AARRGGH Cisco VPN Client resets PC on installation

Recently the Cisco VPN client stopped working - version 4.8.01.0300-k9
(Windows XP2, Athlon XP, Asus nforce2 A7N8X motherboard). Actually
rather more than that - firing it up caused the PC to reset.

I tried to uninstall/reinstall but even doing this caused the PC to
reset itself midway through the process. Used System Restore to go back
in time but no difference.

Then it got worse after further fiddling (trying to uninstall/install
in Safe mode - also resets PC) as the connection to the internet and
the internal network went down - eventually I traced these to the
deterministic drivers (which you have to remove manually as they dont
allow deletion, even in safe mode - see
http://www.cisco.com/warp/public/471/vpn3K_uninstall.pdf for details of
manual removal) and got rid of them to get the network & internet
working again.

Then I tried to install the VPN again but again it crashed the PC - but
at least this time it left the network & internet intact.

So now the PC works but the VPN is only partially installed. Any ideas
how to get it installed and working?

Chris

 

do you have vpn clients by other manufacturers installed ? - I had a similar problem after trying to install the cisco
vpn client "on top" of checkpoint secure remote.

it was simply not possible.
don't ask me which versions those were, though.


M

 

Hi Mak

Nope, no other VPNs installed. And it was working a few weeks ago. Have
managed to install the Cisco VPN after using EndItAll to kill
everything else (Avast and ZoneAlarm in particular), but on running it
resets the PC immediately after establishing the connection.

In the event log it lists Save Dump with the following text;

The computer has rebooted from a bugcheck. The bugcheck was:
0x100000d1 (0x00894fdd, 0x00000002, 0x00000000, 0x88bfc024). A dump was
saved in: C:\WINDOWS\Minidump\Mini010407-01.dmp.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

the 0x100000d1 error number is always the same, the others vary.

Any other suggestions?

Chris

 

that's what I would do:
try different versions of the vpn client,
try different nic

what exactly are you using anyway?
which OS?

M

 

Ok I've tried earlier versions of the VPN with the same reset effect.
Have also tried different removing & reseating memory just in case
there was a hardware error, and disabling virtual memory in case of HD
error. Havent tried different nic yet because the existing one is built
into the nforce2 motherboard (Asus a7n8x) and anyway this was working
all working fine a few weeks ago. No hardware has changed, and Ive
tried uninstalling any recent software but to no effect.

Have managed to get it to stop at BSOD now with either a 0x00000D1
error saying 'DRIVER_IRQL_NOT_LESS OR EQUAL' or a 0x00000BE error 'An
attempt was made to write to read-only memory'

Have tried Windbg on the minidumps; here is an example of what I get:
(hmmm I wonder if the problem is zonelarm which has the vsdatant driver
- will try clean reinstall and see what happens)


--------------------------
Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini010407-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV**http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Thu Jan 4 00:00:53.062 2007 (GMT+0)
System Uptime: 0 days 0:10:51.669
Loading Kernel Symbols
.........................................................................................................................................................
Loading User Symbols
Loading unloaded module list
.............
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 100000D1, {894fdd, 2, 0, 88bfc024}

Unable to load image vsdatant.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for vsdatant.sys
*** ERROR: Module load completed but symbols could not be loaded for
vsdatant.sys
Probably caused by : vsdatant.sys ( vsdatant+44741 )

Followup: MachineOwner

kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid)
address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00894fdd, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 88bfc024, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: 00894fdd

CURRENT_IRQL: 2

FAULTING_IP:
+ffffffff88bfc024
88bfc024 a0dd4f8900 mov al,byte ptr ds:[00894FDDh]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xD1

PROCESS_NAME: Idle

LAST_CONTROL_TRANSFER: from b93144f8 to 88bfc024

STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be
wrong.
8054f8f8 b93144f8 02c6000e ff02a8c0 89536880 0x88bfc024
8054f924 b931270a 88c60008 8054f902 00000001 tcpip!ARPTransmit+0x125
8054f954 b93124a9 88ba5998 ff02a8c0 89536880 tcpip!SendIPPacket+0x18e
8054faa0 b9316b83 b93506b4 88f42878 8918b07c tcpip!IPTransmit+0x287f
8054fb40 b931694a 88dee008 88f42878 891b7008 tcpip!UDPSend+0x41b
8054fb64 b93169b0 0254fb88 89f5dd50 8918b0bc tcpip!TdiSendDatagram+0xd5
8054fb9c b9315308 891b7008 891b709c 891b8900 tcpip!UDPSendDatagram+0x4f
8054fbb8 b92a1741 8a0d8ca8 891b7008 b92a01f4
tcpip!TCPDispatchInternalDeviceControl+0xff
8054fbe4 bae8c8b3 894db100 891b709c 894db100 vsdatant+0x44741
8054fbf8 f7821dc2 784b555f 10000001 5f554b78
USBPORT!USBPORTSVC_LogEntry+0x41
8054fc24 8a065bac 8a2ea9dc 894db100 895a8928
usbehci!EHCI_UnlockQueueHead+0x4c
8054fc4c f7822e5a 8a2ea9dc 015a8928 894db2a0 0x8a065bac
8054fc74 bae7a985 806ee720 895a87b0 8a2ea0e0
usbehci!EHCI_BulkTransfer+0x150
8054fc98 50726261 8a2ea9dc 72424166 0054fce0
USBPORT!USBPORT_FlushAbortList+0x4b3
8054fcac bae7c394 58726261 804e2eb4 895a87b0 0x50726261
8054fce4 8054fce8 8054fce8 895a8870 8a2ea0e0
USBPORT!USBPORT_FlushCancelList+0x3ce
00000000 00000000 00000000 00000000 00000000
nt!KiDoubleFaultStack+0x2868


STACK_COMMAND: kb

FOLLOWUP_IP:
vsdatant+44741
b92a1741 ?? ???

SYMBOL_STACK_INDEX: 8

SYMBOL_NAME: vsdatant+44741

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: vsdatant

IMAGE_NAME: vsdatant.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 44ed374a

FAILURE_BUCKET_ID: 0xD1_vsdatant+44741

BUCKET_ID: 0xD1_vsdatant+44741

Followup: MachineOwner

 

Forgot to say - WinXP SP2 all patches installed as far as I know...

 

OK Ive completely removed Zonealarm (and replaced it with Comodo) and
the VPN works now. Dont know why Zonealarm kept resetting the machine
but dont care any more!

 

congratulations,

 

Hi it's me again
I've got problem with Comodo. My system is configured to allow
simultaneous remote desktop access by two people. But if there are two
concurrent logins, Comodo is disabled (I think it clashes with itself).
So I can't use it unless anyone knows a fix.
Have tried other Firewalls too, eg Outpost & Kerio but havent managed
to configure to allow all of the following:

Internet Connection Sharing
Remote Desktop
Cisco VPN.

So back to Zonealarm which has worked in the past with the above but
now crashes PC. (see the debug report earlier in this thread for more
details). Any more ideas on how to get Zonealarm working with the
above?

 

Anyone? Ive tried sending an Email to but
havent had a response yet ...