Endpoint Protection

Some of our users using Green Hills compiler are complaining slow application performance when SEP is installed. After uninstalling SEP from computer, GHS compiles smoothly. SEP version is 12.1.1101.401.

Following error message appears in the security log:

Code Integrity determined that the page hashes of an image file are not valid. The file could be improperly signed without page hashes or corrupt due to unauthorized modification. The invalid hashes could indicate a potential disk device error.

File Name: \Device\HarddiskVolume2\Windows\System32\sysfer.dll 

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

I have already tried the solution provided here, without success: http://www.symantec.com/business/support/index?page=content&id=TECH103259&locale=en_US

Hello,

Sysfer.dll is the Application Control engine. It gets loaded by sysplant.sys. Both sysplant.sys and sysfer.dll much match.

A message like this usually means that the two files don’t match. In this case the sysfer.dll that sysplant.sys expects is not correct.

Try Running a Repair the SEP client from Add / Remove Programs OR Reinstall the SEP client.

Again, what happens if you do not install the Application and Device Control along with Network Threat Protection Feature of SEP on the same machine?

Let us know.

I tried your suggestions, but none of them helped. After installing SEP without application and device control + NTP the error message from event log disappeared, but the initial problem still remains.

The weird thing is that compiler worked smoothly with SEP until some update (microsoft maybe?) which took place couple of weeks ago. As far as I know, other applications aren't having any performance issues.

Hello,

Could you please create an application exception - check this Article:

How to create an application exception in the Symantec Endpoint Protection Manager

http://www.symantec.com/docs/HOWTO61213

Creating Centralized Exceptions Policies in the Symantec Endpoint Protection Manager 12.1

http://www.symantec.com/docs/TECH183201

Hope that helps!!

Hello,

Thanks for the advise, but unfotunately it didn't solve my problem. I created exceptions for all running executables I could imagine. Besides, I have created folder exception earlier.

The only way to use SEP in those machines is to install it with just Virus, Spyware, and Basic download protection features. That is not desired configuration because Network Threat Protection is not applicable.

Is there something else you could recommend?

I registered a case with Symantec support, and they solved the problem with these instructions

- Login to SEPM.
- Goto Policies > Virus and Spyware Policy > Edit Virus and Spyware Policy which is applied on affected client machine.
- Goto Administrator-Defined Scans > Advanced Tab
    - Uncheck option for "Run Active scan when new definitions arrrive"

- Goto Auto Protect > Click on "Advanced Scanning and Monitoring" Button.
    - Select Option for "Scan when a file is modified".
- Click on OK to save Policy,
- Make sure thaty Policy has been updated on client and try one more time.