symantec warnings

Problems with the Windows version of XAMPP, questions, comments, and anything related.

symantec warnings

Postby melanie » 11. February 2013 12:29

I have recently installed XAMPP for Windows, version 1.8.1, with control panel version 3.1.0.3.1.0, and it is working pretty well, but I get warnings from Symantec that look like this:

SYMANTEC TAMPER PROTECTION ALERT

Target: C:\Program files (x86)\Symantec\Symantec Endpoint Protection\12.1.671.4971
Event Info: Create Process
Action Taken: Logged
Actor Process: C:\XAMPP\XAMPP-CONTROL.EXE (PID 3464)
Time: etc.

I went into Change Settings -> Exceptions -> Configure Settings, and put the following into the list of User-defined Exceptions:
C:\xampp\xampp-control.exe All Scans Ignore
C:\xampp\xampp-start.exe All Scans Ignore

to no avail.

Any suggestions?
melanie
 
Posts: 2
Joined: 11. February 2013 05:32
Operating System: Windows 7, XAMPP 1.8.1

Re: symantec warnings

Postby JonB » 11. February 2013 16:50

I don't use Symantec - BUT

It wouldn't be a 'scan' option, those are for pattern recognition of files on disk. It would be some kind 'firewall'/'live' protection. Symantec is complaining that XAMPP's Control Panel seems to be launching other processes (like malware might) that would interfere with Symantec. Its a behavior issue. I also do not understand why XAMPP would trigger that, maybe its a Port 80 issue.

http://service1.symantec.com/SUPPORT/en ... 6200576f9d

You might want to contact Symantec or use their support forums.

Good Luck
User avatar
JonB
AF Moderator
 
Posts: 3210
Joined: 12. April 2010 16:41
Location: Land of the Blazing Sun
Operating System: Windows XP/7 - Fedora 15 1.7.7

Re: symantec warnings

Postby chetan_savade » 13. February 2013 19:21

Hi,

I am Chetan Savade from Symantec Technical Support team.

Following are the two fixes in SEP 12.1 RU1 MP1 version.
Tamper Protection exceptions are not honored (http://www.symantec.com/docs/TECH171057)
Fix ID: 2580578
Symptom: Tamper Protection exceptions are not honored. An excluded process will trigger tamper protection.
Solution: The SEP client was sending a delta of the exclusion list to the BASH component. The client was modified to send the complete list to resolve this issue.

Folder/file exclusions in SEPM will not accept the ampersand (&) character
Fix ID: 2564781
Symptom: The ampersand (&) character is a valid file/folder-name character on both Windows and Macintosh. Folder/file exclusions in SEPM do not accept the ampersand (&) character.
Solution: SEPM was modified to allow the ampersand (&) character in file/folder exclusions.

Reference: http://www.symantec.com/business/suppor ... TECH187656

SEP 12.1.671.4971 is old version & was released in 2011.

By looking at above two fix id's I would also suggest to upgrade to the latest SEP version i.e. SEP 12.1 RU2 (12.1.2015.2015)

Tamper protection related articles:
Creating a Tamper Protection exception:
http://www.symantec.com/docs/HOWTO55213
How to Create Exceptions or Exclusions for Tamper Protection Alerts that have already been logged
http://www.symantec.com/docs/TECH92553

Thanks and Regards,
Chetan Savade
Technical Support Engineer,
End Point Security
Enterprise Technical Support
Symantec Corporation
www.symantec.com
chetan_savade
 
Posts: 1
Joined: 13. February 2013 19:12
Operating System: Windows XP

Re: symantec warnings

Postby melanie » 19. February 2013 14:15

Problem solved, but in a strange way, so I will post it here in case this helps others.

I asked my university for help in upgrading my symantec, and they sent me a link to their current symantec download. They claimed it would be the version Chetan recommended. I uninstalled Symantec and re-installed with the new download. I got exactly the same version, judging by the version number.

However, I stopped getting the warnings, even without defining an exception.

My working hypothesis is that I could have avoided the whole mess if I had turned off symantec temporarily before installing xampp.
melanie
 
Posts: 2
Joined: 11. February 2013 05:32
Operating System: Windows 7, XAMPP 1.8.1

Re: symantec warnings

Postby JonB » 20. February 2013 17:32

Melanie:

A: I'm glad its working

B: I agree with your analysis

Good Luck with XAMPP
8)
User avatar
JonB
AF Moderator
 
Posts: 3210
Joined: 12. April 2010 16:41
Location: Land of the Blazing Sun
Operating System: Windows XP/7 - Fedora 15 1.7.7


Return to XAMPP for Windows

Who is online

Users browsing this forum: No registered users and 109 guests