Symantec Endpoint Protection Manager 11.x is not updating 32 or 64 bit virus definitions

Posted by T.Redelberger

Problem

Why is Symantec Endpoint Protection Manager 11.x not updating 32 or 64 bit virus-definitions?

Symptoms

Symantec Endpoint Protection Clients do not update virus definitions.

  • Symantec Endpoint Protection Manager shows old virus definitions in "Admin > Server > Local Site >Show LiveUpdate Downloads".

Cause

Old or corrupted virus definitions prevent Symantec Endpoint Protection Manager to update with new downloaded virus definitions.

Solution

Steps to clean Virus Definitions folders and republish Live Update Product Inventory on Symantec Endpoint Protection Manager:

  1. Delete the content of folder %ProgramData%\Symantec\LiveUpdate\Downloads\
    Note: Application Data is a hidden folder. Delete the content of the Downloads folder, but not the folder itself.
  2. Update the LiveUpdate catalog by opening the following link in Internet Explorer:
    http://localhost:9090/servlet/ConsoleServlet?ActionType=ConfigServer&action=PublishLuInventory
    After few seconds you will get a confirmation message "Responsecode="0".
  3. Stop the services "Symantec Endpoint Protection Manager" and "Symantec Endpoint Protection"
    To stop the services:
    1. Go to Start > Run.
    2. Type the following: Services.msc
    3. Select and stop the above mentioned services.
  4. Delete ONLY the numbered or TMP folders inside the following paths:
    • %ProgramFiles(x86)%\symantec\symantec endpoint protection manager\inetpub\content\{1CD85...
    • %ProgramFiles(x86)%\symantec\symantec endpoint protection manager\inetpub\content\{C60DC...
    • %ProgramData%\Symantec\Definitions\SymcData\sesmvirdef32
    • %ProgramData%\Symantec\Definitions\SymcData\sesmvirdef64
    • %ProgramData%\Symantec\Definitions\VirusDefs
  5. Launch the process LUALL.EXE from %programfiles(x86)%\Symantec\LiveUpdate (May be requested to click on "START")
    LiveUpdate should run for some minutes (5-10 min), if some error messages are displayed, exit and launch again LUALL.exe
  6. Restart both Symantec Endpoint Protection services when LiveUpdate is complete.
  7. Verify the numbered folders of virus definitions are created in the following paths:
    (There might be just 2-3 folders in the beginning, but the default number is 10 folders)
    • %ProgramFiles(x86)%\symantec\symantec endpoint protection manager\inetpub\content\{1CD85...
    • %ProgramFiles(x86)%\symantec\symantec endpoint protection manager\inetpub\content\{C60DC...
  8. Log on to Symantec Endpoint Protection Manager Console and launch a LiveUpdate from Admin > Server > Local Site > Download LiveUpdate content.
  9. Verify the correct download/usage of new virus definitions from "Admin > Server > Local Site >Show LiveUpdate Downloads".

Source: http://www.symantec.com/business/support/index?page=content&id=TECH104721&locale=en_US