Endpoint Protection

Hi All,

In some of My clients when ever they are inserting pen drive all the files including folders also becoming short cut even i am using autorun.inf file in application control policy the path of target shortcut file is as velow

c:/windows/System32/cmd.exe..

I am using symantec 12.1 ru1 mp1

It is becoming big headache for me please give solution asap.

Regards

Vinod

Hello

You can submit the infected file to Symantec for analysi. Symantec can provide the defintion according to the virus to clean it

https://submit.symantec.com/essential

Using Symantec Help (SymHelp) Tool, how do we Collect the Suspicious Files in SEP 12.1  and Submit the same to Symantec Security Response Team.

https://www-secure.symantec.com/connect/articles

https://www-secure.symantec.com/connect/articles/using-symantec-help-symhelp-tool-how-do-we-collect-suspicious-files-and-submit-same-symante

Symantec Help (SymHelp)

http://www.symantec.com/docs/TECH170752

Have you disabled autorun? You need to.

You can submit a sample to security response as well.

Also, did you run a full scan of the system in safe mode?

Hi

Please submit the infected files to Symantec Security Response for analysing

Regards

Hello,

Are running the SEP 12.1 client with latest definitions and carry all the latest Microsoft updates and security patches on the machine?

Run a scan in safe mode with networking to remove the virus.

Could you zip each of the folders and submit the zip files (without password) to the Symantec Security Response Team on : 

https://submit.symantec.com/websubmit/essential.cgi

We also offer a self-service site to analyze files, at http://www.threatexpert.com, which can give you more information on the files you submit to it.

What to do when you suspect that a Symantec AntiVirus product is not detecting viruses

http://www.symantec.com/docs/TECH99222

In your case, it is also advisable to follow few important steps:

1) Make sure all these machines are Patched with ALL Latest MS security patches and service packs.

2) Make sure the machines are installed with the Latest Symantec virus definitions.

3) Disable the Autorun Feature on the machine via GPO. http://support.microsoft.com/kb/967715

4) Disable System Restore before you do this as the virus also creates entries in the System Restore Points store volumes.

Also, check this Article:

Using Symantec Help (SymHelp) Tool, how do we Collect the Suspicious Files and Submit the same to Symantec Security Response Team.

Hope that helps!!

Hi

Have you got a chance to submit the files to Symantec Security Response.

Regards

Kindly update the current status of your issue. If it is sorted then please mark the helping comment for Solution.

Have you been able to remedy this?

@ _Brain

No I tried all methods and no solution

but i got solution by installing Microsoft security solutions.

Strange but true

Regards

Vinod Kumar D

Have you submitted the virus sample to symatec security team?

Did you submit it?