Endpoint Protection

OK.  I put a message out here a few weeks ago when I was evaluating version 11.  I was hoping that this would be fixed in version 12, but unfortunately it is not.  We are now a "paying customer" instead of just evaluating. I hope that will have a little more weight in trying to get this fixed, or at least tell me what I need to do to make it work the way it looks like it should.

The basic problem is that even though I've told it not to pop-up a message letting me know that it found a virus in an Outlook e-mail, it is doing so anyway.  I have also changed the message that it puts into the subject of an e-mail, and it is still reflecting the old setting.  Here are some screen prints.

First, here is the message that I'm getting:


Here is the subject modification that occurs, despite the change that I made:


My understanding is that in order to turn this message off, I should go to Change Settings, click Configure Settings beside the "Virus and Spyware Protection" option, click on the Outlook Auto-Protect tab, and click the Notifications button.  Here is a screen shot of that form:



as you can see, the "display the following message..." check box is clearly unchecked.  So, why is it dispalying the alert?

Also, if I click on the Warning button to change the way it changes the subject, you can clearly see that I've changed the message there as well:



"I've changed it to put "[VIRUS]" in front instead of "Security risk found in message", but as you can see from the screen print above, it is still adding "Security risk found in message".

If I understand correctly, this is an "unmanaged client".  In other words, I don't have the manager installed, nor do I want to install it.

Am I misunderstanding how this thing works, or is there a problem with the software?

Jesse

The pop up that you are seeing is enabled from the "File System Auto Protect" page (see below).
Unchecking that option will disable the popup.

I do not have a File System Auto-Protect option.  When I go into settings, this is the screen I get:


I have been through the various sections, and I do not see a File System Auto-Protec option. What you show above appears to be the manager, which I did not install, and do not want to install.  Is that what you have above?

Plus, it doesn't make sense that this would be a File System thing when the message was not a file, but an e-mail received in Outlook that triggered it.

Jesse

Hi VorlonShadow,

Cycletech's screenshot is from SEP SBE 12's management component, the SPC.  (In SEP 11, the management component is te slightly more complex SEPM). 

Make the changes to the policy there in the SPC and apply the policy to all clients.  The behavior will change on all SEP 12 clients in the organization.

Hope this helps!  If further assistance is necessary, do visit the forum again (there's a specific one for SEP small business) or contact Tech Support.  One way or another, we'll get SEP SBE 12 working the way you like.

Thanks and best regards,

Mick 

Well the problem (as stated before, if I understand correctly) is that I do not have the "management component" installed, nor do I want to install the management component. It doesn't make sense to me that I would have to use a management console to make a change when I installed it "un-managed" to begin with. It would seem to me that if I make the change to my client software, then the change should be made...end of story, right?  If I tell it not to notify me of a virus in outlook e-mail, then that's what it should do, right?  Why should I have to install a whole big management console to make that change??

If I've got to install that, then I guess I will, but it doesn't make any sense to gunk my system up with even more software to make a simple change that I've already made in the client.

Jesse

Are you guys stumped on this one?

Jesse

I don't have experience with SBE12 per se, but speaking from a SEP 11 standpoint the answer to your question is that you don't need to install the management console.  If the client was installed as "unmanaged" then you make changes directly on that client.  Just realize that if you have a whole office full of unmanaged clients you have to make this change on each client.

Based on the screenshot in your original post, I would have to agree with Cycletech that it is the File System Auto Protect component detecting the virus.  This is different then the Outlook Auto Protect component.  I don't know enough to explain why the File System component is detecting the virus instead of the Outlook component.

On the client click the Options button that is next to Virus and Spyware Protection.   Look for an option called Change Settings or something similar to that.  Find the tab that says File System Auto-Protect and under Notifications you can uncheck the box to display a notification.  Note that you typically need to have administrator rights to make these changes.

That is exactly what I have done, and exactly what I explained in the original message, screen prints and all.  I installed it unmannaged, I went in and made the changes to the client, and the changes are not working.  I only have two computers here, so I'm not concerned about having to "run around the office" making changes".  We are going to use the other licenses for another "site" that we have, and he will deal with those 2 or 3 computers.

Why would this be a "file system auto protect" alert?  it was triggered by an e-mail that was received with an attachment that was a virus.  I understand that the attachment is a file, but it was contained in an e-mail.  Besides that, the e-mail was tagged in the subject line with the default "security risk found in message" instead of the "[VIRUS]" that I had changed it to. This kind of proves that it's not working, and that it was the Outlook section that found it to begin with.  It appears to me that the Outlook component DID detect the virus, otherwise, it would not have tagged the message with "security risk found" in the subject.

I searched for the File System Auto-Protect the other day when he suggested that.  As a matter of fact, when I found it and clicked on the Notifications button, the "Display a notification message when a security risk is detected" was not even checked.  This means that the orignal alert could not have been the file system auto notification. That is unless this alert is working like the Outlook alert is (in reverse).  So, maybe to turn it off I turn it on and to turn it on, I turn it off?  Besides, even if it IS a file system notification (which I don't believe it is), I don't want to turn those off.  If it finds a virus in my file system, I want to know about it immediately (with an alert).  If it finds one in my e-mail, I don't want it to pop-up an annoying alert, but I do want it to mark it with "[VIRUS]".  But, of course, that's not working.

We just paid $200 for a 5-license copy of this stuff, and while it detects viruses, I think it's a little proud of itself because it wants to notify me even when I tell it not to.  I think it should work as it is set to.  I am going to keep at this until the bug either gets fixed, or we figure out what I'm doing wrong.

Jesse

Anyone have a solution yet?  It happened again today:


Notice that "Location" says "Mail System", not "File System", just like the original screen print.

How do I fix this?

Jesse

Here is one that popped up today:


Again, notice the "Mail System" location.

Jesse

Any progress on this?  I just called someone at Symantec on an unrelated issue.  He let slip, "It wasn't meant to be installed unmanaged", then he seemed to back-step there. Is that really the case?  Was Endpoint not meant to be installed Unmanaged?  If that is the case, that would probably explain it.  However, why allow me to install unmanaged if it isn't meant to be installed that way?

Jesse

Being that I'm getting no response on this, I have had to do some experementing of my own.  After the conversation w/ the fellow at Symantec the other day, I decided to unintsall everything and I re-install managed.  There are some definite benefits to having managed clients, and I like a lot of the features!  Very nice.  However, first, I still think that if you are going to allow someone to install unmanaged that it should work properly, and right now, it is not. 

Second, I am now installed as a MANAGED client. I installed the manager on a WS08 server we have, and have the client installed on that server, and my regular workstation.  Today, I received a virus in email.  I had previously set it up in the manager as I had before in the client to not pop-up a message and to change the subject to say "[VIRUS]" instead of the regular message.  However, despite this, I received the following dialog box when it received the virus:


No message at all in this one.  In addition to this, the subject was changed to "Security risk found in message" instead of the "[VIRUS]" I had changed it to.  So, even when it's managed, this thing isn't working.  In fact, it seems to be worse than when unmanaged (blank dialog boxes).

Someone please help with this.  If I'm doing something wrong, please let me know.  If this is a bug, please fix it, it's driving me nutz, and being that we just paid $200 for this stuff, I can't aford to just let it go.

Jesse

Hi Jesse,

It's probably best to contact Symantec Technical Support for this rather that pursue it in the peer support forum.  

Thanks and best regards,

Mick

Ok, here's the deal with this one.  As suggested, I just called technical support since I was getting nowhere in this forum.  I didn't realize that this was evidentially a soley community supported forum.  Most times, even in a community supported forum on the company's web site, support personnel from the company will chime in and try to resolve the issue.  I guess after the initial reply they just dropped out.

Anyway, the problem consists of several issues, but mostly an interface problem.   When looking at the configuration settings for Virus and Spyware Protection, "Outlook Auto-Protect" does not necessarily mean "Outlook".  It actually means "Exchange Server".  We do not have Exchange Server, we have a different e-mail server.  "Internet Email Auto-Protect"  appears to me to mean "Webmail".  I couldn't understand how they could protect this, but I thought, "Ok, whatever".  What this actually means is "POP3 Email auto-protect"  Being that we do not have Exchange Server, then "Internet Email" is what I needed.  I made that change, but still continued to have the problem. After checking later, I found that it had changed back.  Turns out that since I had installed the manager, it updated the policy from the server, and set it back to what it was before.  I made the change in the manager, and I think I'm set correctly now.  I will know next time I receive a virus in email.

In my opinion, this is an interface problem that is easily corrected. Simply change the title of the tabs to POP3 and Exchange Server or add text on the page for each of the tabs clarifying that "Outlook" means "Exchange Server", and that "Internet email" means "POP3".

Jesse