PrivateFirewall (PFW) + Win7 + Sleep/Hibernate = Freeze + BSOD

Discussion in 'other firewalls' started by soewhaty, Dec 11, 2017.

  1. soewhaty

    soewhaty Registered Member

    Joined:
    Feb 28, 2014
    Posts:
    74
    Tried to describe it as short as psbl in the title. PrivateFirewall (PFW), Win7x64 SP1 (0 Win Updates ever installed). On a previous Win7 install (with some Win Updates installed) on the very same machine, PFW never caused the issue. Since then I've re-installed Win7 and the issue is that whenever I have the PC run for some time, say 10-12h, then I put it to Sleep/Hibernate and that results in a freeze for some time, fan speeds like a mofo and this then leads to BSOD. It's clearly caused by the HIPS module cos when I disable process detection the issue is not there. Also, I'm sure it's PFW cos when I uninstall it, the issues is gone and then comes back when I reinstall PFW. When I try to force the issue after a reboot it doesn't occur. It's as if it needs to run for a bit and then it happens. Haven't placed any extra hardware or whatever that could cause the freeze/BSOD. Also, I left Trusted Publishes enabled and deleted all entries in it except the entries for MS and HP (my notebook's manufacturer). Did go for resetting settings/rules to default but no luck. Also, after the BSOD happens I did check the advanced reports but no blocked process was reported there, so it seemed as if nothing is getting blocked, but that's not the case as else why would it freeze/BSOD.

    Has anyone else ever had such issues and could you guys suggest me something to catch the culprit process/service which PFW is blocking? Any help is appreciated.

    Thank you guys! :)
     
  2. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    Hi Soewhaty

    Two thoughts. One try stopping with sleep/hibernate. I never have found them at all useful, and have had problems with them. I don't use them.

    Two. I have a music service that uses the MS special installer. I also use Appguard in lockdown. Appguard blocks the start up so I simply turn it off and start the service and turn it back on. Sometime that is the simplest solution.
     
  3. soewhaty

    soewhaty Registered Member

    Joined:
    Feb 28, 2014
    Posts:
    74
    Thanks for your input.

    I cannot do without Sleep/Hibernate because 1) they are EXTREMELY useful for me personally, and 2) they've always been rather robust and reliable except for this issue with PFW. Hibernate is insanely useful - say you have work in progress but you gotta go and don't have battery and don't wanna close your work down and then reopen. So just Hibernate it and then you can safely unplug from AC and all the work in progress is still saved and available afterwards when you replug. Moreover, when you are on battery only (and your battery is not the newest in the world) if you put it to Sleep it continues to use some battery juice until it eventually uses up all the juice (say 5h later) and you've lost the work which you thought would be saved for you. Hibernate uses no juice, so again ... rather handy.

    Forgive me if I misunderstand you but I can't relate your 2nd paragraph to my OP.

    Thanks again for the reply.
     
  4. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    Simple. When you need to start that program turn off the firewall, get it started and turn it back on.
     
  5. soewhaty

    soewhaty Registered Member

    Joined:
    Feb 28, 2014
    Posts:
    74
    I'm sorry but ... what are you talking about? Have you even read the OP?

    I'm not talking about any program that is being blocked by PFW. What is blocked by PFW is some process or service that has to do with Sleep/Hibernate and this leads to freeze and then BSOD. There is no program, that you're mentioning ... so ....
     
  6. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    Yes I read the OP. I don't care what PFW is blocking only that it is blocking something.

    If you shut down the FIrewall does the blocking stop. If it does then turn it off, start your program and turn it on.
     
  7. Minimalist

    Minimalist Registered Member

    Joined:
    Jan 6, 2014
    Posts:
    14,439
    Location:
    Slovenia
    Maybe PFW has a problem with itself (driver or service) when waking up from sleep/hibernation? In this case there probably wouldn't be any blocked event logged.
     
  8. soewhaty

    soewhaty Registered Member

    Joined:
    Feb 28, 2014
    Posts:
    74
    Yes, I thought it was clear from the OP but ok yes, when PFW is off the issue is not present. So at this point in time it is clear that it is PFW and that it is its HIPS module causing the issue. But again I don't see why you insist mentioning me starting any program. You clearly either misread or didn't read the OP. There is no program that I need to start, which PFW blocks. What PFW blocks is the functionality of my notebook to go to sleep/hibernate. This means that if PFW and its HIPS are on then whenever I go try to go into sleep/hib. the issue occurs. So AGAIN I'm not running any program ... And even so, why would I have to kill PFW every time I try to enter sleep/hib. That's an overkill and rather annoying to do. Sides, as I said, on my previous Win7 install on this very same machine, this issue was not there. So it's not like it's impossible to achieve ...

    Ya, you might have a point. I should just add that the freeze happens right after I try to enter sleep/hib. and it stays frozen for say 1-2 min, and then it BSOD's. It never actually reaches sleep/hibernate mode. So it's not like it sleeps/hibernate and then upon waking up the issue appears. It appears upon trying to get to sleep/hib.
     
    Last edited: Dec 11, 2017
  9. Minimalist

    Minimalist Registered Member

    Joined:
    Jan 6, 2014
    Posts:
    14,439
    Location:
    Slovenia
    Aha OK, I misread that. It still could be a problem with a component of PFW, not being "compatible" with sleep or hibernate function.
     
  10. soewhaty

    soewhaty Registered Member

    Joined:
    Feb 28, 2014
    Posts:
    74
    Sure, that's prolly the case. Just odd that on the same OS and same machine the issue wasn't there be4. Oh well ...
     
  11. Lexor

    Lexor Registered Member

    Joined:
    Nov 26, 2017
    Posts:
    43
    Location:
    EU
    I've never used PFW but it is "on my list to try" and I am interested in any problems it can have. Since many weeks I read a lot about firewalls from my list and my "idea" is that the root of your problem could be here:
    Maybe, just maybe, PFW is not able to see the difference between "boot/shutdown" and "hibernation/sleep" and have some problem with a state of this service on Windows 7?
     
  12. soewhaty

    soewhaty Registered Member

    Joined:
    Feb 28, 2014
    Posts:
    74
    I'll see what I can do about that. Appreciate your input! :)
     
  13. ichito

    ichito Registered Member

    Joined:
    Jan 14, 2011
    Posts:
    1,973
    Location:
    Poland - Cracow
  14. soewhaty

    soewhaty Registered Member

    Joined:
    Feb 28, 2014
    Posts:
    74
    I just remembered that I have 2 error logs. Here they are, if that helps anything:

    Problem signature:
    Problem Event Name: BlueScreen
    OS Version: 6.1.7601.2.1.0.256.48
    Locale ID: 1033
    Additional information about the problem:
    BCCode: 9f
    BCP1: 0000000000000003
    BCP2: FFFFFA80079C7A10
    BCP3: FFFFF80000B9A3D8
    BCP4: FFFFFA801B45B8F0
    OS Version: 6_1_7601
    Service Pack: 1_0
    Product: 256_1

    and

    Problem signature:
    Problem Event Name: BlueScreen
    OS Version: 6.1.7601.2.1.0.256.48
    Locale ID: 1033
    Additional information about the problem:
    BCCode: 9f
    BCP1: 0000000000000003
    BCP2: FFFFFA80079C8060
    BCP3: FFFFF80000BA0748
    BCP4: FFFFFA80075CAC70
    OS Version: 6_1_7601
    Service Pack: 1_0
    Product: 256_1

    @ichito - thank you very much for the input. At the moment I'm not on PFW any longer (due to the issue I described in OP) and therefore I cannot double check but as I remember powercfg.exe was by default found within the process list (set to filter) and I think I did set it to allow and the OP issue still occurred. As I see it, you're on PFW so you can tell whether or not powercfg.exe was in your process list by default and how it was set by default? Your findings about conime.exe are interesting. Don't think I've noticed this one before. Will give it a try as it might be related to sleep/hibernate. However, the MS site you link to addresses only Hibernate and not Sleep. My issue appeared both with sleep and hibernate. But who knows, they might be related so I'll whitelist conime.exe.

    For the record, inspired by this question's 2nd answer - https://superuser.com/questions/395...e-to-put-your-computer-to-sleep-not-hibernate - I whitelisted shutdown.exe, rundll32.exe, and powrprof.dll because they are responsible for

    Shutdown %windir%\System32\shutdown.exe -s
    Reboot %windir%\System32\shutdown.exe -r
    Logoff %windir%\System32\shutdown.exe -l
    Standby %windir%\System32\rundll32.exe powrprof.dll,SetSuspendState Standby
    Hibernate %windir%\System32\rundll32.exe powrprof.dll,SetSuspendState Hibernate

    but AGAIN it BSOD'd :(
     
  15. act8192

    act8192 Registered Member

    Joined:
    Nov 9, 2006
    Posts:
    1,760
    Did you try to teach PFW to sleep or hibernate and come back again? Do so for each one to see what happens.
    Do a clean pc reset, then just use right click to get into Training mode.
    Also recheck your power settings.

    Sorry for the underlines, using an unknown tablet and it won`t turn off.
     
  16. Jim1cor13

    Jim1cor13 Registered Member

    Joined:
    Aug 4, 2012
    Posts:
    473
    Location:
    US
    I had never had any issues with PF running in Win 7 Pro, but I will say as far as hibernation goes,
    I use powercfg to disable it after installation. I did that recently in Win 10 also.

    I do use sleep function on my laptop, never had issues with PF doing that, but in a tower, I never use
    sleep or hibernate due to wake up issues i have seen in the past.

    What about exiting PF before sleep/hibernation, then after system wakes up, re-enable it? What does
    your event viewer have to report after these blue screens, etc. happen? Anything directly linking it
    to PF?

    Training mode is also a good suggestion to see if the issue goes away as act8192 stated above. :D
     
  17. act8192

    act8192 Registered Member

    Joined:
    Nov 9, 2006
    Posts:
    1,760
    Ditto here.
    Whenever I install something like HIPS (Private, Outpost, SSM on XP) the first thing I do I train it to sleep and shutdown. Never failed.
    And PFW on Windows 7 has never had sleep problems and I do sleep many times during the day. I don't hibernate.
    OP has both sleep and hibernation BSODs so windows event log probably has no records of it.
     
  18. soewhaty

    soewhaty Registered Member

    Joined:
    Feb 28, 2014
    Posts:
    74
    Ya, I did try training it but it didn't help. Thanks for the input, still.

    Thank you too for the input. I'd rather not disable hibernate since I use it heavily.

    Good tip here on first thing after install being to train the power 'moves'.

    Now, after some tinkering and some good input from all you guys, I went for the idea from @ichito as seen in the screenshot. Also worth noting that I don't have the conime.exe he mentioned. It's just not present on my system, so it must be something local he got there from some app or sth. Anyway, having allowed the items as shown on the screenshot seems to be driving my system freeze- and BSOD-free for now. Will continue testing and report if anything changes but for now it looks good. Again, thank you all! :)
     

    Attached Files:

    Last edited: Dec 13, 2017
  19. ichito

    ichito Registered Member

    Joined:
    Jan 14, 2011
    Posts:
    1,973
    Location:
    Poland - Cracow
    OK @soewhaty ...I'll waiting for your next info.
     
  20. Jim1cor13

    Jim1cor13 Registered Member

    Joined:
    Aug 4, 2012
    Posts:
    473
    Location:
    US

    Good to hear it is working now. It should continue to be fine based upon your pic, looks like the power management
    is covered now. :D
     
  21. soewhaty

    soewhaty Registered Member

    Joined:
    Feb 28, 2014
    Posts:
    74
    That you guys, Sadly, died 2 times on me. This time it seems slightly different. It seems to go to sleep/hib without a problem. I see no BSOD'ing whatsoever. But upon waking up it shows as if it died from a BSOD and gives that typical prompt of starting in safe mode. This can drive u nuts.

    I'm starting to think something is just off with my Win7 install. Don't think it's PFW's fault. Not sure what to think actually. I'll try to dig in the event viewer. I'm pretty sure I saw some log about the error.

    What on earth could be wrong with Windows, that is causing this issue ... sleep and hibernate are robust as hell when I remove PFW and as soon as I install it ... Win dies. Have tried on several other computers with the same Win7 install and PFW and the issue is not there. Hell, on the very same machine I'm on now the issue was never there. Just started happening after I reinstalled. Seems like it calls for yet another reinstall.
     
    Last edited: Dec 19, 2017
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.