Release Notes for Symantec Client Security 3.1 MR10


Unable to trace infections to the source IP address

Fix ID: 1304157
Symptom: When enabling the THREATTRACER registry value, the source computer field shows the local host instead of the correct computer.
Solution: ThreatTracer computer name and IP address were not being passed through the anomaly processor, so they were not ending up in the alerts and logs.

Symantec AntiVirus Full Scan does not scan network drives, even if mapped as a drive letter

Fix ID: 1425324
Symptom: Symantec AntiVirus full scan scans only the physical disks connected to the computer.
Solution: The behavior is as designed. Updated to remove references to Network Drive in the description of Full Scan.

Default profile is displayed instead of expected user profile

Fix ID: 1677569
Symptom: The default profile is displayed instead of the expected user profile.
Solution: Added a delay in starting user scheduled scans at service startup to prevent this problem.

When manually adding file to quarantine the original file remains

Fix ID: 1708444
Symptom: When a file is manually added to the quarantine, the original file remains on the disk.
Solution: Files manually added to the quarantine are now deleted.

Symantec Client Security uninstall removes a registry key that has the license keys for Microsoft's Visual Studio

Fix ID: 1744193
Symptom: During Symantec Client Security uninstall, the following reg keys that has the license keys for Microsoft's Visual Studio are removed HKEY_CLASSES_ROOT\Licenses\57CBF9E0-6AA7-11cf-8ADB-00AA00C00905
HKEY_CLASSES_ROOT\Licenses\ED4B87C4-9F76-11d1-8BF7-0000F8754DA1 
Solution: The keys are marked permanent so that they are not removed during Symantec Client Security uninstall.

USB external floppy drive does not give warning that there is a floppy still in the drive

Fix ID: 1824874
Symptom: When a floppy disk is inserted into a USB Floppy Disk Drive and the drive is a boot drive, then at shutdown the floppy is not detected and no pop-up is shown.
Solution: Symantec AntiVirus was modified to check for more types of floppy drives and provide the correct prompt.

Excessive disk space being used by .vdb files on the SYS directory

Fix ID: 1837187
Symptom: When the registry value PatternsToKeep is created and set to 1, then no directories are deleted from the I2_LDVP.VDB directory.  Also, Symantec AntiVirus leaves PatternsToKeep + 1 vdb files in the Symantec AntiVirus Home\Login directory.
Solution: Correct functionality that scans a directory for pattern files.

Multiple AMS alerts generated for a single event

Fix ID: 1846210
Symptom: Multiple AMS alerts are generated for a single event.
Solution: Updates to the AMS component to correct the issue.

Symantec AntiVirus 10.1.4 Upgrade to 10.1.9 results in corrupted run key for vptray

Fix ID: 1869718
Symptom: When Short File Name creation is disabled though the registry, \Run\Vptray contains a Long File Name without quotes.
Solution: Updated the Symantec AntiVirus installer to always generate Long File Name with quotes for the \Run\Vptray value.

BugCheck 50, {fffff80001610060, 0, fffffadcb87273b3, 0} possibly caused by Savrt64x86

Fix ID: 1871159
Symptom: 64-bit computer crashes (blue screen) with bug check 50 (PAGE_FAULT_IN_NONPAGED_AREA).
Solution: The Real-time Protection (File System AutoProtect) driver was modified to prevent an occurrence where it could read invalid memory.

RTVSCAN uses 100% of CPU for ~5-60 minutes

Fix ID: 1879071
Symptom: Rtvscan.exe may consume 100% of available CPU for a period of 5-60 minutes.  The issue is intermittent.
Solution: Rtvscan.exe was modified to prevent a case where the IDB processing logic could get into a loop, consuming all CPU.

Blue screen: PAGE_FAULT_IN_NONPAGED_AREA (50) referencing Savrt

Fix ID: 1898155
Symptom: Computer crashes (blue screen) with bug check 50 (PAGE_FAULT_IN_NONPAGED_AREA) when the File System AutoProtect "SmartScan" feature is enabled.
Solution: The Real-time Protection (File System AutoProtect) driver was modified to properly clean up an internal cache when an application terminates, leaving handles open.

Rtvscan.exe crashes trying to access a NULL pointer

Fix ID: 2015959
Symptom: Rtvscan.exe crashes.
Solution: Corrected the function which was causing the crash.

Reports using set specific dates for time range will not allow DD/MM/YYYY DMY format

Fix ID: 2067388
Symptom: Reports using set specific dates for time range will not allow DD/MM/YYYY DMY format.
Solution: Updated code to evaluate the days in month after evaluating the month and year.

AMS Configuration window is blank after installing Symantec AntiVirus and Symantec System Center from MR9

Fix ID: 2084700
Symptom: Sometimes when opening the AMS Configuration window it is populated with the Alert actions, but generally the window is blank.
Solution: The Alert Management System 2 component was modified to properly display the alert actions in the configuration window.

Setting InheritGroupSettings on a primary causes Symantec AntiVirus to use un-initialized memory for a parent

Fix ID: 2114450
Symptom: Intermittent output traffic to a random IP address.
Solution: Rtvscan.exe was modified to properly initialize the field before first use.

Components