Endpoint Protection

I'm using SEP 12.1 unmanaged on a Mac running Mac OS X 10.7.4, and it keeps adding a scheduled virus scan that I cannot delete.  It isn't listed in Symantec Scheduler, but it does appear in when listing the scheduled tasks with symsched.  This is what it looks like:

VirusScan      55f9a9ed-0a01-1613-0170- 1   0   Weekly   1     20:00  -niceness 20 '///##SYMDISK##' '3'

 

That looks like the default scan for all users that is set upon installation. Are you viewing and deleting said scan with sudo?

See: Symantec Endpoint Protection for Macintosh Frequently Asked Questions (SEP for Mac FAQ)
http://www.symantec.com/docs/TECH134203

(This machine is definitely unmanaged?)

Out of curiosity, why do you not want these machines to do a weekly scheduled virus scan?

sandra

Yes, I have been modifying the scheduled tasks with sudo.  I've even attempted to manage them while logged into the root user, which has the same net result.  I can also confirm that this is an unmanaged client.  It's not that I don't want the weekly virus scan to run, but I don't want it to run when it's scheduling itself.  I want to set up a scan that will run during times that the labs are closed instead, but all I can seem to do is add another scan on top of this one.

Fair point--it may be that it will not allow no 'all-user' scans (I'm not sure to be honest--I haven't directly supported SEP for Mac since March of this year). What happens if you try to overwrite the "VirusScan" scan with another that isn't Monday at 8pm? Using sudo, of course.

See: Guide to symsched Command-line Switches
http://www.symantec.com/business/support/index?page=content&id=TECH105502

Good luck...

sandra

If I add a new all users scan, at first it will appear as if that is the only scan present.  However, as soon as I restart, the other scan will come back.

Well, there's adding a new scan, and there's force-overwriting the existing scan with new information (the -f switch). I take it the latter did not work?

This is really very strange -- is this the most recent version (12.1.2015.2015)? I can't find anything in our Knowledge Base describing an issue like this at all. I'd strongly recommend calling in to Support, or opening a case via MySymantec.

sandra

Hi, Check if there is a process called smcdaemon running. If so, since you want to run this as unmanaged, you can do the following. 1. Stop the process: sudo /Library/StartupItems/SMC/smclient -s 2. Rename the process file: sudo mv /Library/StartupItems/SMC/smcdaemon /Library/StartupItems/SMC/smcdaemon.old 3. Delete the existing schedules as you did earlier 4. Restart system. Check if the schedules have been indeed deleted Do the above ONLY if you want to run it as unmanaged. To make it managed, restore the backed up smcdaemon file and restart system -Anand