We're testing SEP 12.1.2 on a 64-bit Windows 7 Pro client. When we run a full scan, sometimes we get a large difference in the number of files scanned. For example, sometimes SEP will report 170,000 files scanned, then if we immediately run another full scan, SEP will report 80,000 files scanned.
The answer from Symatec Support is that this is normal behaviour for the SEP 12.1 client.
Support says that the first full scan after an AV defs update rescans everything, including the file cache. Subsequent full scans performed before the next AV defs update does not rescan everything as some files are marked as already having been scanned. Support says the product was designed this way for performance.
In our scans, we're seeing between 1,500 and 3,000 files trusted, but the apparently the number of trusted files are not the reason for the difference in the full...