You SEP is managed or unmanged ?

if the scheduled scan is interrupted, it will make it as missed events, and start within the randomization option.

if you want to disable the scan; kill the rtvscan.exe from taskmanager.exe.

Boris_yo,

It could also be a startup scan.

If you client is managed, edit its Antivirus and Antispyware policy. Click Administrator-Defined Scans. Click Advanced (tab at the top). Remove the checkmark from "Run startup scans when users log on".

You may also consider removing the checkmark from "Run an Active Scan when new definitions arrive".

Does that help?

James

I have status "Offline". Does that mean managed? Also i did not find startup item in msconfig to disable scan.

Yes its managed, the configuration need to be changed from the Manager

its not start up under msconfig, its strart up scan option in SEP

check this

https://www-secure.symantec.com/connect/forums/know-how-disable-scan-upon-startup-non-managed-client#comment-2396461

This is only for 32-bit and i have 64-bit operating system.

You shoud find a folder called wow64

HKLM\Software\WOW6432node\Symantec\Symantec Endpoint Protection\AV

Yes i have this one. I have a lot of other folders there and cannot figure out which to delete.

sorry for the delay..

look under.

symantec > symantec endpoint protection > AV > administratorOnly> general  the value enablestartupscan set it to 0.

I don't have what you showed but something else:

STartupScanEnabled value...set it to 0

It was already set 0.