BSOD Conflict with Faronics Anti-Executable?

[pepoluan]

Hi,

I've just installed a PC from scratch. The Operating System is Windows 2000 Professional SP4, with SP4 Update Rollup 1, and IE6 SP1 with IE6 SP1 Update Rollup 1.

After installing the basics, JkDefrag runs okay.

So I continue installing Office, NOD32, and various other programs. The last program I installed was Faronics Anti-Executable. Having finished all that, I tried running JkDefrag again (via JkDefrag GUI)

I noticed that up until SpaceHog phase, JkDefrag runs well. Then, right after SpaceHog finished, the system went BSOD. More than just BSOD, hard reset can't return into Windows; I must use Repair from the installation CD.

I regained access to Windows, and tried running JkDefrag again. Again, BSOD. I hard reset, and again I can't get into Windows.

My question is: Is JkDefrag incompatible with Faronics Anti-Executable up to the point of BSOD?

Thank you for your attention.

[RJARRRPCGP]

If it's STOP: 0x00000050 PAGE_FAULT_IN_NON_PAGED_AREA

-OR-

STOP: 0x0000004E PFN_LIST_CORRUPT

Then likely the RAM chips kicking the bucket.

If it's STOP: KERNEL_INPAGE_ERROR, then likely a bad HDD.

With a bad HDD, Windows may seem OK, but when you run more stuff, it crashes.

[pepoluan]

Thanks for the heads-up. I'll do a check on the RAM and on the HDD.

[jeroen]

Is JkDefrag incompatible with Faronics Anti-Executable up to the point of BSOD?

I don't know, but allow me to ask a slightly different question: is Faronics Anti-Executable compatible with the standard Windows defragmenter? JkDefrag does not access disks by itself, it is based on the standard Windows defragmentation API. If Faronics is compatible with the build-in Windows defragmenter, then it is compatible with JkDefrag.

From the Faronics website I see that it's software that will checksum the installed programs. It must therefore have a hook into the Windows filesystem somewhere. Just like a virus checker. And we all know how many problems virus checkers can cause.... I think you should question Faronics, not JkDefrag.

Do you know about the "big LBA" issue in Windows 2000? If your disk is bigger than 137GB then you must set the "EnableBigLba" registry key by hand, or your system will crash in exactly the way you have described. For more info see http://www.48bitlba.com/enablebiglba.htm

[pepoluan]

Ah yes... never thought to actually test Faronics' compatibility with other defraggers.

Anyways, I'm testing the PC's memory and HD right now. 2 passes of MemTest86+ seems okay (yes, I know some errors crop up after the 7th or 8th pass, but...), and currently deepscanning the hard disk with SpinRite.

As to BigLBA . . . I don't think that's an issue for this hard disk is an old-ish one, only 40GB.

[schitzn]

yes, I know some errors crop up after the 7th or 8th pass, but..

MemTest should throw up no errors on the ram whilst testing, if it takes that long to post a error, your ram is getting too hot perhaps due to case temperature or board overclocking/increased voltage settings.

Do a cmos reset to ensure the board is running at default voltages and memtest to make sure no errors even at pass 8,

[pepoluan]

Okay. I reinstalled the system, and did a barebones test. Here's a rough log of what I've done:

SpinRite Level 4 (DeepScan): No problem detected
MemTest86+: 8.5-pass (not finished 9th pass) No problem

Install Windows 2000 Pro SP4 (SP4 slipstreamed).
Not yet installed SP4 Update Roll-up 1.
Still using IE5 (that comes with Windows 2000).
Installed WinRAR.
Installed JkDefrag.
Installed PerfectDisk 8.0.
Installed Faronics Anti-Executable.

Ran PerfectDisk 8.0 : Defragging runs okay
Ran JkDefrag : Defragging runs okay

So, it may be other 3rd party programs.

Hm. I'll post more if I come up with something conclusive.

[pepoluan]

Okay! I think I found the cuplrit

Faronics Anti-Executable (FAE) has 2 "Security Levels":

• Low : Blocks unauthorized 32-bit apps, Protects FAE directory from access and tampering
  
• High : Low + blocks unauthorized 16-bit apps, blocks unauthorized drivers and .dll files
  

JkDefrag BSODs when the Security Level is "High" (I'll check if this is reproducible)

Haven't checked PerfectDisk. Will do.

[pepoluan]

Final update on this issue.

Set the Security Level on "High".

Run JkDefrag: No BSOD this time, but FAE said "an action is restricted" (or something to that effect) during actual defragging.

Run PerfectDisk: Same. No BSOD, but FAE said "an action is restricted" during analysis.

Run JkDefrag again: Still the same.

Run PerfectDisk again: This time, FAE does not complain.

Run JkDefrag yet again: Same. No complain.

Run PerfectDisk yet again: Same. No complain even after actual defragging starts.

The content of FAE's log:

Restriction:Open - harddiskvolume1\winnt\system32\webfldrs.msi
Restriction:Open - harddiskvolume1\winnt\installer\1aab0.msi
Restriction:Open - harddiskvolume1\winnt\installer\e4b7e.msi
Restriction:Open - harddiskvolume1\winnt\system32\webfldrs.msi
Restriction:Open - harddiskvolume1\winnt\installer\1aab0.msi
Restriction:Open - harddiskvolume1\winnt\installer\e4b7e.msi
Restriction:Open - harddiskvolume1\winnt\system32\webfldrs.msi
Restriction:Open - harddiskvolume1\winnt\installer\1aab0.msi
Restriction:Open - harddiskvolume1\winnt\installer\e4b7e.msi

I still don't know what caused the BSOD, but for now I'll just set FAE on "Low". Hopefully this will prevent BSOD.

I will now reformat the disk and reinstall Windows 2000 from scratch, complete with SP4 UR1, IE6 SP1, IE6 SP1 UR1, FAE set to "Low". If BSOD happens, I'll post.

[schitzn]

Had a quick look at FAE.

Does it degrade performance (I assume its catching via global hooks)?

Why do you use it? It seems designed for corporate/business end users to control their mischevious staff (damn them).

[pepoluan]

@schitzn:
Here in my country, trojan infection via Flash Disk (i.e. autorun.inf autostarting the trojan script) is waaaaaay overboard.

Since this particular PC will be used by my company's secretary -- which, shall I say, is kind of 'technically challenged', to put it mildly -- I need something industrial-strength to prevent such infection.

About FAE's performance: Since the PC in question is an old-ish VIA Samuel (equiv. to Pentium III), I would have noticed any performance degradation. Thankfully, FAE seems to not introduce any noticeable performance degradation.

So, I am happy and content

[jeroen]

Run JkDefrag: No BSOD this time, but FAE said "an action is restricted" (or something to that effect) during actual defragging.

I think your experiments prove that Faronis crashes your system when files are defragmented or optimized that are "protected" by it. When they are not accessed by JkDefrag and/or PerfectDisk the system runs fine. Perhaps you can post a bugreport on their website.

[pepoluan]

Will do. Thanks

That said, JkDefrag is undoubtedly the best defragger there is! *thumbs up*