SymUIAgent.app steals focus from active window

[Migration User]

Dozens of times a day, while I'm typing in a window, focus is stolen from that window and all of my subsequent keystrokes are ignored until I switch back to the original window. Quite a disruption to flow. I found a script that you can run to find out which application is stealing focus and it pointed at SymUIAgent.app:https://gist.githubusercontent.com/iMerica/8928556/raw/73832a509de4dc539...(link is external)Has this issue been fixed in a newer release? Symantec is installed on my work laptop by our IT department and I cannot perform updates but if I knew there was a fix, I could ask my friendly IT folks to help me upgrade to the patched version.

I am running a Mac (10.10.2 Yosemite) and Symantec Solutions LiveUpdate, SmallScanner and Endpoint Protection. 

Thanks!

[ℬrίαη]

Didn't know it was an issue. What version of SEP?

[Migration User]

SEP Version 12.1.5 build 5337

Thanks!

[Migration User]

I wonder if this is a symptom of another problem. When I open Symantec Endpoint Protection (SEP) the following problems are reported: 

* Virus and Spyware Protection is disabled 
* Network Threat Protection is disabled 
* Definitions are Outdated 

I click the "Fix" button and it just tries to update my software and reports that my software is up to date. It appears that the fix button did nothing to resolve the three errors I listed above. 

I then click on the Settings button in SEP and I see that the Virus and Spyware Protection slider is in the off position. I slide it on, enter my password, and then I get an error: Unable to load the Virus and Spyware signatures. Please run LiveUpdate to get the latest version. 

Running LiveUpdate just tells me that I'm already up to date. 

Could it be that the problem that's preventing me from turning on the Virus Protection is also making SymUIAgent.app steal focus so frequently?

[Migration User]

We have the same issue here; i had submitted a technical case about this last week and have been waiting for the "mac team" to call me back from Symantec for a few days now. 

 

This was supposed to be fixed in the upgrade to 12.1.5 and we did a massive upgrade to fix this, and yet it is still happening. We are uninstalling it on every mac because we have developers trying to code and every few minutes have to go back and re-type things which is unacceptable. 

Our machines are on 10.10.1 and 10.10.2. 

 

[Migration User]

Looks like I'm not the only one with this problem.  Do you know if/when it might be fixed?  Thanks!

[Migration User]

If my issue is a duplicate of another issue, could you please let me know which issue is the original so that I can monitor its progress?  Thanks again!!

[Migration User]

Per https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&cad=rja&uact=8&ved=0CB8QFjAA&url=http%3A%2F%2Fwww.symantec.com%2Fbusiness%2Fsupport%2Findex%3Fpage%3Dcontent%26id%3DTECH224706&ei=OJkeVb31JPiasQS4qYHYBg&usg=AFQjCNFx-Riyw2G-c0K-oidn13TJrBQ4sg&sig2=Zv6ighB5xMhn8DCXyUzlqQ&bvm=bv.89947451,d.cWc

There is this "fix" they implemented in 12.1.5

 

Active window loses focus when a scan starts

Fix ID: 3302403

Symptom: The active window on the client loses focus when a scheduled scan begins.

Solution: Changed the scan window to start in the background. The scan will also flash the taskbar icon.

 

I have an open case with Symantec right now about this, apparently that fix is just for Windows, not for macs. They collected logs from me, so we shall see. 

[Migration User]

Thanks SwissHokie!

I am currently running SEP 12.1.5 which presumably has the fix in it but I am still seeing the focus stealing issue.

Based on your previous comment, I was under the impression that it was still not fixed in 12.1.5.  Was there another release or patch of 12.1.5 (perhaps with a build number greater than 5337) that does indeed fix the problem?

Thanks again!

 

Tim

[Migration User]

SwissHokie, 

    I just read the last paragraph of your post about the Mac problem remaining.  Sorry I skipped that on my first reading.

    My computer is a Mac so I still have the problem.

Thanks!

[Migration User]

We are also having an issue with one of our users, any update on a patch?

[Migration User]

Not yet, I have given them logs and a video recording of it happening, and they had some scripts run to show the current process that takes over the mouse and it shows the symui process taking it over. As of this last week they are still looking into it. 

[Migration User]

Just Downloaded 12.1.6, user is testing.

[Migration User]

Just installed 12.1.6 on OS X 10.9.5, same issue as timjstewart - unusable because definitions are permanently outdated and live update always concludes saying that my software is up to date ....

[Migration User]

In my case, running Live Update results in the following entries in /var/log/system.log. I will send my crash log to Symantec if it is not too onerous to do so.

Jul 17 15:03:57 iMac.local Symantec Endpoint Protection[983]: IPS Enabled : 1

Jul 17 15:03:57 iMac LiveUpdate[1372]: objc[1372]: Class XByteCountFormatter is implemented in both /Library/PrivateFrameworks/SymAppKitAdditions.framework/Versions/B/SymAppKitAdditions and /Applications/Symantec Solutions/LiveUpdate.app/Contents/MacOS/LiveUpdate. One of the two will be used. Which one is undefined.

Jul 17 15:03:57 iMac LiveUpdate[1372]: objc[1372]: Class SymAboutBox is implemented in both /Library/PrivateFrameworks/SymAppKitAdditions.framework/Versions/B/SymAppKitAdditions and /Applications/Symantec Solutions/LiveUpdate.app/Contents/MacOS/LiveUpdate. One of the two will be used. Which one is undefined.

Jul 17 15:03:57 iMac LiveUpdate[1372]: objc[1372]: Class SymURLTextField is implemented in both /Library/PrivateFrameworks/SymAppKitAdditions.framework/Versions/B/SymAppKitAdditions and /Applications/Symantec Solutions/LiveUpdate.app/Contents/MacOS/LiveUpdate. One of the two will be used. Which one is undefined.

Jul 17 15:03:58 iMac.local SymDaemon[1371]: No persistent timers found.

Jul 17 15:03:58 iMac com.apple.launchd[1] (com.symantec.symdaemon[1371]): Job appears to have crashed: Illegal instruction: 4

Jul 17 15:03:58 iMac com.apple.launchd[1] (com.symantec.symdaemon): Throttling respawn: Will start in 9 seconds

Jul 17 15:03:58 iMac.local ReportCrash[1354]: Saved crash report for SymDaemon[1371] version 5.2.1 (1) to /Library/Logs/DiagnosticReports/SymDaemon_2015-07-17-150358_iMac-Home.crash

Jul 17 15:03:58 iMac.local ReportCrash[1354]: Removing excessive log: file:///Library/Logs/DiagnosticReports/SymDaemon_2015-07-17-150021_iMac-Home.crash

Jul 17 15:04:00 iMac com.apple.launchd[1] (com.symantec.liveupdate.daemon.ondemand[1374]): Job appears to have crashed: Illegal instruction: 4

Jul 17 15:04:00 iMac.local LiveUpdate[1372]: Connection Died

Jul 17 15:04:00 iMac.local Symantec Endpoint Protection[983]: Symantec Endpoint Protection could not verify the integrity of one of its components.

Jul 17 15:04:00 iMac.local ReportCrash[1354]: Saved crash report for LiveUpdateDaemon[1374] version 6.2.2 (1) to /Library/Logs/DiagnosticReports/LiveUpdateDaemon_2015-07-17-150400_iMac-Home.crash

Jul 17 15:04:07 iMac.local SymDaemon[1379]: No persistent timers found.

Jul 17 15:04:08 iMac.local ReportCrash[1380]: Metadata.framework [Error]: couldn't get the client port

Jul 17 15:04:08 iMac.local ReportCrash[1380]: DebugSymbols was unable to start a spotlight query: spotlight is not responding or disabled.

Jul 17 15:04:08 iMac com.apple.launchd[1] (com.symantec.symdaemon[1379]): Job appears to have crashed: Illegal instruction: 4

[Migration User]

I see in /var/log/system.log that Live Update is crashing with an illegal instruction exception.  That doesn't sound likely.  Maybe this iMac has some memory or other hardware problems.

There is still at least a minor bug, in that SEP responds to crashing and burning with the Pollyanna response "Your software is up to date" (although the status of the software is not actually changed).

[Migration User]

We have a solution!!!!! (not really, but a way for the tool to steal the focus less frequently)

 

https://support.symantec.com/en_US/article.TECH231731.html

 

I changed the heartbeat interval from default 5 min to 4 hours for the macs. guess we will wait and see?