Endpoint Protection

Hi All,

We have symantec endpoint protection 11.0 running on a windows 2003 sp2 32 machine.

Suddenly it is blocking randomly http requests , when disabling the symantec management client, the blocks are gone.

we found that after there was a minifilter update the problem occured.

if we do every second 1 request , we can sometimes see (randomly ) it is being blocked.

 

We have similiar software on another similar machine where the problem not occur.

 

please help.

 

thanks in advance.

 

gr.

Peter

do you see the traffic in the logs of traffic or packet?

Can you copy it over here?

 

Minifilters are Symantec Antivirus Drivers which get loaded up when Symantec Antivirus either gets updates or when the Symantec Antivirus Application starts itself. For Example: when you restart the machine and the Symantec Antivirus application Loads itself.

Basically, these drivers gets loaded automatically, when the machine gets restarted.

You shoudl check your firewall rules/logs, u might be able to see the rule which is blocking the traffic

Hi,

 

i switched of all rules (as far as i know) and still get blocked.

gr.

Peter

 

 

 

 

if the logs are not shpowing up, do you see any event id in teh application event viewer logs during the block?

http://www.msnbc.msn.com/id/44893608/ns/technology_and_science-tech_and_gadgets/ We are seeing the same thing on networks behind three different firewalls. We are starting to think it is not us. We are seeing this on AS400s too. Apparently iOS5 is hitting the Internet hard.

lol...i think i saw that yesterday in the news.

 

btw peter what you can try, you may want to disable SEP for awhile n monitor the performace... if still failed means something else is doing it..

Hi,

 

This is what is in the logs : just before it started

in the application log: New virus definition file loaded. Version: 131008h.

in the system log :  Symantec Antivirus minifilter successfully loaded.

 

i disabled the services one by one and the service where it stopped is : Symantec Management Client

so when stopping this service the problem goes away, all other symantec services had no impact .

gr.

PEter

For whatever it is worth, our similar problem has continued today 10/14/2011.

Hi Pete ,

Any hints for me?

 

thanks in advance.

gr.

Peter

Hi PrimeInc,

 

i dont see the relevance in this?

gr,

Peter

I think it's time to log a case to Support, maybe they can do check from diffrent view,,,

 

sometimes you'll be amazed with hidden KB (related to a problem) that's exist for SEP... only Support know more..