Symantec endpoint protection active scan upon startup non stop

[Migration User]

hi,

the active scan upon non stop and running 2 days.

The windows backup failed to backup until i disable the symantec endpoint protection.

 

OS :w2k8 SBS

Symantec End Point:11.0.6005.562

 

Please advise and thanks.

[ℬrίαη]

***Backup the registry first***

Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Symantec\Symantec Endpoint Protection\AV\LocalScans

Do you see an active scan under the LocalScans key? You should be able to delete and restart SMC

[Migration User]

don't see active scan under the localscans key.

[ℬrίαη]

Check the description of the random numbered ones to see if one is an active scan

[Mithun Sanghavi]

Hello,

I am guessing these servers are running unmanaged SEP clients.

 

In which case, you can change scan on startup options in the GUI, from the "Scan for threats" tab, you should see "Active Scan upon Startup" you can disable or remove it from there.

For the ActiveScan when defs arrive, thats a little harder.. it would need to be a registry key

HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\AV\AdministratorOnly\General

and change the option "EnableDefwatchQuickscan"

 

Also, check this Article:

http://www.symantec.com/docs/TECH103044

[Migration User]

I'm having the same problem, and I had the same issue with the beta, too - except with the beta, I would have TWO scans running during startup.

I have no scans set on the 'Scan for Threats' page, and when I do a 'Repair' of the installation, the first few days are fine with no scans, and then it will start scanning days later.  I can recreate the problem by changing the date on my clock.

I was somehow able to stop this from happening with the beta, and it involved a lot of uninstall procedures.  As soon as I installed the final version, I immediately disabled the scans... and then a week later, it started scanning on its own after startup, anyway.  Very annoying.  I don't want to see pop-ups when I log on to the computer.

I checked the registry key mentioned above and I have no random number registry keys under the 'Active Scans' folder.

EDIT:  I actually think the scan running for mine is the 'Scheduled Scan,' because it says that it checks "well-known virus and security risk locations" - which is an option only checked under the 'Scheduled Scan.'  I have it disabled, so I have no idea why it chooses to run anyway.  On the log, it says "Logged by: Manual Scan" - but I certainly NEVER ran a manual scan.

EDIT 2:  Wow, it happens even when the scans are DELETED from the 'Scan for Threats' page.  What gives???  Also, this only happens on my Windows 7 64-bit machine, not my Windows XP 32-bit machine.  It's unfortunate that this bug was not fixed after I reported it when the beta first came out.  I guess I can try uninstalling and re-installing, again...

[Migration User]

no...

[Migration User]

Yes. this is unmanager client. Is it normal to run 3 days. Data 1.52TB

Already down key zero. change to 1?

thanks.

[Migration User]

Bug? after you uninstall and reinstall work or not?

[Migration User]

Well, so far, so good.  But, it took over a week for it to start happening last time.  So, it might not happen for a few more days.  I could always set the clock forward a week, but then I'd just have to deal with it happening again, which I'm trying to avoid for as long as possible.  But, it happened both with the beta (which did TWO manual scans on its own, even though I never did a manual scan) and it happened with the final product... so it sounds like a bug to me, especially since I've never run a manual scan AND I had the other two scans disabled (and then I deleted them, and it still happened).  It definitely requires some looking into.  If it happens again (now that I re-installed), I'll report back.

[Migration User]

Two manual scans decided to start a few minutes apart from each other about an hour ago.  Why is this happening!?????????????????????

[ℬrίαη]

Manual scan means someone started it.

[Migration User]

But, nobody started it...  I'm the only one who uses this PC, and it happens every time I've used SEP 12.1 - from the beta to the final version.  This never happened with prior versions of SEP. 

Once I do a fresh install of SEP 12, there's no manual scan for a week. Once a week passes, it starts happening.  Uninstall, re-install, another week.

This also happened while my PC was sitting idle after 1 week (2 manual scans started about 10 minutes apart from each other) and happens every time I change the date (to a future date) and re-boot it.  So, this manual scan seems to be on a schedule - but the thing is, I never scheduled any scans!  And I know for certain that no scans should be going because of how many times I've uninstalled/re-installed it.  And it always takes a week.  Only happens on my Windows 7 64bit PC, not my XP PC.  How is this not a bug?  When I went back to SEP 11, last month, I was fine no matter how many times I changed the date on the computer and rebooted it.  Went back to SEP 12, changed the date to a week in the future, rebooted, and it happened again.

This time, I didn't mess with the dates - it had been one week since I last informed you guys I was doing a re-install, and it happened again.  I wouldn't be bothered with it if I didn't SEE the scan taking place - and I even disabled Tamper Protection to turn off the "DisplayStatusDialog" and "ShowStatusDialog" under manual scan - thinking it would hide the scans from me - but that didn't work.  This is buggy as hell.  Any advice?

[ℬrίαη]

Post a screenshot of the scan logs so we can see.

Open a support case as I haven't seen these issues with 12.1, upgraded from 11.x.

[Migration User]

Here's the scan log (and as you can see whenever I advanced the date a couple of days, another scan happened.  All of the scans are logged by 'Manual Scan.'  If anybody has any advice to stop this "Manual Scan" from happening on its own, or to at least make it so that I don't SEE it happen, I'm all ears.

(Don't be alarmed that the Comptuer name is not in the screenshot - I removed it.)

[Migration User]

It's not very complicated at all. Open your SEP interface. On the left hand side, click on Scan for Threats. In the window below, there is a listing of Scan Names (Active Scan Upon Startup & Scheduled Active Scan). 1st one is disabled. To disable the scheduled active scan, right mouse-click and choose: Edit. Uncheck the box labeled: Enable the scan. Click OK. Exit SEP panel. Done!

[Migration User]

I have clients that have run across this issue as well. WinXP, Win7, Server '03 and even if disabling the active scan run into this issue. I've even tried to disable the notify but still run into multiple windows of the results.

[Migration User]

I am experiencing the exact same problem.  I have searched over the forum and FAQ, as well as many other websites and have not found a solution.

 

Has anyone heard of Symantec fixing this bug?

[Migration User]

I've downloaded and installed v12.1 RU1 (v12.1.1000.157) onto one of the Win7 machines that was having this problem. Problem has been corrected although it's only been two days. I have not had a chance to install on any of the other OS's but am cautiously optimistic.