Endpoint Protection

 View Only
  • 1.  I want to black autorun

    Posted Jul 17, 2014 04:42 AM

    Greeting,

    I want to black autorun, but I am concern if I block the autorun is there any impact will infect the system?

    and where I can block through the Symantec endpoint protection or through Group Policy?

    Thank you.

     



  • 2.  RE: I want to black autorun

    Posted Jul 17, 2014 04:49 AM

    but I am concern if I block the autorun is there any impact will infect the system?

    If you will blocked autorun.inf you can reduse virus attackes.

    You can blocked autorun from SEPM

    How to protect systems with SEP from an autorun.inf that links to malware.

    Article:TECH201440 | Created: 2013-01-08 | Updated: 2013-01-08 | Article URL http://www.symantec.com/docs/TECH201440

     

    Preventing viruses using "autorun.inf" from spreading with "Application and Device Control" policies in Symantec Endpoint Protection (SEP) 11.x and 12.1.x

    Article:TECH104909 | Created: 2008-01-09 | Updated: 2011-12-14 | Article URL http://www.symantec.com/docs/TECH104909

    Eliminating viruses and security risks

    Article:HOWTO27280 | Created: 2010-01-08 | Updated: 2010-01-15 | Article URL http://www.symantec.com/docs/HOWTO27280

    The default Application Control rule to block Autorun triggers when a USB drive with no autorun.inf is connected

    Article:TECH162983 | Created: 2011-06-22 | Updated: 2011-06-30 | Article URL http://www.symantec.com/docs/TECH162983


  • 3.  RE: I want to black autorun

    Posted Jul 17, 2014 06:43 AM

    Use this, this is from Symantec, its readymade. you just need to import and apply :) 

    Preventing viruses using "autorun.inf" from spreading with "Application and Device Control" policies in Symantec Endpoint Protection (SEP) 11.x and 12.1.x

    http://www.symantec.com/business/support/index?page=content&id=TECH104909



  • 4.  RE: I want to black autorun

    Posted Jul 17, 2014 07:03 AM

    I want to black autorun, but I am concern if I block the autorun is there any impact will infect the system?

    Most of the cases which i have seen that when ever autorun is enable the usb will autorun when plugin and the virus enter in the system with autorun coding.

    If you can stop it and manully open the usb after scanning there is not way to virus to enter in system.

     

    Preventing viruses using "autorun.inf" from spreading with "Application and Device Control" policies in Symantec Endpoint Protection (SEP) 11.x and 12.1.x

    Article:TECH104909  | Created: 2008-01-09  | Updated: 2011-12-14  | Article URL http://www.symantec.com/docs/TECH104909

    How to protect systems with SEP from an autorun.inf that links to malware.

    Article:TECH201440  | Created: 2013-01-08  | Updated: 2013-01-08  | Article URL http://www.symantec.com/docs/TECH201440

    Preventing a virus from using the AutoRun feature to spread itself

    Article:TECH104447  | Created: 2008-01-21  | Updated: 2013-12-12  | Article URL http://www.symantec.com/docs/TECH104447

    Disable from microsoft

    http://support.microsoft.com/kb/967715

    where I can block through the Symantec endpoint protection or through Group Policy?

    Both of the option is good to block the autorun functionality but i am suggest you to do it from symantec for safely applied.

    Because from symantec it will applied on all of the system where it be installed and from GP it will fail in some cases.

     

     

     



  • 5.  RE: I want to black autorun

    Posted Jul 17, 2014 08:06 AM

    This is already setup in the default ADC policy, you simply need to just apply it.

    You can see this link for more detail:

    How to protect systems with SEP from an autorun.inf that links to malware.



  • 6.  RE: I want to black autorun

    Broadcom Employee
    Posted Jul 17, 2014 11:05 AM

    Hi,

    Could you confirm the SEPM version details?