Video Screencast Help
Search Video Help Close Back
to help

Security Community Blog

Showing posts tagged with Endpoint Protection (AntiVirus)
Showing posts in English
Joao Costa | 13 Jun 2011 | 0 comments

Some random bit of knowledge that I ran across today while troubleshooting a Symantec Endpoint Protection Manager 11.x issue with a customer: 

Sometimes you may need to specify the Php.ini path in IIS (Handler Mappings of the Reporting virtual directory > edit the PHP entry) by adding the 8.3 path (short DOS path) to php-cgi.exe followed by –c parameter and 8.3 path to Php.ini (for more information check Specifying which php.ini the Endpoint Protection Manager (SEPM) Reporting website uses). This is useful or maybe even required if you have more than one PHP version installed in your server.

In this case I tried to find the 8.3 Path of the SEPM folder to add it in IIS with the dir /X switch but it simply didn’t exist. This particular SEPM folder didn’t have a short path..

...

Chad Dupin | 01 Jun 2011 | 0 comments

ITS Partner is looking to hire a few Symantec Security Consultants / Engineers.

 

Location

West Michigan / Grand Rapids, MI Area.

Job Summary

This position will be focused on the implementation of Symantec security products within various customer environments. Job responsibilities include assessing customer needs and expectations, designing solutions to meet those needs, and then implementing the design. In addition to these activities the consultant will participate in the sales process (proposal creation, presentations, sales calls, demos, etc.). This position has the opportunity to grow into a leadership role within ITS to help guide and direct the security team.

Preferred Technical Qualifications

  • Symantec Endpoint Protection
  • Symantec Endpoint Encryption
  • Symantec Data Loss Prevention
  • Control Compliance Suite
  • PGP

Technical Knowledge

...
w-d | 28 Apr 2011 | 0 comments

It happens many times that you try to install SEP or SEPM and at the end it rolls back.

To avoid losing time by guessing what could be the cause of such issue it is worth to find the installation log and look. It gives you much useful information and sometimes helps you to resolve the problem very quickly.

 

Installation log’s names for the above products are:

sep_inst.log for SEP

sepm_inst.log for SEPM

 

Usually they are stored in the temporary folders:

C:\Windows\temp

or

C:\Documents and Settings\User_Name\Local Settings\Temp (where User_Name is currently logged user. You can open this temp by typing %temp% in start -> run)

 

If the installation log will not be found in none of those locations, you can search for those names on your whole disk.

If still cannot be found, you might have to force the...

Govardhan | 25 Apr 2011 | 0 comments

It’s the security officers responsibility to overview the firm’s infrastructure risk exposure and trends in real time. Unfortunately, none of the industry leading security products has a feature to create a consolidated risk report that can help the top security officers to review and keep track with risk events.

As I’ve great exposure into SEP DB schema, I’ve developed a SQL query that generates a consolidated report in a high level format classifying the risk events into below categories:

if user name matches *admin*, report it as "Admin account access"
if user name matches "system", report it as "SYSTEM account access"
if file name matches "unavailable", report it as "unavailable"
if file name matches "*Program Files*|*C:/Winnt*", report it as "System Folders"
if file name matches "*Temporary Internet Files*|*Mozilla/Firefox/Cache*",...

Hear4U | 19 Apr 2011 | 0 comments

Hi folks,

We are trying to get an idea of how many people on Connect actually use the site as their preferred method for resolving their issues.  Answering this will obviously not impact your experience on the site, nor impact our interest in helping you resolve your questions.  Thank you for participating, and please only vote 1x.

 

If the poll does not show for you, please click here to cast your "yes/no" vote.

 

If you would like to provide more information, we'd appreciate knowing the following:

  • How often do you visit the site (daily,weekly, monthly)
  • Do you visit the site primarily to (post questions, comment on other's questions, post & publish content like articles and blogs

...

riva11 | 15 Apr 2011 | 3 comments

I found another good resource to to check how is safe or weak a password.  In the example below, I tested an easy password  : " password  " and The Password Checker (  Strength Test - http://rumkin.com/tools/password/passchk.php ) gives an estimation about how strong is this password in terms of strenght, entropy and charset size.

 

  • Warnings are shown if you enter a common password.
  • Warnings are shown if your password is very short (4 or less characters) or if it is short (less than 8 characters)
  • Password strength is determined with this chart, which might be a bit of a stretch for a non-critical password:

          < 28 bits = Very Weak; might keep out...

Elisse | 13 Apr 2011 | 0 comments

 

OPSWAT released their latest quarterly antivirus market share report recently, announcing Symantec as the leading antivirus vendor in North America with 16.24% of the market. OPSWAT’s report used more than ninety-two thousand opt-in reports from endpoints worldwide to determine the most commonly installed security applications. The opt-in reports, generated by OPSWAT's AppRemover and Am I OESIS OK? tools, utilize the detection capabilities of the OESIS Framework to determine which applications are installed on the endpoint computer.

Symantec was also reported in the top five vendors worldwide and had multiple individual products listed as leading products in North America and worldwide. The details of these ranking are shown in the full report, which can be accessed at opswat.com/media/reports. The full report includes sections for antivirus vendors and products in North America and worldwide, Windows...

jomargonzales | 06 Apr 2011 | 0 comments

I have discovered an online tool whihc is very useful in analyzing file if malicious or not.

Virustotal is a service that analyzes suspicious files and URLs and facilitates the quick detection of viruses, worms, trojans, and all kinds of malware detected by antivirus engines.

URL:

http://www.virustotal.com/

mon_raralio | 05 Apr 2011 | 2 comments

I'd like to share the free tools I downloaded from the Internet. These are the tools that I use almost on a daily basis in deplyoment and troubleshooting SEP clients for the past few months. All of these are freeware so you can use it as long as management approves. So, here goes:

  • PingInfoView - Used to ping multiple clients by list. Either hostname or IP and you can select either ping once or continous and also set the maximum time to wait before timeout. This one doesn't get detected as a malware by Symantec. I use this with the reports of non-reporting clients to check if they're online before starting up the Sylink replacer. You can copy or export the results into a spreadsheet.
  • PSList - a DOS utility from SysInternals that I use to show the running processes. Although you can use the tasklist in DOS which is already available in XP by default. I follow this with:
  • PSKill - a DOS utility from SysInternals to terminate processes on...
riva11 | 27 Mar 2011 | 0 comments

A nice infographic made by the Information designer Jess Bachman,  that tell us how the malware business works.  This flow chart "follows the point of infection to monetary gain of the botmasters, scammers and fraudsters who operate these nefarious lines of code."

Source : Computerschool.org