Question BSOD when using VPN Client software (WppRecorder.sys)

[rodrigofk15]

Hello friends, first sorry for my bad English.

I need help, as I have already researched in several places, including here in the forum and I still haven't found the solution to my problem.

I'm having blue screen problems on Windows 10. However, this problem only happens when I use the Forcepoint VPN Client software to work. After I connect to the VPN, the blue screen can happen in 5 minutes, 30 minutes or 3 hours, it is completely random.

The error shown on the blue screen is:

Stop code: Unexpected Kernel Mode Trap
What failed: WppRecorder.sys

I used Windows 10 Pro version 1909 and is completely updated.

I checked the minidump, and the following information appears: BlueScreenView - Minidump

If anyone can help me, I am making the last two minibump files available on my Onedrive: Minidump Files

Due to the COVID-19 pandemic, we installed this Forcepoint VPN Client for 60 Windows users, and we are only experiencing problems with two users, one of whom is me.

I've been trying to find the cause of this problem for a month. I have already performed several procedures that I found on the internet, but none of them worked, including I have reinstalled the VPN Client.

Thank you for your help.

Rodrigo Azevedo

 

[The_Prophecy]

Hi Rodrigo,

Is this a company owned machine? If so, you should stop immediately and let the company IT department handle this.

If this is your own personal computer that the VPN client is installed on, I would first check to see if there are any updates for the Forcepoint VPN client. Second, according to the dump files you posted, you are indeed not running Windows 10 1909, but 1903. The build number shown in the dump is 18362, which corresponds to Windows 10 version 1903. If you need to be on 1909 for this, I would suggest you update as soon as you can.

As far as your English goes, it's totally fine. I had no trouble understanding your post

 

[rodrigofk15]

Hi @The_Prophecy,

This is my personal computer, but we are having the same problem on a Dell Desktop that was provided by the company. I need to solve this problem, because I'm part of the company's IT team. About the Windows version, this is very strange. For me it is saying that it is the 1909 version, see in the image: VERSION

I have already contacted Forcepoint, and the version of our VPN Client is the latest available: Forcepoint-VPN-Client-6.7.0.6700.exe

As I said, we installed in 60 users with Windows 10 Pro and we are only having problems with two users. I believe that the problem is punctual, some incompatibility of software/driver or hardware, I don't know. I already checked the event view and it has no error information. I have already removed my Kaspersky antivirus (just for testing), and the blue screen problem continued. I also used the command sfc /scannow, in short, I've tried several things.

Another detail is that if I just leave the software open, minimized close to the Windows clock, but without being connected to the VPN, I have no blue screen problems. The problem only starts after I authenticate and connect to the VPN.

 

[The_Prophecy]

Was the OS perhaps updated since those memory dumps were generated? The two I downloaded from your OneDrive said 1903 anyway. Double check by going to the "winver" dialog from the Run box. Should confirm for sure.

Getting back to the bluescreens themselves though, if it's only happening when when the VPN tunnel is actually active, my thought would be to check the network adapter drivers if the VPN client is the same between both machines. If you have a wired and a wifi connection on one of the faulting systems, disable one of the adapters and turn on the VPN. Note what happens (either no bluescreens within the typical time frame, or you continue getting them) and then switch the disabled adapter, re-establish the VPN and repeat.

Edit:
Looks like you might still be missing a patch or two. My build number is shown below (18363.815, vs. 18363.778 in your screenshot)

https://imgur.com/z4y3QXm

 

[rodrigofk15]

Here is the Winver information:

https://imgur.com/Md3bccO

View: http://imgur.com/Md3bccO


I use a desktop and not a notebook, my motherboard is an ASUS TUF Z270 MARK 1, which even has two network cards. I used both, but I disabled one of them and started using only one network adapter to test. In addition, I went to the ASUS website and updated all possible drivers, including the BIOS.

This is the complete configuration of my computer:

https://imgur.com/U3IefKs

View: https://imgur.com/U3IefKs


When this problem started, I suspected it was something related to the network, precisely for the reason that it only happened after authenticating with the VPN.

Anyway, you gave me a good idea. I have a USB WiFi network adapter and I can do a test, deactivating all my network cards and using the VPN via WiFi connection. So I could rule out 100% problems with the onboard network cards.

 

[rodrigofk15]

Only complementing, the minidump files that I made available on OneDrive are from yesterday, May 9, 2020. The last time I updated Windows was during that week.

 

[The_Prophecy]

As long as it's using a different driver from the onboard wifi, that would be a good test as well. Let me know how it goes!

 

[rodrigofk15]

I will perform the tests tomorrow (Sunday) and if there is no blue screen, I will continue testing on Monday, since I will use the VPN all day because of work.

The drivers are completely different. The two network cards are INTEL and the WiFi adapter is REALTEK.

 

[rodrigofk15]

Hi @The_Prophecy,

I couldn't take the test on Sunday, but I took the test today, and in just 10 minutes after I connected to the VPN, unfortunately I continued to receive the blue screen.

https://imgur.com/hthj0kq

View: https://imgur.com/hthj0kq


I disabled my two network cards with INTEL drivers and used only my USB WiFi adapter, which has the REALTEK Driver.

I added the minidump file with today's date to my OneDrive, but the error information is the same as the previous files, nothing has changed. The file name is 051120-7187-01.dmp

https://1drv.ms/f/s!AsV9IvZTdgrQwCUruKpUtQxAHVgR

It's really difficult to understand what is happening.