Endpoint Protection

Hello,

I am running a Windows 2003 Standard Edition Server - Service Pack 2.  Server is running SEP 11.0.5002.333.  Live Update 3.3.

The server handles minimal file sharing, and its primary role is as a printer server for about 4 printers.  About once a week, we have to cold boot the machine becuase it is not responding.  When the Event Logs are reviewed, the last thing that is present is the following event:

Source:   Service Control Manager
Event ID: 7036
Description: The LiveUpdate service entered the running state.

Has anyone run into this?  Any tested resolution to this issue?

Thanks in advance.

Regards,
Rudy

This seemed to have solved my problems - please reply it helped

go to "view Quarantine" on the servers that have this problem and check if specifically the W32.Harakit Virus has been Quarantined.
If this virus has been Quaratined, check if one of the original folders where it was found is C:\windows\temp.
go and check your windows\temp folder for any files named DWHxxx.tmp (where xxx can be numbers or characters).

if the above is true do the following:

• Delete all W32.Harakit detected files form the Quarantine.
• Reboot the server is safe mode as trying to delete the DWHxxx.tmp files will hang your Explorer
• Once in "safe mode" delete all these DHWxxx.tmp files from c:\windows\temp
• probably a good idea to scan all folders in "safe mode" just to make sure its clean
• restart server and check Quarantine to make sure no W32.Harakit virus were found and check that no DHWxxx.tmp file exist in C:\windows\temp
• hopefully after this you can sleep better at night

This solved my problems of some servers hanging after def. updates and
some servers auto-protect not running after def updates and
some servers scheduled scan hanging(when trying to scan the DHWxxx.tmp).

this issue seems to be when Symantec does a def update it rescans the quaratine folder as this causes the issues with that virus in Quarantine as the DHWxxx.tmp file is created just after live-update has completed.

On this page:

https://www-secure.symantec.com/connect/forums/server-hangs-after-liveupdate

Hope it helps...

-Mike

How much free space you have on the C drive?

Nothing in Quarantine. No DHW***.tmp files on the drive.  There's plenty of drive space (30GB) available. 
Does Symantec monitor these forums? 

Thanks.