We recently started upgrading our servers from Symantec Endpoint Protection 12.1 RU4 (12.1.4013.4013) to version 12.1 RU4 MP1 (12.1.4100.4126).
The day after being updated, one of the servers started generating scary events in the System event log:
Many instances of...
An I/O operation initiated by the Registry failed unrecoverably. The Registry could not read in, or write out, or flush, one of the files that contain the system's image of the Registry.
...mixed in with many instances of...
The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume C:.
The System event log also became corrupt.
The first time this happened, I scheduled a chkdsk /f and restarted the computer. Then the next morning, the same thing was found to have occurred over night.
I tracked this down to the scheduled "Active Scan" that runs at 12:30 AM. Knowing this, I tried manually running an active scan and was able to induce the problem at will.
The next thing I tried was to uninstall the client, run CleanWipe, then reinstall it. This did not fix the problem. Running an active scan still caused the errors to be generated and the event log to become corrupted.
So, finally, I uninstalled the client, ran CleanWipe and reinstalled 12.1 RU4 (12.1.4013.4013). After this, I lost the ability to replicate the problem.
Our other servers aren't experiencing this problem. The details of this particular server are:
Type: Virtual (Hyper-V)
OS: Windows Server 2003 (fully patched)
Role: Terminal Server
Our other servers aren't terminal servers. But, we took this server out of load balancing when the problem developed. So, this isn't a multiple user issue. And I was able to replicate the problem right after a boot. So, it wasn't an issue of something slowly happening.
I had installed the client as "Basic Protection for Servers" and only "Virus and Spyware Protection" was showing in the client Status. So, there was nothing exotic installed.
It's my opinion that something got introduced in the 12.1.4100.4126 build that is not playing nice.