This behavior is as-designed. A virus sweep is designed to run on all computers. If a client is off-line when the virus sweep is started, then that client will run the virus sweep scan the next time it connects to the network. When a new client is added, the virus sweep automatically begins on that client.

To disable a virus sweep, delete the virus sweep from the Symantec or Norton AntiVirus parent server's registry.

To remove the virus sweep from the registry

1. Click Start > Run.
2. In the Run dialog box, type:
   
   regedit
   
3. Click OK.
   The Registry Editor Opens.
4. Go to the following key:
   
   HKEY_LOCAL_MACHINE\SOFTWARE\INTEL\LANDesk\VirusProtect6\CurrentVersion\ClientConfig
   
5. In the right pane, delete the VirusSweep value.
6. If you are using client groups, go to the following key:
   
   HKEY_LOCAL_MACHINE\SOFTWARE\INTEL\LANDesk\VirusProtect6\CurrentVersion\Groups\[GroupName]\ClientConfig
   where [GroupName] is the name of a client group to which the new client belongs.
   
7. In the right pane, delete the VirusSweep value.
8. Delete the following key:
   
   HKEY_LOCAL_MACHINE\SOFTWARE\INTEL\LANDesk\VirusProtect6\CurrentVersion\ClientConfig\LocalScans\VirusSweep
   HKEY_LOCAL_MACHINE\SOFTWARE\INTEL\LANDesk\VirusProtect6\CurrentVersion\DomainData\LocalScans\VirusSweep
   
9. If you are using client groups, delete the following key:
   
   HKEY_LOCAL_MACHINE\SOFTWARE\INTEL\LANDesk\VirusProtect6\CurrentVersion\Groups\[GroupName]\ClientConfig\LocalScans\VirusSweep
   where [GroupName] is the name of a client group to which the new client belongs.
   
10. Exit the Registry Editor.

After you delete the VirusSweep keys and values from the parent server, no new Virus Sweeps will begin on that server's managed clients. Computers that have already started the Virus Sweep will continue with the Virus Sweep until it completes.

If you start a new Virus Sweep, all VirusSweep registry information will be recreated on the parent server, and the VirusSweep value will be set to 1. The VirusSweep value on managed clients will be reset with the same value as the parent server.

If the problem persists, read the document Client scans run randomly and continuously.