Endpoint Protection

A couple months ago I upgraded about 20 computers in our company, including myself, from SEP 11.0.6300.803 to the new 12.1.671.4971. Since then a good majority of them have experienced a very odd problem where parts of inactive windows "bleed through" onto active windows. It's actually a very hard problem to put into words. To try and describe it more clearly, if you have two maximized windows, say Window A and Window B, and Window B is on top of Window A, parts of Window A will "bleed through" Windows B and display themselves. Oddly enough they will sometimes bleed through, but end up showing themselves in a different location from where they really should be on the screen. This was happening so badly to 2 people that I actually had to downgrade them to the 11.x version, while other people seem to be able to live with it. In the 2 cases where I downgraded SEP the problem was completely resolved after the downgrade. Another note is that if the windows are bleeding through the problem can be temporarly resolved by minimizing and then restoring the active window on the screen.

Almost all of the computers I upgraded to SEP 12.1 were Windows 7 both 32 and 64-bit machines. I haven't noticed this problem on the XP machines that got the upgrade, but that could also be due to the fact that I upgraded very few. I have also noticed this problem on fresh installs of Windows 7 that never had SEP 11 installed at all.

When people started complaining about this problem to me the last thing I would have thought of was a SEP issue, but after reviewing everything it seems pretty definitive to me that the problem is SEP 12.1. With that said has ANYBODY experienced a similiar issue or have any clue as to what maybe causing the problem?

Have you tried basic performance tuning on the computers. I've seen this type of thing happen when the HD was fragmented badly.

Since the majority of the computers are Windows 7 they get defragmented on a weekly basis via a scheduled task. Also, since I'm seeing this problem on freshly deployed computers as well I don't believe that's the issue. I will double check a couple computers however just to verify the HDD fragmentation level.

Thank you for your input. Any suggestions as this point are definitely welcomed!

Do you have Aero enabled? If so, does disabling it resolve the issue? Or vice-versa if it's disabled?

It is enabeled, but I don't know if disabeling it will fix the problem. I can give it a try, but it will take a day or two to be certain. Is there some reason you think Aero will cause a problem?

We disabled Aero by GPO. It was causing other problems with our applications.

Hello,

Is this issue happening on IE Browser Windows or Windows Explorer ??

Do you see system too busy when you have installed SEP v.12.1??

What process is taking the highest CPU usage??

Does this happen when all feature set is installed on these machines??

Could you try installing SEP v.12.1 with only Antivirus / Anti-spyware and check if that helps?

We are looking forward for your reply.

Keep us posted.

• This problem seems to happen in quite a few different programs including non-microsoft apps.
• When this problem happens I have not noticed any correlation to high CPU usage. It seems to happen even durning low CPU usage periods. I do not know which process, if any, is signifigantly higher than others when the problem occurs.
• Yes this happens on machines with all features installed. I do not currently have any machines with just Antivirus installed, but can certainly modify one for testing purposes if need be.

On another note I realize now that I did have an older Windows XP machine that was having the same issue and actually have a screen shot of it that the user sent me. The downside is that this machine has since been replaced and is no longer available.

Seems to be an issue with the product... Could be a bug... Create a Support Ticket and report the issue so there could be a research done by Symantec. Also update the support ticket number thus we could track this....!

Hi Scott,

Is Aero enabled? If so, does disabling it resolve the issue?

Aero was enabeled on all of my computers, but I disabeled it on one computer last night and the user is still experiencing the same issue this morning.

That was my thought as well. I thought for sure though that with as many computers as I am experiencing this issue on that somebody else would have chimed in saying they have the same thing. I have a feeling contacting Symantec directly will have to be my next step.

If disabling or enabling Aero doesn't fix the issue, check to see if the Virtualization options, particularly VT-d mode for virtual direct hardware access are enabled. If so, try disabling those as these can also cause screen corruption.

Is the hardware all the same -vendor, BIOS version, video driver/monitor driver version?  Odd that SEP manifests this issue, as it seems like it should be a video/display issue.

The virtulization options you are talking about, I'm assuming those are BIOS settings?

No the systems that I have seen this problem on are not all the same hardware or even vendor. In fact the XP system that I noticed it on was an old P4 2.8 GHz model that I guarantee had no virtulization options at all.

can you post a screenshot of the problem?

Here is a screenshot of the problem. This time it happened in Microsoft Outlook. As you can see the reading pane has duplicated itself in the top lefthand corner.

At this point I have opened a support case with Symantec. When/if I come to a resolution I will update this forum thread. Hopefully, the issue is resolveable. 

I believe that reloading the video drivers are working.

Keep us posted if it is fixed.