Most antivirus products these days have a unique ID stored in the registry so that management consoles can distinguish the clients. In you are using some form of cloning in your organisation this can cause problems with clients not updating or reporting back to the management console.

This week I ran into this very issue with eTrustITM v8. Fortunately all you need to do is delete a couple of ID values from the registry before running sysprep.

For eTrustITM delete the following key:
HKEY_LOCAL_MACHINE\SOFTWARE\ComputerAssociates\eTrustITM\CurrentVersion\ID

For eTrust Antivirus delete the following:
HKEY_LOCAL_MACHINE\SOFTWARE\ComputerAssociates\eTrustAntivirus\CurrentVersion\ID

Remember to do this immediately before running sysprep otherwise the clients will register again, particularly if you do a reboot before running sysprep. In my builds I usually have a sysprep.cmd that deletes keys like this and then runs sysprep.exe.