After upgrade SEP MR5 to MR 6 MP1 Ive been having a little problem for a while
all the icons on applications(.exe) have gone missing in explorer and on the start menu. Instead the unknown file icon appears.(msoffice,

i just wondered if anyone knew any solutions. find attach file for same.

• Icon not display.JPG

I bought specifically Symantec Endpoint Protection SB 12.0 as it supports WS2008 R2.
I was running WS2003 which had the symantec corp AV protection software but that is now discontinued and replaced with the product mentioned above.

What happened to the right click > scan file context menu?
Does this mean that the AV does not actually run? That it does not protect the system against threats either? So there is no way to scan a file for infection before I open the file that could be harmful?

AV Corp was so much better as that gave me more trust.

any ideas? (yes, running 64 bit OS - WS2008 R2 is only x64)

Trying to install SEP Management 11.6 on a SBS 2003 server.
-Server has SAV 10 and SSC
-Install rollsback
-Yes, I do get the LUCHECK.exe returned 206
-Yes I uninstalled AMS
-Yes I uninstalled Live Update
-Yes I deleted the Live Update folders
-LiveUpdate does not show up in add/remove programs
-When I try installing LU from the SEP CD I get popup "The installed version of Live Update on this system is already up-to-date"

Something different I have not seen posted yet:
The server also has Sym. Mail Security for Exchange 5.x I think. I upgraded that to the Information Security SMSMSE 6.5. During the install of that I got a message popup box saying:
"Error 1904.module e:\program files\symantec\SMSMSE\6.5\server\SAVFMSELU.dll failed to register. HRESUL -2147220473 contact your support personnel"

The rest of theinstall went O.K. until the end when it asked if I wanted it to run LU and I said yes. It failed and I didn't snip a picture before I said O.K., but it said something about it not being able to check because the version of LU that was installed.

I went into SMSMSE and ran LiveUpdate Certified Definitions and it says it's running. I changed pages, came back and tried running them again but it says they're already running. There is a process named SAVFMSELIVE.exe running, not sure if that's the process or not.

So to wrap up:
I cannot install SEPM because LU is jacked.
I was unable to install LU
It seems as if LU is installed, but not showing in add/remove and it seems like it is running in SMSMSE.

If someone has a real answer for these issues

Hi,

Anybody know i can do that?

Regards

Hi,
I have a norton AV corporate edition and I recently upgraded windows to windows 7. now Im getting the error like 'Symantec TDI and NDIS Drivers has been blocked from running' The auto protect has been disabled. I have recent virus definitions and upgraded till 02-sep-2010. can you help me fixing this.

We are seeing strange results when using Microsoft SCCM to deploy SEP to Windows 2008 R2 servers. The package is a managed export with only AV and AntiSpyware enabled. When this package is installed via SCCM all components install including NTP. If the same package is executed locally on AV and AntiSpyware components are installed and enabled.

Has anyone seen this issue before?

last week I downloaded the recovery disc from fileconnect. It was version 1.0.15 I believe. I believe I'd been on fileconnect a few months ago and didn't see this so I assume it's new. Anyway, I ran it and it's a nice item, however I noticed on one of the screens in the tool that it said the virus definitions are of some time in 2009 - can't remember when but does anybody have any thought on why a tool that just came out recently has such outdated scanning? Is there a wy to update it?

Correct me if i'm wrong about the release accuracy, this thing could be a year old for all I know for certain.

I just downloaded SEP 11.0.6 MP1 and need some guidance on the steps to upgrade our 11.0.5 console and clients. Also does this new version incorporate Mac client AV management and does it "discover and install" the SEP client on unprotected PC's & Macs?

I'm assuming this isn't right... My SEPM server is moving 25 to 35 gigaBYTES per day to it's clients. Installed the SEP Content DistMon today, and saw nearly everyone is pulling Full packages. What can I do to troubleshoot or solve this?

SEPM 11.0.6
Mixed SEP clients, 11.0.5 & 11.0.6

I have been trying to install a remote client  form the endpoint protection manager into a group i created ( I have version 11.0.6005.562)  It keeps failing. it says that i already have it in my default group (Computers). When i checked there are no clients in there. It is empty.

Using SEP 11.0.6005.562 and have pushed install to Windows clients using XP SP3 and Vista SP2.  Most running either Office 2007 or 2003.  Policy is configured to enable the Outlook Auto-Protect. 

Have verified on the clients that theOutlook Auto-Protect tab appears in the EndPoint client,  and in Office that the Outlook Auto-Protect is enabled. 

Later on, upon checking these clients I find that the Outlook Auto-protect tab no longer appears.

Some people (not all) have received this error: 

The Add-in "Symantec AntiVirus Outlook Protection" (C:\Program Files\Common Files\Symantec Shared\vpmsece.dll) cannot be loaded and has been disabled. Please contact the manufacturer for an update.  If no update is available, please uninstall the Add-in.

I perform an Add/Remove Programs on the Symantec Endpoint Protection selecting Modify and now find that the Outlook Scanner has not been installed. I install it and everything is ok.  Then, days later I have to go through this whole cycle again.

Any clues as to what may be happening or what how I can resolve?

Hello,
 I have a need to take teh symantec products and map them to the PCI requirements. I am starting with CCS. What part of PCI does CCS handle?

Been having an issue sending logs to our Syslog server

I've designated one of our SEPMs to be the Master Logging server. It works fine for a few days, then suddenly stops sending the log files. If I restart the SEPM service on that SEPM it will then start sending logs for a few days and then stop again. I can continue to restart the service but it's more of a workaround than a fix.

Just curious to see if anyone has had experience with this.

Nothing has changed on the syslog server or the SEPM for that matter. We put a sniffer on the syslog server and could see traffic from SEPM, then it would stop.

Not really what changed as of yet.

Wodnering if anyone has seen this.  If you receive the weekly Executive Summary report from SEP 12 Protection Center, which is the default one from product installation, and you get a SEP client with a virus thus it'll show you that nice red pie chart thingy and in the list of systems Infected where it'll say "Action Required:   Yes", to the left of that is the Detection Date/Time.  Mine shows 31/12/1969 20:00:00 but the server time is certainly not that. 

Does anybody else see that date ? 

Also does one have to manually clear the virus condition so it'll stop reporting the system as still requiring action?  Or will this condition clear on it's own once a scan runs and doesn't find the same virus in the same spot? 

• Partner Group

As you can see, this is my setup for the Missed Scheduled Scans

My question is, what is the result if I uncheck and don't use it? If a scan is missed, will it start at the normal scheduled time as opposed to re-trying within 4 days? That's my assumption.....

4434241 1283434398

Symantec Endpoint protection Virus definition is blank

Hey there, a little question...

i'm trying to import an OU from a Subdomain of my normal Domain but get an error thats a error occourd while connecting to the DC...
also got this error while configuring the DC of the Subdomain...

isn't it possible to enter 2 Active Directory servers?

i found this thread here:
https://www-secure.symantec.com/connect/de/forums/...

if i understand that statement correct:

"Each Symantec Endpoint Protection Manager makes use of one ODBC driver. When you add one Domain Controller (DC1) in the SEPM, this ODBC is used by that DC1. When you add another Domain Controller (DC2) in the SEPM, the ODBC is already in use by the DC1, therefore you get the error message about the failure of the Directory Server connection."

it isn't possible?

also i'm rather sure that i can't add the subdomain dc as a replicated server...!

thx

my problem is the following
To  install SEP client on host i access a shared folder on the SEP server where i save all the client packages (single file executables) and install the client.
sometimes at the end of the installation the computer freezes and i need to reset.

if i copy the setup file locally to the host and than install i dont have the above problem.

what could be the reason for this?

Thanks

 

4433571 1283432372

QUESTION:
Is there a problem if i upgrade the SEPM to RU6MP1
but take my time upgrading clients?

thanks

4433321 1283428532

Hi,

I am needing some advice regarding false detection of a file.

The file is temporarily created by an Inventory tool (Peregrine Desktop Inventory) which runs once a month on all workstations. The first time this was detected was this month 01/09/2010, however the application has been in use for years, so I am sure it relates to definition file updates.

The file which is detected as a risk and deleted is fpnthw.sys. This can be located on workstations under C:\Documents and Settings\Username\Local Settings\Temp\ 

I have attempted to add an exclusion on SAV 10.1.6.6000, however there appears to be only two options. Either add the extension (.sys) or the folder path (C:\Documents and Settings\Username\Local Settings\Temp\) to the exceptions. Unfortunately a specific file cannot be added on its own, and wildcards may not be used. This creates a larger problem which leaves room for other possible threats.
 
Would it be possible to get Symantec to exclude this file from the definitions if we provide them with a copy?

I believe this also affects a different version of the Anti-Virus and SEP.

Regards

Barry