I was wondering why Symantec Antivirus Corporate Edition version 10 was showing 400 files scanned during a defwatch scan. This isn’t the scheduled scan. In the past, a defwatch scan is a scan of the files in quarantine and the scan has not shown up in the Scan History.
I found a KB article That explains this:

After you update virus definitions, a Defwatch scan runs. In the Scan Histories view, the “Total files” column the Defwatch scan entry shows a number of files that is more than the number of files in quarantine.
Solution:
This behavior is expected. In Symantec AntiVirus Corporate Edition 9.x or earlier, a Defwatch scan only scans the files that are in quarantine. In Symantec AntiVirus 10.x, the Defwatch scan also runs a Quick Scan. The Quick Scan scans any program files that are loaded into memory and common virus and security risk loading points.

Another nice improvement in SAV 10.