lezboyd 0 Posted December 24, 2016 Posted December 24, 2016 Today, I got a BSOD related to epfwwfp.sys, which is an ESET Personal Firewall driver. I have faced this problem a few weeks before also, but at the time, I had upgraded directly from ESS v6 to ESS v9, so I thought that might be the cause. I uninstalled ESS and used Windows Defender for a few weeks to make sure that ESS was actually the cause. I then did a fresh install of ESS v10 on Dec 5 and faced no issues since. But today I got a BSOD again, and it was again traced back to ESET driver. Here is the troubleshooting done at Microsoft's website. https://answers.microsoft.com/en-us/windows/forum/windows8_1-performance/wfplwfssys-related-bsod-need-help-updating-driver/95b928b1-2ffe-4050-b2d4-2e5ee06f2329?tm=1482582489401 I have a 3 year license key that expires in 2019, and I have used ESS for the past 6 years with no issues. This issue has started since v9. I am hoping someone here can resolve this issue for me so I can remain loyal to ESET. Thanks in advance.
Administrators Marcos 5,466 Posted December 24, 2016 Administrators Posted December 24, 2016 I see "Probably caused by : wfplwfs.sys ( wfplwfs!L2802_3ParseMacHeader+87 )" in the dump. Wfplwf.sys is Microsoft's driver. After the New year, our devs will check it out to definitely confirm or deny that the crash is caused by ESET.
lezboyd 0 Posted December 24, 2016 Author Posted December 24, 2016 2 minutes ago, Marcos said: I see "Probably caused by : wfplwfs.sys ( wfplwfs!L2802_3ParseMacHeader+87 )" in the dump. Wfplwf.sys is Microsoft's driver. After the New year, our devs will check it out to definitely confirm or deny that the crash is caused by ESET. Thanks for the reply, Marcos. If you read the above thread, the Microsoft specialist replying to me in the topic is very certain it is the ESET driver after analysing the same dump. I also did not face any BSODs when I had uninstalled ESET and was working with (the horrible) Windows Defender. I shall await a reply from your devs in this regards, and shall help them with any additional info they desire.
lezboyd 0 Posted January 2, 2017 Author Posted January 2, 2017 Hi Marcos, Just a friendly reminder that we are now in the New year, and to please remind your Devs to look into this. My laptop has crashed with the same BSOD 3 more times since the last post. If you want, I can post the dumps for the same.
Administrators Marcos 5,466 Posted January 5, 2017 Administrators Posted January 5, 2017 As soon as I have some news from devs, I'll let you know. Could you try (at least temporarily) uninstalling PeerBlock which uses a driver from 2013 and see if the problem goes away?
lezboyd 0 Posted January 5, 2017 Author Posted January 5, 2017 I have not started Peerblock since Sunday and have not got a BSOD yet. Will continue observing for the rest of the week and let you know on Monday whether or not the problem has returned.
lezboyd 0 Posted January 10, 2017 Author Posted January 10, 2017 (edited) I have been running ESET without running Peerblock for the whole of last week and till the time of this writing, and have not got a BSOD. I suppose it is safe to assume that the 2 drivers are not getting along. However, ESET is in active development whereas Peerblock is not. Also, previous versions of ESET have worked without issues with Peerblock. So I'd like to ask if there is a way to make the 2 drivers play along with one another, as in previous versions. Peerblock has the ability to work with blocklists for malicious, malware and ads domains. This is a pretty cumbersome, complex and manual process in ESET. On the other hand, ESET has application specific firewall rules, which is very handy. So currently I need both. Edited January 10, 2017 by lezboyd
lezboyd 0 Posted January 13, 2017 Author Posted January 13, 2017 (edited) On 5/1/2017 at 7:35 PM, Marcos said: As soon as I have some news from devs, I'll let you know. Could you try (at least temporarily) uninstalling PeerBlock which uses a driver from 2013 and see if the problem goes away? I spoke too soon in my previous posts Just received another BSOD today, this time with no PeerBlock running. Linking to dump files below: https://1drv.ms/f/s!Avzd_Hgdj4WQe9ujeToGujFKRe4 Please help. Edited January 13, 2017 by lezboyd
lezboyd 0 Posted January 16, 2017 Author Posted January 16, 2017 (edited) Another BSOD just received, this time with no PeerBlock running. Link to dumps: https://1drv.ms/f/s!Avzd_Hgdj4WQfsyNBdon0Yh1p68 Please help. Edited January 16, 2017 by lezboyd
Administrators Marcos 5,466 Posted January 17, 2017 Administrators Posted January 17, 2017 In a few weeks the firewall developers are going to pay visit to Microsoft and inquire them as to why they think the issue is caused by ESET. It's not obvious from the dumps that ESET is the culprit.
lezboyd 0 Posted January 17, 2017 Author Posted January 17, 2017 (edited) 28 minutes ago, Marcos said: In a few weeks the firewall developers are going to pay visit to Microsoft and inquire them as to why they think the issue is caused by ESET. It's not obvious from the dumps that ESET is the culprit. From my side, it makes sense. The BSODs started after I installed ESS. They went away for a month when I uninstalled ESET and worked with Windows Defender (which has to be the worst app around) and resurfaced when I installed ESS. At this point, I am updating all the device drivers from scratch, updating Windows components, and running DISM/SFC. I have also turned off the Windows Defender and Windows Firewall services, in case ESET clashes with those. If this does not solve it, I suppose its money wasted on a 3-year ESET license. I will be forced to uninstall it and go with something else. I shall keep you informed. Edited January 17, 2017 by lezboyd
Administrators Marcos 5,466 Posted January 17, 2017 Administrators Posted January 17, 2017 We have come across numerous cases when issues began to manifest after installing ESET but the root of the problem was elsewhere. It used to be either a badly written 3rd party software, a bug in the software and at least 2-3 times it was a bug in Windows itself.
lezboyd 0 Posted January 17, 2017 Author Posted January 17, 2017 (edited) 10 minutes ago, Marcos said: We have come across numerous cases when issues began to manifest after installing ESET but the root of the problem was elsewhere. It used to be either a badly written 3rd party software, a bug in the software and at least 2-3 times it was a bug in Windows itself. I don't doubt that. But I would imagine that experience would have made this process easier and would not entail having to wait weeks for an uncertain outcome. I have also noticed that no one from ESET has asked me for a single thing to help identify the issue. Whatever I have provided, I have done so voluntarily. If the dumps are not enough, is there something else I can provide that would help? I have been using ESET since v3 and have been using most other softwares on my laptop for years too, across multiple laptops, never running into a problem until I upgraded to ESS v9 and beyond. It's a fact. Edited January 17, 2017 by lezboyd
Administrators Marcos 5,466 Posted January 18, 2017 Administrators Posted January 18, 2017 The problem appears to be in the wfplwfs!L2802_3ParseMacHeader function as it reads more bytes from the output of NdisGetDataBuffer than requested. We will talk to Microsoft and open a support ticket with them. We assume that the issue should not occur with v9 as it uses epfwlwf which does not register in Microsoft's wfplwfs driver. Could you confirm?
lezboyd 0 Posted January 18, 2017 Author Posted January 18, 2017 2 hours ago, Marcos said: We assume that the issue should not occur with v9 as it uses epfwlwf which does not register in Microsoft's wfplwfs driver. Could you confirm? Thanks for opening the ticket with Microsoft. Hopefully that'll lead to a resolution. Regarding the second half (quoted), not sure exactly what you need me to do. From my side, I've checked the Windows drivers folder; did not find epfwlwf.sys there. It has epfwwfp.sys and epfw.sys among other ESET drivers that do not start with "epfw". Nothing with that name found under Local Services either. Please advice. Just to be clear, I'm currently on ESS v10.0.369.0. The BSOD problem has started since v9 and continues in the latest version.
Administrators Marcos 5,466 Posted January 18, 2017 Administrators Posted January 18, 2017 35 minutes ago, lezboyd said: Regarding the second half (quoted), not sure exactly what you need me to do. From my side, I've checked the Windows drivers folder; did not find epfwlwf.sys there. It has epfwwfp.sys and epfw.sys among other ESET drivers that do not start with "epfw". Just to be clear, I'm currently on ESS v10.0.369.0. The BSOD problem has started since v9 and continues in the latest version. Epfwlwf.sys is the firewall driver used by v9. V10 doesn't use it on newer Windows. We don't need you to do anything as it will be Microsoft's turn after we report the problem (probable Windows bug) to them.
lezboyd 0 Posted January 19, 2017 Author Posted January 19, 2017 OK, thanks. Please let me know how it goes and how do I proceed once they reply. If you / they any more info, please let me know.
lezboyd 0 Posted January 21, 2017 Author Posted January 21, 2017 On 19/1/2017 at 2:35 AM, Marcos said: Epfwlwf.sys is the firewall driver used by v9. V10 doesn't use it on newer Windows. We don't need you to do anything as it will be Microsoft's turn after we report the problem (probable Windows bug) to them. Just adding one more thing I have noticed. So far, I have got BSODs whenever I have run apps for a prolonged period for whom I have set an application-based Firewall rule (allowed an app, for example) in ESS. If I am using apps for which I have not set a deliberate rule in the firewall, I get no BSODs. Just something I noticed. It might still be a Windows bug, as in how Windows drivers reacts to ESS drivers handling an app-based firewall rule.
itman 1,807 Posted January 21, 2017 Posted January 21, 2017 4 hours ago, lezboyd said: Just adding one more thing I have noticed. So far, I have got BSODs whenever I have run apps for a prolonged period for whom I have set an application-based Firewall rule (allowed an app, for example) in ESS. If I am using apps for which I have not set a deliberate rule in the firewall, I get no BSODs. Just something I noticed. It might still be a Windows bug, as in how Windows drivers reacts to ESS drivers handling an app-based firewall rule. Are you running the Eset firewall in Interactive mode? If so, switch to Automatic mode w/Windows inbound firewall rules applied mode. You will also have to temporarily disable any Eset user created inbound firewall rules. Test to determine is BSOD's disappear. In other words, you have established the issue is with custom firewall rules you created. So you will have to experiment with those to find which one is causing the problem.
lezboyd 0 Posted January 21, 2017 Author Posted January 21, 2017 @itman : ESET firewall is running in Automatic mode with 'Evaluate also rules from Windows Firewall' turned OFF (since I have the Windows Firewall service Disabled; relying solely on ESET's firewall). Currently I am testing my theory by not using any of the apps I have set a firewall rule for and seeing if I get a BSOD. A couple weeks later (last time I tested for only a week, declared everything solved and fell flat on my face), I will test by deleting the custom firewall rule for one of the apps and then using that app for a prolonged period.
itman 1,807 Posted January 21, 2017 Posted January 21, 2017 21 minutes ago, lezboyd said: since I have the Windows Firewall service Disabled This just might be your problem. Disabling the Win firewall service also disables the Windows Filtering Platform i.e. WFP. The Eset firewall interfaces directly with WFP; all it disables is the inbound/outbound rule application portion depending on firewall mode selected. As a rule, the Windows firewall service should never be disabled.
lezboyd 0 Posted January 21, 2017 Author Posted January 21, 2017 (edited) @itman : I disabled it because of the BSODs, thinking maybe ESS Firewall is not playing nice with another firewall. I will turn it back on. Edited January 21, 2017 by lezboyd
Administrators Marcos 5,466 Posted January 25, 2017 Administrators Posted January 25, 2017 We have received an initial response to our open case at Microsoft and they confirmed that it looks like a bug in wfplwfs driver. Moreover, according to our developers this BSOD can occur when fragmented IP packets (usually UDP) are sent over a PPPoE connection. Windows uses some internal structures to represent network packet and in this case they are crafted in an unusual (but still valid) way. The problem is that L2802_3ParseMacHeader function in wfplwfs Microsoft’s driver does not handle this scenario well which may result in BSOD. We know of 3 ways how to mitigate this BSOD so far: Do not use PPPoE connection (use Wifi, or change your cable/dsl modem for a cable/dsl router which will do PPPoE for you) Do not use programs that might create fragmented IP/UDP. Torrents are well known for creating such packets. Disable UDP in your torrent application if possible. Note that web browsing uses mainly TCP, which is safe. Use an older Eset product. ESSv9 should be safe since it has its own LWF driver called epfwlwf and does not depend on Microsoft’s wfplwfs. This has nothing to do with enabled or disabled Windows firewall, nor with Automatic/Interactive mode of ESET firewall or application rules in ESET firewall.
Administrators Marcos 5,466 Posted January 25, 2017 Administrators Posted January 25, 2017 On 21. 1. 2017 at 4:18 PM, itman said: Disabling the Win firewall service also disables the Windows Filtering Platform i.e. WFP. The Eset firewall interfaces directly with WFP; all it disables is the inbound/outbound rule application portion depending on firewall mode selected. As a rule, the Windows firewall service should never be disabled. Disabling Windows Firewall does not affect ESET's filtering whatsoever and doing so merely removes Windows Firewall filters from WFP. The only effect it would have is that IPSec and maybe also some other Windows functionalities would not work.
itman 1,807 Posted January 25, 2017 Posted January 25, 2017 2 hours ago, Marcos said: Disabling Windows Firewall does not affect ESET's filtering whatsoever and doing so merely removes Windows Firewall filters from WFP. The only effect it would have is that IPSec and maybe also some other Windows functionalities would not work. Yep. Got that one wrong. You have to disable the BFE service.
Recommended Posts