Hello

We have recently changed a customer over to Webroot. Since moving them to Webroot the machines will blue screen.

We have had to remove the Webroot for now.

All the PCs are the same Acer model with essentially the same software on them.

I would think the issue is a conflict with Webroot and a driver or program that is running.

The Machines are all running Windows 7 32 bit.

 

Is there any list of known compatibility issues with software or hardware?

Are there any logs I can look at in Webroot that might help point me at an issue?

Other suggestions for find the cause of my issue are most appreciated.

Thank you,

 

Kurt

 

Bluescreen analysis.

 

Microsoft (R) Windows Debugger Version 6.3.9600.16384 AMD64

Copyright (c) Microsoft Corporation. All rights reserved.

 

 

Loading Dump File [I: ToteMEMORY.DMP]

Kernel Summary Dump File: Only kernel address space is available

 

 

************* Symbol Path validation summary **************

Response                         Time (ms)     Location

Deferred                                      SRV*your local folder for symbols*http://msdl.microsoft.com/download/symbols

Symbol search path is: SRV*your local folder for symbols*http://msdl.microsoft.com/download/symbols

Executable search path is:

Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x86 compatible

Product: WinNt, suite: TerminalServer SingleUserTS

Built by: 7601.17944.x86fre.win7sp1_gdr.120830-0333

Machine Name:

Kernel base = 0x83c00000 PsLoadedModuleList = 0x83d4a4d0

Debug session time: Mon Nov 24 10:00:29.867 2014 (UTC + 10:00)

System Uptime: 3 days 0:51:26.648

Loading Kernel Symbols

...............................................................

.....................................................Page 2b3e4 not present in the dump file. Type ".hh dbgerr004" for details

...........

.Page 52ad5 not present in the dump file. Type ".hh dbgerr004" for details

..............................

Loading User Symbols

PEB is paged out (Peb.Ldr = 7ffd400c). Type ".hh dbgerr001" for details

Loading unloaded module list

......

*******************************************************************************

*                                                                             *

*                       Bugcheck Analysis                                  *

*                                                                             *

*******************************************************************************

 

Use !analyze -v to get detailed debugging information.

 

BugCheck 8E, {c0000005, 83c9eea8, be3bca98, 0}

 

Page 2b3e4 not present in the dump file. Type ".hh dbgerr004" for details

Probably caused by : memory_corruption ( nt!MiGetNextNode+b )

 

Followup: MachineOwner

---------

 

1: kd> !analyze -v

*******************************************************************************

*                                                                             *

*                       Bugcheck Analysis                                   *

*                                                                            *

*******************************************************************************

 

KERNEL_MODE_EXCEPTION_NOT_HANDLED (8e)

This is a very common bugcheck. Usually the exception address pinpoints

the driver/function that caused the problem. Always note this address

as well as the link date of the driver/image that contains this address.

Some common problems are exception code 0x80000003. This means a hard

coded breakpoint or assertion was hit, but this system was booted

/NODEBUG. This is not supposed to happen as developers should never have

hardcoded breakpoints in retail code, but ...

If this happens, make sure a debugger gets connected, and the

system is booted /DEBUG. This will let us see why this breakpoint is

Arguments:

Arg1: c0000005, The exception code that was not handled

Arg2: 83c9eea8, The address that the exception occurred at

Arg3: be3bca98, Trap Frame

Arg4: 00000000

 

Debugging Details:

------------------

 

Page 2b3e4 not present in the dump file. Type ".hh dbgerr004" for details

 

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

 

FAULTING_IP:

nt!MiGetNextNode+b

83c9eea8 394804         cmp     dword ptr [eax+4],ecx

 

TRAP_FRAME: be3bca98 -- (.trap 0xffffffffbe3bca98)

ErrCode = 00000000

eax=09693740 ebx=88a85bf8 ecx=862f9b08 edx=000004c2 esi=9956b030 edi=c6a9d008

eip=83c9eea8 esp=be3bcb0c ebp=be3bcb44 iopl=0         ov up ei ng nz ac po cy

cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000             efl=00010a93

nt!MiGetNextNode+0xb:

83c9eea8 394804         cmp     dword ptr [eax+4],ecx ds:0023:09693744=????????

Resetting default scope

 

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

 

BUGCHECK_STR: 0x8E

 

PROCESS_NAME: WRSA.exe

 

CURRENT_IRQL: 0

 

ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre

 

LAST_CONTROL_TRANSFER: from 83cb468e to 83cdee98

 

STACK_TEXT:

be3bc604 83cb468e 0000008e c0000005 83c9eea8 nt!KeBugCheckEx+0x1e

be3bca28 83c3e4e6 be3bca44 00000000 be3bca98 nt!KiDispatchException+0x1ac

be3bca90 83c3e49a be3bcb44 83c9eea8 badb0d00 nt!CommonDispatchException+0x4a

be3bcaa4 83d218c0 00000000 8636cbd0 9956b030 nt!Kei386EoiHelper+0x192

be3bcb44 83e6d039 c6a9d008 8636cad0 9956b030 nt!ExAllocatePoolWithTag+0x8b5

be3bcc14 83e5c9c4 00000302 8636cad0 9956b238 nt!EtwTraceProcess+0x82

be3bcc38 83e6a86c 00000001 8636cad0 9a960c39 nt!PspExitProcess+0x37

be3bccb4 83e7e2a1 00000002 88bf19b8 00000001 nt!PspExitThread+0x59a

be3bcccc 83cb0ec0 88bf19b8 be3bccf8 be3bcd04 nt!PsExitSpecialApc+0x22

be3bcd1c 83c3e34b 00000001 00000000 be3bcd34 nt!KiDeliverApc+0x28b

be3bcd1c 768bc35d 00000001 00000000 be3bcd34 nt!Kei386EoiHelper+0x43

WARNING: Frame IP not in any known module. Following frames may be wrong.

0078fd0c 00000000 00000000 00000000 00000000 0x768bc35d

 

 

STACK_COMMAND: kb

 

FOLLOWUP_IP:

nt!MiGetNextNode+b

83c9eea8 394804         cmp     dword ptr [eax+4],ecx

 

SYMBOL_STACK_INDEX: 0

 

SYMBOL_NAME: nt!MiGetNextNode+b

 

FOLLOWUP_NAME: MachineOwner

 

MODULE_NAME: nt

 

DEBUG_FLR_IMAGE_TIMESTAMP: 503f7f43

 

IMAGE_VERSION: 6.1.7601.17944

 

IMAGE_NAME: memory_corruption

 

FAILURE_BUCKET_ID: 0x8E_nt!MiGetNextNode+b

 

BUCKET_ID: 0x8E_nt!MiGetNextNode+b

 

ANALYSIS_SOURCE: KM

 

FAILURE_ID_HASH_STRING: km:0x8e_nt!migetnextnode+b

 

FAILURE_ID_HASH: {295f335a-a2db-8885-5a2a-9357e2659719}

 

Followup: MachineOwner