Endpoint Protection

Hi All,

I have received below  warning message in my SEP client.

 

"Your virus and spyware definition are missing or corrupted"

 

SEP Client version is : SEP14 MP2

Operating system: Windows  server 2008 enterprise edition.

 

Virtualization platform: VMware.

 

I have tried to run intelligent updater too. But no luck.

 

Kindly help me to sort this issue.

 

 

 

 

 

 

Download and run the SymDiag tool for error checking. Post results here.

Thanks for the reply.

 

On initial trouble troubleshooting what I have found is like.

 

1) Definition are loaded in the system logs but not refleting in the client console.

2) Disabled the Tamper protection and kill the ccSVChst.exe 

3) Restarted the client services

after performing the above troubleshooting steps the client console show the status as " your computer is protected".

 

 After sometime again the same issue is persist.

 

Logged the case with Symantec and they have suggested to fine tune the scan settings as it was a known issue. and they have shared the below link to follow.

 

https://support.symantec.com/en_US/article.TECH236947.html

 

My concern is that 

1) I have faced this issue with only one server. All the other servers present in that group were functioning normally.

2) If I make a changes  in the  scan settings as suggested  ,wheather it would reflect in the entire servers present in that group ?

3) why should I need to change the scan settings since all the servers are reporting without any issue. I am having the issue with only one server.

 

Please help me out to sort the issue.

Thanks     

 

 

 

 

 

If they're all in the same group and you make a change it affects all.

I suggest you continue working with support and bring this up to them.

Hello Brain, 

 

Thank you for the reply.

 

yes, support team have clarified me that

If we have selected best performance for application 
symantec administrator and defwatch scan might conflict 
Because of which we might face this issue.

 

Since I am new to this product. could you please let me know what does defwatch scan will do ?

 

 

 

When new content is loaded, defwatch will run an active scan against the local quarantine if the option is enabled.

Hello Brian,

is this really fixed in SEP14 MR2 as described in https://support.symantec.com/en_US/article.TECH236947.html? 

Because I updated SEP from 12.1. RU6 MP5 to 14.0 MR2 and I'm facing the same issue.

Regards,

Sylvia

 

I would advise you to read the fix list for 14RU1. The RU1 release is newer than 14MP2. There are a few fixes for outdated definitions in the RU1 release as well. https://support.symantec.com/en_US/article.INFO4623.html