Endpoint Protection

Hi,

I can't find any official documents saying that Symantec Endpoint Protection can detect malware within an Excel file (vba macros etc). Can anyone confirm?

Thanks

SEP can as long as it has a signature for it. Additionlly, SONAR/heuristics would be able to detect it.

W97M is usually in the detection name, see here for a writeup:

https://www.symantec.com/security_response/writeup.jsp?docid=2014-110100-2117-99&tabid=2

Hello,

Symantec still detects macro virus, check these below - 

W32.Areses.H!vbs

W32.Areses.Q!vbs

W32.Beagle@mm (vbs)

I agree, that we haven't seen many virus or worms associated with excel since a long time. However, that does not mean the macro virus are not detected by Symantec.

I would suggest to ensure all the features of SEP are installed with policies enabled and locked down.

Hope that helps!!

Hi G33k,

Short answer: yes, absolutely.  Malicious macro spam is not just for Word but for all Office docs.  SEP can detect and block known samples from all Office types, but do follow this guide to harden your environment and minimize the risk against infection.  There are millions of new malicious spam mails sent into the wild each week from many different campaigns. 

Support Perspective: W97M.Downloader Battle Plan
https://www-secure.symantec.com/connect/articles/support-perspective-w97mdownloader-battle-plan

Hope this helps!  Please do update with any additional questions or mark this thread solved if you have received your answer.  

With thanks and best regards,

Mick