Endpoint Protection

Environment -

Windows 7 Professional 64-bit, SEP 12.1.2 MP1 unmanaged client.

Intel i5 3570K 3.4 GHz processor, 16 gigs memory, 256 gig SSD hard drive less that 50% full.

Problem

Occasionally, a manual full scan will complete immediately and reports 0 files scanned.  The AV system log reports "Symantec Endpoint Protection has failed to load the latest virus definitions".

The scan can be retried and eventually it will report more or less a "normal" number of files scanned.   We've run the support tool and it reports that everthing is OK.

This appears only to occur on Win 7 64-bit clients.   We've been wrestling with this problem since May.   We've had it happen on more than one Win 7 64-bit client.

It's not feasible or reasonable to have to reinstall the SEP client every few weeks to correct the issue.    We have an incident open with support but no answers so far.

Anyone else seeing this?   Our gut feeling is that there is something in Win 7 that is conflicting with the SEP client, either random restore points being created when the manual scan tries to run or something like the "Computer Maintenance" task.  Or, it could simply be a code defect in the SEP client.

Comments welcome, except uninstall/reinstall suggestions.   Been there, done that.

Regards,

Wally

How is the manual scan being started. By right clicking and "scanning for viruses.."

Or do you have a custom scan setup to scan a certain directory?

The manual scan is being invoked from the client UI - double click the gold shield in the system tray, select scan, select full scan.

This is not a custom scan.

Hi, 

Have you checked on the event viewer of the same machine what it is showing?

is there any SIC on your environment?

Regards

Ajin

We've checked logs and all of that stuff.   Nothing.

It is possible that the OS is damaged or something relatedt.   We tried a clean install of the SEP 12.1.3 unmanaged client after running the latest cleanwipe.

The first time the install appeared to be successful, but the SEP firewall was broken- SEP couldn't load the firewall driver.    So, we cleanwiped again and ran the reinstall.    This time everything appeared to work, but we couldn't import our custom firewall rules into the SEP 12.1.3 client.   No error messages or anything, it just wouldn't read in the .sar file.

Rather than chase phantoms, we're going to reimage the machine and start out fresh.  It only takes a few minutes to load the OS and SEP, so we'll take that route and see what happens.