I don't see a setting for Express mode in your post, which is the setting I'm looking for. I'm pretty sure that those settings are controlled in the Settings.LiveUpdate files and not in the registry.

Thanks anyway, though.

Hi guys,

I'm administering a small Windows 2003 domain. We are using group policies to install software on our Windows XP clients.

Although it would be possible to install via GPO directly by using the "Symantec AntiVirus.msi" file I would like to make some changes in what is installed. For instance, I dont think our users really need the SAVHelp component...

The "Symantec AntiVirus.msi" file accepts commands from the command line to control what is installed, but as far as I know, it is not possible to issue commands to a GPO installed package.

I have searched the Symantec knowledge base and found this article: Symantec article discussing MST transforms, which suggests creating a MST transform file (we already use a transform file for our Office installation) to make changes to the installation.
So I have become acquainted with Orca, which generates MST files, however, I wouldn't know what to "transform" in the MSI file to make my desired changes appear. Symantec KB doesn't talk about configuring what is installed using MST files.

Have you got any suggestions as to how I might make changes to the installation with GPO distribution in mind?

Thank you.

Best regards
Andreas

I'm not familiar with making MST files in Orca, but you could edit the MSI file it WinINSTALL LE easily enough and remove the sections you don't want installed.

Hi Ryan,

This is great! I am able to define what is to be installed.

Do you know if it is possible to configure the virus definition update interval through wininstall le 2003?

Regards, Andreas

Yes, look back a couple pages for the registry entries involved in doing it.

From there, just go to the registry section of the MSI file in WinINSTALL LE and have the MSI add those entries.

It would be nice if the SAV9 installation guides and all these tips and tricks could be summed up on this page:
http://unattended.msfn.org/xp/applications/sav.htm

I think you want to compress SAV91400 not SAVSource!

I was doing this for some time:
$oem$\Prog$\Symantec\Liveupdate\Settings.Merge.LiveUpdate
$oem$\Prog$\Symantec\Liveupdate\Settings.Host.LiveUpdate

These settings merge at first Liveupdate run into:
"c:\Documents and Settings\All Users\Datos de programa\Symantec\LiveUpdate\Settings.LiveUpdate"
So Liveupdate scan CD for virus def. an other stuff. In facts download:
livetri.zip
symtri.zip
And scan for needed stuff.
I use Liveupdate Administration to keep track of updates, but its 120 Mb of downloads actually, because I used for all Symantec producs.
To slim down the needed updates I peek at:
"c:\Documents and Settings\All Users\Datos de programa\Symantec\LiveUpdate\Log.LiveUpdate"
There is where all the Liveupdate process is logged. So you must first download the requires files to put in the cd:
livetri.zip
symtri.zip
With these files in the "Host file" path, launch Liveupdate: It will recognize the needed updates but fail to download them. But you will get the errors in the log file:

The paths in the example abobe may differ from the host file presented before (should be the same) because is really a log for a NAV2002 update, but you get the idea:
"The files marked with ERROR! should be downloaded from the symantec server"
So for the example abobe you may also download:
http://liveupdate.symantecliveupdate.com/ennfullb.x86
(between other files)
The full update process may require you restart and launch Liveupdate again to get all the updates, so you must repeat the "LiveUpdate Error->Log peek->Download->LiveUpdate Success-Restart"
I personally switch to Liveupdate Administration (hacked*) because is easier to mantain the updates.

Nilfred -)

*The hack consist in a read only and modified products.xml to add the files I need which are not dowloaded by itself.

Been a lurker for about a week now and for the life of me, I have no idea how this site has escaped my attention for so long. Sort of feel like I'm crashin a party here.

Well I just read all 21 pages of this thread, and I hope I didn't miss this, but here goes:

On the distribution CD in the unsupported tools area (where Packager can be found), is a directory called ConfigEd. In there is a little utility where you can generate a GRC.DAT file with all of your desired SAV settings. Place this file in the root of your installation point of SAV and all those settings will be imported into the client at install.

Anyone know if there is a seperate thread for SCS (SAV and the Firewall Client)? Or is this thread open for that discussion too?

hey, don't feel like you're crashing a party at all! for your first post, you nailed it! Using that config util is a MUCH easier and more elegant solution than the registry hack that I came up with.. new blood is always welcome!

-joe

From what I have found on there website sav 9 is up to version 9.0.1.1000

Does anybody know if this is worth updating to?

Actually its up to 9.0.1.1100. Yes its worth updating. That version is Windows SP2 compatible.

I installed XP SP2 and had no problems with 9.0.0.1400, either. However, updates are always required. Is there a patch for 9.0.1.1100, yet?

I haven't found any indication of any version above 9.0.1.1000. Any links to the patch?

@RyanVM & mazin
No patches, and may not be either (coz of the massive extent to which v9.0 got pirated)! Gotta get it direct through sales channels (as of now, atleast ).

@smc1979
If you already have 9.0 slip-streamed to include the latest patch, then don't worry about 9.0.1. It has (almost) the same patch, which permanently uses (additional) 5 MB of memory just for the sake of tying in with the Windows Security Center. Is that good or bad, I leave it to you to decide.


@RogueSpearThere ain't any separate thread existing for SCS. This thread welcomes that discussion as well.

I'm not in a hurry!

Thanks for no-patches confirmation.

I was able to automatically install SAV 9.0 Corporate as described under http://www.msfn.org/board/index.php?showto...ndpost&p=164316 (SAV v9.0.0.1400 and LiveUpdate v2.5.55.0) but now everytime I start the Computer a Explorer window pops off which shows the content of "c:\Progra~1\Symantec". Closing it is not the problem but the next time I boot the computer the window reappears.

The Computer is running German XP Pro SP2

How to solve this?

Thanks
Sebastian

I can only support this method: http://www.msfn.org/board/index.php?showto...ndpost&p=179948

This is usually because you have a bad shortcut in
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
or
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

which is not found. Try all the shortcuts in there and see if any of them is bad, e.g. paste the path in Explorer and remove the filename to see if you end up in an existing folder.

Also check your Startup/Autostart folder or whatever it is called in german windows. Else do as the professionals, always run english version of Windows. If you don't understand the english GUI then you can always put in a german MUI on the english install.

For the record, the version floating around as "9.0.1.1100" is actually 9.0.1.1000 (as I thought). That's the way it shows up within SAV. People were probably confused because some file versions do show as 9.0.1.1100, but the overall program version is still 9.0.1.1000.

For the record

That is not true, version '9.0.1.1100' very much exists. Take a look at the attached screenshot.

weird...

Why do you say wierd? Do you doubt it's authencity?

Not at all. Check your private messages.

, I'm beginning to think Symantec is just messing with my head.

The reason why I ask about the update is because of this

http://www.symantec.com/techsupp/enterpris..._9.0/files.html

Patch: Symantec AntiVirus 9.0.1 Maintenance Patch 1
Release Date: August 25, 2004
File: SAV_9.0.1_MR1-MP1_AllWin_EN.zip (3,034,112 bytes)

Description: Includes fixes for several log forwarding issues. Customers who have installed Symantec AntiVirus 9.0.1 MR1 (9.0.1.1000) are encouraged to download this. This is for Unlicensed installations of SAV 9.0.1. Business Pack customers will be able to download a separate patch later.

But I cant get it to slipstream.

@smc1979
That MSP (patch update) is for the SAV 9.0.1.1000 package, and updates it to "9.0.1.1100" version. It may not apply to "9.0.0.338" which many people seem to have.
RyanVM says he has successfully applied that patch (to the version I said in previous line).

i have the 9.0.0.1400 version. no problem slipstreaming it. Also It works fine with XP sp2.

I just like to keep things as up to date as possible.

Since I a programmer this is kind of a way of life for me to update verything LOL.

I have also made some tools for the xp cd such as change computer name, setwallpaper and change cd key and such. Perhaps I will make a new thread in the right forum here and put what I have to help others.

After all if it wasnt for people helping like this I would have never made my cd so perfect.

I dont have to do a single thing on it all my apps install and the ones that dont fit auto install acroos my network.

Thanks again. I will keep checking this thread for info on updates to sav 9.

Thanks guys.

It sucks to always have to wait for the patches and updates to come to french. I mean, the engine should have 1 language and the GUI should be translated... thus everyone could have the 9.0.1.1100 version for his language while releasing only 1 .exe, no waiting for other languages users

i'm not patient...

I am the same and I agree.

For my program I right on my website I will be adding more laguages to them.

I plan on simply having it translate over.

You would think a major company would do the same.
Symantec just recently won a 23 million dollar law suit against a local company here who was selling illegel copies of norton. They sued them and won. So I know they got money!

Bt I am sure they have there reasons.

I for one would like to know why sav can not be updated through live update like norton. sav is far better than norton on performance.

Very good question indeed, cause it's the only thing not automatic... (once you automate liveupdates)

I think this is because you can't update the SAV engine on a machine with SAV already installed, that's why we do the AIP thing on an empty machine, or before the installation during an unattended install. I we could simply update the files I guess they would've add this to liveupdate.

For my part I am still wondering, except for the bigger installation files and some norton utilities addons, what's the difference between Norton and SAV. If norton was a smaller install I would have stayed with norton since im not an enterprise.

, $23M is pennies to Symantec

Now, it's time to my 2 cents.

NAV:
------
It's designed, intentionally, to protect a single PC. Being designed for this purpose, it assumes a PC user who is careless and a PC that's not connected to a server.

Home users are mostly careless, as we know. They can forget to, frequently, update NAV or V.Defs or LU or whatever. Hence, there's automatic liveupdate and it's on by default.

SAV:
------
It's designed, intentionally, to protect a network. Being designed for this purpose, every PC on the network gets its updates from the server.

The network administrator downloads an XDB file (instead of i32) to the server. Whenever a PC on the network boots, it looks for that file on the server and takes V.Defs updates from it. Other updates are taken care for by the admin, too.

So, there's no need for a client PC to update itself independently via Internet connection. Hence, there's no need to automatic liveupdate.

Now, since we have the client program (the subject of this thread) installed on our single PCs (no servers), we are worried about automatic liveupdate!

However, Symantec did not forget the client entirely. Still, you can schedule LiveUpdate to run automatically and silently to perform a frequent update to your client. Symantec says that it uploads a new V.Defs updater file every week. So you know how often your LiveUpdate should be scheduled to run.

My own experience:
-----------------------
I rarely turn my PC off, unless after an exhaustive defrag operation.
So, my LiveUpdate wakes up at 03:00 AM on Thursdays (while I'm asleep), connects to the Internet, downloads what it likes to, installs it, disconnects from the Internet, then goes back to its bed.

Isn't this automatic liveupdate you worry about?

Its the automatic live update that I like.

I have done soime performance test between norton and sav to. sav is a straight to the point antivirus while norton tends to be a little bloated.

Sav was designed to take as little from the machine as possible since it has many more task to do thinking it is on a network and a work enviorment. Sav wouldnt sell if it bogged down the system.

From my test the system performs faster with sav on it and finds more viruses than norton.

Now for my next question if anyone can help me is I would like to try to find a way to auto set the auto live update options after install. The default is friday at 8. I like it daily at noon within 300 mins. Sav tends to get updated more offten if they have updates. Even says so on there site. there SAV products come first over norton on virus def releases.

Well, I used both and I'm satisfied with them. And there's always the opportunity cost.

SAV doesn't protect a PC against malicious scripts, doesn't protect a recycle bin, isn't integrated to office applications, doesn't perform a pre-scan before installation, and doesn't create emergency disks that are a must sometimes when a PC can't start due to a virus.

On the other hand, if we disabled the above features from NAV, it should be fast, too.

@Mazin thanks for the info. Well, if only it could detect also malicious scripts SAV would be perfect, cause even on a network sometimes an experienced user can have trouble with malicious scripts. But the protected recycle bin is not a must have, neither is the office integration, as long as you don't have fun downloading tons of Word Macros on the web.

@smc1979 I use this reg tweak to set live update to run, im not sure what everyline does but I found this here on msfn so if you browse a bit you can find it back

what i understand about the last post isee the sav. is more light than nav but dont make a total protect like nav.

is this right ?

if it is a need to find a way to activate norton 2005 in all machines

this may work for setting the schedule. but some of these keys shouldnt be needed as it may cause a problem. so I will leave 2 of the keys out and let setup take care of it (Created & LastStart). instead I will only set these keys after install

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Intel\LANDesk\VirusProtect6\CurrentVersion\PatternManager\Schedule]
"SkipEvent"=dword:00000000
"RandomizeDayOfWeek"=dword:00000006
"MinOfDay"=dword:000002df
"MissedEventEnabled"=dword:00000001
"TimeWindowMonthly"=dword:0000000b
"Type"=dword:00000001
"DayOfWeek"=dword:00000000
"TimeWindowWeekly"=dword:00000003
"TimeWindowDaily"=dword:00000001
"RandomizeDayRange"=dword:0000012c
"RandomizeWeekStart"=dword:00000004
"RandomizeWeekEnd"=dword:00000006
"RandomizeMinOfDay"=dword:00000031
"Enabled"=dword:00000001
"DayOfMonth"=dword:00000000
"RandomizeDayEnabled"=dword:00000001
"RandomizeWeekEnabled"=dword:00000000
"RandomizeMonthEnabled"=dword:00000000
"RandomizationGenerate"=dword:00000000
"RandomizedMinOfDay"=dword:00000313
"RandomizedDayOfWeek"=dword:00000000
"RandomizedDayOfMonth"=dword:00000000

This is taken from my config. Also here is a screenshot of my setup.
I will use VPC npw and test to see if it works.

Ok I did a test install on VPC, I install the reg settings after Sav 9 and liveupdate 2.5 is installed.

After which It reboots and I checked and it seem to work just right at setting the schedule.

Thanks for the help!

could someone put the steps of live update, i read all forum but this step is a bit confuse

What is so **** confusing about downloading lusetup.exe, renaming it to lsetup.exe and replacing the original lsetup.exe file with the downloaded one in the SAV LU directory????

because thats with norton. Sav doesnt have the files in a exe, they are all extracted. You well see that eairler in this thread. Since the new liveupdate has new and different files sav doesnt install the new liveupdate correctly. Which is no big deal just install live update afterwards, real easy.

Look here is my batch file that does it

ECHO Installing Symantec Antivirus Corporate v9.0.0.1400
ECHO Please wait...
start /wait %CDROM%\Software\AntiVirus\setup.msi /qb REBOOT=REALLYSUPPRESS RUNLIVEUPDATE=0
ECHO.
ECHO Installing Symantec LiveUpdate 2.5
ECHO Please wait...
start /wait %CDROM%\Software\lusetup.exe /q
ECHO.
ECHO Setting LiveUpdate Schedule
ECHO Please wait...
REGEDIT /S %CDROM%\Software\SetAntivirusUpdateSchedule.reg
ECHO.

@big poppa pump
Well, if you want to pre-set live-update settings, then that's not all that easy.

Otherwise, if having the latest version of LU pre-installed with SAV is what you want, then read the first post of this topic once more please.

I posted in this thread a little ways back about a utility on the SAV install media called ConfigEd. You can set all of your liveupdate settings (among others) there and save to a GRC.DAT file.

Put the GRC.DAT in the root of your install source and the settings will be imported at setup time. You can find the utility buried in the tools\nosuprt directory.

@smc1979

Why do you have to install LU separately?

@RogueSpear

Would you please explain an example of configuring those settings via GRC.DAT? I haven't read much about it.
It'd be better if you could post it, here.

Using the configed utility, you can set all of the various SAV setting, including LiveUpdate settings, and save all of it to a file called GRC.DAT. In a corporate environment, these files hold much more significance, but even with one computer they can be quite handy.

You can lock settings for instance, so a spouse or child can't disable your AV protection. You can set scanning exclusions. As as example to prevent SAV from scanning your event log files during a manual scan. There are also some settings that I have not found any other way to set (except maybe reg hacking). For instance, there is the "Continuous LiveUpdate" mode, where your computer checks for updated defs once an hour if you like. This is how I have primary AV servers set up in enterprise environments. Then the server can update all of the clients within minutes. This is especially helpful for those 0 day virus outbreaks.

Once you have configured all your settings as you want them, save the GRC.DAT file and place it in the root of your installation point. Any installation done from that point, whether it is manual, scripted, or via GPO, will assume the configuration defined in the GRC.DAT file.

For those of you who are using the SCS client that includes the firewall client, you can make a custom firewall policy, save it as cpolicy.xml and put it in the root of the installation point. Then the firewall client assume those settings. The major difference is that while the AV client is immediately active, and immediately applies the settings from the GRC.DAT file, the firewall client requires a reboot. Upon logon you will see a message that the firewall is importing your settings.

And that's it. Making a GRC.DAT file with configed is so easy it insults your intelligence. Making a foolproof, solid firewall policy on the other hand, is much more involved and I'm sure could spawn it's own monster thread. Symantec's documentation has always been lousy at best.

@mazin
I install live update seperetly cause I have tried all things in this thread but I still get the error message after install when I try to slipstream it into SAV.

It is really no big deal to install it after SAV it takes only a few secounds and its done.

I will diffently look into this utilitie on settings for SAV. Sounds great from what I have read.
Thanks!

Oh by the way mazin I have read a many of your posts and help for people.

Thank a many from me. I am sure you dont here it enough.
But from as many post as I have seen from you, you must not have much of a life LMAO jk

Thanks guys.

@smc1979

hmmm...I just wondered why didn't you rename lusetup.exe to Lsetup.exe and put it in: ..\CommonAppData\Symantec\LiveUpdate\LuMMInst\Lsetup.exe, so that SAV installs it for you.

coud someone put a exemple of the string to start sav9.msi on RUNONCEEX.cmd

i try but dont work

here is myne something is wrong

REG ADD %KEY%\014 /VE /D "Symantec AntiVirus 9.0" /f
REG ADD %KEY%\014 /V 1 /D "%systemdrive%\Install\sav\sav.msi\ /qn RUNLIVEUPDATE=0 REBOOT=REALLYSUPPRESS" "%systemdrive%\Install\sav\SAV1400.msp /a" /f

when go to install simply pass to sav not installing but dont give any error

i see the guide in the first page but i think something is wrong because you apply the pach before instale the sav . them i change the things first install sav then the patch . but whem goes to install simple pass trough way on installing anything or giving a error

this is my all runence
[QUOTE]
cmdow @ /HID
@Echo Off

rem PP=%SystemDrive%\Install\

SET KEY=HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx

REG ADD %KEY% /V TITLE /D "Installing Programs" /f

REG ADD %KEY%\000 /VE /D "ACROBAT READER 6" /f
REG ADD %KEY%\000 /V 1 /D "%SystemDrive%\Install\AdobeReader6\AR6.msi /QB" /f

REG ADD %KEY%\001 /VE /D "FRAMEWORK 1.1" /f
REG ADD %KEY%\001 /V 1 /D "%SystemDrive%\Install\dotnetfx\netfx.msi /QB" /f

REG ADD %KEY%\002 /VE /D "FRAMEWORK 1.1 sp1" /f
REG ADD %KEY%\002 /V 1 /D "%SystemDrive%\Install\dotnetfx\NDP1.1sp1.exe /QB" /f

REG ADD %KEY%\003 /VE /D "WINISO 5.3" /f
REG ADD %KEY%\003 /V 1 /D "%SystemDrive%\Install\winiso\WINISO53.EXE /verysilent /sp-" /f

REG ADD %KEY%\004 /VE /D "WINRAR 3.40 CORPORATE" /f
REG ADD %KEY%\004 /V 1 /D "%SystemDrive%\Install\winrar\wrar340CE.exe /s" /f

REG ADD %KEY%\005 /VE /D "DISKEEPER 8" /f
REG ADD %KEY%\005 /V 1 /D "%SystemDrive%\Install\dk8\Diskeeper.msi /QB" /f

REG ADD %KEY%\006 /VE /D "Microsoft Visual Basic 6 Runtimes" /f
REG ADD %KEY%\006 /V 1 /D "%SystemDrive%\Install\vbrun60sp5.exe /Q:A /R:N" /f

REG ADD %KEY%\007 /VE /D "MEDIA PLAYER 10" /f
REG ADD %KEY%\007 /V 1 /D "%SystemDrive%\Install\mp\mp10.exe /Q:A /R:N" /f

REG ADD %KEY%\008 /VE /D "MEDIA ENCODER 9" /f
REG ADD %KEY%\008 /V 1 /D "%SystemDrive%\Install\mp\WMEncoder.exe /Q:A /R:N" /f

REG ADD %KEY%\009 /VE /D "DVD PACK CODEC" /f
REG ADD %KEY%\009 /V 1 /D "%SystemDrive%\Install\DVDPack.msi /QB" /f

REG ADD %KEY%\010 /VE /D "FLASH & SHOCKWAVE PLAYERS" /f
REG ADD %KEY%\010 /V 1 /D "%SystemDrive%\Install\mm_fl_sw_installer.msi /QB " /f

REG ADD %KEY%\011 /VE /D "ISO RECORDER" /f
REG ADD %KEY%\011 /V 1 /D "%SystemDrive%\Install\ISORecorder.msi /qn" /f

REG ADD %KEY%\012 /VE /D "K-LITE MEGA CODECS PACK" /f
REG ADD %KEY%\012 /V 1 /D "%SystemDrive%\Install\k-lite\klmcodec103.exe /silent /s /sp-" /f

REG ADD %KEY%\0013 /VE /D "Sun Java VM 1.4.2.05" /f
REG ADD %KEY%\0013 /V 1 /D "%SystemDrive%\Install\sun\j2re-1_4_2_05-windows-i586-p.exe /s /v\"/qb IEXPLORER=1 REBOOT=ReallySuppress\"" /f

REG ADD %KEY%\014 /VE /D "Symantec AntiVirus 9.0" /f
REG ADD %KEY%\014 /V 1 /D "%systemdrive%\Install\sav\sav.msi\ /qn RUNLIVEUPDATE=0 REBOOT=REALLYSUPPRESS" "%systemdrive%\Install\sav\SAV1400.msp /a" /f

REG ADD %KEY%\015 /VE /D "TWEAKING" /f
REG ADD %KEY%\015 /V 1 /D "REGEDIT /S %systemdrive%\Install\tweaks.reg" /f

REG ADD %KEY%\016 /VE /D "RCGOOGLE" /f
REG ADD %KEY%\016 /V 1 /D "%SystemDrive%\Install\rcgoogle.exe /s" /f

REG ADD %KEY%\017 /VE /D " A finalizar.... " /f
REG ADD %KEY%\017 /V 1 /D "%SystemDrive%\Install\final.cmd" /f

EXIT



thanks

@jquintino

Please slipstream your MSP first and follow this guide before installing SAV: http://www.msfn.org/board/index.php?showto...ndpost&p=179948