WinPE ISO Builder BSOD 0x24 - solved
In a previous post (10769) I reported that when building a PE2.1 ISO on a Win XP SP3 machine using TI 2010 build #7046 with PlusPack (following Gary Darsey’s excellent tutorial), everything went smoothly until I started the TI ISO builder. Clicking 'Proceed' in the step ‘ready to create the Windows PE ISO media’ gave a flurry of small windows followed by a BSOD 0x24.
Windows Kernel debug indicated a driver fault in Acronis’s tdrpm258.sys which appeared to do a bad call to NTFS and made NTFS fall off the end of the world trying to access 0x04.
I replicated the problem on another PC which also ran TI 2010 and Plus Pack.
However, creating a ‘neat’ ISO with Windows AIK worked fine.
I raised a trouble ticket and, as requested, uploaded various dumps to Acronis, but without their offering any solution.
So I then compared the kernel debug stacks from the two PCs looking for common factors. One obvious one was that they both ran ZoneAlarm Security Suite (latest stable build 9.1.008.000). It occurred to me that the Acronis module apparently at fault (tdrpm258.sys) is a NTFS file system filter driver - as is ZA's vsdatant.sys. Could it be that tdrpm258.sys was (wrongly) calling on NTFS to do something illegal because there are other filter drivers in the filter stack which upset it? As far as load order (or mini-filter 'altitude') is concerned, the dump taken with ZA active shows ZA correctly intercepting I/O before it gets to tdrpm258.sys (this is correct and in line with Windows's Filter Manager model: drivers in the 'anti-virus filter group' are loaded earlier or have a higher 'altitude'). But perhaps in the chain of filters - where each filter is called in turn - the target of the NTFS Write was getting corrupted…
So I did a few tests:
Turning ZA off had no effect –still a BSOD.
But since this could have left ZA’s vsmon.exe (basic True Vector module) still lurking it the background, I told ZA not to load vsmon at Win startup (via ZA’s Overview / Preferences tab) - still a BSOD.
So finally I removed ZA completely using ZA’s cpes_clean.exe (which removes the ZA filter driver completely, not merely turns it off).
Result: WinPE ISO Builder worked!
So I now leave it to Acronis to discover why (presumably) vsdatant.sys and tdrpm258.sys are incompatible.
Hello,
I have the same problem as Max posted in #10769 (BSOD when the PlusPack is in process of "Aktualisiere Inhalt der WIM-Datei") with reference to NTFS.SYS. This happens both in the 2010 and in the 2011 version, WinPE3 and WinPE2. However, I have no ZoneAlarm installed on my system.
Acronis support (ref:00D3Zcb.5005A7PRB:ref) states it is not their problem but a Microsoft issue (although the computer is stable otherwise).
Are there any more helpful suggestions?
Best regards.
In addition to my previous post: The PlusPack is working correctly after upgrading my Kaspersky Internet Security 2010 to 2011.