Symantec Offline Image Scanner

Symantec Offline Image Scanner (SOIS) is a stand-alone tool for Symantec Endpoint Protection (SEP) users to scan and detect threats in offline VMware disk images. SOIS runs on Windows and is capable of scanning virtual disks (.vmdk files) used by virtual machines created with VMware products.

Symantec's enterprise security products (Symantec Endpoint Protection, Symantec AntiVirus) currently lack the capability to scan VMware virtual disks. SOIS fills this gap by providing the ability to scan VMware virtual disks and detect threats in them. This version of SOIS has detection capabilities only, and does not remediate the detected threats. The threats detected are logged in XML format and may be used to manually remediate threats by bringing the virtual machine online.


When you run SOIS and specify folders to scan, it scans only .vmdk files present in those folders (and their sub-folders). However, SOIS scans all files present in .vmdk virtual disks including files within containers such as .zip files. SOIS does not support nested VMware disk image files. That is, if a .vmdk file is found inside a .vmdk file, SOIS does not scan that file. SOIS is capable of scanning multiple .vmdk files present in the folders that have been specified for scanning.


SOIS scans virtual disks with FAT32 and NTFS file-systems only. Other file-systems are not supported.


SOIS is specific to VMware virtual images and does not support other virtualized solutions such as HyperV and Xen.

Support Information