Endpoint Protection

Someone else posted this question, and unfortunately it was not answered to the point where I can fix the same problem on my own system.  I cannot find the Policies tab, probably because I cannot access the edit dialog box for the default scan.

Greetings -

Recently installed EndPoint  11.0.3 standalone on machine running XP SP3. After the install, EndPoint immediately starts a full scan. WHen I click 'Scan for Threats', I see that there is a default Weekly Scheduled Scan which is apparently whats running. I tried to delete it, but that option is greyed out. If I go into task manager, and kill rtvscan.exe, the scan is stopped (naturally), but I still can't delete, or edit, the default Weekly Scheduled Scan.

I can successfully create new scans - which I can subsequently edit, or delete, but for some reason, the 'Weekly Scheduled Scan' that was there 'by default' when I installed EndPoint is 'read-only', can doesn't seem to be something I can delete/edit. 

Suggestions? Surely there must be a way to get rid of it - I set my own scedhuled scans, and would rather not have a scheduled scan that I can't modify. 

Thanks in advance...

This scan will be created from SEPM,that is why you are not able to delete it.is it a managed client ?or unmanaged client?

The best way is change the policy in SEPM and at restart the smc service in the client so that it can communicate with SEPM and get the new policy..After getting new policy the scan will disappear from the client....

If the client is not able to communicate the SEPM which the installation package is created,do as follows

Here is the default Admin Defined Scanand if you have created few more scans for this users it will also be listed in the same location but with a different name.

HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\AV\LocalScans\5df13630-79f7-4c70-002b-16b8952f5533 ( name can be any hexadecimal name )

So you can delete this and then you can create your own scan.

first your SEP version is very old..Install SEP 11.0.6200.xx

Delete the registry entry for the scan as pointed out by Aravind above if it is unmanaged it will not come back..however if its managed the scan will again show up.

If it is managed client then you will have to remove it from SEPM.

I have had the forced weekly scan for a while now and for me it was extreamly annoying. The reason is I am a programmer and on my hard drive I have a few million files. The weekly scan starts on Sunday and does not complete by the time I get to work on Monday. So for about 30 minutes to 1 hour each Moday morning my i7 870 machine with 8GB of RAM is totally useless and I am forced to basically wait till the process ends. My version is 11.0.6200.xx unmanaged client but it was customized by the university. I am writing because I could not find the registry key the last time I tried this solution however I forgot on a x64 machine I should look at the HKLM/SOFTWARE/Wow6432Node/Symantec/ instead of HKLM/SOFTWARE/Symantec. I just deleted the Scheduled scan with the hexadecimal name so hopefully I do not have this problem next week.

Thats a very old version of SEP you are using. Please upgrade it. The latest one is 11.0.6MP3. If you are gonna do a upgrade you have to do it through 11.0.6a version of SEPM which is also available for download at http://fileconnect.symantec.com/. That will resolve your issue.

I am not sure I can do that. I have no serial number which the first page is asking. This is enterprize wide licence that allows every person in the University to download an use a copy. I will check the university software distribution system has an updated version. Although I did get the current version that I have from there sometime this year.

Edit: Sorry. They have updated to 11.0.6 MP3 (64-bit). 157MB, I am downloading it now.

I updated SEP to 11.0.6 MP3 (64-bit) however the problem persists and is in some ways worse. Now it does not bring my high end machine to a crawl but instead of running for an hour in the morning on Mondays. It runs the entire day slowing and hindering my ability to work. I really need to either complain to the university that the default settings are unacceptable, find a way delete this scan, uninstall SEP or move my files to an encrypted drive or something so that the scan does not take days to finish.

Looks like the thrashing did not happen today. I can actually work on a monday morning. Anyways, I deleted the reg entry for the forced scan and no other changes and it did not come back. The problem I had the last time is I updated SEP after the delete. I have to remember to delete the entry each update from now on until the university turns off the forced scan or allows me to set exceptions.