Endpoint Protection

 View Only
  • 1.  Event Viewer items since uninstalling Symantec Endpoint Protection

    Posted Jun 14, 2011 11:14 AM

    We were using Symantec Endpoint Protection until February. At that point, we switched vendors. (But based on our experience there, we might be switching back within the year.) The problem we are now facing is that we are receiving numerous items in our event logs that look like:

    Detection of product '{E3F6BA2D-0351-461F-80D0-60C523C24384}', feature 'Bin', component '{711CBE62-401D-47AC-8919-4C0029EC66DD}' failed. The resource 'D:\Program Files\Symantec\Symantec Endpoint Protection Manager\data\temp\UploadTemp\' does not exist.

    I do not know what is causing this. An old client attempting to upload something to quarantine? LiveUpdate attempting to update a non-existent product? MsiInstaller seems to be what is throwing the error so that is what made me wonder if it might be LiveUpdate. What is interesting to note is that prior to the uninstall, we'd get information notices about the same interval, except instead of failing, it was processing installs. And instead of hashes, it was actually indicating Symantec Endpoint Protection. I'm guessing that since the uninstall, it cannot resolve the hashes, which is why it just displays the hash.

    I have attempted to search the registry for the hash but have come up empty-handed. I'm not sure where else to search. What is even more bizarre is that despite the uninstall, the SEP manager still appears to be running. I can connect to it through the management console. So it's as if the uninstall was not complete. (Even though I uninstalled the console, then the client, on the server.) Now I can manually uninstall the management portions, I'm pretty certain. But I'd like to know what's throwing these errors in the event viewer and clean that up, and I don't think removing the management console is going to do that.

    We're still running BackupExec 12.5, otherwise I'd nuke LiveUpdate entirely. (I already uninstalled and re-installed LU but it still attempts to find updates for numerous SEP products. Virus definitions, etc.)

    Anyway, I'd really any suggestions. Is there a way to "nuke" the products that LU is looking for and force it to rebuild what products are installed? I seem to recall seeing many months ago a command line method to do this.

    I'd appreciate any help. Thanks so much!



  • 2.  RE: Event Viewer items since uninstalling Symantec Endpoint Protection
    Best Answer

    Posted Jun 14, 2011 12:38 PM

    You can try following command,

    1.From the Start menu select Run

    2,Enter the following command including the quotes:

    "C:\Program Files\Symantec\Symantec Endpoint Protection Manager\bin\LuCatalog.exe" -cleanup

    This command will unregister all Symantec Endpoint Protection Manager content from LiveUpdate.

    Some times it happens that even after uninstalling SEP , some registery entry  remains in the system.

    You can check following document

    How to manually uninstall Symantec Endpoint Protection client from Windows 2000, XP and 2003, 32-bit Editions

    http://www.symantec.com/business/support/index?page=content&id=TECH102261&actp=search&viewlocale=en_US&searchid=1308069151747

     

     Your satisfaction is very important to us. If you find above information helpful….. Please mark it accordingly .

     



  • 3.  RE: Event Viewer items since uninstalling Symantec Endpoint Protection

    Posted Jun 14, 2011 05:47 PM

    You are a miracle worker! Thank you so much. That resolved it!