WerFault.exe Constant Popup

[IAMCloud_Curt]

 

Windows 10 64bit

 

Hi everyone, has anyone ever seen this and found a fix? Scoured the internet and found nothing. Help would be appreciated, happening on machines that I've imaged onto Win10 over the summer.

 

Win8 laptops/desktops seem to be fine

[abaxter2]

By any chance do you have impero and symantec endpoint installed? If so the issue is with those programs - I have had a support call open with impero and symantec since march 2016, it is down to how sep and impero hock in to a dil, removing either sep or impero will fix the issue - it is a confirmed issue and only affects Windows 10. Impero have released a new version and symantec are testing to so if the issue has been resolved

[IAMCloud_Curt]

By any chance do you have impero and symantec endpoint installed? If so the issue is with those programs - I have had a support call open with impero and symantec since march 2016, it is down to how sep and impero hock in to a dil, removing either sep or impero will fix the issue - it is a confirmed issue and only affects Windows 10. Impero have released a new version and symantec are testing to so if the issue has been resolved

 

I have both installed mate. Shall I call Impero regarding new version?

[kai91]

We also have this issue and is causing us a real pain. The solution that impero have given us is to use the injection exclusion and exclude all the faulting applications which in our opinion isnt good enough.

[abaxter2]

Adding symantec endpoint to the injection exclusion does not solve the issue. the only way round at current is to remove either SEP or impero - I have not upgraded to latest verion of Impero yet because 1: Symantec have not yet fully tested or confirmed if the latest version of Impero has resolved the issue and 2. Because Impero have not confirmed if the updated version fixes the issue - I have a support call open with both Impero and Symantec and they are working together - I will post back once I have had confirmation the issue has been fix but like I have said I have had the support calls open since March 2016.

 

I am hoping that the issue has at long last been fixed but I am waiting for confirmation - I will keep you all updated

Edited September 15, 2016 by abaxter2

[Mic_Impero]

Hi all,

 

I can shed a little light on this one.

Our QA team have been in touch with escalated support at Symantec. We struggled at first as we're not a customer of symantec and so couldn't receive support, so thankfully some of our schools logged a support ticket with Symantec giving us permission to speak on their behalf and shared the ticket numbers with us.

 

Symantec have since investigated and found that they are calling this shared DLL every few seconds, which is what's causing the problem. They should be calling it once, as Impero does. Symantec confirmed to us that they would need to fix the issue with their DLL call and that would resolve the issue with the DLL crash.

 

I really dislike the idea of our customers being passed around in terms of support and no one taking responsibility which is why we've worked closely with Symantec and have been persistent in pushing for a solution. Unfortunately though once Symantec had confirmed the change needed to be made in their code, there was nothing more could be done at our end in terms of dev. It's notable too this issue only occurs with sites on a particular version of Symantec; regardless of the version of Impero (apologies I cannot recall off the top of my head the Symantec version, i'm out of the office at the moment).

 

Hopefully Symantec have released a fix or aren't far away from doing so.

 

Mic

Support Manager

Impero

[abaxter2]

Hi all,

 

I can shed a little light on this one.

Our QA team have been in touch with escalated support at Symantec. We struggled at first as we're not a customer of symantec and so couldn't receive support, so thankfully some of our schools logged a support ticket with Symantec giving us permission to speak on their behalf and shared the ticket numbers with us.

 

Symantec have since investigated and found that they are calling this shared DLL every few seconds, which is what's causing the problem. They should be calling it once, as Impero does. Symantec confirmed to us that they would need to fix the issue with their DLL call and that would resolve the issue with the DLL crash.

 

I really dislike the idea of our customers being passed around in terms of support and no one taking responsibility which is why we've worked closely with Symantec and have been persistent in pushing for a solution. Unfortunately though once Symantec had confirmed the change needed to be made in their code, there was nothing more could be done at our end in terms of dev. It's notable too this issue only occurs with sites on a particular version of Symantec; regardless of the version of Impero (apologies I cannot recall off the top of my head the Symantec version, i'm out of the office at the moment).

 

Hopefully Symantec have released a fix or aren't far away from doing so.

 

Mic

Support Manager

Impero

 

Hi Mic,

 

Sorry but you are not correct in what you are saying! It does not matter what version of symantec you are using as it affects all versions - I have tested each version for Impero and Symantec and I am a customer of both. In fact Impero support wanted to close my case because they said it had been resolved when in fact it has not.

 

It took me ages to get Impero to work with symantec because Impero support was raising the issue with the norton and symantec end point - at current I have symantec working with Impero to fix the root cause and it will require both symantec and impero to fully resolve this issue.

[Mic_Impero]

Hi @abaxter2,

 

I'm taking the information I posted from our QA team and the email trails between our senior QA and the escalated support engineer at Symantec. I'm not suggesting that you're incorrect, but I'm a little concerned that we have such a disparity in what we believe the next steps are; as things stand we risk making no progress.

I'm more than happy for us to work with Symantec to resolve and we'd be happy to agree changes in dev if that's required.

Please could you PM me your school details so that I can ensure QA are indeed working with yourselves and Symantec, and we have some time frames and next actions in place.

 

Thanks

Mic

Support Manager

Impero

[abaxter2]

Hi @Mic_Impero

 

Thank you for your reply and I will PM you.

 

Just so that we are clear and other users can see where I am coming from - I reported this issue back in March when I moved to Windows 10 - symantec had to release a new version that would work with windows 10 (12.1.6 MP4) because without this version SEP would not install on Windows 10 - SEP version 12.1.6 MP4 did indeed fix the install issue but then I started seeing this issue that this thread is regarding so I created a support call with symantec and posted on their forum (https://www.symantec.com/connect/forums/werfaultexe-error-windows-10-after-installing-endpoint-protection) as I belived at this point the issue was with symantec - I also later posted again - https://www.symantec.com/connect/forums/windows-10-sep-1216-mp4

 

After a number of changes / trying to find the root cause I did a fresh build of windows 10 and installed each program I required one at a time and to my surprise I found that symantec would run with no problems will all programs installed apart from Impero - as soon as Impero was installed the issue started and if I removed either Impero or Symantec the issue would stop, I then created a support call with Impero and got my support case with symantec moved to the UK and linked symantec and Impero up to work on the case - this is still ongoing.

 

As you said "I really dislike the idea of our customers being passed around in terms of support and no one taking responsibility" it will require both Symantec and Impero to resolve this issue because even if Symantec release yet another version surely Impero should also test to make sure that us the customer get a true fix.

Edited September 15, 2016 by abaxter2

[i3ai2t]

Symantec emailed me to say SEP 14.0 has been released and the issue has been fixed in this version. I'll test it later today or tomorrow

[abaxter2]

Thanks for the update i3aist this is news to me as the support call I have open with Symantec have not informed me of this fix and have informed me that they are still working on a fix but if I check the what's fixed with SEP 14.0 I can see the following near the bottom of the page:

 

"Processes crash on exit with SEP and Impero (Education) Pro 5.x installed on Windows 10

 

FIX ID: 3968310

 

Symptom: Multiple processes crash on exit when Application and Device Control runs on Windows 10 when Impero (Education) Pro 5.x is also installed.

 

Solution: Updated Application and Device Control so that it is able to work with Impero software installed on Windows 10."

 

Listed here: https://support.symantec.com/en_US/article.INFO4000.html

 

More information here: https://www.symantec.com/connect/forums/symantec-endpoint-protection-140-has-been-released

 

EDIT: Also just seen that "Existing SEP 12.1 serial number will not work" and that you will need a new serial number to install SEP 14.0 (no charge if in contract)

Edited November 7, 2016 by abaxter2