Unfortunately Citrix did not provide any of the vendor integrated scans in the SDK, so if any changes needed to be made to these scans it would involve 'obtaining' the code from somewhere or writing from scratch.

With access to the source code the change would be easy, I'll be honest I have not looked at the Symantec scan, does it actually look to see if the file exists rather then the process is running?  If that is how it is working then it doen't prove much as an end point scan!

Cheers,

Tim