Endpoint Protection

Download Insight not working in 12.1 Ru1

http://files.brothersoft.com/security/keylogger/keystroke-recorder-software.exe

Above site and file infected with virus, it also showing on Norton Safe site.

But symantec Endpoint Protection 12.1 RU1 not able to stop from downloading, we already setting on client as well as on symantec endpoint protection manger but there is no luck to slove th issue. 

more details find the attachment.

Hi Sandip,

I would recommend to enable insight for symantec trusted & then check.

This is a an explanation taken from www.symantec.com/docs/HOWTO55250:

• Symantec and Community Trusted

  This level skips files that are trusted by Symantec and the Symantec Community.

• Symantec Trusted

  This level skips only files that are trusted by Symantec.

Symantec Community are all the users of Symantec products. So the files signed by Community as Trusted, are in the category "Community Trusted".

Please keep in mind that the suggested security option is "Symantec Trusted" from Symantec.

Some more links to this explaination:

How Symantec Endpoint Protection uses reputation data to make decisions about files

http://www.symantec.com/docs/HOWTO55275

To know more check this Whitepaper on Symantec Insight on 

https://www-secure.symantec.com/connect/downloads/insight-deployment-best-practices-whitepaper

Symantec Download Insight, check this Video:

https://www-secure.symantec.com/connect/videos/symantec-download-insight-symantec-endpoint-protection-121

Hope this helps you!!

may the file downloaded from the site does not have reputation. submit the file to security response.

also how did you get to know that the file is infected?

Hello Sandip,

I'd suggest to have a technical case created for this issue and provide he above link to security response team.

If possible install an unmanged client and check if you're able to access that link.

Awaiting update!!

Cheers!

Either your symantec Endpoint Protection 12.1 RU1 is not updated or the update for the virus infected file haven`t relesed.... for SEP.

You are right that Nortan safe show its Infected but it all depend on the GIN.

OR may be the file won`t be infected just the signature or some other matched criteria woulkd had showed IT .

Thanks to all of you for comment......

Thats a good idea to raise case to symantec support