Blue Screen of death from Windows 10 upon shutdown with Endpoint Protection and AhnLab Tamper Protection Driver installed

book

Article ID: 170572

calendar_today

Updated On:

Products

Endpoint Protection Endpoint Protection Cloud

Issue/Introduction

Windows 10 results in a Blue Screen of Death (BSoD) on shutdown with AhnLab Tamper Protection Driver Common Driver (software version 2.0.0.0 and driver version 9.3.0.2) is installed on same machine as a Symantec endpoint client (SEP, SBE, SEPC).

The driver can be found as loading from

C:\Program Files\AhnLab\SaATNetizen with a name of AtamptNt.sys.

Or

AhnLab Smart Defense (software version 2.1.0.1 and driver version 2.9.0.16)

Ahnlab Behavior Driver  C:\Program Files\AhnLab\SaATNetizen\medvpdrv.sys

Cause

The cause is with AhnLab's Netizen software.  AhnLab would corrupt the memory used by SymEvent during shutdown/restart and cause a BSOD.

Resolution

Upgrade AhnLan's Netizen software to a version released post Oct 2017.