Endpoint Protection

Hello all,

We have an unmanaged SEP 11.0.7 client (Win XP Pro 32-bit) that has been in use for some time.    The number of files reported by manual scan keeps growing - doesn't seem reasonable given the usage of the workstation.     

My gut instinct is that the defs are accumulating.   (Nothing is in quarantine).  The defs are being automatically downloaded directly from Symantec, SEPM is not pushing the defs out to the client.

Can someone give me the path to the defs files (anti-virus and IPS, PTP is not installed on this machine)?  Or, share with me any similar experiences. 

Any other thoughts?   We don't think it's Windows maintenance, the files continue to grow between Windows update cycles.

Thanks.

Check C:\Program Files\Common Files\Symantec Shared\VirusDefs\

and C:\Documents and Settings\All Users\Application Data\Symantec\Liveupdate\downloads

It may be corrupt definitions so check this KB article:

How to clear out corrupted definitions for a Symantec Endpoint Protection client manually

http://www.symantec.com/business/support/index?page=content&id=TECH103176

For Window XP path is C:\Program Files\Common Files\Symantec Shared\VirusDefs

Download the defintion manually and try

http://www.symantec.com/security_response/definitions/download/detail.jsp?gid=savce

Have you checked the %temp% folder on the machine? - maybe there is some accumulation of the files there?

Hi,

How to determine if virus definitions of Symantec Endpoint Protection client (SEP) 11 or 12 Small Business Edition, are corrupted

http://www.symantec.com/docs/TECH97677

If you think definitions are corrupted follow this article

How to clear out corrupted definitions for a Symantec Endpoint Protection client manually

http://www.symantec.com/docs/TECH103176

Thanks for the information.  We'll take a look and see if any of the symptoms match.

Good idea.    We'll also run disk cleanup...