Endpoint Protection

At my company we are getting 1-3 viruses a week in the form of ave.exe which goes by many names: Antivirus XP, XP Smart Security ,XP Securityand XP Defender Pro to name a few. Does anyone know a way to set Endpoint Manager up to block this attack before it infects a computer?

Use application and Device Control feature..with that you can block this exe.

Even in the firewall rule add this exe so that it is not allowed to connect to any other site or machine.

You will need to setup and application and device control policy to block this file

http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/7049d06ba3c9e86f802573620054d9c2?OpenDocument

You can block this using Application & Device Control Policies. 

The Symantec Endpoint Protection Manager has some nice feathers for controlling applications.
This Article instructs using one of the feathers called "Application Control".

1. Open Symantec Endpoint Protection Manager Console.
2. Select "Policies" on the left pane.
3. Select "Application and Device control" On the left pane.
4. Double click "Application and Device control policy" on the right screen.
5. Select "Application control" On the left pane.
6. There are 7 rule sets already exist by Symantec (block writing to USB, block registry
Editing etc).
7. Click "ADD" to make a new application control rule.
8. Add the rule name.
9. Add (browse) the process name which the rule controls.
10. Click "add" on the bottom left and choose "add condition".
11. Choose the condition type you want to add and press "action" to configure details.
12. Save all.

How to configure Application Control in Symantec Endpoint Protection 11.0 : Configuring Application Control Policies http://service1.symantec.com/SUPPORT/ent-security.nsf/2326c6a13572aeb788257363002b62aa/7049d06ba3c9e86f802573620054d9c2?OpenDocument



Here are some discussions and/or examples of it
https://www-secure.symantec.com/connect/forums/score-one-my-app-control

https://www-secure.symantec.com/connect/forums/yahoo-my-policy-action

Hi Ryukotsei,

Judging from the names of threats that you list, it sounds like you're up against a series of smitfraud/misleading application/rougeware programs.  Here is an article that I recommend: Does Symantec Endpoint Protection protect me from fake anti-virus programs? (http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2010020116202748)

The best practices in there (IDS, bloodhound settings, user education) will help!!

Thanks and best regards,

Mick

This is probably the most important part of getting SEP to be better able to deal with zero day threats, as well as new variants of the same old Fake AV.

How to increase the sensitivity of Proactive Threat Protection in Symantec Endpoint Protection 11.x

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2009120214031748

Another time where my application control policy posted in the articles area will help.
The info to block that baby is in the policy/dat file............ that and others that are like it.

Yeah, I work for a major university and we've had major problems with this since January of this year.

It's suspected that it's coming in through outdated JAVA.  Go to control panel (under and admin account), go to JAVA, and update from there.

Here's how we get rid of it since SEPS doesn't catch it automatically.

1) Try to launch taskmgr.  If you can't (sometimes av.exe or ave.exe will block it from starting), restart the computer.  AS SOON as it logs in, press ctrl-alt-del and launch task manager.    You can get to task manager if you start it up BEFORE the virus is loaded into the processes.  Be vigilant, you just have to be quick.

2) Kill the process av.exe or ave.exe or whatever name it's calling itself in your special iteration.

3) open regedit and do a search for the process you just killed.  Delete any instance of it.  It will be in several locations. 

4) while you're looking through the registry, see where it's storing the file av.exe (usually in the hidden application data folder under the user's profile).  Hard delete the file (hold shift while you delete).

5) After you delete all those keys that include av.exe (or your iteration), it will very likely block your access to opening .exe files.  You'll need to rebuild this association (this is due to your wreckless deletion of registry keys in step 3.  You're so irresponsible!).  to rebuild the association, go to control panel -> folder options -> file types -> New Association.  In the box, type exe, and then click advanced.  From the drop down menu choose Application.  Your associations are back and you can run exes again.

6) By this point you have manually removed the virus's ability to function.  For all intents and purposes it's clean. BUT there are still traces lingering throughout the system.

7) At this stage, download the program malwarebytes, install, update, and run it.  Start a Full scan with it.  It will find a few leftover files and registry entries (nothing big) and then it is completely removed.

Hope this helps!  It works like a charm for us.

Thanks all for the information. I'm going to load up an image of Windows XP and infect it(I have a link that one of our users got the virus from) and see what kind of steps we can take in blocking this particular attack. Thanks Blenahan for the suggestion and all others for the input. I will let you guys know what I come up with most likely sometime this upcoming Monday.

I have followed Blenahan's steps to setup blocks on programs from running including the settings that make these files unable to terminate, run, edit registry or such and still it seems to not work. I have tested this out by trying to block toolbars for IE such as Ask.com, Google, Yahoo etc. Under Application Control i have a Rules that is in Production and blocks processes such as: *toolbar*.*, ytb*.*. I have waited up to 2 days and updated the policy on a machine and tried installing the toolbar both from the site where it puts an exe in the temp folder of the user and runs it and also from saving it and then running it. It has the correct name that should be blocked yet it runs and installs the toolbar. Any ideas?

You should export your policy and attach it here if you can so we can have a look

We have seen this one on a couple workstations. It was a java sploit so we made a killbit to block it.

Windows Registry Editor Version 5.00
 

Be sure to reboot the client(s) on which you're implementing App and Dev Control for the first time.  I had a similar issue where everything worked OK in my test environment so I duplicated the rules into production but they wouldn't work.  I had to reboot the client so it would pick up that I was implementing App and Dev Control for the first time, and the rules worked.

Disable Java in the Internet Explorer (Internet Zone). I have had some success with that setting. GPO wise It is under Java Permissions, Setting Enabled, Disable Java.

 

Delete the users profile and start over, otherwise you will never be able to trust it again. BTW since the Java fixes above have been in place,  I havn't seen this one come back. I tested the fix and can confirm it outwits the exploit. But we have a very complicated security template here so other lockdown restrictions might also be helping.

-Wayne

I have tried restarting the client. Also the [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}] key is not on this computer I am testing on. I will try logging on to the computer now after another restart with a network profile that is new to the computer.

Also I have tried exporting the policy but it only exports it in .dat format that nothing can read.

Restarting and logging in under a new profile and updating EndPoint's definition file again did not fix this issue. I have a rule set up that blocks processes. In that rule these are the items i have listed: *toolbar*.*, ytb*.*, googletoolbar*.exe, c:\documents and settings\%username%\local settings\temp\*toolbar*.exe, c:\documents and settings\%username%\local settings\temp\*ytb*.exe, c:\documents and settings\%username%\local settings\temp\*toolbar*.exe

The .dat file is what I would need to import into my test SEPM and see what it looks like. You can zip and attach to this board