Version: Symantec Endpoint Protection - 12.1.4013.4013
Whenever a new definition arrives, this is the trail I usually see in the Windows Event viewer:
New virus definition file loaded. Version: 140213002
Scan started on selected drives and folders and all extensions.
Scan Complete: Risks: 0 Scanned: 763 Files/Folders/Drives Omitted: 0 Trusted Files Skipped: 703
The scan takes about 8 minutes. During this time (and for up to 30 minutes after!) the computer is very slow... sometimes the mouse freezes for up to 5 seconds, etc. On other people's computers, the same scan takes a few seconds and scans the same number of files, and they don't even notice it.
Often, this additional log is included in the event viewer:
Reputation check timed out during unproven file evaluation, likely due to network delays.
Our network firewall does not record any traffic from my computer during that time!
From other forum discussions, I see that the "Download Insight" feature needs access to https://ent-shasta-rrs.symantec.com/mrclean When I use any browser, inside or outside of our network, and try to access that page, I get this:
400 Bad Request: cannot parse incoming googlebuf
So, some questions...
- Can I turn on more detailed logging, to see how often the "reputation check" is running?
- Is it possible that SEP is being frequently delayed when trying to do the "reputation check", but the delays are not long enough to time out, but are long enough to slow the entire process down?
- What is causing the "400 Bad Request" error? Is that normal?
Thanks!