Solved vsdatant.sys causes BSOD

JB007

Level 26
Thread author
Verified
Top Poster
Well-known
May 19, 2016
1,574
Briefly explain your current issue(s)
BSOD
Steps taken to resolve, but have been unsuccessful
I cannot delete vsdatant.sys
Hello,
A while ago I had some BSOD on my PC because I tried ZoneAlarm Extreme Security.Troubleshoot - BSOD | MalwareTips Community
Today again a BSOD and it is caused by vsdatant.sys ; I cannot delete it and it is a Zonealarm leftover.

1.PNG
 

Attachments

  • WhoCrashed.txt
    1.9 KB · Views: 314

Gandalf_The_Grey

Level 76
Verified
Honorary Member
Top Poster
Content Creator
Well-known
Apr 24, 2016
6,505
Hello,
A while ago I had some BSOD on my PC because I tried ZoneAlarm Extreme Security.Troubleshoot - BSOD | MalwareTips Community
Today again a BSOD and it is caused by vsdatant.sys ; I cannot delete it and it is a Zonealarm leftover.

View attachment 251249
Use Autoruns to turn it off and see if you can delete it after a reboot.
 
Upvote 0

JB007

Level 26
Thread author
Verified
Top Poster
Well-known
May 19, 2016
1,574
Use Autoruns to turn it off and see if you can delete it after a reboot.
I find it but don't know how I can turn it off ?
2.PNG


3.PNG
 
Upvote 0

JB007

Level 26
Thread author
Verified
Top Poster
Well-known
May 19, 2016
1,574
Try to delete in Windows Safe Mode, or starting a system in USB (a Linux distro for example, or Kaspersky Recue Disk)...
I just tried in safe mode , it was very easy to delete this driver but after reboot in normal mode I cannot access to Internet.
The solution was to restore this driver at its previous location.
4safe.PNG

5safe.PNG

6.PNG

7.PNG

8.PNG
 
Upvote 0

silversurfer

Level 85
Verified
Honorary Member
Top Poster
Content Creator
Malware Hunter
Well-known
Aug 17, 2014
10,048
ZoneAlarm really doesn't provide a special tool to remove leftover files ? :unsure:

EDIT: I found a tool on Major Geeks:
ZoneAlarm Uninstall is a handy application that was created to help you quickly remove all traces of Zone Alarm products from your computer.
 
Last edited:
Upvote 1

sepik

Level 11
Verified
Well-known
Aug 21, 2018
505
After uninstalling ZA, you can check if its still registered to security center:
1. Open a command prompt window as an administrator
2. Run the command: WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path FireWallProduct
3. If you see something Zonealarm related, run the command: wbemtest
4. Click Connect button
5. Then enter: root/securitycenter2
6. Click the "Connect" button
7. Click the "Query..." button
8. Enter: SELECT * from FireWallProduct
9.Select the Firewall product to delete
10. Click the "Delete" button
11. Reboot
 
Upvote 0

JB007

Level 26
Thread author
Verified
Top Poster
Well-known
May 19, 2016
1,574
ZoneAlarm really doesn't provide a special tool to remove leftover files ? :unsure:

EDIT: I found a tool on Major Geeks:

Thanks @silversurfer
This Major Geeks tool is fine and it removes this driver and I can access to Internet after reboot(y)
9.PNG

10.PNG
 
Upvote 0

JB007

Level 26
Thread author
Verified
Top Poster
Well-known
May 19, 2016
1,574
After uninstalling ZA, you can check if its still registered to security center:
1. Open a command prompt window as an administrator
2. Run the command: WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path FireWallProduct
3. If you see something Zonealarm related, run the command: wbemtest
4. Click Connect button
5. Then enter: root/securitycenter2
6. Click the "Connect" button
7. Click the "Query..." button
8. Enter: SELECT * from FireWallProduct
9.Select the Firewall product to delete
10. Click the "Delete" button
11. Reboot
It seems that ZA firewall was also deleted
11.PNG

12.PNG
 
Upvote 0

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top