Use "SymRmvScan" Utility with Endpoint Protection
search cancel

Use "SymRmvScan" Utility with Endpoint Protection


Article ID: 151565


Updated On:


Endpoint Protection


Using Symantec Endpoint Protection (SEP) unidentified scans are happening and their source cannot be identified. The "SymRmvScan" utility needs to be run.


Warning: This utility is provided for customer convenience only. Symantec Technical Support cannot provide support for the use of this utility or any scripts calling this utility. This utility will remove all Symantec Antivirus and Symantec Endpoint Protection scans for all profiles on the system upon which it is run.


  • The "SymRmvScan" utility is only for use in Symantec Endpoint Protection environments. To obtain "SymRmvScan", contact Symantec Technical support at       
  • The zip file is password protected. To unzip the file use the following password: symantec

  • SymRmvScans creates a log file of what was accomplished.  Any discussion of the success or failures of this utility will require this log. The log is named RmvScan.log and is, by default, located in C:\SymRmvScans.

Using the utility:

  1. Extract the file to a convenient location, such as the Desktop, using the unzip password provided above.
  2. Double-click SymRmvScan.exe.
  • Notes:
    • The DOS window should not be closed during any course of action while the tool is running
    • This tool may take several minutes to complete.
    • This tool does not run silently by design.





SymRmvScans_v2.01.exe get_app