Endpoint Protection

We have a java application to remove additional memory consumption by calling "kernelinterface.dll" setprocessworkingsetsize. Before upgrade, no problem. After upgrade, the anti-virus prog. kill the application. Any advice? [change]

do yo mean running script after SEP install you cannot run? any error?

PC running an java application which will trim it's process memory regularly.

Before upgrade, the java application works normally.  After upgrade, each time the java application trim memory, the SEP hang the application,  If SEP is turned off, the application run normally.

can you put that application under exception and verify if it helps?

http://www.symantec.com/business/support/index?page=content&id=TECH104326

by the way do you see any event id for this incident?

Hello,

Could check the Risk Logs, Threat Logs from the SEP client which is installed on the machine and check if there is a risk detected or ?

Secondly, check the Traffic Logs, Packet Logs from the SEP client, which would tell us if NTP is blocking the application.

I agree with Pete above, creating an Exception might help.

http://www.symantec.com/docs/TECH183201

Hope that helps!!

Thanks Pete & Mithun  , actually the problem reported by customer, as my endpoint version is 11 and do not have this problem even without creating an exception.  I tried to upgrade my PC to 12 version cause "blue screen", finally give up, I will re-install another PC with version 12 directly to reproduce the case today.  

However, any clue what additional checking done in version 12 to block the application?

does it happen only with AV component? can you open support ticket for tracking ?

Try to check threat logs for that host, (risk,fw, ips).

You do some test as pointed out, try disable the extra component one by one and monitor the performance..

If nothing then you better get Support as other advice... might be due to other factor.

Disabled SEP in Client PC, still get error ":\kernelinterface.dll: Invalid access to memory location". No special event notified in event log. SEP version is 12.1.671.4971.

Any suggestion?

After uninstalling the SEP, no more error.

Therefore, I guess some system dll is protected or overwritten by SEP version 12.1.671.4971.

My question now:-
I tried to add the Exception in the User PC rather than central policy, Is it same effect as what Pete said "http://www.symantec.com/business/support/index?page=content&id=TECH104326"?  In fact, got the same even add the exception.

Hi Ken,

time to raise a case to support, there might be other factor...

Is this Java application a Browser Helper Object/plugin that runs on Firefox or IE?

Logged the support case, finally, need to turn off the "application and device control" in client PC.

regards,

Ken wat