Video Screencast Help

Created: 03 Oct 2012 • Updated: 03 Oct 2012 | 8 comments


as per the link in the title, I have a number of different machines that don't finish scans. Slightly differently to the previous post, my machines don't finish whether its a full scan or a partial scan of just of one or a number of folders.

I see this on Windows 7 laptop and Server 2008 R2. The servers are terminal servers.

I have an open case with support (although i can 't find teh reference)

They said it was a known issue with 12.1.671.497 and advised upgradeing to MP1 RU1 which is 12.1.1101.401

This didn't actually make any difference. I also experienced the same behaviour with 11.x.x

There is no error. It just stops. I can click on pause or cancel which both work as expected. It doesn't stop at the same spot.

Usually it stops sooner rather than later, ie if I ask it to scan 10,000 - 100,00 files it will stop after 1000 - 3000 files.

Its  both irritating and wierd.

Comments 8 CommentsJump to latest comment

Brɨan's picture

Is there a message given or does it just stop?

Are there exclusions in place that you dont know about?

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

jeffp50's picture


Thanks for replying.

There is no message and nothing in the event logs. It doesn't freeze in any sense at all.

There are a few exclusions, although none that apply to the scans that I'm particularly trying to run at the moment, ie the c:\users folder

The issue also occurs when manually starting a scan.

My Win7 laptop and the 2 servers are all 64bit although I have a W2003x64 bit server that seems to be okay.

I can see the CPU go from 25% to 0% for the process when it stops running.


greg12's picture

Would be interesting to see your scan logs.

On Client: View Logs > Virus and Spyware Protection/View Logs > Scan Log

On SEPM: Monitors > Logs > [Log type] Scan > specify Time range

Can you post a screen shot of the Client scan log?

Mithun Sanghavi's picture


Could you please enable Automatic Symantec Endpoint Protection (SEP) 12.1 Client Debugging, including WPP logs and then start the scan and wait till it gets stuck.

Collect the Logs and Upload these Logs to us.


Create a Case with Symantec Technical Support and upload the Logs to the Case.

How to create a new case in MySymantec (formerly MySupport)

How to update a support case and upload diagnostic files with MySupport

To call Symantec Technical Support - 

Regional Support Telephone Numbers:

United States: 800-342-0652 (407-357-7600 from outside the United States)

Australia: 1300 365510 (+61 2 8220 7111 from outside Australia)

United Kingdom: +44 (0) 870 606 6000

Additional contact numbers:

Hope that helps!!

Mithun Sanghavi
Associate Security Architect


Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.

jeffp50's picture

Hi greg12 and riya31

attached are a screen shot of the client scan log and an xls of the scan log from the SEPM.

(interestingly this forum mechanism doesn't allow uploading of CSV files which are what the export funtion produces in the SEPM so i had to convert it before uploading)

Mithun, I have a case logged already; I' mjust looking for a bit extra support.


Symantec screen shot scan log.PNG
scan_log_SEPM.xls 17.5 KB
jeffp50's picture

hi   the 15 or so scans on the 3rd were me manually starting a scan of c:\users.  you can see that they all stopped after random amounts of time.

it usually used 25% cp, ie one core on a 4 core server for 10, 20, 30 or whatever seconds and then CPU went back to 0 and it stopped.

One time yesterday the same scan actually completed on the other Citrix server, 650,000 files. As far as i know i didn't do anything differently. Since then 2 scheduled scans stopped and have been aborted.

The scan status screen (this could be another thread but hey) seems to appear on a randomly selected users screen. Why is that? When a scheduled scan starts, does it just attach itself to a random user who happens to be logged an at that time and run as them giving them the status screen and the authority to pause or cancel the scan?