Hello all,

This is my first blog post, but I hope to continue these in the future as situations arise, to help others with their SEP Deployments.

At my Organization we currently have 2 SEP Managers (MR4 MP1), that are replicating between each other. Our primary site is running on a Windows 2003 R2 SP2 Machine and has its DB on a separate server running SQL 2005 SP2 on a Windows 2003 R2 SP2 machine. Our Secondary Site is on a Windows 2003 R2 SP2 Machine running SQL 2005 SP2 on the same machine. These Sites are connected over a DS3 WAN Link approx. 200 Mi apart.

This past weekend the blade that is running the primary sites SQL DB failed, and the SEP Manager informed all of our administrators approx. 5-10 min prior to our other monitoring solution. I know that this looks bad for our primary server monitoring system, however SEP alerted us to a Database Down incident first, which got the ball rolling, and it also pointed out that we need to fine tune our primary...

Symantec recently released the findings of its 2009 Storage and Security in SMBs survey, which indicate that some small business are neglecting important information safeguards due to tight budgets and lack of time and IT staff resources.

According to the survey, small and mid-sized businesses (SMBs) clearly understand the importance of security and report that protecting their information, network and servers are their top goals. But despite understanding the risks they face, a surprising number of companies are neglecting basic safeguards.

More than half have not implemented endpoint protection to safeguard laptops, desktops and servers against malware. Almost half do not backup their desktop PCs, leaving their important information at risk.

Finally, one-third of SMBs do not have the most basic protection of all -- antivirus protection. Small business owners are working with many fewer resources and any missteps could shut them down. Every dollar and every...

This zip file contains sample reports provided by Jeff Van Gundy on February 26th at the San Diego User's Group meeting. I have also included a message from Jeff on how to instruct customers to deal with the issue with MR4 MP1.

San Diego Altiris User Group.

Thank you for your time yesterday. I was glad to share the capabilities of Symantec Endpoint Protection with you. As I mentioned before, you can always expect to get straight information from me. I and Symantec value you as customers. We understand that you have invested time and money in our solution. Therefore, it is imperative that we make sure we are direct and honest with you in regards to our security portfolio and how it can impact you. It's easy to stand up and tell you how great we are. It's not so easy when we have an issue. But if I and Symantec are to have integrity, then we need to give you all information both good and bad.

Yesterday I told you that we have an issue with Symantec Endpoint...

W32.Sality

Overview
W32.Sality is a parasitic virus which infects shared drives and Windows executable files by putting its code to host files. It contains downloader functionality to further install Trojan or key logger components. Sality opens a backdoor that allow the remote attacker to get the full control over the infected computer and in turn the confidential information, representing a serious security risk.

Aliases
Microsoft - Virus: Win32/sality.am
Kaspersky - Virus.Win32.Sality.aa

Symptoms
W32.Sality has the following symptoms:

• Modifies System.ini files (Check for the modified date)
• Services listening on the network port(s).
• Unexpected network trafic to one or more of the domain(s).
• No access to File Monitor.
• Disables Safe mode boot
• Disables regedit and taskmanager
• Disables Antivirus

Characteristics
Upon execution, it starts...