BSOD ExPrevDriver.sys

[thecandyman]

Hello,

I've got Immunet on my 2012 R2 production server and i'm starting to have some blue screens (BSOD) and Windows crashes and reboots. When i check my dump files, i get the same cause  that the crash was provided by the driver ExPrevDriver.sys which is in the folder : Immunet\exprev

Any suggestions with this version of driver ? Update ? I've had this problem only since a few months.

[ritchie58]

Mmm. Windows Server 2008 R2, Server 2012 & Server 2016 is supported but I don't believe Server 2012 R2 is also officially supported. That could be the cause with what you're observing at this time.

I would have to assume that 'Immunet was working' with this Windows platform with what you wrote though.

Are you using the newest 7.5.0.20795 build of Immunet? 

Here's something you could try if some file(s) got corrupted. First do a 'clean uninstall' of Immunet. By that I mean when asked by the uninstaller if you plan to reinstall Immunet again choose the 'NO' option. You will have to reconfigure your settings, add any scheduled scans & any custom Exclusions you were using again.

If you're not using it you can download the newest build of Immunet at this link. https://download.immunet.com/binaries/immunet/bin/ImmunetSetup.exe 
Then do a reinstall to see if that corrects the issue.

If that doesn't work then it is very likely that Immunet is not compatible with Windows Server 2012 R2.

Cheers, Ritchie...

[thecandyman]

Hello Ritchie,

Thanks for the reply. Yes i'm update with the 7.5.0.20795 version installed. Everything was fine until about 2 months where i started to get random reboots of the production server. And when i took some time to check the dump files, it's that ExPrevDriver.sys in cause ... Is there not a way just to update this file or use a older version of it ?

You think my last try should be to desinstall Immunet completely and reinstall it ? 

Kinds regards,

Paul

[ritchie58]

Hi Paul,

To my knowledge there is no way to update just a particular file with Immunet.

Like I mentioned Server 2012 R2 is not in the list of supported Windows platforms unfortunately. You can view that data yourself at this link. Click on the 'REQUIREMENTS' tab. https://www.immunet.com/index

You could try to do a clean uninstall & reinstall to see if that corrects the issue but don't get your hopes up if Immunet is actually not compatible with Server 2012 R2.

If that doesn't work there is another option you could use. Immunet does have an enterprise version called "Secure Endpoint" (formally called AMP for Endpoints) you could use instead.

Although not free like Immunet it is reasonably priced, much more configurable to your needs, will provide much better protection for server environments & is easily deployed to multiple endpoints. https://www.cisco.com/c/en/us/products/security/amp-for-endpoints/index.html

Best wishes, Ritchie...