Endpoint Protection

Have Symantec Endpoint Protection installed on the network. One of the employees has a desktop with XP Pro that keeps getting this message asking to report to Microsoft or not. Usually the employee hits the do not send. The error keeps popping up after you select either option (report or not). It says the report was sent to Microsoft successfully and click close. Then the encountered error message pops up right of way.

Is there a cleaner tool that I can use or is a uninstall and re-install recommended?

Thanks.

You would need to open a case with Symantec to get the Cleanwipe tool. What errors are you seeing in the Windows event viewer?

Thomas

Which version of SEP is installed ?

Try to upgrade to the latest version.

A reinstall will always be a better choice then running a removal tool

Only thing I see for Symantec is these but multiple instances:

Event Type: Error
Event Source: Symantec AntiVirus
Event Category: None
Event ID: 45
Date:  8/27/2009
Time:  10:41:57 AM
User:  ATG\George
Computer: GEORGE
Description:
 

SYMANTEC TAMPER PROTECTION ALERT

Target:  C:\Program Files\Symantec AntiVirus\SmcGui.exe
Event Info:  Terminate Process
Action Taken:  Logged
Actor Process:  C:\WINDOWS\system32\taskmgr.exe (PID 2148)
Time:  Thursday, August 27, 2009  10:41:57 AM

=====================================

Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date:  8/27/2009
Time:  10:41:46 AM
User:  N/A
Computer: GEORGE
Description:
Faulting application smcgui.exe, version 11.0.4000.2261, faulting module hppprotectionproviderui.dll, version 11.0.4000.2263, fault address 0x00011ca7.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74   Applicat
0008: 69 6f 6e 20 46 61 69 6c   ion Fail
0010: 75 72 65 20 20 73 6d 63   ure  smc
0018: 67 75 69 2e 65 78 65 20   gui.exe
0020: 31 31 2e 30 2e 34 30 30   11.0.400
0028: 30 2e 32 32 36 31 20 69   0.2261 i
0030: 6e 20 68 70 70 70 72 6f   n hpppro
0038: 74 65 63 74 69 6f 6e 70   tectionp
0040: 72 6f 76 69 64 65 72 75   rovideru
0048: 69 2e 64 6c 6c 20 31 31   i.dll 11
0050: 2e 30 2e 34 30 30 30 2e   .0.4000.
0058: 32 32 36 33 20 61 74 20   2263 at
0060: 6f 66 66 73 65 74 20 30   offset 0
0068: 30 30 31 31 63 61 37 0d   0011ca7.
0070: 0a                        .      

 

I'm unable to open the client.

Add/Remove Programs says version:

11.0.4000.2295

If there's a newer version, can it be updated via SEP Manager?

There is MR4 MP2 out & MR5 will be out in few days.

You can check this document for manual uninstallation

http://service1.symantec.com/support/ent-security.nsf/docid/2008100209320948

What is the OS of the system facing the problem. If its Vista then try to turn off the windows defender.

If you are not able to open the client then the installation seems to be corrupt. You can uninstall the client from add/remove programs first and then install the newer version i.e 11.0.4202.75 MR4MP2 as a fresh deployment. Your SEPM also needs to be migrated to MR4MP2.

Following article might be useful

Migrating to Symantec Endpoint Protection 11.0.4202 (MR4 MP2)

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2009051906042048.


If you are unable to remove the client through add or remove programs then you may use the Cleanwipe tool to remove it and then do a fresh install

Thanks :-)

It's XP Pro SP3.

I'll try what you suggested and then give you an update shortly.

Thanks for everyones help thus far!

Sorry for my ignorance. The employee who works on and setup the SEP is out of the office.

Can I install the 11.0.4202.75 MR4MP2 on the computer with the problem and not on the SEPM?

After looking at the SEPM it looks as if all computers have the 11.0.4000.2295 version.

Yes you can do that, try to install a Unmanaged version of SEP with MR4 MP2.

Yes you can install the MR4MP2 client on the machine in question. You may have to create a new install package for MR4MP2 to deploy it out to the client or install an unmanaged client from the MR4MP2 CD1. You will have to download the new version from Fileconnect website if you have not done so.


Here is the link to download the product

https://Fileconnect.symantec.com

Thanks :-) 

We are planning to upgrade the entire network with the latest version available in a couple of hours.

Is there any information released yet regarding what MR5 addresses?

Thanks!

MR5  would be released in  Sep,2009 but there is no date decided as yet.

please to subscribe yourself to our email bulletin service to stay abreast with the latest product updates. The link for this is as follows:
http://www.symantec.com/business/support/news_bulletins/index.jsp

Pls.capture a full memory dump at crash and submit to symantec support. We would like to know how smcgui.exe got crashed.

@ Troam, can you give us an update on your issue?

Thanks,
Thomas

I haven't had the chance to update nor provide that dump file. Whom should I send it to?

I will send you a PM with a location to upload the file, we can then take a look at the dump. You should still go ahead and open a case with Symantec Support to get the ball rolling on the support side.

Thomas

@ Troam, I never received your memory dump. Did you find root cause of the smcgui crash?

Thomas

What I did to resolved this issue is uninstall then install the latest version of SEP.

Below are the reference that helps me address the concern.

Error: "Symantec CMC SmcGui has encountered a problem and needs to close. We are sorry for the inconvenience."

Document ID: 2008030411110548

Installation goes into a continuos loop when migrating Symantec Endpoint Protection

Document ID: 2009092412054248