Data Execution Prevention (DEP) attempts to shut down Symantec Scan Engine service abruptly

Products

• Scan Engine

Issue/Introduction

You need to know why Data Execution Prevention (DEP) program attempts to close Symantec Scan Engine service abruptly and its workaround.

Symptoms
Error Message:

Data Execution Prevention - Microsoft Windows
To help protect your computer, Windows has closed this program.
Name: ‘symcscan.exe'

Cause

DEP program helps in preventing damage from viruses and other security threats that attack by running (executing) malicious code from memory locations that only windows and other programs should use. It also monitors the programs installed on the system if they are using system memory safely. If a program tries to run code (whether malicious or not) from a protected location, DEP closes the program and notifies you.

Resolution

Two options are available for configuring DEP. Either option may be used to prevent DEP from interfering with Symantec Scan Engine operations:

Option 1:
Turn on DEP for essential Windows programs and services only.

Option 2:
Turn on DEP for all programs and services except those I select:

To add the faulting process to the DEP exclusion list:

1. Right-click My Computer and click Properties.
2. Click the Advanced tab, then Settings button under Performance.
3. Click the Data Execution Prevention tab.
4. Click the Add button and browse to the installation folder of Symantec Scan Engine \Program Files\Symantec\Scan Engine, click the executable symcscan.exe that DEP closed and press Apply.

To learn more about Data Execution Prevention and its behaviour :

• http://support.microsoft.com/kb/875352
• http://technet2.microsoft.com/WindowsServer/en/library/b0de1052-4101-44c3-a294-4da1bd1ef2271033.mspx?mfr=true