Endpoint Protection Small Business Edition

We have an issue with one partiuclar PC that Symantec Support has not been able to assist with to date. After every virus definition update, the System process (PID 4) begins to trawl through all the files on the hard disk, I am guessing some form of background scan. During this time, the computer becomes extremely slow and unresponsible with hard disk activity running at 100% for up to 3 hours. This is directly related to the installation of SEP Virus and Spyware protection (only this feature causes this behaviour). Disabling the option to scan after virus definition updates does NOT affect this behaviour.

Has anyone experienced something similar? Are there any registry settings that can change this behaviour?

Frank

Check the qurantine folder.how many files you have inside the folder?

whats the OS you are running?

The quarantine directory is empty. I can see from Resource Monitor & Process Explorer that the System process is trawling through all files on the hard disk. OS is Windows 7 Prof SP1.

Hello Frank,

is this a managed client from SEPM or Self managed? was the policy not to scan defs checked from SEPM? or via registry on the client.

for new defs it should not run full scan and it should not run for 3 hours. seems like its running complete scan after every update.

can you confirm if you have followed this.

http://www.symantec.com/business/support/index?page=content&id=TECH106098

and also confirm if you have any random scans in the registry.

Managed from SEPM. No errant scans in the registry that I can see. One weekly scan configred for Sundays - this opens a pop up box on the PC when it runs. Policy set not to scan on new definitions - "Run an Active Scan when new definitions arrive" is unticked.

Indeed it does appear to be a complete scan after each update, but I cannot find where to switch this off or reconfigure.

Are you aware of any registry enteries for features that can be turned on and off so I can try figure out what is causing this?

Also, it should be noted that disabling ALL "Virus and Spyware Protection" features does not stop this behaviour.

check this discussion please

http://www.symantec.com/connect/forums/how-disable-sep-121-defwatch-quickscan

Can you check this setting as well.

Scan file cache 

Hello,

Could you upload us the vpdebug.log from the client machine??

How to enable "Vpdebug Logging" on Symantec Endpoint Protection 11.0, 12.1, and 12.1 RU1

http://www.symantec.com/docs/TECH102939

Hope that helps!!

If it is not the defwatch scan ("Run an Active Scan when new definitions arrive") - check the settings for cache scanning:

http://www.symantec.com/docs/TECH191600

http://www.symantec.com/docs/HOWTO27136

Windows 7, fully patched. Same issue. PID 4 (System) reads in all files on the primary disk and an attached USB drive. Disk usage goes to nearly 100% until all files have been read.

It is not clear that SEP is the cause. I have turned off Active Scan to no avail.

We have two computers (at least) where this occurs, but we don't know what is triggering it.

Same version same problem. I spent 4 days on that.

Hi. I am suffering exactly same problem here.

I am using version: 12.1.3001.165 in a Unmanaged way.

Anybody was able to fix the issue? The machine is unusable while the process is executing...

Thanks in advance,

    Chemi.

I have the same issue on many workstations on my network. SEP Small Business Edition, version 12.1.3001.165 scans all files on all partitions after every definition update. "Run an Active Scan when new definitions arrive" is turned off. Disabling SEP locally during scan stops SYSTEM process activity.

These are managed clients.

Where should I upload logs?

Bump