Video Screencast Help

"Smc.exe - Application Error" driving us MAD here

Created: 18 Jan 2008 • Updated: 21 May 2010 | 13 comments

After installing MR1 (ou just upgrading from SEP 11.0.780 to SEP 11.0.1000), a lot of machines start crying:



We select OK, and after some minutes the error message appear again, and again, and again, and again, and again, and again, and again, and again...
Also, an event log is written at Application Log:

Code:
Event Type:       ErrorEvent Source:   Application ErrorEvent Category: (100)Event ID:           1000Date:                17/1/2008Time:                16:07:31User:                N/AComputer:         DTI037Description:Faulting application Smc.exe, version 11.0.1000.1091, faulting module tse.dll, version 11.0.1000.1091, fault address 0x0002002d.For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.Data:0000: 41 70 70 6c 69 63 61 74   Applicat0008: 69 6f 6e 20 46 61 69 6c   ion Fail0010: 75 72 65 20 20 53 6d 63   ure  Smc0018: 2e 65 78 65 20 31 31 2e   .exe 11.0020: 30 2e 31 30 30 30 2e 31   0.1000.10028: 30 39 31 20 69 6e 20 74   091 in t0030: 73 65 2e 64 6c 6c 20 31   se.dll 10038: 31 2e 30 2e 31 30 30 30   1.0.10000040: 2e 31 30 39 31 20 61 74   .1091 at0048: 20 6f 66 66 73 65 74 20    offset 0050: 30 30 30 32 30 30 32 64   0002002d

 
We just can't find what's happening. The machines has a lot of different softwares installed, it's near impossible to find what's the problem. And we do tried!
It's only solved after rolling SEP 11.0.1000 back to 11.0.780 (not MR1). But we need MR1 installed on the computers.

Somebody could help us? Or should we wait for something like a MR2, without this problem, and without the Outlook attachments problem?

Thanks in advance

Comments 13 CommentsJump to latest comment

SKlassen's picture
Question:  Did you perform a reboot after updating from original to MR1?
Eduardo Menegalli Nazato's picture

Yes, it's the first thing we do right after upgrading SEP

We've noticed that some machines work nicely for some minutes, even hours, after installing MR1 (upgrade or clean installation).
And suddenly, the error appears :smileyindifferent:

ukDavidC's picture
Do you use CheckPoint VPN / SecuRemote / SecurClient?

Please don't forget to mark your thread solved with whatever answer helped you : )

Eduardo Menegalli Nazato's picture

Actually we use a modified version of a Nortel VPN Client.
But I think you're right... after some tests, we are close to conclude that this VPN client software has something related to the issue. It seems that the firewall module (Network Threat Protection) is crashing the whole SEP.

Is there a solution for this problems with VPN clients?

niks's picture

We got the same SMC error on our laptops running Checkpoint SecuRemote.

Also :
We noticed the SMC.exe process is growing. It sizes 20MB at start up and 78MB an hour later..
And there are 100% CPU usage peacks of 3-4 seconds every 30 seconds that freeze the computer..





Paul Murgatroyd's picture
Eduardo/Niks,
 
You have PM's
 
 

Paul Murgatroyd
Principal Product Manager, Symantec Endpoint Protection
Endpoint twitter feed: http://twitter.com/symc_endpoint

Rob Schepers's picture
Hi ,
I've got the same problem on several clients after the installation of SEP11,
 
smc.exe take about 100% CPU and then crashes after a while ,
 
Any solution for this problem ?
 
Brgrds
Rob



Message Edited by Rob Schepers on 03-19-2008 02:25 AM

ykaldirim's picture

We are facing the same problem here. On any time smc.exe use %100 of cpu and system is down. smc.exe version: 11.0.1000.1091

kmccormick's picture

We have this problem with v11.0.780.980 with serveral machines.

I am wondering if the cause was a Windows update rather than your MR1 update.

For a matter of fact, I am having this issue on my computer.

Sandeep Cheema's picture
Kmccomick,
 
You should upgrade to MR1 and MR1 MP1 for the manager even though that might not solve this issue.
 
A workaround that could be possible is not to use the Network Threat Protection.
 
Add or Remove Programs > Symantec Endpoint Protection > Change > Take the Network Threat Proection out.
 
Reboot to take effect.
 
 
 
 



Message Edited by Sandeep_Cheema on 04-06-2008 11:22 AM

De facto when AV does something, it starts jumping up and down, waving its arms, and shouting...

"Hey!  I found a virus!  Look at me!  I'm soooo goooood!"

Cowboy Casey's picture
I hope this helps everyone... SMC.exe was consistently using 30 to 70% of CPU... and hoging about 60 to 80K of private working set memory in windows vista SP1.
 
I went through turning on and off everything i could... and BINGO...
 
Open up Symantic status
Open Antivirus and Antispyware protection settings (options, change settings)
click file system auto protect tab
Click advanced
check "scan when a file is accessed" (default is accessed or modified)
Click heuristics
Select minimum level of protection..
Save and close all windows...
 
i did this 7 Apr 08, on 8 Apr 08 i went back in and changed everything back to default settings..
 
CPU stayed at 2 to 8% usage with 3 to 7,000K memory being used.. I will continue to monitor usage to see if utilization goes back up to what it was..
 
Hope it works for you also..
 
Cowboy
 
 
PWC's picture
smc.exe is responsible for the firewall and policy management, among other things.  rtvscan.exe is responsible for virus scanning (including auto-protect).  It seems strange that changing scanning settings would affect smc's cpu and memory usage, but I guess it's possible.
Cashmo's picture

Sorry to drag this thread back from the dead but I'm getting the following intermittent error on multiple XP SP3 PC's using SEP 11 MR2.  Two of them are brand new PC's I'm setting up.

 

Event Type:    Error
Event Source:    Application Error
Event Category:    (100)
Event ID:    1000
Date:        9/3/2008
Time:        10:10:43 AM
User:        N/A
Computer:    TEST

Description:
Faulting application Smc.exe, version 11.0.2000.1231, faulting module trident.dll, version 11.0.2000.1231, fault address 0x00067948.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74   Applicat
0008: 69 6f 6e 20 46 61 69 6c   ion Fail
0010: 75 72 65 20 20 53 6d 63   ure  Smc
0018: 2e 65 78 65 20 31 31 2e   .exe 11.
0020: 30 2e 32 30 30 30 2e 31   0.2000.1
0028: 32 33 31 20 69 6e 20 74   231 in t
0030: 72 69 64 65 6e 74 2e 64   rident.d
0038: 6c 6c 20 31 31 2e 30 2e   ll 11.0.
0040: 32 30 30 30 2e 31 32 33   2000.123
0048: 31 20 61 74 20 6f 66 66   1 at off
0050: 73 65 74 20 30 30 30 36   set 0006
0058: 37 39 34 38               7948   
 

We're not using Network Threat Protection, (Symantec firewall) and SMC.EXE is not generally using up CPU cycles as others have reported.   Any thoughts would be appreciated.

 

Message Edited by Cashmo on 09-04-2008 08:10 AM