Welcome to ISAserver.org

Symantec's Corporate antivirus 10.0

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [ISA Server 2004 Firewall] >> Firewall Client >> Symantec's Corporate antivirus 10.0

Page: [1]

Message

<< Older Topic Newer Topic >>

Symantec's Corporate antivirus 10.0 - 3.Jun.2005 3:12:00 PM

piddlaw

Posts: 7
Joined: 25.Sep.2003
Status: offline

Installation fails if either a push install or local administrator install for the corporate antivirus client (or server) unless you uninstall the MS IAS FIREWALL CLIENT first.
It will hang on our windows xp pro SP2 with local firewall disabled at about the time it gets to the the liveupdate part of the install. It will then consume a ton of resources, you can try and end task on it but most times it ain't pretty.
Is this possible something on our ISA server/clients that i need to fix or check, or is this a symantec bug... anyone else seen this?
Thanks
David Wenzel

ps. if you install 10 on any clients look up the doscan.exe in their knowledge base for a pre or post install fix. the start up scan in this version needs a reg hack to fix or it will eat up 70 to 100 megs of memory and slow the pc to a crawl.

Post #: 1

Featured Links*

RE: Symantec's Corporate antivirus 10.0 - 4.Jun.2005 3:17:00 AM

ianfermo

Posts: 234
Joined: 7.Nov.2004
From: Zamboanga, Philippines
Status: offline

Hi,

If you are saying that it hangs during liveupdate? Symantec LiveUpdate uses HTTP,FTP, HTTPS. Be sure to create an allow rule for *liveupdate.symantec.com with the following protocols allowed.

Cheers,

(in reply to piddlaw)

Post #: 2

RE: Symantec's Corporate antivirus 10.0 - 6.Jun.2005 3:14:00 PM

piddlaw

Posts: 7
Joined: 25.Sep.2003
Status: offline

no, i am saying that during the install(windows xp SP 2 firewall turned off and admin privilages) it gets to a point in the install where it tells you it is installing liveupdate then hangs...
LUCOMS~1.exe and LSetup.exe both hang and have to be killed (the processes) or you have to do a hard reset. Server has been working otherwise just fine. HTTP, HTTPS, and FTP outbound are all enabled and working.
I think ity is more of a symantec bug, so i guess they may fix it someday. i was just hoping to help anyone else who may be tring to do the upgrade ot install in a similar enviroment, or if someone had figured out a registry hack or workaround, so i need not visit 100 workstations this weekend.
thanks
David

(in reply to piddlaw)

Post #: 3

RE: Symantec's Corporate antivirus 10.0 - 6.Jun.2005 5:20:00 PM

piddlaw

Posts: 7
Joined: 25.Sep.2003
Status: offline

more information for anyone who is interseted.

Have confirmed this problem on a windows 200 sp2 machine with the 2004 client with same result of it hanging.
Works Fine if client is running older (isa2000)client. On xp service pack 1 and two machines.
David Wenzel

(in reply to piddlaw)

Post #: 4

RE: Symantec's Corporate antivirus 10.0 - 7.Jun.2005 8:44:00 PM

Kalen

Posts: 6
Joined: 9.Feb.2005
Status: offline

Same problem here on Windows XP SP2 and Windows 2000 machines... lots of them. Have tried several things... no joy except to remove ISA Firewall Client, roll out SAV client, reinstall ISA Firewall Client.

Hoping for a fix, but for the time being it's back to the old sneakernet days.

(in reply to piddlaw)

Post #: 5

RE: Symantec's Corporate antivirus 10.0 - 10.Jun.2005 3:16:00 PM

GeoTech

Posts: 25
Joined: 23.May2001
From: Richmond, VA USA
Status: offline

I have the same problem (XP SP2, windows firewall off, ISA 2004 SP1). I contacted Symantec support and received the info below. However while attempting to perform the steps listed I find that you need a �Value� for the setting and Symantec does not provide that. I assume it is the port? Is this correct or is the "value" another variable? Thanks Ken

++++++++++++++++++++
Greetings,

Here is a copy of a post from one of our customers that was having the same issue We successfully resolved it using the steps below:

On the ISA server, bind the application "lucoms~1.exe" to a proxy so clients know to let that process have internet access. A quick and dirty "how to" of how this (on the ISA server):
- select Configuration
- select General
- (on the right hand side of the screen) select Define Client Firewall Settings
- click the tab for Application Settings
- click the New button
- for Application Name entry enter "lucoms~1.exe" (without the quotation marks)
- for the Key entry, choose the drop down entry that says "proxy bind IP"
- click OK

Note: After this, you will need to get the settings from the server to the client, I am not sure how ISA server does this. (In my case the customer was uninstalling the client and reinstalling it to force the settings change immediately, but presumably ISA has some provision to update the client settings eventually from the server.)

Sincerely, Symantec Technical Support

(in reply to piddlaw)

Post #: 6

RE: Symantec's Corporate antivirus 10.0 - 10.Jun.2005 4:55:00 PM

GeoTech

Posts: 25
Joined: 23.May2001
From: Richmond, VA USA
Status: offline

Update....

I pluged in ports 23,80 and 443 into the "value" and still no luck, then I uninstalled the firewall client and reinstalled it (as syamntec's email suggests) and AntiVirus 10.0 installed properly. YEA!

Now I am still not sure this is the fix because I had the firewall client for ISA 2004 running and after the reinstall it is actually running the SP1 firewall client (I checked and the msi and exe's are updated for SP1). So I will go back and do some more testing.

The question that remains will we have to uninstall and then reinstall the client on every workstation (ouch I have 300) to make this work or is there a way to replicate this change?

Thanks Ken

(in reply to piddlaw)

Post #: 7

RE: Symantec's Corporate antivirus 10.0 - 13.Jun.2005 2:54:00 PM

JimStruve

Posts: 2
Joined: 10.Jul.2002
Status: offline

I am fighting the same problem - Isa 2004 Firewall Client on Win XP SP2. According to Symantec, "LUCOMSERVER_2_6.EXE" which shows up in the tasklist as "LUCOMS~1.EXE" attempts to verify connectivity during setup. Any reply (positive or negative) will allow "LSetup.exe - live update setup" to continue and ultimately finish. I have tried many different options, including:
Firewall Client Settings
"LUCOMS~1.EXE Disable 1"
"LUCOMS~1.EXE DisableEx 1"
"LUCOMSERVER_2_6.EXE Disable 1"
"LUCOMSERVER_2_6.EXE DisableEx 1"
"LUCOMS~1.EXE ProxyBindIp 1"
"LUCOMSERVER_2_6.EXE ProxyBindIp 1"
"LUCOMS~1.EXE ProxyBindIp 192.168.100.74"
"LUCOMSERVER_2_6.EXE ProxyBindIp 192.168.100.74"
"LUCOMS~1.EXE ProxyBindIp 8080:192.168.100.74"
"LUCOMServer_2_6.EXE ProxyBindIp 8080:192.168.100.74"

Firewall Policy
Allow All Protocols From LocalHost to External, Internal, Internet Allusers, System and NetworkService (Monitoring the Client IP yeilds little clue to the answer)

For each attempt I am rebooting the client, which according to Microsoft's KB will refresh the client's settings. Does that really deploy the settings? So far, the only solution I have found is to uninstall the Firewall Client.

(in reply to piddlaw)

Post #: 8

RE: Symantec's Corporate antivirus 10.0 - 13.Jun.2005 4:23:00 PM

Rickymag

Posts: 509
Joined: 26.Nov.2003
From: SA
Status: offline

Good day,

Just a tip.

After a service pack on the ISA server I typically upgrade the ISA client aswell as there are times that MS changes the Client just some thoughts

RM

(in reply to piddlaw)

Post #: 9

RE: Symantec's Corporate antivirus 10.0 - 16.Jun.2005 5:25:00 PM

GeoTech

Posts: 25
Joined: 23.May2001
From: Richmond, VA USA
Status: offline

Resolution!

After doing quite a bit of testing, we have found that the problem is the version of the Firewall Client and not the "Client Firewall Settings" of binding "LUCOMS~1.EXE" to a proxy as Symantec suggested. The problem only occurs when you have ISA 2004 firewall client version 4.0.2161 (non SP1).

You can find the client version by right clicking the firewall client in the system tray, selecte configure. Then click on help, the version is listed at the top of the help window. Version 4.0.3440.81 (SP1) works with Symantec Antivirus 10 no problem.

As I suspected and I'm willing to bet that everyone that has had this problem installed the out of the box firewall client and at some point installed SP1 but never bothered to push the new client out (as I did). When they uninstalled and then reinstall, they did not realize the new client was installing and fixing the problem.

Hope this helps guys.

My next question. Is there an easy way to deploy the new client? In all previous instances I have had to uninstall the old version manually before the new client will install. Can you push this out using group policy and the MSI file?

Thanks, Ken

(in reply to piddlaw)

Post #: 10

RE: Symantec's Corporate antivirus 10.0 - 17.Jun.2005 12:09:00 AM

Kalen

Posts: 6
Joined: 9.Feb.2005
Status: offline

The new ISA Firewall Client appears to have fixed it for me as well... thanks for the update!

To deploy the new ISA Firewall Client via GPO I did the following:
- Deleted the old ISA Firewall Client 4.0 software entry from my GPO (was an "assigned" application to the OU where the computers lived). I told the GPO to leave the existing client on the systems it was already installed on.
- Created a new assigned software entry for the new ISA client
- Rebooted the computers twice (probably could have fixed that by running GPUPDATE /FORCE /BOOT on them... but didn't bother)... the ISA Firewall Client deployed on the second reboot
- ISA Firewall Client rebooted them as well after it installed itself

Thanks again!

(in reply to piddlaw)

Post #: 11