Scan Engine stops responding and possibly crashes when "same virus infections" option is used in "Outbreak" settings and this "Outbreak" is triggered.
Symptoms The Scan Engine service crashes and/or stops responding if Outbreak Management is enabled and the "Same Virus Infections" limit is reached.
The Application Log of the Windows Event Viewer may show the following event: Source: Application Error Category:  Event ID: 1000 Description: Faulting application symscan.exe, version 126.96.36.199, faulting module symscan.exe, version 188.8.131.52, fault address 0x000681cc.
Alternatively, the Application Log of the Windows Event Viewer may also show: EventID: 103 Source: SYMCScan Description: The Scan Engine has crashed Date/time of event = 2008-06-06 07:22:01 Event Severity Level = Error.
For Scan Engine 5.1.x, Symantec recommends upgrading to build 5.1.8, where this issue is resolved. For Scan Engine 5.2.x, Symantec recommends upgrading to build 5.2.1, where this issue is resolved.
To workaround this behavior until you can deploy a build where this issue is repaired, disable the "same virus infection" option of the Outbreak settings.
To disable "Same Virus Infections" in Outbreak Management: 1. Launch the web based GUI for Scan engine. 2. Select Monitors from the left hand column. 3. Expand the hidden column to the right of the column that Monitors is in. You will see two small arrows one on top of the other. The top one points left, and the bottom one points right. Click and drag to the right to expand the hidden column. 4. Select Outbreak from under Views. 5. Uncheck Same Virus Infections. 6. Apply and Save the change.
Imported Document ID: TECH89558
Subscribing will provide email updates when this Article is updated. Login is required.