Activity Summary not changing after 1 hour

Products

• Endpoint Protection

Issue/Introduction

Activity Summary not changing after 1 hour, computers still appearing as Quarantined, even after clear the quarantine folder manually using Symantec Endpoint Protection Mobile (SEPM).

Environment

• Win7, Win8 64 Bits
• SEP 12.1 RU4

Resolution

1. Disable Tamper Protection either on the SEPM or on the client (by following TECH192023).
2. Stop Symantec Management Client service by opening the "Run" box and executing the command: smc -stop
3. Delete the following files.
   • Windows 2000/XP/2003:
   • C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\CurrentVersion\Data\DB\atpi.db
   • C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\CurrentVersion\Data\DB\av.db
   • Windows Vista/7/8:
   • C:\ProgramData\Symantec\Symantec Endpoint Protection\CurrentVersion\Data\DB\atpi.db
   • C:\ProgramData\Symantec\Symantec Endpoint Protection\CurrentVersion\Data\DB\av.db
4. Navigate to the following registry key.
   • HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\CurrentVersion\public-opstate
   • Modify the DWORD "Infected" to '0'.
5. Start Symantec Management Client service by opening the "Run" box and executing the command: smc -start
6. Enable Tamper Protection.