Video Screencast Help

Endpoint Protection blocks internet activity every few minutes

Created: 09 Nov 2012 | 4 comments

I have Symantec Endpoint Protection version 11.0.6005.562 that I purchased through my University as a student.  For the last few months, I have continuously had the following issue: When accessing websites of all kinds, Symantec will periodically (every 5-10 minutes) I receive a notification like this or similar to it .  Followed by a notification saying "Denial of service logged."  After this, my internet connection is completely blocked for several minutes.  Since this happens every few minutes, it prevents me from getting anything done on the internet.  

Please advise as to the best way to deal with this issue.  Thank you.

Comments 4 CommentsJump to latest comment

Brɨan's picture

This was a bug in this version of SEP. This traffic is coming from a Comcast DNS server. You can disable Denial of Service protection although this isn't recommended.

Do you have the opportunity to upgrade to a newer version?

Since you're running the unmanaged version you can't add an exception.

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

Cameron_W's picture

Documentation regarding RU6/RU6a detections of DNS server detections. I would recommend moving to RU6 MP1 or newer to resolve this issue.

If I was able to help resolve your issue please mark my post as solution.

Chetan Savade's picture


Can you ask the university admin to provide you the latest SEP version?

Also, you should have all the SEP feature installed i.e. Antivirus & Antispyware , Proactive Threat Protection (PTP), Network Threat Protection (NTP).

All the features should have latest definitions.

Make sure operating system is updated with Microsoft updates and having latest service pack.

Disable autorun.

Chetan Savade
Sr.Technical Support Engineer, Endpoint Security
Enterprise Technical Support

Don't forget to mark your thread as 'SOLVED' with the answer that best helps you.<