Symantec Corporate File Block on Serv2003 SP1

Performed a manual (custom) install with the recent round of critical updates
(KB914388, KB917159, KB917537) on Server 2003 - SP1 with Symantec Corporate
v.10.x and during one of the updates (I do not know which,) Symantec claims
to have "protected" me from the following:

(text inside of <> was altered by me.)

SYMANTEC TAMPER PROTECTION ALERT

Target: C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
Event Info: Open Process
Action Taken: Blocked
Actor Process:
C:\WINDOWS\SoftwareDistribution\Download\f4069348c d23ff68c87c2ba6541ffdef\update\update.exe (PID 280)
Time: Friday, July 14, 2006 3:10:40 PM

Event Type: Error
Event Source: Symantec AntiVirus
Event Category: None
Event ID: 45
Date: 7/14/2006
Time: 3:10:40 PM
User: <user name>
Computer: <server name>

I obtained the following information from the system logs:

SYMANTEC TAMPER PROTECTION ALERT

Target: C:\PROGRA~1\Symantec AntiVirus\VPTray.exe
Event Info: Open Process
Action Taken: Blocked
Actor Process:
C:\WINDOWS\SoftwareDistribution\Download\f4069348c d23ff68c87c2ba6541ffdef\update\update.exe (PID 280)
Time: Friday, July 14, 2006 3:10:40 PM

Event Type: Error
Event Source: Symantec AntiVirus
Event Category: None
Event ID: 45
Date: 7/14/2006
Time: 3:10:40 PM
User: <user name>
Computer: <server namer>
Description:


SYMANTEC TAMPER PROTECTION ALERT

Target: C:\Program Files\Common Files\Symantec Shared\ccApp.exe
Event Info: Open Process
Action Taken: Blocked
Actor Process:
C:\WINDOWS\SoftwareDistribution\Download\f4069348c d23ff68c87c2ba6541ffdef\update\update.exe (PID 280)
Time: Friday, July 14, 2006 3:10:40 PM

Event Type: Error
Event Source: Symantec AntiVirus
Event Category: None
Event ID: 45
Date: 7/14/2006
Time: 3:10:40 PM
User: <username>
Computer: <server name>
Description:


SYMANTEC TAMPER PROTECTION ALERT

Target: C:\Program Files\Symantec AntiVirus\Rtvscan.exe
Event Info: Open Process
Action Taken: Blocked
Actor Process:
C:\WINDOWS\SoftwareDistribution\Download\f4069348c d23ff68c87c2ba6541ffdef\update\update.exe (PID 280)
Time: Friday, July 14, 2006 3:10:40 PM

Event Type: Error
Event Source: Symantec AntiVirus
Event Category: None
Event ID: 45
Date: 7/14/2006
Time: 3:10:40 PM
User: <user name>
Computer: <server name>
Description:


SYMANTEC TAMPER PROTECTION ALERT

Target: C:\Program Files\Symantec AntiVirus\DefWatch.exe
Event Info: Open Process
Action Taken: Blocked
Actor Process:
C:\WINDOWS\SoftwareDistribution\Download\f4069348c d23ff68c87c2ba6541ffdef\update\update.exe (PID 280)
Time: Friday, July 14, 2006 3:10:40 PM

Event Type: Error
Event Source: Symantec AntiVirus
Event Category: None
Event ID: 45
Date: 7/14/2006
Time: 3:10:40 PM
User: <user name>
Computer: <server name>
Description:


SYMANTEC TAMPER PROTECTION ALERT

Target: C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
Event Info: Open Process
Action Taken: Blocked
Actor Process:
C:\WINDOWS\SoftwareDistribution\Download\f4069348c d23ff68c87c2ba6541ffdef\update\update.exe (PID 280)
Time: Friday, July 14, 2006 3:10:40 PM

Event Type: Error
Event Source: Symantec AntiVirus
Event Category: None
Event ID: 45
Date: 7/14/2006
Time: 3:10:40 PM
User: <computer name>
Computer: <server name>
Description:


SYMANTEC TAMPER PROTECTION ALERT

Target: C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
Event Info: Open Process
Action Taken: Blocked
Actor Process:
C:\WINDOWS\SoftwareDistribution\Download\f4069348c d23ff68c87c2ba6541ffdef\update\update.exe (PID 280)
Time: Friday, July 14, 2006 3:10:40 PM
Event Type: Error
Event Source: Symantec AntiVirus
Event Category: None
Event ID: 45
Date: 7/14/2006
Time: 3:10:40 PM
User: <computer name>
Computer: <server name>
Description:


SYMANTEC TAMPER PROTECTION ALERT

Target: C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
Event Info: Open Process
Action Taken: Blocked
Actor Process:
C:\WINDOWS\SoftwareDistribution\Download\f4069348c d23ff68c87c2ba6541ffdef\update\update.exe (PID 280)
Time: Friday, July 14, 2006 3:10:40 PM

~~:~~

The update continued and installed without error. After reboot, I visited
the updates page again and it indicated that I did not need any.

I googled and searched microsoft, the KB articles, as well as this forum and
could not find any mention of a conflict. Am I in the clear?

Thanks.

The Symantec version is 7/14/2006 rev. 20.

"Cleffer" wrote:

> Performed a manual (custom) install with the recent round of critical updates
> (KB914388, KB917159, KB917537) on Server 2003 - SP1 with Symantec Corporate
> v.10.x and during one of the updates (I do not know which,) Symantec claims
> to have "protected" me from the following:
>
> (text inside of <> was altered by me.)
>
> SYMANTEC TAMPER PROTECTION ALERT
>
> Target: C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
> Event Info: Open Process
> Action Taken: Blocked
> Actor Process:
> C:\WINDOWS\SoftwareDistribution\Download\f4069348c d23ff68c87c2ba6541ffdef\update\update.exe (PID 280)
> Time: Friday, July 14, 2006 3:10:40 PM
>
> Event Type: Error
> Event Source: Symantec AntiVirus
> Event Category: None
> Event ID: 45
> Date: 7/14/2006
> Time: 3:10:40 PM
> User: <user name>
> Computer: <server name>
>
> I obtained the following information from the system logs:
>
> SYMANTEC TAMPER PROTECTION ALERT
>
> Target: C:\PROGRA~1\Symantec AntiVirus\VPTray.exe
> Event Info: Open Process
> Action Taken: Blocked
> Actor Process:
> C:\WINDOWS\SoftwareDistribution\Download\f4069348c d23ff68c87c2ba6541ffdef\update\update.exe (PID 280)
> Time: Friday, July 14, 2006 3:10:40 PM
>
> Event Type: Error
> Event Source: Symantec AntiVirus
> Event Category: None
> Event ID: 45
> Date: 7/14/2006
> Time: 3:10:40 PM
> User: <user name>
> Computer: <server namer>
> Description:
>
>
> SYMANTEC TAMPER PROTECTION ALERT
>
> Target: C:\Program Files\Common Files\Symantec Shared\ccApp.exe
> Event Info: Open Process
> Action Taken: Blocked
> Actor Process:
> C:\WINDOWS\SoftwareDistribution\Download\f4069348c d23ff68c87c2ba6541ffdef\update\update.exe (PID 280)
> Time: Friday, July 14, 2006 3:10:40 PM
>
> Event Type: Error
> Event Source: Symantec AntiVirus
> Event Category: None
> Event ID: 45
> Date: 7/14/2006
> Time: 3:10:40 PM
> User: <username>
> Computer: <server name>
> Description:
>
>
> SYMANTEC TAMPER PROTECTION ALERT
>
> Target: C:\Program Files\Symantec AntiVirus\Rtvscan.exe
> Event Info: Open Process
> Action Taken: Blocked
> Actor Process:
> C:\WINDOWS\SoftwareDistribution\Download\f4069348c d23ff68c87c2ba6541ffdef\update\update.exe (PID 280)
> Time: Friday, July 14, 2006 3:10:40 PM
>
> Event Type: Error
> Event Source: Symantec AntiVirus
> Event Category: None
> Event ID: 45
> Date: 7/14/2006
> Time: 3:10:40 PM
> User: <user name>
> Computer: <server name>
> Description:
>
>
> SYMANTEC TAMPER PROTECTION ALERT
>
> Target: C:\Program Files\Symantec AntiVirus\DefWatch.exe
> Event Info: Open Process
> Action Taken: Blocked
> Actor Process:
> C:\WINDOWS\SoftwareDistribution\Download\f4069348c d23ff68c87c2ba6541ffdef\update\update.exe (PID 280)
> Time: Friday, July 14, 2006 3:10:40 PM
>
> Event Type: Error
> Event Source: Symantec AntiVirus
> Event Category: None
> Event ID: 45
> Date: 7/14/2006
> Time: 3:10:40 PM
> User: <user name>
> Computer: <server name>
> Description:
>
>
> SYMANTEC TAMPER PROTECTION ALERT
>
> Target: C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
> Event Info: Open Process
> Action Taken: Blocked
> Actor Process:
> C:\WINDOWS\SoftwareDistribution\Download\f4069348c d23ff68c87c2ba6541ffdef\update\update.exe (PID 280)
> Time: Friday, July 14, 2006 3:10:40 PM
>
> Event Type: Error
> Event Source: Symantec AntiVirus
> Event Category: None
> Event ID: 45
> Date: 7/14/2006
> Time: 3:10:40 PM
> User: <computer name>
> Computer: <server name>
> Description:
>
>
> SYMANTEC TAMPER PROTECTION ALERT
>
> Target: C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
> Event Info: Open Process
> Action Taken: Blocked
> Actor Process:
> C:\WINDOWS\SoftwareDistribution\Download\f4069348c d23ff68c87c2ba6541ffdef\update\update.exe (PID 280)
> Time: Friday, July 14, 2006 3:10:40 PM
> Event Type: Error
> Event Source: Symantec AntiVirus
> Event Category: None
> Event ID: 45
> Date: 7/14/2006
> Time: 3:10:40 PM
> User: <computer name>
> Computer: <server name>
> Description:
>
>
> SYMANTEC TAMPER PROTECTION ALERT
>
> Target: C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
> Event Info: Open Process
> Action Taken: Blocked
> Actor Process:
> C:\WINDOWS\SoftwareDistribution\Download\f4069348c d23ff68c87c2ba6541ffdef\update\update.exe (PID 280)
> Time: Friday, July 14, 2006 3:10:40 PM
>
> ~~:~~
>
> The update continued and installed without error. After reboot, I visited
> the updates page again and it indicated that I did not need any.
>
> I googled and searched microsoft, the KB articles, as well as this forum and
> could not find any mention of a conflict. Am I in the clear?
>
> Thanks.
>
>
>
>
>
>
>

I too am getting similar error messages with my Symantec AV Enterprise
Edition 10.1 software where the Tamper Protection feature seems to be
attempting to protect me from Windows Updates.

"Cleffer" wrote:

> The Symantec version is 7/14/2006 rev. 20.
>
> "Cleffer" wrote:
>
> > Performed a manual (custom) install with the recent round of critical updates
> > (KB914388, KB917159, KB917537) on Server 2003 - SP1 with Symantec Corporate
> > v.10.x and during one of the updates (I do not know which,) Symantec claims
> > to have "protected" me from the following:
> >
> > (text inside of <> was altered by me.)
> >
> > SYMANTEC TAMPER PROTECTION ALERT
> >
> > Target: C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
> > Event Info: Open Process
> > Action Taken: Blocked
> > Actor Process:
> > C:\WINDOWS\SoftwareDistribution\Download\f4069348c d23ff68c87c2ba6541ffdef\update\update.exe (PID 280)
> > Time: Friday, July 14, 2006 3:10:40 PM
> >
> > Event Type: Error
> > Event Source: Symantec AntiVirus
> > Event Category: None
> > Event ID: 45
> > Date: 7/14/2006
> > Time: 3:10:40 PM
> > User: <user name>
> > Computer: <server name>
> >
> > I obtained the following information from the system logs:
> >
> > SYMANTEC TAMPER PROTECTION ALERT
> >
> > Target: C:\PROGRA~1\Symantec AntiVirus\VPTray.exe
> > Event Info: Open Process
> > Action Taken: Blocked
> > Actor Process:
> > C:\WINDOWS\SoftwareDistribution\Download\f4069348c d23ff68c87c2ba6541ffdef\update\update.exe (PID 280)
> > Time: Friday, July 14, 2006 3:10:40 PM
> >
> > Event Type: Error
> > Event Source: Symantec AntiVirus
> > Event Category: None
> > Event ID: 45
> > Date: 7/14/2006
> > Time: 3:10:40 PM
> > User: <user name>
> > Computer: <server namer>
> > Description:
> >
> >
> > SYMANTEC TAMPER PROTECTION ALERT
> >
> > Target: C:\Program Files\Common Files\Symantec Shared\ccApp.exe
> > Event Info: Open Process
> > Action Taken: Blocked
> > Actor Process:
> > C:\WINDOWS\SoftwareDistribution\Download\f4069348c d23ff68c87c2ba6541ffdef\update\update.exe (PID 280)
> > Time: Friday, July 14, 2006 3:10:40 PM
> >
> > Event Type: Error
> > Event Source: Symantec AntiVirus
> > Event Category: None
> > Event ID: 45
> > Date: 7/14/2006
> > Time: 3:10:40 PM
> > User: <username>
> > Computer: <server name>
> > Description:
> >
> >
> > SYMANTEC TAMPER PROTECTION ALERT
> >
> > Target: C:\Program Files\Symantec AntiVirus\Rtvscan.exe
> > Event Info: Open Process
> > Action Taken: Blocked
> > Actor Process:
> > C:\WINDOWS\SoftwareDistribution\Download\f4069348c d23ff68c87c2ba6541ffdef\update\update.exe (PID 280)
> > Time: Friday, July 14, 2006 3:10:40 PM
> >
> > Event Type: Error
> > Event Source: Symantec AntiVirus
> > Event Category: None
> > Event ID: 45
> > Date: 7/14/2006
> > Time: 3:10:40 PM
> > User: <user name>
> > Computer: <server name>
> > Description:
> >
> >
> > SYMANTEC TAMPER PROTECTION ALERT
> >
> > Target: C:\Program Files\Symantec AntiVirus\DefWatch.exe
> > Event Info: Open Process
> > Action Taken: Blocked
> > Actor Process:
> > C:\WINDOWS\SoftwareDistribution\Download\f4069348c d23ff68c87c2ba6541ffdef\update\update.exe (PID 280)
> > Time: Friday, July 14, 2006 3:10:40 PM
> >
> > Event Type: Error
> > Event Source: Symantec AntiVirus
> > Event Category: None
> > Event ID: 45
> > Date: 7/14/2006
> > Time: 3:10:40 PM
> > User: <user name>
> > Computer: <server name>
> > Description:
> >
> >
> > SYMANTEC TAMPER PROTECTION ALERT
> >
> > Target: C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
> > Event Info: Open Process
> > Action Taken: Blocked
> > Actor Process:
> > C:\WINDOWS\SoftwareDistribution\Download\f4069348c d23ff68c87c2ba6541ffdef\update\update.exe (PID 280)
> > Time: Friday, July 14, 2006 3:10:40 PM
> >
> > Event Type: Error
> > Event Source: Symantec AntiVirus
> > Event Category: None
> > Event ID: 45
> > Date: 7/14/2006
> > Time: 3:10:40 PM
> > User: <computer name>
> > Computer: <server name>
> > Description:
> >
> >
> > SYMANTEC TAMPER PROTECTION ALERT
> >
> > Target: C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
> > Event Info: Open Process
> > Action Taken: Blocked
> > Actor Process:
> > C:\WINDOWS\SoftwareDistribution\Download\f4069348c d23ff68c87c2ba6541ffdef\update\update.exe (PID 280)
> > Time: Friday, July 14, 2006 3:10:40 PM
> > Event Type: Error
> > Event Source: Symantec AntiVirus
> > Event Category: None
> > Event ID: 45
> > Date: 7/14/2006
> > Time: 3:10:40 PM
> > User: <computer name>
> > Computer: <server name>
> > Description:
> >
> >
> > SYMANTEC TAMPER PROTECTION ALERT
> >
> > Target: C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
> > Event Info: Open Process
> > Action Taken: Blocked
> > Actor Process:
> > C:\WINDOWS\SoftwareDistribution\Download\f4069348c d23ff68c87c2ba6541ffdef\update\update.exe (PID 280)
> > Time: Friday, July 14, 2006 3:10:40 PM
> >
> > ~~:~~
> >
> > The update continued and installed without error. After reboot, I visited
> > the updates page again and it indicated that I did not need any.
> >
> > I googled and searched microsoft, the KB articles, as well as this forum and
> > could not find any mention of a conflict. Am I in the clear?
> >
> > Thanks.
> >
> >
> >
> >
> >
> >
> >

MWebb <> wrote:

> I too am getting similar error messages with my Symantec AV Enterprise
> Edition 10.1 software where the Tamper Protection feature seems to be
> attempting to protect me from Windows Updates.

I suggest that you reconfigure that part of Symantec AV Enterprise by
whatever means so as to allow Windows Update to do whatever it is trying to
do.

--
Robin Walker [MVP Networking]

There doesn't to appear to be any ill-effects from the file block. Like I
said in my first post, the update installs, doesn't show an error, and
doesn't reppear on the update website. The server has been running for over a
week with no issues.

While not ideal, I think I'll start disabling Symantec while installing
updates just in case there is a serious issue.

Aaaah.. sweet avoidance.




"Robin Walker [MVP]" wrote:

> MWebb <> wrote:
>
> > I too am getting similar error messages with my Symantec AV Enterprise
> > Edition 10.1 software where the Tamper Protection feature seems to be
> > attempting to protect me from Windows Updates.
>
> I suggest that you reconfigure that part of Symantec AV Enterprise by
> whatever means so as to allow Windows Update to do whatever it is trying to
> do.
>
> --
> Robin Walker [MVP Networking]
>
>
>
>