LiveUpdate Engine is failing to decompress the virus definition updates for Symantec Endpoint Protection 12.1 client

book

Article ID: 155997

calendar_today

Updated On:

Products

Endpoint Protection

Issue/Introduction

LiveUpdate on a Symantec Endpoint Protection (SEP) 12.1 client is not able to decompress the virus definition updates.

 

In the "log.lue" the following errors are listed:

"Install Skipped code set for moniker {6AAE5D6B-C70C-4cdf-96C9-110AA1378E8C}, package 1329246178jtun_sep12ennful26.m26, error while decompressing."Deleting package "C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Data\Lue\Downloads\1329246178jtun_sep12ennful26.m26 in C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Data\Lue\Downloads\Patch7008
due to decompression failure.
...
* Inventory SetAbort called on Moniker {6AAE5D6B-C70C-4cdf-96C9-110AA1378E8C} (Inventory Module), with abort code 500
...
* Inventory SetAbort called on Moniker {6AAE5D6B-C70C-4cdf-96C9-110AA1378E8C} (Inventory Module), with abort code 517
...
* Callback {72DA128F-2591-43f2-B272-29DA5452A197} is a PostSession callback. Callback Failed. Result -2147467259
...
  Update for moniker: {6AAE5D6B-C70C-4cdf-96C9-110AA1378E8C}, P: SEPC Virus Definitions Win32 v12.1, V: MicroDefsB.Error, L: SymAllLanguages, package: 1329246178jtun_sep12ennful26.m26, SeqName: HubDefs, SeqNum: 120213017, has update status code: 201
...
* PostSession Callbacks Failed. Update status code for moniker {6AAE5D6B-C70C-4cdf-96C9-110AA1378E8C}, P: SEPC Virus Definitions Win32 v12.1, V: MicroDefsB.Error, L: SymAllLanguages is: 0x      C9.

The log file can be found in

"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Data\Lue\Logs"

 

On the Client User Interface go to "View Logs",  "Client Management" and open the System Log. You will find the following errors:

German operating system:

Ein Update für Definitionen für Viren- und Spyware-Schutz Win32 (Hub) von LiveUpdate konnte nicht installiert werden. Fehler: Dekomprimierung fehlgeschlagen (201)

Ein Update für Definitionen für Viren- und Spyware-Schutz Win32 von LiveUpdate konnte nicht installiert werden. Fehler: Fehler bei Postsession-Rückruf (208)

 

(translation: "An Update for definitions for virus and spyware protection Win32 (Hub) from LiveUpdate could not be installed. Error: decompression failed (201)")

(translation: "An Update for definitions for virus and spyware protection Win32 from LiveUpdate could not be installed. Error: Post-Session Callback at (208)")

 

 

Resolution

This issue is fixed in Symantec Endpoint Protection 12.1. RU2 MP1 (Fix ID: 2847004).

The updated LiveUpdate Express included in RU2 MP1 updates the decompression process to use less memory, which allows the extraction to occur.
 

 

New fixes and features in Symantec Endpoint Protection 12.1 Release Update 2 Maintenance Patch 1
http://www.symantec.com/docs/TECH204685

Upgrading or migrating to Symantec Endpoint Protection 12.1.2100 (RU2 MP1)
http://www.symantec.com/docs/TECH204449


Applies To

Symantec Endpoint Protection 12.1.x

Windows XP  Pro SP3

This specific error can be seen in SEP clients that retrieve their updates from Interent source servers as well as internal LiveUpdate Administrator 2.x (LUA 2.x) servers.