SPF and VSDATANT

Discussion in 'ProcessGuard' started by jimmytop, Mar 25, 2005.

Thread Status:
Not open for further replies.
  1. jimmytop

    jimmytop Registered Member

    Joined:
    Dec 9, 2004
    Posts:
    268
    Location:
    USA
    A while back I uninstalled (completely) Zonealarm and started using Sygate Personal Firewall 5.6. When I start my computer PG logs the following alert:

    "Sun 13 - 10:20:03 [DRIVER/SERVICE] c:\program files\sygate\spf\smc.exe [1072] Tried to modify an existing driver/service named vsdatant"

    No ZA files exist on my computer, I've gone through the manual uninstall to be sure. Also, vsdatant is disabled in device manager. Why is sygate messing with it? If I ignore the alert everything seems to work fine, but I'm annoyed by this message over and over again.

    Thanks for any help.
    WinXP Pro SP2

    Edit: I even uninstalled the vsdatant hidden device from device manager, but smc.exe still tries to mess with it on start-up. There is no process or service called vsdatant running on my machine. No file with that name either.
     
  2. nick s

    nick s Registered Member

    Joined:
    Nov 20, 2002
    Posts:
    1,430
    Hi jimmytop,

    Have you tried searching your registry for any stray vsdatant keys/values? You may still have one under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services.

    Nick
     
    Last edited: Mar 25, 2005
  3. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
    Hi JimmyTop, Sygate does integrity checking on many files, if you do not want this alert, delete vsdatant.sys or .zip it up. You may have to show hidden files and folders Open windows explorer - Tools - Folder options - View Enable show hidden files and folders and disable Hide protected system files (recommended).

    HTH Pilli
     
  4. jimmytop

    jimmytop Registered Member

    Joined:
    Dec 9, 2004
    Posts:
    268
    Location:
    USA
    Thanks for the suggestion. I did have some entries in the registry for vsdatant so I deleted them. Restarted and now I get this message:

    "Fri 25 - 13:49:04 [DRIVER/SERVICE] c:\program files\sygate\spf\smc.exe [1068] Tried to install a driver/service named vsdatant"

    When I researched this file everyone said it was for zonealarm. So now I'm wondering is it a Sygate thing? There is no file on my machine with that name.
     
  5. jimmytop

    jimmytop Registered Member

    Joined:
    Dec 9, 2004
    Posts:
    268
    Location:
    USA
    That file does not exist on my system. That's whats so perplexing.
     
  6. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
    Hmm
    ZoneAlarm¹s VSDATANT component. VSDATANT resides on computers running ZoneAlarm as a hidden, non-PnP (Plug and Play) device.

    Maybe post on the ZA and / or Sygate forums will throw some light on the problem. At least PG is doing it's job properly :)

    Pilli
     
  7. nick s

    nick s Registered Member

    Joined:
    Nov 20, 2002
    Posts:
    1,430
    Hi jimmytop,

    I tracked a Zonealarm install on a clean XP system and put together a list of registry entries to look for on your system. Check and see if any of these still exist. Also check and see if any of the files listed under SharedDLLs still exist.

    Relevant keys:

    HKLM\SOFTWARE\Zone Labs
    HKEY_CURRENT_USER\Software\Zone Labs
    HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\TrueVector Service
    HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\System\vsdatant
    HKLM\SYSTEM\CurrentControlSet\Services\vsdatant
    HKLM\SYSTEM\CurrentControlSet\Services\vsmon
    HKLM\SYSTEM\ControlSet00*\Services\Eventlog\Application\TrueVector Service
    HKLM\SYSTEM\ControlSet00*\Services\Eventlog\System\vsdatant
    HKLM\SYSTEM\ControlSet00*\Services\vsdatant
    HKLM\SYSTEM\ControlSet00*\Services\vsmon

    Relevant values:

    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs "C:\WINDOWS\system32\vsdata.dll"
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs "C:\WINDOWS\system32\vsdatant.sys"
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs "C:\WINDOWS\system32\vsinit.dll"
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs "C:\WINDOWS\system32\vsmonapi.dll"
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs "C:\WINDOWS\system32\vspubapi.dll"
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs "C:\WINDOWS\system32\vsutil.dll"
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs "C:\WINDOWS\system32\vsxml.dll"
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs "C:\WINDOWS\system32\zlcomm.dll"
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs "C:\WINDOWS\system32\zlcommdb.dll"
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs "C:\WINDOWS\system32\ZoneLabs\camupd.dll"
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs "C:\WINDOWS\system32\ZoneLabs\cerbprovider.pvx"
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs "C:\WINDOWS\system32\ZoneLabs\ssleay32.dll"
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs "C:\WINDOWS\system32\ZoneLabs\vsavpro.dll"
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs "C:\WINDOWS\system32\ZoneLabs\vsdb.dll"
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs "C:\WINDOWS\system32\ZoneLabs\vsmon.exe"
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs "C:\WINDOWS\system32\ZoneLabs\vsruledb.dll"

    If you have Sygate's DLL authentication enabled, try disabling it and see if Sygate still tries to install the driver.

    Nick
     
Thread Status:
Not open for further replies.