Endpoint Protection

 View Only

  • 1.  ฺBlock autorun.inf in application and device control already but virus can create autorun.inf file

    Posted Oct 29, 2010 06:30 AM

    Hello,

     

    I would like to ask about virus that use autorun.inf. I  block autorun.inf on application and device control  as below.

     

    but today I found some virus can create autorun.inf on my server and open file 1000 file as below.

     

     

    Why virus still can create autorun.inf file that I have blocked? I test create autorun.inf on another server by myself but it unable to created. but VIRUS can???



  • 2.  RE: ฺBlock autorun.inf in application and device control already but virus can create autorun.inf file

    Posted Oct 29, 2010 06:41 AM

     

     

    How to prevent Autorun.inf files being copied 
     
    http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2010041910473748
     
     
    Preventing viruses using "autorun.inf" from spreading with "Application and Device Control" policies in Symantec Endpoint Protection (SEP) 11.x  :
     
    http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2008050910464348
     


  • 3.  RE: ฺBlock autorun.inf in application and device control already but virus can create autorun.inf file

    Broadcom Employee
    Posted Oct 29, 2010 06:44 AM

    ensure it is not set to log mode. and polciy is updated by the SEP client



  • 4.  RE: ฺBlock autorun.inf in application and device control already but virus can create autorun.inf file

    Posted Oct 29, 2010 07:09 AM

    Please attach your policy here. If not, please call into Support hence they can evaluate your policy.



  • 5.  RE: ฺBlock autorun.inf in application and device control already but virus can create autorun.inf file

    Posted Oct 29, 2010 12:19 PM

    Your policy I bet is ONLY set to block the running of autorun files.  Your policy isnt stopping the creation of autorun.inf files, which is not what the default rules do.



  • 6.  RE: ฺBlock autorun.inf in application and device control already but virus can create autorun.inf file

    Posted Oct 29, 2010 10:04 PM

    Hello,

     

    I have share folder on 1 server.

     

    I can see autorun.inf (it's hidden) only when I open that share folder on client machine. What does that mean? because when I logon to that server and open that share folder I didn't see autorun.inf file



  • 7.  RE: ฺBlock autorun.inf in application and device control already but virus can create autorun.inf file

    Posted Oct 30, 2010 04:30 AM

    I have found that the best way to disable autoplay is from GPO



  • 8.  RE: ฺBlock autorun.inf in application and device control already but virus can create autorun.inf file

    Posted Oct 30, 2010 07:28 AM

    Pls double check the folder settings and assure that it is set to show all hidden files in the server...

     

    Also as far as I know this policy will block the execution of executables using autorun.inf file,and it will not delete these files....