Endpoint Protection

I have read topic about Excel being slow after upgrading to RU6a, but in my case it is not just slower. If a user tries to save a file on a network share it shows saving progress and never finishes and one has to reset a computer, because it is not possible to kill Excel process (Windows Vista Business SP2). Also this sometimes happens while editing xls files on desktop. But i think these file may have links to other xls files on a share. We are using old xls format. This doesn't happen with XP machines. I have tried to uninstall SEP and install 11.0.5002.333 version on the problematic computers and so far this seems to fix the problem.

When Excel hangs in event logs there is a messages about hanging app:

0000: 006E0055 006E006B 0077006F 0000006E
0008: 0000
In Bytes
0000: 55 00 6E 00 6B 00 6E 00 U.n.k.n.
0008: 6F 00 77 00 6E 00 00 00 o.w.n...
0010: 00 00 ..

I have checked AV policies on my groups and they haven't been changed after the upgrade to RU6a. Bloodhound level is set to Default.

As about XP machines, they are with Office 2003, so maybe that's why they are not affected.

What components of SEP are insatlled?

On one machine remove IPS and see if that helps

Hi,
If you are using application rule in your n/w for protect SEP agent, so exclude.doc, .xls and docx, .xlsx. These are extension scanning while you save your file in network. more information find attach file.

IPS? Do you mean NTP - Network Threat Protection module? I can try isntalling SEP without it, but i'm guessing SEP Firewall will stop working? Then it is not an option for us.

We are not using Application Control policies because of the issue with newest SEP versions. Some applications which are using shares stop working with that policy turned on. Also this is not an option to exclude those file types. We get lots of them from our clients, don't want to risk.

No IPS is a subcomponet of  NTP .

Just disable it for the timebeing to isolate the issue.

Looks like XP/Office 2003 machines are affected too. So far it happens only with one file, xls file which has Workbook Sharing enabled. I have tested with 4 machines and if user has write rights to this file, it will crash Excel. If user has only read-only rights (NTFS), when it is not crashing. Also computers with Vista/Office 2007 are fine with this file. If i disable Workbook Sharing in this file, when Excel 2003 is not crashing.

When i installed older SEP version on one of these XP machines it is working fine with this file, even if Workbook Sharing is enabled.

We have seen simliar issues where Auto Protect in RU6 has caused issues, this issue would be fixed in RU6. What i would recomend you to call support and log a case so that we can verify if this is the same issue or a diffrent issue.

I have uninstalled IPS from NTP module on one pc with Vista/Office2007 and user says, that now Excel is not hanging on saving. So, maybe this is indeed IPS fault in Office 2007 case.

I don't believe it is possible at this time to granularly uninstall IPS without uninstalling the firewall.  The drop-down clearly shows "Firewall and Intrusion Prevention".  This is why people who want to use IPS without the firewall must withdraw the firewall policy as opposed to uninstalling.  I do not know if withdrawing the IPS policy will have a similar effect.  (It is not recommended to keep IPS disabled for security reasons.)

Title: 'Best practices regarding Intrusion Prevention System technology'
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2009080314433948

Is there anything in the user's logs to indicate a firewall rule or a specific IPS detection is what's causing this?

I have not found anything relating to Excel 2007, only this:

Title: 'Modifying/Saving large Microsoft Excel 2003 files onto a network share causes the computer to freeze'
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2008122910042048

sandra

When your machine freezes...  and you are unable to kill the Excel process locally, from a remote machine...

Open a Command Prompt.

"TASKKILL /S [computer_name] /IM Excel* /F"


Taskkill allows you to terminate a process on a machine, local or remote.  To specify a remote machine "/S [computer_name]".  Specifying a process by name as opposed to PID, /IM [process_name].  /F forces the process to end. 

If it can help you stop rebooting your machines... at least there's that.

TASKKILL is not helping in this situation. I don't remember exactly what output was, but it can't access hanging excel process. The only way is cold reboot of that PC.

We are slowly reinstalling clients to older version. Is there any way to do a downgrade to older version via SEPM? Or maybe with a deployment tool?

Is it happening while saving  ALL Excel files, or just wihile saving  Excel files with macros?????

http://www.symantec.com/connect/forums/cannot-copy-files-using-smb-20-protocol-sep-11-ru6-and-ru6a
http://www.symantec.com/connect/forums/copy-over-network-freeze-when-copying-large-files
http://www.symantec.com/connect/forums/sep-mr6-and-6a-random-issues-filey-copy-network-share

Kill smc.exe -> Excel works again.

rgds, Jyrki

I can't tell for sure. But it looks like it can be files without macros. Just huge files with tons of text information, filters and some formulas. Opening such file doesn't ask about enabling Macros (and we have moderate level set), so i think there is no macros at least in one last file, which caused hangs with RU6a.

I'll suggest to install a Unmanaged Client with all features enabled on 1 machine.

Then review the real time Traffic,Security logs and find out what is getting blocked and where.Then create required Rules to allow them.

If it is related to Network threat Protection then its either firewall or IPS but we need to find out which Firewall rule or which IPS Signature is causing this behavious so that we can modify the rules/action

Disable the  file system auto-protect in SEP Then see if you are able to save.

Killing smc.exe does seem to fix excel for that session, unitl next restart.

Well, i have one machine i can test on (not for a long), and i have few documents in a share and most of the time i'm able to reproduce hangs. What exactly should i look for? And what tool should i use? I have tried to watch smc.exe with Process Monitor while Excel is hanging on save. I see some Buffer Overflow or Name not found errors related to DNSclient or Tcpip\Linkage\Bind registry entries. I don't see anything relevant in Security log. Monitoring traffic? Say with Network Monitor or Wireshark? That would be tons of packets. I need to know what should i look for, what to filter out.

Could you  install ru6 mp1, and see??

as I wrote before, look those feeds. This is same problem like many users have with file copying.
SEP versions RU6, RU6a and RU6MP1 have some bug at ntp component.
I guess, target file share resides at Windows 2008 srv or Vista wks.
Everything works if files share is located in Windows 2003, 2008R2 server or Windows 7.
Just wonder where is Symantec QA? Three months already gone with this mess.

Rgds, Jyrki

I have tried the MP1, it behaves the same. Share is on Windows 2008 x64 (not R2).

if you save excel sheet newer xlsx format, i think it success. Size is much smaller.
We have also copying problem, did you try that?
I made many manual downgrade from RU6 to RU5...

Rgds. Jyrki

We don't want to switch to xlsx yet as we have many computers with 2003 version and also clients with older systems. We don't want our 2007 users to add unsupported features to their documents, so we force usage of xls.

Helped fix my SAMBA issues on Windows 7 and Windows Vista.

**********************
Control Panel - Administrative Tools - Local Security Policy

Local Policies - Security Options

Network security: LAN Manager authentication level
Send LM & NTLM responses

Minimum session security for NTLM SSP
Disable Require 128-bit encryption

Another observation. On many computers while doing shutdown End now message is thrown with ccApp being a cause. This is a part of SEP. If user doesn't press End now, it won't shutdown usually. I see this window even on my machine, though i have more RAM than average users. Slowly downgrading almost everyone. Will think double twice before upgrading SEP again.

For this issue you can uninstall mail scanning components of the SEP client...

The issue is targetted to be fixed in next release 11.0_RU7. We do not have information about when it will be released.
http://www.symantec.com/connect/forums/cannot-copy-files-using-smb-20-protocol-sep-11-ru6-and-ru6a

I think twice before buy new maintenance after license expired. I remember clearly MR4MP1 ntp bug beginning of year 2009:
http://www.symantec.com/connect/forums/maintenance-release-4-maintenance-pack-1-mr4-mp1

Rgds, Jyrki