Video Screencast Help

Delete a particular .exe file with SEP

Created: 27 Mar 2013 • Updated: 27 Mar 2013 | 5 comments
diabolicus23's picture
This issue has been solved. See solution.

I'd like to delete a particular file, an EXE file.

I know its hash and I've monitored it through application monitor.

How could I delete it on my clients even if it's not opened/used/modified? I just want to delete it if it's present on the client.

 

I think to act like this:
1) application exception with file signature with quarantine or remove action
2) execution of scan on the clients

My concern is: will an "on demand" scan use the application exception indication?
Is there another and smarter way to obtain this?

Comments 5 CommentsJump to latest comment

.Brian's picture

SEP can't delete files. This is beyond the scope of what SEP can do.

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

diabolicus23's picture

Uhm... if I can add an application exception with a specific hash and assign delete action on it, I think SEP will delete that one when the user launch it.

So SEP could delete files but probably this action is performed only if that file is launched.

.Brian's picture

The file would need to be "actioned" It's not just going to be deleted if it is sitting there.

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

SOLUTION
diabolicus23's picture

Ok thanks.

I've successfully deleted it (as said, when the file is launched) with application exception.
I can verify the result in the SONAR section of Monitoring tab.

Vikram Kumar-SAV to SEP's picture

You can do it if you have SNAC.

Vikram Kumar

Symantec Consultant

The most helpful part of entire Symantec connect is the Search button..do use it.