[DISCUSSION] Symantec Endpoint Protection

Anyone has the Full Installer for:
12.1.7454.7000 (Last version to support XP)
14.2.1057.0103 (Last version to support Vista)

 

You need to login to view this posts content.

 

Sorry, but the links you gave is for
12.1.7445.7000 (March 30, 2018)
not
12.1.7454.7000 (November 26, 2018)

Thanks anyway.

 

You need to login to view this posts content.

 

You need to login to view this posts content.

 

You need to login to view this posts content.

 

You need to login to view this posts content.

 

I have a problem, with SEP now. sometimes, it keeps poping out a dialog box saying it found some risky files. but when I look at where the files are, those files are in the SEP folder \SRTSP\Quarantine\

Anyone knows what happened?

 

You need to login to view this posts content.

 

Disable/enable Symantec Endpoint Protection - if anybody struggle with this setting
Will disable your SEP completely and you can restore your files from quarantine as needed
Is equivalent to "right-click" on tray icon:

SEP disabled

SEP enabled


SEP 14.2.4815.1101.105 x86 - disable

Code:

"C:\Program Files\Symantec\Symantec Endpoint Protection\14.2.4815.1101.105\Bin\Smc.exe" -disable -sep

SEP 14.2.4815.1101.105 x86 - enable

Code:

"C:\Program Files\Symantec\Symantec Endpoint Protection\14.2.4815.1101.105\Bin\Smc.exe" -enable -sep

SEP 14.2.4815.1101.105 x64 - disable

Code:

"C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\14.2.4815.1101.105\Bin\Smc.exe" -disable -sep

SEP 14.2.4815.1101.105 x64 - enable

Code:

"C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\14.2.4815.1101.105\Bin\Smc.exe" -enable -sep

Copy code to CMD or copy to a txt file and change extension to *.bat
Text in red: you need to modify this to reflect your installed version of SEP.

Some notes:
Depending on your settings, SEP will by default automatic re-activate after 30 min or by a restart.
Tray icon will not update, this is normal behavior (annoying yes) and has always acted this way.
Right-click on icon - enable or run code and icon is updated. (expect some time lag - 1 s -> ~n s)
If you have SEP opened in Status you will notice a faster update of status.

The auto re-activate setting is found: Change Settings - Configure Settings - Auto-Protect - Advanced


To make things easier I made 2 scripts, a reg query determine architecture, installed version, path.
Tested on SEP 12/14/x86/x64
SEP_disable.bat

Code:

@echo off
for /f "tokens=3*" %%a in ('reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Smc.exe" ^
/t REG_SZ ^| find /i "Symantec Endpoint Protection"') do set var="%%a %%b"
%var% -disable -sep

SEP_enable.bat

Code:

@echo off
for /f "tokens=3*" %%a in ('reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Smc.exe" ^
/t REG_SZ ^| find /i "Symantec Endpoint Protection"') do set var="%%a %%b"
%var% -enable -sep

 

You need to login to view this posts content.

 

That doesn't look right.....
Could you go to quarantine and delete all files listed?
If you need them, disable SEP, restore files to a location of choice, then compress them with 7z (or equivalent) setting a PW on archive, then delete all files listed in quarantine.
You may want to delete temp files in Windows temp folder and local user temp folder as well
Do manually a full rescan again and see if that helps.
Do LiveUpdate first if your pc is not normally online
Let us know the result

It will be slower on an older pc no matter which AV engine you use in general, some adjustments in settings are possible.
You can disable file cache as an example.
Disable SONAR may speed things up a little, it is not absolutely mandatory with this enabled, it tends to be a bit to aggressive some times.

 

You can also disable "Rescan the cache when new definitions load" while keeping the cache enabled, so you don't get long periods of drive scanning after definitions are updated in the background (if you trust what has already been scanned).

 

great thank you. Let me delete all those quarantined files and see what happens

 

can i check if there is another settings to be changed in order for SEP not to delete upon detection? i have changed the actions in auto-protect tab but it still deletes during manual scan

any advice? thanks!

 

@lazengan

Change Settings -> Configure Settings -> Auto-Protect -> Actions



Next time SEP bumps your file(s), disable SEP (see a few posts above), restore files from quarantine and make Exception rule and enable SEP again.
If you trust file(s) you excluded then business as usual.

 

Thanks man for it.

 

Hi, I have done this on my previous post. How about settings for manual scan? My files were deleted during a manual scan.

Many thanks

 

You need to login to view this posts content.

 

You need to login to view this posts content.