Endpoint Protection

Hi there,

I am running Symantec Endpoint Protection version 14 (14.0 MP2) on Windows 10.

Each time I start my computer, Windows 10 gives me a notification comming from Symantec Endpoint Protection saying that the product requires my attention.

Also, if I put the pointer of my mouse (without clicking) on the Symantec icon on the notification zone, there is a message indicating that there are several problems.

When I launch the Symantec interface, I see nothing and everything seems to work correctly.

How I can see what problems Symantec is talking about? How I can solve this?

Of course, the client has been updated recently, and the virus signatures too.

My entire company is using this soft, and I am the only one with this problem.

Any help of that is (more than) welcomed.

Thanks & cheers, Eric.

This is known, check the following for more info:
https://support.symantec.com/en_US/article.TECH248552.html
https://www.symantec.com/connect/forums/symantec-updates-meltdown-spectre?list_context_id=1403&list_context_type=sc_forum#comment-11959951

 

Hello Eric,

This is in a known issue.

This issue is addressed in the following builds, which were released on 1/17/2018. These are builds for Windows that can be imported into the Symantec Endpoint Protection Manager.

• 12.1 RU6 MP9 (12.1.7384.6902)
  • This client version can be managed by any 12.1 or 14.0 SEPM.
• 14 MP2 (14.0.2455.0206)
  • This client version must be managed by SEPM version 14.0 RTM and later.
• 14 RU1 (14.0.3775.1002)
  • This client version can be managed by SEPM version 14.0 RU1 and later.
• 14 RU1 MP1 (14.0.3892.1101)
  • This client version can be managed by SEPM version 14.0 RU1 and later.

Obtaining the Hotfix Builds:

To obtain client-only builds, contact Symantec Technical Support.

The full 12.1 RU6 MP9 and 14 RU1 MP1 hotfix builds will be available from Fileconnect soon.

Check this Article:

https://support.symantec.com/en_US/article.TECH248552.html

Hope that helps!!

Hello Eric,

John Owens from Symantec has updated the below Threads with his comment:

https://www.symantec.com/connect/forums/sep-system-tray-icon-warns-multiple-issues-following-installation-january-3rd-2018-windows-se#comment-11960111

https://www.symantec.com/connect/forums/latest-win10-update-corrupts-sep14#comment-11959871

The English client packages (hotfix) (.dat/.info) files are available for distribution.  You can download them here:

•    12.1 RU6 MP9 (12.1.7384.6902) - https://symantec.box.com/s/y0j2r3gwl65hxqnwnltwws1...
•    14 MP2 (14.0.2455.0206) - https://symantec.box.com/s/gr3pk9s4hpx5cp1mk4zgeie...
•    14 RU1 (14.0.3775.1002) - https://symantec.box.com/s/qej42vf6efabaisakqomy6m...
•    14 RU1 MP1 (14.0.3892.1101) - https://symantec.box.com/s/kl2dbafvyphzz56i5inqe68...

See the following document for additional details on importing this media into an existing SEPM

https://support.symantec.com/en_US/article.HOWTO81...

The full builds of SEP 14 RU1 MP1 and SEP 12.1 RU6 MP9 are still being worked on for the additional languages.  As soon as they are available I will update the thread.

If you can't upgrade download and install the following MS KB to fix it:

KB4057144 [2018-01 Cumulative Update for Windows 10 Version 1703 for x64-based Systems (KB4057144)]

@Brian

Are you suggesting that both the Symantec Hotfix and the Microsoft CU provide an identical patch for the tray icon issue?

Do you have any suggestions for x86 clients as the Microsoft CU is not applicable in those cases?

I'm not suggesting anything. MS put out a patch that fixes the issue with SEP, was it specific to SEP? I doubt it. I'm only pointing out what others have said in other threads.

In any case, follow the recommendation and get the hotfix applied.

Thanks for all answers.

However, KB4057144 is apparently for Windows 10 Version 1703 while I'm on Windows 10 Version 1709 instead.

Also, I do not have SEPM on my computer. I must install it?

A detailed HowTo to perform the update would be needed, I think..

Cheers, Eric.

The English client hotfixes are avialable:

https://www.symantec.com/connect/forums/latest-win10-update-corrupts-sep14?page=1#comment-11959701

You'll need to apply the one for whichever version of SEP you're currently running.

Sorry, I must be stupid. I do not see the way to solve the problem in the link you are providing in your post.

I thus repeat:

I do not have SEPM on my computer. I must install it?

A detailed HowTo to perform the update would be needed, I think..

Thanks for your help on that!

Cheers, Eric.

The link I posted goes to a post by Symantec's John Owens, who posted the hotfix downloads for the specific SEP versions affected. Pick the version that you're running and download and run the hotfix for it.

The SEPM is not affected by this. Client only. You don't need a SEPM to deploy the hotfix, especially in your case where you're the only one affected.

The other thing you mention is your entire company is running SEP but youre the only one having the issue. Are you the sysadmin or do you have someone you can work with to help out?

@Brian

In the link you posted to John Owens' post, there are additional posts by him that indicate one does need SEPM if for nothing else but to export out the exe or msi for direct client patching.  The download links are for SEPM use to patch clients unless I'm missing other links for client only patches.

You'd need a SEPM if you want to deploy this hotfix to all clients managed by the SEPM. For one offs/manual upgrade, it's not necessary. I don't know if they've posted the client patches yet, which would be the executable install. If they haven't then yes you'd have to go the route of using a SEPM. Otherwise you'll need to open a support case to get the build.

In my last post I said "I must be stupid". Now I know I am studid. There no post from John Owens in the link you've posted.. Am I missing something?

Eric.

The thread has over 230+ comments, so not all comments are shown. At the bottom, you have to click on "Show All Comments" button to see all comments. I have copied & pasted what he has posted for you. :)

IMPORTANT UPDATE:

Over the past couple weeks we’ve been working with Microsoft to have them address the issue outlined in this thread from their end. Ultimately, the systray icon issue was caused by a change they made that impacted how we were using a certain call (CoInitializeSecurity). They had acknowledged it as a known issue, but their timeline for delivery of a solution was Mid-February. So we decided to proceed with publishing the hotfixes mentioned below, in order to unblock customers and allow them to deploy the Microsoft Security Updates for Meltdown.

As many of you have mentioned Microsoft was able to release this fix much sooner than expected.

Here are the updates for each impacted Operating System:

•        Windows Server 2016 – KB4057142
•        Windows Server 2012 R2 – KB4057401
•        Windows Server 2012 – KB4057402
•        Windows 10 1709 – KB4073290
•        Windows 10 1703 – KB4057144  
•        Windows 10 1607 – KB4057142
•        Windows 8.1 – KB4057401

Effectively immediately, we are pulling all 4 hotfix builds from distribution. If you have already applied the patch and are not having any of the issues with the GUI that’s completely fine. Our fix is compatible with the change made by Microsoft and we will support both the original version and the hotfix version of the 4 releases we made available. If you have not yet deployed, there is no reason to continue to make plans to do so. Instead, discard the hotfix media and implement the relevant Microsoft Update outlined above.

Thanks!

(I feel a bit less stupid now, thanks to you ..).

I've install the needed Microsoft update. I had to reboot my system several times before getting to a stable situation. The problem now seems to be solved correctly.

Thanks!

Eric.

Hi Eric,

No problem, glad this is now resolved for you.

Hi there,

Sorry, I was too fast on that. Indeed the two problems that I had (notification comming from Symantec Endpoint Protection saying that the product requires my attention; and on the Symantec icon in the notification zone, a message indicating that there are several problems) disapeared.

However, I now discovered that my computer is apparently not protected any more! Opening the SEP interface, I have orange messages, LifeUpdate cannot be accessed any more, etc.

Clicking on details, I have 5 messages that are more or less (translated from French):

Upload diagnostic not working due a component avoiding intrusion

Protection against threat not working due to a error in intern configuration.

And so on.

I thus had to uninstall the Microsoft update I've installed before. My computer is now back under protection, but the two initial problems are now obviously back..

Hence, the problem remains to be solved..

(this looks like a never ending story).

Thanks for any additional help on that.

Cheers, Eric.

Hi Eric,

I applied the Windows 10 1703 patch (alongside with the patch that Microsoft released a few weeks ago) on SEP v14.0.3752.100 64 bit and I do not see this issue that you've described.

Have you run the most latest def update? We're currently on 19/01/2018 R2 defs.

Hi Tony,

Thanks for your reply.

I applied the Windows 10 1709 – KB4073290 - patch. I have SPE v14.0.2415.0200 64 bits (that's the version I was given by my company). I do not know which is the latest def, but there is a LifeUpdate launched every (early) morning on my side, so I guess this should be fine.

Still no way to solve this issue.. Pfff!

Eric.

Hi Eric,

I'd run SymDiag on this and see what it finds. Feel free to post the result here if you require further help.

Thanks again Tony,

I've run SymDiag (without the Windows update installed), and there are quite a lot of issues (indicated in red). There is file (report) produced, but what can I do with it?

Am I really the only one in this situation? Is there another way than installing this Windows update to solve the problem?

Thanks (again!) and cheers,

Eric.

The file produced is attached here, in the case this will help.

Eric.

Attachment(s)

[MILESDAVIS]__2018-01-19__17-39-05__cd0026.rar   2.46 MB 1 version

The BOX links doesn´t work anymore

Because the hotfix was pulled:

http://www.symantec.com/docs/TECH248552

Microsoft ended up releasing a patch the other which fixed the SEP cosmetic issue.

Anyone else have issues with this SEP version (14.0.3892.1101)  and a Win10 desktops?

On a pc with Teamviewer installed, it seems that every time one signs in  to "Computers and Contacts" on the Teamviewer interface, the SEP client gui crashes (the SEP icon disappears from the taskbar, and a windows application error pop up appears, stating that SmcGui.exe has crashed due to memory that could not be written?

On other random desktops this same GUI crash occurs even without Teamviewer installed....

Help?

This seems to be a different isue but I can't be sure. You can upload the file by opening a case with Symantec and attach the file you have. They will be able to advise you.

We have the issue with SEP Version 14.0.3892.1101 and Windows 10 giving a SmcGui.exe Application Error resulting in the SEP icon disappearing. 

Only our student netbooks with Windows 10 home edition 1709 are having this issue. All the other versions of Windows 10 we have (Pro, Education and LTSB) are fine.

I have a case open with Symantec. In the meantime, I have rolled them back to SEP Version 12.1.6 and the windows patch KB4073290 fixed the yellow dot problem.