Endpoint Protection

We have 8 new Dell computers, 4 Vostro 220, 4 Optiplex 780 running XP SP3 that all exhibit the same problem.  When Endpoint Protection 11 is installed, and someone accesses an Office document or spreadsheet on that computer over the network, the system crashes with a BlueScreen error when the doc is saved. 
The error is usually a 0x24 NTFS_FILE_SYSTEM.  When checked with WinDbg, it pointed to a driver for Network Threat Protection.  With NTP removed, the blue screens still occured, but with several different error codes.  So far I've gotten at least one each of
0x19 BAD_POOL_HEADER
0x1000008E KERNEL_MODE_EXCEPTION_NOT_HANDLED
0x1000000A IRQL_NOT_LESS_OR_EQUAL
0x000000C2 BAD_POOL_CALLER
with a Symantec component being implicated in almost all of them (smc.exe, smcgui.exe, teefer2.sys,wpsdrvnt.sys, etc) .  I've tried installing SEP with various components disabled, but no matter what, it always causes blue screens under the same conditions.  Any computer saving an Office doc or spreadsheet in a share hosted on the computer in question will cause the crash.  Maybe 1 in 10 times they will be able to save it once before it crashes.  Office 2007, 2003, and 2002 all cause it.  OpenOffice.Org does not however.   Only these new Dells are experiencing it.  The rest of our PCs which are all SP3 with current updates and identical software installed do not show these symptoms.

as you mentioned the problem is with NTP
create a new package with just AV and AS and then try the install.

I'd already done installs that didn't include NTP, but I did what you said and did one with only AV and AS ( not even email scanning) and it worked.  I then added in just the POP email scanning, which made it crash with another KERNEL_MODE_EXCEPTION_NOT_HANDLED.

So does anybody know why trying to use more than 10% of this program causes it to crash?

Try keeping the bare minimum feature of endpoint i.e. AV/AS and then check. Do you still get the error

whats the version of SEP you are trying give it a try was a bug in earlier version

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007121216360648

t

Stop 7F (8) Kernel Stack Overflow Blue screen after installing Symantec Endpoint Protection
Fix ID: 1829876
Symptom: A stack overflow crash occurs after installing the MR4 MP2 version of the Symantec Endpoint Protection Client
Solution: Updates made to the Auto-protect component to prevent the crashry on one machine first

The versions.txt in the CD i'm installing from says
SEP Build 11.0.780.1008
CMC/SNAC Build 11.0.780.980
SESM Build 11.0.780.942

Once LiveUpdate runs the version goes to
11.0.780.1109

Does LiveUpdate not include all the updates?

Holy crap!  Upgrade that STAT!  You are 5 MAJOR SERVICE PACKS BEHIND.

That is near the build that first came out in september of 2007.  Current build is referred to as RU6, or 11.0.6000.x


If you get the newest version off Fileconnect.symantec.com, all your problems will be solved more than likely, and you'll get a performance boost too as the client is so memory hungry.

ok, let me get this straight.  I'm at the fileconnect site right now, and it says the current version is 11.0.6 which is supposed to be newer than 11.0.7?

Well it's 11.0.6000 and you are 11.0.780.  You are basically at 11.0 very first release.  After that there has been 11.0 MR1, MR2, MR3, MR4, MR42, RU 5 and now RU 6

The file connect site doesn't show those zeroes, at least not consistently, which apparently are significant digits...

Yep, i went through the same thing before, thought I was installing a version higher than what everyone was saying was a fix.

File Connect does not show the correct info still then.

I wonder how many other people have had this issue as well.

Thumbs down since this should have been fixed years ago by symantec.
I even chatted with a forums advisor on this before.

FAIL

It is not thumbs down to OP, was not his fault.

Ok, so I downloaded the 11.0.6000 installed it, ran LiveUpdate, same issue.
So I think we've pretty firmly established there is something wrong here.

Does this document apply in any way?

Title: 'Saving Microsoft Office files fails due to a sharing violation when Explorer is open to the folder containing the Office files.'
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2010020113250348

Did these machines have any sort of Symantec AV product on them before (i.e. SAV, Norton, etc)?

That this is only happening on your newer Dells makes me wonder if it isn't a conflict with some piece of software that Dell installs.  If you haven't opened a support case, I would definitely recommend it.

sandra

Nope, having the explorer window with the share closed doesn't affect anything.  And they had no previous AV software on them.  Guess it's time for a support case.

I have had previous version of norton and symantec on PC's that have the sharing violation.  When taking off the NTP the error does not occur.