The Symantec Endpoint Protection client user interface displays a red status at the top of the Window stating "Proactive Threat Protection is disabled." Proactive Threat Protection in the product list displays as "Off" and "Waiting for updates."
In the Windows Event Viewer application log you see the following entry: Event ID 74 TruScan has generated an error: code 14: description: CAL Failure
During a TruScan or Proactive Threat Scan, the scan will attempt to authenticate to and then scan all running processes. If the TruScan cannot scan an application due to a difference in required authentication credentials or due to technologies such as file encryption, then a CAL Failure is triggered by TruScan. This condition can correct itself without direct intervention. On the next TruScan that runs, assuming all running applications can be accessed properly by TruScan, the CAL Failure will not occur and the PTP status will change back to On with a green status light.
A new Eraser Engine update was made available on 11/19/08 to address this issue. Please run LiveUpdate and ensure all affected clients receive the Eraser Engine Update. To verify the update has been provided to a Symantec Endpoint Protection client the Eraser Engine version can be verified under Help and Support>Troubleshooting>Versions. The Eraser Engine version containing the update is version 7077890.262147.