Endpoint Protection

I have started to notice several computers that are completely crashing after receiving the update to 12.1 RU1.  These computers were either updated from 11 to 12.1 and then 12.1 RU1 or installed from 12.1 to 12.1RU1.  Either way, after the install completes via SEPM deployment, when the user logs in everything crashes with DLL and other errors.  When any applications are clicked on to execute, DLL errors pop up immediatly.  I have tried to uninstall, repair, reinstall, manually uninstall but the end result always ends up being a complete system reload.

Has anyone else seen this issue?

Thanks!

Chris

whats the OS?

can you post the error message?

Hello,

To Troubleshoot in your case, we would require the Error message.

Could you let us know what Error Message are you receiving??

Also, Do you see this issue occuring on all machines or certain machines??

Again, I would recommend you to Create a Case with Symantec Technical Support and Provide them with the Memory Dump File to them to analyse what is causing the issue to occur.

Hope that helps!!

I have one here now.  System is running XP Pro.  When this laptop starts up applications crash with a Microsoft error of either Verify Clas ID error, Run App as DLL error or just a general failure and they ask if I want to create a bug report to send to Microsoft.  Once this happens I can't even get into add/remove programs to uninstall or modify the SEP install.

-Chris

Hello,

Could you pull up the Application Logs from the Event Viewer??

Could you let us know the exact error??

Again, as you said you are receiving an Microsoft Error, probaly something wrong with either OS or Microsoft application.

I cannot pull up the event viewer because it crashes each time with the Verify Class ID error.  I have seen this issue on about a dozen computers now.  I have stopped my deployment.  I'm surprised nobody else has seen this.

Hello,

Are these machines Virtual Machines??

Was there any upgrades done on these machines before you deployed SEP clients on these machines??

I found this on MS site, I have no idea if this is the same issue as you got..

http://answers.microsoft.com/en-us/ie/forum/ie8-windows_other/verify-class-id-has-encountered-a-problem-and/ebad366d-3546-40bb-8609-1ad806e2069e

I would suggest calling Microsoft on such cases.

Hope that helps!!

That does sound like the error but I get it with more than just explorer and I get the Run App as DLL error on other exe's.  This is only happening on computers that have had SEP 12.1 RU1 deployed so there must  be a connection.  I'll keep my eyes out for anyone one else having issues.

I had the same problem with RU1 and Win XP.  The systems are so toasted that you can't even get a memory dump file or access the event viewer.  I created a post last week with a similar subject.  I'm not as knowlegable as some of the other participants so I can't really say what is happening but I agree that you need to rebuild the system from scratch.  My machines were upgraded from SEP 11.? to SEP 12 without a problem.  The upgrade from 12 to RU1 caused the problem but only on the XP machines.  Win 7 & Vista are both fine.  I had 4 XP machines and 2 of them crashed.  The only difference in my machines is that the 2 with MS Office installed came out fine and the 2 without Office crashed.  I think it has something to do with Office or a system setting that goes along with it but I can't say beyond that.  I set up an XP Group in the manager console and disabled everything but virus protection on that group.

We are seeing the same problems when upgrading clients to 12.1RU1.  Some clients when upgrading are getting the Verify Class ID error, others are getting a Run DLL as APP error, some seem to be installing fine.  We have not yet found any corelation between the ones that are receiving errors and the ones that aren't.

 Same problem also occured to us. Laptop with XP SP3 and SEP client was upgraded to 12.1 RU1. Only things I could run on laptop were task manager and windows explorer. All the others just didn't run and I got nothing or verclsid.exe errors. I uninstalled Symantec in safe mode, deleted registry entries and files from disk and tried new install but same problem.

 After a while I found out that problem was the Application and Device Control component. After I removed the ADC component from install package the problem went away. As the component was included just for the future and we didn't actually use it and there are no problems with the component exclusion. Just don't understand why the problem appeared on one computer but not in other where the ADC runs without any problems.

  I have been upgrading SEP from 11.0 to 12.1 over the last few days.  I have an XP SP3 laptop that is now having this problem after the upgrade. 

  Is there a fix for this issue yet?

We have also noticed that this seems to only be occuring on laptops.  Seems at least 2 other people have noticed the same thing.  Any ideas?

Install 12.1 RU1 and getting Verify Class ID error as well.

Install appeared fine, issue starts at login.

All following startup items and applications fail to launch.

Windows error:

Event ID 1000

Faluting application verclsid.exe, version 5.1.2600.5512, faulting module kernel32.dll, version 5.1.2600.5781, fault address 0x00012b6e.

Ran a cleanwipe (version for 12.1)

did a install with only AV, set tamper protection to log only.

installed a managed only client, still no go.

Thinking it something with the startup items...

opan a support ticket to confirm if it is compatible issue or something else.

Can you explain, "confirm if it is compatible issue or something else"?

I have a ticket open and we actually came across this post and few others that are not helpful.

I'm currenlty removing all startup items from msconfig VIA safe mode as the error doesn't happen in safe mode.

Removed all startup services and items and that did not help.

While in normal mode I ran the setup.exe for the installer, removed all items except AV. (rebooted)

I can now run as normal.

Performing updates on system (office SP, .net framework 4, IE8 updates)

Will enable services before adding SEP features.

  I guess that removing startup items won't help. Check if you have Application and Device Control installed and running, from command prompt - sc query sysplant

 If you have then disable it in safe mode, reboot and look if it helps.

If the clients are managed clients, delete the client from the client group, then push a new install without ADC and the new install will do an un-install and install the program without ADC.  NOTE: if you have password protection enabled for un-install, you need to be logged into the system with the account used to do the install so you can enter the password when prompted.

After rebooting the system, the error will go away.

i meant if SEP version has conflict with the existing software/application running on the system.

I'm having the same exact issue.  The only way I can fix it is to go to a previous restore point and run Cleanwipe.  Everything starts working again.  If I reinstall SEP the problem reoccurs.  Going back to 12.1.671.4971.  It was stable on this particular system.  Hoping it works.  I would like to know when and if there is a fix for this issue.  It is definitely a problem with the SEP installation package.

We are experiencing the same issues.  Is there a resolution to this problem?

I don't know if Symantec has resolved  tha problem but if you have PC with these symptoms then boot in safe mode, disable sysplant service from command prompt:

sc config sysplant start= disabled

and reboot.

this should be a issue with application & device control feature.... the sysfer.dll might be causing this issue. disabling Application and device control feature should help here

Please advise when the sysfer.dll issue is resolved.  I don't like doing work arounds and will not upgrade any more of my clients until this is fixed.   Considering Symantec alternatives for next year if this isn't resolved soon.   The tech support seems to be useless and trying to blame microsoft initially. 

In our environment we've seen this issue with two laptops so far, but no desktops.  Not sure if that helps narrow the issue down.

Has anyone gone through the support process on this issue and if so, what were the results?

Determined it was ADC that was causing the problem. Helped me create install packages without ADC.  This fixed the problem.

Disabling features isn't a real solution.  When will this be fixed.  This issue has been out there for 4 months.  Please advise. 

This is the exact error message I'm getting

I've just had SEP12 pushed out to a number of different machines (Lenovo and Dell workstations) and had issues with 1 so far. Had the Verify class id etc. As the machine was a Dell (Precison T3400)  I have removed the Embassy Wave Security Suite. I had to download the software and run the installer to do a remove all items as it wouldn't run from Add & Remove programmes (not unusual) but this appears to have fixed all of the issues. I have found this piece of software which is preinstalled to prevent a number of other programmes installing and running. I now look for this as a promary fix for any Dell hardware I have issues with and do not include it in my deployment images.

Hope this helps

That is a common thread in my situation. Thanks.  You really are "Helpfull Tguy".   It's great to have this isolated.

Has this been reported to Symantec?    This information needs to get to their support and developers.

Extremely disappointed in 12.1 RU.  Messed up a dektop and notebook, XP SP3, updating from 3 year license to another 3 year license.

Got rid of Embassy Software suite on Dell Optiplex 745 as per posts, but still a problem for every dll - 15 or so during bootup - for system tray, nVidia, WinZip, jucheck, etc. throw errors.  Add/remove programs won't work.

Symantec should know better.  Longing for the DOS, autoexec.bat, config.sys, boot disk days.