Refer to this KB for a possible solution -

Resetting the policy on a Symantec Critical System Protection agent

http://www.symantec.com/business/support/index?pag...

Cheers,

Thomas

Wandi,

The detection policy pack you are using is a bit old and is actually not supported by 5.2 agents. A "bridge" was made between 5.1 distro of detection policies and 5.2. Applying older 5.1 detection policies would have this affect.

If you need assistance in importing the newest policy pack please let me know. 5.2.6 distro includes the new combined and enhanced windows detection policy and the forthcoming 5.2.7 will have the new combined and enhanced unix detection policy and is compatible with any 5.2.x agent along with a highly detailed 100+ page policy guide that was created from scratch to assist in configuration and deployment of these new policies.

Also, upgrade your prevention policy pack as well.

The null policy (even though it tells the IPS driver to do nothing) has been upgraded to r10 with a slightly different method.