Endpoint Protection

Hi

as per the link in the title, I have a number of different machines that don't finish scans. Slightly differently to the previous post, my machines don't finish whether its a full scan or a partial scan of just of one or a number of folders.

I see this on Windows 7 laptop and Server 2008 R2. The servers are terminal servers.

I have an open case with support (although i can 't find teh reference)

They said it was a known issue with 12.1.671.497 and advised upgradeing to MP1 RU1 which is 12.1.1101.401

This didn't actually make any difference. I also experienced the same behaviour with 11.x.x

There is no error. It just stops. I can click on pause or cancel which both work as expected. It doesn't stop at the same spot.

Usually it stops sooner rather than later, ie if I ask it to scan 10,000 - 100,00 files it will stop after 1000 - 3000 files.

Its  both irritating and wierd.

Is there a message given or does it just stop?

Are there exclusions in place that you dont know about?

Just to rule this out, did you enable scan duration and/or scan randomization?

Hi

Thanks for replying.

There is no message and nothing in the event logs. It doesn't freeze in any sense at all.

There are a few exclusions, although none that apply to the scans that I'm particularly trying to run at the moment, ie the c:\users folder

The issue also occurs when manually starting a scan.

My Win7 laptop and the 2 servers are all 64bit although I have a W2003x64 bit server that seems to be okay.

I can see the CPU go from 25% to 0% for the process when it stops running.

Jeff

Would be interesting to see your scan logs.

On Client: View Logs > Virus and Spyware Protection/View Logs > Scan Log

On SEPM: Monitors > Logs > [Log type] Scan > specify Time range

Can you post a screen shot of the Client scan log?

Hello,

Could you please enable Automatic Symantec Endpoint Protection (SEP) 12.1 Client Debugging, including WPP logs and then start the scan and wait till it gets stuck.

http://www.symantec.com/docs/TECH171176

Collect the Logs and Upload these Logs to us.

OR

Create a Case with Symantec Technical Support and upload the Logs to the Case.

How to create a new case in MySymantec (formerly MySupport)

http://www.symantec.com/docs/TECH58873

How to update a support case and upload diagnostic files with MySupport

http://www.symantec.com/docs/TECH71023

To call Symantec Technical Support - 

Regional Support Telephone Numbers:

United States: https://support.broadcom.com (407-357-7600 from outside the United States)

Australia: 1300 365510 (+61 2 8220 7111 from outside Australia)

United Kingdom: +44 (0) 870 606 6000

Additional contact numbers: http://www.symantec.com/business/support/contact_techsupp_static.jsp

Hope that helps!!

Can you please upload Scan logs from SEPM and from SEP client.

Hi greg12 and riya31

attached are a screen shot of the client scan log and an xls of the scan log from the SEPM.

(interestingly this forum mechanism doesn't allow uploading of CSV files which are what the export funtion produces in the SEPM so i had to convert it before uploading)

Mithun, I have a case logged already; I' mjust looking for a bit extra support.

thanks

Attachment(s)

scan_log_SEPM.xls   17 KB 1 version

hi   the 15 or so scans on the 3rd were me manually starting a scan of c:\users.  you can see that they all stopped after random amounts of time.

it usually used 25% cp, ie one core on a 4 core server for 10, 20, 30 or whatever seconds and then CPU went back to 0 and it stopped.

One time yesterday the same scan actually completed on the other Citrix server, 650,000 files. As far as i know i didn't do anything differently. Since then 2 scheduled scans stopped and have been aborted.

The scan status screen (this could be another thread but hey) seems to appear on a randomly selected users screen. Why is that? When a scheduled scan starts, does it just attach itself to a random user who happens to be logged an at that time and run as them giving them the status screen and the authority to pause or cancel the scan?

Thanks