Endpoint Protection

Hi,

Unmanaged SEP 11 RU5 with internet access.  Log file to follow.  Any ideas please?  Tried removing LU and also upgrading to 3.5 ran SEP client repair, but still receiving this error.  Any help please?

The following Symantec products and components are installed on your computer.

> Antivirus and antispyware definitions

> Intrusion Prevention signatures

> LiveUpdate

> Submission Control signatures

> Symantec Endpoint Protection client

> Symantec Security Software

> Symantec Security Software Update

Initializing...

Connecting to liveupdate.symantecliveupdate.com...

Connecting to liveupdate.symantec.com...

Connecting to update.symantec.com...

The following updates have been found:

> Antivirus and antispyware definitions, 84371.9 KB Submission Control

> signatures, 3.1 KB

Total Download 84375.0 KB

The following updates have been aborted:

> LiveUpdate has 2 aborted update(s).

Reason:

LU1847: LiveUpdate could not determine if there is an update for this product because the update list for this product is corrupted.

LiveUpdate could not determine if there is an update for this product because the update list for this product is corrupted.

> Symantec Security Software has 1 aborted update(s).

Reason:

LU1847: LiveUpdate could not determine if there is an update for this product because the update list for this product is corrupted.

> Symantec Security Software Update has 1 aborted update(s).

Reason:

LU1847: LiveUpdate could not determine if there is an update for this product because the update list for this product is corrupted.

> Symantec Endpoint Protection client has 1 aborted update(s).

Reason:

LU1847: LiveUpdate could not determine if there is an update for this product because the update list for this product is corrupted.

Downloading Antivirus and antispyware definitions (1 of 2), complete.

Downloading Antivirus and antispyware definitions (2 of 2), complete.

Error: "LU1847: LiveUpdate could not determine if there is an update for this product because the update list for this product list is corrupted"

Error: "LU1847: LiveUpdate could not determine if there is an update for this product because the update list for this product list is corrupted"

Yes tried this.  Client was only 1 hr ahead, I  Ran LU again and same problem.  I also ran Rx4sep to make sure no corruption on SEP client.  Any other ideas please.

Do you deleted the contents of "...\All Users\ApplicationData\Symantec\LiveUpdate folder before installing back the liveupdate?

Set up the LiveUpdate service to run under the Administrator account

1. Yes all data was deleted in the LU folder.

2. Liveupdate server is running under the administrator account.

There must be another issue, anything else?

Remove SEP from add/remove programs.

Delete following folders if present

C:\Program Files\Symantec

C:\Program Files\Common Files\Symantec Shared

C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Symantec Endpoint Protection
C:\ProgramData\Symantec

C:\Program Files\Symantec antivirus

"...\All Users\ApplicationData\Symantec

Delete following registry keys

HKEY_CURRENT_USER\Software\Symantec

HKEY_LOCAL_MACHINE\SOFTWARE\Symantec

 

 

Reboot the PC install back SEP and try..

I will try this tomorrow.  Just one question, i have a internal LU server, would this be worth pointing the unmanaged client to retrieve the updates?

Check if your network firewall is blocking the liveupdate
http://service1.symantec.com/SUPPORT/sharedtech.nsf/docid/2003090514252213

You can point your unmanaged clients to update from your LUA. For this da as follows
Export the client settings host file, Settings.Hosts.LiveUpdate, used by Windows LiveUpdate clients to download updates from the Distribution Center, or export a liveupdt.hst file, used by Java LiveUpdate clients.
To generate a host file, on the Configure tab, click Client Settings, and then select the Distribution Center that you want your LiveUpdate clients to use.
Click Export Window Settings to export the Settings.Host.LiveUpdate file, or click Export Java Settings to create the Java LiveUpdate client file.
Then copy the file to the "\Program Files\Symantec\LiveUpdate" directory on the LiveUpdate client computers. When the LiveUpdate client runs, it will use the host file for information on where to download updates.


Ref:Installing and configuring LiveUpdate Administrator 2.x

LU log as promised.

17/03/2010, 08:16:25 GMT -> LuComServer version: 3.3.0.92
17/03/2010, 08:16:25 GMT -> LiveUpdate Language: English
17/03/2010, 08:16:25 GMT -> LuComServer Sequence Number: 20090713
17/03/2010, 08:16:25 GMT -> OS: Windows XP Professional, Service Pack: 3, Major: 5, Minor: 1, Build: 2600 (32-bit)
17/03/2010, 08:16:25 GMT -> System Language:[0x0809], User Language:[0x0409]
17/03/2010, 08:16:25 GMT -> IE 7 Support
17/03/2010, 08:16:25 GMT -> ComCtl32 version: 6.0
17/03/2010, 08:16:25 GMT -> IP Addresses: 138.129.0.1
17/03/2010, 08:16:25 GMT -> Loading C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Product.Inventory.LiveUpdate
17/03/2010, 08:16:25 GMT -> Opened the product inventory at "C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Product.Inventory.LiveUpdate".
17/03/2010, 08:16:25 GMT -> Combined Product Inventory Flags 0, Permanent Flags 0, Permanent Flags Filter 0
17/03/2010, 08:16:25 GMT -> LiveUpdate flag value for this run is 0
17/03/2010, 08:16:25 GMT -> ProductRegCom/luGroup(PID=3420/TID=2264): Successfully created an instance of an luGroup object!
17/03/2010, 08:16:25 GMT -> ProductRegCom/luGroup(PID=3420/TID=2264): Path for calling process executable is C:\Program Files\Symantec\LiveUpdate\luall.exe.
17/03/2010, 08:16:25 GMT -> ProductRegCom/luGroup(PID=3420/TID=2264): Destroyed luGroup object.
17/03/2010, 08:16:25 GMT -> Scanning the following file for potentially malicious host entries: C:\WINDOWS\system32\Drivers\etc\hosts
17/03/2010, 08:16:25 GMT -> Scanning the following file for potentially malicious host entries: C:\WINDOWS\system32\Drivers\etc\lmhosts.sam
17/03/2010, 08:16:25 GMT -> LiveUpdate did not find any malicious host entries in any hosts files.
17/03/2010, 08:16:25 GMT -> **** Starting an Express Mode LiveUpdate Session ****
17/03/2010, 08:16:25 GMT -> User Type: Administrator.
17/03/2010, 08:16:26 GMT -> ***********************        Start of New LU Session        ***********************
17/03/2010, 08:16:26 GMT -> EVENT - SESSION START EVENT - The LiveUpdate session is running in Express Mode.
17/03/2010, 08:16:26 GMT -> Check for updates to:  Product: LiveUpdate, Version: 3.3.0.92, Language: English.  Mini-TRI file name: liveupdate_3.3.0.92_english_livetri.zip
17/03/2010, 08:16:26 GMT -> LiveUpdate is about to launch a new callback proxy process for product SESC Virus Definitions Win32 v11 with moniker {C60DC234-65F9-4674-94AE-62158EFCA433}.
17/03/2010, 08:16:26 GMT -> Starting Callback Proxy Worker thread.
17/03/2010, 08:16:26 GMT -> The callback proxy for moniker {C60DC234-65F9-4674-94AE-62158EFCA433} was successfully registered with LiveUpdate.
17/03/2010, 08:16:26 GMT -> LiveUpdate successfully launched a new callback proxy process for product SESC Virus Definitions Win32 v11.
17/03/2010, 08:16:26 GMT -> LiveUpdate is about to execute a PreSession callback for product SESC Virus Definitions Win32 v11.
17/03/2010, 08:16:27 GMT -> ProductRegCom/luProductReg(PID=2968/TID=2880): Successfully created an instance of an luProductReg object!
17/03/2010, 08:16:27 GMT -> ProductRegCom/luProductReg(PID=2968/TID=2880): Path for calling process executable is C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe.
17/03/2010, 08:16:28 GMT -> ProductRegCom/luProductReg(PID=2968/TID=2880): Setting property for Moniker = {B36CDA3C-B15B-421c-A2A4-7EC70E3B852B}, PropertyName = SEQ.HUBDEFS, Value = 100216039
17/03/2010, 08:16:28 GMT -> ProductRegCom/luProductReg(PID=2968/TID=2880): Setting property for Moniker = {B36CDA3C-B15B-421c-A2A4-7EC70E3B852B}, PropertyName = SEQ.CURDEFS, Value = 100314003
17/03/2010, 08:16:28 GMT -> ProductRegCom/luProductReg(PID=2968/TID=2880): Setting property for Moniker = {C60DC234-65F9-4674-94AE-62158EFCA433}, PropertyName = SEQ.CURDEFS, Value = 100314003
17/03/2010, 08:16:28 GMT -> ProductRegCom/luProductReg(PID=2968/TID=2880): Destroyed luProductReg object.
17/03/2010, 08:16:28 GMT -> ProductRegCom/luProductReg(PID=2968/TID=2880): Successfully created an instance of an luProductReg object!
17/03/2010, 08:16:28 GMT -> ProductRegCom/luProductReg(PID=2968/TID=2880): Path for calling process executable is C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe.
17/03/2010, 08:16:28 GMT -> ProductRegCom/luProductReg(PID=2968/TID=2880): Setting property for Moniker = {B36CDA3C-B15B-421c-A2A4-7EC70E3B852B}, PropertyName = VERSION, Value = MicroDefsB.Feb
17/03/2010, 08:16:29 GMT -> ProductRegCom/luProductReg(PID=2968/TID=2880): Setting property for Moniker = {B36CDA3C-B15B-421c-A2A4-7EC70E3B852B}, PropertyName = SEQ.HUBDEFS, Value = 100216039
17/03/2010, 08:16:29 GMT -> ProductRegCom/luProductReg(PID=2968/TID=2880): Setting property for Moniker = {B36CDA3C-B15B-421c-A2A4-7EC70E3B852B}, PropertyName = SEQ.CURDEFS, Value = 100314003
17/03/2010, 08:16:29 GMT -> ProductRegCom/luProductReg(PID=2968/TID=2880): Destroyed luProductReg object.
17/03/2010, 08:16:29 GMT -> The callback proxy finished executing the callback with a result code of 0x0
17/03/2010, 08:16:29 GMT -> The PreSession callback for product SESC Virus Definitions Win32 v11 completed with a result of 0x0      
17/03/2010, 08:16:29 GMT -> LiveUpdate is about to launch a new callback proxy process for product SESC IPS Signatures Win32 with moniker {D3769926-05B7-4ad1-9DCF-23051EEE78E3}.
17/03/2010, 08:16:29 GMT -> The callback proxy for moniker {D3769926-05B7-4ad1-9DCF-23051EEE78E3} was successfully registered with LiveUpdate.
17/03/2010, 08:16:29 GMT -> LiveUpdate successfully launched a new callback proxy process for product SESC IPS Signatures Win32.
17/03/2010, 08:16:29 GMT -> LiveUpdate is about to execute a PreSession callback for product SESC IPS Signatures Win32.
17/03/2010, 08:16:30 GMT -> ProductRegCom/luProductReg(PID=2504/TID=3188): Successfully created an instance of an luProductReg object!
17/03/2010, 08:16:30 GMT -> ProductRegCom/luProductReg(PID=2504/TID=3188): Path for calling process executable is C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe.
17/03/2010, 08:16:30 GMT -> ProductRegCom/luProductReg(PID=2504/TID=3188): Setting property for Moniker = {D3769926-05B7-4ad1-9DCF-23051EEE78E3}, PropertyName = SEQ.UPDATE, Value = 100313002
17/03/2010, 08:16:30 GMT -> ProductRegCom/luProductReg(PID=2504/TID=3188): Destroyed luProductReg object.
17/03/2010, 08:16:30 GMT -> The callback proxy finished executing the callback with a result code of 0x0
17/03/2010, 08:16:30 GMT -> The PreSession callback for product SESC IPS Signatures Win32 completed with a result of 0x0      
17/03/2010, 08:16:30 GMT -> LiveUpdate is about to launch a new callback proxy process for product Symantec Security Content B1 with moniker {E5A3EBEE-D580-421e-86DF-54C0B3739522}.
17/03/2010, 08:16:30 GMT -> The callback proxy for moniker {E5A3EBEE-D580-421e-86DF-54C0B3739522} was successfully registered with LiveUpdate.
17/03/2010, 08:16:30 GMT -> LiveUpdate successfully launched a new callback proxy process for product Symantec Security Content B1.
17/03/2010, 08:16:30 GMT -> LiveUpdate is about to execute a PreSession callback for product Symantec Security Content B1.
17/03/2010, 08:16:30 GMT -> ProductRegCom/luProductReg(PID=2944/TID=3660): Successfully created an instance of an luProductReg object!
17/03/2010, 08:16:30 GMT -> ProductRegCom/luProductReg(PID=2944/TID=3660): Path for calling process executable is C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe.
17/03/2010, 08:16:30 GMT -> ProductRegCom/luProductReg(PID=2944/TID=3660): Setting property for Moniker = {E5A3EBEE-D580-421e-86DF-54C0B3739522}, PropertyName = SEQ.CURDEFS, Value = 100312019
17/03/2010, 08:16:30 GMT -> ProductRegCom/luProductReg(PID=2944/TID=3660): Destroyed luProductReg object.
17/03/2010, 08:16:30 GMT -> The callback proxy finished executing the callback with a result code of 0x0
17/03/2010, 08:16:30 GMT -> The PreSession callback for product Symantec Security Content B1 completed with a result of 0x0      
17/03/2010, 08:16:30 GMT -> Successfully released callback {6FDEE0F0-ECD7-423C-BD1C-525ECBAC7E1B}
17/03/2010, 08:16:30 GMT -> LiveUpdate has called the last callback for product Symantec Security Content B1, so LiveUpdate is informing the callback proxy that it can exit.
17/03/2010, 08:16:30 GMT -> LiveUpdate is about to launch a new callback proxy process for product Symantec Security Content A1 with moniker {812CD25E-1049-4086-9DDD-A4FAE649FBDF}.
17/03/2010, 08:16:30 GMT -> The callback proxy executable for product {E5A3EBEE-D580-421e-86DF-54C0B3739522} is exiting with no errors
17/03/2010, 08:16:30 GMT -> The callback proxy for moniker {812CD25E-1049-4086-9DDD-A4FAE649FBDF} was successfully registered with LiveUpdate.
17/03/2010, 08:16:30 GMT -> LiveUpdate successfully launched a new callback proxy process for product Symantec Security Content A1.
17/03/2010, 08:16:30 GMT -> LiveUpdate is about to execute a PreSession callback for product Symantec Security Content A1.
17/03/2010, 08:16:30 GMT -> ProductRegCom/luProductReg(PID=3216/TID=3672): Successfully created an instance of an luProductReg object!
17/03/2010, 08:16:30 GMT -> ProductRegCom/luProductReg(PID=3216/TID=3672): Path for calling process executable is C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe.
17/03/2010, 08:16:30 GMT -> ProductRegCom/luProductReg(PID=3216/TID=3672): Setting property for Moniker = {812CD25E-1049-4086-9DDD-A4FAE649FBDF}, PropertyName = SEQ.CURDEFS, Value = 100312019
17/03/2010, 08:16:30 GMT -> ProductRegCom/luProductReg(PID=3216/TID=3672): Destroyed luProductReg object.
17/03/2010, 08:16:30 GMT -> The callback proxy finished executing the callback with a result code of 0x0
17/03/2010, 08:16:30 GMT -> The PreSession callback for product Symantec Security Content A1 completed with a result of 0x0      
17/03/2010, 08:16:30 GMT -> Successfully released callback {6FDEE0F0-ECD7-423C-BD1C-525ECBAC7E1B}
17/03/2010, 08:16:30 GMT -> LiveUpdate has called the last callback for product Symantec Security Content A1, so LiveUpdate is informing the callback proxy that it can exit.
17/03/2010, 08:16:30 GMT -> Progress Update: TRYING_HOST: HostName: "liveupdate.symantecliveupdate.com" URL: "http://liveupdate.symantecliveupdate.com" HostNumber: 0
17/03/2010, 08:16:30 GMT -> Progress Update: TRIFILE_DOWNLOAD_START: Number of TRI files: 0 Downloading LiveUpdate catalog file
17/03/2010, 08:16:30 GMT -> LiveUpdate will download the first Mini-TRI file, liveupdate_3.3.0.92_english_livetri.zip
17/03/2010, 08:16:30 GMT -> Progress Update: DOWNLOAD_BATCH_START: Files to download: 1, Estimated total size: 0
17/03/2010, 08:16:30 GMT -> Progress Update: PRE_CONNECT: Proxy: "(not-available)" Agent: "Symantec LiveUpdate" AccessType: 0x0      
17/03/2010, 08:16:31 GMT -> The callback proxy executable for product {812CD25E-1049-4086-9DDD-A4FAE649FBDF} is exiting with no errors
17/03/2010, 08:16:31 GMT -> Progress Update: PROMPT_RAS_DIALUP:possibly prompting the RAS dialogue...
17/03/2010, 08:16:31 GMT -> Progress Update: CONNECTED: Proxy: "(not-available)" Agent: "vH8sA29pdRLAfQVFwTkoJ3jJTPk2Y+gSwAAAAA" AccessType: 0x0      
17/03/2010, 08:16:31 GMT -> Progress Update: DOWNLOAD_FILE_START: URL: "http://liveupdate.symantecliveupdate.com/liveupdate_3.3.0.92_english_livetri.zip", Estimated Size: 0, Destination Folder: "C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads"
17/03/2010, 08:16:31 GMT -> CSendHTTPRequest::SendRequest - Unable to resolve the name of the server.
17/03/2010, 08:16:31 GMT -> Progress Update: DOWNLOAD_FILE_FINISH: - NOTE - URL: "http://liveupdate.symantecliveupdate.com/liveupdate_3.3.0.92_english_livetri.zip", Full Download Path: "C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\liveupdate_3.3.0.92_english_livetri.zip" HR: 0x802A0045
17/03/2010, 08:16:31 GMT -> HR 0x802A0045 DECODE: E_UNABLE_TO_REACH_SERVER
17/03/2010, 08:16:31 GMT -> Progress Update: DOWNLOAD_BATCH_FINISH: HR: 0x802A0045, Num Successful: 0
17/03/2010, 08:16:31 GMT -> HR 0x802A0045 DECODE: E_UNABLE_TO_REACH_SERVER
17/03/2010, 08:16:31 GMT -> EVENT - SERVER SELECTION FAILED EVENT - LiveUpdate failed to connect to server liveupdate.symantecliveupdate.com at path  via a HTTP connection. The server connection attempt failed with a return code of 1814, LiveUpdate could not retrieve the catalog file of available Symantec product and component updates.
17/03/2010, 08:16:31 GMT -> Progress Update: TRYING_HOST: HostName: "liveupdate.symantec.com" URL: "http://liveupdate.symantec.com" HostNumber: 1
17/03/2010, 08:16:31 GMT -> Progress Update: DISCONNECT
17/03/2010, 08:16:31 GMT -> Progress Update: TRIFILE_DOWNLOAD_START: Number of TRI files: 0 Downloading LiveUpdate catalog file
17/03/2010, 08:16:31 GMT -> LiveUpdate will download the first Mini-TRI file, liveupdate_3.3.0.92_english_livetri.zip
17/03/2010, 08:16:31 GMT -> Progress Update: DOWNLOAD_BATCH_START: Files to download: 1, Estimated total size: 0
17/03/2010, 08:16:31 GMT -> Progress Update: PRE_CONNECT: Proxy: "(not-available)" Agent: "vH8sA29pdRLAfQVFwTkoJ3jJTPk2Y+gSwAAAAA" AccessType: 0x0      
17/03/2010, 08:16:31 GMT -> Progress Update: CONNECTED: Proxy: "(not-available)" Agent: "vH8sA29pdRLAfQVFwTkoJ3jJTPk2Y+gSwAAAAA" AccessType: 0x0      
17/03/2010, 08:16:31 GMT -> Progress Update: DOWNLOAD_FILE_START: URL: "http://liveupdate.symantec.com/liveupdate_3.3.0.92_english_livetri.zip", Estimated Size: 0, Destination Folder: "C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads"
17/03/2010, 08:16:31 GMT -> CSendHTTPRequest::SendRequest - Unable to resolve the name of the server.
17/03/2010, 08:16:31 GMT -> Progress Update: DOWNLOAD_FILE_FINISH: - NOTE - URL: "http://liveupdate.symantec.com/liveupdate_3.3.0.92_english_livetri.zip", Full Download Path: "C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\liveupdate_3.3.0.92_english_livetri.zip" HR: 0x802A0045
17/03/2010, 08:16:31 GMT -> HR 0x802A0045 DECODE: E_UNABLE_TO_REACH_SERVER
17/03/2010, 08:16:31 GMT -> Progress Update: DOWNLOAD_BATCH_FINISH: HR: 0x802A0045, Num Successful: 0
17/03/2010, 08:16:31 GMT -> HR 0x802A0045 DECODE: E_UNABLE_TO_REACH_SERVER
17/03/2010, 08:16:31 GMT -> EVENT - SERVER SELECTION FAILED EVENT - LiveUpdate failed to connect to server liveupdate.symantec.com at path  via a HTTP connection. The server connection attempt failed with a return code of 1814, LiveUpdate could not retrieve the catalog file of available Symantec product and component updates.
17/03/2010, 08:16:31 GMT -> Progress Update: TRYING_HOST: HostName: "update.symantec.com" URL: "ftp://update.symantec.com/opt/content/onramp" HostNumber: 2
17/03/2010, 08:16:31 GMT -> Progress Update: DISCONNECT
17/03/2010, 08:16:31 GMT -> Progress Update: TRIFILE_DOWNLOAD_START: Number of TRI files: 0 Downloading LiveUpdate catalog file
17/03/2010, 08:16:31 GMT -> LiveUpdate will download the first Mini-TRI file, liveupdate_3.3.0.92_english_livetri.zip
17/03/2010, 08:16:31 GMT -> Progress Update: DOWNLOAD_BATCH_START: Files to download: 1, Estimated total size: 0
17/03/2010, 08:16:31 GMT -> Progress Update: PRE_CONNECT: Proxy: "(not-available)" Agent: "vH8sA29pdRLAfQVFwTkoJ3jJTPk2Y+gSwAAAAA" AccessType: 0x0      
17/03/2010, 08:16:31 GMT -> Progress Update: CONNECTED: Proxy: "(not-available)" Agent: "vH8sA29pdRLAfQVFwTkoJ3jJTPk2Y+gSwAAAAA" AccessType: 0x0      
17/03/2010, 08:16:31 GMT -> Progress Update: DOWNLOAD_FILE_START: URL: "ftp://update.symantec.com/opt/content/onramp/liveupdate_3.3.0.92_english_livetri.zip", Estimated Size: 0, Destination Folder: "C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads"
17/03/2010, 08:16:31 GMT -> CstInetGetFile::DoTransfer - Unable to resolve the name of the server.
17/03/2010, 08:16:31 GMT -> Progress Update: DOWNLOAD_FILE_FINISH: - NOTE - URL: "ftp://update.symantec.com/opt/content/onramp/liveupdate_3.3.0.92_english_livetri.zip", Full Download Path: "(null)" HR: 0x802A0045
17/03/2010, 08:16:31 GMT -> HR 0x802A0045 DECODE: E_UNABLE_TO_REACH_SERVER
17/03/2010, 08:16:31 GMT -> Progress Update: DOWNLOAD_BATCH_FINISH: HR: 0x802A0045, Num Successful: 0
17/03/2010, 08:16:31 GMT -> HR 0x802A0045 DECODE: E_UNABLE_TO_REACH_SERVER
17/03/2010, 08:16:31 GMT -> EVENT - SERVER SELECTION FAILED EVENT - LiveUpdate failed to connect to server update.symantec.com at path /opt/content/onramp via a FTP connection. The server connection attempt failed with a return code of 1814, LiveUpdate could not retrieve the catalog file of available Symantec product and component updates.
17/03/2010, 08:16:31 GMT -> Progress Update: HOST_SELECTION_ERROR: Error: 0x802A0027
17/03/2010, 08:16:31 GMT -> LiveUpdate did not find any new updates for the given products.
17/03/2010, 08:16:31 GMT -> EVENT - SESSION END FAILED EVENT - The LiveUpdate session ran in Express Mode. LiveUpdate found 0 updates available, of which 0 were installed and 0 failed to install.  The LiveUpdate session exited with a return code of 1814, LiveUpdate could not retrieve the catalog file of available Symantec product and component updates.
17/03/2010, 08:16:34 GMT -> LiveUpdate is about to execute a PostSession callback for product SESC Virus Definitions Win32 v11.
17/03/2010, 08:16:36 GMT -> ProductRegCom/luProductReg(PID=2968/TID=2880): Successfully created an instance of an luProductReg object!
17/03/2010, 08:16:36 GMT -> ProductRegCom/luProductReg(PID=2968/TID=2880): Path for calling process executable is C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe.
17/03/2010, 08:16:36 GMT -> ProductRegCom/luProductReg(PID=2968/TID=2880): Destroyed luProductReg object.
17/03/2010, 08:16:36 GMT -> The callback proxy finished executing the callback with a result code of 0x0
17/03/2010, 08:16:36 GMT -> The PostSession callback for product SESC Virus Definitions Win32 v11 completed with a result of 0x0      
17/03/2010, 08:16:36 GMT -> Successfully released callback {855BA5F4-6588-4F09-AE61-847E59D08CB0}
17/03/2010, 08:16:36 GMT -> LiveUpdate has called the last callback for product SESC Virus Definitions Win32 v11, so LiveUpdate is informing the callback proxy that it can exit.
17/03/2010, 08:16:36 GMT -> LiveUpdate is about to execute a PostSession callback for product SESC IPS Signatures Win32.
17/03/2010, 08:16:36 GMT -> The callback proxy executable for product {C60DC234-65F9-4674-94AE-62158EFCA433} is exiting with no errors
17/03/2010, 08:16:36 GMT -> ProductRegCom/luProductReg(PID=2504/TID=3188): Successfully created an instance of an luProductReg object!
17/03/2010, 08:16:36 GMT -> ProductRegCom/luProductReg(PID=2504/TID=3188): Path for calling process executable is C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe.
17/03/2010, 08:16:37 GMT -> ProductRegCom/luProductReg(PID=2504/TID=3188): Destroyed luProductReg object.
17/03/2010, 08:16:37 GMT -> The callback proxy finished executing the callback with a result code of 0x0
17/03/2010, 08:16:37 GMT -> The PostSession callback for product SESC IPS Signatures Win32 completed with a result of 0x0      
17/03/2010, 08:16:37 GMT -> Successfully released callback {855BA5F4-6588-4F09-AE61-847E59D08CB0}
17/03/2010, 08:16:37 GMT -> LiveUpdate has called the last callback for product SESC IPS Signatures Win32, so LiveUpdate is informing the callback proxy that it can exit.
17/03/2010, 08:16:37 GMT -> The callback proxy executable for product {D3769926-05B7-4ad1-9DCF-23051EEE78E3} is exiting with no errors
17/03/2010, 08:16:37 GMT -> ***********************           End of LU Session           ***********************

The default install of LiveUpdate contains 3 different hosts to try, two HTTP and one FTP. The machine in question cannot reach any of the 3 specified servers. I'd recommend looking for a device between this client and the LiveUpdate servers, such as a proxy or firewall, and verify it allows the traffic (make sure it's done by URL not by IP).

I think if you pointed this client to the internal LU server, it would resolve the problem.

<log snippets>
17/03/2010, 08:16:31 GMT -> EVENT - SERVER SELECTION FAILED EVENT - LiveUpdate failed to connect to server liveupdate.symantecliveupdate.com at path  via a HTTP connection. The server connection attempt failed with a return code of 1814, LiveUpdate could not retrieve the catalog file of available Symantec product and component updates.


17/03/2010, 08:16:31 GMT -> EVENT - SERVER SELECTION FAILED EVENT - LiveUpdate failed to connect to server liveupdate.symantec.com at path  via a HTTP connection. The server connection attempt failed with a return code of 1814, LiveUpdate could not retrieve the catalog file of available Symantec product and component updates.



17/03/2010, 08:16:31 GMT -> EVENT - SERVER SELECTION FAILED EVENT - LiveUpdate failed to connect to server update.symantec.com at path /opt/content/onramp via a FTP connection. The server connection attempt failed with a return code of 1814, LiveUpdate could not retrieve the catalog file of available Symantec product and component updates.