Endpoint Protection

 View Only
Expand all | Collapse all

Unable To Delete Scheduled Scan

  • 1.  Unable To Delete Scheduled Scan

    Posted Jan 28, 2008 01:37 PM
    Hello:
     
    I am having a very frustrating problem.  When I originally installed SAV 10.x on a few machines, I scheduled a full system scan.  Over a period of time, I decided to remove these scheduled scans and run scans manually, instead.  However, I noticed that my CPU pinged at the scheduled scan times, as if the scans were still taking place.  When I look in the Task Manager, I notice that SAV is still running these scans at the scheduled times, although, the scheduled scans are not being displayed in the SAV 10.x GUI. 
     
    In my attempt to remedy this issue, I have uninstalled and reinstalled the SAV 10.x client on these machines and the scheduled scans still run at the previously-scheduled time.  Since uninstalling and reinstalling didn't work, I manually uninstalled the SAV 10.x client, following the detailed and laborious instructions given by the Symantec KB.  And, while I was manually removing registry entries, I was looking for the scheduled scan values to be in the registry where Symantec indicated they would be; unfortunately, they were not being listed or displayed in the registry, either.  :(
     
    So, after uninstalling and reinstalling, via the Add/Remove applet and after manually uninstalling the SAV 10.x client via Symantec's KB instructions, I have reinstalled the SAV 10.x client onto these machines and while I never rescheduled a full system scan after these reinstallations, the client still will run these scans at the originally-scheduled times.  Also, note that while the GUI has been set up to allow the user to see scans taking place and to pause and/or to stop them, when these scheduled scans do run, they are usually never displayed via the GUI; they run silently.  I say usually because one time when I did log on as the Administrator, when the previously-scheduled scan started up, the task "fired up" the GUI and I was able, that time, to stop the scan, via the GUI.  However, that has only happened once or twice.  All other times, the only reason I know the previously-scheduled scans are running is by looking in the Task Manager and seeing the CPU ping to nearly 100% by RTVScan.exe. 
     
    These few machines are all running Windows XP Professional (SP2, along with all up-to-date patches) and none have any scheduled scans showing in the GUI, including the default Quick Scan, as I removed that, too.  I would sincerely appreciate anyone's help, as this issue is really frustrating me.  Thank you.


  • 2.  RE: Unable To Delete Scheduled Scan

    Posted Feb 16, 2008 06:38 PM
    Hello:
     
    Finally, I believe I can report a resolution to this issue.  While I was unable to see the scheduled scan in the GUI, once I logged into the computer as the actual "Administrator" and not as a user under the "Administrators" group, I looked within the "scheduled scans," within Symantec, and there was the scheduled scan.  It remained even after using the Add/Remove applet to uninstall the SAV 10.x application and after using Symantec's manual removal instructions.  Finally, I was able to remove the scheduled scan.  :)
     
    I hope this information may help others who may be experiencing "phantom scans."  Pay attention to log into the machine under all accounts and look under the scheduled scans, within these accounts, as the scheduled scans only show up under the accounts that originally created them.  My apologies to the board if this behavior is by Symantec's design and I misunderstood that.
     
    Thank you.
     
    --Voltron


  • 3.  RE: Unable To Delete Scheduled Scan

    Posted May 13, 2008 07:16 AM
    I have the same problem, but unfortunatelly I cannot use this "solution"! I did logon as actual administrator and the scan is not visible in the scheduled scans so I cannot delete it! I found out, that it can be done only if the user who set it logs on. We have several tens of computers with this silly problem, because some users have scheduled full scan "through lunch" and now it bothers all others using that computers for several hours! Some of these people who set it are gone unfortunatelly so I cannot get them to logon and change the settings. Anyway, the computers are used almost all the time and messing around with logon/logoff to domain would be quite time consuming. Don't tell me that there is no other solution! Where the hell can this settings be stored? I will try to delete user profile caches, but I am not sure if this will help...


    Message Edited by Vitezslav Zurek on 05-13-2008 04:24 AM


  • 4.  RE: Unable To Delete Scheduled Scan

    Posted May 13, 2008 09:13 AM
    it seems that deleting of a testing user profile helped. I will see on monday if it helps on the other machines also...


  • 5.  RE: Unable To Delete Scheduled Scan

    Posted May 13, 2008 04:16 PM
    Dear Vitezslav:
     
    I know how frustrating this can be.  Are you using a client/server configuration or simply client-only installations?  I was dealing with client-only installations, in this situation; but, I would hope that there would be a place on the Symantec Server, to view all scheduled scans for a particular client.  If one could see such information, I would hope that one could also delete any scheduled scan from such a window/dialog box, via the Symantec Server.  You may have already checked this; if so, I apologize for repeating the "obvious."  But, in such frustrating situations, sometimes, restating such events can be helpful.
     
    I am glad to hear that your testing user profile is showing promise for you; I certainly do wish you all the best in fixing this frustrating issue.
     
    Sincerely,


    Message Edited by Voltron on 05-13-2008 04:16 PM


  • 6.  RE: Unable To Delete Scheduled Scan

    Posted Jun 30, 2009 09:35 AM
    Hello
    I have precisely the same situation here, but on about 200 clients, whitch all have a "phantom schedule" that runs every thursday at 9:00.
    It looks like its an old policy from an old server that the clients have gotten the schedule from, but even when I now have cleaned every scheduled scans on both old and new server, the scan is still active on the clients.

    Under scheduled scans on the clients there is nothing to see, exept in the log files, where I can see the scheduled scan have runned.

    Its impossebly to manually go to every client and try to logged in as an user which maybe have a scheduled job listed, so does anyone know a more "central" sollution to this problem?

    The clients all run the newest Endpoint. Same as the server. (11,x).

    TIA


  • 7.  RE: Unable To Delete Scheduled Scan

    Posted Jun 30, 2009 10:52 AM
    Except it is with just one pc. Every couple of hours it runs a scheduled scan which doesn't exist. I am running SEP 11. I have removed, uninstalled, reinstalled, manually uninstalled, even used Cillit Bang but I can not get rid of this scheduled scan.

    SYMANTEC THIS IS RUBBISH, SEP IS ONE OF THE WORST AV PRODUCTS I HAVE SEEN. NOT BECAUSE IT DOESN'T PICK UP VIRUSES BUT BECAUSE WITH EVERY INSTALL I HAVE ONE PROBLEM AFTER ANOTHER. HOW MANY MORE MAINTENAINCE PACKS ARE YOU GOING TO RELEASE!!!

    POOR POOR POOR WORKMANSHIP.

    YOU ARE A LET DOWN.


  • 8.  RE: Unable To Delete Scheduled Scan

    Posted Jun 30, 2009 10:52 AM
    Except it is with just one pc. Every couple of hours it runs a scheduled scan which doesn't exist. I am running SEP 11. I have removed, uninstalled, reinstalled, manually uninstalled, even used Cillit Bang but I can not get rid of this scheduled scan.

    SYMANTEC THIS IS RUBBISH, SEP IS ONE OF THE WORST AV PRODUCTS I HAVE SEEN. NOT BECAUSE IT DOESN'T PICK UP VIRUSES BUT BECAUSE WITH EVERY INSTALL I HAVE ONE PROBLEM AFTER ANOTHER. HOW MANY MORE MAINTENAINCE PACKS ARE YOU GOING TO RELEASE!!!

    POOR POOR POOR WORKMANSHIP.

    YOU ARE A LET DOWN.


  • 9.  RE: Unable To Delete Scheduled Scan

    Posted Jan 15, 2010 02:57 PM
    I too have this kind of issue on SAV console. Though I have adminstrator rights on the SAV console, and I disable or or even delete the scheduled scan, this show still enabled on the target machine. Most other settings on the groups, such as exceptions, for instance, apply!

    Could this be due to privileges on the machine? Cause I don't have any privileges over the machine I'm sending changes to.

    Thanks

    M


  • 10.  RE: Unable To Delete Scheduled Scan

    Posted Jan 15, 2010 03:08 PM
    Russtym, those scans could be startup scans and quick scans; the first is clear what it does, while the latter is triggered by arrival of new definitions - about 3 new updates a day- and they do not take more than a few mins and very slightly affecting the sys performance or not at all


  • 11.  RE: Unable To Delete Scheduled Scan

    Posted Jan 15, 2010 03:08 PM
     You can either manually delete the scan from the registry of the clients or you can call or open a webcase with support and ask for SymRmvScan_1.2.exe utility.
    http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2008070711521548