Symantec Endpoint Protection client computers restart repeatedly after running the Power Eraser tool
|Article:TECH202607|||||Created: 2013-02-07|||||Updated: 2013-05-29|||||Article URL http://www.symantec.com/docs/TECH202607|
|NOTE: If you are experiencing this particular known issue, we recommend that you Subscribe to receive email notification each time this article is updated. Subscribers will be the first to learn about any releases, status changes, workarounds or decisions made.|
After running a Norton Power Eraser or Symantec Power Eraser rootkit scan and restarting, a Symantec Endpoint Protection (SEP) client computer repeatedly restarts. A blue screen error is displayed if the computer is not configured to automatically restart after a sytem failure.
This problem happens when using the rootkit scanning technology in older versions of Power Eraser. Power Eraser uses the Symantec Maximum Recovery driver to cache the current "last known good" versions of several drivers on the computer, including those of the SEP client Antivirus Engine (AvE). In older versions of the tool, these drivers were cached as soon as the user is prompted to restart. If any of these drivers are updated between the times of the prompt and the restart, it is possible for the Power Eraser tool to force an older, incompatible version of the AvE drivers to load, causing the SEP AutoProtect driver to attempt access unallocated memory space.
To resolve the problem, disable the SMR driver using the steps in How to remove Symantec Power Eraser Rootkit Scan drivers manually.
To prevent this problem from happening in the future, ensure you are running the latest version of Power Eraser. This tool is included as part of the Symantec Help tool, which can be found at Symantec Help (SymHelp).
Article URL http://www.symantec.com/docs/TECH202607