[tbma]

Starting with version 10.0.1 processing of the Auto-Created Scans can be disabled by setting DWORD value "StartupScansEnabled" in "HKLM\Software\Intel\LanDesk\VirusProtect6\CurrentVersion\AdministratorOnly\General" to 0.
Scans still will be created, but will be disabled.

reg add HKLM\Software\Intel\LanDesk\VirusProtect6\CurrentVersion\AdministratorOnly\General /v StartupScansEnabled /t REG_DWORD /d 0 /f

p.s. all this is for the unmanaged clients, - with managed clients same parameter can be set from the Server Console.

[RogueSpear]

Caution: Rant ahead. Skip this if you don't want to read something of a non-technical nature.


I've been using both Symantec AntiVirus and Symantec Client Security for several years now. I feel as though I keep on using and recommnding it mostly because I'm familiar with it and quite honestly, because so many of my clients are invested in it and aren't likely to jump ship now. But I have just about had it with Symantec's Mickey Mouse operation.

Everything seems to be a major hassle with this software. Sure it seems to work ok, but I've invested nearly as much time tinkering with Symantec's products as I have Windows itself. Just to make matters worse, I always seem to be educating Tech Support about the very products they are supposed to be supporting. Why in the world can't anything be easy with them?

Since version 1 of Symantec Client Security I have been lodging complaints with Tech Support that you are unable to terminal service into an SCS client without the ccapp.exe thread pegging the CPU at 100%. The only "official" answer that I have received to date is "we aren't sure why that happens, but the programmers have been working on the problem for quite a while now." This was followed by an explanation of how the firewall portion of the client is not supported on Windows Server operating systems because of terminal services and that RDP with Windows XP is such a "new" feature that it would take a little while for it to be officially supported (this discussion was post SP2).

If anyone reading this is a Symantec employee, I urge you to forward this to someone who makes a decision or two over there. At this point I am starting to actively research alternative solutions. I just can't recommend this product any longer. If it helps I'll use some fancy industry speak. The Total Cost of Ownership (TCO) is skyhigh for this product.

[ravashaak]

I too have used SAV and SCS in a managed environment. The software does its job but in many cases proves to be a resource hog, bogging down otherwise idle systems. However, the worst thing is the time required to manage the entire thing. Control and configuration layouts are often duplicative and seldom make much logical sense. Options and settings are spread out all over the place and can prove a bear to handle at times. The documentation often proves poorly-worded, causing further confusion instead of providing solutions.

I have a long laundry list of issues with this software, primarily on the administrative side of things. I could list pages of issues for you. These problems add a great deal of administrative overhead and headache. My employer currently holds a site license for this software, so we continue to use it. However, I too am reluctant to recommend this product to others.

- Ravashaak

[RyanVM]

You guys have got my ear. What packages do you recommend which support the same featureset as well as Symantec? By that, I mean frequently-updated virus defs, spyware detection/removal, email scanning, etc.

[RogueSpear]

RyanVM, on Jul 12 2005, 03:57 PM, said:

You guys have got my ear. What packages do you recommend which support the same featureset as well as Symantec? By that, I mean frequently-updated virus defs, spyware detection/removal, email scanning, etc.
<{POST_SNAPBACK}>

Just about every major AV vendor supports these fuctions to my satisfaction. I will concede that I feel Symantec is the best in terms of definition turn around time and the quality of those definitions. But I'm satisfied enough with the detection capabilities of all the other competing products. If you have your network, operating system, and mail client properly configured, the odds of getting infected are not so great. Spyware is the one form of malware that Symantec really lags behind in so I'll continue to rely upon standalone products, freeware and commercial, for that.

The main problem I have with Symantec is managing their products in the enterprise. Plain and simple.. it sucks. Their documentation is sometimes worse than having none at all as it's often incorrect and misleading, nevermind being incomplete. They also keep on trying to load in new and more features without fixing the existing ones. Manageability is what I'm really looking for at this point in a corporate AV / firewall product.

[what3v3r]

RogueSpear, on Jul 12 2005, 04:16 PM, said:

[...] I will concede that I feel Symantec is the best in terms of definition turn around time and the quality of those definitions. [...]
<{POST_SNAPBACK}>

i cant agree with that...
symantec updates their definitions twice a week, maybe three times but thats it! Other AVs get updates every 3 hours! I once got infected with a Virus i got in an email. i also scanned the email attachement before opening it, but no virus was found... until the next day

This post has been edited by what3v3r: 13 July 2005 - 06:55 AM

[RogueSpear]

what3v3r, on Jul 13 2005, 07:53 AM, said:

i cant agree with that...
symantec updates their definitions twice a week, maybe three times but thats it! Other AVs get updates every 3 hours! I once got infected with a Virus i got in an email. i also scanned the email attachement before opening it, but no virus was found... until the next day 
<{POST_SNAPBACK}>

Ya learn something new everyday.. one of the things I love about this place.


To the mods: I didn't mean to hijack this thread away from it's intended purpose - installing SAV unattended and preconfigured. Just needed to vent some steam. So with that said I'll keep any further comments on topic.

[OrcoXP]

what3v3r, on Jul 13 2005, 07:53 AM, said:

i cant agree with that...
symantec updates their definitions twice a week, maybe three times but thats it! Other AVs get updates every 3 hours! I once got infected with a Virus i got in an email. i also scanned the email attachement before opening it, but no virus was found... until the next day 
<{POST_SNAPBACK}>

Hardly!

Just set the Live Update check to check more frequently...on a more active day for viruses Symantec will sometimes update once an hour...I have seen the defs get to build 28 in a single day.

Every day that my UA goes unfinished I update the VDefHub.zip file at least once per day.

Click here and check the date and revision number.

However some server must go unaware of the latest build so find some other method of updating virus defs and you're all set!

This post has been edited by OrcoXP: 13 July 2005 - 01:38 PM

[what3v3r]

well i dont know what to say, i believe you but i have set my live update to check once every day, and my defs are only updated once a week...

[Rhelic]

Symantec is about to launch their new website redesign, perhaps they're waiting for that before they announce their new products too. I mean bundling all kinds of improvements together really helps your stock

http://preview.symantec.com/

[OrcoXP]

what3v3r, on Jul 13 2005, 03:42 PM, said:

well i dont know what to say, i believe you but i have set my live update to check once every day, and my defs are only updated once a week...
<{POST_SNAPBACK}>

Yeah, when I was using live update I had the same problem...just find a 3rd party method and add it to your task scheduler

[what3v3r]

OrcoXP, on Jul 13 2005, 03:56 PM, said:

what3v3r, on Jul 13 2005, 03:42 PM, said:

well i dont know what to say, i believe you but i have set my live update to check once every day, and my defs are only updated once a week...
<{POST_SNAPBACK}>

Yeah, when I was using live update I had the same problem...just find a 3rd party method and add it to your task scheduler
<{POST_SNAPBACK}>

like what for example?

[OrcoXP]

i had a proggy called defsgetter but it was strictly a script so I am not sure if it is available anywhere...

I lost my harddrive and lost defsgetter but there are others out there...all you need to do is search

[RogueSpear]

I imagine you could make a script to download (ftp) the updates at whatever schedule you like.

[what3v3r]

i imagine a batch script using wget, could do the trick - ah well, maybe ill write it myself. thanks for the suggestion

edit: seems like i was too slow

This post has been edited by what3v3r: 13 July 2005 - 04:53 PM

[tbma]

Huh??

How to automatically update Symantec AntiVirus Corporate Edition definitions without using LiveUpdate... with the batch files.

[OrcoXP]

sweet...that's the one!!!

This post has been edited by OrcoXP: 13 July 2005 - 08:10 PM

[what3v3r]

this update method is for servers only, if im correct?

anyway, i wrote my own update tool for clients. it uses grep, wget, and winrar. it downloads the newest definitions from here:

http://securityresponse.symantec.com/avcen...ges/US-N95.html

and extracts and applies them. you need to have winrar installed in its default directory (you can also edit the batch file of course). i attached almost all the files you will need to run it. just extract the "update.zip" into any folder, and run "update.cmd".

there is one file you will have to download yourself, because it was too big, to attach to this post. get wget here:

http://users.ugent.be/~bpuype/cgi-bin/fetc...l=wget/wget.exe

simply save it into the directory that you extracted update.zip to

let me know if it works for you

Attached File(s)

•  update.zip (47.96K)
  Number of downloads: 36

This post has been edited by what3v3r: 14 July 2005 - 05:14 AM

[sleepnmojo]

Just to save you a little bit of time, and shorten your code.

WGET.EXE -N -c -q ftp://ftp.symantec.com/AVDEFS/norton_antivirus/static/symcdefsi32.exe
REM EXTRACT FILE HERE

Should download the latest vdefs. If you don't like wget, ftp works too.

ftp.exe -s:%0
goto done

open ftp.symantec.com
anonymous
sav@msfn.org
binary
hash
cd AVDEFS/norton_antivirus/static
get symcdefsi32.exe
bye

:done
@ECHO OFF
REM EXTRACT FILE HERE

[what3v3r]

thanks for the suggested improvements, i didnt know that the definitions were also available on symantecs ftp (i didnt know where)

but i guess they both get updated at the same time.