Scan Engine 5.x stops responding and/or crashes when "same virus infections" option is used in "Outbreak" settings and this "Outbreak" is triggered.

Products

• Scan Engine

Issue/Introduction

Scan Engine stops responding and possibly crashes when "same virus infections" option is used in "Outbreak" settings and this "Outbreak" is triggered.

Symptoms
The Scan Engine service crashes and/or stops responding if Outbreak Management is enabled and the "Same Virus Infections" limit is reached.

• The Application Log of the Windows Event Viewer may show the following event:
  Source: Application Error
  Category: [100]
  Event ID: 1000
  Description: Faulting application symscan.exe, version 5.2.0.20, faulting module symscan.exe, version 5.2.0.20, fault address 0x000681cc.
• Alternatively, the Application Log of the Windows Event Viewer may also show:
  EventID: 103
  Source: SYMCScan
  Description:
  The Scan Engine has crashed
  Date/time of event = 2008-06-06 07:22:01
  Event Severity Level = Error.

 

Resolution

For Scan Engine 5.1.x, Symantec recommends upgrading to build 5.1.8, where this issue is resolved.
For Scan Engine 5.2.x, Symantec recommends upgrading to build 5.2.1, where this issue is resolved.

To workaround this behavior until you can deploy a build where this issue is repaired, disable the "same virus infection" option of the Outbreak settings.

To disable "Same Virus Infections" in Outbreak Management:
1. Launch the web based GUI for Scan engine.
2. Select Monitors from the left hand column.
3. Expand the hidden column to the right of the column that Monitors is in. You will see two small arrows one on top of the other. The top one points left, and the bottom one points right. Click and drag to the right to expand the hidden column.
4. Select Outbreak from under Views.
5. Uncheck Same Virus Infections.
6. Apply and Save the change.