Symantec endpoint protection 11 giving tamper protection notices

Posted on 2009-05-11
Last Modified: 2013-12-09
for the past two fridays i have been getting tamper protection notices on my exchange server, i dont know what they are or if i shoul dbe concerned i exported the list and attached it
Question by:cfischer225
  • 3
LVL 23

Accepted Solution

Admin3k earned 500 total points
ID: 24357803
If those are the only errors you get, I wouldn' t worry about them 
in general Tamper protection is a method your antivirus uses to detect whenever a 3rd party / outside application is trying to modify / disable or tamper with Antivirus files or settings.
this method was recently added to Antivirus programs, as the majority of new malware will try to disable / terminate antivirus programs the first thing they do after infection.
in this case , the Tamper protection alert originated from rundll32.exe which is a trusted windows process, I am guessing this is related to secondary login AND / OR RDP Console access.
if your antivirus is up & running and you only get this alert infrequently, I would suggest you ignore it .
LVL 15

Expert Comment

ID: 24357822

Please follow the solution in this KB article:

Create a "Tamper Protection" exception for this executable:


A Symantec Certified Specialist @ your service

Author Comment

ID: 24357994
i noticed i'm running 11.0.2 and im going to upgrade to the latest build. should i upgrade and then make the exculsion or vice versa?

when i upgrade will the new client retain the settings as i have other exclusions because its an exch server?

can i install on top or remove the old and install the new?
LVL 15

Expert Comment

ID: 24358412
1) "should i upgrade and then make the exculsion or vice versa?"

It doesn't matter

2) "when i upgrade will the new client retain the settings as i have other exclusions because its an exch server?"


3) can i install on top or remove the old and install the new?

You'll upgrade on top, you can migrate the current version to either (MR3) or the latest (MR4)

Check the following KB article:
LVL 15

Expert Comment

ID: 24614120

Any update on your case?

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Protecting Server 2008 Standard against ransomware 11 100
Comparison of Enterprise Level Software 3 60
Endpoint security products 4 51
Twitching screen 11 78
There are many HijackThis tutorials on the web already, so this article is about tips that help utilize HijackThis' full potential as a diagnostic tool. Download HijackThis from a TrendMicro link or from known reliable sources only. http://free.…
I recently had to create a utility which aim is to update McAfee's Virusscan and that had to be launched from a command line. I thought I’d share my experience with you. Why is it useful to be able to update an Antivirus from the command line?…
This is used to tweak the memory usage for your computer, it is used for servers more so than workstations but just be careful editing registry settings as it may cause irreversible results. I hold no responsibility for anything you do to the regist…
In this video I am going to show you how to back up and restore Office 365 mailboxes using CodeTwo Backup for Office 365. Learn more about the tool used in this video here: (…

863 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

25 Experts available now in Live!

Get 1:1 Help Now