Endpoint Protection

Refering to the screenshot above. The scheduled scan dated 2/12/2012 is still in the status of 'Scanning...'. And there are completed scans afterwards. This is an SEP 11.0.6100.645 running on a Windows 2003 server with AV/AS component only installed. It encountered other problems the day in question and froze, forcing them to reboot the machine.

This scan could no longer be in effect since it is still reporting and stated that the last scan was for the latest date. Any explanation could help. And also how to set those status to read correctly. Many thanks.

yes, it is becuase the system was rebooted while scan was in progress. It looks cosmetic thing. You can confirm by knowing that next schedule scan is triggered and is running. Since no two scans at the same time, we can confirm it is becuase looks like other custom scan has been run and aborted.

Hi Mon

Can you re scheduled ant one of the scan and try.

Common cause is:

Event ID 6008 is unexpectedly logged to the System event log after you shut down and restart your computer

And here's some MS KBs:

http://support.microsoft.com/kb/326564

http://support.microsoft.com/kb/950323

During the last scan, I pulled the plug on the PC.

Shown is the contents of the Scan Log after startup. SEP 12.1

ok, are you talking about the power plug?

I pulled the plug to see how an interrupted scan would show up on  the screen. Also, I was checking on another Windows event log somewhat related to this and was searching for probable causes.

I believe on SEP 11, you can reproduce the issue i.e. while scan in progress, shut down, the scan log from client GUI will show scanning.

Hi Pete, are there cases where a system hangs or reboots when a scan is initiated?

i have not come across where the system reboots. When we talk about hang (freeze) there are instances when the scan makes system slow. However these were related to policy, system configuration ( not enough RAM, other process consuming application running at same time etc)

Idea:

https://www-secure.symantec.com/connect/ideas/fix-scan-logs-scanning

Some admins may panic when they see that "Scanning..." and could escalate this to the higherups claiming that Symantec is causing a slowdown or is the cause of the system hanging.

The root cause of this message is when the entire system comes to a halt while SEP is conducting a scan. Or if the scan is stopped by other means other than clicking on the cancel or pause option when a scan window is present.

SEP will not continue on this scan on the next service startup but instead apply the rules from the applied policy.

To verify, check with the Windows Task Manager if there are no rtvscan.exe, DoScan.exe or SavUI.exe listed in the Processes tab.

The next scan - scheduled or manual - will create a new entry.