Endpoint Protection

I administer a Symantec Antivirus server for our organization.  The server is running Symantec System Center and all of the clients are running Symantec Antivirus version 10.1.6.6000.  I review the SSC listing everyday and every now and then one or more of the client machines being monitored will show the Scan Engine version number missing.  When I remotely log onto the client to check the system and open Symantec Antivirus, the screen does now show a Scan Engine version number in the Program Versions section of the screen.  The only way that I have been able to figure out how to get the scan engine back is to remotely log on to my client machine, uninstall Symantec Antivirus, then reinstall it from the server install point \\servername\vphome\clt-inst\win32.

 

Can anyone give me some idea how this happens and if there is an easier way to get the scan engine restored without having to completely remove and reinstall the antivirus software on the client machine?  Because sometimes the client does not always uninstall correctly and I have to remove Symantec Antivirus manually which is a real pain!!!

 

Thanks

lwalker1958

While I'm unable to comment on why this is happening, another option instead of uninstalling and reinstalling the client is to run the intelligent updater. This file cleans up the virus definitions structure while updating the definitions. It's sort of an "uninstall/reinstall" of the definitions that doesn't require removing the client and reinstalling it. It's been experienced that a reboot may be required after running the utility to resolve this issue. You'll have to give it a try and see what happens. It can be downloaded from the following link. Please be sure to download the correct file, as there are several choices.

 

http://www.symantec.com/avcenter/download/pages/US-SAVCE.html

 

 

Thanks for your response.  I am guessing that the reason you can't comment on why this is happening is NOT because you don't know but because you are a Symantec Employee and this is a no-charge forum.  I work for the federal government, who I believe has a contract with Symantec to provide antivirus software for it's computer systems.  How would I go about contacting someone who COULD tell me why it happens.

 

I believe I have tried what you suggest and if I recall it did not work.  But I will try it again the next time a client shows up missing the Scan Engine version and see what happens.

 

Thanks

 

Just checked the logs in my SSC and found a client missing the Scan Engine, version 81.1.0.13.  I tried going out to the link you sent and downloading the current definition files for my version of Symantec Antivirus.  I downloaded them, loaded them and rebooted the system.  Then I refreshed my SSC view and the client was still missing the Scan Engine.  I ended up having to remove SAV 10.1.6.6000 and reinstall it from the \server\vphome directory to make it report back correctly to the SSC.

 

Someone has got to be able to tell me why this happens and a better way to resolve the problem.

 

Thanks

I am also running SSC 10.1.4.4000 and have missing scan engines for several computers. The scan engines are 81.1.0.13 and 81.2.0.25. Can you share with us if symantec is working on a solution for this problem? This if very time consuming and frustrating to your customers as well as our end users. Please help us find a solution to this problem!

 

 

I got a hit on my initial message back in Apr 08 from a user named don_ite.  As you can see from the thread, he said that "while he can't comment on why it happens...", he did suggest running the Intelligent Updater to see  if it resolves the problem.  Well, this did not work.  I downloaded the most recent definition files on the client that was missing the scan engine and installed them, which should have also updated the scan engine, but that did not work.

 

I replied back to him that his suggestion did not work and asked him if the reason why he can't comment on why it is happening is because he is a Symantec Employee and to get support for this issue would require me to pay for a tech support phone call.  He never replied.

 

So to answer your question, I would love to share a solution with you, but to date I don't have one.  I guess I am going to have to break down and see if my company will pay the charge to make a call to Symantec to get the solution.  If that happens and the solution resolves the problem, then I will be happy to share it with this fourm.

I have had this problem for some time now on random Clients and I have been able to get around it using the following solution until recently which now it does not work:-

 

the solution can be done from your own desktop as long as you are logged in with domain admin rights.

remotely stop the symantec services using computer managemant connecting to the client PC.

then go to the the :-"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition " directory on the client (use the UNC path to it from your PC) and copy the 7.5 folder from a working client who has a clean quarantine.

(you will notice that the orginal 7.5 folder is full of old virus defs whihc have not worked).

Then copy the most recent XDB and VDB files from the management server (they will be in the c:\Program Files\SAV directoryon the server) into the c:\program files\symantec antivirus folder on the client.

Then start all the symantec antivirus services.

 

This solution has just recently stopped working for me. and I cannot find another solution .

It would help if symantec gave some advice on this one.

 

 

Matthew.

Matthew,

 

Thank you SO VERY MUCH.  I tried your procedure on two clients that I just found this morning with missing Scan Engines and it worked like a charm.  They are both now reporting with up-to-date Scan Engines and Def files.  I hope you get an answer as to why the procedure no longer works for you.  How did you happen upon the solution, if you don't mind me asking?  I plan to use this work around in the future and as long as it continues to work for me it will certainly save me a lot of time not having to uninstall/reinstall the client software, which sometimes does not work and I have to remove SAV manually (which is NO FUN!!!)

 

Lawrin

 

 

I came across it by lots of fiddling about. Plus I have had to upgrade a lot of older stuborn versions (7.5, 8.1 and 10 s). Keep an eye on it as I suspect its got something to do with the current scan engine version which is causing it not to work any more.

 

If only symantec would give some idea to which files are associated to the scan engine.

 

 

Hi

 

I have had this problem for over a year and have been using the following soloution that works for me.

 

Login as Administrator

Go to Administrative Tools

Services

Stop Symantec Antivirus (Real time scanning)

 

Locate Symantec Antivirus Corporate Edition\7.5 this is usually in the path below

 

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Antivirus Corporate Edition\7.5

 

Locate two folders I2_LDVP.VDB and I2_LDVP.TMP delete these.

 

Restart Symantec Antivirus (Real time scanning)

 

Give it a min or two the two folders should re-appear

 

At which point Symantec should install defs and enable scanning engine.

 

This usually works 99% of the time

 

If this fails Symantec AV will need to be removed and re-installed.

 

Note this will NOT work for Symantec 9***

 

Hope this helps.

 

Dave.

 

Techno1

 

Thanks for the response.  The next time I have a client missing the scan engine, I will try your procedure and update the site if it works for me.

 

 

Dave,

 

Just wanted to let you know that I tried your procedure and it worked great for me.  Thanks for the info.  Now I have two solutions that will work for me when the problem arrises.

 

Lawrin

Lawrin

 

I am pleased it worked even though it is a pain to do I wish the problem was sorted out so we do not have to take these steps. The problem appears to happen when the client computer runs low on resources then tries to update defs either by VTDM or live update Symantec apears to give up leaving the client without a scan engine. As I said we have been carring the proceedure out for nearly 2 years, within the next two months we are going over to endpoint hopefully this will be the end of this problem BUT!!! who knows what features luke out there in endpoint.

 

Dave

I'm glad to see I am not the only one that has this annoying problem!

Dave, your solution worked for me, too! You da man!

I noticed that Dave's solution didn't work every time, so I modified the solution littlebit.

1. net stop "symantec antivirus"
2. del "C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.TMP"
3. del "C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB"
4. del "C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\*.vdb
5. del "C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\*.wdb
6. del "C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\*.iad
7. del "C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\*.iex
8. del "C:\Program Files\Common Files\Symantec Shared\VirusDefs\200*.*"
9. del "C:\Program Files\Common Files\Symantec Shared\VirusDefs\*.dat"
10. net start "symantec antivirus"

Reboot might be required.