Endpoint Protection

I found this post with the same issue (it is not English, but you can translate). I search the forum and did not see anything on this. I am new so my search terminology may have had issues.

Here is the post:http://www.devadmin.it/2014/10/30/symantec-endpoint-protection-12-1-5-crash-applicazioni-net-su-share-di-rete/

Basicly, we have some Point of Sale that run some .net 4 vb code from a local server. I was running 11 R6 without any issues, but after installing 12.1.5 they will not run. I then removed 12.1.5 and all runs ok. My system is same as the post, XP SP3 32bit.

Here is the event log message:

Event Type:    Error
Event Source:    Application Error
Event Category:    (100)
Event ID:    1000
Date:        11/3/2014
Time:        5:30:51 PM
User:        N/A
Computer:    ST0476_REG4
Description:
Faulting application , version 0.0.0.0, faulting module unknown, version 0.0.0.0, fault address 0x603be41f.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74   Applicat
0008: 69 6f 6e 20 46 61 69 6c   ion Fail
0010: 75 72 65 20 20 20 30 2e   ure   0.
0018: 30 2e 30 2e 30 20 69 6e   0.0.0 in
0020: 20 75 6e 6b 6e 6f 77 6e    unknown
0028: 20 30 2e 30 2e 30 2e 30    0.0.0.0
0030: 20 61 74 20 6f 66 66 73    at offs
0038: 65 74 20 36 30 33 62 65   et 603be
0040: 34 31 66                  41f     

Here is the Troubleshooting.txt file 

Attachment(s)

Troubleshooting_4.txt   7 KB 1 version

What SEP components are installed and being used? Is it possible the firewall is blocking traffic? Have you tried by disabling all components except for AV? Anything showing in the logs?

Have you tried with only Antivirus and Antispyware components only? 

Just went though it with tech support. I thought I had posted the case number, but I don't see it. 
Case # 0760299

First, it took some convincing since the .net app is one we developed. I pick the simplest one, just a wait program that delays for a batch program. It could be any of the .net. The other interesting thing is the link above, he says if he includes a "config" with the exe that he did not see the problem, without it he had the problem. This makes me think Symantec is tweaking a iexplore security setting.

Anything showing in the logs?
No.

Is it possible the firewall is blocking traffic?
It was not installed.

Rafeeq,Have you tried with only Antivirus and Antispyware components only?
Have you tried by disabling all components except for AV?
This is were it got weird. We un-installed everything and the issue disappear. So we started turning them on one by one and they all worked. Then we un-installed the firewall and it still worked. So, I did a remove install, then re-installed the exe I exported and the problem returned. I just exported a install that included the firewall. Somewhere I saw something about a bug and they had to installed it, then disable it. I will update after the test.

What SEP components are installed and being used?
The feature set with the issue:
Under "Virus, Spyware, and Basic Download Protection
      Advance Download Protection (this one only)

Proactive Threat Protection
      SONAR Protection
      Application and Device Control

Network Threat Protection
      Intrusion Protection (this one only)

Scan when a file is accessed or modified is the radio button that is selected.

If you take that same program and copy to the local hardrive, you will not have the issue.

Ok, tried a install with firewall turn on, same thing. So I removed all features, of course worked, then enable my standard set of features, still worked. 

Next, theory of why it removing all features, then reinstalling work, ... I notice there are no defanation after that process, I am trying to get the definations up todate, and see if it returns.

next time select only scan when modified, it might be accessing few things outside the system and they are getting scanned.

and also the network settings

Anything show up in the traffic log?

Anything show up in the traffic log?
no
 

next time select only scan when modified, it might be accessing few things outside the system and they are getting scanned.

and also the network settings
So I drop the radio button down one to the "scan when modified" radio button, same thing. I started and stop the services (smc -stop, smc -start) same thing.

Not sure what happen to my post, so if this shows up again, sorry.
After the definitions got caught up, I was back to the same issue. This attachment has some event viewer things and a debug log. You can look at the event viewer part and match the time of when the "wait.exe" was executed, to find it in the debug.log part.

Attachment(s)

debug_25.txt   28 KB 1 version

if wait.exe is your executable can you try creating an exception for it?

http://www.symantec.com/business/support/index?page=content&id=TECH104326

Do yu have application and device control enabled ?

if wait.exe is your executable can you try creating an exception for it?
The tech had me try, same issue.

Do yu have application and device control enabled ?
Where do I to look? :-)

remove duplicate post.

Could not see how to delete it.

Add/remove programs, see if that component is installed from when you go to modify the SEP install

Ok, found it. I think.

Under the policy,Application and Device Control...
Application Control Rule Sets. None of the boxes are check.

Device Control
Block Devices is empty
Devices Excluded From BLocking is empty
 

Log Detected devices is check
Notify usesrs when devices are blocked or unblocked is not checked

Oh, yes it is installed. The only things I do not have installed are Outlook, Lotus, Pop server, and firewall

Out of curiosity, create an applicationa nd device control exception for wait.exe, se ehere:

Creating Application Control Exclusions in Symantec Endpoint Protection 12.1

Sorry for taking so long to get back, I was working with Symantec tech yesterday afternoon.

Ok, explain this one. I am reading your article to understand whats going on. One of the links talked about using procmon.exe. So I thought I would start it and see what is going on.

Am I smoking something here, but as long as procmon.exe is running, wait.exe (the .net test program) works, if I stop procmon.exe then wait.exe error. 

I going back down the path of the "injected sysfer.dll" and see where that leads.

This is one of the cases where the test tool is affecting the results. Wait.exe will not run with out procmon running. I am posting the output from procmon filtered on wait.exe. Also I am re-posting for reminder what windows is seeing and why it throws the error.

Remember this is when procmon was not running and windows threw the error.

Event Type:    Error
Event Source:    Application Error
Event Category:    (100)
Event ID:    1005
Date:        11/5/2014
Time:        7:01:55 AM
User:        N/A
Computer:    ST0476_REG4
Description:
Windows cannot access the file \\10.77.77.30\c\user\braums\com\Wait.exe for one of the following reasons:  there is a problem with the network connection, the disk that the file is stored on, or the storage  drivers installed on this computer; or the disk is missing.  Windows closed the program Wait.exe because of this error.

Program: Wait.exe
File: \\10.77.77.30\c\user\braums\com\Wait.exe

The error value is listed in the Additional Data section.
User Action
1. Open the file again.  This situation might be a temporary problem that corrects itself when the program runs again.
2.  If the file still cannot be accessed and
    - It is on the network,  your network administrator should verify that there is not a problem with the network and that the server can be contacted.
    - It is on a removable disk, for example, a floppy disk or CD-ROM, verify that the disk is fully inserted into the computer.
3. Check and repair the file system by running CHKDSK. To run CHKDSK, click Start, click Run, type CMD, and then click OK. At the command prompt, type CHKDSK /F, and then press ENTER.
4. If the problem persists, restore the file from a backup copy.
5. Determine whether other files on the same disk can be opened. If not, the disk might be damaged. If it is a hard disk, contact your administrator or computer hardware vendor for  further assistance.
Additional Data
Error value: C0000022
Disk type: 4

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Attachment(s)

Logfile_Procmon.7z   254 KB 1 version

Hi Paul,

Do you have a solution of your problem ?

Because, I have the same issue

Client Windows XP in french with SEP 12.1.5 client in english

My application is on a network drive and it's using dotNet 3.5.

Thanks

Hi Paul, I have the same problem, did you get a solution?

Thanks!!

Same here. Application running on a network drive on XP32 bit, crashes 66% of the time. Adding it to exceptions is totally ineffective. The ONLY way to get it to successfully run is to turn off File System Autoprotect.

Add me to the list as well.  Server 2003 (32 bit) terminal server with dotNet application on a mapped network drive.  App crashes 2 out of 3 tries. Everything runs fine turning off File System Autoprotect.

No problems running SEP 12.1.4.  Trouble started after upgrading to 12.1.5.  No changes to any settings/policies, just an upgrade.

Could it be this problem?

How to disable deferred scanning in auto-protect for Symantec Endpoint Protection

I tried but I still have the same problem.

Look the attachment

We disabled the deferred scanning as described on the client, to no avail. We are still experiencing the crash. Also, because nothing seems to be fixing this, we also turned off deferred scanning on the server where the application resides. This did not fix it either. As others have noted, the application did not crash with 12.1.4.

I can confirm Sysinternals Process Monitor prevents the crash from occuring

While trying to delve deeper into the cause of this, Sysinternals Process Monitor 3.1 was installed on the client where the crash is occcuring. While Process Monitor is running, the application will run succesfully 100% of the time. Closing Process Monitor, the crash returns.

We don't even know where to go next with this problem.

I'm able to get our app to error while process monitor is running.

We have 3  VB.net applications that intermittently dump after installing SEP 12.1. 11.1 had no issues.

The apps run across a network share in a workgroup environment. The machine the app resides on has no issues. At our corporate location the app runs fine in a domain setting.

If we turn off auto protect the applications run fine 100 percent of the time.

Using Process Monitor I managed to trace ccSvcHst.exe "ACCESS DENIED" as our application requested to read a file. At that point the app went to debug.

I'll try to debug further next week

-John

Out of curiosity is scanning of file on remote computers enabled in any of the cases, like below?

Our Settings are:

Scan when a file is modified

Trust files on remote computers

Seems problem has been around for a while. Here Microsoft put's the blame squarely on Symantec:

https://social.msdn.microsoft.com/Forums/vstudio/en-US/3dcae4b7-6bb3-4b97-a618-3697b8bffbd4/net-applications-crash-during-start-with-net-framework-20-error?forum=clr

Paul

I found your thread with Ermanno

http://www.devadmin.it/2014/10/30/symantec-endpoint-protection-12-1-5-crash-applicazioni-net-su-share-di-rete/

His suggestion of forcing the application to use the correct .net clr seems like a good workaround.

I added

<startup><supportedRuntime version = "v2.0.50727" /></startup>
before the
</configuration> line in the apps config file.

And my applications seem to behave.

I changed the "Enable Insight" setting from "Symantec Trusted" into "Symantec and Community Trusted", then I no longer had this problem (error C000022).