Definition updates add entries to "PendingFileRenameOperations" registry key on a frequent basis

Article:TECH182556  |  Created: 2012-02-28  |  Updated: 2012-11-20  |  Article URL http://www.symantec.com/docs/TECH182556
Article Type
Technical Solution


Issue



On a regular basis, virus definition files for Symantec Endpoint Protection are added to the "PendingFileRenameOperations" registry key.  Is this expected behavior?


Error



Registry key: HKLM\SYSTEM\ControlSet001\Control\Session Manager\PendingFileRenameOperations

Key's value data: \??\C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Data\Definitions\IPSDefs\20120131.002\IDSxpx86.dll


Environment



Windows 7

Windows XP
Windows Server 2008 R2
32- and 64-bit
Symantec Endpoint Protection 12.1 RU1

Cause



Definition files are being replaced; old definition files are not removed until after reboot.


Solution



The issue has been fixed in SEP 12.1 RU2. 

You can obtain a copy of SEP 12.1 RU2 at the following location: 

https://fileconnect.symantec.com

The following are some helpful links to documentation regarding this new release:

 Obtaining the latest version of Endpoint Protection or Network Access Control

http://www.symantec.com/docs/TECH103088

 Upgrading or migrating to Symantec Endpoint Protection 12.1.2011 (RU2)

http://www.symantec.com/docs/TECH197426

 What's new in Symantec Endpoint Protection 12.1.2

http://www.symantec.com/docs/HOWTO81091

Release Notes and System Requirements for all versions of Symantec Endpoint Protection and Symantec Network Access Control

http://www.symantec.com/docs/TECH163829

New fixes and enhancements in Symantec Endpoint Protection 12.1 Release Update 2

http://www.symantec.com/TECH199676


Supplemental Materials

SourceETrack
Value2692127


Article URL http://www.symantec.com/docs/TECH182556


Terms of use for this information are found in Legal Notices