Unwanted Weekly Scan Scheduled Task Behavior

nod32 Release 3.0.684.0

First, I would like to make it clear that I am using the word scan to refer to a full system scan and not the system start-up check.

We have about 60 machines with this version of antivirus and all of them display the same behavior. Whenever I add a weekly scan task to them they always do a full scan on the next restart. This is where the problem is, even if I allow that scan to finish completely I cannot stop the machine from doing a full scan after every reboot.

The only cure I have found is to remove the weekly scan scheduled task. This stops the initiation of a full scan after every reboot.

I have also tried deleting the task and rebuilding another one after reading that the program can get hung up on task ID discrepancies. Even with all task ID's between client and server matching the problem persists.

Digging around here produced some xml related possible fixes having to do with the (client side?)lastexec parameter being stuck on 777777 and making the program respond as if it had never scanned the machine when in fact it had. I also tried making a back-up of the xml and striking any last exec line with this value in it.... no luck.

While this last thing sounds very much like my problem.. I am unsure if the xml file I am calling up in the remote management software is client or server. If it is client then where is the .xml file stored on the machines?

 

Correct me if I am wrong but by that question is it your thinking that when Nod32 starts it loads an .xml file ?

The clients settings are stored in the registry. After the program is loaded, one can import an .xml file via the program import function. The settings contained in that .xml file will be merged into the registry and placed in the appropriate reg keys\subkeys.

 

Ah... that makes sense... i was meaning where does the xml file come from when i select view/ configuration. I see now that the Administrator console just puts client registry values into an xml for viewing/editing. I have located them in the registry (HKLM/SOFTWARE/Classes/eset/esetSecurity/currentversion/scheduler).

That is something else to look at for changes, thanks.