Endpoint Protection

Hi,

I list issue of MR4 MP2 on computers on company :

The computers have all modules installed (ntp, application and devices control, etc... only the email modules is not installed). All computers was updated from MR3 to MR4 and after to MR4 MP2.

* computers not show status on manager and smc.exe use 50% of cpu
* Ip configuration was deleted when updated from manager (policies packages) and i see in configuration a problem with teefer2 driver. The only solution is to remasterize the computers.

Have you solution for this problem ? Have you solution to uninstall teefer2 driver ?

I have tried with cleanwipe but there is not effect, the teefer2 driver is present and i can't uninstall it from configuration panel.

thanks in advance for your help

First delete the reg entry for it
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.Teefer2
And then search for teefer in registry and delete all its entries
Then open device manager -View-Show hidden devices--Non Plug and Play drivers-Teefer2 -Un-install.

Hi Eddy,

What machine config are using in your environment.

After upgrading to MR4MP2, we are not facing any of the issues which you have mention above.

Rgrds,
SAM

 Even after running the clean wipe if you are not able to remove the teefer 2 driver the then try removing the teefer2 from device manager if still the smae then uninstall & re-install the network card drivers is the easy solutions.

Hi,

I use windows Xp Pro SP3 for computers. The servers is on Windows 2003 R2 SP2.

Regards.

Hi,

I have tried to run cleanwipe and / or delete from device manager (in safe mode and in normal mode).. The driver cannot unistalled. When i suppress the regisry keys for teefer2, all teefer2 is deleted from devices manager. but the networkk card doesn't (the ip configuration is ok) but no icmp no resolution, nothing is ok....

I think when i have migrated tp MR4 MP2 the upgrade has damaged a file.

Hi,

To uninstall teefer2 network driver, 

go to  the properties of LAN, Select teefer2 driver and click on uninstall.

The driver will get uninstalled.

Hi,

I don't see it in propreties of lan. It's only on device manager.... And cannot unistall it from device manager

For security reasons Teefer2 was removed from Lan Properties from MR3 onwards.
 

Teffer2 is by default hidden in MR3 onwards.

How are these clients connecting to the SEPM. We are seeing an issue that seems to be affecting computers that connect to the SEPM via a VPN client. More information can be found in the ongoing thread here:
https://www-secure.symantec.com/connect/forums/smcexe-using-50-or-more-processor-while-vpned-office#comment-2662281

If your clients are connecting via VPN then this could be the cause of the high CPU usage. If this is the case please post or PM me and I would like to get some further information from you to help solve this issue.

Thanks
Grant

is there already a fix on this Team?
Since more companies are now using VPN to connect away from the office...
these laptops also are prone to infection...

The computers where smc.exe use 50% of cpu doesn't have VPn software....  But i see the ip adress gateway is not in the same vlan's of ip adress. when i change gateway adress to the same vlan of ip adress. smc client can synchronize directly on Sepm and not use 50% of cpu time.

@ eddy_fazer Thanks for sharing this, I am going to add this info to our thread located here: https://www-secure.symantec.com/connect/forums/smcexe-using-50-or-more-processor-while-vpned-office

@ Nel We are aware of this issue and things are already in the works to get this problem solved. If you want to checkout the link that I posted above you can see a couple of workarounds, however this are NOT solutions yet. Also this problem seems like it is caused by the recent upgrade to MR4MP2. So the one possible workaround is to roll back to the previous release of SEP that worked in your environment. I know this is not ideal and I will probably get flamed for saying it, but until we get this worked out this might be the best workaround. Again more possibles are located in the link above. I am also posted any new information that i hear on this issue, so as soon as I know you guys will. Thanks.

Grant-

The computers where smc.exe use 50% of cpu doesn't have VPn software.... But i see the ip adress gateway is not in the same vlan's of ip adress. when i change gateway adress to the same vlan of ip adress. smc client can synchronize directly on Sepm and not use 50% of cpu time

Thanks for that tip, for every admins tired of searching for that solution.

If your SEP client's gateway is for example 10.100.9.1 but the ip of your client is 10.100.8.XX you will experience SMC.EXE at 90-99% after trying to install a new installation. I lost another day working on a fail update of Symantec (MR4 MP2). I tried everything before seeing that potential solution by a "customer" like me and not even a support guy. Sylinkdrop, SylinkReplacer, SylinkMontinor.. Nothing worked until I decided to give a go to changing the IP. Little over 10 sec after the ip change I saw a green dot and the client was reporting in the SEPM.

Symantec needs to give us solutions for those things, and fast. You can't ask people to call in India for your support everytime we have an issue (It happen too often). I had issue with every patches you guys gave us. I have SEP 11 since before the MR1, it was an error that I won't make again.  You gave us a beta to test to save on testing or whatever reason. That will bite you in 2-3 years when Admins like me will choose another product.

I think I lost 3 weeks of working time in 1.5 years on SEPM/SEP, that is not normal to spend that much time on an AV software. Errors/failures can occur but please don't let your customer in the dark, find a solution and put it on your website or deploy a fix.

Check you IP and default gateway

sample:
   ip=192.168.30.111
   wrong default gateway=192.168.10.1
   correct default gateway=192.168.30.1

Hi guys,

A strange thing happens in our setup. If I change the IP address from dynamic to static the client can reach the management server. There are no IP/GW issues as mentioned above neither in dynamic or static allocation of the IP address. Using the Sylink Monitor tool I have noticed that if the IP is allocated dynamically, the logging stops before checkpoint 5.1. This happens with the MR4 MP2 client. Any ideas?

Regards,
Raul

have you seen an entry of tefeer in services.msc? if so try to disable it

Hi mallcop,

You should try to make a new thread instead of posting on existing topics. This lets you have control of the thread to do things like post logs, screenshots, and mark answers as "the solution". If you feel this thread is relavent feel free to make a link to it in your new thread. You will usually get more answers by making a new thread, because a lot of people will skip over threads they see that are very old.

Cheers
Grant