End Program - Missing virus definitions when logging off

[broc]

Has anyone any ideas why a Windows XP system running Symantec Antivirus Enterprise 10 should keep on displaying a popup window (with prompt to end) titled 'End Program - Missing virus definitions' when the user attempts to logoff ?

 

I have tried uninstalling SAV, removing everything I can find in the registry, rebooting & reinstalling SAV to no effect. SAV looks OK, the virus signature files are current, as is the SAV client code & a full scan runs clean. I cannot find out any more details of which program might be causing this as the popup only exists for maybe 5 seconds before disappearing.

 

It is very frustrating, especially as this is happening on a PC I have been building for a new ghost image & I don't want this problem spreading.

[MusicGeek]

Yes! I have exactly the same problem!

 

I found this forum via Google and yours was the one single hit .... so either there are only two of us, or else it doesn't bother other people. I have done the same things, i.e. remove, reboot, reinstall, several times, all to no avail. I've also gone back to recent previous editions (10.0.1, 10.1.5000) with the same effect. I'm now on 10.1.5010 on XP, mine is Corporate Edition on my home PC because I VPN into work.

 

I've never seen this particular problem before, even though I've been using SAV for almost 10 years. One clue though ... I recently upgraded to a savagely fast quad-core PC .... perhaps a faster PC shuts down quicker as well, and something in SAV doesn't like that?

 

In my case it's just a minor niggle (everything else works fine), but if you're creating a sysprep image then it's a show-stopper really ... could I suggest that you don't install the SAV client on your image, but instead include it as part of the installation process to manually install from the SAV server? If you want to automate that you could do it with AD Group Policy, or something like LanDesk. Something that needs to be updated continually like AV software is not a good candidate for inclusion in a sysprep image.

 

Anyway if I get any information on what's causing this problem I'll update people here.

[treetops]

An age old problem by the looks of it but one that we have.

 

Have tried all of the above and also disabled the notifications for out of date virus defs using Administrator only notifications in every aspect of Symantec control centre on the server.

 

Also tried manually copying the GRC.dat from the server to the client and waiting for it to change the registry and delete itself, which it did, but still the problem persisted,

 

Any ideas anyone?

[Michael]

@broc - The image you're working on, has it been sysprepped previously and maybe you're updating the image? In my experience I have found it better to install AV software after deploying the image using deployment tools.

[treetops]

No, the AV software is not a part of the image. It's rolled out as a CC3 package following the xp build.

[Michael]

In the past using CC3 and Sophos AV, there were a lot of problems with Sophos updating and this was due to strict Software Restriction Policies and incorrect permissions in the registry. An absolute nightmare!

If you logon as administrator, do you still get this problem or just with end users?

[treetops]

I even get it logged in as sytemadmin...

[dwhyte85]

I don't know why it's happening, but mighten it be worthwhile just to tskill the process - i know it's not a fix, at least a workaround for the moment - we have a similar issue with another piece of software, if i don't tskill the process i get support calls because they can't logon :'(

[treetops]

I'm wondering if the clients shutdown sequence is a bit too quick for certain services, so I need to control the order of the service shutdown... more thinking needed me thinks.

[Spiney]

Hi

I stopped by for this very reason..

i found this which you may or may not have considered

 

"end task missing virus definition" | Symantec Connect

 

cheers

[synaesthesia]

I'm wondering if the clients shutdown sequence is a bit too quick for certain services, so I need to control the order of the service shutdown... more thinking needed me thinks.

 

That's exactly what I put it down to on my CC3 networks, where it's very prevalent on modern machines and most laptops - and thats also where Spiney's link looks rather interesting and has now been bookmarked/copied