Video Screencast Help
Search Video Help Close Back
to help
New in the Rewards Catalog: Vouchers for "Symantec Technical Specialist" and "Symantec Certified Specialist" exams.

How to check signature version remotely without using Symantec Console?

Updated: 17 Jul 2010 | 12 comments
SAVuser's picture
0 0 Votes
Login to vote
This issue has been solved. See solution.

Hi all,

We are having issues without our Symantec System Center Console (v10.1.7) reporting the signature versions inaccurately from all distribution servers & hence need an alternative method of checking signatures of Primary & Secondary distribution servers preferably by browsing the file system.
We have a mixture of both Windows & Netware 6.0 servers.
Is this possible?
Any help appreciated.
Thanks in advance.

S.

Comments

Vikram Kumar-SAV to SEP's picture
15
Oct
2009
2 Votes +2
Login to vote

 For

 For windows
\\Servername\C$:\Program Files\Common Files\Symantec Shared\VirusDefs\usage.dat

open the file with notepad and it will show you the Definition date that is used.


Acretian's picture
15
Oct
2009
3 Votes +3
Login to vote

Registry Tweak

You can get the Info from this Registry Location

HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\AV

On this Key you can find two Values  
PatternFileDate  : Current Definition date
PatternFileRevision : Revision

These are Hexadecimal values

Example:
PatternFileDate  : 27090e - 2009 Oct 14 
27090e - YYMMDD Format
27 - 2009
27 Hex is 39 Decimal, this value is since 1970. So 1970+39 = 2009

09 is October (00- Jan, 0B - Dec)
0e Hex - 14 in decimal

PatternFileRevision : 16Hex - 22

16 HEX is 22 in Decimal 

Hope this helps :)

Vikram Kumar-SAV to SEP's picture
15
Oct
2009
0 Votes 0
Login to vote

 @Acretian - This is for SEP

 @Acretian - This is for SEP and SAVUser is looking for SAV 10.x

Acretian's picture
15
Oct
2009
0 Votes 0
Login to vote

Try this is for SAV

The Registry location for SAV 

HKEY_LOCAL_MACHINE\SOFTWARE\INTEL\LANDesk\VirusProtect6\CurrentVersion

Sandeep Cheema's picture
15
Oct
2009
0 Votes 0
Login to vote

I resolve the definition

I resolve the definition corruption for the clients from the parent servers by pushing  the unpacked Rx4Defs. The script replaces the XDB for every run if there is a new one available on the VPHOME. I think this is the snippet that you are looking for.......You might have to modify it to suit your requirement.

verify > nul
set /a check=%date:~10,4%%date:~4,2%%date:~7,2%-2
dir "\\%x%\c$\program Files\Common Files\Symantec Shared\virusDefs\200*" /b>"c:\SAV_Doctor\Defs_Check.txt"
FOR /F  %%i in ('type "c:\SAV_Doctor\Defs_Check.txt"') do if %%i GTR %check% Echo %name%          %x%    Defs_UptoDate>>"c:\SAV_Doctor\Result.txt" & GOTO :eof
Echo %name%          %x%    Out_Of_date>>c:\SAV_Doctor\Result.txt

Check=5 days prior like 20091011 for 11th october 2009
x=machine name or ip address
name=Hostname...List for IP and hostname can be used from SSC. We don't have very good DNS at all the sites so use IP to push and hostname to log.

So, by in large what happens overall is that the XDB on the VPHome is checked, if it's newer than the one within unpacked rx4defs, its replaced, the client is checked if it's alive, if it is, the defintiions are checked, if the definitions are older than 5 days, the utility is pushed and executed. Has been working well for quite some time now...........Runs every day on all the SAV servers.....taming 40k clients.

De facto when AV does something, it starts jumping up and down, waving its arms, and shouting "Hey!  I found a virus!  Look at me!  I'm soooo goooood!"

stryker's picture
16
Jun
2010
0 Votes 0
Login to vote

Rx4Def script

Hello Sandeep,  can you provide me with the script,and any technical instruction how to.
thanks

dmyers's picture
29
Oct
2009
0 Votes 0
Login to vote

Sandeep, How would you go about implementing that script?

Sandeep,

I'm very interested to figure out how you are getting that script to push out to all of your clients.  I've been working on some automation but have been unable to figure out how to make something like that work.  Any info about how to push it out would be greatly appreciated.

Sandeep Cheema's picture
29
Oct
2009
0 Votes 0
Login to vote

Sure, It's a three line code

Sure, It's a three line code that took almost three years of research. I will send you a PM soon.

De facto when AV does something, it starts jumping up and down, waving its arms, and shouting "Hey!  I found a virus!  Look at me!  I'm soooo goooood!"

doflaherty's picture
10
Feb
2010
0 Votes 0
Login to vote

Rx4Defs deployment

Hi Sandeep,

I am looking to deploy rx4defs remotely and would appreciate a look at the code you have created.

Thanks

dmyers's picture
29
Oct
2009
0 Votes 0
Login to vote

Thank you very much.  I'll

Thank you very much.  I'll look forward to your PM.

Sandeep Cheema's picture
29
Oct
2009
0 Votes 0
Login to vote

Sent over.

Sent over.

De facto when AV does something, it starts jumping up and down, waving its arms, and shouting "Hey!  I found a virus!  Look at me!  I'm soooo goooood!"

Twanorati's picture
25
Nov
2009
0 Votes 0
Login to vote

About that script

Sandeep, I am having a similar problem and I think using that script would be a huge help. Just wondering if I could get some details on that as well.