Endpoint Protection

Hi,

On of the computers protected by our Symantec Endpoint Security license will no longer boot up.  It barely gets to the desktop then jumps to the blue screen complaining about SRTSPL64.SYS.   From searching the web I discovered this an SEP driver, but don't know how I can remedy the problem as I can't run windows.  I tried a number thing (recovery, chkdsk, etc. by booting from the system CD (Vista 64-bit). 

Is there anything I can do short of reinstalling Vista?

Thanks,

Teejay

Hi,

Try to boot computer safe mode with networking.

Uninstall SEP

Install latest SEP built i.e RU6 MP3 in safe mode with networking

Similar thread related to you as follow.

http://www.symantec.com/connect/forums/resolving-srtspl64sys-induced-blue-screen-death-enterprise-version-sep

if you think re-imaging gonna take less time then after re-image 

install only Symantec antivirus and antispyware component do not install the firewall component called Network threat protection

There is a good chance this system is infected. Try scanning the system with the SERT utility.

http://www.symantec.com/business/support/index?page=content&id=TECH131732&locale=en_US

SERT video - https://www-secure.symantec.com/connect/videos/symantec-endpoint-recovery-tool-sert

Thanks, but I can't even run in Safe Mode so I don't know how I can unistall SEP or run any utilites against it.  The best I've been able to do is the command prompt from the system CD.

TeeJay

SERT boots from a CD. Download the file and burn to a disk. Boot the infected system and run the scan.

Thanks, I will give that a whril.

TeeJay

When I got to the fileconnect for this product all I see are various language versions for SEP no SERT in the list.  It's not at the bottom as the video suggests. 

Is there one for this version?

TeeJay

Let me post the tool to a fileshare account. I will contactyou via Private Message with the login information. Give me an hour or so.

Thomas

Thank you, Thomas!

PM sent.

Let me know if you have any issues.

Cheers,

Thomas

I donwloaded the SERT and burned it to a CD.  It wasn't clear on the virus definition update page how you specifed Rapid Release vs. Daily Certified, but I found a download file corresponding to the SEP Small Business 12.0 for 64-bit Windows (vd34fe03.jsp so I downloaded that and extracted it to a USB drive.

The computer boots up fine from the CD, but the scan uses the old definitions from the laptop. How do I direct it to the USB drive?  Do I need to install from the USB drive first by booting from it?

TeeJay

Try placing the .jdb file at the root of the infected computer's hard drive so that the Symantec Endpoint Recovery Tool can access the definitions.

Nevermind.  I didn't see the "browse for virus definitions" at the bottom of the screen.  I clicked on that, chose the usb drive, and it is happily scanning with the newer definintions.  Thanks for the suggestion, Cycletech.

TeeJay

I hope that you can get to the root of the BSOD issue. If your system comes up clean, try reseating all the cards and memory on the motherboard, and make sure the CPU and other fans are running as well.

The scan with the new virus definitions was successful and the system came up clean.  Unfortuantely, my boot time failure is still there.  I could try reseating all the cards and such, but the computer doesn't falter when booted from the SERT CD and ran OK through the hours of scans.  Could that still be the problem?

-TeeJay

Your right, no need to reseet the cards. Did you say that Safe-mode BSOD's or you cannot get into safe-mode?

At this point you may need to run a repair of your OS

http://support.microsoft.com/kb/936212

Correct, none of the safe modes work--all eventually terminate at the blue screen that names SRTSPL64.SYS as the failure point:

PAGE_FAULT_IN_NONPAGED_AREA

Yeah, I was afraid of that.  It reported no restore point available and repair did nothing so it looks like I need to reinstall the OS. Thanks for the link.

Well the problem turned out to be a corrupted hard drive.  Chkdsk couldn't repair it so I ended up reformatting an reloading everything.  It is working now.  It was most likely just a coincidence that it failed at the point of loading SRTSPL64.SYS.

The bright side of this is I now have a working SERT recovery CD that I put to good use on another machine that turned out to be infected.

So thanks everyone for you help in this matter.

-TeeJay