Video Screencast Help

SONAR Component Error

Created: 06 Jan 2009 • Updated: 02 Mar 2009 | 25 comments

I have Symantec Endpoint Protection installed on my window XP.  I got this error msg "SONAR Component has encountered a problem and needs to close.  We are sorry for the inconvenience" while I was running a Full system scan.  After the error msg above, my Symantec Proactive Threat Protection now says " Proactive Threat Protection Malfunctioning".  when i open Symantec Endpoint, under the Proactive Threat Protection, instead of "ON", it says "WARNING" and in the definitions, there is not date, it says "Waiting for updates". 


I have liveupdate set to automatically, but i went ahead and run it any again.  it didn't do anything.  I thought maybe my Symantec got corrupted, so i uninstall and re-install; after it scanned for a while, the same error msg appear again.


can someone tell me what is wrong?  Is it a MS OS thing or a Symantec?



Comments 25 CommentsJump to latest comment

Paul Murgatroyd's picture

which maintenanance release of SEP are you using?

Paul Murgatroyd
Principal Product Manager, Symantec Endpoint Protection
Endpoint twitter feed:

S Speck's picture

I'm having the same problem.  Any possible solution for the SONAR component problem?

JohnKoch's picture

I am having this same issue with one of my clients.  We are using SEP11 MR4MP1a.  Any word on a fix for this?

Anibal Bravo HN's picture

I am having the same issue with a client, we are using SEPMR3

ragingws6's picture

I have a client having the same issue.  I will probably try going to MR4 MP2 to see if this fixes it, but by the lack of response, I see no one has a fix.  Even complete manual uninstall and repush doesn't work.

atpeace's picture

I just started to get this error message and it is so disturbing that I am thinking of getting rid of the source and going to a less intrusive protection.  It is really just a pain to get anything done with that message keep coming up.'s picture

SONAR Component has encountered a problem and needs to close.  We are sorry for the inconvenience.  Running SEP 11.  Is there a fix for this error?  Also still getting a "protection definitions are too old for proactive threat protection" error.  I ran all the updates last night, the error went away, but now it's back this morning.  Is anyone at Symantec going to fix this???

Vikram Kumar-SAV to SEP's picture

@ian which version of sep are you using. upgrade to 11.0.5002.xx  

Vikram Kumar

Symantec Consultant

The most helpful part of entire Symantec connect is the Search use it.

Vikram Kumar-SAV to SEP's picture

 are you using sep version 11.0.5002.xx if not then first upgrade to that version and then check if you still have the issue.

Vikram Kumar

Symantec Consultant

The most helpful part of entire Symantec connect is the Search use it.

boe's picture

It had been running fine for a month (windows 7 RTM official release from MS) but today I got a sonar error and even after update and reboot it is turned off and says my defintions are old.  The registry entry listed above already exists.   I'm running 11.0.5002 with todays definitions.

Beppe's picture


I am seeing that this discussion does not have a solution yet. The customers that are still facing this issue are invited to contact the Support to continue the troubleshooting.
I created the KB 2009120210034548 to track the issue with the engaged engineers.

Best regards,



PlantViewMan's picture

I have the same problem.
Still don't see a resolution.
Whats up?

adendel's picture

We have this same issue, we've remove, reinstalled, etc.  Used clean wipe, upgraded to latest version RU6a.  Still have this problem.  Symantec - do you have any solution??

SRupp's picture

Good to know this is getting timely attention for support.

Dave the Man Miller's picture

Is there a solution yet to this problem. A year and a half is a long time to wait.


TallTech's picture

I have at least 3 more people reporting the SONAR error out of my 17,000 machines. I have Cleanwiped at least one and the error returns. I am trying to see if all 3 get this at the same time. I am trying to tie it to a Live Update or Proactive Threat update. Any others with a definite fix?

jeff_spenner's picture

I was able to remove the error by removing PTP and NTP. Fortunately we dont use them much anyways. Believe it may have something to do with the SENS service not running, even with a DependsOnService registry hack. We are on RU6, mostly, we still get it on new installs using 11.0.5002.333. I am able to leave our 12000+ clients on AV/AS only and SEP runs much better all the way around on the client end. Much less overhead and open threads as well. Now i kinda like SEP :)

bob.lewis's picture

I've been encountering this error for over two months now, 10-12 times per day. Corporate environment. Version 11.0.5002.333 for SEP. I don't see a separate version number for PTP.  Definitions are up to date, but the "Fix" button is enabled and is saying protection definitions are too old for Proactive Threat Protection. Clicking the Fix button does not resolve the problem, and indicates that all files are current. PTP has disabled itself, but continues to generate errors every hour or so. My OS is XPSP3.  Obviously I'm not the only one encountering this problem, and it's at least a year and a half old. Symantec, what are you doing about it?

GJames's picture

My company is using SEP 11.0.5002.333 Managed with about 1000+ users.  All systems are Dell hardware currently running Windows XP.  I have one user who has had a complete system replacement and the SONAR problem persists.  It can be resolved for a short time by un-installing, running Symantec removal tool and then reinstalling a clean copy.  This lasts from a few weeks to a month then returns.  I have another user who just recently started getting this error right after upgrading his system with XP's SP3.  All of my Internet search results in more of the same as here, no solution. Symantec?

Pascal KOTTE's picture

See same problem for:

Endpoint Protection 11.0, RU6 MP1(11.0.6100.645), under Microsoft Windows XP Professional Service Pack 3 (build 2600) 32 bits.

But latest version Symantec Endpoint Protection is 11.0, RU6 MP2(11.0.6200.754)... But does this will resolve.

I see this problem on a machine after this in the log:

Type    Date    Heure    Source    Catégorie    Événement
Informations    06.12.2010    15:49:32    DrWatson    Aucun    4097
Erreur    06.12.2010    15:45:41    Application Error    -100    1000
Erreur    06.12.2010    14:46:47    Symantec AntiVirus    Aucun    73

Not sure any relation...

Hum, don't find any windows application or system log with SONAR !?

~Pascal @ Do you speak French? Et utilisez Altiris: venez nous rejoindre sur le GUASF

Pascal KOTTE's picture

Type de l'événement :Erreur

Source de l'événement :             Application Error

Catégorie de l'événement :       (100)

ID de l'événement :       1000

Date :                   06.12.2010

Heure :                08:45:41

Utilisateur :        N/A

Ordinateur :       PC183

Description :

Application défaillante COH32.exe, version, module défaillant COH32.exe, version, adresse de défaillance 0x000b31ad.

Type de l'événement :Informations

Source de l'événement :             DrWatson

Catégorie de l'événement :       Aucun

ID de l'événement :       4097

Date :                   06.12.2010

Heure :                08:46:55

Utilisateur :        N/A

Ordinateur :       PC183

Description :

L'application, C:\Program Files\Fichiers communs\Symantec Shared\COH\coh32.exe, a généré une erreur d'application L'erreur s'est produite le 12/06/2010 à 08:46:55.378 L'exception générée était c0000005 à l'adresse 004B31AD (coh32)

~Pascal @ Do you speak French? Et utilisez Altiris: venez nous rejoindre sur le GUASF

Pascal KOTTE's picture


Resolved an error indicating COH32.exe has crashed
Fix ID: 2107090
Symptom: Symantec Endpoint Protection clients receive a SONAR error indicating that Symantec Endpoint Protection needs to close. coh32.exe is listed as the faulting application.
Solution: Named pipe communication in COH was enhanced to prevent this crash.

~Pascal @ Do you speak French? Et utilisez Altiris: venez nous rejoindre sur le GUASF

Pascal KOTTE's picture

seems solved now with this update !

~Pascal @ Do you speak French? Et utilisez Altiris: venez nous rejoindre sur le GUASF