Video Screencast Help
Symantec Secure Login will be live on Connect starting February 25. Get the details here.

Teefer Removal Tool for SEP12.1

Created: 25 Oct 2012 | 3 comments
Mohan Babu's picture
5 Agree
1 Disagree
+4 6 Votes
Login to vote

Lot of SEP clients having Firewall malfunctioning issue under the scenario like

  • Migrated from SEP11.x to SEP 12.1
  • Upgraded from SEP11.x to SEP 11.0.7 & Above
  • Upgraded from SEP 12.1.671 to SEP 12.1.1101
  • Upgraded from SEP 12.1.1000 to SEP 12.1.1101

To fix the issue with prior to SEP11.0.7 & SEP12.1 clients. we have Teefer2 removal utility.

Existing Teefer2 removal will no longer work on SEP11.0.7 & above, SEP 12.1 & above clients 

We don't have a  Teefer Removal utility to remove the Teefer driver in SEP11.0.7 & above, SEP 12.1 & above clients 

All we need to do is we need to manually remove  teefer driver. Its acceptable for small network.

What if we have a huge environment. if the impact is on more than 1000+ clients. Without a automated tool its hard to remove the teefer driver on a huge network.

Hope Symantec will pulish the teefer remover utility for SEP11.0.7 & above, SEP 12.1 & above clients .


Comments 3 CommentsJump to latest comment

JUSTICE's picture

This is an old thread but relevant even today - 2015 and beyond. I chime in with the following articles collected touching the subject of Network Threat Protection (NTP) Firewall component and its issues and problems over the years. It is critical to understand the full context of the SEP Guru himself, Mr. Paul Murgatroyd famous statement (confirmed in the Best Practice PDF document floating out there for then SEP 11 - equally applicable for SEP 12.1.x). Clearly now in SEP 12.1.6 (RU6) now, more than ever teefer.sys (Symantec Endpoint Protection 12.1 Teefer driver version is not reflected in the driver file name or display name (Article: TECH161111) (Check the version tab of the Teefer.sys file properties) 

"The Teefer driver is responsible for capturing all network traffic entering or leaving a particular interface ( via the associated miniport driver ), so that the packets may be passed to the personal firewall component of the SEP 11.0 client for analysis." See here: Teefer2 Miniport ?. See also Differences in MR4 (“Teefer was removed from the list, since it could be disabled by admin users and was a security risk”)

Over the very keenly and with full attention to the details, scenarios and real world experience from the experts and novices who are SEP/SEPM/SNAC admins.

Slow Network Copy Caused by SEP Firewall (Most Recent)

SEP Network Threat Protection blocking network unexpectedly

Network Threat Protection blocks Traffic when PC is connected with WWAN Module to internet

Network Threat Protection: Slow network share

Network Threat Protection always slows down - true?

network threat protection and slowness

Clearly now in SEP 12.1.6 (RU6) now, more than ever teefer.sys and the SEP NTP Firewall components must be stable and bug free to take full advantage of the product features, i.e.

Configuring peer-to-peer authentication for Host Integrity enforcement (Article: HOWTO80751)

Using Symantec Endpoint Protection's Network Activity Tool to Identify Suspicious Processes (Article: TECH92950)

Marcus Sebastian Payne
"So cyberspace is real. And so are the risks that come with it."
- President Barack Obama

Login to vote
Mohan Babu's picture

Thanks @ JUSTICE for sharing such informative knowledge. Though the problem was quite OLD, your infomation was really helpful. I know still people are running with 12.1 RTM Versions in corporate environments.

Mohan Babu

+91 9884382160

Your satisfaction is very important to us.If you find above information helpful or it has resolved your issue...please mark it accordingly :)

Login to vote
JUSTICE's picture

@Mohan, you are welcome sir. The now and current future SEP 12.1.6168.6000 (RU6) is on the scene. It appears from the new fixed issues and problems does NOT reference Network Threat Protection (NTP), the Firewall or teefer.sys. New fixes in Symantec Endpoint Protection 12.1.6 (Article: TECH230558). Let us hope it is stable and Justice prevails from here on.

12.1.5830.6000 Teefer.PNG

Marcus Sebastian Payne
"So cyberspace is real. And so are the risks that come with it."
- President Barack Obama

Login to vote