Endpoint Protection

Hi all,

I am sorry for duplicate threads, but first thread is in solved status and it's not correct.

First thread is: https://www-secure.symantec.com/connect/forums/blue-blank-screen-when-system-shutdown.

We performed upgrade of Symantec Endpoint Protection to RU4 version. Frequency of problems is smaller, but problem with shutdown and freezing of programs is still here.

We tested cleaning with CleanWipe, but without solution.

Does anyone know a solution of this problem?

Thanks...

What components do you have installed?

Run the SymHelp tool to see if any errors arise:

Symantec Help (SymHelp) Download

http://www.symantec.com/docs/TECH170752

Troubleshooting computer issues with the Symantec Help support tool

http://www.symantec.com/docs/HOWTO80839
 

If nothing, you will need to collect some advanced logs and open a support case:

How to use the advanced debug logging options for the Symantec Endpoint Protection client in SymHelp

http://www.symantec.com/docs/TECH207795

How to use the Symantec Help Tool to collect data for Support

http://www.symantec.com/docs/TECH203599

How to create a new case in MySymantec

http://www.symantec.com/docs/TECH58873

Phone numbers to contact Tech Support:

Regional Support Telephone Numbers:

    United States: https://support.broadcom.com (407-357-7600 from outside the United States)
    Australia: 1300 365510 (+61 2 8220 7111 from outside Australia)
    United Kingdom: +44 (0) 870 606 6000

Additional contact numbers: http://www.symantec.com/support/contact_techsupp_static.jsp

if 12.1.4 did not solve the issue, best thing is to open the support case.

Hi Brian,

I launched SymHelp on computer which had problem (before hard restart) and everything is fine.

Only "Disable the Windows Autorun feature" is red, but it is ok. We use "Aplication and Device Control", rule "Block access to Autorin.inf [AC9]".

We install full Symantec Endpoint Protection without SNAC.

If you want to do a quick test, remove all components except antivirus and test again. Maybe we can narrow it down to one specific component.

We dismantled SEP... step by step and when we banned driver SRTSPX, problem was solved. But if SRTSPX is banned, SEP does not work correctly... of course...

We dont have problem before SEP12 RU2 with running SRTSPX (for example RU1 MP1 and lower), but from version RU2, we have problem...

SRTSPX is Symantec Real Time Storage Protection. Here is probably problem, because, Altiris Recovery Solution uses driver ofmlvdrv.sys, which works with hard disk too... And problem is always after snapshot of Recovery Solution...

Snapshots of Recovery Solution without SEP are without problems...

I am sorry for my english:(

So it may be more the AV component than anything else. You could uninstall the AV component to verify but than what's the point...

Probably best to get support involved to look at this, especially being on the latest version of SEP.

The original thread mentions the Altiris Recovery Solution, is this still part of the problem?

I'd recommend assigning a test policy to a machine to disable Auto-Protect only, and see how this affects performance.

If this improves performance, then it's possible that something is generating lots of Disk I/O during the shutdown process (which Auto-Protect is exacerbating).  In which case, you'll want to find what's causing the Disk I/O and consider excluding the file from scanning.

Something else to check is if you have a GPO set to zero out the hibernation file on shutdown.  This can also cause a load of Disk I/O (which again will look worse with Auto-Protect scanning the hibernation file).

Yes, I will try uninstall AV and then, I will contact Symantec support...

There is not other way...

I would only uninstall just as a test. Don't go too long with it disabled.

You can also use ProcMon to check the disk activity as well to see what is happening.

As per my post below, I'd recommend against disabling Auto-Protect altogether, as this leaves you far too vulnerable to attack.

Instead, I'd suggest you investigate to determine what is causing the Disk I/O, and exclude it from scanning/auto-protect.

Blue blank of screen when shutdown is only consequence, because some processes cannot terminated.

On screenshot of processes on original thread can you see problem with process igfxsrvc.

Thus we detect problems on computers. We dont have another method of detecting. Only a lot of same immortals process and blue blank of screen when shutdown.

We dont use hibernation.

I think, that driver SRTSP don't survive step of ofmlvdrv, which create virtual snapshot of harddisk, to be able to back up data. SRTSPX denies access to some data, virtual shapshot isn't consistent and problem is on the world...

If you believe the igfxsrvc process to be part of the problem, have you tried investigating it?

From what I can tell it's not really required as all it provides is the gui and systray icon for some Intel software.

I'd also recommend you look into another Desktop recovery product, as Recovery Solution reached End of Support Life in July last year :

http://www.symantec.com/business/support/index?page=releasedetails&key=56079

No, igfxsrvc is too only consequence, because, problematic process is random. Sometime it is component of graphic and only one icon in systray has problem, which is visible (when system shutdown -> blue blank screen), sometime it is MS Excel (or another product of Microsoft) and in this case user contact our helpdesk, some time it is Explorer and this usualy we identify imadiately (freezing of desktop). Byt at the same time when for example Excel has problem, other processes may not have problem.

I am sorry, but solve the problem of Symantec Endpoint Protection by we find another rRecovery product... that is not right solution...

We have licence to Symantec System Recovery 2013, but this Suite hasn't too benefits against Altiris Recovery Solution (for example deduplication on server site storage for all users. For big company indispensable.).

Can I make video with problem on computer, if it improves the understanding of the problem, ok? :)

If you believe the issue is a bug or incompatibility, then the recommended action is to log a case directly with Symantec for them to investigate.  Just pick your region from the drop-down list on the below page and give them a call 

http://www.symantec.com/support/techsupp_contact_phone.jsp

As far as my personal investigation suggestions, they remain the same:

1. Confirm it is the auto-protect component causing the issue
2. Determine what it is scanning
3. Exclude that from the auto-protect scans

Perhaps you could try using Process Monitor (http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx) to track Disk I/O by process and see if anything is particularly high during the shutdown process?