Hi,

We have a small company network of 12 computers (all Windows XP professional SP3) plus a server (Windows Server 2003 R2 SP2). We've been experiencing errors with smc.exe. Fortunately, it's not a frequent error, but when it does happen it will bring the entire network down: no internet activity or intra-network activity, as well as frozen software.

We run the Symantec Endpoint Protection Small Business Edition v.12.1.671.4971.

The error happens only in the server machine.

I was able to pull these error messages from the server's event viewer:

1. Event Type:    Error
   Event Source:    Application Error
   Event Category:    (100)
   Event ID:    1000
   Date:        4/24/2014
   Time:        12:35:16 PM
   User:        N/A
   Computer:    CHLORINE
   Description:
   Faulting application Smc.exe, version 12.1.671.4971, faulting module ntdll.dll, version 5.2.3790.4937, fault address 0x0001bb52.

   For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
   Data:
   0000: 41 70 70 6c 69 63 61 74   Applicat
   0008: 69 6f 6e 20 46 61 69 6c   ion Fail
   0010: 75 72 65 20 20 53 6d 63   ure  Smc
   0018: 2e 65 78 65 20 31 32 2e   .exe 12.
   0020: 31 2e 36 37 31 2e 34 39   1.671.49
   0028: 37 31 20 69 6e 20 6e 74   71 in nt
   0030: 64 6c 6c 2e 64 6c 6c 20   dll.dll
   0038: 35 2e 32 2e 33 37 39 30   5.2.3790
   0040: 2e 34 39 33 37 20 61 74   .4937 at
   0048: 20 6f 66 66 73 65 74 20    offset
   0050: 30 30 30 31 62 62 35 32   0001bb52

2. Event Type:    Error
   Event Source:    Application Error
   Event Category:    (100)
   Event ID:    1000
   Date:        4/24/2014
   Time:        12:34:10 PM
   User:        N/A
   Computer:    CHLORINE
   Description:
   Faulting application Smc.exe, version 12.1.671.4971, faulting module ntdll.dll, version 5.2.3790.4937, fault address 0x0001bb52.

   For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
   Data:
   0000: 41 70 70 6c 69 63 61 74   Applicat
   0008: 69 6f 6e 20 46 61 69 6c   ion Fail
   0010: 75 72 65 20 20 53 6d 63   ure  Smc
   0018: 2e 65 78 65 20 31 32 2e   .exe 12.
   0020: 31 2e 36 37 31 2e 34 39   1.671.49
   0028: 37 31 20 69 6e 20 6e 74   71 in nt
   0030: 64 6c 6c 2e 64 6c 6c 20   dll.dll
   0038: 35 2e 32 2e 33 37 39 30   5.2.3790
   0040: 2e 34 39 33 37 20 61 74   .4937 at
   0048: 20 6f 66 66 73 65 74 20    offset
   0050: 30 30 30 31 62 62 35 32   0001bb52

3. Event Type:    Information
   Event Source:    Application Popup
   Event Category:    None
   Event ID:    26
   Date:        4/24/2014
   Time:        12:32:51 PM
   User:        N/A
   Computer:    CHLORINE
   Description:
   Application popup: Smc.exe - Application Error : The instruction at "0x7c81bb52" referenced memory at "0x656e6547". The memory could not be "read".

   Click on OK to terminate the program
   Click on CANCEL to debug the program

   For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

4. Event Type:    Information
   Event Source:    Application Popup
   Event Category:    None
   Event ID:    26
   Date:        4/24/2014
   Time:        12:35:57 PM
   User:        N/A
   Computer:    CHLORINE
   Description:
   Application popup: Microsoft Visual C++ Runtime Library : Runtime Error!

   Program:

   
   This application has requested the Runtime to terminate it in an unusual way.
   Please contact the application's support team for more information.

   
   For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

5. Event Type:    Information
   Event Source:    Application Popup
   Event Category:    None
   Event ID:    26
   Date:        4/24/2014
   Time:        12:42:05 PM
   User:        N/A
   Computer:    CHLORINE
   Description:
   Application popup: Microsoft Visual C++ Runtime Library : Runtime Error!

   Program: C:\Program Files\Symantec...

   R6025
   - pure virtual function call

   
   For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

6. Event Type:    Information
   Event Source:    Application Popup
   Event Category:    None
   Event ID:    26
   Date:        4/24/2014
   Time:        12:42:10 PM
   User:        N/A
   Computer:    CHLORINE
   Description:
   Application popup: Smc.exe - Application Error : The exception unknown software exception (0x40000015) occurred in the application at location 0x6ae86401.

   Click on OK to terminate the program

   For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

 

When this happens, the only thing we can do is to restart the server, the router and our ISP modem. That gets our network working again.

Does anybody have any ideas as to how can i prevent this from happening?

Thanks!

Can you try 12.1.4 MP1 thats the latest version..

it used to crash if client was gup

Are any of these GUPs? I would upgrade first to latest version if it still happens call support

Hello, 

recommened to upgrade to newest version.

Regards

Ajin

Hi,

Thanks to all for your suggestions. I have been trying to upgrade our software, but while the linked upgrade help document tells all the steps to do so, there is no explanation as to how to obtain the software upgrade. My Endpoint Manager has never even suggested that there's a new version out and i see not way to download the upgrade from there.

Can anyone tell me how to obtain the software so i can then upgrade the server and all clients?

Thanks!

You can obtain from https://fileconnect.symantec.com using your serial number.

Hi,

I went to the symantec file connect website, put it the serial number and got to the files. But the only available software is an older version than the one we have.

We are already running version 12.1.671.4971 installed. But i can only download version 12.1.4a. That looks to me to be an older version of the endpoint protection.

Am i reading this right? Is version 12.1.4a newer than 12.1.671.4971?

Thanks for your help!

Correct 12.1.4a is newer as 12.1.671.4971 is the very first version of 12.1

Just to note, the latest version of 12.1 is RU4 MP1a.

We have installed the SEPM version 12.1.4104.4130.

We have tested the new SEP client version: 12.1.4100.4126

The problem with Smc.exe still exists on computers with GUP role on Win7 (App event from today):

Faulting application name: Smc.exe, version: 12.1.4100.4126, time stamp: 0x532a1666

Faulting module name: ntdll.dll, version: 6.1.7601.18247, time stamp: 0x521ea91c

Exception code: 0xc0000005

Fault offset: 0x00055f1b

Faulting process id: 0xdac

Faulting application start time: 0x01cf6a9d453eb178

Faulting application path: C:\Program Files\Symantec\Symantec Endpoint Protection\12.1.4100.4126.105\Bin\Smc.exe

Faulting module path: C:\Windows\SYSTEM32\ntdll.dll

Report Id: 4433b0a4-d693-11e3-a1eb-b8ac6f31d794

 

This problem was in version 12.1.4013.4013 and still has not been resolved (App event from previous version)!

Faulting application name: Smc.exe, version: 12.1.4013.4013, time stamp: 0x52647bec

Faulting module name: ntdll.dll, version: 6.1.7601.18247, time stamp: 0x521ea91c

Exception code: 0xc0000374

Fault offset: 0x000c3873

Faulting process id: 0x344

Faulting application start time: 0x01cf644fa6e6f377

Faulting application path: C:\Program Files\Symantec\Symantec Endpoint Protection\12.1.4013.4013.105\Bin\Smc.exe

Faulting module path: C:\Windows\SYSTEM32\ntdll.dll

Report Id: 9ee32043-d045-11e3-80c6-b8ac6f31d794

 

Better to open a support case as this was supopsed to be fixed.

We migrated from SEP 11.x - used since 2009. I have started testing with new installed version SEP 12.1 RU2(April 2013). After this I was tested SEP 12.1 RU2 MP1 (June 2013) but first version installed on ~2000 clients was SEP 12.1 RU3. When was published the next version SEP 12.1 RU4 the new clients have been installed with this version (~5000 clients). All of this tested and installed version have some errors that was not resolved for tooday with published SEP 12.1 RU4 MP1 (a). My dream is stable SEP Any version.

Thank you all. I've finally managed to upgrade our SEPP to the latest version and, at least for now, we've had not issues.

 

Thanks for your help!