Why does Symantec End Point Protection Tamper Monitor lock out my LabView App for up to 5 seconds?

[Andrew_Scott_SPCi.ca]

Why does Symantec End Point Protection Tamper Monitor lock out my LabView App for up to 5 seconds?

I am running a multi threaded application where each thread is assigned to a different core on a 4-core PC running XPPro. Two of the threads are identical and started through a VIT. LabView queues are used to communicate between the various threads. The application makes extensive use of the Vision Development software, including real time acquisition from multiple GigE cameras. Software is LabView 2009, Vision 2010 and VAS 2010 and Windows XPPro. We use serial communication and write TXT files to disk. We do not access the Internet.

Our customer runs Symantec End Point Protection (corporate version of the Norton AV software) V11.0.6200.754. Something in our application causes the Symantec Tamper Protection EXE to lock out our LabView app and all other software including the XP task monitor for periods of up to 5 seconds at random intervals. If you disable tamper protection, the application runs fine. You can also download a standalone version of Symantec AV and the application runs fine. So it seems like it is something about the Symantec Tamper Protection.

Anybody else seen this problem? Help would be greatly appreciated!

Andrew

[AnalogKid2DigitalMan]

Our corporate Symantec does not have Tamper Monitor, but are there any events recorded in the Symatec logs that correspond to the lockout events?

-AK2DM

[smercurio_fc]

We also have Symantec Endpoint Protection at work, but it's the Small Business Edition, v12. It does not have Tamper Monitor. A brief look seems to indicate that this can happen with other applications. See, for example, here: http://www.symantec.com/business/support/index?page=content&id=TECH96718&key=55357&actp=LIST

[Andrew_Scott_SPCi.ca]

Thanks for the question. Unfortunately the is nothing in any of the Symantec logs other than normal Symantec virus updates. The frequency of these lockouts is high (multiple times per minute) and there are no corresponding log entries. But your question made me wonder about the system logs. I just check them and again, there is nothing there.

Andrew

[SynergyMike]

I don't know if this would apply to your customer, but just in case...

We have Symantec Endpoint Protection V11.something here, and on my LV(7.1) development system, I get random freezes for a few seconds when running LV (even when just trying to open a VI).  If I use Windows (XP) Task Manager to end the NI memory manager, the problem goes away (at least for awhile).  So I think there may be some resource conflict between the two.

Regards,

Michael Tracy

Synergy Microwave

[RavensFan]

I've seen this happen myself on one PC.  It makes the PC essentially unusable.  I found that if I disabled the DAQmx stuff in the application I did not have a slow down.  I haven't seen this on other PC's because none of them are using DAQ hardware.

Obviously I need to have DAQ for this application, so disabling my DAQ functions was not an option.  (For reference, this application uses LV 8.2.1 and DAQmx driver 8.6.0f5).  I don't know if the problem would go away with newer LV or newer DAQmx driver.  I haven't had a reason to upgrade this app.

What versions of LabVIEW and DAQmx are you using?  When this happens, do you see any processes eating up large percentages of CPU?

I tracked it down to a few files created by Symantec.

The processes SMC.exe, SMCGUI.exe, and RTVscan.exe.

But there are also two services that if I don't disable, cause RTVscan.exe to pop back up.

The two services are Symantec Management Client  and Symantec Endpoint Protection.

If you stop and disable those two services, then kill the 3 processes if they are still running, your problem may go away.  At least that is what seemed to work for me when I had a similar problem.

I hope this information helps, or at least gets you looking in the right direction.  Please update the thread with anything you find out.  If it works, it is a good confirmation.  If it turns out to be something else, that is good to know also.  I don't think this is a widespread problem among LV users.  At least when I was trying to figure out, I didn't find much on either the NI website or by Google.  I think what got me looking at Symantec as the problem was that things went from fine to bad in the course of a week and I happened to know that IT pushed down some anti-virus "upgrades" during that time.  This all happened to me in late July 2009.  I think there was one instance since then when I had to go in and disable stuff again.  Perhaps it was after IT had pushed another "upgrade".

[spaaw]

Is there a way to turn Symantec End Point Protection Tamper Monitor off programatically?

~ Peter 

[smercurio_fc]

You would need to check with Symantec on that. My guess is probably not (or at least not disclosed publicly), as that would defeat its purpose, right?

[Andrew_Scott_SPCi.ca]

You can turn tamper protection off for short periods of time, but it is reset when the system loads or new settings are pushed down. Even if we could do this, long term our customer will not allow it.

We have been working on this problem recently, but have not reached any conclusions except that it appears if you disable the VIT part of the app, the problem goes away. I hope to have an update in a week or so.

[Andrew_Scott_SPCi.ca]

Thanks to all who responded to this. In the end I have a solution, but am not sure how or why it is any better. The old code used a VIT server, multiple iinstances assigned to different cores using timed loops. The new version, which does not offend Symantec uses a single instance still called through a VIT server. It does not use timed loops (just normal while loops) and uses threads rather than explicit assignments to cores. Who knows why this fixed the problem, but it did.