Endpoint Protection

Hi,
I am using SEP 11 on windows server 2003 and not able to start the service gives error 1053: the service did not respond to start or control request in a timely fashion.
I tried uninstall with cleanwipe and reinstall.
Reinstalled with different setup.
copied the odbcbcp.dll from SEPM. 
still the same

Event log shows:
Event id: 7009

From this KB, it sounds like a possible infection. Try running the SERT tool and then reinstall the client.

Symantec Settings Manager will not start after an infection and the command prompt will not open
http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/458f82cc5fabe7d6882576110072e1eb?OpenDocument

How To Use the Symantec Endpoint Recovery Tool with the Latest Virus Definitionshttp://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/750ab70cd21259ae88257706004bafc9?OpenDocument

I am moving this thread to the Endpoint forum for better visibility.

Thomas

Hi,

Thanks for the support,
Checked the registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
but there is not symantec key.

Also scanned the system with Symantec Endpoint Recovery Tool with the Latest Virus Definitions. 
There were 0 infected files or threats.

Still i am facing the same issue. The symantec endpoint protection service wont start. 

Hi,

Kindly download and  scan with the Norton security scan tool. ftp.symantyec.com/misc/tool

There are multiple causes for errors like these.
1. The Windows Root Certificates are out of date.
2. Invalid or incomplete DCOM permissions are the cause of errors like these.
3. SEP installation is corrupt.

Update the Root Certificates for Windows - see http://support.microsoft.com/kb/931125.

Correct the DCOM using the following kb  http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/3f862957b21b671588256c620077a200?OpenDocument

Checking DCOM settings

The last place to check rights on a computer is in its DCOM settings.

To verify Distributed COM properties

1. On the Windows taskbar, click Start > Run.
2. Type the following, and then click OK:
   
   dcomcnfg
    
3. Do one of the following, depending on your operating system:
   • In Windows XP/2003, click Component Services > Computers > My Computer. Then right-click My Computer and click Properties.
   • In all other versions of Windows, go on to the next step.
4. On the Default Security or Default COM Security tab, under Default Access Permissions, click Edit Default.
5. Verify that Administrators, Interactive, and System accounts are set to Allow Access, and then click OK.
6. Under Default Launch Permissions, click Edit Default.
7. Verify that the Administrators, Interactive, and System accounts are set to Allow Launch, and click OK.
8. Do one of the following, depending on your operating system:
   • In Windows XP/2003, skip the two following steps.
   • In all other versions of Windows, go on to the next step.
9. In the Default Configuration Permissions section, click Edit Default.
10. In the Registry Key Permissions window, verify that the following are set to Full Control, and then click OK:
    
    CREATOR OWNER
    ...\Administrators
    SYSTEM
     
11. On the Default Properties tab, verify that Default Impersonation Level is set to Identify.
12. Click Apply, and then click OK.
13. Restart the computer for the changes to take effect.

Try-ed the above steps thanks.

Windows Root Certificates was updated
Checked the DCOM settings, i changed some settings as given above and restarted the server.

Still the same problem.

Try-ed installing from a different setup created from SEPM.
The installation goes through but the SEP server wont start same error.

I Do get the below error message frequently on my machine. Is this related to SEP service?

the procedure entry point urldownloadtofile could not be located in the dynamic link library urlmon.dll

Hi neal316,

Urlmon.dll is a file that’s used by the Windows “OLE” (Object Linking And Embedding) linking technology. This file is widely used by Microsoft Office programs and are best known for being used inside Microsoft Word & Excel. This file is used to put “objects” inside your documents, such as links, media, images, Wordart, etc.

Thanks Everyone,

Finally it worked.

I was using administrator profile, uninstalled SEP. Logged in as different user with admin rights.
Reinstalled SEP in this profile.
Ran malwarebytes, it detected 2 malwares deleted it.
Restarted the system. 
Worked like a Gem.