Endpoint Protection

 View Only
Expand all | Collapse all

Client gives Server Busy message on scan (take 2)

Rafeeq

RafeeqMar 02, 2011 07:26 AM

Migration User

Migration UserMar 03, 2011 07:24 PM

  • 1.  Client gives Server Busy message on scan (take 2)

    Posted Mar 02, 2011 07:06 AM

    Hi support,

     

    I have run into this issue where no scan can proceed and attempting a scan produces the following message:

    Sever Busy
    This action cannot be completed because the other program is busy.  Choose 'Switch to' to activate the busy program and correct the problem.
    Switch to /Retry

    I have read and applied the solution to this issues as suggested in this other post:

    https://www-secure.symantec.com/connect/forums/client-gives-server-busy-message-scan

    I am worried however that, if I were a virus designer, this would give me a perfect recipe for bringing down SEP and bypass the antivirus protection: i.e. copy vpmsece.dll in the location where SEP does not want to see it, kick off a scan, and, tada!!! ... virus shut down. From the posts I've been reading, it does not seem like the Symantec support is giving this issue all the attention it deserves: it is after all a serious and real security loophole. A better response than a hacky workaround is needed in a case like this. Please advise.

     

    Btw, I ran into this issue on a Dell PC running win7 enterprise. It's a 64 bits machine, so the dll file mentioned in the referenced post was not in the advertised path but under

    c:\program files (x86)\common files\Symantec

    instead.

     

    Thank you for your support.

     

    L.

     



  • 2.  RE: Client gives Server Busy message on scan (take 2)

    Posted Mar 02, 2011 07:26 AM

    are you on the latest version 11.0.6??



  • 3.  RE: Client gives Server Busy message on scan (take 2)

    Trusted Advisor
    Posted Mar 02, 2011 08:08 AM

    Hello,

    This problem seems not related to Symantec Endpoint Protection or Backup Exec DLO but envionmental.

    This comes up because some resources needed by application (in this case DLO Live Update) are not met which results in this pop up message.

    To resolve and more information on this issue please follow the following links.

    http://seer.entsupport.symantec.com/docs/324876.htm
    http://seer.entsupport.symantec.com/docs/324210.htm



  • 4.  RE: Client gives Server Busy message on scan (take 2)

    Posted Mar 02, 2011 08:57 AM

    Hi Rafeeq,

     

    I think so, version tag is 11.0.6200.754.

     

    L.



  • 5.  RE: Client gives Server Busy message on scan (take 2)

    Posted Mar 02, 2011 09:05 AM

    do u have anyother product which would conflict with symantec wrt to resources, say like backup softwares, imaging software??



  • 6.  RE: Client gives Server Busy message on scan (take 2)

    Posted Mar 02, 2011 09:16 AM

    Hi Mithun,

    I'm running Win7. Apparently, in this version I don't have a Tools - Options - LiveUpdate menu in the Netbackup Desktop Agent (I suppose this is what you mean by DLO as I don't have anything called DLO on my system?).

     

    Thanks.

     

    L.



  • 7.  RE: Client gives Server Busy message on scan (take 2)

    Posted Mar 02, 2011 09:25 AM

    DLO version tag is:

    Symantec Desktop and Laptop Option for NetBackup 6.1 MP4, Build 350B1 4b.



  • 8.  RE: Client gives Server Busy message on scan (take 2)

    Posted Mar 02, 2011 10:33 AM

    I am worried however that, if I were a virus designer, this would give me a perfect recipe for bringing down SEP and bypass the antivirus protection: i.e. copy vpmsece.dll in the location where SEP does not want to see it, kick off a scan, and, tada!!! ... virus shut down.

    But this issue hasn't (to my knowledge) caused SEP itself to be disabled or for Auto-Protect to stop working, which is what you are describing. Or are you saying that is that what you're seeing, that you are able to drop an EICAR test string on the system and it's not being detected?

    My suggestion would be that if you're experiencing this with the most current builds of your Symantec software then I strongly recommend you give Support a call so we can look into this and gather data. An issue similar to this was resolved in SEP with RU6. What you're seeing now may have a different cause altogether.

    sandra



  • 9.  RE: Client gives Server Busy message on scan (take 2)

    Posted Mar 02, 2011 12:41 PM

    Hi Sandra,

     

    Sorry I don't understand what you mean by "you are able to drop an EICAR test string on the system". What I'm saying is that upon resuming from sleep state when I came to the office this morning, I tried to connect to my company's VPN network and the client would not let me through because SEP was down. I checked SEP and saw that it had been indeed turned off, although not by me. After that I was unable to get it running again and perform a successful scan, even after rebooting, manually restarting the service etc... . So I googled the error and found the post I refer to in my first message. I applied the workaround advertised in the message which basically consist in renaming a DLL file. I took this to mean that the SEP shut down was caused by the presence of that DLL file in that location, but apparently, I can now perform the scan even if I reinstate the incriminated DLL file, so there is more to it than just adding or removing a file. So forgive my ignorance, it is hopefully just a false alert. What is true however is that some combination of events caused SEP to shut itself down without my consent or intervention and that renaming that DLL file apparently removed the deadlock.

     

    Regards,

     

    L.



  • 10.  RE: Client gives Server Busy message on scan (take 2)

    Posted Mar 02, 2011 01:18 PM

    EICAR.org provides a downloadable test string to test whether your realtime protection is working. It is harmless so that you can test functionality (by attempting to download the file) without actually putting your system at risk.

    I don't think the presence or absence of this file is the cause of what shut SEP down. Did you see the scanning issue happening prior to this morning? I would look in the SEP logs and the Windows event logs to determine when the service was stopped. Perhaps repair the installation in Add or Remove Programs.

    I just looked on my own installation (mind you, I don't have email scanning tool installed) and this file is not present. I am able to scan without issue.

    sandra



  • 11.  RE: Client gives Server Busy message on scan (take 2)

    Posted Mar 02, 2011 06:00 PM

    As sandra.g have posted, AutoProtect is not offline during that message.

    That message simply saying that when you want to perform a Scan, the scan module [client] will contact its server [ccapp] saying that " I want to perform a scan, can you please note this down ?"

    The server maybe busy handling other transaction hence the error is displayed because scan module have waited x miliseconds without any response.

    I found this issue a lot when a Outlook Auto protect component is used and somehow in stall / hung mode.

    Best to call Symantec Support and raise a case with us.

    Some of the Support team do frequent the forum but from my knowledge, this forum is not an official means of support.

     



  • 12.  RE: Client gives Server Busy message on scan (take 2)

    Posted Mar 03, 2011 07:44 AM

    Sorry, I have to disagree: what I was seeing after I ran into that problem was that the Antivirus and Spyware protection was reverted to 'off'. For instance, at one point I rebooted my computer. This caused the Antivirus and Spyware protection to be reverted to 'on' status. After attempting a scan I got the message again, and visiting the status page after that showed that the protection was turned off. I did not turn it off myself, therefore it must have turned itself off because of this issue.

    I don't think I can raise a case because I am not currently experiencing this problem: I solved it using the method advertised on this forum (https://www-secure.symantec.com/connect/forums/client-gives-server-busy-message-scan), i.e. by temporarily renaming the DLL. I would like to make sure I don't run into the same issue again by applying the DLO settings change as suggested by Mithun above, but apparently my version of DLO does not provide the settings option that I need to change, so Mithun's suggestion does not seem to apply to my case.



  • 13.  RE: Client gives Server Busy message on scan (take 2)

    Posted Mar 03, 2011 05:32 PM

    vpmsece.dll is Outlook AP plugin.

    And you can open a case and ask the Engineer to investigate based on the available evidence.

    some of the Support team have a Sherlock Holmes like talent :)

     



  • 14.  RE: Client gives Server Busy message on scan (take 2)

    Posted Mar 03, 2011 07:24 PM

    Will do!

     

    Thanks everybody for helping.