Endpoint Protection

Hello,

I posted earlier to another Symantec forum, but I believe this group is where I should have posted the issue. My apologies for the duplicates.

I am an individual user trying to help my son, a college student, with recent dilemma.  He has a laptop running Windows XPSP3 with Symantec Corp Edition 10.1.5 antivirus protection through his university, which was required for any students living on campus.

This morning when attempting to logon he encountered an error that indicated user profile unable to load.  When his computer booted to desktop his documents and numerous items are missing.  Next, a tamper alert from symantec popped up citing a problem with uphclean.

He attempted to talk to his IT help desk with this information, but the student volunteer there had no idea what to do about it and the Tech Director is out of town for next 4-5 days. While he was going to classes and taking tests I attempted to search google for a solution for him.  I found several threads on this forum from corporate IT persons discussing the issue, but none of which indicated what solution would be. 

My son tried removing UPHclean from add/remove and rebooting laptop.  He still does not have his user profile and needs to be able to access his docs etc to work on thesis.  As he no longer lives on campus, he can remove Symantec and use another antivirus if he chooses.  Was unsure if removing Symantec would be the solution.   Have heard this can be difficult to remove. 

Would greatly appreciate if someone could kindly give basic instructions how he can solve this problem.

Thanks!

 Disable\Turn Off Tamper Protection

Thank you kindly for suggestion, but this does not solve the problem.  Earlier he unchecked tamper protection and rebooted.  Still no user profile and he double checked that tamper protection box was still unchecked. 

UPHclean is the Microsoft User Profile Hive Cleanup Service.  For users running Windows XP, it is not necessary for a desktop machine used by a single user.  It may be worth removing it from the Add/Remove programs control pannel to see if that helps.

Even with this error, your son should also still be able to access his documents by navigating to My Computer, then the main hard drive (usually C:), then "Documents and Settings", his username, and then Documents.  Although, he wouldn't have access to his settings (like bookmarks) going this route.

Removing Symantec A/V should also be possible via the Add/Remove programs control pannel, but let us know if you have troubles.

Let us know if you need some more assistance.

 Un-install Tamper Protection

Go to device Manager - View -Show Hidden Devices- Non-Plug and Play Devices -SPBBCDrv

right click Un-install.

Am somewhat aware what UPHclean service does and he was directed several years ago by an MS tech to use this service  to resolve very long shutdown times/issues.  The situation persisted even with a brand new reformat. 

Regardless, as I noted in first post he removed UPHclean from add/remove earlier today and it did not help the problem.  He also has unchecked tamper protection. 

He can access his docs via C drive but not his desktop or his bookmarks in either IE or Firefox.  These he needs for his research.

He is just wanting/needing his userprofile back to normal from logon so my question is how to accomplish that?  Will removing Symantec put things back to normal or what exactly will? 

Thanks for your time.

If user Profile is corrupted then there is a very little chance that by removing SAV it will work fine..
Try doing a System Restore. 

It may if there is still a conflict.  However, I'd be worried that the damage may be to his user registry files (ntuser.dat).  If that's the case, creating a new profile and copying important data back to the new profile would be an option.

Microsoft has a nice KB article that describes that process step-by-step.

Thanks again.  When he gets back from class I will have him try that.  I know some settings in this Symantec 10.1 are blocked by his Tech department.  Would it not accomplish same thing for him to remove Symantec and install other more manageable protection?

Thanks for the article.  Pretty disappointing that an Antivirus designed to work on MS operating systems would have such a conflict with an MS program  (which evidently has been know about by Symantec for some time) that would corrupt the users registry files. 

Would you recommend creating new profile before attempting to ditch Symantec?

Should have mentioned the first thing he tried was system restore for three earlier dates, and it came back that it could not do restore or some such.  Even had him doublecheck that System Restore was turned on and running. 

Exclude using Commn Software Exception Policy...

This resolves the conflict.


Regards....
Ramji Iyyer 

I've seen all sorts of things cause damage to the ntuser.dat file, esspecially power blips that happen at just the wrong time.

All of the XP computers in one of our divisions use the User Profile Hive Cleanup Service and SEP and haven't had this problem.  My hunch would be that something else is causing the problem, and SEP--being embeded at a low level in the operating system for security reasons--ends up showing the negative effects first.

Log into the machine with Admin rights, create a new user for your son.  Copy desktop and favorites from old user directory to new user directory.  Test new user account.   Most probably before you started doing anything drastic, the only thing that was a problem was the registry hive for that specific user.   Creating a new user would give your son access to his items.  

I would copy at least the following for him to test
IE favorites - <userprofile>\Favorites
Desktop - <userprofile>\Desktop
Firefox - %APPDATA%\Mozilla\Firefox\Profiles\xxxxxxxx.default\


Good luck,
Toast

Did your son try system restore?
How about when he boots up hit F8 and pick last know good config
Good luck

I suppose without definitive proof it's always easy to speculate that something else suddenly caused the issue with his profile.  I find it awfully coincidental  that the Symantec tamper alert, Symantec logs, and the Windows system Event Viewer all indicate error occured between UPHclean and Symantec AV.  And, at the exact same time the system is alerting about problems between the 2 programs  my son's profile just happened to incur damage.

I don't think it's all that uncommon for some users to have issues/conflicts while other machines with different configurations do not. 

I presume there are some users who haven't had any issues using the two programs on the same system, however I found this forum by googling the very issue.  There are numerous threads by IT professionals like yourself, who had many machines in certain departments effected by this very issue.  Here is just one such thread, that led me to this forum to begin with: www-secure.symantec.com/connect/forums/endpoint-protection-stopping-users-reciving-there-windows-profiles. 

I do appreciate everyones time and your pointing me towards the MS article.   He was able to use that to create new profile and has since removed the Symantec Corporate AV.