Blue screen durch vsdatant.sys

Hi,
Immer wenn man Drop Box, Azureus oder das Tor Netzwerk startet kommt unten angegebener Blue screen.
Ich habe Zone Alarm deinstalliert. Comodo ausprobiert , andere Datei verursacht das Problem afd.sys, Ms Fix geladen, gleiches Problem wieder. Memtestx84 gemacht - alles Ok. Grafik treiber neu - alles beim alten geblieben. Zone alarm alte version - alles gleich. Virenscan und Registryclean alles gemacht. Ich würde mich über Hilfe wirklich freuen!

System:

Computer:
Betriebssystem Microsoft Windows XP Professional
OS Service Pack Service Pack 3
DirectX 4.09.00.0904 (DirectX 9.0c)

Motherboard:
CPU Typ Intel Pentium III Xeon, 3333 MHz (8 x 417)
Motherboard Name Asus P5Q Turbo Pro Chipsatz:Intel P45
Arbeitsspeicher 3328 MB
BIOS Typ AMI (06/15/09)
Anschlüsse (COM und LPT) Kommunikationsanschluss (COM1)

Anzeige:
Grafikkarte ATI Radeon HD 4800 Series (1024 MB)
Grafikkarte ATI Radeon HD 4800 Series (1024 MB)
Multimedia:
Soundkarte HD Audio rear output

Datenträger:
IDE Controller Intel(R) ICH10R SATA AHCI Controller
IDE Controller JMB36X Standard Dual Channel PCIE IDE Controller
SCSI/RAID Controller JMicron JMB36X Controller
Festplatte WDC WD1500HLFS-01G6U1 (139 GB, IDE)
Festplatte WDC WD20EVDS-63T3B0 (1863 GB, IDE)
Optisches Laufwerk ATAPI iHAS324 A
S.M.A.R.T. Festplatten-Status OK

Partitionen:
C: (NTFS) 143086 MB (114207 MB frei)
D: (NTFS) 1907726 MB (1430922 MB frei)
Speicherkapazität 2002.7 GB (1508.9 GB frei)

E
Netzwerk:
Netzwerkkarte D-Link DWA-547 RangeBooster N650 Desktop Adapter (192.168.178.21)

Dump File:

Microsoft (R) Windows Debugger Version 6.10.0003.233 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini042912-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Sun Apr 29 15:25:42.218 2012 (GMT+2)
System Uptime: 0 days 0:02:39.913
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
...............................................................
................................................................
.............................
Loading User Symbols
Loading unloaded module list
................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {e36b5000, 2, 1, 8060d96c}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*** WARNING: Unable to verify timestamp for vsdatant.sys
*** ERROR: Module load completed but symbols could not be loaded for vsdatant.sys
*** WARNING: Unable to verify timestamp for avgtdix.sys
*** ERROR: Module load completed but symbols could not be loaded for avgtdix.sys
*** WARNING: Unable to verify timestamp for acsmux.sys
*** ERROR: Module load completed but symbols could not be loaded for acsmux.sys
*** WARNING: Unable to verify timestamp for acsint.sys
*** ERROR: Module load completed but symbols could not be loaded for acsint.sys
*** WARNING: Unable to verify timestamp for afd.sys
*** ERROR: Module load completed but symbols could not be loaded for afd.sys
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Probably caused by : vsdatant.sys ( vsdatant+1b7f6 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: e36b5000, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 8060d96c, address which referenced memory

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************

FAULTING_MODULE: 804d7000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 4eeec4aa

WRITE_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPoolCodeStart
unable to get nt!MmPoolCodeEnd
e36b5000

CURRENT_IRQL: 2

FAULTING_IP:
nt+13696c
8060d96c f3ab rep stos dword ptr es:[edi]

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: WRONG_SYMBOLS

BUGCHECK_STR: 0xA

LAST_CONTROL_TRANSFER: from 8060dcbe to 8060d96c

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
99af0374 8060dcbe 00000000 00001000 e1003e70 nt+0x13696c
99af0388 8060dd91 e1003e70 87537020 e1003e7c nt+0x136cbe
99af03a0 8060dff5 00000000 876da898 e1003e70 nt+0x136d91
99af03c8 8060e65d e1003e70 99af03e0 00000000 nt+0x136ff5
99af03e4 805bd893 e1003e70 99af0418 8924aee0 nt+0x13765d
99af0430 805bbb91 00000000 8924aef8 00000000 nt+0xe6893
99af0480 80576057 00000000 00000000 34856800 nt+0xe4b91
99af04fc 805769ce 99af079c 00000004 99af0730 nt+0x9f057
99af0558 805790d8 99af079c 00000004 99af0730 nt+0x9f9ce
99af0598 a03207f6 99af079c 00000004 99af0730 nt+0xa20d8
99af063c 8054167c 99af079c 00000004 99af0730 vsdatant+0x1b7f6
99af0670 80500031 badb0d00 99af06e8 00000000 nt+0x6a67c
99af077c a030d963 99af0798 99af079c 00000000 nt+0x29031
99af07a0 a030ec74 891b1008 99af07c8 8a43acf0 vsdatant+0x8963
99af07c0 a030ed6b 891c2008 87676008 876760c0 vsdatant+0x9c74
99af07d4 a030f00b 8a43acf0 891b1008 399934a2 vsdatant+0x9d6b
99af096c 804ef19f 8a43acf0 87676008 87676008 vsdatant+0xa00b
99af098c a03d446a 8a5c81d8 87676008 99af09b4 nt+0x1819f
99af099c 804ef19f 8a5c81d8 87676008 892ed5b8 avgtdix+0x246a
99af09b4 9cf51400 8a5c81d8 87676008 895db000 nt+0x1819f
99af09d8 ba449b06 00000000 87676008 876760c0 acsmux+0x1400
99af0a04 ba449c7c 87676008 89249330 8944b0e8 acsint+0x1b06
99af0a24 ba449d66 8944b030 87676008 876760c0 acsint+0x1c7c
99af0a40 804ef19f 8944b030 87676008 99af0aac acsint+0x1d66
99af0a80 a02e5de9 89217990 99af0aa0 0000000c nt+0x1819f
99af0aac a02f2098 89217990 00000000 a02f9c86 afd+0x2de9
99af0b0c a02e58aa 89239e28 0001200b af0cb801 afd+0xf098
99af0c5c 805804ad 89239e28 00000001 0491f698 afd+0x28aa
99af0d00 80579298 00000a6c 0000083c 00000000 nt+0xa94ad
99af0d34 8054167c 00000a6c 0000083c 00000000 nt+0xa2298
99af0d64 7c91e514 badb0d00 0491f664 00000000 nt+0x6a67c
99af0d68 badb0d00 0491f664 00000000 00000000 0x7c91e514
99af0d6c 0491f664 00000000 00000000 00000000 0xbadb0d00
99af0d70 00000000 00000000 00000000 00000000 0x491f664


STACK_COMMAND: kb

FOLLOWUP_IP:
vsdatant+1b7f6
a03207f6 ?? ???

SYMBOL_STACK_INDEX: a

SYMBOL_NAME: vsdatant+1b7f6

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: vsdatant

IMAGE_NAME: vsdatant.sys

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner
---------

1: kd> lmvm nt
start end module name
804d7000 806e6000 nt T (no symbols)
Loaded symbol image file: ntoskrnl.exe
Image path: ntoskrnl.exe
Image name: ntoskrnl.exe
Timestamp: Tue Oct 25 14:51:50 2011 (4EA6B0E6)
CheckSum: 001FE571
ImageSize: 0020F000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
1: kd> lmvm vsdatant
start end module name
a0305000 a0383f80 vsdatant T (no symbols)
Loaded symbol image file: vsdatant.sys
Image path: vsdatant.sys
Image name: vsdatant.sys
Timestamp: Mon Dec 19 05:59:22 2011 (4EEEC4AA)
CheckSum: 000863EC
ImageSize: 0007EF80
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4


Vielen Dank
Jester

http://www.file.net/prozess/vsdatant.sys.html
so unnötig wie Tor und Azureus !

Danke, aber das ist eine der ersten Seiten, die ich schon gelesen hatte. Eine Lösung offenbart sich mir da aber nicht.
Keiner eine Idee?

Miraculichs schrieb:

IRQL_NOT_LESS_OR_EQUAL (a)

Zum Vergrößern anklicken....

manchmal hilft ein treiberupdate. das hier http://support.microsoft.com/kb/314063 empfielt microsoft ...

gruß

hugo

So, die Windows Hilfe hilft nicht, weil das Problem nur auftritt wenn eine Firewall installiert ist, z.b. zone Alarm oder comodo. komisch oder?

Miraculichs schrieb:

So, die Windows Hilfe hilft nicht, weil das Problem nur auftritt wenn eine Firewall installiert ist, z.b. zone Alarm oder comodo. komisch oder?

Zum Vergrößern anklicken....

Was soll daran komisch sein? der Blaue nennt doch den entsprechenden Treiber.

der Treibe ist vsdatant.sys, das ist die Datei von Zone alarm, bei comodo ist es die afd.sys, hatt ich aber alles schon genau beschrieben.

Miraculichs schrieb:

der Treibe ist vsdatant.sys, das ist die Datei von Zone alarm, bei comodo ist es die afd.sys, hatt ich aber alles schon genau beschrieben.

Zum Vergrößern anklicken....

Ja und? Den Mist loswerden musst du schon selbst.

Bin ich auch losgeworden, was ich nicht verstehe ist, weshalb das Problem auf einmal nach Jahren auftritt.
Comodo würde ich gerne installieren, was aber aufgrund dieses Fehlers nicht funktioniert.
Ich bräuchte da eine konstruktive Lösung wie ich das Speicheradressierungsproblem lösen kann.
Nu ma was schlaues bitte.

Was ganz Schlaues wäre zu sagen, beende Aktivitäten wo du meinst, daß spezielle Software-Firewalls Schutz geben. Die win-eigene reicht.
Konstruktiver kann ich nicht sein, ist mein bester Rat. Over and out.