[big poppa pump]

I had the same problem with SAV 10. I think its the spyware scan engine with this version. I was surprised when I did my unattended install and found that DAP was not installed. I finally realized that SAV was cleaning out the entire DAP directory in Program Files the moment it is installed. FTM, I have got rid of SAV10 and sticking with SAV 9. Too many things wrong with SAV 10 if you ask me.

[hammermtl]

i tried using the

[QUOTE]/qb RUNSCAN=0 RUNLIVEUPDATE=0 REBOOT=REALLYSUPPRESS[QUOTE]

as suggested but i still get the message that my virus definitions are old and displays the message to update.

HOWEVER the installation continues and all my other applications install and then the PC reboots.

Does anyone think this would have any ill-effects on the computer?

This is being done on an actual machine and not VM. Any suggestions?


Josh

[RyanVM]

Yeah, that message is annoying me too. The "workaround" I'm using right now is to just update vdefhub.zip from time to time

[plutoz]

http://service1.symantec.com/SUPPORT/ent-s...niver=sav_ce_10

DoScan.exe causes high CPU usage

Situation:
You installed Symantec AntiVirus Corporate Edition 10.0. After you restart the computer, you notice that the process DoScan.exe is using a large amount of CPU and memory. After the DoScan.exe process completes, the Rtvscan.exe process is using about 40 MB of memory.

Solution:
Symantec is investigating this problem to determine a solution. This document will be updated when new information or a solution is available.


The DoScan.exe process is part of the default startup Quick Scan that runs after a user logs on. You cannot disable this Quick Scan using Symantec System Center.

[Nilfred]

Nice workaround on that link dude!

[plutoz]

upon further investigation I found I was able to get rid of the auto-generated quickscan simply by deleting the following key:

[HKEY_CURRENT_USER\Software\Intel\Landesk\VirusProtect6\CurrentVersion\Custom Tasks\TaskPadStartup\Auto-Generated QuickScan]


not sure why the symantec workarounds remove so much other registry information!

[boooggy]

or u open symantec antivirus go to startup scans and right click on sturtup scan and click delete.

[rezzo]

Sanjay, on May 25 2005, 08:00 AM, said:

Does anyone else have a problem with running Download Accelerator with 'SAV Corporate 10.0.0.359'. Every time I install Download Accelerator, 'SAV Corporate 10.0.0.359' immediately opens up a window with the following info:

Scan type:  Auto-Protect Scan
Event:  Threat Found!
Threat: Adware.DAP
File:  C:\Program Files\DAP\DAPBHO.dll
Location:  C:\Program Files\DAP
Computer:  VISUALTECH
User:  VISUALTECH\Sanjay
Action taken:  Pending Side Effects Analysis
Date found: Wednesday, May 25, 2005  5:31:53 PM

and another window pops up wanting to delete the 'DAPBHO.dll' file. The end result is I am unable to keep Download Accelerator as long as I have 'SAV Corporate 10.0.0.359' installed. This was not a problem with older versions of SAV Corporate.

Any ideas why this happening or what the solution might be?
<{POST_SNAPBACK}>

I have the same problem here. Symantec 10.0 is so buggy.

[mickmack]

it is not a bug, it warns you about Browser Helper Object that adds its button to IE. you can exclude monitoring such a things in SAV

[RogueSpear]

While I have used DAP from time to time myself, it has long been on the naughty list of several anti-malware vendors. I don't know what their current business practices are, but I remember that for quite some time they really walked a fine line between legit and spyware spreader. So if their products still raise alarms it really doesn't surprise me, even if they have cleaned up their act.

[tbma]

My version of install.cmd

rem * Supress annoying warning about outdated virus definitions until nex update. Number is a definitions date, and depends 
rem on you current installation. Can be taken from HKLM\SOFTWARE\Intel\LANDesk\VirusProtect6\CurrentVersion\PatternFileDate
rem after test install.
reg add HKLM\SOFTWARE\Intel\LANDesk\VirusProtect6\CurrentVersion /v NoWarnPattern /t REG_BINARY /d 23030C0000000000 /f

rem * Installing all components except LotusNotus Auto-Protect. Enabling "Tamper Protection".
start /WAIT msiexec /i "Symantec AntiVirus.msi" /QB!- RUNLIVEUPDATE=0 SYMPROTECTDISABLED=0 ADDLOCAL=SAVMain,SAVUI,SAVHelp,EMailTools,OutlookSnapin,Pop3Smtp,QClient

rem * Launch silent LiveUpdate for virus definitions.
start /WAIT "" "%programfiles%\Symantec Antivirus\VPDN_LU.EXE" /s

rem * Removing auto-created startup scan to avoid high CPU usage.
reg delete "HKCU\Software\Intel\LANDesk\VirusProtect6\CurrentVersion\Custom Tasks" /f

[sleepnmojo]

rem * Removing auto-created startup scan to avoid high CPU usage.
reg delete "HKCU\Software\Intel\LANDesk\VirusProtect6\CurrentVersion\Custom Tasks" /f

This is only a temporary solution. You need to add the key I specified in post 43 of this thread. When SAV doesn't see it, it will create the startup scan. The Symantec solution is similar, but adds an extra key, which isn't really needed.

[tbma]

sleepnmojo, on Jun 5 2005, 10:28 AM, said:

This is only a temporary solution.  You need to add the key I specified in post 43 of this thread.  When SAV doesn't see it, it will create the startup scan.  The Symantec solution is similar, but adds an extra key, which isn't really needed.
<{POST_SNAPBACK}>

Many Thanks!! I've added the line below following your recommedtations as the last line and it dit the trick.

reg add "HKCU\Software\Intel\LANDesk\VirusProtect6\CurrentVersion\Custom Tasks" /v CreatedUserQuickScan /t REG_DWORD /d 0x1 /f

[[deXter]]

**** I'm liking Symantec more and more!

Just yesterday morning I discovered a new virus strain which wasn't detectable by any AV and wasn't documented anywhere on web either! So I analyzed the virus, documented exactly what it did and submitted it to them. I immediately got a reply that my submission was accepted, and is being processed. A few hours later, I got another auto-reply saying that the new virus has now been officially recognized! The new signature was added to the virusdefs and bam after updating SAV can now remove it! All in a span of few hours! And today I checked up the Symantec Security Response site, and noticed that the new virus has been documented, and in full detail too!

Btw, for those interested, you can always get the latest and by latest I mean hourly updated defs here:

http://securityresponse.symantec.com/avcen...a.download.html

You ought' to download that in one go; cause if you pause and resume later, for all you know the defs already been updated! (I tried pausing and downloading an hour later, file size was already changed.)

[boooggy]

thanx for the link. but i think is useless. i downloaded the definition from there and after that i looked here symantec downloads and in my link the definitions are newer.....

[sleepnmojo]

I'll give those a try. I ended up finding one yesterday that SAV couldn't detect, even updated to latest and greatest. I was looking for a link to send it in, but couldn't find one. I do believe it has been discovered though, because I typed some info in google and came up with variants.

I ran it through VMWare just to play with it, and didn't look like it did much. I could remove it manually, so I felt it was pretty weak.

[plutoz]

sleepnmojo, on Jun 5 2005, 02:28 PM, said:

rem * Removing auto-created startup scan to avoid high CPU usage.
reg delete "HKCU\Software\Intel\LANDesk\VirusProtect6\CurrentVersion\Custom Tasks" /f

This is only a temporary solution.  You need to add the key I specified in post 43 of this thread.  When SAV doesn't see it, it will create the startup scan.  The Symantec solution is similar, but adds an extra key, which isn't really needed.
<{POST_SNAPBACK}>

sleepnmojo, what is the timeframe for the re-creation of the automatic startup scan? I have removed it from PCs on my network by deleting the key I posted previously (no need to delete the entire 'Custom Tasks') and been through several reboots and it has not come back, without adding your key.

[sleepnmojo]

plutoz, on Jun 6 2005, 02:56 PM, said:

sleepnmojo, what is the timeframe for the re-creation of the automatic startup scan? I have removed it from PCs on my network by deleting the key I posted previously (no need to delete the entire 'Custom Tasks') and been through several reboots and it has not come back, without adding your key.
<{POST_SNAPBACK}>

If you were to delete the whole Custom Tasks key, then I would say after next login. As for the key you posted, it wouldn't matter. As long as the CreatedUserQuickScan key is there, it shouldn't come back. Since you don't delete it, it won't come back.

Now you could just import the key at t-12, or import it into the default profile, and not have to delete it at all.

[plutoz]

sleepnmojo, on Jun 6 2005, 06:05 PM, said:

If you were to delete the whole Custom Tasks key, then I would say after next login.  As for the key you posted, it wouldn't matter.  As long as the CreatedUserQuickScan key is there, it shouldn't come back.  Since you don't delete it, it won't come back.

That makes a lot of sense, thx.

Quote

Now you could just import the key at t-12, or import it into the default profile, and not have to delete it at all.
<{POST_SNAPBACK}>

Not sure I understand this part...can you explain a bit more?

I tried adding the CreatedUserQuickScan to HKU\.DEFAULT\Software...etc but it didn't affect new users logging in on the machine - they got the auto generated scan for their first logins until the login script command I set up deleted it from their HKCU....

[tbma]

Quote

I tried adding the CreatedUserQuickScan to HKU\.DEFAULT\Software...etc but it didn't affect new users logging in on the machine - they got the auto generated scan for their first logins until the login script command I set up deleted it from their HKCU....
<{POST_SNAPBACK}>

You need to add 2 keys, imho.

reg add "HKU\.DEFAULT\Software\Intel\LANDesk\VirusProtect6\CurrentVersion\Custom Tasks" /v CreatedUserQuickScan /t REG_DWORD /d 0x1 /f
reg add "HKU\.DEFAULT\Software\Intel\LANDesk\VirusProtect6\CurrentVersion\Custom Tasks" /v CopiedDefaultScanOptions /t REG_DWORD /d 0x1 /f

adding those 2 in installation script to HKCU, before running MSIEXEC, would disable autocreation alltogether.

This post has been edited by tbma: 07 June 2005 - 09:12 AM