Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

Black screen on boot - FSLX.sys causing super slow boot

Created: 23 Mar 2009 • Updated: 29 Jul 2010 | 20 comments

SVS problem

Hi All,

We have just started getting an odd problem with our PC's and laptops. Basically when a PC boots up, it displays the Windows XP logo, the screen then goes black and then it just hangs. We were struggling to figure out what the problem might be and then it actually happened to my PC.

My PC gave a BSOD and rebooted. But it wouldn't boot and gave exactly the same problem as other PC's.

The PC would however booting safe mode ok, safe mode with networking ok but not in VGA or last know good configuration. In safe mode I disabled all the services and any programs that might load up. Still no luck. I then came across this post

http://forums.altiris.com/messageview.aspx?catid=28&threadid=54714&enterthread=y

Which pointed me in the right direction. I performed the following to fix my problem.

1) Boot in safe mode

2) rename the Altiris SVS driver fslx.sys to be fslx.$$$ (it's located in c:\windows\system32\drivers)

3) Rebooted PC. Machine would now boot all ok

Then it got a bit tricky. I tried a the following;

4) After machine had booted all ok, rename fslx.$$$ back to fslx.sys and rebooted system

5) PC booted ok but no SVS apps were active.

6) Tried to activate them via the command line but got error message about driver filter missing. Seems that fslx.sys might not have loaded.

7) Tried to remove SVS and reinstall it but it complained saying the install was corrupt.

8) Renamed fslx.sys back to fslx.$$$ and was then able to remove and reinstall SVS

9) My own PC was ok and I was able to reactive the SVS applications. On another PC, reinstalling the SVS agent didn't seem to fix the problem and just bought it back again.

So I've figured out that the fslx.sys is causing a super slow boot process (2 hours to logon screen). This gives the appearance that the PC has hung. But I've no idea why it's causing the problem.

We run Sophos Antivirus on all our PC's (Dell Optiplex and Dell Latitude) and having read the forums, I've seen there are problems with Norton AntiVirus and Dell Core Dell PC's doing exactly this problem.

Any suggestions or ideas would be greatly apprieactied. I'm just worried that one day I'll get a call to day it's happened to 100 pc's.

Regards

Comments 20 CommentsJump to latest comment

AngelD's picture

Do you have or have tried to add the AV process(es) to the process ignore list?

Leonard Powers's picture

Thanks for the prompt reply.

What does the Ignore list do?

We're just in the process of testing this fix now.  I've added in all our sophos executables.  It was interesting to see that Altiris had added in all the Norton Antivirus .exe

Regards

AngelD's picture

It will make sure the process added to the list will not see the virtual file/registry (ex. C:\Program Files\folder\file.xxx) but only the redirected file/registry instead.

Jordan's picture

We added Norton a long time ago, before I started working for Altiris, and the reason was Norton AV opens up files for read and write privileges which would cause all the virtualized files to get pulled to the base thus unvirtualizing part of the app. 

If a forum post solves your problem please flag is as the solution

Leonard Powers's picture

Taking into account what everyone has said above (many thanks) I think I've discovered what the problem might be.

The PC in question which had this problem had about 15 SVS apps installed.  We use a particular app called "sims.net".  It appears that this SVS layer had somehow become corrupted.  The solution was as follows:-

1) Boot in Safe Mode with networking
2) Log into domain
3) goto to command prompt and run svscmd "sims.net" AUTO -N to disable auto activation
4) Reboot PC as normal - it will work now as the sims.net app wont activate
5) Logon into PC, and delete sims.net app and resend it via Deployment console

I don't know what caused the layer to become corrupted.  Funny enough a new version of sims.net has been release today that we will be deploying.  I also wonder if making the changes to the IgnoreProgramList as detailed above might fix the problem.

If anyone else gets something similar, I'd check for a corrupted Layer.  Easiest way is to disable them all (can be done in safe mode) and then add them one at a time.

Regards

scaryfruit's picture

Do you have or have tried to add the AV process(es) to the process ignore list?

Hi,

I'm also experiencing this problem.  It only seems to have started happening since upgrading to SVS agent 2.1.3062.

We use McAfee AV Agent v.4.0.0.1345.  I have added the McAfee processes to the "ProgramIgnoreList" reg key (is this what you meant when mentioning the process ignore list?) of a machine currently experiencing this problem, but when rebooting I'm still getting a blank screen.

As another post mentioned, I too worked out it's a result of a corrupt layer, and disabling it or removing it from the fslrdr folder allows the computer to boot up.  On one machine I've tested, it was two seperate layers that had become corrupt and if either were present it resulted in a blank screen.

Going through this process, or re-downloading all the SVS layers everytime a machine has this problem is really a workaround, not a fix.  And it's becoming a huge burden.  Is there anything more permanent that any Altiris gurus out there can suggest to prevent layers becoming corrupt?

Thanks.
 

Jordan's picture

there's a newer version of SVS out (2.1.3071) that you might want to try (think you're two or three build back from where the current version is).

as for your issue, I don't know what's causing the problem.  Do you any layers set to activate on system startup?  I'm not sure this is a corrupt layer, that's just what people have been calling it, and unless I can see a layer when a machine is in this state I won't know for sure.

If you have a paid support contract it would be a good idea to go that route since they have the resources to check in to this, if I had a layer from the machine while it wasn't booting properly I could look at it but I don't have much time  since my forum participation\support isn't part of my job.

If a forum post solves your problem please flag is as the solution

erikw's picture

We saw some problems with the naming of the layers.
Try to avoid special caracters like $, %, €, and so.

Using these caracters is making SVS somewhat unstable.

Please let us know if this is the case in your situation.

Regards Erik www.DinamiQs.com Dinamiqs is the home of VirtualStorm (www.virtualstorm.org)

*************************************************************
If your issue has been solved, Please mark it as solved
***********

bulrich's picture

Where can I find and download this version?  I've only been able to download v.2.1.3066 from the Symantec site.  I'm having the same issue but I'm unable to trace it down to any specific layer.  I don't see this issue with EVS v.6.1 but I can't use that version due to it still being in beta/rc status.

Thanks for any responses!

-Brian

Jordan's picture

Huh, it's not up anywhere.  I've contacted the people that need to be contacted to see if 3071 is going to be released publically (it should).

If a forum post solves your problem please flag is as the solution

bulrich's picture

Thanks for the quick reply on this.  I'll monitor this thread for a few days and hope for a confirmation that 3071 is available.

-Brian

Jordan's picture

I got confermation that it will be released but not until 6.1 is released.

If a forum post solves your problem please flag is as the solution

bulrich's picture

Ok, well with that being said, are you able to provide an estimated time frame for release of 6.1 or is that still under hush-hush treatment as it was 2 months back?

Jordan's picture

next month is probable, can't say much more then that.

If a forum post solves your problem please flag is as the solution

Jordan's picture

Hah.

Looks like support is more proactive then PM, that article was made in march when build 3071 was approved for release.

If a forum post solves your problem please flag is as the solution

KrisH123's picture

Looks like this issue still occurs.  My computer crashed the other night, and i couldn't figure out for the life of me why it wouldn't boot any more.  I was able to recover the crash dump file from safe mode and analyze it and sure enough it pointed to fslx.sys.  At the time i didn't even know what that was.  I ended up disabling the driver in safe mode and sure enough the pc worked fine afterwards.  Of couse i no longer had any of my virtualized apps.

Luckily i found this thread and knew what apps i was using when the system crashed otherwise idenitfying the offendor would have been difficult.  I have almost 20 apps virtualized including some big ones like MS Office and Photoshop.  In the end it was Office cauing the issue.  I should have known having had issue with this app virtualized in the past.  I think that i'll avoid running Office in a virtual layer in the future.

When Symantec finally fixes this issue, they should make it a point to write out some relevant information to the event viewer to make resolving a problem like this easier.

Thanks for all the helpful posts.

-Kris

Gene Kupfer's picture

Hi KrisH123. Are you using one of the older versions of SVS or the newer SWV? We are actually able to successfully virtualize both Office and Photoshop so I'd be very interested in getting more details about your environment to see what the root of the problem is. If it is in fact our product I could log a bug for it to make sure it gets addressed. If you have some time, please drop me a private message so I can get more details from you.

We have an "Ideas" forum on Connect where everyone is welcome to post good ideas such as yours about the event viewer. The link is in the navigation bar at the top of the page, but here is the direct link so you don't have to look for it.

https://www-secure.symantec.com/connect/endpoint-management-virtualization/ideas

Once there just open the drop-down that says "All Products", select "Workspace Virtualization" and post away. Maybe do a quick scan through previous posts, in case this has already been suggested.


 

Symantec EndPoint Virtualization Product Info Facebook

RichC's picture

using SWV version 6.1.5104

blue screen on boot referencing fslx.sys, came back up fine after restart, but it is definitely concerning.  we're starting to push foward with virtualizing apps and i'm hoping it's an isolated occurence, but it seems this is a known issue.

--->    i'm no stranger to slack, but i'm not a slacker

Jordan's picture

If anyone has dumps they can get me that will help in issue.

RichC, 5104 is a very old build and we've fixed may crash dumps since then. 

If a forum post solves your problem please flag is as the solution