Windows 10: BSOD after installing Symantec Endpoint Protection v14

This is a an MSI GhostPro GS60 2QE-606 laptop running Windows 10 Pro creators edition and has the NVidia Geforce GTX 970M display adaptor.

After installing SEP 14 and restarting, sys will not boot it instantly goes into BSOD with KERNEL_MODE_SECURITY_ERROR and I think I may have also seen IRQL_NOT_LESS_OR_EQUAL (or something similar to that...

Researching I found this may be tied to the nVidia card. Ibooted into safe mode and tried rollingback the driver (had the newest installed) and then rebooted, still BSOD. I disabled the card in Device Manager andcould then boot normally. I thenuninstalled SEP and re-enabled the nVidia card and rebooted and all was well again. I tried re-installing SEP 14 again and hadto repeat the same process again as the BSOD returned after SEP was installed.Help? SEP14 is ourcorporate AV so I need to get this working somehow…
DIM files attached. Thanks!



:)

 

Update Trusted Sites has stopped working

I believe this is something to do with Symantec Endpoint Protection v14. Have you got that installed? I see that on every system that has v14 installed and none that have v12 installed.

See this thread:

UpdateTrustedSites.exe Error - SEP 14.x - Windows 10 1607 - System Center Config Manager Client | Symantec Connect

 

Excel Preview on Windows 10 Pro

Hi,

I am from Symantec Technical Support team.

Symantec Endpoint Protection (SEP) adds support for Windows 10 with 12.1.6 MP1 .For Symantec Endpoint Protection 12.1, a maintenance patch has been released on July 29, 2015.

You can upgrade to Windows 10 with Symantec Endpoint Protection 12.1.6 MP1 or 12.1.6 MP1a installed, You must uninstall earlier versions of Symantec Endpoint Protection.

For more details check the following article:

Endpoint Protection support for Windows 10

Related article: Upgrade to Windows 10 prompts to uninstall Endpoint Protection after an upgrade to 12.1.6 MP1

Error: "Uninstall this app now because it isn't compatible with Windows 10" after upgrade to Endpoint Protection 12.1.6 MP1 or later

Best Regards,

Chetan

 

Hi jhickey ,

There were 3 bsod minidump files that were debugged and there was no specific misbehaving driver identified.
The first test will be memory testing.
There needs to be at least 8 passes to not have false negatives.
With 16GB of RAM this will take many hours. One or more errors indicates defective RAM or DIM/MB problems.
If the RAM passes the next step will be windows driver verifier to stimulate drivers and find misbehaving drivers.
At this moment Symantic has not yet appeared in the BSOD debugging. So for now you can continue running it. At a later time we may need to uninstall it and use Windows defender.
If there are any new BSOD please update the zip or post a new one.



Open administrative command prompt and type or copy and paste:


1) sfc /scannow


2) dism /online /cleanup-image /restorehealth


3) chkdsk /scan


4) When these have completed > right click on the top bar or title bar of the administrative command prompt box > left click on edit then select all > right click on the top bar again > left click on copy > paste into the thread

5) Run memtest86+ version 5.01 for at least 8 runs.
This may take many hours so plan to run it overnight.
Memtest86+ - Advanced Memory Diagnostic Tool
When Memtest86+ has completed 8 or more runs make an image of the results to post into the thread.
Memory problems. - Microsoft Community
MemTest86+ - Test RAM Windows 10 BSOD Tutorials


6) Make sure that there is no over clocking while troubleshooting.

Sometimes there are problems in the bios that produce bsod.

The bios in your computer: BIOS Version/Date American Megatrends Inc. E16H5IMS.509, 7/27/2015


7) Please check to see if this is the most up to date version.


8) To ensure that there are no improper bios settings please reset the bios.


Sometimes there can be failure to boot after resetting the bios.

9) So please make sure your files are backed up.

10) Please make a backup image with Macrium:


Macrium Software | Macrium Reflect Free: Macrium Software | Your image is everything


11) And please create a restore point.




How to Clear Your Computers CMOS to Reset BIOS Settings:
How to Clear Your Computers CMOS to Reset BIOS Settings
3 Ways to Reset Your BIOS - wikiHow:
3 Ways to Reset Your BIOS - wikiHow








Application errors for observed in the Windows Event Viewer



Code: BugCheck 139, {3, ffffbe805206a120, ffffbe805206a078, 0} Probably caused by : win32kbase.sys ( win32kbase!IOCPDispatcher::WaitAndDispatch+6c )[/quote] Code: BugCheck 139, {3, ffffbd8153846790, ffffbd81538466e8, 0} Probably caused by : memory_corruption[/quote] Code: BugCheck A, {8, 2, 0, fffff801ad8c911e} Probably caused by : memory_corruption[/quote]

Code: +++ WER5 +++:Fault bucket , type 0Event Name: OsMitigationResponse: Not availableCab Id: 0Problem signature1: consent.exeP2: 10.0.15063.0P3: e0f856c4P4: StackHash_0c4fP5: 0.0.0.0P6: 00000000P7: PCH_F6_FROM_ntdll+0x00000000000A5EF4P8: c0000409P9: 000000000000002dP10:[/quote]
Code: 7/20/2017 6:26 PM Application Error Faulting application name: consent.exe, version: 10.0.15063.0, time stamp: 0xe0f856c4 Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000 Exception code: 0xc0000409 Fault offset: 0x0000000000000000 Faulting process id: 0x2ac8 Faulting application start time: 0x01d30185b1a5ee9c Faulting application path: c:\windows\system32\consent.exe Faulting module path: unknown Report Id: 6dbb3009-7824-44be-9dfd-27ad720f642d Faulting package full name: Faulting package-relative application ID:7/20/2017 6:51 PM Application Error Faulting application name: consent.exe, version: 10.0.15063.0, time stamp: 0xe0f856c4 Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000 Exception code: 0xc0000409 Fault offset: 0x0000000000000000 Faulting process id: 0x26c8 Faulting application start time: 0x01d3018925003a98 Faulting application path: c:\windows\system32\consent.exe Faulting module path: unknown Report Id: 118fcdac-2cdd-4c66-bbb5-0da1badfcd83 Faulting package full name: Faulting package-relative application ID:7/20/2017 6:56 PM Application Error Faulting application name: consent.exe, version: 10.0.15063.0, time stamp: 0xe0f856c4 Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000 Exception code: 0xc0000409 Fault offset: 0x0000000000000000 Faulting process id: 0x26c0 Faulting application start time: 0x01d30189ed208d99 Faulting application path: c:\windows\system32\consent.exe Faulting module path: unknown Report Id: 2d15eed0-d1d7-4315-8536-7ddd26035fb8 Faulting package full name: Faulting package-relative application ID:7/20/2017 6:39 PM Application Error Faulting application name: consent.exe, version: 10.0.15063.0, time stamp: 0xe0f856c4 Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000 Exception code: 0xc0000409 Fault offset: 0x0000000000000000 Faulting process id: 0x2460 Faulting application start time: 0x01d301878737df48 Faulting application path: c:\windows\system32\consent.exe Faulting module path: unknown Report Id: 36251b35-303f-478b-b9e1-1e844fc0365c Faulting package full name: Faulting package-relative application ID:7/20/2017 6:56 PM Application Error Faulting application name: consent.exe, version: 10.0.15063.0, time stamp: 0xe0f856c4 Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000 Exception code: 0xc0000409 Fault offset: 0x0000000000000000 Faulting process id: 0x20a0 Faulting application start time: 0x01d30189ea4c938e Faulting application path: c:\windows\system32\consent.exe Faulting module path: unknown Report Id: 2c36a55b-b853-4524-9ec1-d142446a187c Faulting package full name: Faulting package-relative application ID:7/20/2017 6:26 PM Application Error Faulting application name: consent.exe, version: 10.0.15063.0, time stamp: 0xe0f856c4 Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000 Exception code: 0xc0000409 Fault offset: 0x0000000000000000 Faulting process id: 0x1b50 Faulting application start time: 0x01d30185a4aeca5e Faulting application path: c:\windows\system32\consent.exe Faulting module path: unknown Report Id: 984ad72a-283c-49a9-b8b3-bd9be23023ec Faulting package full name: Faulting package-relative application ID:7/20/2017 6:39 PM Application Error Faulting application name: consent.exe, version: 10.0.15063.0, time stamp: 0xe0f856c4 Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000 Exception code: 0xc0000409 Fault offset: 0x0000000000000000 Faulting process id: 0x16e8 Faulting application start time: 0x01d301877c690ab6 Faulting application path: c:\windows\system32\consent.exe Faulting module path: unknown Report Id: 66e1a533-770d-4893-92b3-39ebbae61235 Faulting package full name: Faulting package-relative application ID:7/20/2017 6:27 PM Application Error Faulting application name: consent.exe, version: 10.0.15063.0, time stamp: 0xe0f856c4 Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000 Exception code: 0xc0000409 Fault offset: 0x0000000000000000 Faulting process id: 0x16e4 Faulting application start time: 0x01d30185c8280834 Faulting application path: c:\windows\system32\consent.exe Faulting module path: unknown Report Id: f5221e68-d3aa-460a-9c2b-9a9a1290ae22 Faulting package full name: Faulting package-relative application ID:7/20/2017 6:55 PM Application Error Faulting application name: consent.exe, version: 10.0.15063.0, time stamp: 0xe0f856c4 Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000 Exception code: 0xc0000409 Fault offset: 0x0000000000000000 Faulting process id: 0x16e0 Faulting application start time: 0x01d30189d178c7b1 Faulting application path: c:\windows\system32\consent.exe Faulting module path: unknown Report Id: 456dc254-2cf8-4f5b-940b-2320f96b7cb9 Faulting package full name: Faulting package-relative application ID:7/20/2017 6:50 PM Application Error Faulting application name: consent.exe, version: 10.0.15063.0, time stamp: 0xe0f856c4 Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000 Exception code: 0xc0000409 Fault offset: 0x0000000000000000 Faulting process id: 0x13c4 Faulting application start time: 0x01d3018914896a4a Faulting application path: c:\windows\system32\consent.exe Faulting module path: unknown Report Id: 8c62fa98-894c-430c-aa06-7395e6fc6382 Faulting package full name: Faulting package-relative application ID:[/quote]
Code: Miniport Plugable Ethernet, {90326E5C-5E1D-46C7-ACEE-B305F2771699}, had event Fatal error: The miniport has failed a power transition to operational power[/quote] Code: The mrxsmb service depends on the rdbss service which failed to start because of the following error: A device attached to the system is not functioning.[/quote] Code: The driver \Driver\Qcamain10x64 failed to load for the device PCI\VEN_168C&DEV_003E&SUBSYS_15251A56&REV_20\4&1724731d&0&00E4.[/quote] Code: The processing of Group Policy failed. Windows attempted to read the file \\oene.com\sysvol\oene.com\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following: a) Name Resolution/Network Connectivity to the current domain controller. b) File Replication Service Latency (a file created on another domain controller has not replicated to the current domain controller). c) The Distributed File System (DFS) client has been disabled.[/quote] Code: The Symantec Endpoint Protection service failed to start due to the following error: The system cannot find the file specified.[/quote] Code: The device Plugable UD-3900 (location 0000.0014.0000.020.001.000.000.000.000) is offline due to a user-mode driver crash. Windows will attempt to restart the device 5 more times. Please contact the device manufacturer for more information about this problem.[/quote] Code: The machine USK1508000361 attempted to join the domain oene.com but failed. The error code was 1326.[/quote]