Symantec Endpoint Protection client computers restart repeatedly after running the Power Eraser tool

Article:TECH202607  |  Created: 2013-02-07  |  Updated: 2013-08-30  |  Article URL http://www.symantec.com/docs/TECH202607
NOTE: If you are experiencing this particular known issue, we recommend that you Subscribe to receive email notification each time this article is updated. Subscribers will be the first to learn about any releases, status changes, workarounds or decisions made.
Article Type
Technical Solution


Subject

Issue



After running a Norton Power Eraser or Symantec Power Eraser rootkit scan and restarting, a Symantec Endpoint Protection (SEP) client computer repeatedly restarts. A blue screen error is displayed if the computer is not configured to automatically restart after a sytem failure.


Cause



This problem happens when using the rootkit scanning technology in older versions of Power Eraser. Power Eraser uses the Symantec Maximum Recovery driver to cache the current "last known good" versions of several drivers on the computer, including those of the SEP client Antivirus Engine (AvE). In older versions of the tool, these drivers were cached as soon as the user is prompted to restart. If any of these drivers are updated between the times of the prompt and the restart, it is possible for the Power Eraser tool to force an older, incompatible version of the AvE drivers to load, causing the SEP AutoProtect driver to attempt access unallocated memory space.


Solution



To resolve the problem, disable the SMR driver using the steps in How to remove Symantec Power Eraser Rootkit Scan drivers manually.

To prevent this problem from happening in the future, ensure you are running the latest version of Power Eraser. This tool is included as part of the Symantec Help tool, which can be found at Symantec Help (SymHelp).


Supplemental Materials

SourceETrack
Value3070444

SourceETrack
Value2949979

SourceETrack
Value3053567



Article URL http://www.symantec.com/docs/TECH202607


Terms of use for this information are found in Legal Notices