Symantec 10551441 - AntiVirus Corporate Edition Service manual

Symantec AntiVirus™
Corporate Edition
Administrator’s Guide

Symantec AntiVirus™ Corporate Edition
Administrator’s Guide
The software described in this book is furnished under a license agreement and may be
used only in accordance with the terms of the agreement.
Documentation version 9.0
Copyright Notice
Copyright © 2004 Symantec Corporation.
All Rights Reserved.
Any technical documentation that is made available by Symantec Corporation is the
copyrighted work of Symantec Corporation and is owned by Symantec Corporation.
NO WARRANTY. The technical documentation is being delivered to you AS-IS, and
Symantec Corporation makes no warranty as to its accuracy or use. Any use of the
technical documentation or the information contained therein is at the risk of the user.
Documentation may include technical or other inaccuracies or typographical errors.
Symantec reserves the right to make changes without prior notice.
No part of this publication may be copied without the express written permission of
Symantec Corporation, 20330 Stevens Creek Blvd., Cupertino, CA 95014.
Trademarks
Symantec, the Symantec logo, LiveUpdate, and Norton AntiVirus are U.S. registered
trademarks of Symantec Corporation. Norton Internet Security, Norton Personal Firewall,
Symantec AntiVirus, Symantec Client Firewall, Symantec Client Security, and Symantec
Security Response are trademarks of Symantec Corporation.
Other brands and product names mentioned in this manual may be trademarks or
registered trademarks of their respective companies and are hereby acknowledged.
Printed in the United States of America.
10987654321

Technical support
As part of Symantec Security Response, the Symantec global Technical Support
group maintains support centers throughout the world. The Technical Support
group’s primary role is to respond to specific questions on product feature/
function, installation, and configuration, as well as to author content for our
Web-accessible Knowledge Base. The Technical Support group works
collaboratively with the other functional areas within Symantec to answer your
questions in a timely fashion. For example, the Technical Support group works
with Product Engineering as well as Symantec Security Response to provide
Alerting Services and Virus Definition Updates for virus outbreaks and security
alerts.
Symantec technical support offerings include:
■A range of support options that give you the flexibility to select the right
amount of service for any size organization
■Telephone and Web support components that provide rapid response and
up-to-the-minute information
■Upgrade insurance that delivers automatic software upgrade protection
■Content Updates for virus definitions and security signatures that ensure
the highest level of protection
■Global support from Symantec Security Response experts, which is
available 24 hours a day, 7 days a week worldwide in a variety of languages
for those customers enrolled in the Platinum Support Program
■Advanced features, such as the Symantec Alerting Service and Technical
Account Manager role, offer enhanced response and proactive security
support
Please visit our Web site for current information on Support Programs. The
specific features available may vary based on the level of support purchased and
the specific product that you are using.
Licensing and registration
If the product that you are implementing requires registration and/or a license
key, the fastest and easiest way to register your service is to access the
Symantec licensing and registration site at www.symantec.com/certificate.
Alternatively, you may go to www.symantec.com/techsupp/ent/enterprise.html,
select the product that you wish to register, and from the Product Home Page,
select the Licensing and Registration link.
Contacting Technical Support
Customers with a current support agreement may contact the Technical
Support group via phone or online at www.symantec.com/techsupp.
Customers with Platinum support agreements may contact Platinum Technical
Support via the Platinum Web site at www-secure.symantec.com/platinum/.

When contacting the Technical Support group, please have the following:
■Product release level
■Hardware information
■Available memory, disk space, NIC information
■Operating system
■Version and patch level
■Network topology
■Router, gateway, and IP address information
■Problem description
■Error messages/log files
■Troubleshooting performed prior to contacting Symantec
■Recent software configuration changes and/or network changes
Customer Service
To contact Enterprise Customer Service online, go to www.symantec.com, select
the appropriate Global Site for your country, and then choose Service and
Support. Customer Service is available to assist with the following types of
issues:
■Questions regarding product licensing or serialization
■Product registration updates such as address or name changes
■General product information (features, language availability, local dealers)
■Latest information on product updates and upgrades
■Information on upgrade insurance and maintenance contracts
■Information on Symantec Value License Program
■Advice on Symantec's technical support options
■Nontechnical presales questions
■Missing or defective CD-ROMs or manuals

Contents
Technical support
Section 1 Managing Symantec AntiVirus
Chapter 1 Managing Symantec AntiVirus
About managing Symantec AntiVirus .............................................................. 13
Managing with the Symantec System Center ................................................. 14
Using console views .................................................................................... 15
Saving console settings ............................................................................... 16
Understanding Symantec System Center icons ...................................... 17
Discovering computers and refreshing the console ............................... 19
Auditing computers ..................................................................................... 31
About clients and servers ...................................................................................37
About primary servers ................................................................................ 37
About secondary servers ............................................................................38
About parent servers ................................................................................... 38
About server and client groups ......................................................................... 38
Deciding whether to manage with server groups and/or
client groups ......................................................................................... 39
Server and client group scenario .............................................................. 41
Managing with server groups ............................................................................ 41
Creating server groups ................................................................................ 41
Locking and unlocking server groups ...................................................... 42
Working with server group passwords .................................................... 43
Renaming server groups ............................................................................. 45
Selecting a primary server for a server group ........................................45
Changing primary and parent servers ..................................................... 46
Moving a server to a different server group ............................................ 46
Viewing server groups ................................................................................ 47
Deleting server groups ................................................................................ 48
Enhancing server group security ...................................................................... 48
How the access list works ........................................................................... 48
Implementing enhanced server group security ...................................... 49

6Contents
Managing with client groups ............................................................................. 53
Creating new client groups ........................................................................ 53
Adding clients to a client group ................................................................ 53
Configuring settings and running tasks at the client group level ....... 54
Finding client group settings ..................................................................... 54
Moving clients in client groups ................................................................. 54
Viewing client groups ................................................................................. 54
Filtering the client group view .................................................................. 56
Renaming client groups .............................................................................. 57
Deleting client groups ................................................................................. 57
Configuring clients directly ............................................................................... 58
Changing an unmanaged client into a managed client (and the
reverse) .......................................................................................................... 58
How settings propagate ...................................................................................... 60
New Grc.dat files overwrite old Grc.dat files ........................................... 61
Chapter 2 Setting up the Alert Management System
About the Alert Management System .............................................................. 63
How Alert Management System works ............................................................ 64
Configuring alert actions .................................................................................... 65
Alert configuration tasks ............................................................................ 65
Configuring alert action messages ............................................................ 66
Speeding up alert configuration ................................................................ 68
Configuring the Message Box alert action ............................................... 70
Configuring the Broadcast alert action .................................................... 71
Configuring the Run Program alert action .............................................. 71
Configuring the Load An NLM alert action ............................................. 72
Configuring the Send Internet Mail alert action .................................... 73
Configuring the Send Page alert action ................................................... 74
Configuring the Send SNMP Trap alert action ....................................... 76
Configuring the Write To Event Log alert action ................................... 79
Working with configured alerts ........................................................................ 79
Testing configured alert actions ............................................................... 80
Deleting an alert action from an alert ...................................................... 80
Exporting alert actions to other computers ............................................ 80
Using the Alert Management System Alert Log ............................................. 82
Viewing detailed alert information ........................................................... 84
Filtering the Alert Log display list ............................................................ 85
Forwarding alerts from unmanaged clients .................................................... 86

7Contents
Section 2 Configuring Symantec AntiVirus
Chapter 3 Scanning for viruses and other threats
About threats ........................................................................................................ 91
About scans in Symantec AntiVirus ................................................................. 93
Understanding Auto-Protect scans ........................................................... 94
Understanding scheduled scans ................................................................ 94
Understanding manual scans .................................................................... 94
Selecting computers to scan ......................................................................95
Configuring Auto-Protect scans ........................................................................ 97
Configuring Auto-Protect for files ............................................................98
Configuring Auto-Protect email scanning for groupware
applications .........................................................................................107
Configuring Auto-Protect scanning for Internet email .......................108
How to specify exclusions ........................................................................110
Configuring Auto-Protect settings ..........................................................111
How to lock and unlock Auto-Protect options ......................................112
Configuring manual scans ................................................................................112
How to specify exclusions ........................................................................114
Deleting files and folders that are left on computers by threats .......115
Configuring scheduled scans ...........................................................................115
Scheduling scans for server groups or individual Symantec
AntiVirus servers ...............................................................................115
Scheduling scans for Symantec AntiVirus clients ...............................118
Setting options for missed scheduled scans ..........................................120
Editing, deleting, or disabling a scheduled scan ...................................121
Running a scheduled scan on demand ...................................................122
Deleting files and folders that are left on computers by threats .......122
Handling Symantec AntiVirus clients with intermittent connectivity .....123
Configuring scan options .................................................................................124
How to assign primary actions and secondary actions for
detected viruses .................................................................................124
How to assign primary actions and secondary actions for
other detected threats .......................................................................125
Controlling the user experience ..............................................................126
Scanning for in-memory threats .............................................................134
Excluding files from scanning ................................................................134
Selecting file types and extensions to scan for viruses .......................136
Enabling expanded threat categories .....................................................140
Setting options for scanning compressed files .....................................142
Configuring HSM settings ........................................................................143
Setting CPU utilization .............................................................................145

8Contents
Chapter 4 Updating virus definitions files
About virus definitions files ............................................................................147
Virus definitions files update methods ..........................................................148
Best practice: Using the Virus Definition Transport Method and
LiveUpdate together ..........................................................................149
Best practice: Using Continuous LiveUpdate on 64-bit computers ...149
Updating virus definitions files on Symantec AntiVirus servers ..............150
Updating and configuring Symantec AntiVirus servers using the
Virus Definition Transport Method ................................................150
Updating servers using LiveUpdate .......................................................156
Updating servers with Intelligent Updater ...........................................159
Updating servers using Central Quarantine polling ............................ 159
Minimizing network traffic and handling missed updates .................160
Updating virus definitions files on Symantec AntiVirus clients ...............162
Updating virus definitions files on Symantec AntiVirus clients
immediately ........................................................................................164
Configuring managed clients to use an internal
LiveUpdate server ..............................................................................165
Enabling and configuring Continuous LiveUpdate for managed
clients ..................................................................................................166
Setting LiveUpdate usage policies ..........................................................167
Controlling virus definitions files ...................................................................168
Verifying the version number of virus definitions files ......................169
Viewing the threat list ..............................................................................169
Rolling back virus definitions files .........................................................169
Testing virus definitions files ..........................................................................170
Update scenarios ...............................................................................................171
About scanning after updating virus definitions files .................................171
Chapter 5 Responding to virus outbreaks
About responding to virus outbreaks .............................................................173
Preparing for a virus outbreak ........................................................................174
Creating a virus outbreak plan ................................................................174
Defining Symantec AntiVirus actions for handling
suspicious files ...................................................................................175
Automatically purging suspicious files from local Quarantines ........176
Handling a virus outbreak on your network .................................................177
Using virus alerts and messages ............................................................. 177
Running a virus sweep ..............................................................................178
Tracking virus alerts using Event Logs and Histories .........................178
Tracking submissions to Symantec Security Response with
Central Quarantine Console .............................................................179

9Contents
Chapter 6 Managing roaming clients
About roaming clients .......................................................................................181
Roaming client components ............................................................................182
How roaming works ..........................................................................................183
Implementing roaming .....................................................................................183
Analyzing and mapping your Symantec AntiVirus network ..............184
Identifying servers for each hierarchical level .....................................185
Creating a list of 0 level Symantec AntiVirus servers .........................185
Creating a hierarchical list of Symantec AntiVirus servers ...............186
Configuring roaming client support options from the Symantec
System Center console ......................................................................186
Configuring additional roaming client support for roam servers .....189
Configuring additional server types for roaming clients ....................191
Command-line options ......................................................................................191
Registry values ...................................................................................................193
Chapter 7 Working with Histories and Event Logs
About Histories and Event Logs ......................................................................195
Sorting and filtering History and Event Log data ........................................197
Viewing Histories ...............................................................................................199
Working with Threat Histories ................................................................200
Working with Scan Histories ...................................................................202
Understanding Event Log icons ..............................................................204
Forwarding client logs to parent servers .......................................................205
Configuring log forwarding options .......................................................205
Configuring log events to forward ..........................................................206
Best practice: Configuring events to forward for sometimes managed
clients ...................................................................................................208
Reviewing the forwarding status file ......................................................208
Deleting Histories and Event Logs ..................................................................209
Index

10 Contents

Section 1
Managing Symantec
AntiVirus
■Managing Symantec AntiVirus
■Setting up the Alert Management System

12

Chapter 1
Managing Symantec
AntiVirus
This chapter includes the following topics:
■About managing Symantec AntiVirus
■Managing with the Symantec System Center
■About clients and servers
■About server and client groups
■Managing with server groups
■Enhancing server group security
■Managing with client groups
■Configuring clients directly
■Changing an unmanaged client into a managed client (and the reverse)
■How settings propagate
About managing Symantec AntiVirus
Using the Symantec System Center, you can perform Symantec AntiVirus
administrative operations such as installing antivirus protection on
workstations and network servers, updating virus definitions, and managing
Symantec AntiVirus servers and clients. In addition to the Symantec System
Center, you can also use configuration files (Grc.dat) to configure Symantec
AntiVirus clients. You can use configuration files if you want to use a third-
party tool to perform remote configuration on your network.

14 Managing Symantec AntiVirus
Managing with the Symantec System Center
Managing with the Symantec System Center
When the Symantec System Center runs, it displays a system hierarchy of
server groups, client groups, and servers displayed in an expandable/collapsible
tree. The system hierarchy is the top level that contains all server groups and
client groups.
Note: The system hierarchy is not populated until you install at least one
Symantec AntiVirus server.
To start the Symantec System Center
◆On the Windows taskbar, click Start > Programs > Symantec System Center
Console > Symantec System Center Console.
Contents of object
selected in tree appear
in right pane
Locked server
group
Unlocked server
group
Top server group level
Console tree tab
Client groups

15Managing Symantec AntiVirus
Managing with the Symantec System Center
Using console views
Each product management snap-in makes a new product view available within
the Symantec System Center console. For example, when you install the
Symantec AntiVirus management snap-in, the Symantec AntiVirus view is
added, which includes fields related to Symantec AntiVirus, such as Last Scan
and Definitions.
The columns that appear in the right pane change based on the selected view.
When System Hierarchy is selected, the Console Default View includes the
following data columns:
■Name
■Status
■Primary Server
■Valid State
Table 1-1 lists the data columns in the Symantec AntiVirus view.
Table 1-1 Data columns in the Symantec AntiVirus view
Object selected in left pane Data columns that appear in right pane
System hierarchy icon ■Server Group
■Status
■Definition Sharing
■Newest Definitions
■Status of server updates
Server group icon ■Server
■Type
■Status
■Last Scan
■Definitions
■Version
■Scan Engine
■Address
■Status of client updates
Groups icon (for client groups) ■Group Name
■Configuration Change Date
■Number of Clients

16 Managing Symantec AntiVirus
Managing with the Symantec System Center
Changing console views
Unless you change the view, the Symantec System Center console displays the
Console Default View. The other views available depend upon which managed
Symantec AntiVirus products you have installed.
To change console views
1In the Symantec System Center console, in the left pane, expand System
Hierarchy.
2On the View menu, in the list that appears at the bottom of the menu, select
a view.
Saving console settings
When you close the console, you are prompted to save console settings for the
Symantec System Center.
To save console settings
◆Do one of the following:
■Click Yes if you want to see the same console view the next time that
you launch the Symantec System Center.
■Click No if you want to see the last saved view the next time you launch
the Symantec System Center.
Client group icon or Server icon ■Client
■User
■Status
■Last Scan
■Definitions
■Version
■Scan Engine
■Address
■Group
■Server
Table 1-1 Data columns in the Symantec AntiVirus view
Object selected in left pane Data columns that appear in right pane

17Managing Symantec AntiVirus
Managing with the Symantec System Center
Choosing No may result in lost settings. For example, if you change
settings for an attached Quarantine Server, and then choose No when
exiting the console, the changes are not retained for the Quarantine
Server.
Note: If a newer version of MMC is present on the system, you may need to
upgrade to the newer version to save changes upon exiting the Symantec
System Center console.
Understanding Symantec System Center icons
The Symantec System Center uses icons to represent the different states of
computers that are running Symantec managed products. For example, if the
server group icon in the server group view appears with a padlock icon, the
server group must be unlocked with its password before you can configure or
run scans for the computers in the server group.
Table 1-2 lists the Symantec System Center icons.
Table 1-2 Symantec System Center icons
Icon Icon descriptions
Highest level object representing the system hierarchy, which contains all
server groups.
Unlocked server group or client group. Compare this icon to the locked
server group icon. For security reasons, all server groups default to locked
when you start the Symantec System Center.
Locked server group. You must enter a password before you can view the
computers in the server group to configure and run updates and scans.
An issue needs to be resolved in this server group. For example, there may
not be a primary server assigned to the server group or a server may be
infected with a threat.
Symantec AntiVirus server running on a supported Windows or NetWare
computer. Compare this icon to the next one, which is the primary server for
the server group.
Symantec AntiVirus primary server running on a supported Windows or
NetWare computer.

18 Managing Symantec AntiVirus
Managing with the Symantec System Center
Unavailable Symantec AntiVirus server. This icon appears when
communication is severed between the Symantec AntiVirus server and the
Symantec System Center console. The communication error may result
from one of several different causes. For example, the server system is not
running, the Symantec software has been removed, or there could be a
network failure between the console and the system.
A virus was detected on the computer that is running Symantec AntiVirus
server.
A threat other than a virus, such as adware or spyware, was detected on the
computer that is running Symantec AntiVirus server.
Note: If Symantec AntiVirus detects a virus and a threat other than a virus
on the same computer, the virus icon appears.
Symantec AntiVirus client running on a supported Windows computer.
When you select this computer, you view options only on that computer.
A virus was detected on the computer that is running Symantec AntiVirus
client.
A threat other than a virus, such as adware or spyware, was detected on the
computer that is running Symantec AntiVirus client.
Note: If Symantec AntiVirus detects a virus and a threat other than a virus
on the same computer, the virus icon appears.
An issue needs to be resolved with this client. For example, virus definitions
files may be out-of-date or the client group to which the client was assigned
is no longer valid.
The status field in the Symantec System Center console indicates the actual
problem.
The computer, which runs Symantec AntiVirus client software, is not
currently connected to the network.
You must enable a setting for the Symantec System Center console to show
when clients are not connected to the network.
Table 1-2 Symantec System Center icons
Icon Icon descriptions

19Managing Symantec AntiVirus
Managing with the Symantec System Center
Showing when clients are offline
You can configure the Symantec System Center console to show when
computers running Symantec AntiVirus client software are not currently
connected to the network. The icon in the last row of Table 1-2 indicates that the
client is offline.
To show when clients are offline
1In the Symantec System Center console, on the Tools menu, click SSC
Console Options Properties.
2In the SSC Console Options Properties dialog box, on the Client Filter tab,
under Group Options, check Indicate when clients are offline.
This option is unchecked by default.
Showing client Auto-Protect status
You can configure the client or server icon to appear in the Windows system
tray.
The icon shows a client or server’s Auto-Protect status as follows:
■When Auto-Protect is enabled, a check mark appears next to Enable Auto-
Protect and the icon appears as a full shield.
■When Auto-Protect is disabled, the icon is covered by a universal no sign (a
red circle with a diagonal slash).
Discovering computers and refreshing the console
At the first startup of a newly installed Symantec System Center console, the
console will ping the network to find all available computers running Symantec
AntiVirus servers. As soon as the servers respond, they are added to the console.
Connected workstations running a managed Symantec client product are added
when their parent server is selected in the console tree.
If you start servers that are running a manageable Symantec product while the
Symantec System Center is already running, you may need to locate the server
using the Find feature or Discovery Service so that it will display in the server
group view.
You can also use Discovery to locate network computers on which Symantec
AntiVirus is not installed.

20 Managing Symantec AntiVirus
Managing with the Symantec System Center
Using the Discovery Service
The Symantec System Center console runs a single Windows NT service, the
Symantec System Center Discovery Service (Nsctop.exe). This service is
responsible for discovering the computers running Symantec AntiVirus server
that appear in the Symantec System Center console. The Discovery service also
populates the Symantec System Center console with objects.
You can choose one of the following Discovery types:
■Load from cache only
■Local Discovery
■Intense Discovery
See “Understanding Load from cache only discovery type” on page 22.
See “Understanding Local Discovery” on page 22.
See “Understanding Intense Discovery” on page 23.
How discovering computers on the network works
To discover computers on the network, a computer running Symantec AntiVirus
server sends a ping packet to a computer running Symantec AntiVirus client.
The ping program verifies that the remote computer exists and can accept
requests. When the Ping Discovery Service (Intel PDS) hears a ping, it responds
with a pong packet. Ping and pong packets are about 1 KB. A successful ping-
pong discovery ensures that the computer is working.
The pong also provides valuable information, such as the following:
■Date of the computer’s virus definitions files
■When the computer was last infected
Both IP and IPX pings are sent to the remote computer running Symantec
AntiVirus server to determine what type of protocol it uses.
Pings are also sent that support Norton AntiVirus Corporate Edition and
LANDesk Virus Protect, legacy versions of Symantec AntiVirus.
The data from the computer running Symantec AntiVirus client is stored on the
computer running Symantec AntiVirus server that is the client’s parent server.
The Symantec System Center console reads each parent server’s registry to get
the data that it displays in the console.
Following the completion of this process, Normal Discovery runs.