Endpoint Protection

Hi


In one windows xp pc which was running as managed client  in symantec endpoint 11.06 ,is having some issues in endpoint which I previously posted in my issues as "SMC SERVICE not starting".Atlast Idecided to uninstall the endpoint and reinstall but it is loading as managed client and still the smc error is existing.


Please try to give a soluiton

Thanks & Regards

Techshan

did you use the admin account for install? does smc - start on command prompt start the smc service?

I will try and let u know


fyi:   I done all with the administrator rights in the particular pc




thanks and regards


Techshan(Swaminathan)

Hi

I gave the command "start smc" in command prompt but no result


Thanks&Regards

Techshan( Swaminathan)

Can you please paste a screen shot of the error ?

  Ihave attached the screenshot 

Please paste the sylink log  , run https://www-secure.symantec.com/connect/downloads/sylink-toggle

What is the error can you post it

Take a copy of SerDef.dat and sylink.xml from a working PC.It will be under C:\Program Files\Symantec\Symantec Endpoint Protection folder.Move these original files along with its backup files from the problematic client(You have to stop smc service by using smc -stop command before doing this.)Put the new files in problematic pc in C:\Program Files\Symantec\Symantec Endpoint Protection then start SMC service(smc -start command).

What  is the exact error  message   you are  getting, when you  try  to start the service???

Hi

After copying the serDef.dat & sylink.xml from the working pc also no effect

I am attaching the errors

Thanks&Regards

Techshan ( Swaminathan)

Download the  norton security  Scan, and  run  it.
ftp://ftp.symantec.com/misc/tools/nss/

There  could  be  a threat  on the  computer, that  is not  allowing  the  smc service  to start.

 

Hi

I am sure that there is no threats in this pc since it is fully scanned by one antivirus powerful than symantec



and here is the previous chat unsolved https://www-secure.symantec.com/connect/forums/symantec-client-not-working for the same issue

So please kindly be particular in giving the solution


Thanks & Regards

Techshan (swaminathan)

Kindly  run sep support  tool, with  loadpoint  analysis option selected, and upload the logs here........

I have uploaded the loadpoint analysis here

Thanks & Regards

Techshan (Swaminathan)

Hi,


Please post the event logs from event viewer.

Application as well as System log.

Also, please run the TestSec tool and post the logs.

Aniket

Hi,

Can you please confirm that the service Symantec management Client is not in Disabled state?

Aniket

Can you tell us:

Which version of Windows XP (and service pack) are you using

What software found the malware/trojans?

Have you tried using the regmon and filemon apps from Sysinternals.  Could point to the failure point.  permossion, missing file, missing registry key etc

Did you originally follow this to convert to unmanaged?


http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2008021910355348

Please try this

Re-register the msxml.dll-
Go to Start>> Run
Type "regsvr32 msxml.dll"
Click OK

Start SMC from run line-
Go to Start>> Run
Type "smc -start"
Click OK

  or you can Re-start the SMC service from Services Console 

If  the above steps do not work try this  http://support.microsoft.com/kb/910656

First Uninstall SEP, then follow this

Uninstall and reinstall the MSXML subsystem

To uninstall the MSXML subsystem, follow these steps:

1. Click Start, click Run, type appwiz.cpl, and then click OK.
2. Under Currently installed programs, locate the MSXML Parser.
3. Click the program, and then click Remove.
4. Restart the computer.

To install the MSXML subsystem, follow these steps:

1. Download and install MSXML 4.0 SP2. To do this, visit the following Microsoft Web site: http://www.microsoft.com/downloads/details.aspx?FamilyID=3144b72b-b4f2-46da-b4b6-c5d7485f2b42&DisplayLang=en (http://www.microsoft.com/downloads/details.aspx?FamilyID=3144b72b-b4f2-46da-b4b6-c5d7485f2b42&DisplayLang=en)
   Note this is a complete replacement of MSXML 4.0 and MSXML 4.0 Service Pack 1 (SP1).
2. Download and install the following MSXML update:
   Microsoft XML Parser 3.0 Service Pack 5. For more information, visit the following Microsoft Web site:

   http://www.microsoft.com/downloads/details.aspx?FamilyID=4a3ad088-a893-4f0b-a932-5e024e74519f&DisplayLang=en (http://www.microsoft.com/downloads/details.aspx?FamilyID=4a3ad088-a893-4f0b-a932-5e024e74519f& DisplayLang=en)

   Note Make sure that you note any error messages that you receive during the installation.
3. Restart the computer.
4. Reinstall SEP.

Hi

Thanks for all who gave the prompt support !


I will apply all the solutions and let you know the result today itself

Thanks & Regards

Techshan (Swaminathan)

Try this once
Click on Start > Run and type Services.msc
Right-click on the System Event Notification service and click on Properties.
Under the General tab, verify that the startup type is set to automatic and start the service.
Click OK and start the Symantec Management Client service

If above suggestion not helps reinstall SEP
Follow the below steps
 
Remove SEP
Delete following folders if present
C:\Program Files\Symantec
C:\Program Files\Symantec AntiVirus
C:\Program Files\Common Files\Symantec Shared
C:\Documents and Settings\All Users\Application Data\Symantec
 
Also delete following reg keys
HKLM\Software\symantec
HKCU\Software\symantec
Install SEP and try..

May be old antivirus did't completely removed or Virus has affected the machine. Please run CleanWipe removal tool then try to install.

Hi


I have attached the logs  here for you


Thanks & Regards


Techshan (Swaminathan)

Can you see what exactly event id shows in event viewer-- under application

Event id and source related to symantec errors and warning

Administrators is missing in the access permissions for DCOM.
INTERACTIVE is missing in the access permissions for DCOM.


Could you  please  correct   this and  then chk?

Did you reinstall the  MSXML  subsystem??

Check the permissions as per this KB

Troubleshooting Symantec AntiVirus Corporate Edition and Symantec Endpoint Protection installations: Checking rights and permissions

hi

find the symantec event id in attached file

Thanks & Regards

Techshan (Swaminathan)

Hi Eric


If you find the solution for the last posted event id the problem will be solved ,I guess


Techshan

Hi

If you find the solution for the last posted event id the problem will be solved ,I guess

Techshan

The follwoing article describes how to read the information you are trying to view

http://support.microsoft.com/?kbid=312216

Hi all

I have improved in the way that I uninstalled the endpoint 11.06.... and loaded the old version  endpoint 11.0.780.1109 and successfully loaded as unmanaged client  and the rest i will post in minutes

Thanks & Regards


Techshan ( Swaminathan)

Hi Swami

That is really strange , You  were having difficulty with RU6 and SEP RTM got  installed fine,

Even i am waiting to see how will the client behave once it becomes managed

Hi

I am attaching the errors & screenshots .

In screenshot it is saying that is self-managed which is little bit consoling information which i got


But in other errors it is saying autoprotect failure & other failures


Why it took so long for me to post this because I tried to upgrade the older version which is right now loaded in the pc with sep 11.5 but I got the same symptom as before .

So i uninstalled with cleanwipe and loaded the older version 11.0.780.... and posted the errors for you


Thanks & Regards

Techshan ( Swaminathan)

Hi,

As mentioned in my earlier comment, what is the status of Symantec services?

Also, run the testsec tool attached in my previous comment and let us know the results.

Aniket

Hi


I have uploaded the result of the test tool which u have sent


And the symantec services are automatic and started not like the latest version; catch you all tomorrow

Thanks & Regards

Techshan ( Swaminathan)

Hi,

I believe this is an issue related to DCOM permissions. The logs indicate the following:

Administrators is missing in the access permissions for DCOM.
INTERACTIVE is missing in the access permissions for DCOM.

Please follow the steps below to resolve the issue:

Checking DCOM settings

The last place to check rights on a computer is in its DCOM settings.

To verify Distributed COM properties

1. On the Windows taskbar, click Start > Run.
2. Type the following, and then click OK:
   
   dcomcnfg
    
3. Do one of the following, depending on your operating system:
   • In Windows XP/2003, click Component Services > Computers > My Computer. Then right-click My Computer and click Properties.
   • In all other versions of Windows, go on to the next step.
4. On the Default Security or Default COM Security tab, under Default Access Permissions, click Edit Default.
5. Verify that Administrators, Interactive, and System accounts are set to Allow Access, and then click OK.
6. Under Default Launch Permissions, click Edit Default.
7. Verify that the Administrators, Interactive, and System accounts are set to Allow Launch, and click OK.
8. Do one of the following, depending on your operating system:
   • In Windows XP/2003, skip the two following steps.
   • In all other versions of Windows, go on to the next step.
9. In the Default Configuration Permissions section, click Edit Default.
10. In the Registry Key Permissions window, verify that the following are set to Full Control, and then click OK:
    
    CREATOR OWNER
    ...\Administrators
    SYSTEM
     
11. On the Default Properties tab, verify that Default Impersonation Level is set to Identify.
12. Click Apply, and then click OK.
13. Restart the computer for the changes to take effect.

Aniket

Hi

I have given the settings which you pointed and restarting the pc

Thanks & Regards

Techshan ( Swaminathan)

Swami can try to run Symantec Power Eraser and then try to install SEP

Symantec Power Eraser is designed to complement mainline antivirus applications by detecting and remediating specific types of threats:

• • New variants of existing threats for which there is no coverage by the current definition sets
  • Fake antivirus applications, and other rogueware
  • Rootkits
  • System settings that have been tampered with maliciously

Because Symantec Power Eraser uses aggressive methods to detect these threats, there is a risk that it can select some legitimate programs for removal. Use standard antivirus applications and troubleshooting techniques first; if they do not remove all of the threats, use Symantec Power Eraser.

http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/6c156dbdfef028738825775b006e7b89?OpenDocument


Where can I find more information?

Video:
https://www-secure.symantec.com/connect/videos/pow...
 
Download:
ftp://ftp.symantec.com/public/english_us_canada/products/symantec_endpoint_protection/SEPDIAG/Sep_SupportToolSPE.exe

Hi

I restarted the pc and the same symptom still exists.


When I try to use the liveupdate , I am getting this error attached

Thanks & Regards

Techshan ( Swaminathan)

Hi  Prachand


Norton power eraser giving the following errors attached when I run it


 

http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/2c62c4ee0e697aae882573b000034ded?OpenDocument

Can you try with a new copy of norton power eraser. ?

Hi Aravind

Tried a new copy of download and ran but same symptom


If we figure out why rtvscan is not active the problem is solved

I think there may be some virus affection id present in this PC .That is why it is ging all these errors.Can you boot from symantec recovery CD and perform a scan?

Can you may this drive to a diffrent computer and run a full scan.

Hi,

Can you please attach a debugger to the rtvscan process and see if you can get a process dump for that?\

http://www.symantec.com/connect/videos/advanced-troubleshooting-debugdiag

Aniket

And Swami if mapping is a concern and if you have the back up of your data , and since this is the only computer where you have the issue, Reimaging should  be an alternative.

If you have time  then i would suggest you to Reimage the system and then try to install

Also,

please check the article below and see if you can install the hotfix from microsoft.

http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/be169c222e7152c4652574cd006e3ace?OpenDocument

Aniket

Hi all


This is to come to conclusion that something is bugging in the particular pc related to symantec endpoint protection software only!!!!!!!


Why I am putting this forward is since kaspersky internet security 2011.. version trial product got successfully installed and found no threats or viruses for my consolation!!!!!


Now I am going to remove the kaspersky and load the same old version of sep and upload the error log


Thanks & Regards

Techshan( Swaminathan)

Swami, is there any issue in re-imaging the system as it will save a lot of your time.

Hi Prachand


You mean re-imaging like cloning?

Thanks

Swaminathan

Re-imaging as in formatting the drive and reinstalling the OS

You can just format the drive where the OS is installed and then reload the OS

hI Prachand


I already loaded symantec corporate edition client and it is functional .


I don't want to format that pc since apart from  this issue else everything is working fine..

Now symantec 10.0 corporate client is also working fine

Thanks anyway for all of your help but my advice to all in symantec company  is try to find a solution rather to provide a format solution 

I know all in the forum are striving hard to provide the solution but the symantec antivirus & security products have to be  improved a lot in these type of installation,reinstallation problems.

N.B: In the same pc as I stated earlier kasperksy got installed properly and I uninstalled it and installed symantec client 10.0


Thanks

Swaminathan

DO you tried SEP RU6MP1?If no give a try...

Hi aravind

All the problems posted in this post is with SEP RU6MP1 since  I just updated my license with symantec and installed in maximum pc's

Swaminathan

Which are the other softwares installed in this PC?

Noone has replied to this thread in a while.

Bu the messages about unable to read and unable to write o certain addresses can really directly be related to the HDD having difficulties.

Have you tried running a:

chkdsk /R [drive letter you are trying to install to]

 

??