Symcorpui crashing on Windows 7. Error: 'Symantec AntiVirus has stopped working' while running scan.
search cancel

Symcorpui crashing on Windows 7. Error: 'Symantec AntiVirus has stopped working' while running scan.

book

Article ID: 152498

calendar_today

Updated On:

Products

Endpoint Protection

Issue/Introduction

When attempting to perform a quick scan and/or full scan with the Symantec Endpoint Protection (SEP) client, the scan stops and the following error message is generated:
"Symantec AntiVirus has stopped working. A problem caused the program to stop working correctly. Windows will close the program and notify you if a solution is available."

When attempting to accomplish a manual scan, the following pop-up is displayed:


In the Windows Application Event Log, you may see one or both of the following events recorded:

  1. Application Information with Event ID: 1001
    Description-
    Fault bucket 452704182, type 5
    Event Name: ScriptedDiagFailure
    Response: Not available
    Cab Id: 0

    Problem signature:
    P1: Microsoft Windows.NetworkDiagnostics.1.0
    P2: Default
    P3: 1.0.0.0
    P4: Default
    P5: 4527041820
    P6: 4527041821
    P7: 4527041822
    P8: 4527041823
    P9: 4527041824
    P10: 4527041825

    Attached files:4527041826

    These files may be available here:
    4527041827

    Analysis symbol: 4527041828
    Rechecking for solution: 4527041829
    Report Id: 50
    Report Status: 51
     
  2. Application Error with Event ID: 1000
    Description-
    Faulting application name: SymCorpUI.exe, version: 11.0.6070.422, time stamp: 0x4bd14884
    Faulting module name: ntdll.dll, version: 6.1.7600.16385, time stamp: 0x4a5bdb3b
    Exception code: 0xc015000f
    Fault offset: 0x0008440
    Faulting process id: 0x824
    Faulting application start time: 0xSymCorpUI.exe0
    Faulting application path: SymCorpUI.exe1
    Faulting module path: SymCorpUI.exe2
    Report Id: SymCorpUI.exe3

 

Cause

This issue is caused by insufficient permissions in registry. The registry keys involved can be seen in a ProcMon log:

  1. HKEY_CURRENT_USER\SOFTWARE\Symantec\Symantec Endpoint Protection
  2. KEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\AV\Custom Tasks

     

    An example seen in ProcMon:

ACCESS DENIED on RegCreateKey for SymCorpUI.exe on registry path- HKEY_CURRENT_USER\SOFTWARE\Symantec\Symantec Endpoint Protection\AV\Custom Tasks\Temporary Quick Scan Options {FFEE7373-7E6F-4E06-9883-44C4FBF4BB47}

Note: "Temporary Quick Scan Options" will appear only when running a scan.

 

 

 

Resolution

WARNING: The following steps require editing of the system registry. Prior to editing the registry, make a back up the registry.
Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify only the registry keys that are specified.
For assistance with backing up the registry prior to editing it, see the document "Back up the registry" (http://windows.microsoft.com/en-us/windows7/Back-up-the-registry).

Check permissions on the following registry keys:
'HKEY_CURRENT_USER\SOFTWARE\Symantec\Symantec Endpoint Protection'
'HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\AV\Custom Tasks'.

Change the permission the listed keys to the following:

  1. Administrator - Full Control
  2. SYSTEM - Full Control
  3. Users - Full Control
  4. Restricted - Read (may not present)

Note: Make sure All the permissions above apply to "This key and subkeys" and the permissions are inherited to child registry keys by checking the option - "Replace all child objects permissions with inheritable permissions from this object"