Disabling the Quick Scan that runs after virus definitions update in Symantec AntiVirus 10.1 and Symantec Client Security 3.1

Symantec.com > Enterprise > Support > Knowledge Base

Disabling the Quick Scan that runs after virus definitions update in Symantec AntiVirus 10.1 and Symantec Client Security 3.1

Question/Issue:
After you update virus definitions, Symantec AntiVirus Corporate Edition 10.1 runs a Defwatch Quick Scan. You need to know how to disable the Defwatch Quick Scan.

Solution:

Before you begin: This document applies to Symantec AntiVirus 10.1 and Symantec Client Security 3.1. If your clients or servers run Symantec AntiVirus 10.0 or Symantec Client Security 3.0, read the following document:
Disabling the Quick Scan that runs after virus definitions update in Symantec AntiVirus 10.0 and Symantec Client Security 3.0

A Quick Scan is a fast scan of the following:

Files loaded into memory
Common virus and security risk loading points, including registry keys and startup files

To disable the Quick Scan that runs after virus definitions update, follow the directions for each type of computer in your environment.

Managed clients
You can disable the Quick Scan that runs after virus definitions update by changing a setting in Symantec System Center.

To disable the Defwatch Quick Scan on managed clients

Start Symantec System Center.
Unlock the server group.
Right-click a server group, a client group, or a server, and then click All Tasks> Symantec AntiVirus> Client Administrator Only Options.
On the Scans tab, under Triggered Scans, uncheck Run a Quick Scan when new definitions arrive.
Click OK.

Note: If Symantec AntiVirus quarantines security risks for which you created an exception during this Quick Scan, make sure that you add the security risk to the global exclusions list.
For directions, read Configuring global security risk exclusions in Symantec AntiVirus 10.1 and Symantec Client Security 3.1.

Servers
On Symantec AntiVirus 10.1 servers, the Defwatch Quick Scan is disabled by default. You can disable or enable the Defwatch Quick Scan by editing the registry.

To disable or enable the Defwatch Quick Scan by editing the registry

On the Windows taskbar, click Start> Run.
In the Open box, type the following text:

regedit
Click OK.
In the left pane of the Registry Editor, go to the following key:

HKEY_LOCAL_MACHINE\Software\Intel\Landesk\VirusProtect6\CurrentVersion\AdministratorOnly\General
In the right pane, double-click the EnableDefwatchQuickscan value.
Do one of the following:
- To disable the Defwatch Quick Scan, change the Value data field to 0, and then click OK.
- To enable the Defwatch Quick Scan, change the Value data field to 1, and then click OK.
Exit the Registry Editor.

Unmanaged clients
You can disable the Defwatch Quick Scan by editing the registry.

To disable the Defwatch Quick Scan by editing the registry

On the Windows taskbar, click Start > Run.
In the Open box, type the following text:

regedit
Click OK.
In the left pane of the Registry Editor, go to the following key:

HKEY_LOCAL_MACHINE\Software\Intel\Landesk\VirusProtect6\CurrentVersion\AdministratorOnly\General
In the right pane, double-click the EnableDefwatchQuickscan value.
Change the Value data field to 0, and then click OK.
Exit the Registry Editor.

Document ID: 2006032313184248
Last Modified: 11/20/2007
Date Created: 03/23/2006
Operating System(s): Windows 2000, Windows XP Home, Windows XP Professional Edition, Windows XP Tablet PC, Windows XP 64-Bit Edition 2003, Windows Server 2003 32-bit Edition, Windows Server 2003 64-bit Edition, Windows XP Media Center Edition 2005
Product(s): Symantec AntiVirus 10.1, Symantec Client Security 3.1
Release(s): Symantec AntiVirus 10.1 [All Releases], Symantec Client Security 3.1 [All Releases]