Video Screencast Help

Security Community Blog

Showing posts tagged with 11.x
Showing posts in English
v16 | 06 Mar 2010 | 18 comments

While searching the web for iPhones, a fake security malware infected my laptop. Although I use Firefox and Symantec Endpoint, the trojan slipped through my XP SP3 system. When I ran a full scan, the March 5 r of Symantec did not identify the problem.  After researching the web, I found a blog at "," which fully described the problem and the solution. I used MalwareBytes' AntiMalware to remove the infected registries and files. Note that the rogue has other names, such as Vista Internet Security 2010, Win 7 Internet Security 2010, and several others.  This rogue must be disabled before it allows other executable files to run. I used FixExe.reg.

Variants of the files infected are as follows.

%UserProfile%\Local Settings\Application Data\av.exe

%UserProfile%\Local Settings\Application Data\WRblt8464P


Warrior6945 | 23 Feb 2010 | 0 comments

 Client install package shows wrong Server details

You have a Primary SEPM and a secondary SEPM installed.
When you create an install package from the secondary SEPM, the sylink file will show the details of the Primary SEPM
After installing the SEP Client with the created install package, the clients reports to the Primary SEPM
Client shows up in the secondary SEPM however with a red arrow
Open the SEP Manager Console
Go to Clients tab and select the group.
Click on the Policies tab of the selected group
Go to Communication Settings
Change the MSL which has the details of the Secondary SEPM
Create the install package again.
Now the sylink file of the package should have the details of the Secondary Server
sezam | 02 Feb 2010 | 2 comments

If during applying the "31 December" patch you get an error "Unable to apply the SEP server patch on this computer".

To solve this issue You need.

1. Stop Symantec Endpoint Protection Manager servcie.
2. Go to "%PROGRAMFILES%\Symantec\Symantec Endpoint Protection Manager\tomcat\webapps\scm\WEB-INF\lib".
3. Delete scm-server.jar
4. Rename scm-server.jar.disabled into scm-server.jar.
5. Start Symantec Endpoint Protection Manager service.
6. Run SEPServerPatch-v6.01.exe again

Now patch schould apply without problems.

snekul | 01 Feb 2010 | 0 comments

Just a quick blog post seems relevent after some problems were encountered with our SEPM server.  After finding preformance lacking a bit on our SEPM server, I fired up the disk defragmenter.  Despite having run it not that long ago, the drive was heavily fragmented.  Our server has 60 GB of space, was about 2/5ths full, and was well over 40% fragmented.  I setup a task to defrag the drive daily during the early morning hours.   Since then, we haven't had a problem with fragmentation on the SEPM server.

Just some background.  Our SEPM server is running Server 2003 x86 and SEPM RU5.  I suspect due to the database backups and the regular definition downloads, that SEPM, by its nature, has a tendency to fragment drives rapidly.

crazeeeeeem | 26 Jan 2010 | 0 comments

Asissoft's release of Sudden Attack ( is a trojan and is collecting Windows passwords.

It works by preventing a user from logging into his/her PC, then providing an form to fill in a password and user name field, which if filled in correctly, will allow access to the user's machine. What its doing is of course well known subterfuge but the business world seems very unaware of the issues and costs, maybe rightly so.

A probably more overt proponent of this method of controlling and obtaining information from unsuspecting users is a company called LogMeIn ( The simply ask for your passwords over the internet.

Since everyone is doing it, I guess they may as well.

mon_raralio | 21 Jan 2010 | 4 comments

We're currently seeing a lot of Mark.W0rm.exe files appearing in our network. At the moment, the only available information is that it is a "test" virus that copies itself to common Windows folders.
Removal is quite simple:

End the task Mark.W0rm.exe in task manager if present and delete the file copied into the following directories:

C:\Documents and Settings\[user]\Local Settings\
C:\Documents and Settings\[user]\My Documents\My Music\My Music.exe
C:\Documents and Settings\[user]r\My Documents\My Documents.exe
C:\Documents and Settings\[user]\My Documents\My Pictures\My Pictures.exe

Note: It may also copy itself on shared folders so you might want to check for that too.

sezam | 18 Jan 2010 | 9 comments

When SEPM console is tried to be open an ERROR: "Could not find the main class Program will exit "  occurs.


The problem is UAC. To make SEPMconsole working properly You need to dissable UAC.

sezam | 14 Jan 2010 | 0 comments
Some time I face with customer which have a problem with continuous SEP installation.

This could be connected with 2 problems:

1. Domain or Local User privileges are to restricted[remember to much restrictions is also not good. You need to know how to balance with restrictions]
2. Installation is corrupted.

This problem is annoying because Windows Installer want to install SEP client continuously which can be very nervous.

Solution for this problem is to:


1. Find UninstalString value for Symantec Endpoint Protection which is situated in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

2. Paste this string to command line with changed option /I to /X (  ex.  MsiExec.exe /X{68B52EFD-86CC-486E-A8D0-A3A1554CB5BC}   ) 

sezam | 14 Jan 2010 | 5 comments


Sometimes SEP client is unable to install itself on Windows7 operating systems.

The problem is connected with 2 issues.

1. EXE file extractor[FreeExtractor] is not working correctly.

Sometimes on Windows 7 setup.exe file cannot automatically extract into %TEMP% folder.
To resolve this issue You need to Extract setup.exe file application like Winrar and install SEP using setup.exe or *.msi file in extracted folder.

2. Live Update application cannot be installed.

To resolve this problem You need to perform first step from point 1. but in hear firstly You need to install Live Update using LUSETUP.exe file after install it using setup.exe or *.msi file.
Second solution is to install SEP as unmanaged client.

sezam | 07 Jan 2010 | 0 comments

Some days ago I faced with an issue.
In a big network all Live Update applications were configured with Proxy[Unmanaged clients]. But the proxy setting were needed to be disabled.

Network configuration is handled by files:
- Settings.LiveUpdate;

- 1.Settings.LiveUpdate;
- 2.Settings.LiveUpdate.

which are situated in C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate folder.

If You have a big environment and You need to perform disabling of proxy setting for FTP an WWW the best is create a script which will delete Settings.LiveUpdate and 1.Settings.LiveUpdate files.

I think It could be useful.