Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

SEP 12.1 RU1 MP1 - Scan Logs indicate scan never completes

Created: 24 Jan 2013 | 6 comments
JRS17's picture

Hi - 

I am looking for a solution for the following problem:

When new definitions arrive, per our policy, a virus scan kicks off as expected (DefWatch Scan).  For ~20 out of 60 servers, the scans take over 8 hours to complete, despite being tuned for best scan performance.  Also, the Scan log (console) and local scan log (host) indicate that the scan is still taking place.  It seems as if the agent never registers the scan completed and doesnt log it, or the scan never completes.  Not sure.

Does anyone have any ideas?  Thanks. 

Comments 6 CommentsJump to latest comment

.Brian's picture

Was the box rebooted during a scan or the scan cancelled? I've seen this happen when either of these are done.

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

JRS17's picture

No, these are production servers, so they are not rebooted until maintenance windows.  

.Brian's picture

And the scan is not cancelled prematurely by an admin?

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

SebastianZ's picture

We have seen already several cases of scan in fact never completing due to problems while scanning certain archives or .pdf files.

Does the normal scheduled full scan produces the same problem? - if not you can disable the option for scan to be started after new defintions are received and relay only on the scheduled scans - if this is an option for you.

rocksuitcase's picture

I had this issue on one client's PC (Win XP, SEP client 12.1). the user was complaining about slowness to open and close programs, especially OUTLOOK 2007. MOving between Office files and pdf's and iTuunes was also very slow. After doing several Microsoft Office repair steps I opened the SEP client "view logs, scan log" and found a defwatch scan dated two weeks earlier saying "scanning". There was no way to delete it so I did the old : Start|run-> "smc -stop", then "smc -start". opened the client back up and that scan was gone, but another, one week later was saying "scanning". I did the same thing and there were no more "phantom scans" showing up in the scan logs.

I then followed Sebastian's advice ( I am the SEP Admin); I opened the SEPM console->Policies| Virus and Spyware Protection Policies| Virus and Spyware Protection Policy-Balanced (may be different for your system)| Advanced Tab| and unchecked the box "Run an Active Scan when new definitions arrive".

The client appears to be running "faster" now, and is not having issues moving between multiple programs or opening and closing OUTLOOK.