Endpoint Protection

After upgrading to11.0.6005.562 on Windows 7 64bit copying very large files (300MB or more) over the network freezes the copying process.
When disabling "Bloodhound(TM) heuristic virus detection" in Heuristic scanning settings everything is fine.
Anyone else with the same problem?

Hmm I haven't heard of any reports of this yet. What version did you upgrade from? Do you think you could run the support tool so we can grab more info from you system.

About the Symantec Endpoint Protection Support Tool

http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/be437c7f369b39e688257489005c49ec?OpenDocument

Thanks
Grant

Grant, appreciate your fast reply.
I upgraded from the version which was available before the very latest one. Don't remember the number.
Don't want to run your support tool, because when the copying freezes, the machine needs to be cold reset. It will not should down, but hang at the logoff screen. Means after rebooting the machine will resync its mirrored drives which result in slow performance for hours.
I think I have to live with the workarround to turn off "Bloodhound". Hope it doesn't significantly increase my virus risk.

https://www-secure.symantec.com/connect/forums/sep-mr6-and-6a-random-issues-filey-copy-network-share

Hi Vmax,

Just letting you know i haven't forgot about your case. I am still looking into this since I have not seen this problem on the RU6 upgrade. Will keep you updated here.

Thanks
Grant

I have several machines that do the same thing since the upgrade to 11.0.6000.550.  If you end the process SMC.exe in taskmgr the file will finish copying, nothing else needs to be done because it usually will finish the copy before SMC starts itself.  If you have a very large file go into Services and disable Symantec Manager Client, go into taskmgr and end the SMC process, finish your copy.  Then go back and set the SMC service to Automatic again and start it.

This is not ment to be a fix just a temporary work around.

Our machines were upgraded from RU5  -> RU6 - RU6a. The copy process just stalls when you try to copy an executable of 50MB or larger. When you cancel the copy process it does not cancel it. Killing explorer.exe does not help. You have to reboot the machine and that does not work because it does not shut down so you have to force a shutdown. We have Bloodhound Scanning set to high.
 

Any new news?
We hold upgrade process because of this case.

Rgds, Jyrki

Grant, 5 weeks ago you wrote you didn't forget me, but it seems you did ...

Grant or anyone else still looking into the issue?

@Vmax8 - did you happen to put in a case for this yet? "Sometimes" fixes and suggestions come more quickly when issues like this go through Symantec's standard case submittal process.

-Mike

Mike,
too buys to put in a case with emailing log files etc.
Wish Symantec reads and follow up their own forums and fix this annoying problem.

We do read this forum, but there's not enough information here to turn around and give you a root cause.  You said yourself that you can't even run the Support Tool to gather information to post here.  I personally have not encountered this issue, and without logs and other information about your specific environment we can't really hazard a guess.  I didn't quite understand your last post... have you opened a ticket with technical support?

sandra

Sandra, I did not open a support ticket. From the other posts here, you can see, that I am not alone.

Sandra, I did run the support tool on two machines which show the problem. Where to should I send the reports?
Furthermore over time, I realized, that this problem does also occur randomly although when "Bloodhound(TM) heuristic virus detection" is disabled, however I can't recreate the problem. When "Bloodhound(TM) heuristic virus detection" is running, it happens every time.

"From the other posts here, you can see, that I am not alone."

I'm not unsympathetic, believe me, but without detailed, indepth investigation through official means (in the form of a support case), issues cannot get fixed.  We need examples and data to work with.  I hope some of the others on this thread have opened a case.

As for Support Tool results, were there any errors or warnings?  You could upload the results here for our perusal.

Thanks--
sandra

One machine no error, the other one with an error, which in my opionion can't be related to the issue. Where and can I upload the reports?

Look at the bottom of this page where it says "File Attachments". :)  It may need to be archived first as a zip.

sandra

Are there no confidential information in the file?

As no help from Symantec, testing following now:

https://www-secure.symantec.com/connect/forums/sep-mr6-and-6a-random-issues-filey-copy-network-share

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007100512163348

Sorry, got very busy at the end of last week.

Possibly IP numbers and your domain name, certainly a list of installed programs and other logs... which is why I enourage you to open a case if you have not already.

sandra

I don't doubt this is happening, but I do not know what help we can be expected to offer without receiving and reviewing data from an affected machine.  People can talk about the issue all they like on the forum, but without an official investigation in the form of a case, little can be done to actually resolve it.

sandra

After tracking this down for 6 hours, the problem ended up being RU6a.  Large backups were failing to network shares with no error making windows unresponsive.  Copies of large files would also stop midstream with no errors.

In both instances the programs copying the data to the network drive could not be terminated and windows would not shutdown gracefully requiring a hard shutdown.

After removing SEP RU6a the problem went away.  Reinstalling RU5 did not result in the same problem.

Why should we waste our time to open a case when Symantec QA should have caught this?  Last i checked we are the customers.  If you want to pay us to troubleshoot symantec products, then pay us for it :o)  I'm only saying this since the past cases resulted in no fixes and were a complete waste of time.

AliBaba0101, you are absolutely right.
Don you know where I can download RU5? I deleted it, and Fileconnect just shows RU6a.

unfortunately it looks like its no longer available for download. I had my old copy still on my server.  sorry :(

Why should we waste our time to open a case when Symantec QA should have caught this?

I don't work in QA but I can venture to guess that this is because not every environment and every possible configuration can be duplicated in a lab.   The only way to fix something like this is to have the data to track down the root cause.

sandra

Found RU5 on an off-site backup. Installed it. The file copying problem disappeared. It's clearly a RU6a issue.

Just another observation after removing RU6a and installing RU5 on the workstations: Frequent network connection errors in MS Access 2010, which connects to a database on a server, disappeared.
Hope RU7 will be better.

Is there a convenient way to move back to RU5? I tried putting it into the "install packages" tab of the sepm but it won't delete the newer ru6 versions on the client... so how do I downgrade?

The only way to downgrade is to remove and reinstall the SEP client.

Just out of curiosity, has anyone experiencing this issue actually opened a support case?

sandra

Hi Sandra,

I opened a support case (# 412-498-511) via the support website

So I have to do that seperately on every Client? Geeee...

Great, thanks.  So you've narrowed this down to NTP?  This is definitely not related to the earlier issue, then; that was AV/AS-related.

I was not aware of this other thread, so thanks for that too:

https://www-secure.symantec.com/connect/forums/cannot-copy-files-using-smb-20-protocol-sep-11-ru6-and-ru6a

sandra

We are experiencing the same issue copying files aftering updating to version RU6a. (Vista 32 bit and 64bit)

It's causing some serious headaches as we work with some very large files.

Stopping SMC.exe service seems to fix the problem.

Is any of your machine Netbook or connected through a VPN kind of?

No VPN at all.

No VPN here either.

Sandra, someone opened a support case. Any result?

ETH0 will have to bring us up to date on his/her case.  I can't discuss customer cases and I am not working it, so am not familiar with it.

sandra

I had this issue too.  Win7 64BIT EE, Win XP...  All after upgrading to RU6.  

https://www-secure.symantec.com/connect/forums/cifs-blocked-sepm-1106a-win7-64bit-ee

I also added some new CIFS allow rules for the new methods Win7 uses to the allow file sharing rule.   I believe it was UDP on the same old CIFS ports vs TCP/IP.  Can't say 100% for certain.

I did have the issue a few times after making the change, then it was gone.   I haven't had the issue in months now.  

If this problem is linked to the issue raised in this thread:
http://www-secure.symantec.com/connect/forums/cannot-copy-files-using-smb-20-protocol-sep-11-ru6-and-ru6a

It would appear Symantec have acknowledged there is a problem.

Seems to be the same problem as the link mentioned by asistephen. Can't get it, why it takes Symantec 3 month to acknowledge it.

I had a case opened for this problem. Symantec Support called me and confirmed that it is considered a defect in the product. The suupport engineer did not know when (in what version) they will fix it. He advised me the disable SMB2.0 as a workaround.

The problem is caused by the NTP component. The problem only occurs when SEP RU6a / MP1 is installed and the NTP component is installed (disabling policy does not help) and files are being copied to another machine using SMB 2.0. I tested with SEP RU5 (unmanaged) on same machine and problem did not occur.

Hopefully they will fix it soon because we have disabled NTP for the time being (that is three months already) until this problem is solved. That means we cannot use Application and Device Control either because it depends on NTP.

 

Symantec QA should be fired for this oversight.  I'm not sure what can be more basic than a simple file transfer test.

Before anyone blindly applies the registry fix/s referenced above....here is a good page to take a gander at first.

http://technet.microsoft.com/en-us/library/ff686200(WS.10).aspx

-Mike

Greetings all,

I have the same problem.  SBS2008 sharing folders with clients running windows 7 that have those shared folders mapped on the client machines.  Copying files to the server takes forever, hours, sometimes freezes.  I have removed symantec endpoint from the server, and everything is back to normal.  I doubt it has to do with windows.  There has to be an issue with symantec that makes this happen.  Has anyone had the same problems trying another virus scanner on the server?  I would like to go with another protection solution since symantec doesnt provide one.

Hi zcyx,

Do you have SEP + NTP installed on the clients and copy files using SMB2.0? This is causing the problem. There are three workarounds for this problem:
1) Force the clients/workstations to use SMB1.0 instead of SMB2.0 via registry or group policy.
2) Uninstall SEP NTP component from clients and loose firewall, IPS and application and device control
3) Downgrade to RU5.

We are still waiting for a fix from Symantec.