I’ve chased, along with Citrix and Microsoft support, a bug with my Windows 2008 servers running on XenServer for months, and believe I’ve finally got the fix figured out.
First a little back story.
I switched from Symantec to Sunbelt Vipre Premium in 2010. The move went off without an issue on my then fleet of Windows 2003 32bit & 64bit servers. We moved to a new building in November of 2010 and I spun up new Windows 2008 R2 servers at the new site. Initially I didn’t notice if shutdowns took an inordinate amount of time and resulted in A BSOD. I first really noticed it when completing the December 2010 Windows updates. Most of the 2008 server updates were failing because the reboot process was taking so long.
Thinking it may be related to an old version of Desktop Authority, I began removing the service as I was moving to GP Prefs anyway. This did nothing to fix the issue. At this time I noticed that it was only my 2008 R2 servers that were affected, or so I thought. I engaged a MSP I use for additional help from time to time and they suggested that I reinstall the Citrix Tools. That worked until it was time for another round of Windows Updates.
This is when Citrix & Microsoft Support was brought in to take a look. We generated dump files, reinstalled Citrix Tools countless times, but still couldn’t nail down the cause. All they could tell was it had something to do with the network drivers. I then realized it wasn’t only my Windows 2008 R2 boxes, but all 2008 (32 & 64 bit) boxes and that they all had Vipre Premium installed. I had recently spun up some new 2008 R2 servers and installed vanilla Vipre them. These servers didn’t have the BSOD issue when shutting down.
I then began to remove the firewall enabled version of Vipre and replace it with regular Vipre. Trouble is, this didn’t fix the issue either. What the hell?
Around this time I had done a P2V on a server and was cleaning up the hidden devices when I saw that Vipre Premium had left it’s hooks in the NIC drivers. Thinking that this might be the same for the Vipre Premium to Vipre servers I took a look at device manager on an affected server. Bingo! You can see the traces left behind here.
Now I needed a good way to get rid of the offending driver. I wasn’t able to just uninstall it from device manager. Uninstalling the Citrix driver didn’t get rid of the hooks either. I ended up having to uninstall Citrix tools, reboot, uninstall the physical NIC, reboot, let Windows reinstall the physical NIC then reinstall Citrix Tools and reboot. Only then do I not see the Vipre Firewall driver. 
It took nearly 10 months for this to be resolved and caused no end of head aches for me.









