svdriver.sys BSOD Windows 7 32 bit

[emtunc001]

Hello,

I noticed this morning that one of our virtual desktops (Windows 7 32 bit) was in the 'already running' state in VMware View. I consoled in to it and saw that it has blue screened so I copied the mini-dump file off of it and used a dump analyser to see if I could see what the cause of the BSOD was.

According to the dump analysis, it looks like it may have been caused by the svdriver.sys file. This file is somehow related to the App Volumes agent install/filter driver.

Has anyone experienced blue screens relating to the App Volumes agent? We are using the latest version of App Volumes and the latest version of the Agent - both of which are 2.9

I have attached the dump files so if anyone can have a look to see why the system crashed and confirm if indeed it was caused by the App Volumes agent, that would be great!

[BullpenDave]

I am experiencing a similar issue during the provisioning process. My provisioning VM is also running Windows 7 32 bit. If I reboot at all during the provisioning process, I get a BSOD every time.

[Jason_Marshall]

‌svdriver is App Volumes but a BSOD is pretty rare. Can you th list out and check if there are any other filter drivers running?

Just run comand "fltmc filters" and please post the results.

[BullpenDave]

Jason, thank you VERY much for your reply, you helped me identify the issue in my environment. I ran the command as you suggested and noticed the "vsepflt" filter present, which appears to be installed with VM Tools if the VMCI driver/Guest Introspection drivers are selected. Once I removed this option, my issue was resolved. However reinstalling this option also resolved the issue, which was a suggested fix I found in the following article:

VMware KB: Windows virtual machine installed with vShield Endpoint Thin Agent (vsepflt.sys) and vShi...

Thanks again!!

[Jason_Marshall]

So happy to hear that! Can you make this as answered? Nice to see more green in the forum

[emtunc001]

I have run the command suggested and the below is what we have on the Gold Image:

SAVOnAccess (Sophos)

svdriver

luafv (UAC related)

FileInfo

[BullpenDave]

Emtunc001 - I would bet if you remove the Sophos SAVOnAccess filter driver, it will resolve your issue. Have you tried that?

[emtunc001]

It's not frequently occurring enough for me to troubleshoot and test with Sophos uninstalled. However I'd be reluctant to blame Sophos when the change in environment for us has been App Volumes and the BSOD dump seems to point towards svdriver.sys. It would be more beneficial if someone who can analyse and understand the dump can chime in and give an opinion.

[Jason_Marshall]

Do you have an SR# for this that I can look into?

[emtunc001]

I do not - how can I create one? Possible to create a case even if we're still running the App-Volumes trial?

P.S. attaching another BSOD dump we received today.

[Jason_Marshall]

Do you have any products with VMware like Horizon View? Or do you work with an account team? You can file under Horizon or request you SE or rep to file for you.