Endpoint Protection

 View Only

  • 1.  SEP 11 and .Net Framework problems

    Posted Mar 16, 2010 02:52 PM

    Running RU5 on Windows Server 2003.

    Our Windows admins say that RU5 interferes with two things in the .Net Framework. When they run a .Net Framework update, a  .Net optimization" service fails to start even though it's set to Auto. This service is normally running all the time but seems to get invoked when a patch to the framework is applied. They say they have to actually uninstall SEP 11 before they can patch the .Net Framework. Once it's run, they can reinstall SEP and then it works fine through reboots.

    They also say they have to uninstall RU5 to get regiis.exe to run.

    Is anyone else experiencing issues like this? If so, do you have a fix?

    Thanks,

    Ray



  • 2.  RE: SEP 11 and .Net Framework problems

    Posted Mar 16, 2010 03:27 PM

     

    Below is a similar issue that we have seen regarding this issue. If you are using the same Application and Device Control policy try removing it to see if it helps.
     
    Problem: The client uses a non-default Application and Device Control (ADC) policy which has enabled Sysplant.
     
    In SEP 11 RU5, when sysfer.dll loads it tries to load with a base image of 0x10000000 which is different than previous builds of sysplant and sysfer.dll. When the RU5 sysfer.dll attempts to inject into an application that is also using a base image of 0x10000000, this causes a conflict and the application fails to load.
     
    Workarounds:
    1. Create a new Application and Device Control Policy without any rule changes and apply it to the affected group. Update the policy on the client and restart the affected computers. (Note: Withdrawing the ADC policy should also work.)
    2. Roll the client back to 11.0.4202.75. (this is obviously a temperary fix)
     
    Thanks,
    Grant


  • 3.  RE: SEP 11 and .Net Framework problems

    Posted Mar 16, 2010 04:09 PM

    Did you just say we have to install a default policy with no rule changes, which kind of makes Application and Device Control useless? Or did I misunderstand?

    We can go back to MR4 MP2 as long as RU5 cleanly uninstalls.

    What about this patch? Does that fix it? We kind of have a problem with our Server 2008 and Windows 7 systems given that RU5 is the only one marked as OK for them.

    11.0.5024.404_RU5 (patch for

    11.0.5024.404_RU5 (patch for RU5 clients running 11.0.5.333) has been released, my support tech sent me a direct download FTP link with username/password (therefore I cannot share it). Contact symantec tech support to obtain it if you'd like it. Otherwise wait for RU6 as this fix will apparently be contained in RU6 as well. I will best testing this hopefully in the next few days and will report back.

    Ray



  • 4.  RE: SEP 11 and .Net Framework problems

    Posted Mar 16, 2010 04:20 PM

    Well going back to MR4 MP2 will definetely fix the issue and if you have a small about of clients then I would suggest you just do that. It should be a clean process with no issues. I haven't read anything that says that the patch should fix this particular issue but you should try and let us know how it goes before you jump back to MR4.

     

    Thanks

    Grant