Endpoint Protection

Symantec is not decting svchost.exe and other exe virus files.iam using windows 7 and in every folder an .exe file is automatically creating with same name of folder like if i have a folder by name NEW FOLDER then new folder.exe file created automatically in that folder and i update and complete scan my system but symantec is not detecting any viruses, but there is a lot virus files like that in my system. So please tell me that why symantec is not detecting these files. Please give me solution for this asap.

Thanks.

Submit these files to Symantec for analysis.

How to Use the Web Submission Process to Submit Suspicious Files

http://www.symantec.com/business/support/index?page=content&id=TECH102419

 also check this article

https://www-secure.symantec.com/connect/articles/using-symantec-support-tool-how-do-we-collect-suspicious-files-and-submit-same-symantec-sec

Hi,

unfortunately it is not possible to get and analyze all malicious files before anyone else (customers, competitors, etc.). When it happens, you need to send us the threat as explained above.

To mitigate this issue, you should migrate to SEP 12.1 which brings new technologies to detect new malware.

Hello,

These are the symptoms of sillyfdc worm. you may have to check the infected machine in the network as it might be spreading.

If you have ADC in use with your SEP, you can block that file's MD5 by policy: How to use Application and Device Control to limit the spread of a threat.

I agree with Pete, if you have a support contact with Symantec, make sure you submit your files to Symantec Security Response Team. 

I recommend that you open a case with them and ask for a manual analysis of that suspicious file---- it will receive attention more quickly that way than in its present queue.

Reply to: Mithun Sanghavi

As per your suggestion i already check below link but on this link they mention that it is recomended for 32 bit os not for 64 bit.

(ADC in use with your SEP, you can block that file's MD5 by policy: How to use Application and Device Control to limit the spread of a threat.)

Reply to: Beppe

Dear Beppe we already have SEP 12.1 in our environment but unable to detect this virus, in every folder virus is growing with same folder name.exe files.

Reply to: pete_4u2002

I am trying to get symantec support id for Submit Suspicious Files.

Hi AhmedAli,

The following articles contain a lot of good advice:

Best practices for troubleshooting viruses on a network
Article: TECH122466   |  Created: 2010-01-15   |  Updated: 2011-08-02   | 
Article URL http://www.symantec.com/docs/TECH122466

What to do when a competitor's antivirus, adware scanner, or spyware scanner detects a threat that Symantec AntiVirus does not detect
Article: TECH99494   |  Created: 2001-01-17   |  Updated: 2010-01-09   | 
Article URL http://www.symantec.com/docs/TECH99494

Hope this helps!
 

Hello AhmedAli,

It states, "The Application and Device Control is designed for use on 32-bit operating systems. These steps will not help 64-bit clients. ", that's because in SEP 11.x, ADC does not work on 64 bit machines, however that's not the case with SEP 12.1.

So, this statement does not apply for SEP 12.1.

Hope that helps!!

Reply to: pete_4u2002

From where can i get my symantec support id, i already check my license also but unable to found that id no. so can you please check in this matter.if you nedd i can provide you my symantec customer number or symantec agreement number.

Reply to: pete_4u2002

Thanks for usuall supprt i already got my support id and submit the virus files also.

great!. i also suggest to open a support ticket so that the tracking can be followed and necessary information is provided by support team.

Replt yo: pete_4u2002

I already submit virus files to symantec and they sent me tracking number  24608620.

Ok, however suggest to open a support case since it has come clean. The support team will look into the logs and ask you to submit the suspicious files.

Hi again AhmedAli,

If you have not already done so, please run the load point tool (part of the SEp Support Tool) and work with your case owner to identify any additional suspicious files that Security Response should examine.  The file submitted on that tracking number is not the cause of any malicious activity.