Results 1 to 9 of 9

Thread: Disabling "srescan" prevents BSOD in ZASuite

  1. #1
    jclarkw Guest

    Default Disabling "srescan" prevents BSOD in ZASuite

    Dear Colleagues:




    Whenever I close the lid of my laptop, the computer crashes:
    I can hear the hard disk spin down and I get a blue-screen-of-death, saying,
    "STOP 0x00000050...
    "PAGE_FAULT_IN_NONPAGED_AREA
    "...ntoskrnl.exe
    "..."
    This problem has occurred on TWO DIFFERENT Dell notebooks, both running Windows 2000 SP4, and with THREE DIFFERENT versions of ZoneAlarm Security Suite.
    It seems to be related to "srescan", since disabling this driver eliminates the problem.
    (I see that others on this forum had BSOD problems with "srescan" early this year, but nobody seems to be complaining about the current version.)
    Details are given below.




    I've been working on this problem with ZA Tech Support on and off since August 21st, and they cannot seem to explain or fix it.
    Unless anyone here knows a solution, I propose to permanently disable srescan (via "My Computer/Properties/Hardware/Device Manager/View: Show Hidden Devices/Non-Plug and Play Drivers/srescan/Disable", which seems to survive even a clean un-install and re-install of ZASuite!).
    Then I will at least have an up-to-date firewall and virus scanner.
    Before I do this, however, I have the following two questions:
    1) Exactly what does "srescan" do (i.e., what do I lose by disabling it)?2) Will disabling "srescan" cause problems (other than eliminating its intended function)?

    Any relevant information or advice would be greatly appreciated.



















    Sincerely,



















    John Willett


    Details of the Two Laptops, Debugging Attempts, and "srescan" Versions:
    A) The system that has received the most diagnosis is a Dell Latitude C600 Notebook, Intel Pentium III processor (x86 Family 6 Model 8 Stepping 10), built circa July 2001 (DS/N TW-09C748-12800-16J-3942), with 261,600 KBytes of RAM installed, running Microsoft Windows 2000 5.00.2195, Service Pack 4 (with all of the latest Critical Updates from Microsoft).
    The BIOS version is A09.
    B) The other system that exhibits the identical problem is a Dell Latitude D505 Notebook, Intel Celeron M processor 1200MHz, built circa April 2004 (DS/N CN-0H2049-48643-41T-1738), with 260,312 KBytes of RAM installed, running Microsoft Windows 2000 5.00.2195, Service Pack 4 (also with all of the latest Critical Updates from Microsoft).
    The BIOS on this system is A03.
    (This system also differs in that its hard disk crashed roughly a year ago, and I had to re-install Windows 2000, etc., on a new drive.
    Therefore, this system is not so cluttered with extraneous software and registry entries as the older C600.)




    On both of the above systems the BSOD-on-lid-closure problem began when I upgraded ZASuite from version 6.5.737.000 to version 7.0 (in one case, to version 7.0.337.000, and the other, to version 7.0.408.000 -- the latest available).
    The problem is eliminated by a manual un-install of 7.0 and return to the ORIGINAL version 6.5.737.000.
    The problem recurs, however, as soon as I do an Anti-spyware Update on version 6.5.737.000, which also installs the newest version (5.0.176.0) of the Anti-spyware engine.
    However, the problem does NOT occur (so far, at least) on an IBM laptop dating from 2001 (call it Machine C), running the same OS along and ZoneAlarm Pro version 6.5.722.000, even though this ZAPro has also updated to Anti-spyware engine version 5.0.176.0 on this machine.




    On Machine A, I followed the detailed instructions of tech support to manually un-install ZASuite 7.0 and do a clean re-install -- didn't help -- and (using "msconfig.exe", copied from a Windows XP machine) to turn off all non-Microsoft services except "TrueVector Internet Monitor" and all startup items except "Zlclient.exe" -- also didn't help.
    Under "Power Options Properties/Advanced", we also turned off "Enable hibernate support" and "Prompt for password when computer goes off standby".
    ("When I close the lid of my portable computer" has always been set to perform the action, "None", on all three laptops.)
    I even tried un-installing and re-installing the latest device driver for "System Devices/APCI Lid", also to no avail.
    The only things that DID eliminate the BSOD were to disable "srescan" in the Device Manager, as described above, or to revert to version 6.5.737.000 WITHOUT updating the Anti-spyware signatures.
    Tech support finally requested a memory dump and promoted my problem to the "Escallations Dept.", where it now languishes, apparently indefinitely.




    For what it's worth, the PRESENT version numbers and digital-signature timestamps of "srescan" on these three machines are as follows:
    Machine
    ZA Progrm Version

    srescan.sys version

    srescan.dll version

    BSOD?
    ---------
    ----------------------


    ------------------------
    ----------------------
    --------




    A






    Suite 7.0.408.000



    5.0.172.0, 06/08/07

    5.0.176.0, 08/14/07

    Yes




    B






    Suite 6.5.737.000


    5.0.83.0,
    08/31/06


    5.0.83.0,
    08/31/06


    No




    C






    Pro


    6.5.722.000



    5.0.176.0, 08/14/07

    5.0.176.0, 08/14/07


    No
    (Why the .sys and .dll versions are different on Machine A, I don't know.
    As noted above, I did perform a manual (presumably complete) uninstall of the previous installation, as instructed by tech support, before re-installing the current version.)


    Operating System:Windows 2000 Pro
    Software Version:7.0
    Product Name:ZoneAlarm Internet Security Suite

  2. #2
    Join Date
    Dec 2005
    Posts
    9,056

    Default Re: Disabling "srescan" prevents BSOD in ZASuite

    Screscan is the driver and .dll for the ZA Antispyware scanner. It works as a plugin for the vsmon.exe. The files are different because the different versions have versions files and probably are different as the new releases are made. Disabling the screscan effectively stopped the antispyware scanner in the ZAISS.

    My guess would be there is some DELL program or component (updater or dell cd resource or internet helper, etc) that is the conflict. I have zero DELL programs installed in my DELL 3100 desktop and have no problems. Actually I wiped the harddrive disk and used the "clean" Windows OS disk for a neat and clean installation. Then installed the needed drivers and have been DELL bloat free ever since.

    Oldsod
    Best regards.
    oldsod

  3. #3
    jclarkw Guest

    Default Re: Disabling "srescan" prevents BSOD in ZASuite

    Dear Oldsod,




    Thanks for the useful information.
    It appears that I will lose only the Anti-spyware function by disabling "srescan".
    You also wrote,
    >>My guess would be there is some DELL program or component (updater or dell cd resource or internet helper, etc) that is the conflict.<<
    I'm puzzled that such
    "bloatware" would
    not be disabled by "msconfig.exe".
    I'm also puzzled
    why other owners of Dell laptops don't seem to be complaining about this problem.

    In any case, I'm not ready to re-install Windows quite yet.
    (It's a big job, and I have only the Dell OEM Windows 2000 CD from way back at SP-1.)
    Do you think Dell tech support might be able to help?


























    Regards.

























    John Willett

  4. #4
    Join Date
    Dec 2005
    Posts
    9,056

    Default Re: Disabling "srescan" prevents BSOD in ZASuite

    I by no means wished to infer the additional vendor's software wa actually at fault. Just merely pointing out that it could be the cause.
    Never the less, the PC runs a lot better without the extras ever having been installed. I did the very same with my other PC that are other various manufactures.

    Disabling applications in the MSConfig will disable the application, of course. But the application does use files and possiblely some drivers that may well extend into the various areas of the kernel of the operating system or into the files and drivers of the hardware applications. The presence of those files and drivers, although not opened, will often still have issues.
    The issue of having too many lower kernel hooks from different applications into an operating system can and often does cause issues.
    Basically, the less cooks in the kitchen, the better the soup. Too many disk managements and/or too many security applications and/or too many driver based friendly GUI helpful applications can possiblely have issues.

    DELL forum is great and so is the DELL support. I have been at both places and left with found great results. It impresses me to no end that the main moderator at the DELL forum is none other than Michael Dell himself. Cudos to a big boss that does talk to his "little people" type of customers from time to time.

    Cheers, Oldsod
    Best regards.
    oldsod

  5. #5
    Join Date
    Dec 2005
    Posts
    9,056

    Default Re: Disabling "srescan" prevents BSOD in ZASuite

    BTW, if you do decide upon the complete wipe first obtain the SP2 media disk from Microsoft. It does make the upgrade a lot easier.
    If your needed drivers are not on media (from the original DELL purchase), they are available at the DELL sitre.
    Oh that reminds me of something. I would suspect you have been updating the drivers for the hardware of the laptop and checked to see if there is a newer BIOS available?
    Sometimes just the older version of the driver being replaced by newer drivers can solve issues - especially with security applications that have a firewall and an antivrus.

    Sometimes the manufactures does not always list the newer drivers and just stays with the older drivers downloads. The newer drivers for all of the hardware can be still found at the manufacture's web site.

    Cheers, Oldsod
    Best regards.
    oldsod

  6. #6
    jclarkw Guest

    Default Re: Disabling "srescan" prevents BSOD in ZASuite

    Dear Oldsod -- Sorry about the previous abortive attempt!
    You wrote, in part,
    >>Disabling the screscan effectively stopped the antispyware scanner in the ZAISS.<<
    Oddly, when I do disable "srescan" through Device Manager, as described above, the on-demand spyware scanner still seems to perform normally.
    (It didn't find anything, but then neither did the previous scan before "srescan" was disabled.)
    Only the BSOD has gone away.
    What gives?
















    Best Regards.















    John Willett

  7. #7
    Join Date
    Dec 2005
    Posts
    9,056

    Default Re: Disabling "srescan" prevents BSOD in ZASuite

    Hi JClarkW

    The driver is secondary. I suppose the ZA can still call it up. If you have both the spyware scanner and the BSOD gone, then I suppose that is a good thing.
    The driver and .dll were never unregistered in the Windows API. The files were never stopped from running. They still have the registry keys. basically everything is there to make it work.
    Cheers, Oldsod
    Best regards.
    oldsod

  8. #8
    jclarkw Guest

    Default Re: Disabling "srescan" prevents BSOD in ZASuite

    Oldsod -- For what it's worth, ZA Tech Support is telling me that "srescan" is their "real-time" spyware scanner, which does on-access scanning but does not participate in the on-demand scanning that you can control or schedule from the GUI.
    Disabling it does not affect that anti-virus on-access scanner, but just the spyware.
    Still, it would be a good thing to have... -- John Willett

  9. #9
    srwargo Guest

    Default Re: Disabling "srescan" prevents BSOD in ZASuite

    Very interesting.

    Its good to know that it wasnt my notebook which caused the problem

    I installed zone alarm yesterday, with the anouncement of the free version:
    https://www.zonealarm.com/store/cont...omo.jsp?menu=1
    Today, I started getting BSOD.

    Now, I did not put 1 and 1 together until... my sister called with the same exact problem.

    Then reading this post, just made me more upset.







Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •