q000061

My computer crashed during installation after I clicked the FINISH button.

This article applies to: BlackICE Defender.

SUMMARY

At the end of an installation process, your system immediately crashes after you clicked the FINISH button. In general, this is due to network adapter the product tries to open. If that interface is not network-related or is an intermediate virtual adapter, this problem can happen. There is a way to work around this by adjusting the product's configuration.

DETAILS

Basically, when your computer crashes immediately after clicking the FINISH button, you will need to get back into the system in order to make adjustments to the configuration.

If you are reading this knowledge base article, you are probably in one of the following situations:

1. You hard-booted your computer and removed the product from your computer by doing one of the following things:
   • manually removing entries in the registry
   • using the BIREMOVE utility you obtained from our web site
2. You have done 1 above and have also deleted the entire installation directory.
3. You have not used your computer because you are not sure what to do.
4. You have re-booted your computer and decided to go into Windows SAFE mode (applicable to Win 95/98 only).

Regardless of your situation, you'll need to get ahold of a log file called blackd.log and/or blackd-old.log. You'll need to open one of those files using notepad or wordpad.

If you are in situation #2 above, you will need to re-install the product and suffer through the crash one more time in order for Defender to have the log file we need to fix the situation.

This is that portion of the log file you will need to look at in order to fix the problem:

A sample log from a Win NT installation

...stuff deleted... debugLog.clear = INFORMATION DATABASE SPATCH  ------------/blackice.ini ------------- BI_Sensor() 1 Description: 3Com Fast EtherLink XL PCI 10/100Mb Adapter (3C905) 1 Title: [1] 3Com Fast EtherLink XL Adapter (3C905) 1 Details: El90x1 / El90x (3Com) 8 Description: 8 Title: [8] Bogus Adapter Unable to list Win9x adapters Tue, 30 Nov 1999 06:17:54: licensekey = 123456789 Tue, 30 Nov 1999 06:17:54: LICENSE: expires in 13929 days, expires=2038-01-19 Found filtered 2 adapters  ------- Adapter: \Device\El90x1 -------- \Device\El90x1: Adapter open Vendor 3Com 3C90x Ethernet Adapter NDIS version 400 Media type 802.3 MAC address 123456789abc Link speed 10000000 Max packet size 1514 NDIS buffer 96896 \Device\El90x1 Running in filtered mode \Device\El90x1 PacketCreate(): allocating 512000 bytes for buffer \Device\El90x1 SETFILTER: successful  ------- Adapter: \Device\Bogus -------- \Device\Bogus: Adapter open Vendor Bogus Corp. NDIS version 300 Media type MAC address Link speed -1 Max packet size 78777671514 NDIS buffer 0 ... log ends here ...

A sample log file from a Win 9x installation

... stuff deleted ... debugLog.clear = INFORMATION DATABASE SPATCH  ------------/blackice.ini ------------- Unable to list WinNT adapters 0000 DriverDesc: Dial-Up Adapter 0000 AdapterName: MS$PPP 0000 NDIS: 3.10 PPPMAC 0005 DriverDesc: IBM Ethernet Credit Card Adapter II 0005 NDIS: 3.10 SNIP 0001 DriverDesc: Toshiba FIR Port Type-U 0001 AdapterName: *TOS7009 0001 NDIS: 4.0 *TOS7009 IN::Tue, 30 Nov 1999 07:05:38: setDrvCnt(): set drvcnt to 0 Tue, 30 Nov 1999 07:05:38: licensekey = 123456789 Tue, 30 Nov 1999 07:05:38: LICENSE: expires in 13929 days, expires=2038-01-19 Found filtered 3 adapters  ------- Adapter: 0000 -------- 0000: Adapter open Vendor PPP Adapter. NDIS version 400 Media type Wan MAC address 444553540000 Link speed 9600 Max packet size 1514 NDIS buffer 10200 0000 Running in filtered mode 0000 PacketCreate(): allocating 66000 bytes for buffer 0000 SETFILTER: successful  ------- Adapter: 0005 -------- 0005: Adapter open Vendor National Semiconductor SNIP Adapter. NDIS version 30A Media type 802.3 MAC address abcdef123456 Link speed 10000000 Max packet size 1514 NDIS buffer 5120 0005 Running in filtered mode 0005 PacketCreate(): allocating 512000 bytes for buffer 0005 SETFILTER: successful  ------- Adapter: 0001 -------- ... log ends here ...

From the Windows NT log, we can see that the adapter \Device\Bogus looks suspicious. This is a candidate device that we can have Defender ignore.

From the Windows 95/98 log file, we can see that the adapter 0001 is suspicious because the log seems to end at the point where it is supposed to open it.

Depending on your situation, the following things need to be done:

If Defender has not been uninstalled...

1. For Win 95/98, boot your system into safe mode; for Win NT, boot your system and make sure to stop the service before it gets a chance to restart; you have 5 minutes or more to do this.
2. Open the file blackice.ini and add the following line:
   • for the Win NT example above, you would add the line:
     

     adapter.enabled\Device\Bogus=false

   • for the Win 95/98 example above, you would add the line:
     

     adapter.enabled0001=false

3. Save and close blackice.ini
4. Restart your system if you have Win 95/98 or if you have Windows NT, start the service from the Windows NT service list.

If the product was removed...

1. Start the installation program.
2. Just before you click the FINISH button within the installation process, minimize the installer by clicking the minimize button at the top right corner of the window.
3. Using notepad, open the blackice.ini file that has already been placed there by the installer and make changes to it similar to the examples below:
   • for the Win NT example above, you would add a line like:
     

     adapter.enabled\Device\Bogus=false

   • for the Win 95/98 example above, you would add a line like:
     

     adapter.enabled0001=false

4. Restore the installer, and click the FINISH button.

Should you continue to experience difficulties, please send the files blackd.log, blackd-old.log, and blackice.ini to support-l1@networkice.com.

 
Keywords: crash, adapter.enabled, adapter, BSOD 
Version:  1.8.6.8 
Fixed:     
Modified: 1999-11-30