• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 5080
  • Last Modified:

Symantec AntiVirus - Auto-Protect is disabled

I have some computers on my network that are getting a error message where Auto-Protect is disabled.  The service for AV is not running which is causing this error message.  I start the service and then when the computer is restarted, the service for AV has not started.  It is set to Automatically start.  I have some computers that are not having this problem.  I have checked everthing but at whits ends to what is causing this situation.  There are no events taged in the event viewer logging a problem with AV.  I did find an event on one machine with ID 6 that states Auto-Protect is disabled because registration of the virus databases failed.  Anyone have any ideas
0
sandra_mayo
Asked:
sandra_mayo
  • 9
  • 5
  • 4
1 Solution
 
jhyieslaCommented:
I would try removing the AV from the PC, reboot and then reinstall.
0
 
sandra_mayoAuthor Commented:
I forgot to mention the version- Symantec Corporate version 10.0.  I have already tried removing the AV from the PC and rebooting and reinstall.  I still get the same problem.
0
 
jhyieslaCommented:
Are you running this on the client as managed or unmanaged?
0
When ransomware hits your clients, what do you do?

MSPs: Endpoint security isn’t enough to prevent ransomware.
As the impact and severity of crypto ransomware attacks has grown, Webroot has fought back, not just by building a next-gen endpoint solution capable of preventing ransomware attacks but also by being a thought leader.

 
sandra_mayoAuthor Commented:
As managed but had difficulties with trying to run it has unmanaged.
0
 
Leon TealeCommented:
i have the exact same issue and have done for past couple of months....i have done EVERYTHING to try resolve this...and still it occurs :(
0
 
jhyieslaCommented:
Try this.

Uninstall the product from your PC and reboot.

Then start up the registry editor (standard caveat about the danger of editing the registry), and goto HKLM\software\intel\landesk and see if you have a VirusProtect6 Key.  Export the key... just in case.. and then delete the key.  Then install the product again.  See if that fixes your problem.
0
 
Leon TealeCommented:
i know this isnt my question but i would also like to point out that this is happening on numberous machines
0
 
jhyieslaCommented:
I realize that.  And this may not be the answer.  But we've used this product for years and for no apparent reason I've had a small number be unable to start and the fix usually has been the deletion of that key and the reinstallation of the product.
0
 
sandra_mayoAuthor Commented:
ok, Symantec Support sent me instructions on how to manually remove AV from your computer.  I had to delete a lot of registry keys and one of the last steps was to search for this key and delete all keys and values that contain this string.  But, I don't remember if is was in this particular place.  Should I still try this?  I have done everything just like the other person and still the service will not be started after you restart the machine.
0
 
jhyieslaCommented:
Symantec's instructions should have included the Key that I referenced, but you could always check to be sure.
0
 
Leon TealeCommented:
do you happen to have a copy of what symantec sent you? would be suuuuch a huge help :)
0
 
jhyieslaCommented:
Unfortunately I do not.  I did find this on their web site, but it will probably take you to what  they sent to you:

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2002031914291648

There used to be a program they had written that would do all of this for you, but I couldn't find it so either it's not there any more or I just missed it.  Normally just following hte procedure that I outlined above has fixed problems for me.  If not, then following the more manual process has always worked.

If' you're doing all of this and still can't get the service to start, I'd start to suspect some incompatibility between SAV and something recently installed on your PC.  Did you make any recent changes or download an patches right be fore the problem started?


0
 
Leon TealeCommented:
in my scenario...all the computers are basicaly the same..and its the server that roles it out..tis completely random, timing, computers,users,programs running...

so hard to make a decision to what could be causing it.
0
 
jhyieslaCommented:
I have that same basic scenario.  With a new PC, I do install "manually" from the server so that the client ends up knowing that it should talk to the server to get updates and then the client shows up in the Control Center.

We've used the 10.x stuff for ages.  What point release are you using?  We're up to 10.1.5.5010.  I know that there are at least a couple of point releases beyond this and then there is the new product 11.x, but this version seems to be pretty stable for us and I've not felt the need to move up to the next level of 10.x or to 11.x.
0
 
jhyieslaCommented:
Sorry, hit submit too soon.. I wanted to also say that the only time I had a situation where the service wouldn't start, it has always been solved by a uninstall, remove that key if necessary, and reinstall.  The only time I've ever had to use the manual uninstall method is if the automatic uninstall failed.

That's why I was asking about something new on the PC, but it appears, as you say, a more random event.

Do you have one of these PCs that you could either do a wipe and reinstall of Windows or even the repair that wipes and replaces the Windows files?  It wouldn't directly answer you question, but may solve the problem.  

Also, if one of the PCs you're having issues with has XP and you've recently added in SP3, try removing SP3.
0
 
sandra_mayoAuthor Commented:
In the instructions from Symantec Support, they do instruct you to remove this key VirusProtect6.  I did delete the key.  But, these computers also run Symantec PCAnywhere so some of the keys they mentioned to delete I did not because they instructed only to delete these if you were only running Symantec Security Client.  Could the problem be somewhere in there where I did not delete all the keys because of PCAnywhere.  Also, the machines are running Service Pack 2 on them.  I am a New Network Administrator at this company and this is a pre-existing problem that I have inherited.  I also ran Norton's Cleanup Utility hoping that might fix some other registry/file problem with the program.  But to no affect.  The service will not start and display a big yellow warning about Auto-Protect is disabled.
0
 
sandra_mayoAuthor Commented:
I wanted to let you and the other person know that I did run the OS Repair on one of my machines that was giving me this trouble and it worked.  It fixed the problem with the service not running.  Now the service runs on this machine.  I will be doing this on my other machines.  It maybe a little lengthy process but one that does fix the problem.  Thanks so much for suggesting this.
0
 
jhyieslaCommented:
That's good news.   Symantec makes good products, but if they get weird it can sometimes be a pain to get them back on track again.
0

Featured Post

What Security Threats Are We Predicting for 2018?

Cryptocurrency, IoT botnets, MFA, and more! Hackers are already planning their next big attacks for 2018. Learn what you might face, and how to defend against it with our 2018 security predictions.

  • 9
  • 5
  • 4
Tackle projects and never again get stuck behind a technical roadblock.
Join Now