Release notes for Symantec Client Security 3.1.x and Symantec AntiVirus 10.1.x

Symantec.com > Enterprise > Support > Knowledge Base

Release notes for Symantec Client Security 3.1.x and Symantec AntiVirus 10.1.x

Question/Issue:
This article documents the changes and fixes in each update to Symantec AntiVirus Corporate Edition 10.1.x and Symantec Client Security 3.1.x. Symantec Client Security 3.1.x includes Symantec AntiVirus 10.1.x and Symantec Client Firewall 8.7.x.

Solution:
As updates to Symantec Client Security are released, they are added as sections in this document. The sections are added in chronological order, with the most recent additions at the top. For information about how to obtain the latest build of Symantec AntiVirus or Symantec Client Security, read the following document: Obtaining an upgrade or update for Symantec AntiVirus Corporate Edition or Symantec Client Security.

Maintenance Release 9 (MR9)
This section describes the fixes in Maintenance Release 9 of Symantec AntiVirus 10.1 and Symantec Client Security 3.1.

Components

Component	Version
Symantec AntiVirus	10.1.9.9000-71
Symantec Client Firewall	8.7.4.205
QServer	3.5.4.101
Symantec AntiVirus Reporting	1.0.258
AMS	6.12.0.152
AntiSpam	2005.3.0.115
Auto-Protect	9.7.7
Behavior Blocking	2.4.1
Common Client	104.0.19.5
Decomposer (Windows)	3.16.5.5
Decomposer (NetWare)	3.2.14.33
DefUtils	3.1.13.0
ECOM	51.3.0.11
IPS	6.2.2.2
LiveUpdate	3.3.0.85
NAVAPI	4.2.0.8
NIS Shared Components	2005.3.0.90
SymEvent	12.5.4.2
SymNetDrv	6.0.11.3
SymSentry	2.1.0.101

Symantec AntiVirus Fixes

IAO.exe terminates unexpectedly

Fix ID:

Symptom:

Solution:

A primary server stops distributing virus definitions to secondary servers.

Fix ID:

Symptom:

Solution:

Network scanning option "Trust" does not reduce file transfer times

Fix ID:

Symptom:

Solution:

Symantec Antivirus service cannot be stopped and generates an application error

Fix ID:

Symptom:

Solution:

Computer stops responding during migration from MR5 PP1 to MR5 MP1

Fix ID:

Symptom:

Solution:

Symantec AntiVirus/Symantec Client Security logon script does not recognize an already up-to-date client installation

Fix ID:

Symptom:

Solution:

Sorting Computer Status logs by "Status" does not sort in a logical or meaningful manner

Fix ID:

Symptom:

Solution:

Scheduled scan fails because the wrong user account is used for the scan

Fix ID:

Symptom:

Solution:

Computer stops responding when a process is terminated

Fix ID:

Symptom:

Solution:

Symantec Antivirus service crashes when moving server from group to group using the Symantec System Center console

Fix ID:

Symptom:

Solution:

Scheduled scans occur at unscheduled times

Fix ID:

Symptom:

Solution:

Unexpected crash in Rtvscan.exe

Fix ID:

Symptom:

Solution:

LiveUpdate cannot update virus definitions from current/monthly delta

Fix ID:

Symptom:

Solution:

Process termination crash in SAVRT.SYS

Fix ID:

Symptom:

Solution:

Group roaming settings do not move during the promotion of a new primary server

Fix ID:

Symptom:

Solution:

Setting change propagates to clients even though Auto-Protect is not "locked" in the Symantec System Center settings

Fix ID:

Symptom:

Solution:

Server crash with stop-code 7F referencing SAVRT.SYS

Fix ID:

Symptom:

Solution:

High CPU usage of Rtvscan.exe on Citrix Presentation Server

Fix ID:

Symptom:

Solution:

Netware Server abends due to RTVSCAN.NLM

Fix ID:

Symptom:

Solution:

Conflict between SymTDI and network management software causes blue screen error

Fix ID:

Symptom:

Solution:

Symantec AntiVirus Server generates excessive connections to Symantec AntiVirus client during client installation

Fix ID:

Symptom:

Solution:

"Quarantine" is triggered when "Cleaned" action is selected if threat is detected on a Windows File Share

Fix ID:

Symptom:

Solution:

Quarantine scan causes Auto-Protect detections in %temp% folder

Fix ID:

Symptom:

Solution:

Symantec Client Firewall fixes

Computer crashes when Symantec Protection Agent and Symantec Client Security are installed on the same computer

Fix ID:

Symptom:

Solution:

After uninstalling/upgrading Symantec Client Security, port 80 is blocked until the computer restarts

Fix ID:

Symptom:

Solution:

Symantec AntiVirus Reporting

Virus Outbreak email alert contains non-functional report link

Fix ID:

Symptom:

Solution:

10 minute CGI timeout on Reporting server Home page

Fix ID:

Symptom:

Solution:

"Risk Reports > Auto-Protect not running" fails to apply filters over a specific time period

Fix ID:

Symptom:

Solution:

The "Computers Not Scanned" report for the past 24 hours lists computers that were scanned in the last 24 hours

Fix ID:

Symptom:

Solution:

Virus definition out-of-date email alert link does not link to expected clients list

Fix ID:

Symptom:

Solution:

Question mark cannot be used as wildcard in Reporting Server's Advanced options

Fix ID:

Symptom:

Solution:

The "Computers Not Scanned" report displays the wrong date when the Last Scan Time in the database is NULL

Fix ID:

Symptom:

Solution:

The "Auto-Protect not running" report does not display all computers where Auto-Protect is not running

Fix ID:

Symptom:

Solution:

Reporter displays incomplete information in risk and status reports

Fix ID:

Symptom:

Solution:

README Items

Running LiveUpdate after installation requires additional space

Fix ID:

Symptom:

Solution:

Maintenance Release 8 (MR8)
This section describes the fixes in Maintenance Release 8 of Symantec AntiVirus 10.1 and Symantec Client Security 3.1.

Components

Component	Version
Symantec AntiVirus	10.1.8.8000
Symantec Client Firewall	8.7.4.152
QServer	3.5.4.79
Symantec AntiVirus Reporting	1.0.248.0
AMS	6.12.0.150
AntiSpam	2005.3.0.115
Auto-Protect	9.7.5.2
Behavior Blocking	2.4.1
Common Client	104.0.18.2
Decomposer (Windows)	3.15.3.0
Decomposer (NetWare)	3.2.14.28
DefUtils	3.1.13.0
ECOM	51.3.0.11
IPS	6.2.2.2
LiveUpdate	3.2.0.68
NAVAPI	4.2.0.8
NIS Shared Components	2005.3.0.90
SymEvent	12.5.4.2
SymNetDrv	6.0.10.2
SymSentry	2.1.0.101

Symantec AntiVirus Fixes

Cannot use AV Client Rollout to 64-bit systems with 32-bit operating systems

Fix ID:

Symptom:

Solution:

Symantec System Center displays AutoProtect tabs incorrectly

Fix ID:

Symptom:

Solution:

Dell Optiplex 745 computers fail to start after installing Symantec AntiVirus

Fix ID:

Symptom:

Solution:

Rtvscan.exe high CPU usage on 64-bit Citrix Servers

Fix ID:

Symptom:

Solution:

Rtvscan.exe left in a hung state with 1 thread

Fix ID:

Symptom:

Solution:

Symantec AntiVirus does not skip offline files as expected

Fix ID:

Symptom:

Solution:

The Symantec Event Manager Service registry key's permissions are reset each time the service is reloaded

Fix ID:

Symptom:

Solution:

Settings changes made to the server group are not set on secondary servers

Fix ID:

Symptom:

Solution:

AutoProtect Error: AutoProtect is unable to block security risks

Fix ID:

Symptom:

Solution:

Default LiveUpdate configuration settings are not applied to client group members

Fix ID:

Symptom:

Solution:

Verifying Security Risk exceptions from another Symantec System Center deletes existing exceptions

Fix ID:

Symptom:

Solution:

Symantec System Center crashes when rolling out Symantec Client Firewall policy

Fix ID:

Symptom:

Solution:

Auto-Protect actions and exclusions under All Risks allows locked categories to be edited

Fix ID:

Symptom:

Solution:

Inconsistency in default values when creating scans in the Symantec System Center

Fix ID:

Symptom:

Solution:

Rtvscan.exe crashes when performing a Master Boot Record scan

Fix ID:

Symptom:

Solution:

AV Server Rollout migrating Symantec AntiVirus server to Symantec Client Security server does not preserve custom install path

Fix ID:

Symptom:

Solution:

Roaming profiles revert to default profiles

Fix ID:

Symptom:

Solution:

Computer stops responding about 30 seconds after the user logs on

Fix ID:

Symptom:

Solution:

Rtvscan.exe application error when shutting down

Fix ID:

Symptom:

Solution:

"Nlnhook.exe - DLL initialization failed" message during Windows shutdown

Fix ID:

Symptom:

Solution:

Rtvscan.exe does not release files after it finishes scanning

Fix ID:

Symptom:

Solution:

Restoring files from quarantine server causes a Runtime error

Fix ID:

Symptom:

Solution:

The IP address in the Symantec AntiVirus debug log (vpdebug.log) may be incorrect when running under heavy load

Fix ID:

Symptom:

Solution:

ESX Performance issues with Symantec AntiVirus during heavy I/O events

Fix ID:

Symptom:

Solution:

Secondary servers do not respond to configuration changes made through the Symantec System Center

Fix ID:

Symptom:

Solution:

Registry entries from Enabling Multithreaded are removed during migration

Fix ID:

Symptom:

Solution:

Symantec AntiVirus logs do not display the correct IP address

Fix ID:

Symptom:

Solution:

Vpstart /uninstall removes user groups even though there are other servers in context

Fix ID:

Symptom:

Solution:

Netware Servers hang with Novell Audit 2.0.2 and Symantec AntiVirus server

Fix ID:

Symptom:

Solution:

Netware server pushes full VDB to clients instead of IDB

Fix ID:

Symptom:

Solution:

Symantec Reporting Server Fixes

"Computers Not Scanned" shows computers outside the selected client group

Fix ID:

Symptom:

Solution:

Error when creating a Full Report for All Products with Past 24 hour time range

Fix ID:

Symptom:

Solution:

Only the first of multiple "Virus definitions out- of-date" Reporting alerts is triggered

Fix ID:

Symptom:

Solution:

Reports emailed by Reporting Server contain non-functional links

Fix ID:

Symptom:

Solution:

Configured virus definition alert does not run

Fix ID:

Symptom:

Solution:

Agent Down email notifications being sent out in error

Fix ID:

Symptom:

Solution:

"Risk Type" column in exported Reporting Risk logs does not contain meaningful data

Fix ID:

Symptom:

Solution:

Servers that have been taken offline still show in Reporting

Fix ID:

Symptom:

Solution:

Cannot report by specific virus type in Reporting Server

Fix ID:

Symptom:

Solution:

1970 records created in database incorrectly when user is logged out

Fix ID:

Symptom:

Solution:

Incomplete scan engine information causes Error 2 in parent inventory log

Fix ID:

Symptom:

Solution:

Reporting Risk Logs Advanced Settings are not retained

Fix ID:

Symptom:

Solution:

Symantec Client Firewall fixes

Script error when creating General Rules with Symantec Client Firewall Administrator

Fix ID:

Symptom:

Solution:

pRules based on Size Range are not created correctly

Fix ID:

Symptom:

Solution:

When viewing Symantec Firewall Client Network Connections, unknown IP addresses appear for UDP port 137 or 138

Fix ID:

Symptom:

Solution:

Cannot access Web page with Symantec Client Security enabled

Fix ID:

Symptom:

Solution:

Parent Server Name is rewritten on Symantec Client Firewall events, thereby overwriting IPS signature

Fix ID:

Symptom:

Solution: Added a check for the Event type to ensure that Symantec Client Firewall events do not overwrite the IPS signature.

Maintenance Release 7 (MR7)
This section describes the fixes in Maintenance Release 7 of Symantec AntiVirus 10.1 and Symantec Client Security 3.1.
Components

Component	Version
Symantec AntiVirus	10.1.7.7000
Symantec Client Firewall	8.7.4.117
QServer	3.5.4.79
Symantec AntiVirus Reporting	1.0.234.0
AMS	6.12.0.148
AntiSpam	2005.3.0.31
Auto-Protect	9.7.2.3 (a)
Behavior Blocking	2.4.1.1
Common Client	104.0.15.2
Decomposer (Windows)	3.15.3.0
Decomposer (NetWare)	3.2.14.28
DefUtils	3.1.13.0
ECOM	51.3.0.11
IPS	6.2.2.2
LiveUpdate	3.2.0.67
NAVAPI	4.2.0.8
NIS Shared Components	2005.3.0.75
SymEvent	12.2.1.2
SymNetDrv	6.0.7.703
SymSentry	2.1.0.101

Symantec AntiVirus fixes

Migration from 10.1.4010 to 10.1.5.5000 creates nested Symantec AntiVirus folders

Fix ID:

Symptom:

Solution:

Event ID 42 is not forwarded to the parent server

Fix ID:

Symptom:

Solution:

Symantec AntiVirus Server upgrade rollout changes original installation location

Fix ID:

Symptom

Solution:

DWHWizrd.exe application error

Fix ID:

Symptom:

Solution:

Symantec AntiVirus MR5 scheduled scans are not honoring short (8.3) folder and file names in exclusions

Fix ID:

Symptom:

Solution

Server hangs after event id 7031 is encountered

Fix ID:

Symptom:

Solution:

File restoration is slow with Veritas or ARCserve restore on NetWare

Fix ID:

Symptom:

Solution

EMC/Legato Networker users experience full backups instead of incremental backups after Symantec AntiVirus scans run.

Fix ID:

Symptom:

Solution:

Symantec AntiVirus does not provide satisfactory error on why new definitions cannot be downloaded or processed

Fix ID:

Symptom:

Solution:

Symantec AntiVirus installs to the root of the Program Files folder after a migration

Fix ID:

Symptom:

Solution:

"Unable to open system registry" error during ClientRemote Installation

Fix ID:

Symptom

Solution

"Minutes to delay the start of continuous LiveUpdate" does not set in Client Groups

Fix ID:

Symptom:

Solution:

99 Character limit in the SAVRoam configuration textbox in the Symantec System Center

Fix ID:

Symptom:

Solution:

Client event timestamp conversions can be incorrect when a client roams to parents in different time zones

Fix ID:

Symptom:

Solution:

Manually removed ReportServerURL value in the registry is not recreated by the Symantec System Center

Fix ID:

Symptom:

Solution:

Scan History entries disappear from the Symantec AntiVirus console in Netware after a few minutes

Fix ID:

Symptom:

Solution:

Symantec Reporting Server Fixes

Database Maintenance Agent times out on large databases

Fix ID:

Symptom:

Solution:

Reporter home page shows two agents "hanging"

Fix ID:

Symptom:

Solution:

DBMaint agent shows "next run" time in GMT instead of local time

Fix ID:

Symptom:

Solution:

DBMaint Timeout error

Fix ID:

Symptom:

Solution:

"Source" field does not display accurate information in reporting

Fix ID:

Symptom:

Solution:

Clicking "more info" link for risk name in outbreak report gives multiple search results

Fix ID:

Symptom:

Solution:

Reporting Server displaying Last Scanned Time as 12/31/1999

Fix ID:

Symptom:

Solution:

"Definitions out-of-date" alert email has a broken hyperlink

Fix ID:

Symptom:

Solution:

The "last date updated" in Symantec Reporting Server console does not appear to match the last run time

Fix ID:

Symptom:

Solution:

LogReaderEvents agent quits unexpectedly

Fix ID:

Symptom:

Solution:

Cannot install Reporting with non-default settings

Fix ID:

Symptom:

Solution:

Daily report alert e-mails have broken URLs

Fix ID:

Symptom:

Solution:

Spaces in a Server group name cause some server group specific reports to report data incorrectly

Fix ID:

Symptom:

Solution:

Full log export does not honor filter settings

Fix ID:

Symptom:

Solution:

Scanned and Last checked-in reports are slow to generate

Fix ID:

Symptom:

Solution:

Log entry for definitions arriving on Quarantine server appears as error

Fix ID:

Symptom:

Solution:

Symantec Client Firewall fixes

Cannot access streaming audio through ISA proxy with Security enabled

Fix ID:

Symptom:

Solution:

Maintenance Patch 1 for Maintenance Release 6 (MR 6 MP 1)
This section describes the fixes in Maintenance Patch 1 for Maintenance Release 6 of Symantec AntiVirus 10.1 and Symantec Client Security 3.1. You can apply this patch over Symantec AntiVirus 10.1.6.x or Symantec Client Security 3.1.6.x. To learn how to obtain and apply the patch, read Applying Maintenance Patch 1 for Symantec Client Security 3.1 and Symantec AntiVirus 10.1 Maintenance Release 6.

Components

Component	Version
Symantec AntiVirus	10.1.6.6010
Symantec Client Firewall	8.7.4.112
Common Client	104.0.15.2
Decomposer	3.15.3.0
NIS Shared Components	2005.3.0.74
SymNetDrv	6.0.6.604

Symantec AntiVirus Fixes

Lotus Notes profile created in the incorrect directory

Fix ID:

Symptom:

Solution:

RTVScan holds open user profiles after a user logs off of a session using Citrix Metaframe or Web Presentation server

Fix ID:

Symptom:

Solution:

Symantec AntiVirus Client unable to recover from corrupted definitions and accumulation of .vdb files in 7.5 folder

Fix ID:

Symptom:

Solution:

RTVScan error on logoff

Fix ID:

Symptom:

Solution:

Dell Optiplex 745 computers fail to start after installing Symantec AntiVirus

Fix ID:

Symptom:

Solution:

Future-dated events in the Symantec AntiVirus log files are forwarded multiple times

Fix ID:

Symptom:

Solution:

Scheduled scans run as "missed events" after a client roams to another parent server

Fix ID:

Symptom:

Solution:

Blue screen occurs when Symantec Antivirus definitions are repeatedly backdated then reapplied

Fix ID:

Symptom:

Solution:

The Symantec Event Manager service registry key's permissions are reset each time the service is reloaded

Fix ID:

Symptom:

Solution:

An empty GUID is reported when running Symantec AntiVirus on a computer with two network cards

Fix ID:

Symptom:

Solution:

While logging on the computer, a new user profile is created

Fix ID:

Symptom:

Solution:

Symantec Client Firewall Fixes

Script error when viewing Symantec Client Firewall logs with Internet Explorer 7 installed

Fix ID:

Symptom:

Solution:

Maintenance Release 6 (MR 6)
This section describes the fixes in Maintenance Release 6 of Symantec AntiVirus 10.1 and Symantec Client Security 3.1.

Components

Component	Version
Symantec AntiVirus	10.1.6.6000
Symantec Client Firewall	8.7.4.110
QServer	3.5.4.71
Symantec AntiVirus Reporting	1.0.223.0
AMS	6.12.0.147
AntiSpam	2005.3.0.31
Auto-Protect	9.7.2.3 (a)
Behavior Blocking	2.3.0.2
Common Client	104.0.13.2
Decomposer	3.2.14.26
DefUtils	3.1.13.0
ECOM	51.3.0.11
IPS	6.2.2.2
LiveUpdate	3.1.0.99
NAVAPI	4.2.0.8
NIS Shared Components	2005.3.0.71
SymEvent	12.2.1.2
SymNetDrv	6.0.5.506
SymSentry	2.1.0.101

Symantec AntiVirus Fixes

Using the login scripts for migration does not force a reboot

Fix ID:

Symptoms:

Solution:

Continuous LiveUpdate window in Symantec System Center does not reflect current configuration

Fix ID:

Symptoms:

Solution:

AntiVirus Server Rollout does not find computers across a VLAN

Fix ID:

Symptoms:

Solution:

ClientRemote installs Symantec AntiVirus server instead of client during migration

Fix ID:

Symptoms:

Solution:

Symantec AntiVirus server does not provide Symantec AntiVirus for Handhelds definitions to clients

Fix ID:

Symptoms:

Solution:

NetWare server shows an "out of memory" message after running a scheduled scan

Fix ID:

Symptoms:

Solution:

Symevent is uninstalled and Auto-Protect disabled after migration

Fix ID:

Symptoms:

Solution:

NetWare server abends when scanning .gsh files

Fix ID:

Symptoms:

Solution:

Symantec AntiVirus excludes infected files on read-only media

Fix ID:

Symptoms:

Solution:

OpenScanningMode=0 registry value disappears from Symantec AntiVirus clients

Fix ID: 990596

Symptom:

Solution:

Scheduled Scan deletes the SID's shell folder startup registry value

Fix ID:

Symptom:

Solution:

Duplicate domain GUIDs on NetWare servers

Fix ID:

Symptom:

Solution:

Quarantine Server version changes after migrating to Symantec AntiVirus 10.1 MR4 MP1
Fix ID: 819184
Symptom: After you install Symantec AntiVirus 10.1 MR4 MP1 to the Quarantine Server, the version of the Qserver.exe file appears to be updated.
Solution: Updated the Quarantine Server build scripts to show the correct version information.

Entries for Completed Scans disappear from Scan History after refreshing the NetWare Symantec AntiVirus console
Fix ID: 644997
Symptom: When you refresh the NetWare Symantec AntiVirus console, the entries for Complete scans disappear from the Scan History window.
Solution: Made the history window full size so it doesn't change and fixed the cursor so that it doesn't disappear.

NetWare login script fails on Tablet PCs
Fix ID: 898197
Symptom: When you use a NetWare login script to install Symantec AntiVirus on a Tablet PC, the installation ceases to respond and does not complete.
Solution: Added a pause to VP_Log32.exe to allow for a WM_Close command to complete.

Symantec Client Firewall Fixes

Multicast packets use default rule set

Fix ID:

Symptom:

Solution:

Reporting Server Fixes

Cannot view details about a computer that shows as infected in computer status logs

Fix ID:

Symptom:

Solution:

Only one email sent for multiple virus events

Fix ID:

Symptom:

Solution:

Reporting Agent Status window reports shows a date in the future

Fix ID:

Symptom:

Solution:

Database backup agent error shows incorrect path when using a remote SQL server

Fix ID:

Symptom:

Solution:

Maintenance Patch 1 for Maintenance Release 5 (MR 5 MP 1)
This section describes the fixes in Maintenance Patch 1 for Maintenance Release 5 of Symantec AntiVirus 10.1 and Symantec Client Security 3.1. You can apply this patch over Symantec AntiVirus 10.1.5.x or Symantec Client Security 3.1.5.x. To learn how to obtain and apply the patch, read Applying Maintenance Patch 1 for Symantec Client Security 3.1 and Symantec AntiVirus 10.1 Maintenance Release 5.

Components

Component	Version
Symantec AntiVirus	10.1.5.5010
Symantec Client Firewall	8.7.4.104
QServer	3.5.5.57
Symantec AntiVirus Reporting	1.0.207
AMS	6.12.0.142
AntiSpam	2005.3.0.31
Auto-Protect	9.7.2.3
Behavior Blocking	2.2.0.7
Common Client	104.0.13.2
Decomposer	3.2.14.26
DefUtils	3.1.13.0
ECOM	51.3.0.11
IPS	6.2.2.2
LiveUpdate	3.1.0.90
NAVAPI	4.2.0.8
NIS Shared Components	2005.3.0.66
SymEvent	12.2.1.2
SymNetDrv	6.0.4.402
SymSentry	2.1.0.101

Symantec AntiVirus Fixes

"Faulting application Rtvscan.exe, version 10.1.5.5000, faulting module I2ldvp3.dll..." appears after installing Symantec AntiVirus 10.1.5.5000

Fix ID:

Symptom:

Solution:

Symantec AntiVirus clients do not appear in Symantec System Center after applying the SYM06-010 point patch

Fix ID:

Symptom:

Solution:

Event ID 7009 or Event ID 7011: "Timeout (30000ms) waiting for a transaction response from the SAV service"

Fix ID:

Symptom:

Solution:

Symantec AntiVirus service fails to start when using network paths

Fix ID:

Symptom:

Solution:

Roaming Profiles are not deleted on a Windows 2003 Terminal Server

Fix ID:

Symptom:

Solution:

SAVRoam service not restarted after applying a Maintenance Patch

Fix ID:

Symptom:

Solution:

Defwatch Quick Scan no longer runs after installing Symantec AntiVirus 10.1 Maintenance Release 4

Fix ID:

Symptom:

Solution:

SAVRoam fails when the parent server is unavailable

Fix ID:

Symptom:

Solution:

VPRemote install log file path is hard-coded

Fix ID:

Symptom:

Solution:

Installation of Symantec AntiVirus fails when using HP's Radia deployment software

Fix ID:

Symptom:

Solution:

Symantec AntiVirus server does not purge logs after 30 days

Fix ID:

Symptom:

Solution:

Symantec Client Firewall Fixes

Symantec Client Firewall permissions are not used when running a Program Scan

Fix ID:

Symptom:

Solution:

Point Patch 1 for Maintenance Release 5 (MR 5 PP 1)
This section describes the fixes in Point Patch 1 for Maintenance Release 5 of Symantec AntiVirus 10.1 and Symantec Client Security 3.1. You can apply this patch over Symantec AntiVirus 10.1.5.5000 or Symantec Client Security 3.1.5.5000. To learn how to obtain and apply the patch, read Applying Point Patch 1 for Symantec Client Security 3.1 and Symantec AntiVirus 10.1 Maintenance Release 5.

Components

Component	Version
Symantec AntiVirus	10.1.5.5001
Symantec Client Firewall	8.7.4.97
QServer	3.5.5.57
Symantec AntiVirus Reporting	1.0.207
AMS	6.12.0.142
AntiSpam	2005.3.0.31
Auto-Protect	9.7.2.3
Behavior Blocking	2.2.0.7
Common Client	104.0.11.1
Decomposer	3.2.14.10
DefUtils	3.1.13.0
ECOM	51.3.0.11
IPS	6.2.2.2
LiveUpdate	3.1.0.90
NAVAPI	4.2.0.8
NIS Shared Components	2005.3.0.58
SymEvent	12.1.2.1
SymNetDrv	6.0.4.402
SymSentry	2.1.0.101

Symantec AntiVirus Fixes

"Faulting application Rtvscan.exe, version 10.1.5.5000, faulting module I2ldvp3.dll..." appears after installing Symantec AntiVirus 10.1.5.5000

Fix ID:

Symptom:

Solution:

Symantec Client Firewall Fixes
No fixes for Symantec Client Firewall are included in this patch.

Maintenance Release 5 (MR 5)
This section describes the fixes in Maintenance Release 5 of Symantec AntiVirus 10.1 and Symantec Client Security 3.1.

Components

Component	Version
Symantec AntiVirus	10.1.5.5000
Symantec Client Firewall	8.7.4.97
QServer	3.5.5.57
Symantec AntiVirus Reporting	1.0.207
AMS	6.12.0.142
AntiSpam	2005.3.0.31
Auto-Protect	9.7.2.3
Behavior Blocking	2.2.0.7
Common Client	104.0.11.1
Decomposer	3.2.14.10
DefUtils	3.1.13.0
ECOM	51.3.0.11
IPS	6.2.2.2
LiveUpdate	3.1.0.90
NAVAPI	4.2.0.8
NIS Shared Components	2005.3.0.58
SymEvent	12.1.2.1
SymNetDrv	6.0.4.402
SymSentry	2.1.0.101

Symantec AntiVirus Fixes

NetWare server abends when unloading Symantec AntiVirus on a parent with a large number of clients

Fix ID:

Symptom:

Solution:

Imaged computer cannot join a domain after using Sysprep

Fix ID:

Symptom:

Solution:

Drive not spinning down with Rtvscan.exe running

Fix ID:

Symptom:

Solution:

High memory utilization with SAEX

Fix ID:

Symptom:

Solution:

UDP rules applied to all locations

Fix ID:

Symptom:

Solution:

When "PluginInstalledOnlyOnPrimary" is set to 0 for the SCFsesa plugin, no events are sent from parent

Fix ID:

Symptom:

Solution:

Server Group server tuning options are not shared with other servers

Fix ID:

Symptom:

Solution:

Application error against NLNHook.exe

Fix ID:

Symptom:

Solution:

Disconnecting and reconnecting a computer to the network does not recognize network change

Fix ID:

Symptom:

Solution:

Windows and NetWare Logon Scripts fail when using Symantec Client Security 3.1

Fix ID:

Symptom:

Solution:

Scheduled LiveUpdate is not removed when moving client groups

Fix ID:

Symptom:

Solution:

AMS does not alert on certain events

Fix ID:

Symptom:

Solution:

When threat status indicates Adware/Spyware, Audit Network feature no longer displays correct client type

Fix ID:

Symptom:

Solution:

Installing Symantec AntiVirus 10.01 server to an existing server group from a command line creates a duplicate group

Fix ID:

Symptom:

Solution:

Liveupdate fails to run when installing Symantec AntiVirus from a command line

Fix ID:

Symptom:

Solution:

SavRoam for Enterprise Security Manager fails with Enterprise Security Manager 6.5 installed

Fix ID:

Symptom:

Solution:

Global Security Exclusion settings are not propagated to client groups when changes are made from the server group level

Fix ID:

Symptom:

Solution:

Symantec System Center sometimes crashes when security risks are repeatedly added to Global Security Risk Exclusions

Fix ID:

Symptom:

Solution:

Symantec AntiVirus on NetWare causes errors scanning long filenames

Fix ID:

Symptom:

Solution:

Symantec AntiVirus 10.0.2 ABENDs

Fix ID:

Symptom

Solution:

Symantec AntiVirus ABENDs in VPStart.nlm

Fix ID:

Symptom:

Solution:

NetWare login scripts do not fill in the $FILE_SERVER$ variable correctly

Fix ID:

Symptom:

Solution:

Long directory names cannot be viewed on NetWare Servers

Fix ID:

Symptom:

Solution:

Continuous LiveUpdate settings revert to default settings

Fix ID:

Symptom:

Solution:

Cannot see server groups across VLANs during remote server deployment

Fix ID:

Symptom:

Solution:

CPU spike when installing with Terminal Services disabled

Fix ID:

Symptom:

Solution:

Client tracking is not turned off by default

Fix ID:

Symptom:

Solution:

Scan histories from different levels in Symantec System Center do not match up

Fix ID:

Symptom:

Solution:

NetWare 6.5 SP 5 server abends when Symantec AntiVirus 10.1.4 runs a scheduled scan

Fix ID:

Symptom:

Solution:

Symantec Client Firewall fixes

Cannot import policy after importing a specific set of rules

Fix ID:

Symptom:

Solution:

Phantom IP address is reported in Symantec Client Firewall log

Fix ID:

Symptom:

Solution:

Clients managed by secondary servers do not receive a policy file when you deploy a policy at the client group level

Fix ID:

Symptom:

Solution:

Symantec AntiVirus Reporting

Custom virus search links in Reporting are invalid due to Symantec Web site change

Fix ID:

Symptom:

Solution:

Reporting is slow to transfer data to the database

Fix ID:

Symptom:

Solution:

Reporting does not work correctly with a proxy connection

Fix ID:

Symptom:

Solution:

Reporting requires local user account on Reporting Server

Fix ID:

Symptom:

Solution:

Maintenance Patch 1 for Maintenance Release 4 (MR 4 MP 1)
This section describes the fixes in Maintenance Patch 1 for Maintenance Release 4 of Symantec AntiVirus 10.1 and Symantec Client Security 3.1. This patch can be applied only to computers that run Symantec AntiVirus 10.1.4 or Symantec Client Security 3.1.4. To learn how to obtain and apply the patch, read Applying Maintenance Patch 1 for Symantec Client Security 3.1 and Symantec AntiVirus 10.1 Maintenance Release 4.

Symantec AntiVirus Corporate Edition 10.1.4.4010-1

Shared Components

Shared Component	Version	Build
Symantec AntiVirus	10.1.4	4010-1
Quarantine Server	3.5.4	56
AMS	6.12.0	142
Auto-Protect	9.7.1	4
Behavior Blocking	2.2.0	7
Decomposer	3.2.14	10
LiveUpdate	3.0.0	160
NAVAPI	4.2.0	8
SymEvent	12.0.3	1
Common Client	104.0.11	1

New fixes

Server Group Server Tuning Options do not propagate to secondary servers

Fix ID:

Symptom:

Resolution:

Virus definitions do not update until the Symantec AntiVirus service restarts

Fix ID:

Symptom:

Resolution:

Symantec AntiVirus service (Rtvscan.exe) does not start

Fix ID:

Symptom:

Resolution:

Improved handling of Rapid Release definitions

Fix

ID:

Symptom

Resolution

Roaming between parent servers starts a scheduled scan

Fix ID:

Symptom:

Resolution:

Symantec Client Security 3.1.4.4010-1

Shared Components

Shared Component	Version	Build
Symantec Client Security	3.1.4	4010-1
Symantec Client Firewall	8.7.4	84
Symantec Client Firewall Administrator	8.7.4	84
Ad Blocking	2005.3.0	30
SymNetDrv	6.0.3	303
SymSentry	2.1.0	101
IPS (SymIDSCo)	6.2.2	2

New fixes

User permissions are not applied to ALEScan

Fix ID:

Symptom:

Resolution:

Messaging for Exchange does not work properly with Symantec Client Firewall

Fix ID:

Symptom:

Resolution:

New clients do not apply policy files from the parent server

Fix ID:

Symptom:

Resolution:

SSIM SMNP traps sometimes do not have the MAC and/or IP addresses for Symantec Client Firewall events

Fix ID:

Symptom:

Resolution:

Maintenance Release 4 (MR4)
This section describes the fixes in Maintenance Release 4 of Symantec AntiVirus 10.1 and Symantec Client Security 3.1.

Symantec AntiVirus Corporate Edition 10.1.4.4000

Shared Components

Shared Component	Version	Build
Symantec AntiVirus	10.1.4	4000
Quarantine Server	3.5.4	55
AMS	6.12.0	142
Auto-Protect	9.7.1	4
Behavior Blocking	2.2.0	7
Decomposer	3.2.14	8
LiveUpdate	3.0.0	160
NAVAPI	4.2.0	8
SymEvent	12.0.2	1
Common Client	104.0.8	3

New fixes

Symantec Client Security and Symantec AntiVirus Elevation of Privilege vulnerability (SYM06-010)

advisory

Restricted Users cannot run LiveUpdate

Fix ID:

Symptom:

Resolution:

Files copied to floppy/USB drive not encrypted when using Hitachi Hibun encryption software

Fix ID:

Symptom:

Resolution:

When using .mbox format for storing electronic mail, the inbox file is quarantined when a virus is found

Fix ID:

Symptom:

Resolution:

AMS reports the action taken as "undefined"

Fix ID:

Symptom:

Resolution:

Symantec Client Security 3.1.4.4000

Shared Components

Shared Component	Version	Build
Symantec Client Security	3.1.4	4000
Symantec Client Firewall	8.7.4	79
Symantec Client Firewall Administrator	8.7.4	79
Ad Blocking	2005.3.0	30
SymNetDrv	6.0.2	211
SymSentry	2.1.0	101
IPS (SymIDSCo)	6.2.2	2

New fixes

Symantec Client Security server migration hangs during a migration from Symantec Client Security 3.0.2 to Symantec Client Security 3.1

Fix ID:

Symptoms:

Resolution:

The SAV Parent Netspec does not reapply itself after a network change

Fix ID:

Symptom:

Resolution:

Symantec SecurePort service fails randomly

Fix ID:

Symptom:

Resolution:

Maintenance Patch 1 for Symantec Client Security 3.1 and Symantec AntiVirus 10.1
Versions of this patch are available for installation over Symantec Client Security 3.1 or Symantec AntiVirus 10.1.

Unable to enter Standby with Symantec AntiVirus service enabled
Fix ID: 1-4XG3PT
Symptom: The computer will not enter Standby mode while the Symantec AntiVirus services are still running.
Resolution: The Symantec AntiVirus service was preventing Standby mode by calling the DefUtils library unnecessarily. Changed it to call DefUtils only when there are new virus definitions.

Scan engine failure during manual scan
Fix ID: 1-5J7F4G
Symptom: While running a manual scan, a scan engine failure occurs. The error reported is 0x20000058.
Resolution: The scan was trying to run before it got the login account of the user, so it would fail for permissions reasons. Changed code to wait (approximately 60 seconds maximum) to get the login account so that manual scans are successful.

Auto-Protect does not give warning when it cannot use definitions
Fix ID: 1-58FE31
Symptom: If definitions are deleted and new definitions are pushed to the client, Auto-Protect will not reload definitions until the computer restarts.
Resolution: Added check for valid definitions. Auto-Protect now loads the new definitions without requiring a restart.

Roaming profiles are not saved at shutdown
Fix ID: 1-581TK3
Symptom: When Symantec AntiVirus 10.x is installed, roaming profiles are not saved when the computer shuts down.
Resolution: Added code to allow the roaming profiles data to be saved.

Repeating entries in Wbemprox.log
Fix ID: 1-4LW4BQ
Symptom: Large numbers of errors are logged in the Wbemprox.log file.
Resolution: Connecting to Windows Security Center results in an error when run on Windows 2000. The fix was to avoid updating the Windows Security Center unless running on Windows XP or a later version. The logging errors stop after the Symantec AntiVirus service starts.

Cannot scan with PointSec Media Encryption installed
Fix ID: 1-4SCR15
Symptom: With PointSec Media Encryption installed, Symantec AntiVirus can not perform a scan.
Resolution: When there is a gap of about 60 seconds or more between the Windows login and the PointSec Media application login, the manual scan fails. When the PointSec Media application prompts for login, the shell is not initialized, and the user is still logging in. Fixed by having Symantec AntiVirus process the log again after VPTray is loaded.

SymSPort fails
Fix ID: 1-5NAZ08
Symptom: If a network connection with a NULL device name exists on the system, SymSPort crashes.
Resolution: Made changes to handle network connections with NULL device names.

Symantec AntiVirus 10.x changes the Last Accessed date after scheduled or manual scan
Fix ID: 1-5G86I8
Symptom: Manual or scheduled scans change the Last Accessed date on files that are not protected by Windows File Protection or read-only, which triggers backup applications to back up the files unnecessarily.
Resolution: Code changes made to preserve the Last Accessed Date on scanned files.

Extension exclusions are not propagated under same circumstances as folder exclusions
Fix ID: 1-4NHFUX
Symptom: When a folder exclusion is set at the server group level, the setting is automatically propagated to the clients. When an extension exclusion is set at the server group level, the setting is not automatically propagated to the clients.
Resolution: Added fix to always update exclusions on clients when new changes are present.

Without the Ad Blocking component, error "SymAdBlockinUI is null or not an object" occurs
Fix ID: 1-503XY4
Symptom: On a Symantec Client Security client installed without the Ad Blocking component, the error "SymAdBlockinUI is null or not an object" occurs if the user interface is open while a policy is pushed to the client.
Resolution: Added validation code to check whether Ad Blocking is enabled. This prevents the error from occurring.

Symantec Client Security 3.1 and Symantec AntiVirus 10.1 (includes Maintenance Release 3)
This section describes the fixes in the first release of Symantec Client Security 3.1 and Symantec AntiVirus 10.1. For a list of new product features, read What's new in Symantec Client Security 3.1 or What's new in Symantec AntiVirus Corporate Edition 10.1.

Symantec AntiVirus Corporate Edition 10.1.0.394

Shared Components

Shared Component	Version	Build
Symantec AntiVirus	10.1.0	394
Quarantine Server	3.5.0	52
AMS	6.12.0	142
Auto-Protect	9.7.1	4
Behavior Blocking	2.2.0	7
Decomposer	3.2.14	8
LiveUpdate	3.0.0	160
NAVAPI	4.2.0	8
SymEvent	12.0.2	1
Common Client	104.0.7	3

New fixes

Symantec System Center 10.0 slow to retrieve log files from legacy servers

Fix ID:

Symptom

Resolution

Manual or scheduled scan on NetWare sets Meta Data archive bit

Fix ID:

Symptom

Resolution

Clients show offline in Symantec System Center when they're still online

Fix ID:

Symptom

Resolution

NetWare server abends after upgrading NetWare 6.5 to Support Pack 5 with Symantec AntiVirus 10.0 installed

Fix ID:

Symptom

Resolution

Error: "The wizard was interrupted..." with "WriteCCSettingsTables" error in the install log

Fix ID:

Symptom

Resolution

Error: "Loader cannot find public symbol: netdbgethostbyname for module VPSTART.NLM" when installing Symantec AntiVirus 10.0 to NetWare

Fix ID:

Symptom

Resolution

Odd Central Quarantine Event entries under the Event Actions configuration menu

Fix ID:

Symptom

Resolution

ADDLOCAL= in Vpremote.dat causes Symantec AntiVirus 10.0.2 client installations to fail

Fix ID:

Symptom

Resolution

Security Risk exceptions are not available in Symantec System Center if the parent server is NetWare

Fix ID:

Symptom

Resolution

Symantec Client Security 3.1.0.394

Shared Components

Shared Component	Version	Build
Symantec Client Security	3.1.0	394
Symantec Client Firewall	8.7.0	58
Symantec Client Firewall Administrator	8.7.0	58
Ad Blocking	2005.3.0	30
SymNetDrv	6.0.2	211
SymSentry	2.1.0	101
IPS (SymIDSCo)	6.2.2	2

New fixes

Policy file is not applied when migrating from Symantec AntiVirus to Symantec Client Security

Fix ID:

Symptom

Resolution

Using IP Address in a pRule does not function properly

Fix ID:

Symptom

Resolution

Unlocked rules on a Symantec Client Firewall client are deleted after deploying a policy file

Fix ID:

Symptom

Resolution

Secure Port and ISservice fail to load at startup

Fix ID:

Symptom

Resolution

"Any Version" in Prule creation continues to prompt for user action

Fix ID:

Symptom

Resolution

SSL E-mail does not work with Privacy Control

Fix ID:

Symptom

Resolution

Document ID: 2006050314483048
Last Modified: 09/14/2009
Date Created: 05/03/2006
Operating System(s): Windows 2000, Windows XP Professional Edition, NetWare 5.1, NetWare 6.0, NetWare 6.5, Windows XP 64-Bit Edition 2003, Windows Server 2003 32-bit Edition, Windows Server 2003 64-bit Edition, Windows XP Media Center Edition 2005
Product(s): Symantec AntiVirus 10.1, Symantec Client Firewall 8.7, Symantec Client Security 3.1
Release(s): Symantec AntiVirus 10.1 [All Releases], Symantec Client Firewall 8.7 [All Releases], Symantec Client Security 3.1 [All Releases]