HI,

CHeck this thread

https://www-secure.symantec.com/connect/forums/can...

Hello,

I have read your thread and Symantec check all file, even hidden but not in my case. Also I scan a nas device, I think it is a different behaviour.

Here what happened :

1. Virus hide my share folder on my nas and replace them by exe file
2. I delete exe file and unhide file
3. I activated Symantec Protection Engine
4. After a few hours, virus come back with same behaviour on same shared file
5. Nothing is seen by Symantec

For me, SPE do not check file attribute change or I haven't found the good option.

Thanks

Incase of suspicious activity still happening, then follow the steps provided in the Article below and submit the files to the Symantec Security Response Team:

Using Symantec Support Tool, how do we Collect the Suspicious Files and Submit the same to Symantec Security Response Team.

What gets scanned is entirely determined by the netapp filer. It requests a scan and the scan engine will return a result to the scan engine. You can turn the logging levels up to verbose and see the scan engine results for all files in a detailed report, otherwise you will only see files the scan engine determines to be a threat or ecounters an error scanning a file.

I have check NetApp options and there is nothing about hidden folder or folder attribute. I have confirmation with Netapp support

With verbose options I can see only creation of exe file :

Thu Jan 31 09:22:09 CET 2013, A file has been scanned Event Severity Level : Verbose File name : \\?\UNC\192.168.0.1\ONTAP_ADMIN$\vol\vol_datas\ERF.exe Client SID : S-1-5-21-2043879999-2266753580-3138237620-7629 Client Computer : LPT357 Client IP : 10.123.4.162 Scan Duration (sec) : 0.016 Connect Duration (sec) : 0.047 Symantec Protection Engine IP address : 192.168.8.47 Symantec Protection Engine Port number : 0 Uptime (in seconds) : 152899

Nothing about attribute change. So it means that I don't need Antivirus for NAS because NEtapp do not log this action.

Even if I make a manual scan with Symantec EndPoint Protection 11 Client on my computer to this exe file, nothing is found.