During an upgrade of the Symantec Endpoint Protection (SEP) client the upgrade fails and then the roll back of the installation fails as well. This leaves the SEP client in a corrupted state.
This issue has been seen for upgrades to the version 12.1 RU6 MP5 and to the version 12.1 RU6 MP4
The ccSvcHst.exe process crashes during the upgrade and this event appears in the event viewer:
Date Log Event Type Source Computer User Event ID Description
30/08/2016 11:41:11 Application Error Application Error 1000 "Faulting application name: ccSvcHst.exe, version: 220.127.116.11, time stamp: 0x573cfe4d
Faulting module name: MSVCR100.dll, version: 10.0.40219.1, time stamp: 0x4d5f0c22
Exception code: 0x40000015
Fault offset: 0x0008d6fd
Faulting process id: 0xff8
Faulting application start time: 0x01d202aae4064ba5
Faulting application path: C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.7004.6500.105\Bin\ccSvcHst.exe
Faulting module path: C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.7004.6500.105\Bin\MSVCR100.dll
Report Id: 43df4e85-6e9e-11e6-81dc-00a0c6000014"
The crash happens during the "Sending the opstate..." stage, in the C:\ProgramData\Symantec\Symantec Endpoint Protection\New version being installed\Data\Install\LogsSIS_Inst.log:
2016-08-30T10:40:40.278Z INFO I SIS Sending the opstate...
2016-08-30T10:41:12.082Z ALL I SIS --------------------------------------------------------------------------------
2016-08-30T10:41:12.082Z ALL I SIS Log file set to: C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.7004.6500.105\Data\Install\Logs\SIS_INST.LOG
2016-08-30T10:41:12.082Z ALL I SIS Log level set to: DEBUG
2016-08-30T10:41:12.082Z INFO I SIS VersionNT: 601
2016-08-30T10:41:12.082Z INFO I SIS WindowsBuild: 7601
2016-08-30T10:41:12.082Z INFO I SIS ServicePackLevel: 1
2016-08-30T10:41:12.082Z INFO I SIS ProductType: 1
2016-08-30T10:41:12.082Z INFO I SIS
2016-08-30T10:41:12.113Z INFO I SIS Current local time is 2016-08-30T11:41:12.113
2016-08-30T10:41:12.113Z INFO I SIS PID 976 (0x3D0)
2016-08-30T10:41:12.113Z INFO I SIS Disabling transactions based on useTransactions property in installData.xml
2016-08-30T10:41:12.113Z DEBUG I SIS Suppressing transaction use.
2016-08-30T10:41:12.113Z DEBUG I SIS CSepInstallService::RunInstallProcess() Created InstallServiceNotification object.
2016-08-30T10:41:12.113Z INFO I SIS Successfully reset script start event (before execution)
2016-08-30T10:41:12.113Z INFO I SIS Successfully reset script cancel event (before execution)
2016-08-30T10:41:12.113Z INFO I SIS Successfully set script start event (before execution)
2016-08-30T10:41:12.113Z ERROR I SIS Detected Script Engine Executor interrupted - The install process will rollback.
And unfortunately the rollback is also failing. The entry in c:\Windows\Temp\Rollback.log:
MSI (s) (B0:24) [11:50:22:935]: Product: Symantec Endpoint Protection -- Error 1306. Another application has exclusive access to the file C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.7004.6500.105\Data\Cached Installs\smcinst.log. Please shut down all other applications, then click Retry.
Error 1306. Another application has exclusive access to the file C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.7004.6500.105\Data\Cached Installs\smcinst.log. Please shut down all other applications, then click Retry.
MSI (s) (B0:24) [11:50:22:950]: User policy value 'DisableRollback' is 0
MSI (s) (B0:24) [11:50:22:950]: Machine policy value 'DisableRollback' is 0
Action ended 11:50:22: InstallFinalize. Return value 3.
Some information received by the SEP client from the SEPM is creating a buffer overflow, causing the crash of ccSvcHst.exe.
The crash of ccSvcHst.exe has been fixed in version 12.1 RU6 MP6. Upgrade to this version (or higher).
Subscribing will provide email updates when this Article is updated. Login is required.