Endpoint Protection Small Business Edition

 View Only
  • 1.  Symantec Power Eraser/SERT Available?

    Posted Apr 23, 2015 05:41 PM

    In the past we have the Symantec Power Eraser and/or the Symantec Endpoint Recovery Tool (SERT) to resolve difficult malware problems.  Are there two products still available?  I am having difficulty locating the current versions.

    It looks like Symantec Power Eraser may have been replaced by a broader-function product called "Symantec Help?" 

    Thanks.

     



  • 2.  RE: Symantec Power Eraser/SERT Available?

    Posted Apr 23, 2015 05:51 PM
    SERT tool should still be available for download in fileconnect as long as you have a valid serial. Hasn't been updated in awhile. Correct. You can use the symhelp tool to run a threat analysis scan. If you have 12.1.5 you can kickoff a power eraser scan from the SEPM


  • 3.  RE: Symantec Power Eraser/SERT Available?
    Best Answer

    Broadcom Employee
    Posted Apr 24, 2015 04:08 AM

    Hi,

    Thank you for posting in Symantec community & would be glad to assist you here.

    You can see in the following screenshot at fileconnect SERT is available along with the latest versin of SEP 12.1 RU5.

    SERT.jpg

    Symantec power eraser is not replaced by broader-function product called "Symantec Help?"

    Symantec power eraser is now integrated with the SEPM itself. You can run power eraser directly from SEPM console.

    Screenshot is attached to the reference.

    Power Eraser_0.jpg

    Symantec Power Eraser

    Symantec Power Eraser uses heuristics to help identify potential malware before it is detected by anti-malware software definitions.  These heuristics require immediate access to Symantec Insight. For this reason Symantec Power Eraser heuristics will only be applied when the Threat Analysis Scan is run on a system while it is online. If the Threat Analysis Scan is not run online then the Symantec Power Eraser heuristics are not applied to the system. 

    Symantec Power Eraser heuristics are defined in a set of updatable definitions.  Symantec Power Eraser downloads the latest definitions automatically when you run it. The current definitions are version 4/23/2015 r20.  You can determine which definitions were applied to a scan by clicking on the Definitions link in the upper right corner of the Threat Analysis scan report window.

    Symantec Power Eraser also supplies, as a separate option, special rootkit detection heuristics. Selecting this option requires that the system be rebooted. After the reboot the Threat Analysis Scan will use Symantec Power Eraser to examine additional files based on the data collected during the reboot.

    Symantec Power Eraser also provides the means to remove a suspicious file from the system as well as restore it should its removal be later determined to be unnecessary. 

    Threat Analysis Scan:

    Use the Threat Analysis Scan when you believe there might be malware on a system but security software is either unable to detect it or to remediate it. The Threat Analysis Scan can help to identify the following types of malware

    • New variants of existing threats that are not detected by the current definition sets
    • Fake antivirus applications and other rogueware
    • Rootkits
    • System settings that have been tampered with maliciously

    Because the Threat Analysis Scan uses aggressive heuristics to detect these threats, there is a risk that it can select some legitimate programs for removal. You must always review the files identified as suspicious and clear those that are known to be safe applications before taking steps to further investigate or remove those files from a system.  

    By default the Threat Analysis Scan is configured to collect the required data when working with Symantec Support, but it can also be used to find and remove suspicious files without Support assistance.

    Go through these articles for more details:

    About the Threat Analysis Scan

    http://www.symantec.com/docs/TECH215550

    How to run the Threat Analysis Scan in Symantec Help (SymHelp)

    http://www.symantec.com/docs/TECH215519