Endpoint Protection

Upgraded SEP server to 14 started pushing out the update to clients  Mixed Windows 7 and 10 machines. Daily getting BSOD on a portion of the windows 7 machines. BSOD error with MUP.SYS. We are just starting to try an dfigure this out so will update as i can with more details

Best to get a case open now and submit the dump file for review. What components do you have enabled? Generic Exploit Mitigation? If so, try disabling that temporarily to see what the result is.

Hello,

MUP.SYS is related to Windows Drivers. 

Were there any Windows updates performed recently? Try performing Windows Restore to an earlier date.

I would also suggest you to create a Case with Symantec. 

More specifically, these mup.sys errors can be caused by:

• Incorrectly configured, old, or corrupted Windows device drivers. (very common)
• Corruption in Windows registry from a recent mup.sys-related software change (install or uninstall).
• Virus or malware infection that has corrupted the mup.sys file or related Windows program files.
• Hardware conflict after installing new Microsoft hardware, or hardware related to mup.sys.
• Damaged or removed system files after you’ve installed software or drivers related to Windows.
• mup.sys blue screen caused by a damaged hard disk.
• mup.sys STOP error due to memory (RAM) corruption.

Regards,

I have this problem to! After update to 14 version.

if i downgrade clients SEP to ver 12 work fine!

Do you maybe have EMET installed? And also the new feature from Symantec which does basically the same? (Generic Exploit ...)

Regards

Stephan

I have a case open due to this issue. It has been over a week and due to lack of resolution we are MANUALLY rolling back to version 12.x (which works fine).

We are stuck with a manual roll back since certain areas do not run AD.  This is a HUGE time consuming task.

Have you requested escalation or have a rep that can get it moved past first level support?

Already moved to engineering....

Anyone have a status?

Is this happening on 64bit systems, 32bit systems, or both? How many systems are affected? How soon after installation did you begin experiencing this? I am getting ready to deploy SEP14 and want to do everything I can, including *not* deploying, to ensure I avoid this issue.

Hi All, we are having the same issue. We have a mix of windows 7 32 and 64bit and windows 10 64bit computers and since upgrading to v14 the windows 7 64bit and ONLY them get a BSOD when a certain piece of software is run. We added the folders and exe's to the exclusion policy but no joy. The only fix we have found is to roll back to the previous 12.1 version the same 64bit computer works fine.

I opened a case with Symantec and all they say is its a windows driver issue however they are unable to answer the question as to why exactly the same computer with the same drivers works fine with the previous version. Getting nowhere with them

Yep same here, seeing the BSOD on quite a large number of pc's since upgrading to SEP 14, all the DMP files from these machines show the cause is MUP.sys. Way too many machines doing this since upgrading to be anything other than Symantec.

We have a few machines that are still on a previous version that we have not rolled out to yet and we see no issues whatsover!

My organization is experiencing the same problem. BSOD (mup.sys), reboot loops, and a couple devices hanging on login. Removed SEP 14 and the problem went away. I have turned off the Generic Exploit Mitigation and awaiting test results. We also tried removing the firewall component entirely. Did not fix the problem.

So SEP 14 is not Stable? If BSOD is being trigerred, It would be a RISK to upgrade to SEP 14?

NeelShetty,

I would certainly be reluctant in upgrading as of yet, we are looking into rolling back to a previous version!

I would avoid the upgrade at this point.  There is no benefit but there are potential issues.  Symantec is pointing a finger at Microsoft BUT v12 works fine with no changes.....  so who is at fault? and is someone actually working on a resolution?

True CGS, However the support is recommending Upgrade to SEP 14 ASAP. Whereas BSOD is something cannot be ignored.

Thanks Darren, Support recommended me for SEP 14 Upgrade ASAP however considering the feedback 2017 will be the right time for an RFC and get this rolling

You weigh your own options then - mine is easy - people can work and are productive with v12 and no BSOD.... I manually rolled back 800+ workstations

We are experiencing a similar issue.  Random BSODS on a segment of our WIndows 7 x64 population that has been upgraded to SEP 14.  The bulk of our environment upgraded without issue.  Does someone have a case open with Symantec including their memory dumps?  

We're having a similar issue here, but it seems to be isolated to two particular segments of our network - each of which is on different hardware (Dell Optiplex 7010, and Panasonic Tough Book Model CF-31).  Both are in different departments, so we're having trouble finding a commonality aside from the upgrade to SEP 14.  All workstations are Windows 7 Enterprise x64.  Does someone still have an open case with Symantec that includes the dump files from Windows for analysis by Symantec, and if so, can you provide their feedback?  I will open a case with Symantec as soon as I get my hands on the dump files.

Sorry for the double post!  The first one wasn't there when I cam back and checked, so I reposted.

I'll open a ticket shortly, but I'm attaching the output from Windows Debugger.  I'm not an analyst, but it looks like there's a reference to a memory location that doesn't exist or was changed as part of the upgrade process of SEP - (maybe?).  Hoping someone smarter than me can decipher it.  Anything I google for MUP.SYS BSOD seems to refer to windows XP/2000 from several years back.  My guess is that something buried in Windows during the upgrade process is modified/removed that during the post install processes causes a fault of some sort.  

At least I'm not the only one having an issue

Attachment(s)

Analysis.txt   7 KB 1 version

Just found this article - Symantec is aware of the problem:  https://support.symantec.com/en_US/article.TECH236346.embed.html

SEP 14 MP1 is out:

Symantec™ Endpoint Protection 14 MP1 Release Notes

New fixes and component versions in Endpoint Protection 14 MP1

Can we go ahead and upgrade our servers and workstations from SEP 12.1.6 to 14 now?

Are the issues related to BSOD , reboot loops and machines hanging on welcome screen resolved?

You'll want to make sure you go right to 14 MP1. This version resolved multiple issues in 14 RTM.

I have as customer who is having the same issue on Windows 7 32-bit machines with SEP 14 MP1. Still not fixed and Symantec support is still figuring out why it is happening.

Better stick to 12.1 until they release 14 MP4 or MP5.

thats interesting, we removed 12.5 from some of our win 7 64bit computers and installed with the latest patched v14 and have not had a repeat of the issues with had with the previous v14. we never had any issues with our 32bit computers