Solved vsdatant.sys causes BSOD

[JB007]

Describe the problem

BSOD

What have you tried?

I cannot delete vsdatant.sys

Hello,
A while ago I had some BSOD on my PC because I tried ZoneAlarm Extreme Security.Troubleshoot - BSOD | MalwareTips Community
Today again a BSOD and it is caused by vsdatant.sys ; I cannot delete it and it is a Zonealarm leftover.

 

[harlan4096]

Try to delete in Windows Safe Mode, or starting a system in USB (a Linux distro for example, or Kaspersky Recue Disk)...

 

[Gandalf_The_Grey]

Hello,
A while ago I had some BSOD on my PC because I tried ZoneAlarm Extreme Security.Troubleshoot - BSOD | MalwareTips Community
Today again a BSOD and it is caused by vsdatant.sys ; I cannot delete it and it is a Zonealarm leftover.

View attachment 251249

Use Autoruns to turn it off and see if you can delete it after a reboot.

bsod issues with checkpoint remnants - Windows Crashes and Blue Screen of Death (BSOD) Help and Support

bsod issues with checkpoint remnants - posted in Windows Crashes and Blue Screen of Death (BSOD) Help and Support: i removed zonealarm recently and avast. I am now having issues with a remnant of zone alarm... its a driver... vsdatant.sys i cant delete it.... tried several ways... as...

www.bleepingcomputer.com

 

[JB007]

Use Autoruns to turn it off and see if you can delete it after a reboot.

bsod issues with checkpoint remnants - Windows Crashes and Blue Screen of Death (BSOD) Help and Support

bsod issues with checkpoint remnants - posted in Windows Crashes and Blue Screen of Death (BSOD) Help and Support: i removed zonealarm recently and avast. I am now having issues with a remnant of zone alarm... its a driver... vsdatant.sys i cant delete it.... tried several ways... as...

www.bleepingcomputer.com

I find it but don't know how I can turn it off ?

 

[Gandalf_The_Grey]

I find it but don't know how I can turn it off ?
View attachment 251251

View attachment 251252

Did you use Autoruns with right click as admin?
Can you turn it off delete it as admin?
A possible solution would be to do this in safe mode like @harlan4096 suggested.

 

[JB007]

Did you use Autoruns with right click as admin?
Can you turn it off delete it as admin?
A possible solution would be to do this in safe mode like @harlan4096 suggested.

Yes
OK I will try in safe mode

 

[JB007]

Try to delete in Windows Safe Mode, or starting a system in USB (a Linux distro for example, or Kaspersky Recue Disk)...

I just tried in safe mode , it was very easy to delete this driver but after reboot in normal mode I cannot access to Internet.
The solution was to restore this driver at its previous location.

 

[Gandalf_The_Grey]

And you don't have Zonealarm installed anymore?
I hope somebody else has a better idea how to deal with this.

 

[JB007]

And you don't have Zonealarm installed anymore?
I hope somebody else has a better idea how to deal with this.

Thanks
Yes ZoneAlarm was uninstalled .

 

[silversurfer]

ZoneAlarm really doesn't provide a special tool to remove leftover files ?

EDIT: I found a tool on Major Geeks:

ZoneAlarm Uninstall is a handy application that was created to help you quickly remove all traces of Zone Alarm products from your computer.

Download ZoneAlarm Uninstall 15.8.190.19023 - MajorGeeks

ZoneAlarm Uninstall is a handy application that was created to help you quickly remove all traces of Zone Alarm products from your computer.

www.majorgeeks.com

 

[sepik]

Zonealarm Uninstaller: Download

Last time i used this uninstaller tool, it did remove the software but left firewall registered to security center....

 

[sepik]

After uninstalling ZA, you can check if its still registered to security center:
1. Open a command prompt window as an administrator
2. Run the command: WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path FireWallProduct
3. If you see something Zonealarm related, run the command: wbemtest
4. Click Connect button
5. Then enter: root/securitycenter2
6. Click the "Connect" button
7. Click the "Query..." button
8. Enter: SELECT * from FireWallProduct
9.Select the Firewall product to delete
10. Click the "Delete" button
11. Reboot

 

[JB007]

ZoneAlarm really doesn't provide a special tool to remove leftover files ?

EDIT: I found a tool on Major Geeks:

Download ZoneAlarm Uninstall 15.8.190.19023 - MajorGeeks

ZoneAlarm Uninstall is a handy application that was created to help you quickly remove all traces of Zone Alarm products from your computer.

www.majorgeeks.com

Thanks @silversurfer
This Major Geeks tool is fine and it removes this driver and I can access to Internet after reboot

 

[JB007]

After uninstalling ZA, you can check if its still registered to security center:
1. Open a command prompt window as an administrator
2. Run the command: WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path FireWallProduct
3. If you see something Zonealarm related, run the command: wbemtest
4. Click Connect button
5. Then enter: root/securitycenter2
6. Click the "Connect" button
7. Click the "Query..." button
8. Enter: SELECT * from FireWallProduct
9.Select the Firewall product to delete
10. Click the "Delete" button
11. Reboot

It seems that ZA firewall was also deleted

 

[Gandalf_The_Grey]

Glad to see it resolved