Hello!

Customers encountered and reported the following problem after SEP 12.1.2015 is installed on CallPilot voice messaging servers.

CallPilot AOS service (nmaos.exe) fails to start and terminates unexpectedly after Symantec Endpoint Protection  12.1.2015.2015 is installed.

As a result, CallPilot voice messaging server is out of service, it is not able to accept calls, fax and text messages.

The windows service creates and uses named mailslots to send\receive maintenance messages from other CallPilot services.

I tried to debug the service and found out that it crashed when an unhandled exception in nmaos.exe (NTDLL.DLL) 0xC0000005: Access Violation took place when the service called ReadFile function and attempted to read from a mailslot. If I comment a call of the ReadFile function, the service does not crash.

Important note: We fully qualified SEP version 12.1.1000.157 and this SEP version does not cause any issues on CallPilot servers: all CP services are starting and running with no crash.

I also read a posted question about a similar problem with mailslots (http://www.symantec.com/connect/forums/createmailslot-fails-twice-day-when-symantec-endpoint-protection-active) and uninstalled Application & Device Control feature but this didn't solve my problem, CP AOS service still crashes.

Does SEP 12.1.2015 hook named mailslots ? Any help is appreciated !

Thanks,

Evgeny

What components are installed? NTP?

Hi,

Did we add any exceptions in SEP for this software . If not try adding all the folders used by this software and check if it works.

We need to identify what component is causing the issue.

Try uninstalling one component at a time and check which component is the culprit. Try uninstalling NTP first then PTP. If we still face issue then try disabling Auto protect and check .

Once you have component then we can think of a way around.

- MASH 

The following components are installed:

Virus, Spyware and Bacis Download Protection: Advanced Download Protection.

Proactive Thread Protection: SONAR

Network Thread Protection: Intrusion Prevention, Firewall.

I tried to add all kind of exceptions in SEP to prevent my service from crashing but it didn't help.

Then I uninstalled SONAR component and my service started successfully but this workarund is not accepteble for our customers.

BTW, Operating system is Windows Server 2003 SP2

Should be false positive check this document

Handling and preventing SONAR false positive detections

http://www.symantec.com/business/support/index?page=content&id=HOWTO55273

Hi,

My service (nmaos.exe) is still crashing at startup after all possible SEP exceptions are configured . See enclosed screenshot.

nmaos.exe is excluded from scanning, can you exclude it from SONAR as well.

I excluded an entire folder (D:\Nortel\bin\*) from SONAR detection where the service resides.

I also excluded the file (nmaos.exe) from SONAR, having added an application exception. Please see another enclosed screenshot, showing configured application exceptions.