Endpoint Protection

We have a test environment setup with SEP v12.1 RU1 installed on it. We have attached to this about ten clients all running the v12.1 client. These have a mix of Lotus Notes clients installed but most are v8.5.2 and v8.5.3

We used the SEPM Manager to update four of these machines (3 Windows 7 and 1 XP) to the v12.1 RU1 client.

On all clients Lotus Notes failed to work after the system was rebooted and the following error was generated in Lotus Notes..

[0CC4:0002-0CD0] Thread=[0CC4:0002-0CD0]
Stack base=0x00137A84, Stack size = 6968 bytes
PANIC: semaphore invalid or not allocated

The only way to fix the issue is to remove SEP/Lotus Notes & Java and clear out all remaining disk entries and registry entries (you must do this or Lotus Notes will not even install).

We don't use email scanning on clients btw as this is done using SMSDOM on the Noted mail servers.

Re-Install Lotus Notes then SEP manually and finally Java the issue is then resolved.

I've rased it with support but wondered if anyone else has come across this yet with v12.1 RU1 and Lotus Notes clients???

Upgrading clients today. Will report back on my findings.

Upgraded a few PCs and so far all is good.

Running AV/PTP/NTP/SNAC. Not running the Notes scan plugin.

Thanks for testing this and taking the time to reply with your results!

Currently gathering some data for Symantec will keep this updated with what we find as it may help someone else.

For one of the computers that has Lotus Notes installed, are you able to deploy just a core installer package that has the minimal amount of features? One way to do this is to use the DVD installer to install an unmanaged client using Custom Setup. You can just install core files from here.

It would be nice to see if we can get the client to work with Lotus Notes scaled down with no features first. If you find it works, then you can install the other necessary features, one by one until you get a failure.

You might also try upgrading your Java if you have not done so already. Also, are you using jinitiators in your environment at all?

Thanks for the information!  For info we are using Java v6 u26 we can indeed upgrade them on the test machines and see if that helps.  I can create a deployment using just the basic client setting with email options etc missing from it to see if that helps.

It is NLNHOOK.EXE that generates the panic error in Notes so this should resolve the issue.  However I know moving forward this is not an acceptable solution for us as we may be moving away from SMSDOM and will need to have email scanning on the clients side if we do.

Not aware of us using jinitiators as the machine I am doing the testing on has a base XP build (fully patched), Java, Lotus Notes and nothing else.

Anything in the tamper protection logs? If so, try setting an exclusion.

There is something showing in Tamper Protection!

"","","Blocked","Process","Open","C:\PROGRAM FILES\IBM\LOTUS\NOTES\FRAMEWORK\RCP\ECLIPSE\PLUGINS\COM.IBM.RCP.BASE_6.2.3.20110915-1350\WIN32\X86\NOTES2.EXE (PID 4016)","C:\Program Files\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin\ccSvcHst.exe (PID 2372)","C:\Program Files\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin\ccSvcHst.exe (PID 2372)","23/11/2011 09:41:16"

Will set an exclusion and see if that resolves the issue....

Ok we've set the exclusion for the follwing file/directory..

C:\PROGRAM FILES\IBM\LOTUS\NOTES\FRAMEWORK\RCP\ECLIPSE\PLUGINS\COM.IBM.RCP.BASE_6.2.3.20110915-1350\WIN32\X86\NOTES2.EXE

Hmm.. still not working...

I've even put in an exclusion for the C:\PROGRAM FILES\IBM\LOTUS\NOTES and all sub folders.. still no luck..

How are you configuring the exception?  Manually typing it into the SEPM, or using the logs to add the exception?

Using the logs for the first and adding a exclusion manually for the main directory one.

I've even added an exception for NLNHOOK.EXE  as this crashes as soon as the machine is booted even before you start Lotus Notes...

Hi

here is one solution I can give you to solve this issue. pleae delete .dll extention from following path in notes.ini file from user directry. after deleting .dll only lotus notes will started, IF i m sure you will be getting exe error in command prompt while system rebooting and cause Lotus crashed, Pls try this solution and for details you can write to me at ajay.singh@jalindia.co.in if problem solved or more details. We faced similar problem in entire netoerk , throuth this we solved this issue. Remember in user profile pls go to user profile /local setting/application data/lotus and from here open notes.ini file and delete .dll path.

NSF_HOOKS=NLNVP.DLL

Ajay singh

Jaiprakash Associates Ltd

It works!! Nice one!

Now to get Symantec to create a bug fix for this issue as we're not able to make that change on 47,000 desktops worldwide!!

But is this a Notes or SEP issue? Seems more related to Notes.

Just for info the NLNVP.DLL file is located in the following directories...

C:\Program Files\IBM\Lotus\Notes

C:\Program Files\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin

This file is flagged as a SEP file from checking the properties so this is definately a Symantec issue.

Just had this confirmed by Symantec support...

"Thank you for calling Symantec Technical Support. This is already a defect for the lotus notes plugin for 12.1 and 11.0.7 which is targeted for a resolution in in a later release. I figured that might be what was occurring but I didn't want to have you start ripping stuff out of files before I was able to confirm the issue.

So this is for the notes plugin only? we don't use that so I assume we're fine

Yes it seems it's only the Notes plug in.

I went in and deleted all but the first four lines on the notes.ini file and restarted Notes and rebuilt it.  That seems to be working for me.

HI All,

This is SEP RU7 issue, its confirmed by Symantec Support, when we faced similar issue in entire network, they tested in lotus version with Image of a Desktop of our organization , after testing they confirmed its SEP RU7 product issue, If you are facing similar issue still issue is not fixed by next release, its very unfortunate, I have case id for similar issue, against this Syamtec Support Advance team confirmed that after all testing its product issue, not Louts issue

Ajay Kr, Singh

Jaiprakash Associates Ltd,

Delhi

Hi Stiffing,

this is SEP product issue, its confirmed by Symatec Support Advance Team, Pune India, they also assured that in new release the fix were pathced. there is no any solution that you can run any centralises proces to delete .dll extn from notes.ini in your all desktops. So I believe its mannual process, or you can do , please delete package from you group , so any new clinet wont be update with new package and will prevent from this error, I have tested the system which formatted and intalled SEP problem occurs again in systems, I would be please to have communiction with you for this issue and other SEP related issue for knowledge sharing.

Regards,

Ajay kr, Singh

Japirakash Associates Ltd

ajay.singh@jalindia.co.in

Just to clarify further SEP 11 RU7 came out after v12.1 and the issue was carried forward into sep 12.1 RU1 from v11 RU7 bypassing the first SEP 12.1 release.

Just had an email from Symantec advising this will be fixed in the next major release which will be mid 2012.

Not overlly impressed it's going to take that long but at least it will be fixed.

 

So there won't be a release or two in between?

I'd be surprised if there wasn't a maintenance release between now and then but this fix is penciled in for the next RU release which is med 2012.

Personally I'm surprised this fix is being held back until then as there are a lot of Notes users out there who will not be able to deploy RU1 anytime soon and will be stuck on the vanilla release fo 12.1.

Hi

https://www-secure.symantec.com/connect/articles/troubleshooting-articles-symantec-endpoint-protection-version-121

Regards

Reply from Support Person for Lotus Notes Crash issue when I came accross this today.

"It will be fixed in next release of Sep i.e SEP 12.1 RU1 MP1. But currently we do not know  release date of Sep 12.1 Ru1 Mp1.So you can either uninstall Sep 12.1 Ru1 client and degrade to old version of Sep or wait till next release i.e Sep 12.1 Ru1 Mp1."

This means they are expecting more issues to be fixed from the current RU1 release.