Sounds like a crash (BOD) to me and that the clients are configured to automatically restart.

What happens if you "disable" the filter server (fslx) and then reboot, does the same happen?



Can you configure to save a memory dump for analyze?

If I disable fslx.sys (rename the file) or remove HKLM\System\CurrentControlSet\services\FSLX the computer boots fine, but of course the SVS layers aren't available.



Okay, will wait for another computer to have the problem and I'll post the memory dump.

After a BlueScreen on my Vista 32 computer i've got the same behavior. I booted into safe mode. Removed the SVS software. Rebooted and the computer runs fine again. Then i could reinstall SVS wothout an issue. Something destroyed SVS when the bluescreen did appear.

The bluescreen i think was a problem of the computer because of heavy cpu load. Nothing to do with SVS



greetz

Sundance

quote:
Originally posted by: Sundance

The bluescreen i think was a problem of the computer because of heavy cpu load. Nothing to do with SVS

Just load the crashdump into windbg and you should see if it's the SVS virtual driver (fslx.sys) or not.

Here's a dump from a machine that had the problem today.

Hi DSguy,



Could be that you have an old ATI graphics driver (ati2mtag.sys).

Try to get a new driver version and see if that helps.



STACK_TEXT:

f78d6b14 80550fc5 00000019 00000020 804ea6bb nt!KeBugCheckEx+0x1b

f78d6b64 805503e3 804ea6c3 00000000 f78d6bd4 nt!ExFreePoolWithTag+0x2c1

f78d6b74 ba7b7732 804ea6c3 893ff1a8 89ab1038 nt!ExFreePool+0xf

WARNING: Stack unwind information not available. Following frames may be wrong.

f78d6bd4 ba7b6e91 f78d6cd0 f78d6d18 f78d6bf8 ati2mtag+0xb2732

f78d6d68 8056d03c 89ab1038 89b053a8 805694fc ati2mtag+0xb1e91

f78d6d7c 804e23b5 893ff1a8 00000000 89bfab30 nt!IopProcessWorkItem+0x13

f78d6dac 80574128 893ff1a8 00000000 00000000 nt!ExpWorkerThread+0xef

f78d6ddc 804ec781 804e22f1 00000001 00000000 nt!PspSystemThreadStartup+0x34

00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16



FOLLOWUP_IP:

ati2mtag+b2732



ba705000 ba883000 ati2mtag T (no symbols)

Loaded symbol image file: ati2mtag.sys

Image path: ati2mtag.sys

Image name: ati2mtag.sys

Timestamp: Wed Feb 22 04:46:24 2006 (43FBDE90)

CheckSum: 0017213C

ImageSize: 0017E000

Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0

I've had the BSOD twice in the last week from the FSLX.SYS. Not seeing the boot loop. Able to power cycle and restart with no problems. Minus the annoying BSOD YA KNOW!

Interesting....



Going back and looking at the last six computers with this problem, I found they all have the same ATI Radeon x600 card. The driver date for all computers is from 2/2/2006. The Dell site has this listed as the latest driver version for the Dell Optiplex g620 PC. I've download the latest driver for this card from the AMD site and will try updating the next machine this happens to.



If this is the culprit, why then does renaming the FSLX.sys file in Safe Mode and rebooting resolve the issue?

This is a kernal stack overflow error. The kernal stack has a very limited amount of space and when this is all used up, the machine will blue screen. The SVS filter driver is a kernal driver and uses some of the stack, albeit a small alount, however, your machines are in a state of this being the straw that broke the camels back. For reasons not understood by anybody outside ATI, their display drivers are using a much larger portion of the kernal stack than any other vidoe drivers out there. If we go back to my previous analogy with SVS as the straw, the ATI video driver is the MAC truck. We have tried to work with ATI on this before, but they refuse to change their ways.



In my own personal testing, I found the stock windows drivers for ATI video adapters perform better than the ATI bloatware anyway.

I have removed the ATI drivers from ADD/Remove Programs from a problem computer, but still have the problem. But now, instead of displaying a black screen or rebooting, I get the blue screen right before the Winlogon. It's not the Blue screen of death, but an actual blue screen.



Where can I see all the kernel drivers being loaded and how much each one takes up? Is there an app for this?

If you use Process Explorer then any process running in the SYSTEM, NETWORK SERVICE or LOCAL SERVICE user context should be a system driver.



To check for loaded filter drivers just run flmc.exe from a dos console.

tasklist.exe should show you some details.



You can also learn about the startorder from Windows NT startup process



If you open the crash dump in WinDbg you should be able to see all loaded drivers by typing the "lmv" command.

I have removed the ATI drivers from ADD/Remove Programs from a problem computer, but still have the problem.

This will actually not remove the drivers. You need to install a newer one or force to another driver install.