Endpoint Protection

 View Only

  • 1.  VPTray.exe Querying symoem.dll constantly

    Posted Feb 12, 2008 10:46 AM
    While tracing Files using Sysinternals File Monitor shows VPTray.exe attempting to request symoem.dll repeatedly.  I searched around on Google and didn't find much about this.  I checked out multiple servers and clients and did not find any such location or file.
     
     
    Process:  VPTray.exe
    Request:  Query Information
    Path:  c:\Program Files\Common Files\Symantec Shared\OEM\symoem.dll
    Result:  PATH NOT FOUND
     
    The reason I am concerned is I'm having odd issues on my Intranet Server and am beginning to wonder of Symantec is causing them.  This "Query Information" repeats itself almost constantly.  It tries eight times every two to five seconds.  I'm sure it would run better if it wasn't looking of path and file that does not exist.
     
    More info:
    Server:  Windows Server 2003 R2 Enterprise Edition SP2
     
    Symantec File:  VPTray.exe
    Version:  10.1.5.5000
     
    I searched the Registry entireley for the symoem.dll and did not find any entries.  Perhaps, there would be less performance lost if it wasn't constantly looking for this dll file?


  • 2.  RE: VPTray.exe Querying symoem.dll constantly

    Posted Feb 12, 2008 11:38 AM
    I went ahead and checked out a couple other servers I have running Symantec AntiVirus Corporate edition and found the following. 
     
    Servers running SAV CE 10.1.5.5000 were all doing the same thing with the VPTray.exe attempting to access the symoem.dll file.
    (Verified on three W2k3 servers)
     
    Servers running SAV CE 10.0.2.2002 did not have any calls for symoem.dll
    (Verified on one W2k3 server)
     
    (By the way, I am looking to upgrading all of them to SEP.. However, I'm still wanting some performance issues fixed before I put my companies servers and network through SEP)
     
    I also noticed that VPC32.exe is "Querying Information" for the symoem.dll file. 


  • 3.  RE: VPTray.exe Querying symoem.dll constantly

    Posted Apr 20, 2009 07:21 AM
    Just to save everyone a call to Symantec (official answer):

    This is expected behavior seeing SYMOEM.dll when running Filemon. Every 2.5 seconds vptray checks to see whether it needs to perform some OEM operations. To do this it looks for the SYMOEM.dll. Calling the Windows API call "LoadLibrary" to do this is a *very* inexpensive operation (computationally) and would not cause any significant performance impact.

    I was using latest 10.1.8.8000. Don't know if endpoint has the same problem, but considering SEP is, well, not a very successful product... :)



  • 4.  RE: VPTray.exe Querying symoem.dll constantly

    Posted Apr 22, 2009 01:11 PM
    Reinstall Symantec and that can only solve your problem.


  • 5.  RE: VPTray.exe Querying symoem.dll constantly

    Posted Apr 22, 2009 01:13 PM
    Reinstall Symantec and that can only solve your problem.


  • 6.  RE: VPTray.exe Querying symoem.dll constantly

    Posted Apr 22, 2009 01:43 PM
    Yes i agree with binayak.


  • 7.  RE: VPTray.exe Querying symoem.dll constantly

    Posted Apr 22, 2009 02:02 PM
    Any inputs from others?