Windows service terminates unexpectedly following install of Symantec Endpoint 12.1.2015
Hello!
Customers encountered and reported the following problem after SEP 12.1.2015 is installed on CallPilot voice messaging servers.
CallPilot AOS service (nmaos.exe) fails to start and terminates unexpectedly after Symantec Endpoint Protection 12.1.2015.2015 is installed.
As a result, CallPilot voice messaging server is out of service, it is not able to accept calls, fax and text messages.
The windows service creates and uses named mailslots to send\receive maintenance messages from other CallPilot services.
I tried to debug the service and found out that it crashed when an unhandled exception in nmaos.exe (NTDLL.DLL) 0xC0000005: Access Violation took place when the service called ReadFile function and attempted to read from a mailslot. If I comment a call of the ReadFile function, the service does not crash.
Important note: We fully qualified SEP version 12.1.1000.157 and this SEP version does not cause any issues on CallPilot servers: all CP services are starting and running with no crash.
I also read a posted question about a similar problem with mailslots (http://www.symantec.com/connect/forums/createmails...) and uninstalled Application & Device Control feature but this didn't solve my problem, CP AOS service still crashes.
Does SEP 12.1.2015 hook named mailslots ? Any help is appreciated !
Thanks,
Evgeny
Comments 8 Comments • Jump to latest comment
What components are installed? NTP?
SEP Knowledge Base
Endpoint SWAT
The following components are installed:
Virus, Spyware and Bacis Download Protection: Advanced Download Protection.
Proactive Thread Protection: SONAR
Network Thread Protection: Intrusion Prevention, Firewall.
Hi,
Did we add any exceptions in SEP for this software . If not try adding all the folders used by this software and check if it works.
We need to identify what component is causing the issue.
Try uninstalling one component at a time and check which component is the culprit. Try uninstalling NTP first then PTP. If we still face issue then try disabling Auto protect and check .
Once you have component then we can think of a way around.
- MASH
- MASH
I tried to add all kind of exceptions in SEP to prevent my service from crashing but it didn't help.
Then I uninstalled SONAR component and my service started successfully but this workarund is not accepteble for our customers.
BTW, Operating system is Windows Server 2003 SP2
Should be false positive check this document
Handling and preventing SONAR false positive detections
http://www.symantec.com/business/support/index?pag...
Please don't forget to mark your thread solved with whatever answer helped you : ) Rafeeq
Hi,
My service (nmaos.exe) is still crashing at startup after all possible SEP exceptions are configured . See enclosed screenshot.
nmaos.exe is excluded from scanning, can you exclude it from SONAR as well.
Please don't forget to mark your thread solved with whatever answer helped you : ) Rafeeq
I excluded an entire folder (D:\Nortel\bin\*) from SONAR detection where the service resides.
I also excluded the file (nmaos.exe) from SONAR, having added an application exception. Please see another enclosed screenshot, showing configured application exceptions.
Would you like to reply?
Login or Register to post your comment.