Using two or more antivirus applications on the same computer

Products

• Endpoint Protection

Issue/Introduction

You want to know if it's OK to run two or more antivirus applications on your computer at the same time.

Resolution

The use of third-party antivirus solutions, concurrent with a Symantec solution that contains antivirus protection, such as Symantec Endpoint Protection (SEP), may cause unexpected behavior and undesired results, and is not supported. You should only run one antivirus program at a time.

Having more than one antivirus program active in memory uses additional resources and can result in program conflicts, false virus alerts, and lowered protection.

Risks of using more than one antivirus program

Antivirus and antispyware programs are generally written with the expectation that they will interrupt actions taken by other programs, in the interest of security. If more than one such program is running, there are a number of ways in which they can interfere with each other.

To give a simple example, suppose that antivirus scanners A and B are installed on a computer. Program A copies a file to a temporary location for scanning. Program B notices the file activity, and copies the file from program A's temporary location to its own. Program A notices that file activity and makes another copy, and so an infinite loop forms. This could end with the computer running out of memory or hard drive space, hangs or crashes in the antivirus scanners, or other undesirable behaviors.

Types of programs that can cause conflicts

The following types of programs should not run concurrently:

• Antivirus and antispyware real-time scanning programs such as Norton AntiVirus, Symantec Endpoint Protection, McAfee VirusScan, or Kapersky AntiVirus.
• On-demand scanning programs, such as the Windows Malware Removal Tool.
• Single-use malware removal tools that are designed to remove files from individual threats.

Types of antivirus programs that can run concurrently

On certain types of servers, there are antivirus programs that specifically scan the content that the server handles. For example, Symantec Mail Security for Microsoft Exchange (SMSMSE) scans the messages that come through Microsoft Exchange, and nothing else. On a server that runs SMSMSE, another antivirus program such as SEP is required to protect the rest of the file system.

Programs such as SMSMSE can run concurrently with real-time scanners such as SEP, provided that they are prevented from scanning the same files. In the case of SEP and SMSMSE, the SEP Auto-Protect real-time scanner has built-in folder exclusions that prevent it from scanning the folder that SMSMSE scans. With other combinations of server and endpoint programs, such exclusions may need to be created manually.