Symantec Endpoint Protection Versions 12 and 14 Cause Elliott Startup Error
Overview
There are some Elliott users who reported between 5/12/17 and 5/15/17 that using the latest anti-virus definition update of Symantec Endpoint Protection Versions 12 and 14 caused an Elliott startup error. The problem could be quickly identified because disabling Symantec Endpoint Protection resolved the problem. Some users expressed displeasure about the fact that Elliott can't work with anti-virus software like Symantec. But the proper question is why is Symantec stopping legitimate software like Elliott from running.Anti-virus software is what we call a "necessary evil." It is like an overzealous policeman who wants to arrest all criminals -- in the process, it sometimes arrests good guys. The situation is so bad that it is common when you call for support of an application, that the first thing the vendor will ask you to do is to disable the anti-virus software to see if that resolves your problem. Most unsophisticated users need the anti-virus software to protect themselves from malware. But on the other hand, anti-virus software often causes problems and keeps other legitimate software from running. This article documents what we found during this support experience and shares with our users some possible solutions to resolve this matter.
Identify this Problem
When a user starts up Elliott V8, he/she sees the following Elliott startup banner:
After that, the user receives the following Btrieve file access error message:
EL800US: Btrieve Error 034 on USERS SY Users Lic. File (32-Bit)
See sample screen below:
If you click on Details, you will find the actual error is 3106, which means the PSQL client is having difficulty connecting the PSQL engine, perhaps due to a network error. EL800US is the background Elliott executable that writes to the USERS.BTR file in the Elliott root directory in order to keep track of Elliott's user license count. In this case, EL800US failed to write to the USERS.BTR file due to error 3106.
After a while, then following message shows up:
Error in Macro APP-CONTROL - call to AppControl
A-1: Error finding application
No window available
See sample screen below:
This is a natural result of the previous error because EL800.EXE tried to detect whether EL800US.EXE was successfully launched, and it did -- thus the "Error finding application" message displayed. Elliott couldn't start up because EL800US.EXE failed to start.
Solutions
Disable Symantec Endpoint Protection
To quickly identify this problem, you can disable Symantec Endpoint Protection. If Elliott starts to work, then you know for sure this issue is caused by Symantec Endpoint Protection. Since we are not the software provider for Symantec, we can't really tell you how to have Symantec enabled while not affecting Elliott. We suggest that you give Symantec's support staff a call to get their advise.At first, we thought this issue seemed to indicate a network-level error. Maybe Symantec blocked the PSQL TCPIP port#3351 (Btrieve) to cause this error. After further testing, we determined that that was not the case.
In the meantime, we have received suggestions from users on how they have resolved this issue. We cannot guarantee that these suggestions will work; we are simply sharing these ideas your reference:
Exclude Pervasive Local Folders from Symantec Endpoint Protection
One Elliott re-seller claims that "It appears that if we exclude the Symantec scanning of the Pervasive directory on the user’s local computer, Elliott works fine..."This claim is consistent with the symptom because if Symantec would provide PSQL's dll from loading, then we could receive error 3106 upon starting up Elliott.
PSQL 11 client will be installed in the following folders:
- 32-bit client: C:\Program Files (x86)\Pervasive Software\PSQL\bin
- 64-bit client: C:\Program Files\Pervasive Software\PSQL\bin
- 32-bit client: C:\Program Files (x86)\Actian\PSQL\bin
- 64-bit client: C:\Program Files\Actian\PSQL\bin
Uninstall Proactive Threat Protection & Network and Host Exploit Mitigation
Another Elliott re-seller claims that "I have found that Elliott runs with Symantec Endpoint Protection but the Proactive Threat Protection and Network Host and Mitigation features need to be uninstalled.The two options below the Virus and Spyware Protection need to be removed, Elliott then runs."
See sample screen below:
In our opinion, if the previous solution of disabling the local PSQL folders from monitoring works, then it is a better solution than this one. Again, this information is provided for your reference only.
EMK