SEPM 11.0.7 LiveUpdate not downloading anti-virus definitions

December 17, 2013, 7:40 am

≫ Next: SEP - how do I install defintions for a given date

≪ Previous: SEPM Windows Definitions older than Symantec

$

0

0

I need a solution

I've re-installed SEPM 11.0.7, and from a 'new' install I still don't get anti-virus definitions downloading.  Ive scoured for information to correct this issue.

 

I've:

    Re-installed SEPM already

    Re-installed LiveUpdate, re-ran LuCatalog.exe --cleanup LuCatalog.exe --update, still no dice

    Manually updating the JDB seems to put the files in the Inetpub/Content folders, but they dissappear after a while

    Running LiveUpdate by itself doesn't seem to show the definitions as part of the download package

    SyLink debug doesn't show the moniker for the Antivirus definitions in the content index:

12/17 09:55:40 [9700] <mfn_DoGetIndexFile200>Index File: <?xml version="1.0" encoding="UTF-8" ?><GroupIndex SiteID="6CFB35710A6404A301960DCA1FE4A809" ServerID="C155194F0A6404A300F76964384E95C4" GroupID="3AF5C3E00A6404A30096A978366D1BB4" GroupCheckSum="842CEA790A323210858413531" LastModifiedTime = "17/12/2013 09:55:32"> <Profile Checksum="0B460522A884190DD2054539AEB6788A" SerialNumber="3AF5-12/17/2013 14:55:27 177" LastModifiedTime="17/12/2013  09:55:32"/> <ConfigFile Checksum="371F4B4866869FE0F6103961BF5D9C90" LastModifiedTime="16/12/2013  18:14:29"/> <IDSFile Checksum="703A0AE1B8EC84B36CDBAECB7E800283" LastModifiedTime="16/12/2013  18:14:29"/> <SylinkFile Checksum="9FF322938991914936FAD0628E40069B" LastModifiedTime="17/12/2013  09:55:32"/> <LSProfile Checksum="34D2B4FCEBBF480901D0D789DB50D01B" SerialNumber ="3AF5-12/17/2013 14:55:27 177" LastModifiedTime ="17/12/2013  09:55:32"/>

<LiveUpdate>

<File Checksum="0564396080661325ADE1B8D365711AEA" DeltaFlag="1" FullSize="1206867" LastModifiedTime="1387262322511" Moniker="{42B17E5E-4E9D-4157-88CB-966FB4985928}" Seq="131216001"/>

  <File Checksum="366E018648D3F9F4A70DD0F3DC4230FD" DeltaFlag="1" FullSize="1185589" LastModifiedTime="1387262021253" Moniker="{D3769926-05B7-4ad1-9DCF-23051EEE78E3}" Seq="131216001"/>

  <File Checksum="2BCC6DFEFF0788882097BCCD82EDD973" DeltaFlag="1" FullSize="669829" LastModifiedTime="1387147925371" Moniker="{C25CEA47-63E5-447b-8D95-C79CAE13FF79}" Seq="80929016"/>

  <File Checksum="85FA2BDE9F92CD228F841376B78562A7" DeltaFlag="1" FullSize="886158" LastModifiedTime="1387147930840" Moniker="{ECCC5006-EF61-4c99-829A-417B6C6AD963}" Seq="2012111400"/>

  <File Checksum="4A49FDF8842481D65D661615DAEFEF31" DeltaFlag="1" FullSize="88188" LastModifiedTime="1387147938340" Moniker="{EA960B33-2196-4d53-8AC4-D5043A5B6F9B}" Seq="80820001"/>

  <File Checksum="2DC4D3735698A8F6CD6F73AC29A871C6" DeltaFlag="1" FullSize="6762" LastModifiedTime="1387147940059" Moniker="{4F889C4A-784D-40de-8539-6A29BAA43139}" Seq="131024024"/>

  <File Checksum="8423DCA0E594841AC7C403FCCD4331A6" DeltaFlag="1" FullSize="1662247" LastModifiedTime="1387147941450" Moniker="{DB206823-FFD2-440a-9B89-CCFD45F3F1CD}" Seq="80820001"/>

  <File Checksum="A50A8C71081A8EDC341811350542975B" DeltaFlag="1" FullSize="1419193" LastModifiedTime="1387147955419" Moniker="{C13726A9-8DF7-4583-9B39-105B7EBD55E2}" Seq="80820001"/>

  <File Checksum="E44B7D258B3EC5945BB45F7DC008014D" DeltaFlag="1" FullSize="77361" LastModifiedTime="1387291949435" Moniker="{CC40C428-1830-44ef-B8B2-920A0B761793}" Seq="131217002"/>

  <File Checksum="91920BA1D1CBCA6DA2A488A0BECC7379" DeltaFlag="1" FullSize="13077129" LastModifiedTime="1387291956677" Moniker="{812CD25E-1049-4086-9DDD-A4FAE649FBDF}" Seq="131217002"/>

  <File Checksum="400B2F3ACFE7FC9A8E6B04361590B724" DeltaFlag="1" FullSize="13077148" LastModifiedTime="1387291965291" Moniker="{E1A6B4FF-6873-4200-B6F6-04C13BF38CF3}" Seq="131217002"/>

  <File Checksum="1FBBBA895DD2A8B8ECB739FAA5F17EDF" DeltaFlag="1" FullSize="77349" LastModifiedTime="1387291966286" Moniker="{E5A3EBEE-D580-421e-86DF-54C0B3739522}" Seq="131217002"/>

</LiveUpdate>

</GroupIndex>

 

It seems like my issue is in getting LiveUpdate and SEPM linked and set to download AV definitions.  If LuCatalog.exe doesn't fix this, what is the solution?

I'd really love to avoid installing 12.1 as it is year-end and we are barred from making major changes to our environment.

---

SEP - how do I install defintions for a given date

December 17, 2013, 10:54 am

≫ Next: SEP 12 RU4 ON 64-bit Windows Server 2012 R2

≪ Previous: SEPM 11.0.7 LiveUpdate not downloading anti-virus definitions

$

0

0

I need a solution

I am developing a process in which a vendor I am working with will give me the date of the virus defintions I need to use in SEP.

for example: I need to install the SEP defintions from this date:

2013-11-18 rev.2 

I have my Liveupdate server configured to download content to a network folder. My thinking is, I am going to copy the files I need out of the Liveupdate directory and copy them to a directory where the SEP Manager will see them. What files do I need from that download

to utilize the defintions from that day?

 

Is it only files with this in the filename?   131118002

this format breaks down:

13 year

11 month

18 day

002 revision

any help would be appreciated.

SEP 12 RU4 ON 64-bit Windows Server 2012 R2

December 17, 2013, 11:02 am

≫ Next: What is the latest version of SEP?

≪ Previous: SEP - how do I install defintions for a given date

$

0

0

I need a solution

We are creating a test lab for SEP 12 RU4 on 64-bit Windows Server 2012 R2.

But I need to know which database is better SQL Server Enterprise Core 2012 or SQL Enterprise Edition 2012

1387376469

What is the latest version of SEP?

December 17, 2013, 2:31 pm

≫ Next: How to upload new version from fileconnect into SEMP

≪ Previous: SEP 12 RU4 ON 64-bit Windows Server 2012 R2

$

0

0

I need a solution

I was in contact with Syamtnec yesterday and they gave me access to file connect to download the newest version of Symantec SEP.  I was told it was version 12.1.4.  A co-worker just told me that she has version 12.4.671.4971.  Is this available?  where can I get it?

 

thanks

How to upload new version from fileconnect into SEMP

December 17, 2013, 3:56 pm

≫ Next: The risk and gotcha when enabling the anti-MAC spoofing feature ?

≪ Previous: What is the latest version of SEP?

$

0

0

I need a solution

Hello _ i recently downloaded the latest version of SEP - 12.1.4 fromFileConnect and want to import it into my SEPM to use to update my workstations.  My question is how to do this.  I am trying to follow the directions you guys have given me in the past but when I upzip the fileconnect package - there is no.info file, just .ini and .exe files.  Can someone tell me in layman terms how to get this new version into the SEPM?  like step 1 - download file from file connect.  2.  unzip file connect file.  I am very confused......(like usual   :)    )

The risk and gotcha when enabling the anti-MAC spoofing feature ?

December 17, 2013, 8:52 pm

≫ Next: ccSvcHst takes 100% core and slow down opening of file or links

≪ Previous: How to upload new version from fileconnect into SEMP

$

0

0

I need a solution

Hi People,

Can anyone here please let me know what is the risk of enabling the anti-MAC spoofing feature in SEP for client or even Windows Server ?

Because I believe there has to be a reason why it is disabled or unchecked in the first place.

ccSvcHst takes 100% core and slow down opening of file or links

December 17, 2013, 9:00 pm

≫ Next: SEP failed cant download one updates only

≪ Previous: The risk and gotcha when enabling the anti-MAC spoofing feature ?

$

0

0

I need a solution

Hi,

Windows 7 64-bit with the latest update.

Symantec Endpooint Protection 12.1.2015

Windows Firewall is turned on and block outgoing connection by default.  Live Update has been enabled through Firewall so that the software and virus/threat definition is kept up to date.

In the last month of so, I've seen degrading performance of my PC.  Many examples.

Starting a program now takes a few seconds.

Open an email attachment in Outlook take 10 or more seconds

Clicking on a link in Outlook takes 30 seconds or more to open the page in browser

I kept task manager on the side then I noticed as soon as I click on the attachment or link, ccSvcHst will take 100% of a single core.  Until that goes away, no file or link will be opened.

What could be causing this?

Thanks

SEP failed cant download one updates only

December 17, 2013, 11:08 pm

≫ Next: Server hang up when getting the latest definition

≪ Previous: ccSvcHst takes 100% core and slow down opening of file or links

$

0

0

I need a solution

 Please help. How to solve it. This file is existing in LUA folder/ but my clients computers can not dowload it

---

Server hang up when getting the latest definition

December 18, 2013, 2:12 am

≫ Next: Has Symantec heard of PUP.Optional.MyWordTool.A

≪ Previous: SEP failed cant download one updates only

$

0

0

I need a solution

I setup SEP11 client on Windows Server 2003 SP2 virtual machine on KVM, and it

sometimes hangs up when getting the latest definition from SEP manager,

When this occurs,it doesnt respond to ping command and I cant connet via RDP. Also, KVM console of this server turns black.

After some minutes, it recovers as if nothing has happened with no error message/event log error.

I've got 15 - 20 guest OSs with the same specs on KVM, but only this virtual machine has this issue.

Has anyone had an issue like this?

Any suggestions would be appreciated.

Thank you.

 

Has Symantec heard of PUP.Optional.MyWordTool.A

December 18, 2013, 6:24 am

≫ Next: Issues saving file to Server 2008r2 (11x environment)

≪ Previous: Server hang up when getting the latest definition

$

0

0

I do not need a solution (just sharing information)

Has Symantec heard of PUP.Optional.MyWordTool.A?

 

One of our users was infected with malware that was re-directing her browser. She ran Symantec scans and powereraser but found nothing. Then she ran malwarebytes and found PUP.Optional.MyWordTool.A. Unfortunately she was unable to get the malicious files to upload to Symantec.

 

Here is information on PUP.Optional.MyWordTool.A

http://www.malwareremovalguides.info/pup-optional-mywordtool-a/

 

 

Just an FYI

Issues saving file to Server 2008r2 (11x environment)

December 18, 2013, 6:32 am

≫ Next: trojan.maljava keeps coming back?

≪ Previous: Has Symantec heard of PUP.Optional.MyWordTool.A

$

0

0

I need a solution

Good morning,

 

I have a user that is having an issues saving their files. Everytime they go to save a file to the server, their machine locks up.

When I disabled Symantec all together, everything was fine. 

Is this a known issue?

Is there a work around or fix in place?

Thank you in advance

 

 

trojan.maljava keeps coming back?

December 18, 2013, 9:44 pm

≫ Next: unmanage client

≪ Previous: Issues saving file to Server 2008r2 (11x environment)

$

0

0

I need a solution

Hi all,

A email will be sent to me when there is a risk/virus detected on a user's computer. 3 days ago, I received a email that Trojan.Maljava was found on a user's computer and was deteled by endpoint. However, I keep receiving this email, saying Trojan.Maljava was found on that user's computer. The path of the file infected is the same in all mails I received.

Then, I did a full scan on that user's PC but no virus or malware was found.

I also checked if there is any log or record regarding the risk on the Endpoint server. But sadly no record regarding that user was found.

Besides checking the logs on the server, I have also checked the logs in the Symantec Endpoint Protection on that user's PC but again, no log was found. And the user said that there was no notification or pop-up window from the endpoint saying a risk or malware was found on his PC.

Dose anyone know what happened and what should I do?

unmanage client

December 18, 2013, 11:13 pm

≫ Next: Centralize policy

≪ Previous: trojan.maljava keeps coming back?

$

0

0

I need a solution

Incase i can install any client with the the unmanage setup. Will it be use the License from Server or it come as a trial Computer?

Centralize policy

December 19, 2013, 12:29 am

≫ Next: SEP local install crashes without error message on Mac OS X 10.7.5 (11G63)

≪ Previous: unmanage client

$

0

0

I need a solution

I have some of the important data in my System drive, i can add the exception of that group so it can't be scan in the future. How to add?

SEP local install crashes without error message on Mac OS X 10.7.5 (11G63)

December 19, 2013, 12:55 am

≫ Next: Symantec Services

≪ Previous: Centralize policy

$

0

0

I need a solution

 i need Solution for this i have attached the log

 

Thanks in advance

Phani

 

• symantec.docx

1387459563

---

Symantec Services

December 19, 2013, 1:01 am

≫ Next: Migrate Symantec Endpoint 12 to new server

≪ Previous: SEP local install crashes without error message on Mac OS X 10.7.5 (11G63)

$

0

0

I need a solution

How can we temporarily stop or disable SepMasterService services

Migrate Symantec Endpoint 12 to new server

December 19, 2013, 2:35 am

≫ Next: Virus definition not update

≪ Previous: Symantec Services

$

0

0

I need a solution

Hi all.

We have Symantec Endpoint 12. It is deployed on Windows Server 2003 R2. 

We need to migrate it on Windows Server 2012 R2.

And we need to get help us.

Virus definition not update

December 19, 2013, 3:01 am

≫ Next: Some SEP 12.1 Questions

≪ Previous: Migrate Symantec Endpoint 12 to new server

$

0

0

I need a solution

I have a new 12.1.3 Management server.  The server gets updates daily, but none of the 12.1.3 clients get updates.  I have one 11.x machine that does get updates.  Why would the older client get updates, but none of the new?

Some SEP 12.1 Questions

December 19, 2013, 6:16 am

≫ Next: SEPM temp download temp files

≪ Previous: Virus definition not update

$

0

0

I need a solution

1. is Advanced Download Protection also called Download Insight?

2. it this article :

http://www.symantec.com/business/support/index?page=content&id=HOWTO55268

it states " Symantec recommends that you keep the Insight lookups option enabled. If you disable the option, you disable Download Insight completely"

where is it possible to enable or disable "insight lookups"?

 

SEPM temp download temp files

December 19, 2013, 7:01 am

≫ Next: Errors when trying to manually update Def files

≪ Previous: Some SEP 12.1 Questions

$

0

0

I need a solution

I have a setup where I have the SEPM (12.1.3) built on a D: drive as there is not much space available on the C: drive. It's built with an embedded database. There is only 4gb available on c: drive when liveupdate tries to run on the SEPM it gets to download and then the embedded database service stops and won't start back up. 

 

Is this because the SEPM is writing the temp download files to c: drive? If so is there any way to move where it downloads them to? Or anything else it may be writing to the c: drive. 

 

I've tried refreshing the sem5.log this gets the database back up but then when liveupdate starts again the service goes down.