Endpoint Protection

After installing the RU5 (11.0.5002.333), ANY executable i try to run i get this error:

"The application failed to initialize properly. 0xc0000005. Click on OK to terminate the application."

The system goes back when i install the same installer, but with the Application and Device Control module disabled. I need this module since i have some rules blocking some usb devices and some applications.

Any solutions?

tks,

Can you provide some more details? Give us the OS, version and model of hardware. Is this happening on one or many systems?
Are there any special applications running on this system?

Thomas

I found this KB that may apply to your situation.



http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2008022914263148

Cycletech,

All the systems are running Windows XP (SP2 or SP3)... All the systems are Notebooks Dell Latitude D630 / 2Gb Ram / Core 2 Duo.

This is happening on around 90% of the systems and happens to any app.

What do you consider a "special app"?

Unfortunately i cannot apply the KB you sent me, i followed the solution but i still get the error.

 Can you let us know what are the rules you have applied for Application and Device Control...as it looks one of rule is causing the problems.

I meant any proprietary, encryption, or other security software . Can you run the SEP support tool and report back here any errors that may come up.

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2008071709480648

Thanks,
Thomas

Cycletech,

3 curious points:

1. ANY .exe file i need to run i can only run using the "run as..." option. I choose the same user i am logged in and the application works fine.

2. I am running safeboot encription system on all Dell laptops.

3. When i run the Support Tool i get the error saying that the driver SYMREDRV is stopped. This is the only error the tool is shows.

I looked at Event Viewer and there is no error. I looked at device manager and selecting "show devices by connection" and show the hidden devices and still, no exclamation marks for any devices.

Give an email address i can send the full log collected by support tool.

I sent you a PM with fileshare account info. Upload the files there.

Thanks,
Thomas

I would bet that McAfee Endpoint Encryption (formerly SafeBoot Device Encryption) is conflicting with Symantec. I would try disabling McAfee and let us know the results.

Thomas

Thomas,

The file is there.

tks,

Ok, this might be a conflict issue, but this is not happening on all machines, 90% of them, but some are working fine, with no problems.

I will disable safeboot and see what happens.

Thanks,

I am downloading the SEP tool output now.

I too am receiving this error on one Windows 7 Professional x86 RTM system that has SEP RU5 installed. This started occuring after RU5 was applied last night. We only have one Windows 7 system with SEP installed on it so far (thankfully) and I have confirmed this occurs on a Virtual Machine with Windows 7 Ultimate x86 installed as well. I do have application and device rules setup to block running files from removable drives and to block UltraSurf (as per http://www.symantec.com/connect/articles/most-detailed-way-block-ultrasurf) [ bit.ly/1XlA9X and bit.ly/153UDm ] and Vista Business x86 SEP RU5 systems are not exibiting these problems and they have the exact same install/policies being applied.

The only .exe that is exibiting this problem that I can see so far is an ancient telnet program called "PowerTerm" (ptw32.exe) from way back in 2000... I tried creating centralized exceptions for this exe [ bit.ly/3xFPKG ] but that has not helped.

Any ideas?

P.S. These systems have no McAfee software installed, and my test VM system has virtually no software installed except SEP 11.0.5 RU5 so I don't think there would be any conflicts.
P.S.S. Would I be better off creating a separate thread for this in this support forum since the problem is a bit different? And/or should I just call Symantec tech support for quicker/better results? This is the first major problem I've had in 3+ years with SEP, so I'm not sure what the best route for a quick resolution would be.

Does anyone from Symantec has any news about this problem????

I am not seeing anything from the SEP tool that could point to root cause. What was the result of disabling the McAfee Endpoint Encryption?

Thomas

Cycletech, if it would help, I could provide you with temporary remote access to my test Virtual Machine that is exhibiting this issue, whether it be through Remote Desktop, Remote Assistance, or WebEX, etc, so that you can troubleshoot this for all of  us.

Please let me know. Thanks.

The best way to get this resolved quickly will be to open a case with Symantec Support. Let me know the case number once it is created, and I will transfer the SEP tool data to the engineer assigned to the case.

Thanks,
Thomas

Hi,
We get the exact same result after deploying the RU5 (11.0.5002.333).

We've a special CRM application used by 50 clients, I'm not sure what language it is developed in.

Other applications run fine, but this won't work on 80 percent of the clients.

We been trying the following:

Disable DEP for both applications
Disable Simple File Sharing

We've no other conflicting Anti-virus programs running.

I've tried to run the SEP Support tool on a PC  where the application works and on PC where the application doesn't work.

The non-working PC indicates these windows\system32 dlls:
atl71.dll
MFC80ENU.dll
mfc80u.dll
msvcp80.dll
msvr80.dll

The working PC indicates the exact same dlls, including 10 more so this is not the problem.

We've to use the night to uninstall the Symantec AV-clients manually and install the old version, before people comes to work tomorrow (Norway)

Symantec Technical Support: Please update this thread if there are any progress.

Thanks.


 

Bit more info: disabling all the Symantec AV services and stopping it all (smc -stop, etc ) does not help. SEP has to be uninstalled completely for the .exe to start properly. Setting centralized exceptions for the executable in question does not help either.

I have opened a case with Symantec (let me know if I should post the case # here for whatever reason).

With tech support i tried disabling the Application and Device Control policy with no effect.

I have provided Symantec Tech support a dump from the .exe that crashes, the log from the Symantec Support Tool, and an export of our Application and Device Control policy.

Hopefully I'll hear back later today or tomorrow.

Great, update here when you have new information. PM me the case number so that I can add my notes.

Thanks,
Thomas

I re-exported the client setup without the Application and Device Control module and reinstalled... The system works fine now, but, as i said before, we need  this module on because of some policy i have here.

Disabling the McAfee Endpoint Encryption and still get the same errors.

I agree with hvaliatti, I am still working with Symantec Tech support and have been for hours now. The problem is totally related to the App and Device Control module. Disabling conditions or rules within the modules does not help, you have to totally uncheck the " Block applications from running" option in App and Device control and then reboot, which in turn causes the App and Device control module to get unloaded, you are then in the clear.

Strange that hvaliatti is having this problem under Windows XP though. I do not have this problem in XP or Vista, just Windows 7... and it only occurs with one EXE... an old EXE from the year 2000 (a really old telnet client that we use for our ancient accounting system)... everything else is fine so far (or at least no users have reported problems...

I am going to fire up my test XP and Vista VMs and see if I can somehow get the EXE to fail on them as well just in case (but no users on t hose OS's have complained).

Yes, my environment has only Windows XP systems. I did upgraded to RU5 in some Dell desktops and laptops for tests and only some laptops reported the error. I did installed on my personal machine, which is a dell one, and not getting any errors at all.

lets wait for a quick answer from Symantec support team to figure out what to do now.

Sounds good hvaliatti.

I just finished testing under XP and Vista virtual machines, and the EXE in question runs just fine... go figure! We'll leave the figuring up to Symantec from here on in, I'm out of ideas :)

I am currently sending a Virtual Machine VHD file to Symantec tech support so they can reproduce the problem on their end (having a bit of trouble getting it to them though, grr), but hopefully once they have it they will be able to figure out a fix or workaround quickly.

Trafsta,

Verify that if you choose the option  "run as" and use the same user you are logged in, you are able to run any app that shows the error. This might be a clue of what is wrong.

hvaliatti, trying to do a runas doesn't seem to help. The EXE still errors out for me.

Just an update: Symantec tech support is having trouble using my MS Virtual PC image with their VMWare virtualization software (bluescreens on startup) so I've recreated another test system in VMWare Workstation which is what they use. It is 7 RTM Professional x86 image, I did NOT join it to our domain, it is a vanilla install with only SEP 11.0.5 RU5 deployed to it using our standard SEPM policies, and our EXE in question still fails to start up on it. So I've basically ruled out an group policies or anything at all non-symantec related from being the source of the problem.

This test VMWare image is being uploaded to their support FTP site and they will be testing it out tomorrow.

I had the same exact thing on about 10% of my computers.

DoniC,

Whats the SO of the computers you noticed the problem? Are they a notebooks? dell? Running any special app?

I have also encountered this exact same problem.  We started deploying the RU5 update (using the SEPM autoupdate feature) with a test deployment group of about 15 machines.  Of those, 2 encountered the same issue.  Just about every .exe file throws the same 0xC0000005 error. 

Heading:  xxxxx.exe - Application error
Body:  The application failed to initialize properly (0xC0000005).  Click OK to terminate the program

This also includes MMC windows, Regedit, CMD prompt, System Restore, and all Control Panel icons which makes it very difficult to troubleshoot.

Like  hvaliatti, the 2 systems in question are both Dell Latitude laptops (a D430 and a D620).

In safe mode, executable files worked correctly.  To confirm it was an issue with Symantec, I was able to use the cleanwipe tool in Safe mode to remove all references of SEP 11 RU5 (although I had to run it twice).  Upon reboot, the system worked correctly.  I then did a manual push of the RU5 client from the SEPM using the 'Find Unmanaged Computers' task.  It installed correctly and upon reboot, the same problem appeared.

The other system that experienced the problem was re-imaged using our in-house custom Corporate XP image.  The latest Symantec client was pushed to it and is running without incident.  Standard protocol is to put our corporate image on all new machines the moment they hit the door now... but ex-employees in the past would use the pre-loaded image that came from Dell.

Both of the machines in question were loaded with Dell's standard load which  leads me to believe this is related to one of the 3rd party applications that Dell throws on their laptops.

The list of software in Add/Remove programs on this machine is very long but here are some that might fit the category you were looking for (any proprietary, encryption, or other security software).

1. Broadcom Advanced Control Suite (which includes a TPM driver installer and ASF Management Application)
2. EMBASSY Trust Suite by Wave Systems

Both machines were XP SP3 and both had those applications on them (all machines that completed successfully are XP SP3 as well and many were laptops that have our corporate image which does not include the programs above)

Can anyone else experiencing this problem check to see if the machines in question have either of those applications?

Although I initially found this problem on a Dell system, it was a fresh install of Windows 7 with no Dell software. I have since reproduced it with a fresh install of Win7 on a test virtual machine without even adding the system to the domain. It only happens with one exe so far for us, but it is an exe we use for connecting to our accounting system so it is pretty critical. Fortunately it is only on Win7 clients. XP and Vista systems are fine with this same exe... go figure.

Symantec support still has my case open and they have reproduced it in their own environment (on virtual servers)...
If you guys haven't already opened up cases with symantec support, please do. And please PM me so I can tell you my case number so that they can be cross-referenced to get a quicker resolution to this problem.

Thanks.

I can confirm that the combination of SEP and Embassy Trust Suite will cause problems. In our environment, they'd cause .NET applications to error out. Removing the Embassy Trust Suite and rebooting solved the problems for me.

Very keen to hear the outcome, Dell D630 with the same issue - most exe's fail - Win XP SP2 - happens wiht both the single exe upgrade to RU5 and an exported clean install of RU5.

Just an FYI, the recommended workaround by Symantec Technical Support is to just disable Application and Device control policies on the affected systems for the time being. No other workarounds or fixes yet. I'm curious to hear what the rest of you have been told regarding your open Symantec tech support cases since you are having more serious and widespread exe issues than we are.

Please keep us all up to date here :)

Just deployed RU5 to most of my users. Getting calls this morning about 0xc05 and no .exe firing. I can boot to safe mode, I can also remove SEP via the .msi on the cd. This is happening on latitude d630. I updated the Embassy trust suite to A04 (3.3.xxx) with no luck. I didn't suspect that would fix the problem as the embassy problem would only cause autoupdate.exe to 0xc05.. 

On the horn with SEP Support now.

1) From the CD fire up Symantec Antivirus.msi.
2) Change to remove the Application and Device Control
3) Reboot
4) All works for now.

He wanted to check the Sysplant driver, my system had an (!) next to it.
We looked in the registry to change this value but no regentry for it.
Went to:
Device Manager->View->Show hidden
I uninstalled Sysplant and rebooted as well.

From the CD, Change->Reinstalled the Application and Device Control.
Back to 0xc05.

He's going to call me back Monday. We'll see then.

dammit. It's the Embassy Suite Issue again. After removing the Embassy Trust Suite everything is working as expected.

We had to remove NTP and App & device control from the affected clients as an urgent action to get things working back to normal.
Now, we are opening a case with support to dig into it.

btw, we don't have Embassy suite app :)

Does anyone has any news about that?

Ok - I tested on about 50 machines and didn't get a single fault reported.

Now I've rolled out to all machines and getting the exact same error on about 10% (so around 100 machines).

Really - this is unacceptable.

When can we expect an update from Symantec about this?

Hi All,

Figured I'd give an update on my experiences with this problem....

On several Dell machines with Embassy Suite installed, we had complete system meltdown - IE Every single executable generated the 0xc0000005 error when you try to run it.
An uninstall of Embassy Suite fixed these machines, with the exception of two which didn't uninstall cleanly - on these two, a manual uninstall of SEP was the only option (spent 3 hours on the phone with support exploring the other options).

NB - Embassy Suite is pre-installed by Dell if you have Dell build your laptops for you (we normally build them ourselves, but it looks like a few sliped through the net)

On a number of other machines, we get the 0xc0000005 error on individual applications - several using the PowerBuilder application and numerous using an older version of one of our 'in-house' written applications.
We have also seen it whilst using Cisco ADSM on one occasion (on a Win 7 box).

All in all, only around 5-10% of our machines have had any negative affects, which is probably why these issues slipped through our testing.

There is definitely something amiss with this version of SEP, but we've yet to put our finger on a common cause to this error.

Nick

Just thought I would weigh in on this issue... I also updated to 11.0.5002.333 on one of my groups in SEPM and experienced this issue. In our environment however, the only applications that generate the 0xc0000005, error are applications which run from folders in the root of the C drive, and not programs running from application folders in C:\Program Files.

Disabling all the Application Control options in the Application and Device Control policy, and rebooting the clients stopped the problem.

Our clients are a mix of Dell and HP computers. Most factory images, but a few have corporate images. The commonality I see is the location of the executable file.

I am hoping for a fix, as we rely on several of these settings to enforce our security policy.

write this is cmd windows:

sc config sysplant start= disabled

then reboot...

Aviv Hassidim
National Insurance Of Israel

Sysplant is the Application and Device Control driver service AFAIK... yes you can disable the service as a workaround, but it's not a fix. Plus if a workaround is what you want it makes more sense to disable Application and Device Control via a policy so you can easily re-enable it once this issue has been fixed with a patch/MR/RU/hotfix or whatever its now called. AFAIK as long as App and Device control is not enabled this issue should not exist - correct me if I'm wrong, but I think that is what tech support has been telling me as well.

Also, FYI, the latest I have heard from my open case with Symantec tech support is "This has been confirmed as a defect and will require a product fix which will be included in a later build of the product". No ETA on a released fix though...

To disable Application and Device Control via a policy is not helping at all....
only this command baypass the problem....when symantec will publish a fix i will set a logon script to enable sysplant again....

Really? Strange, disabling it via a policy fixes it for me (it's what tech support told me to do). Perhaps your issue is slightly different :)

I am having the same problem. Only thing is, when I searched another number that popped up in that box (0x75347eb2), Symantecs database pulled it up as an win95 through XP software virus. I am running Windows Vista 64 Home Premium. 

I dont know a whole lot about computers but, I know enough to know when my computer is having issues. I did find some of the binary files in the registry but I dont want to mess my laptop up by deleting something that Im unsure of.

Originally posted by: Aviv:

command to Baypass the problem

__________________________________________________________________________________________________________________________

I am not running any security policy. What exactly will happen if I do that?

I think symantec will expedite the release of RU6 to resolve this issue encountered in RU5

I'm getting a similar error on a specialised database application


It occurs on ANY machine that RU5 is installed WITH NTP. If we uninstall (not disable) the NTP and app/device control then the application works fine.

I've placed a virtual machine in a seperate management area and set the policies to default and ALLOW EVERYTHING no blocking or anything, and the error still happens.

I downgrade/re-install RU4 and the error does not occur.

I've tried clean installs and in place upgrades. As soon as it goes to RU5 it breaks. No log events ANYWHERE.


Forgot to mention:

XP SP3 (x86)
Hardware - Varies between Lenovo / HP
Software apps running - Nothing security related or what could possibly interferre

Hello,

Just adding my name to the list of SEP11 admins experiencing this error, for me it's an older powerbuilder application that does not start once RU5 (all components) is installed.  I removed app/dev control in the add/remove programs and this fixed the issue.  At least Symantec is aware of the problem, although my Symantec tech could not say if it's been escalated.  I have been given the workaround to disable the sysplant service on all workstations.  I'm not sure at this point what that will do to SEP11 client, but I imagine it will hamper the App/Device control component.

I most likely will just NOT roll out RU5 despite it's other bug fixes/GUP upgrades....which is disappointing. 

I have the same error. Fortunately is only one Dell notebook. I´ll remove the MR5 client and reinstall MR4 MP2 until Symantec fix the problem maybe in MR5 MP1.

When bugs in SEP will end?  

I was researching a little bit more about this issue and found out this thread.

The funny thing is that my environment is exactly the same from hvaliatti:

Dell Latitude D630 running Windows XP SP3 and Safeboot Encryption.

I hope Symantec fix this issue asap. I'm downgrading the machines that this error occur from RU5 to MR4 MP2 and leaving then in a group without the Install Package to upgrade.

Just to clarify my errors on the powerbuilder app were from an HP Desktop formatted with our standard image, so although the problem may be Dell specific for some, for me that is not the case.  Thanks.

Well, I've just had my support case on this issue closed by Symantec technical support, despite me asking them not to and despite the issue not being resolved.

I've asked for the case to be re-opened, re-assigned to a different tech and to have the original tech publically flogged (for various reasons), but suffice to say that it doesn't look like they (Symantec) are taking this seriously.

Our main issue is with some Dell laptops, with the Embassy Suite installed - most of these, removing the Embassy Suite resolved the problem, but on several, the machines were completely toasted and needed a full re-build.

We also had issues with Powerbuilder - we rolled back to the previous version of SEP on these machines.

I would like to re-iterate to Symantec that a roll back workaround, and removal of Embassy Suite is NOT a fix and is NOT an acceptable solution.

Nick

We also have a PowerBuilder application that fails to run on some Dell Desktop PCs when Network Threat Protection and Application and Device Control are enabled.  We're running SEP version 11.0.5002.333 (RU5).

Either you uninstall Dell's Embassy software, or jusr disable the App & Devive policy (uninstalling the App & Dev component isn't required). I hope it gets fixed in any upcoming MR.

Tested working Solution on XP : ok first login to OS safe mode then run command "sc config sysplant start= disabled" this will allow you to login to the pc/laptop normally then you can safely uninstall Pre-installed WAVE Embassy Trust Suite without complications, make sure the network cable is connected because the SEP server will enable SYSPLANT service startup again! This only takes affect again after restart.
If it is a stand-alone SEP RU5 Installation re-initialize the SYSPLANT service ""sc config sysplant start= enabled" and restart.(To be safe).
Lets hope they release a solution soon.

It's been a while, so figured I'd give an update on where we are with this.....

My support call with Symantec, after much going backwards and forwards has largely resulted in an impass - to paraphrase, they have effectively said:
 
Regarding the Embassy Trust Suite  0xc0000005 related error
'Tough, we aren't going to fix it - if you are too stupid to try to install two security products that that's your problem'
The have effectively said that despite it working prior to RU5, RU5 was a major revision, and therefore no guarantees of continuing compatibility are made - I could accept this approach with obscure, 1 in 10000 occurrences, but this is a very common problem.

Regarding the Powerbuilder 0xc0000005 related error
'It will be fixed in the next patch - use the previous version until then or disable ADC'

We have also recently started experiencing (following an acquisition) the .NET 0xc0000005 related error...
Haven't bothered reporting this to Symantec support - what's the point? Am going to roll them back to MR4 and wait - Anyone at Symantec care to tell me how long I'll need to?

The 'Positive Feedback' post that seems to be permanently pinned to the top of this forum was started by me....
Despite meaning what I said at the time - Symantec did save my bacon..... once.... Since then they have kicked me in the teeth repeatedly.



Nick

People
The issue here is the 11.0.5002 Version


Just stay on the 11.0.4202 version until next version after 11.0.5002

I get the same error on some clients. Applications and .exe file don't  work.

Uninstall the 11.0.5002, run the cleaning tool (Sweep Clean) and Install the 11.0.4202 version
This work for all my affected clients.

Excellent advice for people who haven't already deployed RU5 - and something I'm certainly doing on the majority of my affected clients.

Cleanwipe and rollback isn't an option for everything when you've deployed to circa 1000 machines, it just isn't viable....

Nor does cleanwipe address those low numbers of clients where you cannot even get the machine to fully boot (the 0xc000005 error even kills the logon process and we couldn't get anywhere with safe mode either, or with the manual process of removing SEP) - Symantec support couldn't seem to comprehend this aspect of the problem  - kept on saying they needed to remote on to the machine to see it, and extolling how Symantec offered a 'total security' platform.... oh how we laughed.... 'total security', as in the machine cannot be accessed for anything, not even by those who shoud be able to....

We did offer put the tech up in a hotel if he could get a flight over here - it's the only way he could have experienced the utter machine death.... He wasn't that desparate to see the problem.

Since a lot of updates Symantec have released for SEP so far have had major 'show stopping' bugs in them, I'm not holding my breath for the next patch to be any better - instead I have asked my team to step up evaluation of the alternatives with a serious view to switching.

Hello NickF
I dont know if its later to tell you this, but I recomend to use SEPprep.exe tool. This tool remove all the version for many antivirus and All  versions of Symantec EndPoint . I create a new Package with Config Manager and add all my affected computers into a collection. Then I set a schedule for run the SEPprep utility to uninstall Endpoint on all the affected computers. The Config Manager generate a report of the clients was have sucesfully running the SepPrep tool. Then I re-send the 11.0.4202 package to all the computers using the Endpoint deployment tool and YESSSS It's working.
I have almost 300 computers affected with the 11.0.5002 version.

I think this way can help you with yours 1000 computers.
 

Instead of installing the 11.0.4202 on all our 500 machines which now have 11.0.5002 I going back to Mcafee EPO. Atleast over there the techincal support won't advice you to disable the product security features.

Also see the post http://www.symantec.com/connect/forums/application-failed-initialize-properly-0xc0000005-after-installing-sep-ru5-application-and-de
it say that symantec should fix this problem in the next release of SEP.

The only way i got round this problem was when I deleted all the device blocking in my Application and Device Policy. We block Bluethooth ande Infrared devices.

I don't believe I was the one suggest to buy it for our company.

Shimic
Are you use the Clean Wipe Tool before install the 11.0.4202 version?

You need to run the Clean Wipe, Then In safe Mode delete the <install drive\program file\symantec > folder Also need to delete the program files\common files\symantec share folder.

Then install the 11.0.4202 version.

Or you can use the SEPprep tool for remove all version of EndPoint. Restart the computer and then install, the 11.0.4202 version.

Really the 11.0.5002 version it's a BIG PAIN.

Further info in this saga of failure.....

Have just discovered that SQL Server 2005 SP2 and SP3 also fail with 'Application error 0xc0000005'
Uninstall SEP, or roll back to MR4 and all is well again....

NB this is SQL installed on client machines, not on servers, (where we don't have ADC installed)...

Any news on when the patch that fixes this 'uber' failure is going to be released?

Has there been any update on a patch to correct this issues as we had to roll back some DEV peopel to 11.0.4 to correct the issue?

What versions of SEP is this for? I've seen 11.0.2 and 11.0.3 but now I'm getting the error with clients on 11.0.4, 11.0.5 looks to be ok though.

I apologize in advance if this has already been posted somewhere above but I did not see it anywhere. It gives some more information on RU5 conflicts and this issue.

After migrating a Symantec Endpoint Protection (SEP) 11 client to Release Update (RU) 5 or installing RU5, applications fail to initialize properly with a 0xc0000005 error.
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2009110612204948

Thanks
Grant

Would there be a timeframe on a fix for this? I would like to use this but had to pull the plug due to issues. It is very useful though.

I've been getting bi-weekly updates from tech support for many many months on this, and I have been told today that:

"This is currently slated to be fixed in RU 6 which has a *very* soft ETA of mid-April.  This is, of course, subject to change and pending final QA certification."

Insane :) I thought I should share this though...

Has anyone tried upgrading to "Symantec Protection Suite Enterprise Edition 3.0" which was released earlier this month (I think)? Curious to know if it fixes this issue... I'm way too scared to try though since I'm sure that even if it fixes this issue it'll probably break a dozen other things since this is the first 3.0 release...

Thanks for posting this KB and to all the folks troubleshooting on this thread.

I had the same issue on a Dell Latitude D820, the Wave Embassy Suite was installed. The issue began when upgrading the client to RU5.

Booting to safe mode and running sc config sysplant start= disabled allowed me to use the system in non-safe mode.

I had trouble uninstalling the Embassy suite, I tried originally in safe mode and it did not totally remove the software.
I resorted to manually deleting files and registry keys, but following your KB link I finally succeeded by deleting wxvault.dll from the c:\windows\system32 directory.

Not the first time we've had an application conflict with the Embassy suite.

Hi,

We are not a Symantec customer but are a software company and one of the applications we develop has been hit by this SEP bug. I wanted to share with you that this bug is not limited to Power Builder, etc, as has sometimes been suggested but could affect any application on any PC at any time. SEP crashes any application that uses, or has a DLL that uses, an image base of 0x10000000. When applications start there are many more DLLs loaded with the process than just those shipped with the application and Windows dynamically assigns the image base to DLLs, so this means any application could hit 0x10000000 at any time. Given that SEP will cause that application to crash this is a very serious issue and it is disappointing that, according to the previous post, Symantec may not properly address this for another 3 months.

Jon

Thanks guys had the same issues as you folloed the threat through and disabled sc config sysplant start=disabled fine now but what a pain Embassy Trust Suite

I get this error on any application that tries to open when using app and device control policy. I made the reg change, updated the policy and it still reverted back. Finally I just uninstalled it altogether. I have no idea why but I called and opened up a ticket on it, mainly because I don't want to uninstall it. It is very useful.

Had similar problems as all of you. Have a fairly run of the mill desktop build here. When I created a Application and Decvice Control policy and applied it to machines, I could not open an EXE for an application that sits on a shared drive. When I used the default settings for this policy there was no problems. But any tiny little tweeks and then I would have problems.

Disabling sysplant worked for me. It is still blocking USB keys etc and allowing HID interfaces so assume all is working fine. Will have to run with this for the moment unfort. But like many of ye am not to happy with this workaround.

Latest update from Symantec tech support:

"This issue is slated to be resolved in the next release, RU 6.  RU 6 was slated for a mid-April release, but development has pulled that date and, when queried, now say "2010"...so I'm not sure if they mean May 2010, or December 2010.  Hopefully they mean closer to May then December."

Looks like it's still going to be quite a while :(

11.0.5024.404_RU5 (patch for RU5 clients running 11.0.5.333) has been released, my support tech sent me a direct download FTP link with username/password (therefore I cannot share it). Contact symantec tech support to obtain it if you'd like it. Otherwise wait for RU6 as this fix will apparently be contained in RU6 as well. I will best testing this hopefully in the next few days and will report back.

Hmm, decided to test this out right away, so far no good.... I've reported back to Symantec tech support that it is still not working even with their latest client (0xc0000005 as usual).

If anyone else has different results please let me know!

Why do we have to contact Symantec Support to get this patch? Is it still available for English systems only? When will the other languages follow?

I agree, I would like to get the patch as well. I called but they said it was not yet available.

I'm guessing you HAVE to call them to get the patch because it is still being tested by all the companies that reported this problem, therefore they haven't publically released it yet.

I did call but was unsuccessful in getting it. I emailed back after my case was closed but did not hear from anyone.

*shrug*... all I can say is call again and complain some more, say you want to be part of the testing and that it is really impacting your company... or if you are REALLY desperate I suppose I could send you the files... you'd just have to be really careful with them and ensure you test them like crazy before deploying them company wide. For me, for example, they did not fix the problem and symantec tech support development team is looking into it some more.... PM me if you REALLY can't wait to try it...

@ trafsta

This seems to be working fine for me...are you still having issues with it?

Yes I am still having these issues, and we are apparently the only ones. It's just with one ancient telnet program used for our accounting system. We switched to a new accounting system 2 months ago so it's not as big a deal anymore but since I sent them the telnet program (which includes the .exe in question) I would have thought they would have used it in their testing, but I guess not... still waiting to hear back from them as they are having their development or whatever team look at it again.

Interesting.....I just created the package and "upgraded" 11.0.5 to the PP....even so I have 8k+ clients so it's not like I'm applying this any time soon.