Endpoint Protection

Installing SEP (version 11.0.6100.645) AV updates on an isolated 64-bit W2k8 system. When runnning updates like: 20110427-002.v5i64.exe the Log.InelligentUpdater.txt show Failures near the bottom similar to those described in article TECH122906. 

However the DLL files in question are different and do not appear to exist on the system.  ISAuthDLL/ISDeployDLL and AuthDLL/DeployDLL.

NOTE: The SEP GUI show the date of the new definitions; and the Antivirus and Antispyware Protection System log list the definition update.

So Question is what are the errors trying to tell me?  Did the update really install successfully?  Is the system protected?

log Exerpt:

Entry details:
     Update-File:             VIRSCAN.zip
     Update-Desc:             Virus Definitions
     Auth DLL Name:             ISAuthDLL
     Auth DLL Location:         local
     Auth Content-Type:         virus definitions x64
     Deploy Content-Type:         virus definitions x64
     Deplo DLL Name:         ISDeployDLL
     Deploy DLL Location:         local
 AUTH DLL LOCATION: IU will read the DLL location from registry - ISAuthDLL
 REG SUCCESS: Success while opening key
 REG FAILURE: Failed while reading the value for key named
 DEPLOY DLL LOCATION: IU will read the DLL location from registry - ISDeployDLL
 REG SUCCESS: Success while opening key
 REG FAILURE: Failed while reading the value for key named
 IGNORE ENTRY: Ignoring entry for VIRSCAN.zip because of registry read failure. Error occurred while reading the path for the Authorization DLL from the registry.
 IU failed while deploying V because a compatible product could not be found on the system. Please make sure that a compatible Symantec product is installed on the system.
 PROCESSING ENTRY: VIRSCAN.zip - Virus Definitions
 Entry details:
     Update-File:             VIRSCAN.zip
     Update-Desc:             Virus Definitions
     Auth DLL Name:             Norton X64 AuthDLL
     Auth DLL Location:         local
     Auth Content-Type:         VirusDefs
     Deploy Content-Type:         VirusDefs
     Deplo DLL Name:         Norton X64 DeployDLL
     Deploy DLL Location:         local
 AUTH DLL LOCATION: IU will read the DLL location from registry - Norton X64 AuthDLL
 REG SUCCESS: Success while opening key
 REG FAILURE: Failed while reading the value for key named
 DEPLOY DLL LOCATION: IU will read the DLL location from registry - Norton X64 DeployDLL
 REG SUCCESS: Success while opening key
 REG FAILURE: Failed while reading the value for key named
 IGNORE ENTRY: Ignoring entry for VIRSCAN.zip because of registry read failure. Error occurred while reading the path for the Authorization DLL from the registry.
 IU failed while deploying V because a compatible product could not be found on the system. Please make sure that a compatible Symantec product is installed on the system.

Complete Log.IntelligentUpdater.txt attached

Attachment(s)

Log.IntelligentUpdater.txt   7 KB 1 version

IU failed while deploying V because a compatible product could not be found on the system. Please make sure that a compatible Symantec product is installed on the system.

however the filename of IU is right for 64bit , open a ticket with Symantec on this issue. I assume we can ignore the message unless the deinifion are not updated.

Hi,

As per logs

Entry details:
     Update-File:             VIRSCAN.zip
     Update-Desc:             Virus Definitions
     Auth DLL Name:             Norton X64 AuthDLL
     Auth DLL Location:         local
     Auth Content-Type:         VirusDefs
     Deploy Content-Type:         VirusDefs
     Deplo DLL Name:         Norton X64 DeployDLL

Was Norton previously installed on computer ? remove all the registry entry for Norton if present ?

As per article TECH122906, you have also upgraded your product ? what was upgrade path ? 

Have you tried by reinstalling prouduct ?

Check this thread as well.

https://www-secure.symantec.com/connect/forums/symantec-endpoint-intelligentupdater-v5i32

Hello,

Please Ignore the Messages.

The Errors like 

 IU failed while deploying V because a compatible product could not be found on the system. Please make sure that a compatible Symantec product is installed on the system.

clearly indicates that

"A compatible product was not found."

The Intelligent Updater 20110427-002.v5i64.exe which you had download was meant for Norton as well as Symantec products as shown below:

So, Since you don't have a Norton Product on the machine, the Definitions meant for Norton Products were not Applied as the Intelligent Updater didn't find the Compatible Product (Norton).

And, Yes, ISAuthDLL are the for the Authorized dll files to Install Virus definitions for the Norton 360Hope that Answers!!!!

Yes 64-bit W2K8 OS and 64-Bit SEP installed down:  c:\Program Files (x86)\Symantec\...

Install pops up SUCCESS - but Log.IU.txt has these errors.  AV system log show update.

No Norton never installed on these servers - issue happens on multiple machines of same configuration.

Registry existed correctly for LuAuth.dll and DefUDeploy.dll.  Other registry entries do not exist.

From someone else on my team - I agree:

Seems that Symantec could alter their wording regarding a ‘Failure’ of an unloaded product.  Would be more logical for them to note each product attempted, and the status of ‘Success’ or ‘Failure’ if found, and ‘Not Deployed’ if not on system… 

This could have save us a day's chasing an ingorable log entry - which is really not a Error/Failure from the perspective of the system being updated.

Thanks to ALL for their responses and education...

Hello,

Seems a Great Idea.

Please Add this as an IDEA !!!

https://www-secure.symantec.com/connect/security/ideas

Hope this may be worked upon by the Symantec Engineers in tge Upcoming Releases...

THANKS! - Now this and the log make a lot more sense.

I now see how it is obvious that the NORTON x64 reference do not apply - now that you point it out,

But what about the other set of Failures - how do I know by looking at them that they do not aapplyy to this instance?  Is it becuse ISAuthDLL and ISDeplyDLL are not present in this installation, while SAVIUAuth, LuAuth.dll and DefUDeploy.dll are found and used at the top of the log?

Entry details:
     Update-File:             VIRSCAN.zip
     Update-Desc:             Virus Definitions
     Auth DLL Name:             ISAuthDLL
     Auth DLL Location:         local
     Auth Content-Type:         virus definitions x64
     Deploy Content-Type:         virus definitions x64
     Deplo DLL Name:         ISDeployDLL
     Deploy DLL Location:         local
 AUTH DLL LOCATION: IU will read the DLL location from registry - ISAuthDLL
 REG SUCCESS: Success while opening key
 REG FAILURE: Failed while reading the value for key named
 DEPLOY DLL LOCATION: IU will read the DLL location from registry - ISDeployDLL
 REG SUCCESS: Success while opening key
 REG FAILURE: Failed while reading the value for key named
 IGNORE ENTRY: Ignoring entry for VIRSCAN.zip because of registry read failure. Error occurred while reading the path for the Authorization DLL from the registry.
 IU failed while deploying V because a compatible product could not be found on the system. Please make sure that a compatible Symantec product is installed on the system.

NOTE: confirmed that ISAuthDLL is for Norton 360 and not applicable to SEP.
 
 

Done!  Thanks