Endpoint Protection

Good Morning,

After installing SEP to my center that all have Windows 7, There are several reports from users stating that upon login several programs are crashing. Mainly,

Intel Management, AMD Catalyst Control, Dell Control Point, EMET Notifier

I have verified that Symantec is the issue because the issue will go away after uninstalling the SEP client.

When looking at the event log every error stems from Ntdll.dll

Is this a known issue?

What's the exact version and what components do you have installed?

What version of SEP are you installing? 

I am installing SEP ver12.1.3

Only component that has been installed is the application and device control add-on

So you're only using SEP to utilise the ADC feature?

Sounds like you need to add an exception.

Check this Mick2009 article on ADC and how to add them:

https://www-secure.symantec.com/connect/articles/crreating-application-control-exclusions-symantec-endpoint-protection-121

This could be the problem.

Is it a specific app or random? Any in-house ones?

I have tried adding an exception but I am still getting the app crashes upon login. It's always specific apps.

Faulting application event logs are as follows...

Faulting application name: PrivacyIconClient.exe, version: 5.2.0.1020, time stamp: 0x4ad78332
Faulting module name: ntdll.dll, version: 6.1.7601.18229, time stamp: 0x51fb164a
Exception code: 0xc0000005
Fault offset: 0x000000000005339d
Faulting process id: 0x1b58
Faulting application start time: 0x01ceca8bf8cbbab9
Faulting application path: C:\Program Files (x86)\Common Files\Intel\Privacy Icon\PrivacyIconClient.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: 367f6a6d-367f-11e3-9659-0023ae9c239f

Faulting application name: MOM.exe, version: 2.0.0.0, time stamp: 0x4f2058d9
Faulting module name: ntdll.dll, version: 6.1.7601.18229, time stamp: 0x51fb164a
Exception code: 0xc0000005
Fault offset: 0x000000000005339d
Faulting process id: 0x1388
Faulting application start time: 0x01ceca8bd5db221e
Faulting application path: C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: 1392c9c0-367f-11e3-9659-0023ae9c239f

Faulting application name: EMET_notifier.exe, version: 3.0.0.0, time stamp: 0x4fa819b8
Faulting module name: ntdll.dll, version: 6.1.7601.18229, time stamp: 0x51fb164a
Exception code: 0xc0000005
Fault offset: 0x000000000005339d
Faulting process id: 0x1230
Faulting application start time: 0x01ceca8bd580c635
Faulting application path: C:\Program Files (x86)\EMET\EMET_notifier.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: 1347efcc-367f-11e3-9659-0023ae9c239f

Faulting application name: BcmDeviceAndTaskStatusService.exe, version: 1.6.460.87, time stamp: 0x4bba25d9
Faulting module name: ntdll.dll, version: 6.1.7601.18229, time stamp: 0x51fb164a
Exception code: 0xc0000005
Fault offset: 0x000000000005339d
Faulting process id: 0xb90
Faulting application start time: 0x01ceca8bd4f4f68a
Faulting application path: C:\Program Files\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: 12d5e3b5-367f-11e3-9659-0023ae9c239f

Faulting application name: Dell.ControlPoint.exe, version: 1.3.0.77, time stamp: 0x4a31ddb3
Faulting module name: ntdll.dll, version: 6.1.7601.18229, time stamp: 0x51fb164a
Exception code: 0xc0000005
Fault offset: 0x000000000005339d
Faulting process id: 0xaec
Faulting application start time: 0x01ceca8bd4f75817
Faulting application path: C:\Program Files\Dell\Dell ControlPoint\Dell.ControlPoint.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: 12c075c0-367f-11e3-9659-0023ae9c239f

Judging by the exception code being thrown, 0xc0000005, this looks to be caused by the ADC component. You followed Mick's steps on adding the exception for ADC? Can you use process explorer to verify sysfer.dll is present in the app?

Hello,

I would request you to create a case with Symantec Technical Support and PM me the case #.

Check these Steps below:

How to create a new case in MySymantec

http://www.symantec.com/business/support/index?page=content&id=TECH58873

Phone numbers to contact Tech Support:-

Regional Support Telephone Numbers:

• United States: https://support.broadcom.com (407-357-7600 from outside the United States)
• Australia: 1300 365510 (+61 2 8220 7111 from outside Australia)
• United Kingdom: +44 (0) 870 606 6000

Additional contact numbers: http://www.symantec.com/business/support/contact_t...

As it turns out, creating the exception policies for the listed programs has resolved my issue. For some reason it took a very long time to take effect, even after forcing the policy update via the client. I can live with slow communication. Thanks everyone!

Awesome, glad it works