VMware Horizon Community
dylomc
Contributor
Contributor
Jump to solution

Internet Explorer crashing due to faulting module vmwsci.dll

I had a few reports of IE crashing for some users. I've found this appears to be happening for a lot of VM's. The logs show the following error:
Faulting application name: IEXPLORE.EXE, version: 11.0.15063.850, time stamp: 0x3173cb3d

Faulting module name: vmwsci.dll, version: 7.2.0.21950, time stamp: 0x5910b368


The faulting module (vmwsci.dll) appears it has to do with the View Agent PCoIP Smart Card Interception. Is that the same thing as the Smarcard Redirection feature? We don't even select this for our View Agent installs.  It's happening on various versions of view agent (7.0.3, 7.2).  It does appear these errors started to occur right after the July Windows and Office updates.

Reply
0 Kudos
1 Solution

Accepted Solutions
BenFB
Virtuoso
Virtuoso
Jump to solution

I'd recommend opening a case with Symantec. We had a similar issue with Carbon Black where it was corrupting files. After the team that managed Carbon Black engaged support they were able to resolve it.

View solution in original post

Reply
0 Kudos
14 Replies
BenFB
Virtuoso
Virtuoso
Jump to solution

Do you have an image before the July Windows/Office updates to test with?

What antivirus and I/O filter drivers are you using? We've seen a lot of issues like this where antivirus or a I/O filter driver are the culprit.

Reply
0 Kudos
dylomc
Contributor
Contributor
Jump to solution

I forgot, we did just update Symantec Endpoint Protection earlier this month, which appears to be at version 14.0 RU 1 MP 2.

I'm also seeing a lot of Audit Failures for this file (vmwsci.dll) regarding code Integrity not being valid:

LogName=Security

SourceName=Microsoft Windows security auditing.

EventCode=6281

EventType=0

Type=Information

ComputerName= name of vm

TaskCategory=System Integrity

OpCode=Info

RecordNumber=2227863

Keywords=Audit Failure

Message=Code Integrity determined that the page hashes of an image file are not valid. The file could be improperly signed without page hashes or corrupt due to unauthorized modification. The invalid hashes could indicate a potential disk device error.

File Name:    \Device\HarddiskVolume2\Windows\System32\vmwsci.dll

Reply
0 Kudos
BenFB
Virtuoso
Virtuoso
Jump to solution

I'd recommend opening a case with Symantec. We had a similar issue with Carbon Black where it was corrupting files. After the team that managed Carbon Black engaged support they were able to resolve it.

Reply
0 Kudos
dylomc
Contributor
Contributor
Jump to solution

It's definitely from the Symantec Endpoint Protection update. I rolled back some VM's to prior version and don't receive this error. The version we are currently on is 14.0 RU1 MP2.

Reply
0 Kudos
MarcusLittle
Contributor
Contributor
Jump to solution

Hi,

We have been experiencing the exact same problem with Symantec Endpoint Protection 14.0 RU1 MP1 Build 3897 on View and RDS 2012 R2.

It certainly seemed to start after the June or July windows updates.

Apart from rolling back have you found any further on resolving this?

Which version did you have success with?

Reply
0 Kudos
dylomc
Contributor
Contributor
Jump to solution

We are going to update to 14.2 to see if this resolves the issues we've been running into. The previous version of 14.0 MP2 (14.0.2455.0206) that we rolled back to didn't seem to have issues.

Reply
0 Kudos
dylomc
Contributor
Contributor
Jump to solution

Thanks for your response.  ​​I did have another question that I was wondering you could maybe help with. You mentioned that you ran into issues with CarbonBlack. We are just getting started with this as well. We just deployed this to select machines late June. Starting this Monday, 6 out of the 12 VM's that have the Carbon Black Sensor (version 6.0.3.70821) installed have crashed all at the same time. The dmp file indicates that it's caused by NETIO.SYS.​:
BugCheck D1, {10, 2, 0, fffff80a99d27515}Probably caused by : NETIO.SYS ( NETIO!NsiEnumerateObjectsAllParametersEx+224 )

​I was just curious what you were running into.

Thanks

Reply
0 Kudos
BenFB
Virtuoso
Virtuoso
Jump to solution

I don't manage CB but we've definitely seen this. Get with CB support and verify you are running the best practices for virtual desktops. I remember they had to do something with USN journal in the CB config. If these are linked clones/instant clones you need to make sure the parent is template properly in CB.

Reply
0 Kudos
MarcusLittle
Contributor
Contributor
Jump to solution

Thanks for the reply. Please post your results with 14.2. We are trying to decide whether to upgrade to 14.2 or not.

Reply
0 Kudos
dylomc
Contributor
Contributor
Jump to solution

14.2 Did not fix this.

Reply
0 Kudos
MarcusLittle
Contributor
Contributor
Jump to solution

Thanks for the reply. That is a pity.

In the meantime we have added a scan exception for vmwsci.dll and are monitoring the results.  Positive so far.

Reply
0 Kudos
MarcusLittle
Contributor
Contributor
Jump to solution

We have not seen the appcrash since adding the Virus scan exclusion for the VMWSCI.DLL to the policy covering the RDS servers.

Reply
0 Kudos
MarcusLittle
Contributor
Contributor
Jump to solution

Sadly the fault is still occurring with varying regularity.

Reply
0 Kudos
BenFB
Virtuoso
Virtuoso
Jump to solution

Do you possibly have another product installed on the VM with a filter driver? If not I would work with your A/V vendor to get it resolved.

Reply
0 Kudos