ddc 805450de ba530b85 89af98d0 00000000 nt!CcPfBootWorker+0x4ac
b1959de4 89af98d0 00000000 4000027f 02e90000 nt!KiThreadStartup+0x16
WARNING: Frame IP not in any known module. Following frames may be wrong.
b1959de8 00000000 4000027f 02e90000 5ad72679 0x89af98d0

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KeSetEvent+13
804f9f5f 8b7904 mov edi,dword ptr [ecx+4]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!KeSetEvent+13

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4249fa54

FAILURE_BUCKET_ID: 0xA_nt!KeSetEvent+13

BUCKET_ID: 0xA_nt!KeSetEvent+13

Followup: MachineOwner

---------

_________________________

DUMP 6

Microsoft ® Windows Debugger Version 6.11.0001.404 X86
Copyright © Microsoft Corporation. All rights reserved.

Loading Dump File [C:\minidump\Mini041609-06.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: http://msdl.microsof...ownload/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp.050329-1536
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Thu Apr 16 15:07:32.515 2009 (GMT-7)
System Uptime: 0 days 0:00:32.211
Loading Kernel Symbols
...............................................................
................................................................
.......
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************

* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {4, 1c, 0, 804f9f5f}

Probably caused by : ntkrpamp.exe ( nt!KeSetEvent+13 )

Followup: MachineOwner

---------

1: kd> !analyze -v
*******************************************************************************

* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000004, memory referenced
Arg2: 0000001c, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 804f9f5f, address which referenced memory

Debugging Details:

------------------

READ_ADDRESS: 00000004

CURRENT_IRQL: 1c

FAULTING_IP:
nt!KeSetEvent+13
804f9f5f 8b7904 mov edi,dword ptr [ecx+4]

CUSTOMER_CRASH_COUNT: 6

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: vsmon.exe

LAST_CONTROL_TRANSFER: from 8061bd88 to 804f9f5f

STACK_TEXT:
b9363be0 8061bd88 00000000 00000000 00000000 nt!KeSetEvent+0x13
b9363d74 00000000 00000000 00000000 00000000 nt!CcPfBootWorker+0x4ac

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KeSetEvent+13
804f9f5f 8b7904 mov edi,dword ptr [ecx+4]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!KeSetEvent+13

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4249fa54

FAILURE_BUCKET_ID: 0xA_nt!KeSetEvent+13

BUCKET_ID: 0xA_nt!KeSetEvent+13

Followup: MachineOwner

[rongill]

______________________

DUMP 4

Microsoft ® Windows Debugger Version 6.11.0001.404 X86
Copyright © Microsoft Corporation. All rights reserved.

Loading Dump File [C:\minidump\Mini041609-04.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: http://msdl.microsof...ownload/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp.050329-1536
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Thu Apr 16 14:35:59.562 2009 (GMT-7)
System Uptime: 0 days 0:01:54.258
Loading Kernel Symbols
...............................................................
................................................................
....
Loading User Symbols
Loading unloaded module list
.............
*******************************************************************************

* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {4, 1c, 0, 804f9f5f}

Probably caused by : ntkrpamp.exe ( nt!KeSetEvent+13 )

Followup: MachineOwner

---------

0: kd> !analyze -v
*******************************************************************************

* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000004, memory referenced
Arg2: 0000001c, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 804f9f5f, address which referenced memory

Debugging Details:

------------------

READ_ADDRESS: 00000004

CURRENT_IRQL: 1c

FAULTING_IP:
nt!KeSetEvent+13
804f9f5f 8b7904 mov edi,dword ptr [ecx+4]

CUSTOMER_CRASH_COUNT: 4

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: vsmon.exe

LAST_CONTROL_TRANSFER: from 8061bd88 to 804f9f5f

STACK_TEXT:
a14b3be0 8061bd88 00000000 00000000 00000000 nt!KeSetEvent+0x13
a14b3ddc 805450de b9d30b85 89894648 00000000 nt!CcPfBootWorker+0x4ac
a14b3de4 89894648 00000000 4000027f 02e90000 nt!KiThreadStartup+0x16
WARNING: Frame IP not in any known module. Following frames may be wrong.
a14b3de8 00000000 4000027f 02e90000 5ad72679 0x89894648

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KeSetEvent+13
804f9f5f 8b7904 mov edi,dword ptr [ecx+4]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!KeSetEvent+13

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4249fa54

FAILURE_BUCKET_ID: 0xA_nt!KeSetEvent+13

BUCKET_ID: 0xA_nt!KeSetEvent+13

Followup: MachineOwner

---------

________________________

DUMP 5

Microsoft ® Windows Debugger Version 6.11.0001.404 X86
Copyright © Microsoft Corporation. All rights reserved.

Loading Dump File [C:\minidump\Mini041609-05.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: http://msdl.microsof...ownload/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp.050329-1536
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Thu Apr 16 14:46:38.734 2009 (GMT-7)
System Uptime: 0 days 0:04:55.430
Loading Kernel Symbols
...............................................................
................................................................
.

Loading User Symbols
Loading unloaded module list
................
*******************************************************************************

* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {4, 1c, 0, 804f9f5f}

Probably caused by : ntkrpamp.exe ( nt!KeSetEvent+13 )

Followup: MachineOwner

---------

0: kd> !analyze -v
*******************************************************************************

* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000004, memory referenced
Arg2: 0000001c, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 804f9f5f, address which referenced memory

Debugging Details:

------------------

READ_ADDRESS: 00000004

CURRENT_IRQL: 1c

FAULTING_IP:
nt!KeSetEvent+13
804f9f5f 8b7904 mov edi,dword ptr [ecx+4]

CUSTOMER_CRASH_COUNT: 5

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: vsmon.exe

LAST_CONTROL_TRANSFER: from 8061bd88 to 804f9f5f

STACK_TEXT:
b1959be0 8061bd88 00000000 00000000 00000000 nt!KeSetEvent+0x13
b1959ddc 805450de ba530b85 89af98d0 00000000 nt!CcPfBootWorker+0x4ac
b1959de4 89af98d0 00000000 4000027f 02e90000 nt!KiThreadStartup+0x16
WARNING: Frame IP not in any known module. Following frames may be wrong.
b1959de8 00000000 4000027f 02e90000 5ad72679 0x89af98d0

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KeSetEvent+13
804f9f5f 8b7904 mov edi,dword ptr [ecx+4]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!KeSetEvent+13

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4249fa54

FAILURE_BUCKET_ID: 0xA_nt!KeSetEvent+13

BUCKET_ID: 0xA_nt!KeSetEvent+13

Followup: MachineOwner

---------

_________________________

DUMP 6

Microsoft ® Windows Debugger Version 6.11.0001.404 X86
Copyright © Microsoft Corporation. All rights reserved.

Loading Dump File [C:\minidump\Mini041609-06.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: http://msdl.microsof...ownload/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp.050329-1536
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Thu Apr 16 15:07:32.515 2009 (GMT-7)
System Uptime: 0 days 0:00:32.211
Loading Kernel Symbols
...............................................................
................................................................
.......
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************

* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {4, 1c, 0, 804f9f5f}

Probably caused by : ntkrpamp.exe ( nt!KeSetEvent+13 )

Followup: MachineOwner

---------

1: kd> !analyze -v
*******************************************************************************

* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000004, memory referenced
Arg2: 0000001c, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 804f9f5f, address which referenced memory

Debugging Details:

------------------

READ_ADDRESS: 00000004

CURRENT_IRQL: 1c

FAULTING_IP:
nt!KeSetEvent+13
804f9f5f 8b7904 mov edi,dword ptr [ecx+4]

CUSTOMER_CRASH_COUNT: 6

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: vsmon.exe

LAST_CONTROL_TRANSFER: from 8061bd88 to 804f9f5f

STACK_TEXT:
b9363be0 8061bd88 00000000 00000000 00000000 nt!KeSetEvent+0x13
b9363d74 00000000 00000000 00000000 00000000 nt!CcPfBootWorker+0x4ac

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KeSetEvent+13
804f9f5f 8b7904 mov edi,dword ptr [ecx+4]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!KeSetEvent+13

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4249fa54

FAILURE_BUCKET_ID: 0xA_nt!KeSetEvent+13

BUCKET_ID: 0xA_nt!KeSetEvent+13

Followup: MachineOwner

[edge2022]

Check your RAM. Nt Kernel causing a BSOD with an IRQL error points to possible RAM issues.
Click on "Memtest Instructions" in my sig, and follow the steps.

[rongill]

will do .. its a brand new dell laptop with vista running before and no problems.

[edge2022]

What other security software do you have running or installed on your computer. There might be a conflicting issue with two security suites.

[rongill]

dont have anything. It is a fresh install of Winxp and all the drivers. Windows office/adobe.

It is a dell m1330 XPS series.

[edge2022]

Exactly when do you get the blue screen? At bootup or when you start Checkpoint Integrity?

Can you zip up and attach your minidumps. I'll try to see what I come up with. The process causing this is the Zonealarm firewall and the failing image name is part of the OS Kernel and System core components.

[rongill]

It happens right when checkpoint starts after installing.

Attached Files

•  minidump.zip   97.51KB   145 downloads

Edited by rongill, 04 May 2009 - 04:13 PM.

[edge2022]

When I analyzed your minidump from Saturday April 25, the faulting image was Pool_Corruption (memory issues) and the faulting process was scanstub.exe
Scanstub belongs to Norton.

The other ones, point to the NT Kernel with an IRQL error.
Please check your RAM. Click on "Memtest Instructions" in my sig, and follow the instructions. We need to see if this really is the source of the problem.

[rongill]

I am doing the memory test now. Will keep you posted.

[edge2022]

All right. Uninstall Checkpoint Integrity, and reboot. Then in safe mode, try installing it again.

[rongill]

no errors on each memory stick . i let it run overnight.

I tried installing it in safemode. It did install but had an X on it in the taskbar saying system error please reboot.

Once I rebooted into normal mode and logged in I got the BSOD irq less or not equal.

[edge2022]

Uninstall Checkpoint Integrity in safe mode, and then boot into normal mode. Is everything ok? (no BSODs or errors)
Disconnect from the internet. Then, close every other security program you have running in safe mode. Then try to install Checkpoint again.

• A Stop 0xA message might occur after installing a faulty device driver, system service, or firmware. If a Stop message lists a driver by name, disable, remove, or roll back the driver to correct the problem. If disabling or removing drivers resolves the issues, contact the manufacturer about a possible update. Using updated software is especially important for multimedia applications, antivirus scanners, and CD mastering tools.

• A Stop 0xA message might also be due to failing or defective hardware. If a Stop message points to a category of devices (video or disk adapters, for example), try removing or replacing the hardware to determine if it is causing the problem.

If that doesn't work, then uninstall Checkpoint again, and update all your drivers and security programs.

[rongill]

When i uninstall it and boot .. no errors.

The laptop itself is a few months old and I just did a fresh install of windows xp and drivers. I have no other security programs running. In your note u said something was related to norton. I didn't install that but I will check.

This version of zonelabs checkpoint is quite old and that maybe the problem.

[edge2022]

This version of zonelabs checkpoint is quite old and that maybe the problem.

Very likely, try getting a newer version.
Not sure about the Norton thing.