This article describes the new features and fixes in each update of Symantec Endpoint Protection 11 and Symantec Network Access Control 11.

As updates to Symantec Endpoint Protection are released, they are added as sections in this document. The sections are added in chronological order, with the most recent additions at the top.

Note: To download the latest release of Symantec Endpoint Protection, read the following document: Obtaining the latest version of Symantec Endpoint Protection or Symantec Network Access Control.

  This document contains information for the following versions:

• Release Update 7 Maintenance Patch 4 (RU7 MP4)
• Release Update 7 Maintenance Patch 3 (RU7 MP3)
• Release Update 7 Maintenance Patch 2 (RU7 MP2)
• Release Update 7 Maintenance Patch 1 (RU7 MP1)
• Release Update 7 (RU7)
• Release Update 6 Maintenance Patch 3 (RU6 MP3)
• Release Update 6 Maintenance Patch 2 (RU6 MP2)
• Release Update 6 Maintenance Patch 1 (RU6 MP1)
• Release Update 6a (RU6a)
• Release Update 6 (RU6)
• Release Update 5 (RU5)
• Maintenance Release 4 Maintenance Patch 2 (MR4 MP2)

 This document should be read in conjunction with the appropriate Readme files:

• Readme_SEP.txt
• Readme_SNAC.txt
• Readme_appliance.txt
• Readme_trialware.txt 

Release Update 7 Maintenance Patch 4 (RU7 MP4)

[Back to top]

For complete information on new features and known issues in this release, see the Release Notes. For new fixes and component versions, see below.

Blue screen crash caused by teefer3.sys on Windows Vista

Fix ID: 2387830

Symptom: The computer crashes with stop code D1 (DRIVER_IRQL_NOT_LESS_OR_EQUAL). The stop screen references the teefer3.sys driver. The Teefer driver crashes due to binding or unbinding the network adapter during a large data transfer.

Solution: Modified the Teefer driver code to resolve this crash.

Error generated by securitynotifytask: "Intermittent Authentication failure. Please try again."

Fix ID: 2763318

Symptom: The Symantec Endpoint Protection Manager console activity log (typically, scm-server-0.log) displays the following error:

SEVERE: Authentication Failure. Please try again. in: com.sygate.scm.server.task.SecurityAlertNotifyTask

Solution: Resolved an issue where the server state could become out of date, resulting in the Symantec Endpoint Protection Manager console regarding the local server as offline.

Symantec Endpoint Protection Manager console is slow to load client groups

Fix ID: 2793951

Symptom: The Symantec Endpoint Protection Manager console experiences degraded performance when loading client group data.

Solution: Optimized a SQL query to increase performance for domain admin users.

"Japanese" displays multiple times for LiveUpdate Content Languages

Fix ID: 2844897

Symptom: After you install a replication partner, the second Symantec Endpoint Protection Manager console displays "Japanese" multiple times on the Download LiveUpdate Content screen.

Solution: Modified Symantec Endpoint Protection Manager to verify whether the language already exists before adding "LiveUpdate supported language" to the replication partner.

Traffic log shows incorrect information about blocked packets

Fix ID: 2867420

Symptom: The Symantec Endpoint Protection traffic log incorrectly displays packets as Ethernet Type 0x0 .

Solution: Modified the logging code to display the correct packet type.

Symantec Endpoint Protection Manager port scan report from Windows 7 shows incorrect data

Fix ID:  2914500

Symptom: A f alse positive port scan detection appears in the security log when a port scan executes from a Windows 7 machine.

Solution: Modified the port scan report to correctly detect packets on the loopback adapter of the client.

Explorer.exe process stops responding after installing the Symantec Endpoint Protection client           

Fix ID:  2916250 

Symptom: After you install Symantec Endpoint Protection, Explorer.exe stops responding and locks up the computer.

Solution: Modified the Sysplant.sys driver to correct a suspended thread.

Computer becomes unresponsive after installing Symantec Endpoint Protection client

Fix ID:  2919278

Symptom: After you install Symantec Endpoint Protection, the computer may become unresponsive due to the wpsdrvnt.sys driver .

Solution: Modified the wpsdrvnt.sys driver to prevent a memory access condition.

Risk Type "APPLICATION_DETECTION_TYPE_-1_0" in Symantec Endpoint Protection Manager logs for Macintosh clients

Fix ID:  2935579

Symptom: The Symantec Endpoint Protection Manager report displays the following risk type for a Macintosh client:

"(None) APPLICATION_DETECTION_TYPE_-1_0"  

Solution: Added the proper identifier type to the Symantec Endpoint Protection Manager resource file.

"Administrator not found" error when logging onto Symantec Endpoint Protection Manager

Fix ID:  2938977

Symptom: When you attempt to log on to the Symantec Endpoint Protection Manager console, an "Administrator not found" error appears, and the console immediately logs out. The SCM-UI.err log displays the following message:

“com.sygate.scm.console.util.ConsoleException: Administrator not found [0x11010000]”

Solution: Resolved an issue in Symantec Endpoint Protection Manager where the Symantec Network Access Control enforcer caused a deadlock when it connected to the server.

Custom scan scans files twice if the selected scan target does not display the plus sign (+)

Fix ID: 2939056

Symptom: When you create a custom scan and make a selection of drives or folders that result in only a checkmark next to your selections, the scan scans the files twice and therefore takes longer to finish. Custom scan selections that display a plus sign (+) with a checkmark scan normally.

Solution: Modified the state of the folders to have the proper “check”, “check plus”, or “empty” selection.

Repeated Full.zip downloads when free disk space is between 700 and 900 MB

Fix ID:  2947400

Symptom: The Symantec Endpoint Protection client repeatedly downloads full.zip files from the server when the client is low on disk space.

Solution: The default required disk space estimate was updated to the current definition size.

Forced TruScan proactive threat detections are logged as Trojan Worm

Fix ID:  2948103

Symptom: A forced TruScan proactive threat detection appears as Trojan Worm in the Symantec Endpoint Protection Manager log. The application type for some of these detections may list "tracking cookie." The procedure describing how to force this detection appears in the Knowledge Base article Configuring an exception to force TruScan proactive threat scans to detect a process.

Solution: Resolved an issue where the application type and detection type could both be 0. The new application type will be "Heuristic application."

Scheduled/Quick Report filters only saves 255 characters for the Group field

Fix ID:  2953711

Symptom: When you create a saved filter and use the "select" popup for the group filter, the group filter list can be greater than 255 characters. After you save the filter, the list truncates to 255 characters.

Solution: Limited the group filter list to 255 characters. Symantec Endpoint Protection Manager displays an error message if the group filter list is greater than 255 characters.

Duplicate entries are not generated in the Symantec Endpoint Protection Manager, despite a change of the hardware ID (HWID)

Fix ID: 2973571

Symptom: Active Directory domain migration can cause a regeneration of the hardware ID (HWID). The HWID value change may not create duplicate entries in Symantec Endpoint Protection Manager as expected.

Solution: Modified the client to resolve an issue when sending a hardware ID update request.

LastScannedVersionCheck property added to Lotus Notes documents

Fix ID: 3060147

Symptom: After Lotus Notes Auto-Protect scans an attachment, it adds t he LastScannedVersionCheck document property to the attachment, even if you enable the Symantec Endpoint Protection option “NotLeaveScanRecord”.

Solution: Modified the Symantec Endpoint Protection client to properly honor the NotLeaveScanRecord option when enabled.

SMC.exe process terminates unexpectedly

Fix ID: 3067417

Symptom: The SMC.exe process terminates unexpectedly with code C0000005 (ACCESS_VIOLATION) when Symantec Endpoint Protection debugging is enabled .

Solution: Resolved an issue in the client debug logging to prevent this crash.

Symantec Endpoint Protection recovers only once from a corrupted sdi.dat

Fix ID: 3087001

Symptom: Symantec Endpoint Protection can only recover once from corruption of the SDI.dat file. Symantec Endpoint Protection cannot recover after subsequent occurrences of SDI.dat file corruption.

Solution: Modified the Symantec Endpoint Protection code to restore SDI.dat from SDI.bak if corruption is detected.

Scan log incorrectly displays a Scheduled Scan as a Manual Scan

Fix ID: 3093421

Symptom: The scan log incorrectly shows a Scheduled Scan type listed as a Manual Scan type.  

Solution: Updated the logger type in the registry to display the proper scan type.

GFValidate.exe process terminates unexpectedly

Fix ID: 3146457

Symptom: The GFValidate.exe process terminates unexpectedly. The Windows event log displays the following message:

"Event ID 1000: Faulting application: GFValidate.exe"

Solution: Modified Symantec Endpoint Protection Manager to handle an exception to prevent the application from terminating unexpectedly.

SMC.exe service terminates unexpectedly on designated GUP systems

Fix ID: 3183935

Symptom: On a Symantec Endpoint Protection client computer designated as a Group Update Provider (GUP), the SMC.exe process becomes unresponsive or terminates unexpectedly.

Solution: Modified the SMC code to prevent an unhandled exception. 

Valid ping triggers false positive for "Smurf" attack

Fix ID: 3187443

Symptom: A ping from any computer with an IP address ending in .0 or .255 triggers a false positive detection for a "Smurf" attack.

Solution: Modified the firewall to detect a broadcast address correctly in this situation.

IllegalThreadStateException in AgentLogCollector task

Fix ID: 3210577

Symptom: The Symantec Endpoint Protection Manager log (scm-server-0.log) references an unknown exception in com.sygate.scm.server.task.AgentLogCollector and provides the following additional details:

SEVERE: Unknown Exception in: com.sygate.scm.server.task.AgentLogCollector

java.lang.IllegalThreadStateException: process has not exited

Solution: Modified Symantec Endpoint Protection Manager to catch an exception and record an appropriate log message. 

Whitelisted application is detected by File System Auto-Protect

Fix ID: 3244632

Symptom: File System Auto-Protect detects and quarantines a custom application. The custom application is on the whitelist. 

Solution: Modified the File System Auto-Protect driver to resolve this issue.

SMC.exe process terminates unexpectedly

Fix ID:  3257412

Symptom: The SMC.exe process consumes a large amount of memory and terminates unexpectedly.

Solution: Resolved an issue where the SMC.exe process did not close a handle while querying for the Windows Firewall status from Windows System Center.

Firewall does not detect outbound traffic on Windows XP

Fix ID: 3304422

Symptom: The Symantec Endpoint Protection firewall does not detect outbound traffic on Windows XP. Disabling the QoS Packet Scheduler resolves the issue.

Solution: Resolved a compatibility issue between Symantec Endpoint Protection and the QoS Packet Scheduler to allow Symantec Endpoint Protection to filter outbound traffic correctly.

Symantec Endpoint Protection Manager fails to process 64-bit definitions

Fix ID: 3337423

Symptom: Symantec Endpoint Protection Manager downloads the full.zip for 64-bit antivirus definition content but fails to extract it to the “full” directory. You configured Symantec Endpoint Protection Manager to use a Microsoft SQL Server database.

Solution: Resolved an issue where the antivirus content became too large to upload to a Microsoft SQL Server database.

Component versions in RU7 MP4

Release Update 7 Maintenance Patch 2 (RU7 MP2)

[Back to top]

For complete information on new features in this release, system requirements, and known issues, see this document. For new fixes and component versions, see below.

New fixes in this version

Auto-Protect and Scheduled Scan (ERASER) behave differently on risk detection
Fix ID: 2030979
Symptom: When scan actions are set to first "Clean Risk" and second "Quarantine", a scheduled scan Quarantines risks while Auto-Protect deletes them.
Solution: Actions taken by Auto-Protect are now the same as the actions taken by a manual or scheduled scan.

Files re-detected during Defwatch scan
Fix ID: 2067778
Symptom: DWHxxxx.tmp files are being re-detected when Defwatch scan is running.
Solution: Fixed some scan issues, making the scan faster. Also created a separate folder to rescan Quarantine items that can be used to create exceptions.

Client Security Alert Notifications do not contain data
Fix ID: 2100605
Symptom: Client Security Alert Notifications appear with no data.
Solution: Expected data was not returned upon a query. Fixed the query.

Cluster Server becomes non-responsive
Fix ID: 2228502
Symptom: Cluster Server becomes non-responsive when the server transitions from one node to another.
Solution: Moved the query of the mounted directory of the module out of the network traffic data checking cycle.

smc.exe crashes when large number of locations are configured
Fix ID: 2235166
Symptom: smc.exe crashes while doing autolocation switch by accessing invalid address within released object.
Solution: Fixed the problem maintaining the hash table of DNS host entries.

Database becomes corrupted
Fix ID: 2248662
Symptom: Database becomes corrupted after replication.
Solution: If an exception occurs while adding a group in the User interface, SEPM removes the group from Cache before the next save.

Cancelling sending Internet email with a large attachment file when Internet Email Auto-Protect is enabled causes the attachment file to be broken
Fix ID: 2249511
Symptom: When a user cancels sending email with Internet Email Auto-Protect enabled from Windows Mail (SMTP/POP3 mailer) while the mailer is sending the message, the message gets sent to the address although it is cancelled. If the mail has attachment files of large size, the attachment arrives broken.
Solution: Changed to correctly handle the situation when a cancel command comes in while data is being prepared.

Differences in number of scanned files between Administrator and Users
Fix ID: 2282822
Symptom: The number of files scanned as Domain Administrator and Domain User is different.
Solution: Created a new folder, DecTemp, with rights to everyone so that the compressed files can be scanned via Decomposer.

APQxxxx.tmp files are being re-detected by scheduled or manual scan.
Fix ID: 2326228
Symptom: Threats detected by Auto-Protect are not added to Quarantine, and an infected APQxxxx.TMP file is left behind.
Solution: Corrected the error handling when failure occurs.

Error handling in case of Auto-Protect detected threats
Fix ID: 2344862
Symptom: If Quarantine folder access is blocked, scan results say Quarantine Successful, and (infected) APQxxxx.TMP file is left behind.
Solution: Detect the problem, log the related information, and delete the APQxxxx.TMP file.

SEPM does not create deltas in time
Fix ID: 2379262
Symptom: SEPM cannot create deltas quickly enough to satisfy large numbers of requests. The server gets multiple requests for the same delta, causing it to spend more time handling these requests. This takes away from actually creating the delta.
Solution: Added a delta request hash table to Secars. It will hold a list of pending requests and only send new requests to SEPM.

Clients cannot connect to server after performing threat tests
Fix ID: 2380290
Symptom: Server connectivity is lost after performing tests.
Solution: Reset the blocking flag after a connection is closed and set a limitation to SEP firewall TCP and UDP session.

Live Update fails
Fix ID: 2401024
Symptom: Event 1001 & 1004 occur, and LiveUpdate fails after deleting the old data folder.
Solution: Fixed a problem involving the Windows registry caused by the Windows Installer health check and self-repair.

'Scheduled Scan when user not logged in' is performed even after Administrator disallows it
Fix ID: 2407550
Symptom: The user-defined scheduled scan when no users are logged in is performed even when it is disabled through Anti policy.
Solution: Disable the corresponding “Perform the scheduled scan even when no users are logged on” option in UI.

Scan runs twice
Fix ID: 2409368
Symptom: Schedule scan runs 3 minutes after the last missed scheduled scan completes.
Solution: Fixed an issue where incorrect information was added into the registry key.

Quarantine server fails to connect to gateway.dis.symantec.com to submit files or download new definitions
Fix ID: 2419298
Symptom: Quarantine server 3.6 does not pass credentials for firewall/proxy that is configured in quarantine server console.
Solution: Added additional code to handle authentication needed by proxy (resolves error 407).

SEP cannot control Windows Firewall
Fix ID: 2419842
Symptom: Windows Firewall is enabled if IP address is renewed/released.
Solution: Added code to detect whether SEP firewall has been enabled on Win7/2008R2 and if not will retry to enable it. Also added code to deal with a very rare case where a call failed on Win7/2008R2 if the network service is not ready and the call returns a non-failure code.

PTP is off with "Waiting for updates" status
Fix ID: 2426074
Symptom: When updating the PTP definition, RUNDLL32.EXE fails to find the "Documents and Settings\All Users\Application Data\Symantec\SyKnAppS\SyKnAppS.dll" path.
Solution: Enhanced DIS engine to check for Short File Name to Long File Name conversion behavior setting.

Scan of USB drive does not pop up with scan window
Fix ID: 2438735
Symptom: If a USB drive is attached to the system and the file system within it is empty, the right click scan does not do anything.
Solution: Added error handling to deal with this case and show appropriate error dialog window.

Client cannot communicate with SEPM because SMC hangs
Fix ID: 2441903
Symptom: SMC hangs when receiving new AV commands, if it is processing some AV commands at the time.
Solution: Make a local copy of command list before releasing a plug-in lock. This prevents the hang.

Cisco's VPN does not work when selected
Fix ID: 2450673
Symptom: When Location Criteria > Network Connection Type is set to [Cisco VPN], Cisco's VPN does not work.
Solution: There is a known limitation where "connection type = Cisco VPN" doesn't work with Cisco AnyConnect. The customer can use "NIC description" and "DNS suffix rule" as a workaround to this limitation.

Script error message appears in Java remote console
Fix ID: 2486836
Symptom: In French language SEPM, a script error message appears in Java remote console > Monitors > Logs/Reports.
Solution: Escape all single quotes in a text message passed as an input parameter to a JavaScript function.

Location specific Liveupdate policies are not correctly set
Fix ID: 2488603
Symptom: When "Remember Last Location" is disabled, location-specific Liveupdate policies are not correctly set at boot time.
Solution: First do checking, comparing and updating of the policy hash. After that, if it is the first time, force a policy update. Otherwise, perform the update based on the return value of the initial checking.

Scheduled report of Application and Device Control shows no data
Fix ID: 2510697
Symptom: When SEPM sends the Scheduled Report for Application and Device Control, only the "Default" filter shows data. When using the "Custom" filter, the data is reported as "No Data."
Solution: An incorrect filter was used when using customized filter. Fixed it.

Installation of SEP 11 causes Lotus Notes plug-in to crash
Fix ID: 2513096
Symptom: Lotus Notes Plug-in crashes causing user-specific Notes data directories not to be created.
Solution: Some internal pointers were not correctly initialized. Fixing this resolves the issue.

SEPM "unknown exception: 0x10010000" error: com.sygate.scm.server.task.TelemetrydataTask, referencing HTTP 409 conflict
Fix ID: 2513174
Symptom: SEPM generates this error frequently: "unknown exception: 0x10010000".
Solution: Provide an exception handler for a HTTP error that was previously not handled correctly.

Windows Security Center reports that virus protection is Off
Fix ID: 2517760
Symptom: Windows Security Center reports that virus protection is off when definitions are loaded.
Solution: During the definition update, the 'Virus Protection' status is not updated. Fixed.

Java app loses connection with SEP installed
Fix ID: 2519427
Symptom: The application downloads .jar files on startup to function. Downloads are never completed.
Solution: Increased the internal buffer cache to avoid this issue.

SMC Fault : IdsTrafficPipe!ParseString
Fix ID: 2525143
Symptom: Smc.exe crashes when applying a new custom IPS library.
Solution: Changed code to safely exit the string delimiter when reaching the end of the string.

Web console does not work correctly when using SSL and Self-signed certificates
Fix ID: 2525234
Symptom: Host name is converted to IP Address in web console upon login.
Solution: Removed the code that specifically converted hostname to IP address for web console during login.

Configured scans are not printed correctly
Fix ID: 2525405
Symptom: The "doscan /list" command does not print the configured scans correctly.
Solution: Set Locale correctly and convert the Unicode scan name data to the appropriate character set.

Smc.exe takes up CPU during idle time
Fix ID: 2525510
Symptom: Very high CPU usage on any computer with many TDI connections known to wpsdrvnt.
Solution: Optimize the code to improve performance.

"Security Risk found" message is not recorded in Windows application event log
Fix ID: 2525521
Symptom: When an infected file within a zip archive is scanned and the file path length is more than 26 bytes, an event ID 51 "Security Risk Found!" is not recorded in the Windows application event log.
Solution: Fixed the parsing of the log events before it adds the entry to the event log.

User-specific notes directories are not created
Fix ID: 2526318
Symptom: Lotus Notes Plug-in crashes, causing user-specific Notes data directories not to be created.
Solution: Some Internal pointers were not properly initialized. Fixing this resolves the issue.

Unable to install SEP
Fix ID: 2527479
Symptom: Installation rolls back during the configuring services stage.
Solution: Fixed the error with buffer overrun that causes installation to be rolled back.

Client can't come back to the previous Group Update Provider (GUP) if it has already been shut down
Fix ID: 2531477
Symptom: If there are two GUPs, A and B, where A is off and B is on, clients will download from GUP B. iF B is turned off and A is turned on, the client insists on downloading from B and does not try A again.
Solution: If the end of the list is reached, reset the GUP to "NO_RESPONSE" status. Then in the next try, Sylink will iterate from the start.

Modification date of Notes document is changed while Notes Auto-Protect is enabled
Fix ID: 2534512
Symptom: When an attachment file is opened, it is scanned, even though the Notes document has not been updated or the virus definition has not been updated since the last scan for the temporary file.
Solution: Improved the bookkeeping function on when an attachment is scanned, so that the plug-in skips the file next time if it remains unchanged.

Enforcer groups become corrupted after a policy export/import, if replication is used
Fix ID: 2536571
Symptom: Enforcer groups become corrupted after policy export/import and replication, with an "unexpected exception" error. DBvalidator errors exist.
Solution: Use the existing Enforcer policy object reference when importing the policy, since the same object reference exists in the remote partner.

Error message after upgrading from SEP11
Fix ID: 2551819
Symptom: Issues when restarting the system. Error message "The Extend WG Protocol Driver service failed to start due to the following error: The system cannot find the file specified."
Solution: Fixed an issue with updating a registry entry (both 32bit and 64bit).

SEP Firewall blocks USB-over-wireless traffic
Fix ID: 2556466
Symptom: Wireless mouse interoperability problem with SEP Firewall.
Solution: Added default firewall rules to allow for client control mode and USB over IEEE802.

Sustained SMC.exe CPU utilization on virtualized Windows 2003 32-Bit Citrix XenApp terminal
Fix ID: 2559467
Symptom: Very high CPU usage on any machine with many TDI connections known to wpsdrvnt.
Solution: Better handling of how simultaneous calls are prioritized and processed.

Custom Application Control rule in place with test mode causes blue screen crash
Fix ID: 2559560
Symptom: Enabling a custom rule to block access to VPN configuration files in test mode only causes random crashes.
Solution: The process information list was damaged. The issue was resolved by adding a lock when doing process information updates.

Incorrect count of computers with out-of-date IPS and total computer count
Fix ID: 2559712
Symptom: From the Security status detail, the count of IPS out-of-date is more than the SEP endpoints that included the NTP feature.
Solution: Clients that do not have the Firewall feature are excluded.

ScanDuration DWORD value is not removed from registry when disabled through policy
Fix ID: 2561077
Symptom: Full system scans scheduled weekly with missed events, scanning limit and scan start randomization enabled fail to complete. They are logged as "scan suspended" after a few minutes of scanning
Solution: Fixed the issue that SEPM was not updating the default profile correctly.

Firewall malfunctions after migrating unmanaged client from SEP 11.0 RU7 to SEP 12.1
Fix ID: 2567235
Symptom: Firewall malfunctions after migrating unmanaged client from SEP 11.0 RU7 to SEP 12.1. The issue is temporarily fixed after reinstall but then fails.
Solution: The order of deleting a particular registry key and system file has been corrected.

SEPM sends notifications related to "The root cannot be deleted"
Fix ID: 2570868
Symptom: "The root cannot be deleted" appears when the querying ID contains an invalid character.
Solution: Changed the code related to the relevant error message.

Volume Shadow copies fail to be created in a clustered environment after a scheduled scan
Fix ID: 2575285
Symptom: After a scheduled scan, the VSS service can no longer create shadow copies on the mount drive for the mounted volume.
Solution: A problem in how ccScan is integrated with Windows Single-Instance Store (SIS) and its backup was corrected.

PSLucomServer_3_3.DLL is missing from 11.0.6 clients that repeatedly download TruScan definitions
Fix ID: 2575446
Symptom: The file is missing after rebooting the computer.
Solution: Fixed an issue where a file was deleted but the registry key was not cleaned up.

Application rule to allow traffic does not function
Fix ID: 2575698
Symptom: SEP Firewall blocks traffic to an application despite a rule allowing the application by file name and path.
Solution: Fixed an issue in teefer3 that caused a "\" character to be removed in the path.

Installing Network Threat Protection (NTP) causes loss in communication
Fix ID: 2575843
Symptom: Installing SEP with NTP causes the client to lose all communications with SEPM. All other network traffic remains unaffected.
Solution: Fixed the issue where a needed attribute was missing from a specific dll.

Process SecurityMiningTask can not lock the process status table
Fix ID: 2576036
Symptom: There are two symptoms for this.

• There is a repeated message in the server console: "process SecurityMiningTask cannot lock the process statustable. The process status has been locked by the server"
• In the server log there are related lines: "FINEST: Blob data: Host Integrity check failed to complete because the configuration file is not complete or has been corrupted".

Solution: Started filtering old security logs that are already processed and added a setting to avoid missing records.

Unexpected behavior when out of space for definitions on SEPM
Fix ID: 2582206
Symptom: When SEPM runs of disk space to store definitions, unexpected behavior occurs.
Solution: SEPM now checks disk space on functions that require writing to disk. Two new settings are added in conf.properties file:

• scm.server.diskspace.warning=1024
• scm.server.diskspace.severe=512

Units are in MB, and default values are as noted above.

A newly added group is broken
Fix ID: 2585686
Symptom: Exceptions happen while adding a group. Consequently, SemClientGroupTree modification and SemGroupPolicy inserting also fail.
Solution: Remove the group when exception happens during "add a new group" in UI.

Incorrect date and time while running Comprehensive scheduled reports
Fix ID: 2593263
Symptom: The "Risk comprehensive scheduled reports" do not update the time range even if the scheduled report is run repeatedly.
Solution: A field was added. Another issue was fixed with legacy data table settings.

After upgrading SEPM to RU7, Java Heap space errors and "OutOfMemoryError: GC overhead limit exceeded" error when replication is triggered
Fix ID: 2595106
Symptom: The size of the object that records site information keeps growing.
Solution: Corrected the mechanism that records the site information such that it does not cause memory issues.

Error: "Unexpected console error 0x80010000" and broken links on SEPM group policy
Fix ID: 2597044
Symptom: After a failed replication, the following message is seen on SEPM: "Unexpected console error 0x80010000"
Solution: Remove the group when an exception happens while adding a new group in the UI.

On a computer low in resources, blue screen error may occur while running a vulnerability scan
Fix ID: 2598652
Symptom: Blue screen error occurs on some computers after upgrading to RU7 and running vulnerability scans.
Solution: Fixed an issue where an access is made without checking the validity of the data.

Client count in SEPM computer status report doesn't match count in group details tab
Fix ID: 2600601
Symptom: SEPM Computer Status report has a different client count than the Clients tab.
Solution: Use the same logic to query registered computer and user count between client details, client properties and computer status report.

SMC crashes periodically
Fix ID: 2606596
Symptom: GUPs experience periodic crashes on application Smc.exe. Fault address 0x00014eee.
Solution: Fixed an issue where memory used by cache list wasn't released after memory allocation failure when loading content. Another issue was fixed as a result of which if the cache file of a valid cache entry is removed from disk, the status of the entry is reset and the file is downloaded again.

Clients are not blocking as expected when using the blacklisting feature
Fix ID: 2608450
Symptom: Blacklist policies are not effective.
Solution: Fixed an issue where the policy parsing the function does not download the protectionxx.dat file correctly.

An administrator account with space in the name cannot be deleted if it owns a scheduled scan
Fix ID: 2612812
Symptom: The following message appears: "Unexpected server error [0x10010000]"
Solution: Encoded the owner name in the URL request string.

SEPM service crashes when accessed by incorrect console
Fix ID: 2614798
Symptom: In the local console of RU7 SEPM, if server field is changed from localhost to point to an RU6 MP3 SEPM, then by logging in as SEPM administrator and clicking on client tab, RU6-MP3 SEPM service crashes.
Solution: Fixed SEPM to log the exception at both client and server console and server.

Removal of a policy removes all related historical activity entry of that policy
Fix ID: 2614962
Symptom: If the policy is removed, all of the related historical activity pertaining to that policy is also removed even though in Monitors > Logs >Audit, the historical entry is still present.
Solution: Fixed such that for policy and policy components, all the logs belong to the domain and same object type will be shown.

SEPM risk reports do not show anything after TruScan Risk log filter is enabled
Fix ID: 2620537
Symptom: There are options under Advanced filter settings for Risk logs for PTP events in scan type filter (Truscan). Therefore it is expected that PTP events in Risk Logs will be seen.
Solution: Truscan related options are removed from event type on risk log pages.

During upgrade of Hummingbird Exceed V.14 on systems with the SEP client, the install fails
Fix ID: 2622110
Symptom: During upgrade of Hummingbird Exceed V.14 on SEP client the install fails with the following error: "Open Text Exceed 14 -- Error 1406.Could not write value to key \Xstart.XstartCom.1\CLSID. System error Verify that you have sufficient access to that key, or contact your support personnel."
Solution: Rolled back an earlier fix that caused this issue.

"OutOfMemoryError: GC overhead limit exceeded" errors
Fix ID: 2623401
Symptom: Messages appear that indicate out of memory on SEPM.
Solution: Added a limitation on the minimum value of date filtering to avoid querying records that are old. The configuration in conf.properties is: scm.securityalertnotifytask.analyzetimerange.deltaforminimum

Out of Memory Messages
Fix ID: 2628941
Symptom: Many login requests in a short amount of time result in out of memory message.
Solution: There were two changes made to fix this issue.

• The cookie was saved correctly after login to tomcat in notification task. This allowed terminating the session properly after logoff.
• Session info is now recorded in the log file owned by thread.

Searching for invalid client ID causes an exception
Fix ID: 2634470
Symptom: While searching for Client by computer ID, entering an invalid ID causes an exception.
Solution: This action is by design. To improve the error handling, the blank spaces in "Logon User Name" and "Computer Name" are now not trimmed, but the blank spaces in "Computer ID" are now trimmed.

"Authentication failure" errors
Fix ID: 2635104
Symptom: Repeated "authentication failure" errors are seen on the Admin > Servers page in the SEPM. The System Server Activity Logs show many errors and the error type reads "An unexpected exception has occurred".
Solution: This issue is seen when the owner of a report is deleted. The fix is to allow a notification to be generated and to allow changing the ownership of the report.

Internal LiveUpdate server fails to connect when double byte characters are used in Server name
Fix ID: 2635398
Symptom: SEP client is unable to connect to internal LiveUpdate server with authentication information (user ID/password) supplied by a LiveUpdate policy, if the "Server name:" field in the LiveUpdate policy includes MBCS character string.
Solution: Provide the right data so that decryption key can be correctly generated.

The duration for weekly scan retry time changes
Fix ID: 2637991, 2647871
Symptom: The upper limit for weekly scheduled scans is seven (7) days. It shows up as three (3) instead.
Solution: Fixed the issue where the maximum duration was incorrectly showing as three (3) days.

Interrupted Active Directory Sync results in widespread client group deletion
Fix ID: 2638516
Symptom: SEPM drops or deletes a large number of Active Directory synchronized client groups from the SEPM.
Solution: The issue was with Active Directory synchronization continuing to run even when a communication exception occurred. This is now fixed and Active Directory synchronization is now interrupted.

Adding PTP feature using Auto-Upgrade does not follow update schedule
Fix ID: 2639011
Symptom: The upgrade starts immediately and does not follow the upgrade schedule. This happens if the upgrade package version is the same as the installed client version and auto-upgrade function is used to update client features.
Solution: Added a specific return code to handle this scenario. SMC returns this code to indicate that the upgrade package is needed, but it does not have to be downloaded. The upgrade schedule and user notification are controlled. When there is a request for upgrade it is fulfilled from the cache. If applying new features with cached installer fails, a full package is downloaded from the server.

Modification date of Lotus Notes document is changed while Lotus Notes Auto-Protect is enabled
Fix ID: 2641800
Symptom: When Lotus Notes Auto-Protect scans attachments of a Lotus Notes Journal Document, it records some text properties to the document. This is done so Lotus Notes Auto-Protect can determine whether it's necessary to scan the attachments when it is opened. This reduces the number of scanning for attachments, and improves the system performance. However, after the scan runs for attachments, the Lotus Notes GUI shows that the document has been updated.
Solution: Added the following registry value. If this registry value exists and is set to 1, Lotus Notes Auto-Protect does not leave the records after scanning attachments.

• Registry Key: (for x86) HKLM\Software\Symantec\Symantec Endpoint Protection\AV\Storages\LotusNotes (for x64) HKLM\Software\Wow6432Node\Symantec\Symantec Endpoint Protection\AV\Storages\LotusNotes
  Registry Value: NotLeaveScanRecords
  Type: REG_DWORD
  Data: 1 (not to leave the records after scanning attachments), or other

Note: Setting the registry value to 1 may cause performance impact as attachments are scanned every time they are opened.

Sysfer injection causes the "M-Files" application to stop responding
Fix ID: 2643257
Symptom: The M-Files application hangs when a new file or document is created.
Solution: The presence of sysver.dll module causes the mfclient.exe process to stop responding when a new document or file is created. The fix is to use an extra critical section and separate the code to avoid calling Kernel32 API after obtaining the lock.

Clients do not communicate with the Symantec Endpoint Protection Manager (SEPM)
Fix ID: 2657985
Symptom: The policy serial number is blank and database validation fails after configuring replication.
Solution: Added broken link check in SEPM publishing area.

Policy serial number is blank and database validation fails
Fix ID: 2662405
Symptom: After configuring replication, the Policy serial number is blank and there are Prolog errors in the Admin - Server site. Further, client packages cannot be exported and the clients do not report the replication parter.
Solution: The issue was casued by the presence of a "-->" string. This string in the description of metadata marks the replicated XML content as broken and creates exceptions. This was fixed by reading the last "-->" as the end of description for replication.

Clients bypass recently promoted GUP in favor of SEPM
Fix ID: 2673894
Symptom: Sometimes the clients will bypass a newly promoted GUP and connect directly to SEPM even though the GUP is set to "never bypass".
Solution: Fixed an issue where if the GUP list was empty, the client would bypass to SEPM even if the policy did not allow it.

A lot of temp files are kept in tomcat\temp directory
Fix ID: 2675567
Symptom: Many jtdsxxxx.tmp files including Java Heap Dump [semsvc_heap.hprof] build up in the tomcat\temp directory.
Solution: Developed a cleanup mechanism in a separate task to clean up old accumulated JTDS tmp files.

Add 'Sophos version 9.0', 'Trend Micro version 10.0', and 'AVG version 9.0' support for Host Integrity template
Fix ID: 2677531, 2677532, 2677534
Symptom: Host Integrity cannot detect the AV signature correctly.
Solution: Added support to the Host Integrity template

The date of the next scheduled scan is incorrectly shown when the scheduled scan is aborted
Fix ID: 2679293
Symptom: If a scheduled scan starts and is aborted mid run, the next scheduled scan time is shown as double the expectation.
Solution: Fixed the issue where the time for next scheduled scan was being incorrectly calculated. This happened because the time for next scan got incorrectly added to the last scheduled scan time.

Error: BugCheck_STR: 0x8E referencing sysplant
Fix ID: 2688234
Symptom: Application and Device Control feature causes blue screen error when the machine enters hibernation.
Solution: Added a hook to link to the library only once and improved error handling.

 Component versions

Release Update 7 Maintenance Patch 1 (RU7 MP1)

Release Update 7 (RU7)

[Back to top]
 

• Certified support for Windows 7 Service Pack 1 and Windows Server 2008 R2 Service Pack 1
• Firewall support for mobile broadband adapters

• Windows 2000 Professional/Server/Advanced Server/Datacenter Server with Service Pack 3 or later
• Windows XP Professional with Service Pack 1 or later
• Windows Server 2003 Standard Edition/Enterprise Edition/Datacenter Edition/Web Edition

• Windows 2000 Professional/Server/Advanced Server/Datacenter Server with Service Pack 3 or later
• Windows XP Professional with Service Pack 1 or later
• Windows Server 2003 Standard Edition/Enterprise Edition/Datacenter Edition/Web Edition

1. Install the Microsoft SQL Server 2008 Native Client:
   For X86 OS: http://go.microsoft.com/fwlink/?LinkID=188400&clcid=0x409
   For X64 OS: http://go.microsoft.com/fwlink/?LinkID=188401&clcid=0x409
2. Download the Microsoft Drivers for PHP for SQL Server:
   http://www.microsoft.com/downloads/en/details.aspx?FamilyID=80e44913-24b4-4113-8807-caae6cf2ca05
3. Unzip SQLSRV20.exe and copy “php_sqlsrv_53_ts_vc6.dll” and “php_sqlsrv_53_nts_vc6.dll” to the directory <Symantec Endpoint Protection Manager installation folder>\Php\ext
4. Open <Symantec Endpoint Protection Manager installation folder>\Php\Php.ini and add the following two lines:
   extension=php_sqlsrv_53_ts_vc6.dll
   extension=php_sqlsrv_53_nts_vc6.dll
5. Restart the Symantec Endpoint Protection Manager service.

Release Update 6 Maintenance Patch 3 (RU6 MP3)

[Back to top]

Release Update 6 Maintenance Patch 2 (RU6 MP2)

What's new in this version

The current release includes the following improvements that make Symantec Endpoint Protection and Symantec Network Access Control easier and more efficient to use. This maintenance patch cannot be installed over any versions of Symantec Endpoint Protection or Symantec Endpoint Protection Manager prior to RU6. It must be installed over RU6, RU6a, or RU6-MP1.

Symantec Protection Center
Symantec Protection Center is a Web-based console that allows you to access and manage multiple Symantec products. The console provides visibility and analytics across products as well as useful security feedback and attack statistics.

The console provides a single sign-on screen for the following registered Symantec products:

• Symantec Endpoint Protection

• Symantec Critical System Protection

• Symantec Web Gateway

• Symantec Brightmail Gateway

• Symantec IT Analytics

• Symantec Data Loss Prevention

Symantec Endpoint Protection Manager Web-based console
You can access Symantec Endpoint Protection Manager remotely in a Web-based console. The Java-based remote console is also still available.

Symantec Endpoint Protection for Macintosh
You can use Symantec Endpoint Protection Manager to manage Mac OS X clients that run Symantec software.

Randomized scheduled scans
You can specify a time interval during which scheduled scans start, and enable the scans to start at different times within that time interval. By running scans at random times, you can increase scan performance, especially in virtualized environments.

Enhanced default Antivirus and Antispyware security policies
For new product installations, changes in the default security policies make Symantec Endpoint Protection more efficient at detecting malware.

Customers who upgrade to Symantec Endpoint Protection version 11 RU6a MP2 do not receive new default policies. To see the new recommended Antivirus and Antispyware security policies settings so that you can make the settings changes in your policies manually, see Security Response recommendations for Symantec Endpoint Protection settings.

The Symantec Endpoint Recovery Tool
The Symantec Endpoint Recovery Tool provides an image that you can burn on a disc, and then use to scan and remove malware from client computers. You use this tool for the computers that are too infected for Symantec Endpoint Protection to clean effectively.

You can download the tool from the following URL: https://fileconnect.symantec.com/.

You need your Symantec Endpoint Protection serial number to download the tool.

Host Integrity policies check for additional security software
You can run a Host Integrity check to see whether the client computers run the following software:

• Norton Antivirus 2010
• Norton Internet Security 2010
• Norton 360 Version 3.0
• Symantec Endpoint Protection Version 11 Release Update 6a, MP2
• McAfee Internet Security 2010
• McAfee VirusScan Plus 2010
• McAfee Total Protection 2010
• McAfee VirusScan Enterprise 8.7i

Release Update 6 Maintenance Patch 1 (RU6 MP1)

Release Update 6a (RU6a)

[Back to top]
 

What's new in this version
Symantec Endpoint Protection RU6a provides a fix for two specific problems that existed in RU6. RU6a is a full build of Symantec Endpoint Protection.

Deploying or migrating clients when using multi-byte character group names in the Symantec Endpoint Protection Management console
Fix ID: 2020545
Symptom: If you create groups with names that use a double-byte character set, you cannot add new RU6 clients to those groups through any form of installation. New clients are automatically placed into the Default group.
Solution: With RU6, clients were incorrectly parsing DBCS characters resulting in a corrupt group name. When registering with the Symantec Endpoint Protection Manager using a corrupt group name, clients are placed into the Default group. With this fix, client-side changes were made to parse DBCS group names correctly.

Periodic CPU spike when using Symantec Endpoint Protection Manager Java console
Fix ID: 2022713
Symptom: With RU6, a periodic CPU spike occurs when a user selected the Policies, Clients, or Admin page in the Symantec Endpoint Protection Manager Java-based console.
Solution: This issue was caused by a periodic refresh of the Home page to prevent a time-out of the PHP session. The refresh task now refreshes the Reports page, which consumes fewer resources. In addition, you can now configure the refresh time by setting the scm.keepalivescheduleminute value in the conf.properties file.

Release Update 6 (RU6)

[Back to top]

What's new in this version
The current release includes the following improvements that make Symantec Endpoint Protection and Symantec Network Access Control easier and more efficient to use.

Symantec Endpoint Protection includes client software to run on a Macintosh computer. The client runs on the following versions of Mac OS X:

• Mac OS 10.4
• Mac OS 10.5
• Mac OS 10.6 (32-bit and 64-bit versions)

• Symantec Protection Center
  Symantec Protection Center is a Web-based console that enables you to access and manage multiple supported Symantec products. The console also provides visibility and analytics across products as well as providing useful security feedback and attack statistics.
  
  The console provides a single sign-on screen for the following registered Symantec products:
  • Symantec Endpoint Protection
  • Symantec Critical System Protection
  • Symantec Web Gateway
  • Symantec Brightmail Gateway
  • Symantec IT Analytics
  • Symantec Data Loss Prevention
• The Symantec Endpoint Recovery Tool
  The Symantec Endpoint Recovery Tool is an image that you can burn on a disc, which you can use to scan and remove malware from client computers. You use this tool for the computers that are too infected for Symantec Endpoint Protection to clean effectively.
  
  You can download the tool from the following URL: https://fileconnect.symantec.com/
• Scheduled scans have the option to be run at random times
  You can configure scheduled scans to run at randomized times, so that virtualized environments do not all run scan sessions at the same time.

Release Update 5 (RU5)

[Back to top]

What's new in this version
The current release includes the following improvements that make Symantec Endpoint Protection and Symantec Network Access Control easier and more efficient to use.

Symantec Endpoint Protection Manager now supports the following operating systems:

• Microsoft Windows Server 2008 Service Pack 2 (all editions except for Itanium)
• Microsoft Windows Server 2008 R2 (all editions except for Itanium)

• Microsoft Windows 7 (all editions except for Itanium)
• Microsoft Windows Server 2008 R2 (all editions except for Itanium)
• Microsoft Windows Vista Service Pack 2

• Limit the amount of bandwidth that the Group Update Provider can use when the Group Update Provider downloads content from the management server.
• You can define a Group Update Provider by using rules and conditions, such as an IP address or host name. You can configure a single Group Update Provider in a single LiveUpdate Policy that applies across multiple groups for multiple clients.
• Define clients to connect to a Group Update Provider within the same site to improve performance.
• Identify which clients act as Group Update Providers.

• Users on the client can download a support tool from the Support Web site that helps to diagnose the common issues that they might encounter on the client.

• New Host Integrity templates support Altiris 7, BigFix Enterprise Suite, and new versions of additional third-party products.
• End users with a valid RADIUS logon but a computer with no client installed can be blocked from your company's network.
• You can configure when the command-line interface on the Enforcer times out.