Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

SysPlant.sys - Windows BSOD Issues

Created: 02 Oct 2008 • Updated: 22 Jun 2010 | 16 comments
This issue has been solved. See solution.

Hi All,

 

I have been having some issues with BSOD on a few workstations that have been caused by SysPlant.sys on a regular basis. What exactly does SysPlant.sys do? Also, What risks or repercussions would I see if I disabled the sysplant driver in device manager. Are there any known issues with sysplant.sys and other software?

 

Currently, we are running SEP 11 (MR2) without application/device control enabled. 

Any info would be great. Thank you for the time.

 

Mike 

 

 

Comments 16 CommentsJump to latest comment

David-Z's picture

Sysplant.sys is our Application and Device Control driver. Since you are not using this functionality please feel free to disable the driver as it will cause you no issue.

 

There has been some conflicts in the past revolving around Sysplant and most of them have been addressed throughout the different releases of Endpoint Protection. If you wish to keep this driver enabled then I would recommend you migrate to the latest version 11.0.3001.2224 and see if that resolves the BSODs. If after migrating to MR3 you still experience BSODs relating to this driver I would suggest you open up a Technical Support Case with us so we can collect a Memory Dump and determine why you are getting them.

 

Hope that helps!

David Z.

Senior Principal Technical Support Engineer, Symantec Corporation

Enterprise Security, Mobility and Management

SOLUTION
postechgeek's picture

Thanks for the information. Very helpful.

 

Mike 

 

Hani2002's picture

Hello,

How can i Disable the SysPlant ???

Regards

Hani

Hani2002's picture

Dear Sir,

i have Symantec Endpoint Protection Version 11.0.4000.2295 and i have the same problem ,My windows restart suddenly and i read the mini dump that windows created it and sysplant.sys is the problem the application that i have on my pc :
1 - Office 2007
2 - TOAD
3 - Oracle 10G
4 - PL/SQL developer
5 - IBM Rational

Regards

Hani Allwasi

Ashutosh Sathe's picture

Dear Sir,

I also have Symantec Endpoint Protection Version 11.0.6000.550 (MR6) and i have the same problem, with sysplant.sys.

Paul Murgatroyd's picture

We had a similar issue with another customer running Oracle who would see the same problem.

In their case, it was fixed by upgrading their SEP client to MR4 MP1.

If you get the client only patch from here: http://seer.entsupport.symantec.com/docs/notes/files/sep/sep_11.0.4.1/11.0mr411.0.4000.2295tomr4mp1aclient-onlypatch32bit.html

you can try it on a single machine to test, but I'm fairly optimistic.

Paul Murgatroyd
Principal Product Manager, Symantec Endpoint Protection
Endpoint twitter feed: http://twitter.com/symc_endpoint

Ashutosh Sathe's picture

Dear Sir,

I also have Symantec Endpoint Protection Version 11.0.6000.550 (MR6) and i have the same problem, with sysplant.sys.

Hani2002's picture

Dear Sir,

kindly i installed the fix but i still have the same problem .
if i can send to you the mini dump that windows create it , i read the error : -

READ_ADDRESS: 6344123f

CURRENT_IRQL: 1c

FAULTING_IP:
nt!KiAttachProcess+63
804f8933 8b10 mov edx,dword ptr [eax]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

LAST_CONTROL_TRANSFER: from 804f8b77 to 804f8933

STACK_TEXT:
a8981a40 804f8b77 853269a8 859cd758 859cd700 nt!KiAttachProcess+0x63
a8981a60 a9cadd7c 859cd700 a8981d04 849c1b68 nt!KeStackAttachProcess+0x7d
WARNING: Stack unwind information not available. Following frames may be wrong.
a8981d34 8054088c 00000010 ffffffff 0012f828 SysPlant+0x4d7c
a8981d34 00000000 00000010 ffffffff 0012f828 nt!KiFastCallEntry+0xfc

STACK_COMMAND: kb

FOLLOWUP_IP:
SysPlant+4d7c
a9cadd7c ?? ???

SYMBOL_STACK_INDEX: 2

SYMBOL_NAME: SysPlant+4d7c

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: SysPlant

IMAGE_NAME: SysPlant.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 493dfd21

FAILURE_BUCKET_ID: 0xA_SysPlant+4d7c

BUCKET_ID: 0xA_SysPlant+4d7c

Followup: MachineOwner

Regards

Hani Allwasi

Weisman's picture

I have the same random BSOD on machines using a Logitech wireless Bluetooth keyboard and mouse. It doesn't effect the other machines as far as I know. I have a feeling it is the USB Bluetooth transceiver causing the problem. I'm going to try to make an exclusion and add the device to the allowed devices to see if it helps. Otherwise were back to replacing the wireless keyboards with wired units as a workaround.

LeandroC's picture

I have the same problem! I runnig MR4 MP2 but the problem appears again!!

What's solution??

Waiting for MR5??

Please any answer??

mssym's picture

I have seen few instances recently with 11.0.4202.75. I never installed any old versions, so not sure this BSOD on Sysplant.sys was just in this version or also existed in other older versions.

Illes_Csikos's picture

During a 2-week priod we had BSoD on 577 workstations of the ~3000 where SEP11.0.4202.75 has been rolled out.
We have an open case, but i think it's better to wait for MR5 (due to release in September) and play the send-me-more-logs-again-before-i-tell-you-something game with the Symantec support only if the issue will still exist.

Moggis's picture

during from 1 sept until now we have only 11 clients that has bsod, and the common with this is the wlan card,  it is INTEL 4965ag/agn

we have around 2000 clients and of those there is 650 with this wlan card... and untill now only 10 clients has bsod... 

we have tryied diffrent drivers etc...

but we also have a open case,..  so we will wait untill MR5 and see.....

is there anyone that have notice this? 

Serengeti's picture

we have also seen several Sysplant BSODs. Investigating and getting memory dump analysis.
SEP MR3. We are currently preparing MR5, whcih we will test on affected machines if Symantec so advise.