INVALID_WORK_QUEUE_ITEM blue screens with error 0x00000096 - Symantec End Point

[Migration User]

I have a problem since I migrated to Symantec End Point protection.
I'm looking after around 200 pc's from the past 3 years. There were no problems at all with those computers untill we migrated to SEP.
Since we migrated they perioadicaly get blue screen of death with the error INVALID_WORK_QUEUE_ITEM blue screens with error 0x00000096

I thought it was something to do with a OS or hardware rather than Symantec, but I did mem test, rebuild pc's installed fresh os, but it did make no difference.
I did a research on-line and fount this :

http://www.techspot.com/vb/topic126289.html#post856302

I must agree with user : unknownians , We have exact the same issue as many other people that joined the discussion, interestingly enough there is no post on Symatnec forum about it.

I'm thinking what could be a solution to that ?  I did an update of entire Windows System, memory banks are free of errors, but systems kept blue screening.

Crash Analysis Tool shows NavEx15.sys is a problem for all my comptuers as well... is symantec aware of an issue ? is there a fix for it ? 
 

[Rafeeq]

What is the version of symantec endpoint you are using?

Srtsp.sys causes system instability.

https://www-secure.symantec.com/connect/forums/invalidworkqueueitem-blue-screens-error-0x00000096-symantec-end-point
Do you have network threat protection installed too?

[Migration User]

ver.11.05002.333 ? 

I went to a console, and ABOUT: 

this is what it's showing up.


I have added a screenshot as well in case I'm missing something,

where would I find about MR ver ?

[Rafeeq]

Hi,

 

y0u sepm is of latest version

do you have clients also running on the same version?

check the version on affected machines.

do you have network threat protection installed too? 

[Migration User]

Yes, Network Threat protection is installed as well.

All computers are running the same client from this server. Version variations are not possible in this case.

I attached what we're running in the next screenshot.

[postechgeek]

Are you using application/device control?
I had a similar issue with SysPlant.sys that was causing bluescreens.

[Rafeeq]

thats was one of the question i wanted to ask, postechgeek was quick :)
on the blue screen machines do you have any conflicting softwares installed, any pop of autoprotect ?

[Migration User]

What is software /device control software ? 

These blue screens are on most of the computers, today I got one on my own pc.
There is only one antivirus SEP installed, what do you mean by other protection software ?

[Migration User]

Go to add/remove programs in one of the client pc,Select symantec end point protection,click on change ,it will pop up a window.Click next,select modify,click next here you un select application and device control,click next,click install.Rebot th PC and check any issue is present.

[Rafeeq]

its a component which gets installed along with Network thereat protection..
go to sepm
click on policy'
application and device control
do you see any policies configured , like block application or device?
 

[postechgeek]

You could create a client package that has just the the antivirus/antispyware component and see if you are still getting the bluescreens.

SEPM>Admin>Installed Packages>Export Install Package

Uninstall the client that is installed, and install this new client.
This should be done in a test setup.

Mike

[postechgeek]

You know, I'm not sure if this is related, but I had reports of BSODs yesteday on two workstations with the the INVALID_WORK_QUEUE 0x00000096 error. It wasn't a the NavEx15.sys file, but ntoskrl.exe. Strange. We are not using app/device control for this group. The BSODs were at 6:54PM and 7:00PM. We are currently running RU5.

[Migration User]

Well, I have uninstalled ALL the modules for the computers.
I left only Antivirus. They keep bluescreening. Bluescreens we're getting are on Dell 745 & 755. 

I analyzed the dump file and it points at ntoskrl.exe as well. I got some file from Symantec and analyzed entire computer and on one PC as expected I noticed "Corrupted signature file , following file have not been used : " and LONG LONG list of files.


I believe it's something to do with updates because this simply can not be an issue.
Symantec must address that issue asap.

[postechgeek]

@ Mariuszp,

Just an FYI. ntoskrl.exe is used in file and print sharing on ports 137-138. So, at least on my end I'm thinking it has to do with a computer that has a shared printer. At least that's my thoughts. The errors are always at the same address 21cc5 on all three computers that are having the bluescreen. Strange huh?

Mike

[Migration User]

Hold the phone...  There is a known issue with Dell 745 and 755 machines and SEP.

It has to do with either the sound card or CDROM...

You'll have to update the drivers on the Dell machines to get this resolved, if this is the same issue.  I'll come back with a link for you in a bit.

[Migration User]

https://www-secure.symantec.com/connect/forums/optiplex-755-restarting-enpoint-protection-11  <--While this is talking about reboots, it was also known to BSOD too.

Here is what you can try...

For the affected machines, physically open the computers, and disconnect the CDROM drives, and test for a day or two....

Next, update the sound card drivers for all machines.

[postechgeek]

Thanks teiva!

We are using Dell workstations here as well. OptiPlex 320s. I'll give that a shot.

Mike

[postechgeek]

I checked our 320s and we are using LTN-4891S (Lite-On) CDROM drives, and have an older SoundMax chipset. The sound driver that was posted for the 755 will not install. Pretty interesting non the less.

Mike

[postechgeek]

In the event log, I am seeing that these BSODs are occuring after new virus defs have been loaded. Strange.

Mike

[Migration User]

I'm gotting the same issue in an Dell Optiplex 755.

The helpdesk of my company, sad it is a Symantec version issue.

But, they not sure.

Waiting for an solution ...

Thanks,

Luiz Bonetti

[postechgeek]

Hey Luiz,

I am running OptiPlex 320s here. The 755's might have bad CDROM drives or drivers. Check the thread from the top. Lots of good info that might help.

Mike

[Migration User]

Postechgeek ,
In the event log, I am seeing that these BSODs are occuring after new virus defs have been loaded. Strange


We seem to have the same issues,  I got a Symantec Tool that collects data and produce a report after. I did a data capture for analysis for symantec.

One computer showed just what I read on the very first post ever about 0x0000096 BSOD. According to a gentleman in his post he says  the blue screens occur because of corrupted virus definition files received by end computers.  Report I gathered on one of the blue screening computers showed that the virus definition file IS corrupted and following files have NOT been used: and here a long list of files.

I'm working with a security team of the organization I work for and we removed every possible component of Symantec End Point protection except Antivirus. However after about 5 days period we got blue screens all over the place including machine with only antivirus installed.

We have a policy to start autoscan of entire Hard disk on Friday and every friday we have the most BSODs. there is a corralation for sure.


Security team advised what has been said here, Update all the drivers, and wait.

So I downloaded latest BIOS for these machines, installed Latest Chipset drivers. Some of the computers don't have CD-ROMS at all and still blue screening ? I haven't checked the Soundcard yet, but since we don't need one. I'll try to disable it in BIOS completely.
 

[postechgeek]

@ Mariuszp,

I ended up formatting the boxes that were bluescreening. They haven't had a problem sense. I do use rapid release defintions that I have scripted to download every two hours. Do you use rapid release defs? Maybe that's part of the problem.

Mike

[STF Consulting]

We have Dell OptiPlex 320s that all have relatively the same builds with MR6 installed (No App/Dev) and all drivers have been fully updated via Dell's website but the unit still bluescreens.  SeaTools HD test and MemTest came back passing.

What's interesting is we had 2 machines, both 320s at the same location, that would bluescreen and we performed the same actions/driver updates on the machines.  One of them seems to have stopped bluescreening, the other one persists.

You think maybe a CleanWipe and re-install of SEP is in order?  Attached is a .ZIP with all the dumps that have occured, in case that helps at all.

Thanks!

Attachment(s)

ROVI1 Dumps.zip   110 KB 1 version

[Migration User]

You should open a new thread for this. Since this one is months old it will most likely get ignored. If you feel that it is relevant then feel free to provide a link back to this one. Very good post though and please attach the dumps again on the new post.

Thanks
Grant

[Migration User]

http://www.windowsrecoverys.com, ,I met this problem before!