Hey Jay,

What version of Endpoint Protection is this user running and is this machine currently infected?

Thanks.

What Symantec product and version are you using? Have you run Windows updates? What OS is this happening on?

Sorry  Client is XP Pro SP3

Symantec v 11.0.4000.2295

Clients laptop was infected...had to use Malwarebytes because Symantec rarely catches anything.

Does anyone else have a problem with this...We pay all this money for protection and have to use free software to take care of the problem.

If I right click C: and scan for viruses, it completes with ZERO files scanned

The laptop had Trojan.Fakeavalert  which Endpoint did find and reported that it cleaned it but in reality it took Malwarebytes to remove

Try running a repair install on the SEP client to see if that helps. Start->Run.. type: "appwiz.cpl"->click OK.
Select Symantec Endpoint Protection from the list and choose the Change button. Then select the repair option and choose install. Then test to see what the result is if you try a scan.

Regarding detection rates:

Always make sure you are running the latest definitions.

If the threat is not detected with the latest definitions please try our "Rapid Release" definitions.

Title: 'Applying rapid release definitions to a Symantec Endpoint Protection (SEP) client.'
Document ID: 2008052116163448
> Web URL: http://service1.symantec.com/SUPPORT/ent-security....

If the Rapid Release definitions do not detect the threat then submit a sample to our Security Response team for analysis.

https://submit.symantec.com/gold

Ensure you are taking full advantage of all of the protections available to you in Endpoint Protection. (NTP/Intrusion Prevention, TruScan, Bloodhound Heuristics.)

Following these steps will ensure you have a better experience in dealing with these types of threats in the future.

Hope that helps!

Are you still seeing issues? Please update us when you can.

Thanks,
Thomas

I have the same problem happening on desktops and laptops. The desktops don't even have users logged on when the scan is running. So it's not like the user stopped the scan or something. This is happening on numerous machines. I 've attached a screen shot. We have our scan's set to run on Thursday's at 6:00 PM. This machine was off at that time, so it started the scan when the machine was turned on. (we have machines auto power on at 5:30 AM)

No one else has this problem?
Has anyone bothered to check the scan logs using SEPM?