I run Symantec AntiVirus Corporate edition 2002 (build version 8.00.9374) in the stand alone, unmanaged installation on my PC that runs on XP with service pack 3.  A virus system scan last ran successfully a week ago (May 6).  My PC has 2 GB of RAM, 50 GB of free space, I have a 2046 MB pagefile and I clean out my temporary internet files twice a month.

I discovered the problem yesterday morning (May 13) when my weekly virus update and system scan is scheduled.  Live Update did occur but when the system scan began and the control box opened, the scan stopped immediately (with no files scanned) and the message "scan stopped by user" followed by the date and time appeared in the title bar.  All of the control buttons (restart, pause, etc.) are GREYED out and not functional except for the "close box" button.

The only change that occurred to my PC was the download and installation of the most recent Microsoft Security update for Windows XP (KB978542) which is described as:  "Microsoft Security Bulletin MS10-030 - Critical Vulnerability in Outlook Express and Windows Mail Could Allow Remote Code Execution (978542)"  (url: http://www.microsoft.com/technet/security/bulletin/MS10-030.mspx)

I have tried uninstalling the security update; uninstalling - rebooting - reinstalling - the antivirus application; using system restore point to go back to the previous week - all to NO AVAIL.  I ran a trial version of ESET NOD32 that showed no virus infestations.

I have subsequently identified this same, exact issue on 3 other XP with sp 3 computers that run the same Symantec AntiVirus.  All had just installed the most recent Microsoft Security Update.  THe problwm is the same on each computer: upon beginning a system scan, the scan box opens and immediately stops, displays the message "scan stopped by user" followed by the date & time and all of the control buttons are greyed out except for the close button.

I would be grateful to any and all suggestions on how to rectify this situation.  As a newbie to this forum, I would appreciate if others would copy this posting to other sections of the Symantec and Microsoft sites that may give this matter prominent attention.

Thank you,

Bryan Pepper - email me at bpeppy1@gmail.com

Symantec Antivirus 8.0 reached its End of Support Life as of November 30, 2005 and Symantec Antivirus 8.1 reached its End of Support Life as of January 31, 2007, as defined in the Symantec Enterprise Technical Support Policy. Therefore virus definition updates are no longer supported for this product.

http://www.symantec.com/business/security_response/definitions/download/detail.jsp?gid=savce

You need to upgrade to a new AV product. An 8 year old AV software is no protection against todays threats.

Bryan,

What Cycletech said is true.. SAV 8.0 has reached its EOL but you can look up at this document which might be helpful for you...

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/1999121717035848

Thanks..

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/1999121717035848

this is not the issue.

i run the same version on three servers and 25 work stations.

an update from symantec on 05-13-2010 caused all users to have te same problem.

yes the support of this product has expired but the anti-virus engine is still currently suppoted by definition updates.

http://www.symantec.com/business/security_response/definitions/download/detail.jsp?gid=n95

this is a symantec issue, not a MS update issue.

Since 5/12/2010, Whenever a scan is booted, the message as above appears and the scan is stopped.
I have the 

Symantec AntiVirus Corporate Edition 2002 8.1.1.314

and it has worked beautifully until the above named date.

I believe that I may also have received an update from  Microsoft around that same time.

I hope there is a solution I can implement.

I tested that Uninstalling, then Reinstalling the Client gets the product working again.
You have to reboot in between, and right now I don't want to take down some of my older systems.
They have been running for a few years continously and I hate the idea of bringing them down.
Just Avoid any of the Virus Definitions released Since 05-12-2010.

I'm hoping that On Monday the new release of the Definitions will not break these older versions again.

it's $1,250 to upgrade to a newer version, not $40 as has been mentioed in another thread.
I'm concerned about how it will support the older 16 bit systems we have, If at all?

Same scenario as VPCNC here.
While I appreciate not needing to exhaustively search for a viral cause for every instance of SAV to simaltaniously and mysteriously fail - I would like to know if I need to scramble for a new, comparably costly solution - while reinstalling the client and shutting off the automated updates during unschedulesd outages at the same time...

I understand we are well past EOL, but I would like to know authoritatively if any further definitions will continue to break the currently running software. Some protection is better than none until we have a new AV solution to put in place.

That message has been posted since 2007.  Why on May 13th did the scanner stop working? 

"this is a symantec issue, not a MS update issue."

This product is extremely old and was never designed to work with the newest versions of XP.  That it has managed to do so thus far is lucky.  You may be able to find a work around, but bear in mind that this is not something that Symantec is going to address in a fix.

Since definitions are no longer tested against SAV 8, no one is going to be able to say authoritatively that further definitions will or will not break it.  You will probably want to test on a few machines in advance of rolling out to a production environment.

I would certainly recommend an upgrade.  SAV 8 was not conceived to handle the modern threat landscape.  Avoiding updating definitions on the old build, or avoiding upgrading your security software... either way, you are putting your systems at risk... Just a thought.

ETA: I don't mean to sound snarky up there, because that is not my intention... but I can't tell you how frequently I speak to people who are infected by a threat that (e.g.) takes advantage of a vulnerability that was patched a year and a half ago...

sandra

I liked the old SAV 8.1.  Sorry to see it go!  I dont like endpoint.

I have version 8.1.0.825.  My scans were automatically set to run at noon every day.  Sunday I come back to my desktop and it has the error message "scan stopped by user" even though I wasn't there to stop it!?!?  So Symantec sent out an update that killed it's own software?  I tried to do another scan but each time I get the same message every time.  If you know what I can do to fix this please email me at jlangfordgray@sbcglobal.net

For a short term solution, download the Norton AntiVirus 2011 Beta version for free. You will be protected and get a chance to try out the latest in AV protection technologies.

http://www.symantec.com/norton/beta/overview.jsp?pvid=nav2011beta_overview

"SYMANTEC STRONGLY ADVISES THAT YOU DO NOT INSTALL THIS BETA PRODUCT ON A PRODUCTION MACHINE OR USE ON A PRODUCTION NETWORK. THIS BETA PRODUCT IS FOR TEST USE ONLY."

I know it feels like you're getting less protection when SAV 8 breaks... but the reality is: Over the last 2-3 years, you have had no reasonable expectation of protection. SAV 8 is ancient technology in a threat landscape that changes monthly.

It's like taking a knife to a gun fight.

To help put things in perspective:

When Sav 8 was still the cutting edge anti-virus programs:

1. Bill Clinton was President
2. Youtube will not be released for almost another 8 years
3. The average computer had only 256MB of Ram
4. Google had just started
5. People were trying to decide between Netscape and IE for their web browsers
6. Warcraft 2 was still a popular video game (one which won't even install on modern computers : )

Ok well all kidding aside I don't see how this is even still a topic of discussion. The product has been EOL for quite some time now, so no one should expect that future updates will not break it. In fact this is exactly what the meaning of End Of Life is! Bottom line is it is against your best interest to run this old of a product because it WILL NOT protect you against new viruses. Even modern anti-virus programs fail to stop some viruses in this ever changing cesspool we call the internet :). If you haven't been infected by now call yourself lucky, but my guess is that you probably are infected (you just don't know it) and you should immediately download a new age anti-virus and run a full scan.

Cheers
Grant

I wonder though... How long will it go unnoticed that Symantec has silently disabled these old products with the May 11, 2010 (and newer) virus def's?  How often does a "typical" user actually perform a manual scan or review their scan history log; the only way to learn that something is wrong.  How many users will simply assume they have protection because their virus definition files are up-to-date?  The default scheduled scan was Sunday morning, which means that for most the first failure occurred just a few days ago (May 16, 2010) - it will take some time before it becomes apparent that manual or scheduled scans are not working for these users. I believe Symantec has grossly underestimated the impact this will have.  Symantec needs to go public and warn users that have these old products that they are no longer protected, even though the program appears to be working and has the latest virus defs.

Symantec can hang on to the "EOL defense", but should be prepared for the backlash from users that don't keep up with Symantec's marketing literature regarding EOL.  I'm sure we can agree that an unprotected user WILL catch a virus.  How do you think that user will feel about Symantec products when they figure out their old program was misleading them - giving the appearance that they had the latest virus defs?  What would compel that user to EVER consider buying a Symantec product again?

Just my opinion, but Symantec is about to make a historical marketing blunder if they don't right this quickly.  And the fix is really easy, here's what they should do:

1) temporarily restore the functionality to the virus defs.
2) go public and let everyone know that at some future date (10/10/10 would be fine), the virus defs will not work with older programs.
3) Everyone likes a discount!  Now is the time to offer upgrades at a SALE price.

Or.... Do nothing, let the virus hit your former unsuspecting users and ensure they remain "former" customers forever.

Just my opinion...

ThatOldITguy

Consider for a minute the possibility that users using these old products realize that they don't provide complete protection - but rather just one specific type of protection.  Who says all of your protection has to come from one vendor or just one product?   For most users XP's firewall is more than adequate when combined with a simple firewall router.   There are plenty of other software programs available to detect malware, spyware and other risks - and some, like XP's firewall are provided by Microsoft for free or included with the product.

It sounds like you would be surprised at how well a "blended" solution like this has worked, and maybe I'm an exception - but I've remained completely virus free for many years.  On the other hand, I have helped many Symantec customers clean infected computers.  They got this way because the user failed to renew their subscriptions or tried to install one version over another and ended up with NO protection - something that can only be fixed with a "Removal tool".  Of course the user is to blame, but the complexity of these all-in-one programs make it nearly impossible for the uninitiated user to "upgrade" to a better place - other wise there would be no need for vendor "Removal tools".  So I think the blame should be shared between the user and software titles.  Are you considering this as part of the changing threat landscape?  You should!  My point is this, while it may be necessary to have a complicated program to defend effectively against todays modern "blended threat" - the complicated programs themselves, under the weight of their own complexity often fail leaving the user completely defenseless.  While a "Blended" solution with independent components is harder to manage, at least your not completely defenseless should one component be out of date or fail.

Yea, it's just a knife, but I also have body armor and a grenade - I've pulled the pin.  Stand close and Fire for effect.

ThatOldITGuy.

A good thread - lots of excellent discussion here.  Thank you to all contributors.

This is an informed guess, but I believe that the root of the SAV 8 problem is in the limitations of memory mapping for older Operating Systems.  The new Engine released last week contains important changes that benefit users of supported products on current OS's.  Trying to maintain backward compatability with technology from ten years ago can only hold back the vast majority of customers who are paying for their computers' protection. 

Any sort of step backward would require delaying the development of fixes and enhancements for current products and future releases.  It's unrealistic to expect that will happen.  Such a change would not be possible within a matter of days  or weeks anyway- engines require long periods of testing.   

As new threats are discovered in the wild daily, I recommend getting into a protected state any old SAV 8 or SAV 9 clients displaying this "scan stopped by user" message.  A modern AV product with firewall and IPS, like SEP, is 100% essential. 

Thanks and best regards,

Mick

Hi,
i'm having same issue but not on all computers!

Re-installed a laptop today, and I get thi message when starting to scan the drives for the first time.

I went on another computer habving same symantec installed, updated the virus def. and was able to scan the disks.

Need to say that currently it is:
Program: 8.1.0.825
Scan engine: 4.2.0.7
Virus def: 5/18/2010 rev. 4


And this information is valid for both computers.

I know that we (the company I work for) are about to go on endpoint bla bla...

Question:

Why does it work on one c omputer and not on the other one?

Best regards

marsu

During testing I found the same thing.  The "first" scan after reinstalling and/or "live-updating", it would work fine - but only ONCE.  All subsequent scans would fail.

The fact that it DOES work once suggests this is a simple bug that could be fixed - after all, it does scan the one time.  Doesnt sound like Symantec will be fixing it though.

I'll withhold my rants on SEP for another time - I have to go figure out my SEPM password, which HAS to be different than my Administrator password because it doesnt support special characters! (like !)   This must improve security somehow.

ThatOldITGuy.
 

Mick,

Thank you for the insight to the inner workings at Symantec and the problem.  Permit me to make another suggestion.  If the virus Def's truely cannot be fixed to work with the older products then how about this compromise:

1) an update to Live-Update that recognizes the old products and only downloads the last virus def (May 10, 2010 version 2), that the products will work with.

2) Write and post a technical article that explains why live update doesnt download the newer defs.

3) post the XDB for the old defs so people can download it directly from Symantec.

At least then the user could be clued into the fact they their anti-virus protection is getting stale, and at 30 days the automatic 30-day warning would appear.

I've already said I think Symantec has grossly under-estimated the impact of this.  How Symantec handles this "scan stopped by user" issue will speak to it's commitment to security and quality as a organazation.

I like Symantec (although I have issues with Endpoint) - it has been my first choice for years whenever asked about a security product.  I think it speaks highly that Comcast switched from "another vendor" recently to a Symantec product. 

I hope Symantec will step up and do the right thing here.

ThatOldITGuy.

I have installed the Beta version as suggested but it indicated that there was a bug.

I would like to know if people are uninstalling their "older" versions of Norton AV which has been giving the message  "scan stopped by user"?  If you are and even if you aren't could you tell me if there is anything I need to do with the "settings" (or anything else)  before I remove the program?

Thanks very much

For me, uninstalling SAV8.1 Corporate was painless - just the control panel add/remove.  No settings needed or changed.  Your mileage may differ.  If that's not working then unfortunately you will probably need to use one of the vendors removal tools.

Here's a couple of links:

http://download.mcafee.com/products/licensed/cust_support_patches/MCPR.exe

ftp://ftp.symantec.com/public/english_us_canada/removal_tools/Norton_Removal_Tool.exe

Good luck!

 

Here is the link with the different Norton removal tools.

http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2005033108162039

ATTN: "Symantec Employee"

Can you at least please tell us how to un-do this mess so we can have time to decide what our next step is ?

 

can you try this 

Message: "Scan stopped by user" when launching a manual scan

http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/ef06f50fcab0ce1188256a2200272927?OpenDocument

"can you try this"

http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/ef06f50fcab0ce1188256a2200272927?OpenDocument

Rafeeq, i appreciate your reply but do you realize how confusing those instructions look to a novice ?  Please send symantec programmer back to the drawing board to undo these changes.

Another thing, I realize we purchased this years ago and that there are new virus definitions out there but that is my choice.  I work for a company that has minimal expenses for the IT department this was not in our budget till next year.

Thank You



Rafeeq,
This has been effective on each PC we have tried it on thus far and we will be scripting the reg-backup and regedit to patch the rest.

While I assume this is effectively shutting off the boot sector scans - this is a *not as dangerous as not being able to scan anything* option while we franticly look for a new AV solution.

Thanks.

As many other have said. That's simply not going to happen. We are moving forward with SEP. I seriously doubt any resources are going to be put towards fixing an end of life product. SAV 8 isn't even designed to deal with the size of the the definitions files that are being put out today. The fact that it has this long is amazing.

My rtvscan.exe is dated May 21, 2003.  Tomorrow will be it's 7 year birthday.  Maybe we should have a retirement party for it.

Happy that it helped you :) 

Symantec, this is a disgusting way to treat your customers.

Firstly, why not use an error message that explains that the product is now EOL? Instead of the obfuscating "Scan stopped by user"?. This has caused us widespread and totally unecessary IT problems since the fated update a few days ago.

Secondly, as a corporate user of Symantec AV for many years, we originally paid a great deal of money for a licence that is called "Perpetual". Yes, the licence states "Perpetual". Clearly you do not understand the meaning of the word, neither did your sales team when they originally sold us this licence, they advised us that our AV software would be updated indefinitely, even if a particular program version was discontinued.

We have received no communication advising that this product would be declared EOL. Why not even the attempt to sell us something new? Just disable the product when you feel like it without any advance warning.

We are not renewing our Symantec products in any of our offices and believe you me, that is a significant financial loss to yourselves.

Well done Symantec.

How is it that you have been using this product for years, but your membership to the forums is only 1 hour 45 minutes old?
I find it hard to beleive you have never had an issue and posted here before. It is funny how most of these negetive posts are by users that just joined the forums.

@cycletech:-

Since when is it a mandatory requirement of any software licence to become a member of the support forum? Why would anyone bother to join this forum anyway if your response to my post is anything to go by?

Instead of being so unhelpful, what about answering the following questions:-

1) Why the misleading error message, instead of a message that explains "the version you are using is now obsolete"? Those who are responsible for the IT in a large organisation will understand that such an error message leads to confusion amongst users and a headache for those tasked to find a solution. The "EOL" message would have saved considerable time and effort.

2) Why no attempt to contact existing licence holders to advise that the software we purchased is no longer supported? Not even an attempt to sell us a new version?

3) When does "Perpetual" not mean perpetual? When we purchased this software we were advised that it would remain supported even through program updates. We paid a considerable sum of money for the licence on that basis. Why sell a "Perpetual" licence if it doesn't mean that?

Your unconstructive comment merely serves to enforce the belief that I and now many Symantec users have, that you as a company have no idea who uses your products and the manner in which they were originally sold. Why does it matter how long I have been a member of the forum? Simply so that you can discredit anything I say? Are you suggesting that if I had been a member of the forum for more than a year, you would have responded constructively to my post?

You might as well be honest and put "at Symantec we just don't care". Well, don't worry we've got the message. We'll be updating our AV but it won't be with anything you sell.

1.) How would you propose such an error message be retroactively incorporated into a piece of software that is no longer being updated... to let you know that a change to the virus definitions being applied to a very old build has inadvertently broken the ability to scan?

2.) I'm pretty sure the privacy rules by which we abide forbid unsolicited email--and anyway, even if that's something that was feasible, it would be very likely that any email addresses obtained at time of purchase are no longer valid.  I know I don't have the same email address I had 8 years ago.

3.) I don't work the licensing side of things, so I can't answer a question about the meaning of a 'perpetual' licence and exactly what it was that you purchased, but presumably "[t]hose who are responsible for the IT in a large organisation" are aware that software programs are constantly being improved and updated... and support for old versions is eventually ended.

sandra

Note: I'm not an 'official voice' of Symantec. Yes, I'm an employee... but I'm not part of any PR team. I'm as much of a peon in the corporate ladder as there ever has been. Symantec's official interpretation of the word 'perpetual' may be different, although I suspect it is not. I'll be the first to agree that the term 'perpetual' is a foolish word to use for a piece of software. It's more than likely a good buzzword that Marketing came up with to make a few extra sales. None of us should be so naive to take such 'promises' as the infallible truth...

To answer #3...
http://www.merriam-webster.com/netdict/perpetual

See Definition 1B(2): "holding (as an office) for life or for an unlimited time" (underline is mine)

The End of Life for SAV 8 has come. The updates were perpetual for the life of the product.

That is because everything was going along smoothly and then all of a sudden we get the "scan stopped by user" so we Google it and guess what pops up ........ SYMANTEC !

I think the problem here can be summed up in one word. Communication, or rather the lack thereof.

Sandra, I do appreciate the technical and administrative complications Symantec, like any software vendor, face in handling the EOL of a product. Ryan, I'm not even suggesting that I expect to have software that truly works forever.

My point is that we (and no doubt countless other users) were led to believe that the software would continue to work for the immediate future and that if things changed, we would have some time to retire the product and look for an upgrade or an alternative.

Instead, Symantec has continued to issue definition updates for this 8 year old software, suggesting to users of said software that all is well. Yes I realise that the definitions may apply to all your products but the point is from a user's perspective, all was well until last week.

Then, suddenly a definition update "breaks" SAV8. Your users were given no clue as to what had happened and why, instead they had to search the internet to discover this forum and to realise that effectively the plug has been pulled.

I am fairly sure that your programmers could have notified users by means of a program update. The LiveUpdate supports code updates in addition to the virus defs, but this is a technicality and not something your users should have to think about.

I can see I'm not getting anywhere with this and as we've already decided to go elsewhere for our AV, further contributions to this thread seem pointless too.

Then, suddenly a definition update "breaks" SAV8. Your users were given no clue as to what had happened and why, instead they had to search the internet to discover this forum and to realise that effectively the plug has been pulled.

But the plug had already been pulled... for something like 3-5 years.  I don't let any program  sit on my machine for that long without checking for program updates and compatibility.  Maybe that's just me.

I am fairly sure that your programmers could have notified users by means of a program update.

No program updates have been developed for SAV 8 for quite some time... not to mention that no testing is done with SAV 8 in order to have known it was going to break.  (You're right -- this is going in circles.)

sandra

Communication (that SAV 8/9 has reached EOL) was available on our site for years.

"My point is that we (and no doubt countless other users) were led to believe that the software would continue to work for the immediate future and that if things changed, we would have some time to retire the product and look for an upgrade or an alternative."

EOL was announced 3 years ago I believe. I think that's ample time to prepare to retire the product and move on to a newer supported piece of software.

You don't seem to understand. SAV 8 never should have been able to process those definition updates to being with. It was never intended or designed to process definiions the size they are today. Symantec didn't do anything to suddenly break the product, those definions should have broken it years ago. The reason the definitions on SAV 8/9 still updated, is because the program has no way to differentiate between SAV 8, SAV 9, or SAV 10 definitions, as they are essentially the same, so the updates went out. As long as LiveUpdate downloaded them and SAV 8/9 could process them they worked. This was the proverbial straw that broke the camel's back so to speak.

FYI, Symantec does not test new defintion updates against discontinued products. That said, no clue was given as to what is happening, and why because we ourselves did not know until the posts started to appear in the forums. How do you propose Symantec update the program to say a set of defintions is going to break it, when we don't know it will? Our programers do not update or work with SAV 8/9 any longer. They've reached EOL, which means the code has been retired and is no longer worked on. Which in turn means no further updates will be made to it.

I've just recently joined these forums too.  You may find it "Hard to Believe", but many of us IT professionals actually read the manuals and technical articles before we turn to this kind of a format to resolve our issues.  Your right, we don't join the forums to say how much we love that the program has been working for years - perhaps we should.  Would that make you feel better?  Sounds like someone needs a hug?  Here ya go: [hug]

Thanks for the hug.

I do understand what  you and these other users are going through. At my old job, I was responsible for Desktop Security in a public environment (Science Museum), with nearly 300k visitors a year touching our computer systems. I learned the hard way when I let our AV solution lapse due to budget constraints. After numerous exhibit systems became infected and many hours of rebuilding them,  upper management finally agreed to let me spend the money to protect our systems. They learned just how important it was to keep our AV subscriptions up-to-date. That was a great lesson for me, and we never had another incident after that.

If you have not had a major infection in your network while running an old AV product, then consider yourselves very lucky.

Thomas