Not what you were looking for? Ask our experts!
Reply
Visitor
Constractor1
Posts: 5
Registered: ‎07-14-2010

Vulnerability Protection Signatures corrupted...

Hi, all. Newbie here. (Brace yourselves.)

I've read the other threads on this, and they haven't helped. This is happening almost every day now, sometimes twice, so Help!

It's happening randoml - it just happened again- randomly, not just when I restart. NIS 4, Mac 10.4.11, eMac 1.25 USB 2.0.

Thanks. Have to update and restart again now...

Symantec Employee
ryan_mcgann
Posts: 864
Registered: ‎01-10-2009

Re: Vulnerability Protection Signatures corrupted...

Sorry for the problems.

 

When you say this is happening randomly, can you please elaborate on what you were doing when the error appears…does it appear when you restart your Mac, or only after your Mac has been running for a while? And how often does it appear?

 

Also, please make sure you have the latest versions of everything. Some people have had their Vulnerability Protection definitions get out of sync somehow. You can verify you have the latest versions by following these steps:

1. Open the Terminal application (in Applications -> Utilities).

2. Copy and paste (or type) the following:

cd /Library/Application\ Support/Symantec/IntrusionPrevention/CurrentSignatures

cat virscan1.dat

kextstat

 

Please post the results of these commands into the forums here so I can take a look.

 

Thanks,

Ryan

 

Ryan McGann
Principal Software Engineer
Macintosh Products & Solutions
Symantec
Visitor
Constractor1
Posts: 5
Registered: ‎07-14-2010

Re: Vulnerability Protection Signatures corrupted...

Hello, Ryan, thanks for the prompt and helpful reply.

 

The version check you asked me to run should be attached.

 

As I say, there seems to be no pattern to the occurances. I'm on 3-5 hours or so in the evenings during the week, and recently it's happening once or twice an evening. It certainly happens within the first 20 minutes or so - which is strange, because I've scheduled a Live Update to run as soon as I start - and then it may happen again later on.

 

I've usually been putting my computer to sleep during the day, then waking it up to work, but recently I've been shutting it down instead. Doesn't seem to make a difference.

 

Thanks again.

Symantec Employee
ryan_mcgann
Posts: 864
Registered: ‎01-10-2009

Re: Vulnerability Protection Signatures corrupted...

Your output shows that everything you have installed is the correct version.

 

My next piece of advice you may not like to hear: wait (please). We will be releasing an update soon which may, or may not resolve this particular problem--since I can't say for certain what your issue is, I am not sure if the upcoming update will fix it. But if we're lucky, then the update that should be released next week could fix everything. I'll be posting here when we release the update.

Ryan McGann
Principal Software Engineer
Macintosh Products & Solutions
Symantec
Visitor
Constractor1
Posts: 5
Registered: ‎07-14-2010

Re: Vulnerability Protection Signatures corrupted...

Ryan-

 

I owe it to you now, and to others it might help, to tell you about the second problem I've been having, just in case the two are related. Excuse me for waiting until now, but I didn't want to complicate things, in case this was a known issue with a separate solution. It's also a little humiliating.

 

Having reason to believe my Mac was infected (Norton firewall lock wouldn't stay locked... which, it turns out, is normal for this version), I misread some directions on securing my Mac, and deleted the passwords on all my system users. Now I have Clamav and Amavisd in my login window. I put a strong password on my Root User at the same time, so hopefully I've avoided any real trouble. I joined the Apple forums a few days before starting here to solve this, but it's not resolved yet either. At the moment, and with the weekend ahead of me, I'm considering re-installing everything.

 

I can hear the gasps from here....

 

 

Visitor
Constractor1
Posts: 5
Registered: ‎07-14-2010

Re: Vulnerability Protection Signatures corrupted...

Update, FYI:

 

I ended up doing a system restore, and re-installed NIS. It fixed the user password problem, but not the Vulnerability Protection Signature problem. 

Symantec Employee
ryan_mcgann
Posts: 864
Registered: ‎01-10-2009

Re: Vulnerability Protection Signatures corrupted...

[ Edited ]

Just as a quick check, could you send us a full system profile? We're interested in how much memory your computer has, and whether any of our processes are crashing.

 

The message you are seeing should only be seen in three cases:

1) during system startup

2) when you get a new LiveUpdate containing Vulnerability Protection signatures

3) whenever our background process crashes (which is hopefully not frequently)

 

If you could generate a system profile the next time you see this message, that would tell us a lot. If you could also check the folder

/Library/Logs/CrashReporter

and see if it has a file that begins with "SymDaemon.crash" that would tell us if our background process is crashing. You can post both files up here on the forums.

 

Thanks,

Ryan

Ryan McGann
Principal Software Engineer
Macintosh Products & Solutions
Symantec
Symantec Employee
ryan_mcgann
Posts: 864
Registered: ‎01-10-2009

Re: Vulnerability Protection Signatures corrupted...

[ Edited ]

I think the problems are that our process is crashing, and when it re-launches, there is insufficient memory to load the Vulnerability Protection definitions. On older computers the defs can fail to load after several attempts. Usually only one attempt is needed, but if our background process crashes, it will re-load them, causing a failure. The alert you saw on the 18th was probably right after our SymDaemon process crashed, which was also on the evening of the 18th.

 

While the crashing is not ideal, the good news is that the alert is unnecessary. The signatures have already been loaded but because our process crashed it thinks it needs to load them again. 

 

I'll look into seeing why the crashes are occuring but no guarantees. In the mean time you can just ignore the alerts. If they occur frequently (once a day or so) then that means our background process is crashing a lot and we should look into that.

 

Sorry for the problems.

Ryan McGann
Principal Software Engineer
Macintosh Products & Solutions
Symantec
Visitor
Constractor1
Posts: 5
Registered: ‎07-14-2010

Re: Vulnerability Protection Signatures corrupted...

Ryan-

 

FYI: It's been 11 days now since I re-installed, and I haven't had any more alerts, except for the one you mentioned on the 18th.