Symantec™ Endpoint Protection and Symantec Network Access Control Client Help

  • Getting started on the client
  • Responding to alerts and notifications
  • Making sure that your computer is protected
  • Managing scans
  • Managing the firewall and intrusion prevention
  • Managing Symantec Network Access Control


Getting started on the client

This section includes the following topics:

  • About the Symantec Endpoint Protection client

  • About the Symantec Network Access Control client

  • Getting started on the Status page

  • About alert icons on the Status page

  • Scanning your computer immediately

  • Where to get more information


About the Symantec Endpoint Protection client

The Symantec Endpoint Protection client combines several layers of protection to proactively secure your computer against known and unknown threats and network attacks.

Table: Types of protection describes each layer of protection.

Table: Types of protection

Layer | Description
Virus and Spyware Protection | This layer combats a wide range of threats, including spyware, worms, Trojan horses, rootkits, and adware. File System Auto-Protect continuously inspects all computer files for viruses and security risks. Internet Email Auto-Protect scans the incoming and outgoing email messages that use the POP3 or SMTP communications protocol over the Secure Sockets Layer (SSL). Microsoft Outlook Auto-Protect scans incoming and outgoing Outlook email messages. See Managing scans on your computer.
Proactive Threat Protection | Proactive threat technology includes SONAR, which offers real-time protection against zero-day attacks. SONAR can stop attacks even before traditional signature-based definitions detect a threat. SONAR uses heuristics as well as file reputation data to make decisions about applications or files. See Managing SONAR on your client computer.
Network Threat Protection | This layer comprises firewall and intrusion prevention protection. The rules-based firewall prevents unauthorized users from accessing your computer. The intrusion prevention system automatically detects and blocks network attacks. See Managing firewall protection.

Your administrator manages which types of protection the management server should download to your client computer. The client automatically downloads the virus definitions, IPS definitions, and the product updates to your computer. Users who travel with portable computers can get virus definitions and product updates directly from LiveUpdate.

See Updating the computer's protection.


About the Symantec Network Access Control client

The Symantec Network Access Control client evaluates whether a computer is properly protected and compliant with security policy before it is allowed to connect to the corporate network.

The client ensures that your computer complies with a security policy that your administrator configures. The security policy checks whether your computer runs the most recent security software, such as virus protection and firewall applications. If your computer does not run the required software, either you must update the software manually, or your client may update the software automatically. Until your security software is up to date, your computer may be blocked from connecting to the network. The client runs periodic checks to verify that your computer continues to comply with the security policy.

See How Symantec Network Access Control works.


Getting started on the Status page

When you open the client, the main window and the Status page appear.

Table: Client main window displays the main tasks that you can perform from the client's menu bar and Help option.

Table: Client main window

Click this option

To do these tasks

Help

Access the main online Help and perform the following tasks on the client:

  • View information about your computer, the client, and the client's protection.

    See Troubleshooting: Management.

    See Troubleshooting: Versions.

  • View information about the client's connection status with the management server. You can also try to connect to the server, if necessary.

    See Troubleshooting: Connection Status.

  • Import and export security policies and communication settings on an unmanaged client.

    See Troubleshooting: Management.

  • View and export debugging logs and a troubleshooting file to help your administrator diagnose a problem with the client or the client's protection.

    See Troubleshooting: Debug Logs.

    See Troubleshooting: Management.

  • Download a support utility tool to diagnose common issues with the client.

Status

View whether the computer is protected and whether the computer's license is current. The colors and alert icons in the Status page show you which technologies are enabled and protecting the client.

See About alert icons on the Status page.

You can:

  • Enable or disable one or more protection technologies.

    See About enabling and disabling protection.

  • View whether you have the latest definitions files for Virus and Spyware Protection, Proactive Threat Protection, and Network Threat Protection.

  • Run an active scan.

    See Scanning your computer immediately.

  • View the threat list and view the results of the last virus and spyware scan.

Scan for Threats

Access and perform the following tasks:

  • Run an active scan or full scan immediately.

    See Scanning your computer immediately.

  • Create a scheduled, startup, or on-demand scan.

    See Scheduling a user-defined scan.

    See Scheduling a scan to run on demand or when the computer starts up.

Change Settings

Configure settings for the following protection technologies and features:

  • Enable and configure Auto-Protect settings.

    See Customizing virus and spyware scan settings.

  • Configure the firewall settings and the Intrusion Prevention System settings.

    See Managing firewall protection.

  • View and add exceptions to scans.

    See Excluding items from scans.

  • Display the notification area icon.

    See How to determine whether the client is connected and protected.

    See Client Management Settings: General.

  • Configure the Tamper Protection settings.

    See Enabling, disabling, and configuring Tamper Protection.

  • Create a schedule to download content and product updates to the client.

    See Updating the content on a schedule.

See Managing your computer's protection.

View Quarantine

View the viruses and security risks that the client has detected and quarantined. You can restore, delete, clean, export, and add files in the quarantine.

See About quarantining files.

View Logs

View any of the client logs.

See Viewing the logs.

LiveUpdate

Run LiveUpdate immediately. LiveUpdate downloads the latest content definitions and product updates from a management server that is located within your company's network.

See Updating the content immediately.


About alert icons on the Status page

The top of the Status page displays various alert icons to indicate the protection status of the computer.

Table: Status page alert icons

Icon

Description

Shows that each protection is enabled.

Warns you that the client computer virus definitions are out of date. To receive the most current virus definitions, you can run LiveUpdate immediately.

The client computer might have also have the following issues:

  • The client computer failed the Host Integrity security compliance check. To find out what you need to do to pass the check, check the Client Management Security log.

  • Host Integrity is not connected.

See Updating the computer's protection.

Shows that one or more protections are disabled or that the client has an expired license. To enable a protection, you click Fix or Fix All.

See About enabling and disabling protection.


Scanning your computer immediately

You can manually scan for viruses and security risks at any time. You should scan your computer immediately if you recently installed the client, or if you think you have recently received a virus.

Select anything to scan from a single file to a floppy disk to your entire computer. On-demand scans include the Active Scan and Full Scan. You can also create a custom scan to run on demand.

See Scheduling a scan to run on demand or when the computer starts up.

See Updating the computer's protection.

For more information on the options on each dialog box, click Help.

To scan your computer immediately

  • Do one of the following actions:

    • In the client, on the Status page, next to Virus and Spyware Protection, click Options > Run Active Scan.

    • In the client, in the sidebar, click Scan for threats.

      Do one of the following actions:

      • Click Run Active Scan.

      • Click Run Full Scan.

      • In the scan list, right-click any scan, and then click Scan Now.

        The scan starts.

        You can view the scan progress unless your administrator disables the option. To view scan progress, click the message link that appears for the current scan: scan in progress.

        See About scan results.

    You can also pause or cancel the scan.

    See Pausing and delaying scans.

To scan your computer from Windows

  • In the My Computer window or the Windows Explorer window, right-click a file, folder, or drive, and then click Scan For Viruses.

    This feature is supported on both 32-bit and 64-bit operating systems.

    Note:

    Insight Lookup does not scan a folder or a drive when you perform this type of scan. Insight Lookup does run if you select a file or group of files to scan.


Pausing and delaying scans

The pause feature lets you stop a scan at any point during the scan and resume it at another time. You can pause any scan that you initiate.

Your administrator determines whether you can pause an administrator-initiated scan. If the Pause Scan option is not available, your administrator disabled the pause feature. If your administrator has enabled the Snooze feature, you can delay an administrator-scheduled scan for a set interval of time.

When a scan resumes, it starts from where the scan stopped.

Note:

If you pause a scan while the client scans a compressed file, the client might take several minutes to respond to the pause request.

To pause a scan you initiated

  1. When the scan runs, in the scan dialog box, click Pause Scan.

    The scan stops where it is and the scan dialog box remains open until you start the scan again.

  2. In the scan dialog box, click Resume Scan to continue the scan.

To pause or delay an administrator-initiated scan

  1. When an administrator-initiated scan runs, in the scan dialog box, click Pause Scan.

  2. In the Scheduled Scan Pause dialog box, do one of the following actions:

    • To pause the scan temporarily, click Pause.

    • To delay the scan, click Snooze 1 hour or Snooze 3 hours.

      Your administrator specifies the period of time that you are allowed to delay the scan. When the pause reaches the limit, the scan restarts from where it began. Your administrator specifies the number of times that you can delay the scheduled scan before this feature is disabled.

    • To continue the scan without pausing, click Continue.

More Information

Managing scans on your computer


Where to get more information

The product includes several sources of information.

Table: Symantec Web sites displays the Web sites where you can get additional information to help you use the product.

Table: Symantec Web sites

Types of information | Web address
Symantec Endpoint Protection software | http://www.symantec.com/business/products/downloads/
Public knowledge base Releases and updates Manuals and documentation updates Contact options | Symantec Endpoint Protection: http://www.symantec.com/business/support/overview.jsp?pid=54619 Symantec Network Access Control: http://www.symantec.com/business/support/overview.jsp?pid=52788
Virus and other threat information and updates | http://securityresponse.symantec.com
Product news and updates | http://enterprisesecurity.symantec.com
Free online technical training | http://go.symantec.com/education_septc
Symantec Educational Services | http://go.symantec.com/education_sep
Symantec Connect forums: | Symantec Endpoint Protection: http://www.symantec.com/connect/security/forums/endpoint-protection-antivirus Symantec Network Access Control: http://www.symantec.com/connect/security/forums/network-access-control


Responding to alerts and notifications

This section includes the following topics:

  • Types of alerts and notifications

  • About scan results

  • Responding to a virus or risk detection

  • Responding to Download Insight messages that ask you to allow or block a file that you try to download

  • Responding to messages that ask you to allow or block an application

  • About expired license messages

  • Responding to messages to update the client software


Types of alerts and notifications

The client works in the background to keep your computer safe from malicious activity. Sometimes the client needs to notify you about an activity or to prompt you for feedback.

Table: Types of alerts and notifications displays the types of messages you might see and need to respond to.

Table: Types of alerts and notifications

Alert

Description

<scan name> started on or Symantec Endpoint Protection Detection Results dialog box

If a scan detects a virus or a security risk, the scan results or Symantec Endpoint Protection Detection Results dialog box appears with details about the infection. The dialog box also displays the action that the scan performs on the risk. You usually do not need to take any further actions other than to review the activity and to close the dialog box. You can take action if necessary, however.

See About scan results.<scan name> started on or Symantec Endpoint Protection Detection Results

Other message dialog boxes

You may see pop-up messages for the following reasons:

  • The client automatically updates the client software.

    See Responding to messages to update the client software.

  • The client asks you to allow or block an application.

    See Responding to messages that ask you to allow or block an application.

  • The client's evaluation license has expired.

    See About expired license messages.

Notification area icon messages

Notifications that appear above the notification area icon occur in the following situations:

  • The client blocks an application.

    For example, you might see the following notification:

    Traffic has been blocked from this application:
(application name)

    If the client is configured to block all traffic, these notifications appear frequently. If your client is configured to allow all traffic, these notifications do not appear.

  • The client detects a network attack against your computer.

    You might see the following type of notification:

    Traffic from IP address 192.168.0.3 is blocked
from 2/14/2010 15:37:58 to 2/14/2010 15:47:58.
Port Scan attack is logged.

  • The security compliance check failed. Traffic may be blocked from going to and from your computer

You do not need to do anything else other than to read the messages.

See How to determine whether the client is connected and protected.


About scan results

For managed clients, your administrator typically configures a full scan to run at least one time each week. For unmanaged clients, an automatically generated Active Scan runs when you start up your computer. By default, Auto-Protect runs continuously on your computer.

When the scans run, a scan dialog box appears to report progress and to show the results of the scan. When the scan is completed, the results appear in the list. If the client detects no viruses or security risks, the list remains empty and the status is completed.

If the client detects risks during the scan, the scan results dialog box shows results with the following information:

  • The names of the viruses or security risks

  • The names of the infected files

  • The actions that the client performs on the risks

If the client detects a virus or security risk, you might need to act on an infected file.

Note:

For managed clients, your administrator might choose to hide the scan results dialog box. If the client is unmanaged, you can display or hide this dialog box.

If you or your administrator configures the client software to display a scan results dialog box, you can pause, restart, or stop the scan.

More Information

About managed clients and unmanaged clients

Responding to a virus or risk detection

Pausing and delaying scans


Responding to a virus or risk detection

When an administrator-defined scan, a user-defined scan, or Auto-Protect runs, you might see a scan results dialog box. You can use the scan results dialog box to act on the affected file immediately.

For example, you might decide to delete a cleaned file because you want to replace it with an original file.

You can also use the Quarantine or the Risk or Scan log to act on the file later.

To respond to a virus or risk detection in the scan results dialog box

  1. In the scan results dialog box, select the files on which you want to act.

  2. Right-click the selection, and then select one of the following options:

    Clean

    Removes the virus from the file. This option is only available for viruses.

    Exclude

    Excludes the file from being scanned again.

    Delete Permanently

    Deletes the infected file and all side effects. For security risks, use this action with caution. In some cases, if you delete security risks you might cause an application to lose functionality.

    Undo Action Taken

    Reverses the action taken.

    Move To Quarantine

    Places the infected files in the Quarantine. For security risks, the client also tries to remove or repair the side effects. In some cases, if the client quarantines a security risk, it might cause an application to lose functionality.

    Properties

    Displays the information about the virus or security risk.

    In some cases, the action might not be available.

  3. In the dialog box, click Close.

    You might not be able to close the dialog box if the risks that are listed require you to take action. For example, the client may need to terminate a process or an application, or it may need to stop a service. In that case, a Remove Risks Now dialog box appears.

  4. If the Remove Risks Now dialog box appears, click one of the following options:

    • Yes

      The client removes the risk. The removal of the risk might require a restart. Information in the dialog box indicates whether or not a restart is required.

    • No

      The results dialog box reminds you that you still need to take action. However, the Remove Risks Now dialog box is suppressed until you restart your computer.

  5. If the results dialog box did not close in step 3, click Close.

More Information

Managing quarantined files on your client computer

How scans respond to a virus or risk detection

Viewing the logs

Managing scans on your computer


About removing a virus or risk from an infected file

If the client needs to terminate a process or application or stop a service, the Remove Risks Now option is active. You might not be able to close the dialog box if risks in the dialog require you to take action.

Table: Options in the results dialog box describes the options in the results dialog box.

Table: Options in the results dialog box

Option

Description

Close

Closes the results dialog box if you do not need to take action on any of the risks.

If you need to take action, one of the following notifications appears:

  • Remove Risk Required

    Appears when a risk requires process termination. If you choose to remove the risk, you return to the results dialog box. If a restart is also required, the information in the risk's row in the dialog box indicates that a restart is required.

  • Restart Required

    Appears when a risk requires a restart.

  • Remove Risk and Restart Required

    Appears when a risk requires process termination and another risk requires a restart.

Remove Risks Now

Displays the Remove Risk dialog box.

In the Remove Risk dialog box, you can select one of the following choices for each risk:

  • Yes

    The client removes the risk. The removal of the risk might require a restart. Information in the dialog box indicates whether or not a restart is required.

  • No

    When you close the results dialog box, the Remove Risk dialog box appears. The dialog box reminds you that you still need to take action. However, the Remove Risk dialog box is suppressed until you restart your computer.

If a restart is required, the removal or repair is not complete until you restart the computer.

You might need to take action on a risk but choose not to take action right now.

The risk can be removed or repaired at a later time in the following ways:

  • You can open the risk log, right-click the risk, and then take an action.

  • You can run a scan to detect the risk and reopen the results dialog box.

You can also take action by right-clicking a risk in the dialog box and by selecting an action. The actions that you can take depend on the actions that were configured for the particular type of risk that the scan detected.

More Information

Responding to a virus or risk detection


Responding to Download Insight messages that ask you to allow or block a file that you try to download

When Download Insight notifications are enabled, you receive messages about the malicious and the unproven files that Download Insight detects when you try to download them.

Note:

Regardless of whether or not notifications are enabled, you receive detection messages when the action for unproven files is Prompt.

You or your administrator can change how sensitive Download Insight is to malicious files. Changing the sensitivity level might change the number of notifications that you receive.

Download Insight uses Insight, Symantec's technology that evaluates and determines a file rating that is based on its global community of millions of users.

The Download Insight notification shows the following information about the detected file:

  • File reputation

    The file reputation indicates the trustworthiness of a file. Malicious files are not trustworthy. Unproven files may or may not be trustworthy.

  • How common the file is in the community

    The prevalence of a file is important. Files that are not common might be more likely to be threats.

  • How new the file is

    The newer a file is the less information Symantec has about the file.

The information can help you to decide whether to allow or block the file.

To respond to a Download Insight detection that asks you to allow or block a file

  1. In the Download Insight detection message, do one of the following actions:

    • Click Remove this file from my computer.

      Download Insight moves the file to the Quarantine. This option only appears for unproven files.

    • Click Allow this file.

      You might see a permission dialog that asks whether or not you are sure that you want to allow the file.

      If you choose to allow an unproven file that was not quarantined, the file runs automatically. If you choose to allow a quarantined file, the file does not automatically run. You can run the file from your temporary Internet folder.

      Typically the folder location is \\Documents and Settings\username\Local Settings\Temporary Internet Files.

  2. On unmanaged clients, if you allow a file, Symantec Endpoint Protection automatically creates an exception for the file on this computer. On managed clients, if your administrator lets you create exceptions, Symantec Endpoint Protection automatically creates an exception for the file on this computer.

More Information

Managing scans on your computer

How Symantec Endpoint Protection uses reputation data to make decisions about files


Responding to messages that ask you to allow or block an application

When an application on your computer tries to access the network, the client might ask you to allow or block the application. You can choose to block an application that you think is unsafe from accessing the network.

This type of notification appears for one of the following reasons:

  • The application asks to access your network connection.

  • An application that has accessed your network connection has been upgraded.

  • Your administrator updated the client software.

  • The client switches users through Fast User Switching.

You might see the following type of message, which tells you when an application tries to access your computer:

IEXPLORE.EXE is attempting to access the network.
Do you want to allow this program to access the network?

To respond to a message that asks you to allow or block an application

  1. Optionally, to suppress the message the next time the application tries to access the network, in the dialog box, click Remember my answer, and do not ask me again for this application.

  2. Optionally, to learn more about the connection and the application, click Detail >>.

  3. Do one of the following actions:

    • To allow the application to access the network, click Yes.

    • To block the application from accessing the network, click No.

    You can also change the action of the application in the Running Applications field or in the Applications list.

See Configuring application-specific settings.


About expired license messages

The client uses a license to update the virus definitions for scans and to update the client software. The client may use an evaluation license or a paid license. If either license has expired, the client does not update any content or the client software.

Table: Types of licenses

License type

Description

Evaluation license

If an evaluation license has expired, the top of the client's Status pane is red and displays the following message:

Evaluation License has expired.

All content download will discontinue on date.
Please contact your Administrator to purchase a full
Symantec Endpoint Protection License.

You can also view the expiration date by clicking Help > About.

Paid license

If a paid license has expired, the top of the client's Status pane is yellow and displays the following message:

Virus and Spyware Protection definitions are out
of date.

For either type of license, you must contact your administrator to update or renew the license.

See Types of alerts and notifications.

More Information

Viewing the logs


Responding to messages to update the client software

If the client software is automatically updated, you may see the following notification:

Symantec Endpoint Protection has detected that
a newer version of the software is available from
the Symantec Endpoint Protection Manager.
Do you wish to download it now?

To respond to an automatic update notification

  1. Do one of the following actions:

    • To download the software immediately, click Download Now.

    • To be reminded after the specified time, click Remind me later.

  2. If a message appears after the installation process begins for the updated software, click OK.


Making sure that your computer is protected

This section includes the following topics:

  • Managing your computer's protection

  • Updating the computer's protection

  • How to determine whether the client is connected and protected

  • About managed clients and unmanaged clients

  • Checking whether the client is managed or unmanaged

  • About enabling and disabling protection

  • Enabling or disabling protection on the client computer

  • Enabling or disabling Auto-Protect

  • Enabling, disabling, and configuring Tamper Protection

  • About the logs

  • Viewing the logs

  • Tracing logged events back to their source

  • Exporting log data


Managing your computer's protection

By default, your client computer is protected and you should not need to configure the client. However, you may want to monitor your protection for the following reasons:

  • Your computer runs an unmanaged client.

    Once an unmanaged client is installed, only you have control over your computer's protection. An unmanaged client is protected by default. But you may need to modify the computer's protection settings.

    See About managed clients and unmanaged clients.

  • You want to enable or disable one or more protection technologies.

  • You want to verify that you have the latest virus definitions.

  • You have heard of a recent virus and want to run a scan.

Table: Process for managing your computer's protection displays the process to make sure that your computer is protected.

Table: Process for managing your computer's protection

Step

Description

Respond to alerts or notifications

Respond to messages that appear, asking you for input. For example, a scan might detect a virus or security risk and display a scan results dialog box that asks you to act on the detection.

See Types of alerts and notifications.

Check the protection status

Regularly check the Status page to determine that all the types of protections are enabled.

See Getting started on the Status page.

See Enabling or disabling protection on the client computer.

Update virus definitions

(Unmanaged client only)

Check that the latest virus definitions are installed on your computer.

  • Check whether you have the latest protection updates. You can check the date and number of these definitions files on the client's Status page, under each type of protection.

  • Obtain the latest protection updates.

    See Updating the computer's protection.

Scan your computer

Run a scan to see if the computer or your email application has any viruses. By default, the client scans the computer when you turn it on, but you can scan the computer at any time.

See Scanning your computer immediately.

Adjust protection settings

In most cases, the default settings provide adequate protection for your computer. If necessary, you can decrease or increase the following types of protection:

  • Scheduling additional scans

    See Managing scans on your computer.

  • Adding firewall rules (unmanaged client only)

    See Managing firewall protection.

View logs for detections or attacks

Check the logs to see if your client has found a virus detection or network attack.

See Viewing the logs.

Update the security policy

(Managed client only)

Check that the client received the latest security policy. A security policy includes the most current protection technology settings for your client.

The security policy is updated automatically. To ensure that you have the latest policy, you can update it manually by right-clicking the client notification area icon and clicking Update Policy.

See How to determine whether the client is connected and protected.


Updating the computer's protection

Symantec products depend on current information to protect your computer from newly discovered threats. Symantec makes this information available through LiveUpdate.

Content updates are the files that keep your Symantec products current with the latest threat protection technology. LiveUpdate retrieves the new content files from a Symantec Internet site, and then replaces the old content files. The updates that you receive depend on which products are installed on your computer. How your computer receives the updates depends on whether your computer is managed or unmanaged, and on how your administrator has configured updates.

The following types of files are examples of content updates:

  • Virus definition files for Virus and Spyware Protection.

  • Heuristic signatures and commercial application lists for Proactive Threat Protection.

  • IPS definition files for Network Threat Protection.

    See About Network Threat Protection.

LiveUpdate can also provide improvements to the installed client. These improvements are usually created to extend the operating system or hardware compatibility, adjust performance issues, or fix product errors. These improvements to the client are released on an as-needed basis. A client computer can receive these improvements directly from a LiveUpdate server. A managed client computer can also receive these improvement updates automatically from a management server at your company.

Table: Ways to update content on your computer

Task | Description
Update the content on a schedule | By default, LiveUpdate runs automatically at scheduled intervals. On an unmanaged client, you can disable or change a LiveUpdate schedule. See Updating the content on a schedule.
Update the content immediately | Based on your security settings, you can run LiveUpdate immediately. See Updating the content immediately.


Updating the content immediately

You can update the content files immediately by using LiveUpdate. You should run LiveUpdate manually for the following reasons:

  • The client software was installed recently.

  • It has been a long time since the last scan.

  • You suspect you have a virus or other malware problem.

See Updating the content on a schedule.

See Updating the computer's protection.

To update your protection immediately

  • In the client, in the sidebar, click LiveUpdate.

    LiveUpdate connects to the Symantec server, checks for available updates, then downloads and installs them automatically.


Updating the content on a schedule

You can create a schedule so that LiveUpdate runs automatically at scheduled intervals. You may want to schedule LiveUpdate to run during a time that you do not use your computer.

See Updating the content immediately.

Note:

If you have a managed client, you can only configure LiveUpdate to run on a schedule if your administrator has enabled you to. If the padlock icon appears and the options are grayed out, you cannot update your content on a schedule.

To update your protection on a schedule

  1. In the client, in the sidebar, click Change settings.

  2. Beside Client Management, click Configure Settings.

  3. In the Client Management Settings dialog box, click LiveUpdate.

  4. On the LiveUpdate tab, check Enable automatic updates.

  5. In the Frequency and Time group box, select whether you want the updates to run daily, weekly, or monthly. Then select the day or week and time of day you want the updates to run.

    The time settings depend on what you select from the Frequency group box. The availability of the other options on this dialog box also depends on the frequency that you select.

  6. In the Retry Window group box, check Keep trying for, and then specify the time interval during which the client tries to run LiveUpdate again.

  7. In the Randomization Options group box, check Randomize the start time to be + or - 9in hours), and then specify the number of hours or days.

    This option sets a range of time before or after the scheduled time for the update to start.

  8. In the Idle Detection group box, check Delay scheduled LiveUpdates until the system is idle. Overdue sessions will eventually run unconditionally.

    You can also configure options for proxy server connection to an internal LiveUpdate server. See the online help for information about the options.

  9. Click OK.


How to determine whether the client is connected and protected

The client uses a notification area icon to indicate whether the client is online or offline and whether the client computer is adequately protected. You can right-click this icon to display frequently used commands. The icon is located in the lower-right hand corner of the client computer desktop.

Note:

On managed clients, the notification area icon does not appear if your administrator has configured it to be unavailable.

Table: Symantec Endpoint Protection client status icons

Icon | Description
 | The client runs with no problems. It is either offline or unmanaged. Unmanaged clients are not connected to a management server. The icon is a plain yellow shield.
 | The client runs with no problems. It is connected to and communicates with the server. All components of the security policy protect the computer. The icon is a yellow shield with a green dot.
 | The client has a minor problem. For example, the virus definitions may be out of date. The icon is a yellow shield and a light yellow dot that contains a black exclamation mark.
 | The client does not run, has a major problem, or has at least one protection technology disabled. For example, Network Threat Protection may be disabled. The icon is a yellow shield with a white dot outlined in red and a red line across the dot.

Table: Symantec Network Access Control client status icons displays the Symantec Network Access Control client status icons that appear in notification area.

Table: Symantec Network Access Control client status icons

Icon | Description
 | The client runs with no problems and has both passed the Host Integrity check and updated the security policy. It is either offline or unmanaged. Unmanaged clients are not connected to a management server. The icon is a plain gold key.
 | The client runs with no problems and has both passed the Host Integrity check and updated the security policy. It communicates with the server. The icon is a gold key with a green dot.
 | The client has either failed the Host Integrity check or not updated the security policy. The icon is a gold key with a red dot that contains a white "x."

See Hiding and displaying the notification area icon.


Hiding and displaying the notification area icon

You can hide the notification area icon if necessary. For example, you can hide it if you need more space on the Windows taskbar.

See How to determine whether the client is connected and protected.

Note:

On managed clients, you cannot hide the notification area icon if your administrator has restricted this functionality.

To hide or display the notification area icon

  1. In the main window, in the sidebar, click Change settings.

  2. On the Change Settings page, for Client Management, click Configure Settings.

  3. In the Client Management Settings dialog box, on the General tab, under Display Options, uncheck or check Show Symantec security icon in notification area.

  4. Click OK.


About managed clients and unmanaged clients

Your administrator can install the client as either a managed client (administrator-managed installation) or an unmanaged client (standalone installation).

Table: Differences between a managed client and an unmanaged client

Client type

Description

Managed client

A managed client communicates with a management server in your network. The administrator configures the protection and the default settings, and the management server downloads the settings to the client. If the administrator makes a change to the protection, the change is almost immediately downloaded to the client.

Administrators can change the level at which you interact with the client in the following ways:

  • The administrator manages the client completely.

    You are not required to configure the client. All the settings are locked or unavailable, but you can view information about what the client does on your computer.

  • The administrator manages the client, but you can change some client settings and perform some tasks. For example, you may be able to run your own scans and manually retrieve client updates and protection updates.

    The availability of the client settings, as well as the values of the settings themselves, can change periodically. For example, a setting might change when your administrator updates the policy that controls your client's protection.

  • The administrator manages the client, but you can change all the client settings and perform all the protection tasks.

Unmanaged client

An unmanaged client does not communicate with a management server and an administrator does not manage the client.

An unmanaged client can be one of the following types:

  • A standalone computer that is not connected to a network, such as a home computer or a laptop. The computer must include a Symantec Endpoint Protection installation that uses either the default option settings or administrator-preset settings.

  • A remote computer that connects to the corporate network that must meet security requirements before it connects.

The client has default settings when it is first installed. After the client is installed, you can change all the client settings and perform all the protection tasks.

See Checking whether the client is managed or unmanaged.

Table: Differences between a managed client and an unmanaged client by feature area describes the differences in the user interface between a managed and unmanaged client.

Table: Differences between a managed client and an unmanaged client by feature area

Feature area | Centrally managed client | Self-managed client
Virus and Spyware Protection | The client displays a locked padlock option and the option appears dimmed for the options that you cannot configure. | The client does not display either a locked padlock or an unlocked padlock.
Proactive Threat Protection | The client displays a locked padlock option and the option appears dimmed for the options that you cannot configure. | The client does not display either a locked padlock or an unlocked padlock.
Client management and Network Threat Protection settings | The settings that the administrator controls do not appear. | All the settings appear.

See Types of alerts and notifications.


Checking whether the client is managed or unmanaged

To check how much control you have to configure protection on your client, you first check whether your client is managed or unmanaged. You can configure more settings on a unmanaged client than on a managed client.

See About managed clients and unmanaged clients.

To check whether the client is managed or unmanaged

  1. On the Status page, click Help > Troubleshooting.

  2. In the Troubleshooting dialog box, click Management.

  3. In the Management panel, under General Information, next to Server, look for the following information:

    • If the client is managed, the Server field displays either the management server's address or the text Offline.

      The address can be an IP address, DNS name, or NetBIOS name. For example, a DNS name might be SEPMServer1. If the client is managed but not currently connected to a management server, this field is Offline.

    • If the client is unmanaged, the Server field is Self-managed.

  4. Click Close.


About enabling and disabling protection

In general, you always want to keep the protection technologies enabled on the client computer.

You might need to temporarily disable either all the protection technologies or individual protection technologies if you have a problem with the client computer. For example, if an application does not run or does not run correctly, you might want to disable Network Threat Protection. If you still have the problem after you disable all protection technologies, you know that the problem is not the client.

Warning:

Be sure to enable any of the protections when you have completed your troubleshooting task to ensure that the computer remains protected.

Table: Purpose for disabling a protection technology describes the reasons why you might want to disable each protection technology.

Table: Purpose for disabling a protection technology

Protection technology

Purpose for disabling the protection technology

Virus and Spyware Protection

If you disable this protection, you disable Auto-Protect only.

The scheduled or startup scans still run if you or your administrator has configured them to do so.

You might enable or disable Auto-Protect for the following reasons:

  • Auto-Protect might block you from opening a document. For example, if you open a Microsoft Word that has a macro, Auto-Protect may not allow you to open it. If you know the document is safe, you can disable Auto-Protect.

  • Auto-Protect may warn you about a virus-like activity that you know is not the work of a virus. For example, you might get a warning when you install new computer applications. If you plan to install more applications and you want to avoid the warning, you can temporarily disable Auto-Protect.

  • Auto-Protect may interfere with Windows driver replacement.

  • Auto-Protect might slow down the client computer.

Note:

If you disable Auto-Protect, you also disable Download Insight, even if Download Insight is enabled. SONAR also cannot detect heuristic threats. SONAR detection of host file and system changes continues to function.

See Enabling or disabling Auto-Protect.

If Auto-Protect causes a problem with an application, it is better to create an exception than to permanently disable the protection.

See Excluding items from scans.

Proactive Threat Protection

You might want to disable Proactive Threat Protection for the following reasons:

  • You see too many warnings about the threats that you know are not threats.

  • Proactive Threat Protection might slow down the client computer.

See Enabling or disabling protection on the client computer.

Network Threat Protection

You might want to disable Network Threat Protection for the following reasons:

  • You install an application that might cause the firewall to block it.

  • A firewall rule or firewall setting blocks an application due to an administrator's mistake.

  • The firewall or the intrusion prevention system causes network connectivity-related issues.

  • The firewall might slow down the client computer.

  • You cannot open an application.

See Enabling or disabling intrusion prevention.

See Enabling or disabling protection on the client computer.

If you are not sure that Network Threat Protection causes the problem, you might need to disable all the protection technologies.

On a managed client, your administrator might lock Network Threat Protection completely so that you cannot enable or disable it.

Tamper Protection

Typically you should keep Tamper Protection enabled.

You might want to disable Tamper Protection temporarily to make sure that you do not get false positive detections.

See Enabling, disabling, and configuring Tamper Protection.


Enabling or disabling protection on the client computer

On the client, when any of the protections are disabled:

  • The status bar at the top of the Status page is red.

  • The client's icon appears with a universal no sign, a red circle with a diagonal slash. The client icon appears as a full shield in the taskbar in the lower-right corner of your Windows desktop. In some configurations, the icon does not appear.

    See How to determine whether the client is connected and protected.

On a managed client, your administrator can enable any protection at any time.

You can also disable Auto-Protect, Proactive Threat Protection, or Network Threat Protection for troubleshooting purposes. On a managed client, your administrator might lock a protection so that you cannot disable it.

See About enabling and disabling protection.

See Enabling or disabling Auto-Protect.

To enable protection technologies from the Status page

  • On the client, at the top of the Status page, click Fix or Fix All.

To enable or disable protection technologies from the taskbar

  • On the Windows desktop, in the notification area, right-click the client icon, and then do one of the following actions:

    • Click Enable Symantec Endpoint Protection.

    • Click Disable Symantec Endpoint Protection.

To enable or disable Proactive Threat Protection or Network Threat Protection

  • In the client, on the Status page, beside protection type Protection, do one of the following tasks:

    • Click Options > Enable protection type Protection.

    • Click Options > Disable all protection type Protection features.


Enabling or disabling Auto-Protect

You can enable or disable Auto-Protect for files and processes, Internet email, and email groupware applications. When any type of Auto-Protect is disabled, the virus and spyware status appears red on the Status page.

When you right-click the icon, a check mark appears next to Enable Auto-Protect when Auto-Protect for files and processes is enabled.

See About alert icons on the Status page.

See About enabling and disabling protection.

Note:

On a managed client, your administrator might lock Auto-Protect so that you cannot disable it. Also, your administrator might specify that you can disable Auto-Protect temporarily, but that Auto-Protect turns on automatically after a specified amount of time.

If you have not changed the default option settings, Auto-Protect loads when you start your computer to guard against viruses and security risks. Auto-Protect checks programs for viruses and security risks as they run. It also monitors your computer for any activity that might indicate the presence of a virus or security risk. When a virus, virus-like activity (an event that can be the work of a virus), or a security risk is detected, Auto-Protect alerts you.

Note:

If you disable Auto-Protect, you also disable Download Insight even if Download Insight is enabled. SONAR also cannot detect heuristic threats; however, SONAR continues to detect host file and system changes.

To enable or disable Auto-Protect for the file system

  • In the client, on the Status page, next to Virus and Spyware Protection, do one of the following actions:

    • Click Options > Enable Virus and Spyware Protection.

    • Click Options > Disable all Virus and Spyware Protection features.

To enable or disable Auto-Protect for email

  1. In the client, in the sidebar, click Change settings.

  2. Next to Virus and Spyware Protection, click Configure Settings.

  3. Do one of the following actions:

    • On the Internet Email Auto-Protect tab, check or uncheck Enable Internet Email Auto-Protect.

    • On the Outlook Auto-Protect tab, check or uncheck Enable Microsoft Outlook Auto-Protect.

    • On the Notes Auto-Protect tab, check or uncheck Enable Lotus Notes Auto-Protect.

  4. Click OK.


Enabling, disabling, and configuring Tamper Protection

Tamper Protection provides real-time protection for Symantec applications that run on servers and clients. It prevents non-Symantec processes such as worms, Trojan horses, viruses, and security risks, from affecting Symantec resources. You can configure the software to block or log attempts to modify Symantec resources.

If Tamper Protection is enabled, you can choose the action that it takes when it detects an attempt to tamper with Symantec software. You can also have Tamper Protection display a message to notify you of tamper attempts. If you want to customize the message, you can use the predefined variables that Tamper Protection fills in with the appropriate information.

Note:

On a managed client, your administrator might lock the Tamper Protection settings.

For information about the predefined variables, see the Help on the Tamper Protection tab.

To enable or disable Tamper Protection

  1. In the client, in the sidebar, click Change settings.

  2. Next to Client Management, click Configure Settings.

  3. On the Tamper Protection tab, check or uncheck Protect Symantec security software from being tampered with or shut down.

  4. Click OK.

To configure Tamper Protection

  1. In the client, in the sidebar, click Change settings.

  2. Next to Client Management, click Configure Settings.

  3. On the Tamper Protection tab, in the Action to take if an application attempts to tamper with or shut down Symantec security software list box, click Block it and log the event or Log the event only.

  4. If you want to be notified when Tamper Protection detects suspicious behavior, check Display a notification message when tampering is detected.

    If you enable these notification messages, you may receive notifications about Windows processes as well as Symantec processes.

  5. To customize the message that appears, update the text in the message field.

  6. Click OK.

More Information

About enabling and disabling protection


About the logs

Logs contain information about client configuration changes, security-related activities, and errors. These records are called events. The logs display these events with any relevant additional information.

Security-related activities include information about virus detections, computer status, and the traffic that enters or exits your computer. If you use a managed client, its logs can be regularly uploaded to the management server. An administrator can use their data to analyze the overall security status of the network.

Logs are an important method for tracking your computer's activity and its interaction with other computers and networks. You can use the information in the logs to track the trends that relate to viruses, security risks, and attacks on your computer. If several people use the same computer, you might be able to identify who introduces risks, and help that person to use better precautions.

For more information about a log, you can press F1 to view the help for that log.

Table: Client logs describes the event types that each log displays.

Table: Client logs

Log

Description

Scan Log

Contains entries about the scans that have run on your computer over time.

Risk Log

Contains entries about viruses and security risks, such as adware and spyware, that have infected your computer. Security risks include a link to the Symantec Security Response Web page that provides additional information.

See Quarantining a file from the Risk or Scan Log.

Virus and Spyware Protection System Log

Contains the information about system activities on your computer that are related to viruses and security risks. This information includes configuration changes, errors, and definitions file information.

Threat Log

Contains the information about the threats that SONAR detected on your computer. SONAR detects any files that act suspiciously. SONAR also detects system changes.

Proactive Threat Protection System Log

Contains information about system activities on your computer that are related to SONAR.

Traffic Log

Contains the events that concern firewall traffic and intrusion prevention attacks. The log contains information about the connections that your computer makes through the network.

The Network Threat Protection logs can help you to detect potentially threatening activity such as port scanning. They can also be used to trace traffic back to its source. You can also use Network Protection logs to help troubleshoot connectivity problems or possible network attacks. The logs can tell you when your computer has been blocked from the network and help you to determine why your access has been blocked.

Packet Log

Contains the information about the packets of data that enter or leave through the ports on your computer.

By default, the Packet log is disabled. On a managed client, you cannot enable the Packet log. On an unmanaged client, you can enable the Packet Log.

See Enabling the Packet Log.

Control Log

The Control Log contains information about the Windows registry keys, files, and DLLs that an application accesses, as well as the applications that your computer runs.

Security Log

Contains the information about the activities that could pose a threat to your computer. For example, information might appear about such activities as denial-of-service attacks, port scans, and executable file alterations.

Client Management System Log

Contains the information about all of the operational changes that have occurred on your computer.

The changes might include the following activities:

  • A service starts or stops

  • The computer detects network applications

  • The software is configured

  • The status of a client serving as a group update provider

Tamper Protection Log

Contains entries about the attempts to tamper with the Symantec applications on your computer. These entries contain information about the attempts that Tamper Protection detected or detected and thwarted.

Debug Logs

Contains the information about the client, scans, and the firewall for troubleshooting purposes. Your administrator may ask you to enable or configure the logs and then export them.

More Information

Viewing the logs


Viewing the logs

You can view the logs on your computer to see the details of the events that have occurred.

Note:

If Network Threat Protection or Network Access Control are not installed, you cannot view the Security Log, System Log, or Control Log.

To view a log

  1. In the main window, in the sidebar, click View Logs.

  2. Click View Logs next to one of the following items:

    • Virus and Spyware Protection

    • Proactive Threat Protection

    • Network Threat Protection

    • Client Management

    • Network Access Control

    Some items might not appear depending on your installation.

  3. In the drop-down menu, select the log that you want to view.

More Information

About the logs


Enabling the Packet Log

All Network Threat Protection logs and Client Management logs are enabled by default, except for the Packet Log. On unmanaged clients, you can enable and disable the Packet Log.

On managed clients, your administrator might let you enable or disable the Packet Log.

To enable the Packet Log

  1. In the client, on the Status page, to the right of Network Threat Protection, click Options, and then click Change Settings.

  2. In the Network Threat Protection Settings dialog box, click Logs.

  3. Check Enable Packet Log.

  4. Click OK.

More Information

About the logs


Tracing logged events back to their source

You can trace some events back to pinpoint the source of data from a logged event. A back trace shows the exact steps, or hops, that incoming traffic made. A hop is a transition point such as a router, which a packet travels through as it goes from computer to computer on the Internet. A back trace follows a data packet backwards, by discovering which routers the data took to reach your computer.

For some log entries, you can trace a data packet that was used in an attack attempt. Each router that a data packet passes through has an IP address. You can view the IP address and other details. The information that is displayed does not guarantee that you have discovered who the hacker truly is. The final hop's IP address lists the owner of the router that the hackers have connected through, and not necessarily the hackers themselves.

You can back trace some logged events in the Security Log and the Traffic Log.

To back trace a logged event

  1. In the client, in the sidebar, click View logs.

  2. To the right of Network Threat Protection or Client Management, click View Logs. Then, click the log that contains the entry that you want to trace.

  3. In the log view window, select the row of the entry that you want to trace.

  4. Click Action, and then click BackTrace.

  5. In the Back Trace Information dialog box, click Who is > > to view detailed information on each hop.

    A drop panel displays detailed information about the owner of the IP address from which the traffic event originated. You can use Ctrl-C and Ctrl-V to cut and paste the information in the panel into an email message to your administrator.

  6. Click Who is << again to hide the information.

  7. When you are finished, click OK.

More Information

About the logs


Exporting log data

You can export the information in some logs into a file with comma-separated values (.csv) or into an Access Database (*.mdb) format. The .csv format is a common file format that most spreadsheet and database programs use to import data. After you import the data into another program, you can use the data to create presentations, graphs, or to combine with other information. You can export the information in the Network Threat Protection logs and the Client Management logs into tab-delimited text files.

Note:

If you run the client software on Windows Server 2008 Server Core, you cannot export log data to an .mdb file. The .mdb format requires some Microsoft applications that are not available on Server Core.

You can export the following logs to a .csv or .mdb file:

  • Virus and Spyware System Log

  • Virus and Spyware Risk Log

  • Virus and Spyware Scan Log

  • Proactive Threat Protection System Log

  • Proactive Threat Protection Threat Log

  • Tamper Protection Log

Note:

If you filter the log data in any way and then export it, you only export the data that you have currently filtered. This restriction is not true for the logs that you export to a tab-delimited text file. All the data in those logs is exported.

You can export the following logs to a tab-delimited .txt file:

  • Client Management Control Log

  • Client Management Security Log

  • Client Management System Log

  • Network Threat Protection Packet Log

  • Network Threat Protection Traffic Log

Note:

In addition to a tab-delimited text file, you can also export the data from the Packet Log into network monitor format or NetXray format.

On the Server Core installation of Windows Server 2008, the user interface dialog boxes might differ from the ones that are described in these procedures.

To export data to a .csv file

  1. In the client, in the sidebar, click View logs.

  2. Beside either Virus and Spyware Protection or Proactive Threat Protection, click View Logs.

  3. Click the name of the log you want.

  4. In the log window, make sure that the data that you want to save appears, and then click Export.

  5. In the Save in drop-down list, browse to the directory where you want the file to be saved.

  6. In the File name text box, type a name for the file.

  7. Click Save.

  8. Click OK.

To export Network Threat Protection log data or Client Management log data to text file

  1. In the client, in the sidebar, click View logs.

  2. To the right of Network Threat Protection or Client Management, click View Logs.

  3. Click the name of the log you want to export data from.

  4. Click File > Export.

    If you selected the Packet Log, you can click Export to network monitor format or Export to Netxray format instead.

  5. In the Save in drop-down list, browse to the directory where you want the file to be saved.

  6. In the File name text box, type a name for the file.

  7. Click Save.

  8. Click File > Exit.

More Information

About the logs


Managing scans

This section includes the following topics:

  • Managing scans on your computer

  • How virus and spyware scans work

  • Scheduling a user-defined scan

  • Scheduling a scan to run on demand or when the computer starts up

  • Managing Download Insight detections on your computer

  • Customizing Download Insight settings

  • Customizing virus and spyware scan settings

  • Configuring actions for malware and security risk detections

  • About excluding items from scans

  • Excluding items from scans

  • Managing quarantined files on your client computer

  • About submitting information about detections to Symantec Security Response

  • Submitting information about detections to Symantec Security Response

  • About the client and the Windows Security Center

  • Managing SONAR on your client computer


Managing scans on your computer

By default, a managed client runs an active scan every day at 12:30 P.M. An unmanaged client installs with a preset active scan that is disabled.

If you have an unmanaged client, you can manage your own scans. On a managed client, you might be able to configure your own scans, if your administrator made these settings available.

Table: Managing scans

Step

Description

Read about how scans work

Review the types of scans and the types of viruses and security risks.

See How virus and spyware scans work.

Update virus definitions

Make sure that you have the latest virus definitions installed on your computer.

See Updating the computer's protection.

Check that Auto-Protect is enabled

Auto-Protect is enabled by default. You should always keep Auto-Protect enabled. If you disable Auto-Protect, you also disable Download Insight and you prevent SONAR from making heuristic detections.

See Enabling or disabling Auto-Protect.

Scan your computer

Regularly scan your computer for viruses and security risks. Ensure that scans run regularly by checking the last scan date.

See Scanning your computer immediately.

See Scheduling a user-defined scan.

Pause or delay scans

Whenever an on-demand, scheduled, startup, or user-defined scan runs, by default Symantec Endpoint Protection displays a scan progress dialog box to report progress. In addition, Auto-Protect can display a results dialog whenever it detects a virus or security risk. You can disable these notifications.

The pause feature lets you stop a scan at any point during the scan and resume it at another time. You can pause any scan that you initiate.

In managed networks, your administrator determines whether you can pause an administrator-initiated scan. If the Pause Scan option is not available, your administrator disabled the pause feature. If your administrator has enabled the Snooze feature, you can delay an administrator-scheduled scan for a set interval of time.

When a scan resumes, it starts from where the scan stopped.

Note:

If you pause a scan while the client scans a compressed file, the client might take several minutes to respond to the pause request.

See Pausing and delaying scans.

Interact with scan results

When scans run, you might see a scan results dialog box. You can use the scan results dialog box to perform some actions on the items that scans detect.

In a managed network, the scan progress dialog box might not appear for administrator-initiated scans. Your administrator may choose not to display results when the client detects a virus or security risk. In some cases, your administrator might let you view the scan results but not to pause or resume a scan.

Note:

The language of the operating system might not be able to interpret some characters in the virus names that appear in the scan results dialog box. If the operating system cannot interpret the characters, the characters appear as question marks in notifications. For example, some unicode virus names might contain double-byte characters. On the computers that run the client on an English operating system, these characters appear as question marks.

See Responding to a virus or risk detection.

Adjust scans to improve your computer performance

By default, Symantec Endpoint Protection provides a high level of security while it minimizes the affect on your computer performance. You can customize settings to increase the computer performance even more.

For scheduled and on-demand scans you can change the following options:

  • Scan tuning

    Set the scan tuning to Best Application Performance.

  • Compressed files

    Change the number of levels to scan compressed files.

  • Resumable scans

    You can specify a maximum time for a scan to run. The scan resumes when the computer is idle.

  • Randomized scans

    You can specify that a scan randomizes its start time within a specific time interval.

You might also want to disable startup scans or change the schedule for your scheduled scans.

See Customizing virus and spyware scan settings.

See Scheduling a user-defined scan.

Adjust scans to increase protection on your computer

In most cases, the default scan settings provide adequate protection for your computer. In some cases you might want to increase the protection. If you do increase the protection, you might affect your computer performance.

For scheduled and on-demand scans you can change the following options:

  • Scan performance

    Set the scan tuning to Best Scan Performance.

  • Scan actions

    Change the remediation actions that occur when a virus is detected

  • Scan duration

    By default, the scheduled scans run until the specified time interval expires and then resume when the client computer is idle. You can set the scan duration to Scan until finished.

  • Insight Lookup

    Insight Lookup uses the latest definition set to scan and make decisions about files. It also uses Symantec's reputation technology. You should make sure that Insight Lookup is enabled. Insight Lookup settings are similar to the settings for Download Insight.

You can also increase the level of Bloodhound protection. Bloodhound locates and isolates the logical regions of a file to detect virus-like behavior. You can change the detection level from Automatic to Aggressive to increase the protection on your computer. The Aggressive setting, however, is likely to produce more false positives.

See Customizing virus and spyware scan settings.

Modify Auto-Protect settings to improve your computer performance or increase protection

For Auto-Protect, you might want to change the following options:

  • File cache

    Make sure that the file cache is enabled (the default is enabled). When the file cache is enabled, Auto-Protect remembers the clean files that it scanned and does not rescan them.

  • Network settings

    When Auto-Protect on remote computers is enabled, make sure that Only when files are executed is enabled.

  • You can also specify that Auto-Protect trusts files on remote computers and uses a network cache.

    By default, Auto-Protect scans files as they are written from your computer to a remote computer. Auto-Protect also scans files when they are written from a remote computer to your computer.

    A network cache stores a record of the files that Auto-Protect scanned from a remote computer. If you use a network cache, you prevent Auto-Protect from scanning the same file more than one time.

See Customizing virus and spyware scan settings.

Manage Download Insight detections

Download Insight inspects files that you try to download through Web browsers and text messaging clients and other portals. Download Insight uses reputation information from Symantec Insight to make decisions about files.

See Managing Download Insight detections on your computer.

Manage SONAR

SONAR is part of Proactive Threat Protection.

See Managing SONAR on your client computer.

Identify scan exceptions

Exclude a safe file or process from being scanned.

See Excluding items from scans.

Submit information about detections to Symantec

By default, your client computer sends information about detections to Symantec Security Response. You can turn off submissions or choose which kinds of information to submit.

Symantec recommends that you always enable submissions. The information helps Symantec address threats.

See Submitting information about detections to Symantec Security Response.

Manage quarantined files

Symantec Endpoint Protection quarantines infected files and moves them to a location where the file does not infect other files on the computer.

If a quarantined file cannot be repaired, you must decide what to do with the file.

You can also do the following actions:

  • Delete a quarantined file if a backup file exists or a replacement file is available from a trustworthy source.

  • Leave files with unknown infections in the Quarantine until Symantec releases new virus definitions.

  • Periodically check quarantined files to prevent accumulating large numbers of files. Check quarantined files when a new virus outbreak appears on the network.

See Managing quarantined files on your client computer.

See About quarantining files.


How virus and spyware scans work

Virus and spyware scans identify and neutralize or eliminate viruses and security risks on your computers. A scan eliminates a virus or risk by using the following process:

  • The scan engine searches within files and other components on the computer for traces of viruses within files. Each virus has a recognizable pattern that is called a signature. Installed on the client is a virus definitions file that contains the known virus signatures, without the harmful virus code. The scan engine compares each file or component with the virus definitions file. If the scan engine finds a match, the file is infected.

  • The scan engine uses the definitions files to determine whether a virus or a risk caused the infection. The scan engine then takes a remediation action on the infected file. To remediate the infected file, the client cleans, deletes, or quarantines the file.

    See How scans respond to a virus or risk detection.

Table: Computer components that the client scans describes the components that the client scans on your computer.

Table: Computer components that the client scans

Component

Description

Selected files

The client scans individual files. For most types of scans, you select the files that you want scanned.

The client software uses pattern-based scanning to search for traces of viruses within files. The traces of viruses are called patterns or signatures. Each file is compared to the innocuous signatures that are contained in a virus definitions file, as a way of identifying specific viruses.

If a virus is found, by default the client tries to clean the virus from the file. If the file cannot be cleaned, the client quarantines the file to prevent further infection of your computer.

The client also uses pattern-based scanning to search for signs of security risks within files and Windows registry keys. If a security risk is found, by default the client quarantines the infected files and repairs the risk's effects. If the client cannot quarantine the files, it logs the attempt.

Computer memory

The client searches the computer's memory. Any file virus, boot sector virus, or macro virus may be memory-resident. Viruses that are memory-resident have copied themselves into a computer's memory. In memory, a virus can hide until a trigger event occurs. Then the virus can spread to a floppy disk in the disk drive, or to the hard drive. If a virus is in memory, it cannot be cleaned. However, you can remove a virus from memory by restarting your computer when prompted.

Boot sector

The client checks the computer's boot sector for boot viruses. Two items are checked: the partition tables and the master boot record.

Floppy drive

A common way for a virus to spread is through the floppy disks. A floppy disk might remain in a disk drive when you start up or turn off your computer. When a scan starts, the client searches the boot sector and partition tables of a floppy disk that is located in the disk drive. When you turn off your computer, you are prompted to remove the disk to prevent possible infection.


About the types of scans

Symantec Endpoint Protection includes different types of scans to provide protection against different types of viruses, threats, and risks.

By default, Symantec Endpoint Protection runs an active scan every day at 12:30 P.M. Symantec Endpoint Protection also runs an active scan when new definitions arrive on the client computer. On unmanaged computers, Symantec Endpoint Protection also includes a default startup scan that is disabled.

On unmanaged clients, you should make sure that you run an active scan every day on your computer. You might want to schedule a full scan once a week or once a month if you suspect that you have an inactive threat on your computer. Full scans consume more computer resources and might impact computer performance.

Table: Scan types

Scan type

Description

Auto-Protect

Auto-Protect continuously inspects files and email data as they are written to or read from a computer. Auto-Protect automatically neutralizes or eliminates detected viruses and security risks.

Auto-Protect also protects some email that you might send or receive.

See About the types of Auto-Protect.

Download Insight

Download Insight boosts the security of Auto-Protect by inspecting files when users try to download them from browsers and other portals.

Download Insight uses reputation information to make decisions about files. The reputation scoring of files is determined by a Symantec technology called Insight. Insight uses not only the source of a file but also its context. Insight provides a security rating that Download Insight uses to make decisions about the files.

Download Insight functions as part of Auto-Protect and requires Auto-Protect to be enabled. If you disable Auto-Protect but enable Download Insight, Download Insight cannot function.

See How Symantec Endpoint Protection uses reputation data to make decisions about files.

Administrator scans and user-defined scans

For managed clients, your administrator might create scheduled scans or run scans on demand. For unmanaged clients, or managed clients for which scan settings are unlocked, you can create and run your own scans.

Administrator or user-defined scans detect viruses and security risks by examining all files and processes on the client computer. These types of scans can also inspect memory and load points.

The following types of administrator or user-defined scans are available:

  • Scheduled scans

    A scheduled scan runs on the client computers at designated times. Any concurrently scheduled scans run sequentially. If a computer is turned off during a scheduled scan, the scan does not run unless it is configured to retry missed scans. You can schedule an active, full, or custom scan.

    You can save your scheduled scan settings as a template. You can use any scan that you save as a template as the basis for a different scan. The scan templates can save you time when you configure multiple policies. A scheduled scan template is included by default in the policy. The default scheduled scan scans all files and directories.

  • Startup scans and triggered scans

    Startup scans run when the users log on to the computers. Triggered scans run when new virus definitions are downloaded to computers.

  • On-demand scans

    On-demand scans are scans that you start manually. You can run scans on demand from the Scan for Threats page.

SONAR

SONAR offers real-time protection against zero-day attacks. SONAR can stop attacks even before traditional signature-based definitions detect a threat. SONAR uses heuristics as well as file reputation data to make decisions about applications or files.

Like proactive threat scans, SONAR detects keyloggers, spyware, and any other application that might be malicious or potentially malicious.

More Information

Managing scans on your computer


About the types of Auto-Protect

Auto-Protect scans files as well as certain types of email and email attachments.

If your client computer runs other email security products, such as Symantec Mail Security, you might not need to enable Auto-Protect for email.

Auto-Protect works on your supported email client only. It does not protect email servers.

Note:

If a virus is detected as you open email, your email may take several seconds to open while Auto-Protect completes its scan.

Table: Types of Auto-Protect

Type of Auto-Protect

Description

Auto-Protect

Continuously scans files as they are read from or written to your computer

Auto-Protect is enabled by default for the file system. It loads at computer startup. It inspects all files for viruses and security risks, and blocks the security risks from being installed. It can optionally scan files by file extension, scan files on remote computers, and scan floppies for boot viruses. It can optionally back up files before it attempts to repair the files, and terminate processes and stop services.

You can configure Auto-Protect to scan only selected file extensions. When Auto-Protect scans the selected extensions, it can also determine a file's type even if a virus changes the file's extension.

If you do not run Auto-Protect for email, your client computers are still protected when Auto-Protect is enabled. Most email applications save attachments to a temporary directory when users launch email attachments. Auto-Protect scans the file as it is written to the temporary directory and detects any virus or security risk. Auto-Protect also detects the virus if the user tries to save an infected attachment to a local drive or network drive.

Internet Email Auto-Protect

Scans internet email (POP3 or SMTP) and attachments for viruses and security risks; also performs outbound email heuristics scanning.

By default, Internet Email Auto-Protect supports encrypted passwords and email over POP3 and SMTP connections. If you use POP3 or SMTP with Secure Sockets Layer (SSL), then the client detects secure connections but does not scan encrypted messages.

Note:

For performance reasons, Internet Email Auto-Protect for POP3 is not supported on server operating systems. Internet email scanning also is not supported for 64-bit computers.

Email scanning does not support IMAP, AOL, or HTTP-based email such as Hotmail or Yahoo! Mail.

Microsoft Outlook Auto-Protect

Scans Microsoft Outlook email (MAPI and Internet) and attachments for viruses and security risks

Supported for Microsoft Outlook 98/2000/2002/2003/2007/2010 (MAPI and Internet)

If Microsoft Outlook is already installed on the computer when you perform a client software installation, the client software detects the email application. The client automatically installs Microsoft Outlook Auto-Protect.

If you use Microsoft Outlook over MAPI or Microsoft Exchange client and you have Auto-Protect enabled for email, attachments are immediately downloaded. The attachments are scanned when you open the attachment. If you download a large attachment over a slow connection, mail performance is affected. You may want to disable this feature if you regularly receive large attachments.

Note:

On a Microsoft Exchange server, you should not install Microsoft Outlook Auto-Protect.

Lotus Notes Auto-Protect

Scans Lotus Notes email and attachments for viruses and security risks

Supported for Lotus Notes 4.5x, 4.6, 5.0, and 6.x

If Lotus Notes is already installed on the computer when you perform a client software installation, the client software detects the email application. The client automatically installs Lotus Notes Auto-Protect.


About viruses and security risks

Symantec Endpoint Protection scans for both viruses and for security risks. Security risks include spyware, adware, rootkits, and other files that can put a computer or a network at risk.

Viruses and security risks can arrive through email messages or instant messenger programs. You can unknowingly download a risk by accepting an End User License Agreement from a software program.

Many viruses and security risks are installed as "drive-by downloads." These downloads usually occur when you visit malicious or infected Web sites, and the application's downloader installs through a legitimate vulnerability on your computer.

You can view information about specific risks on the Symantec Security Response Web site.

The Symantec Security Response Web site provides the latest information about threats and security risks. The Web site also contains extensive reference information, such as white papers and detailed information about viruses and security risks.

Table: Viruses and security risks lists the type of viruses and risks that can attack a computer

Table: Viruses and security risks

Risk

Description

Viruses

Programs or code that attach a copy of themselves to another computer program or file when it runs. When the infected program runs, the attached virus program activates and attaches itself to other programs and files.

The following types of threats are included in the virus category:

  • Malicious Internet bots

    Programs that run automated tasks over the Internet. Bots can be used to automate attacks on computers or to collect information from Web sites.

  • Worms

    Programs that replicate without infecting other programs. Some worms spread by copying themselves from disk to disk, while others replicate in memory to reduce computer performance.

  • Trojan horses

    Programs that hide themselves in something benign, such as a game or utility.

  • Blended threats

    Threats that blend the characteristics of viruses, worms, Trojan horses, and code with server and Internet vulnerabilities to initiate, transmit, and spread an attack. Blended threats use multiple methods and techniques to spread rapidly and cause widespread damage.

  • Rootkits

    Programs that hide themselves from a computer's operating system.

Adware

Programs that deliver advertising content.

Dialers

Programs that use a computer, without the user's permission or knowledge, to dial out through the Internet to a 900 number or FTP site. Typically, these numbers are dialed to accrue charges.

Hacking tools

Programs that hackers use to gain unauthorized access to a user's computer. For example, one hacking tool is a keystroke logger, which tracks and records individual keystrokes and sends this information back to the hacker. The hacker can then perform port scans or vulnerability scans. Hacking tools may also be used to create viruses.

Joke programs

Programs that alter or interrupt the operation of a computer in a way that is intended to be humorous or frightening. For example, a joke program might move the recycle bin away from the mouse when the user tries to delete it.

Misleading applications

Applications that intentionally misrepresent the security status of a computer. These applications typically masquerade as security notifications about fake infections that must be removed.

Parental control programs

Programs that monitor or limit computer usage. The programs can run undetected and typically transmit monitoring information to another computer.

Remote access programs

Programs that allow access over the Internet from another computer so that they can gain information or attack or alter a user's computer.

Security assessment tool

Programs that are used to gather information for unauthorized access to a computer.

Spyware

Stand-alone programs that can secretly monitor system activity and detect passwords and other confidential information and relay it back to another computer.

Trackware

Stand-alone or appended applications that trace a user's path on the Internet and send information to the controller or hacker's system.

More Information

How scans respond to a virus or risk detection


How scans respond to a virus or risk detection

When viruses and security risks infect files, the client responds to the threat types in different ways. For each threat type, the client uses a first action, and then applies a second action if the first action fails.

Table: How a scan responds to viruses and security risks

Threat type

Action

Virus

By default, when the client detects a virus, the client:

  • Tries first to clean the virus from the infected file.

  • If the client cleans the file, the client completely removes the risk from your computer.

  • If the client cannot clean the file, it logs the failure and moves the infected file to the Quarantine.

    See About quarantining files.

Security risk

By default, when the client detects a security risk:

  • It quarantines the infected file.

  • It tries to remove or repair any changes that the security risk made.

  • If the client cannot quarantine a security risk, it logs the risk and leaves it alone.

In some instances, you might unknowingly install an application that includes a security risk such as adware or spyware. If Symantec has determined that quarantining the risk does not harm the computer, then the client quarantines the risk. If the client quarantines the risk immediately, its action might leave the computer in an unstable state. Instead, the client waits until the application installation is complete before it quarantines the risk. It then repairs the risk's effects.

For each scan type, you can change the settings for how the client handles viruses and security risks. You can set different actions for each category of risk and for individual security risks.


How Symantec Endpoint Protection uses reputation data to make decisions about files

Symantec collects information about files from its global community of millions of users and its Global Intelligence Network. The collected information forms a reputation database that Symantec hosts. Symantec products leverage the information to protect client computers from new, targeted, and mutating threats. The data is sometimes referred to as being "in the cloud" since it does not reside on the client computer. The client computer must request or query the reputation database.

Symantec uses a technology it calls Insight to determine each file's level of risk or "security rating."

Insight determines a file's security rating by examining the following characteristics of the file and its context:

  • The source of the file

  • How new the file is

  • How common the file is in the community

  • Other security metrics, such as how the file might be associated with malware

Scanning features in Symantec Endpoint Protection leverage Insight to make decisions about files and applications. Virus and Spyware Protection includes a feature that is called Download Insight. Download Insight relies on reputation information to make detections. If you disable Insight lookups, Download Insight runs but cannot make detections. Other protection features, such as Insight Lookup and SONAR, use reputation information to make detections; however, those features can use other technologies to make detections.

By default, a client computer sends information about reputation detections to Symantec Security Response for analysis. The information helps to refine Insight's reputation database. The more clients that submit information the more useful the reputation database becomes.

You can disable the submission of reputation information. Symantec recommends, however, that you keep submissions enabled.

Client computers also submit other types of information about detections to Symantec Security Response.

More Information

Managing Download Insight detections on your computer

Submitting information about detections to Symantec Security Response


Scheduling a user-defined scan

A scheduled scan is an important component of threat and security risk protection. You should schedule a scan to run at least one time each week to ensure that your computer remains free of viruses and security risks. When you create a new scan, the scan appears in the scan list in the Scan for threats pane.

Note:

If your administrator has created a scheduled scan for you, it appears in the scan list in the Scan for threats pane.

Your computer must be turned on and Symantec Endpoint Protection Services must be loaded when the scan is scheduled to take place. By default, Symantec Endpoint Protection Services are loaded when you start your computer.

For managed clients, the administrator may override these settings.

If you schedule multiple scans to occur on the same computer and the scans start at the same time, the scans run serially. After one scan finishes, another scan starts. For example, you might schedule three separate scans on your computer to occur at 1:00 P.M. Each scan scans a different drive. One scan scans drive C. Another scan scans drive D. Another scan scans drive E. In this example, a better solution is to create one scheduled scan that scans drives C, D, and E.

See Scanning your computer immediately.

For more information on the options on each dialog box, click Help.

To schedule a user-defined scan

  1. In the client, in the sidebar, click Scan for threats.

  2. Click Create a New Scan.

  3. In the Create New Scan - What To Scan dialog box, select one of the following types of scans to schedule:

    Active Scan

    Scans the areas of the computer that viruses and security risks most commonly infect.

    You should run an active scan every day.

    Full Scan

    Scans the entire computer for viruses and security risks.

    You might want to run a full scan once a week or once a month. Full scans might impact your computer performance.

    Custom Scan

    Scans the selected areas of the computer for viruses and security risks.

  4. Click Next.

  5. If you selected Custom Scan, check the appropriate check boxes to specify where to scan, and then click Next.

    The symbols have the following descriptions:

    The file, drive, or folder is not selected. If the item is a drive or folder, the folders and files in it are also not selected.

    The individual file or folder is selected.

    The individual folder or drive is selected. All items within the folder or drive are also selected.

    The individual folder or drive is not selected, but one or more items within the folder or drive are selected.

  6. In the Create New Scan - Scan Options dialog box, you can modify any of the following options:

    File Types

    Change which file extensions the client scans. The default setting is to scan all files.

    Actions

    Change first and second actions to take when viruses and security risks are found.

    Notifications

    Construct a message to display when a virus or security risk is found. You can also configure whether or not you want to be notified before remediation actions occur.

    Advanced

    Change additional scan features, such as displaying the scan results dialog box.

    Scan Enhancements

    Change which computer components the client scans. The options that are available depend on what you selected in step 3.

  7. Click Next.

  8. In the Create New Scan - When To Scan dialog box, click At specified times, and then click Next.

    You can also create an on-demand or startup scan.

    See Scheduling a scan to run on demand or when the computer starts up.

  9. In the Create New Scan - Schedule dialog box, under Scan Schedule, specify the frequency and when to scan, and then click Next.

  10. Under Scan Duration, you can specify a length of time during which the scan must complete. You can also randomize the scan start time.

  11. Under Missed Scheduled Scans, you can specify an interval during which a scan can be retried.

  12. In the Create New Scan - Scan Name dialog box, type a name and description for the scan.

    For example, call the scan: Friday morning

  13. Click Finish.

More Information

Managing scans on your computer


Scheduling a scan to run on demand or when the computer starts up

You can supplement a scheduled scan with an automatic scan whenever you start your computer or log on. Often, a startup scan is restricted to critical, high-risk folders, such as the Windows folder and folders that store Microsoft Word and Excel templates.

If you regularly scan the same set of files or folders, you can create an on-demand scan that is restricted to those items. At any time, you can quickly verify that the specified files and folders are free from viruses and security risks. You must run on-demand scans manually.

If you create more than one startup scan, the scans run sequentially in the order in which they were created. Your administrator may have configured the client so that you cannot create a startup scan.

See Scanning your computer immediately.

For more information on the options on each dialog box, click Help.

To schedule a scan to run on demand or when the computer starts up

  1. In the client, in the sidebar, click Scan for threats.

  2. Click Create a New Scan.

  3. Specify what to scan and any scan options for the scheduled scan.

    See Scheduling a user-defined scan.

  4. In the Create New Scan - When to Run dialog box, do one of the following actions:

    • Click At startup.

    • Click On demand.

  5. Click Next.

  6. In the Create New Scan - Scan Name dialog box, type a name and description for the scan.

    For example, call the scan: MyScan1

  7. Click Finish.


Managing Download Insight detections on your computer

Auto-Protect includes a feature that is called Download Insight, which examines the files that you try to download through Web browsers, text messaging clients, and other portals. Auto-Protect must be enabled for Download Insight to function.

Supported portals include Internet Explorer, Firefox, Microsoft Outlook, Outlook Express, Windows Live Messenger, and Yahoo Messenger.

Note:

In the Risk log, the risk details for a Download Insight detection show only the first portal application that attempted the download. For example, you might use Internet Explorer to try to download a file that Download Insight detects. If you then use Firefox to try to download the file, the Downloaded by field in the risk details shows Internet Explorer as the portal.

Download Insight determines that a downloaded file might be a risk based on evidence about the file's reputation. Download Insight does not use signatures or heuristics to make decisions. If Download Insight allows a file, Auto-Protect or SONAR scans the file when the user opens or runs the file.

Note:

Auto-Protect can also scan the files that users receive as email attachments.

Table: Managing Download Insight detections on your computer

Task

Description

Learn how Download Insight uses reputation data to make decisions about files

Download Insight uses reputation information exclusively when it makes decisions about downloaded files. It does not use signatures or heuristics to make decisions. If Download Insight allows a file, Auto-Protect or SONAR scans the file when the user opens or runs the file.

See How Symantec Endpoint Protection uses reputation data to make decisions about files.

Respond to Download Insight detections

You might see notifications when Download Insight makes a detection. For managed clients, your administrator might choose disable Download Insight detection notifications.

When notifications are enabled, you see messages when Download Insight detects a malicious file or an unproven file. For unproven files, you must choose whether or not to allow the file.

See Responding to Download Insight messages that ask you to allow or block a file that you try to download.

Create exceptions for specific files or Web domains

You can create an exception for an application that your users download. You can also create an exception for a specific Web domain that you believe is trustworthy.

By default, Download Insight does not examine any files that users download from a trusted Internet or intranet site. Trusted sites are configured on the Windows Control Panel > Trusted Internet Sites > Security tab. When the Automatically trust any file downloaded from an intranet site option is enabled, Symantec Endpoint Protection allows any file that a user downloads from one of the trusted sites.

Download Insight recognizes only explicitly configured trusted sites. Wildcards are allowed, but non-routable IP address ranges are not supported. For example, Download Insight cannot recognize 10.*.*.* as a trusted site. Download Insight also does not support the sites that are discovered by the Internet Options > Security > Automatically detect intranet network option.

See Excluding items from scans.

Make sure that Insight lookups are enabled

Download Insight requires reputation data to make decisions about files. If you disable Insight lookups, Download Insight runs but cannot make detections. Insight lookups are enabled by default.

See Submitting information about detections to Symantec Security Response.

Customize Download Insight settings

You might want to customize Download Insight settings for the following reasons:

  • Increase or decrease the number of Download Insight detections.

    You can adjust the malicious file sensitivity slider to increase or decrease the number of detections. At lower sensitivity levels, Download Insight detects fewer files as malicious and more files as unproven. Fewer detections are false positive detections.

    At higher sensitivity levels, Download Insight detects more files as malicious and fewer files as unproven. More detections are false positive detections.

  • Change the action for malicious or unproven file detections.

    You can change how Download Insight handles malicious or unproven files. You might want to change the action for unproven files so that you do not receive notifications for those detections.

  • Get alerts about Download Insight detections.

    When Download Insight detects a file that it considers malicious, it displays a message on the client computer if the action is set to Quarantine. You can undo the quarantine action.

    When Download Insight detects a file that it considers unproven, it displays a message on the client computer if you set the action for unproven files to Prompt or Quarantine. When the action is set to Prompt, you can allow or block the file. When the action is Quarantine, you can undo the quarantine action.

    You can turn off user notifications so that you do not have a choice when Download Insight detects a file that it considers unproven. If you keep notifications enabled, you can set the action for unproven files to Ignore so that these detections are always allowed and you are not notified.

    When notification are enabled, the malicious file sensitivity setting affects the number of notifications that you receive. If you increase the sensitivity, you increase the number of user notifications because the total number of detections increases.

See Customizing Download Insight settings.

Submit information about reputation detections to Symantec

By default, clients send information about reputation detections to Symantec.

Symantec recommends that you enable submissions for reputation detections. The information helps Symantec address threats.

See Submitting information about detections to Symantec Security Response.


Customizing Download Insight settings

You might want to customize Download Insight settings to decrease false positive detections on client computers. You can change how sensitive Download Insight is to the file reputation data that it uses to characterize malicious files. You can also change the notifications that Download Insight displays on client computers when it makes a detection.

Customizing Download Insight settings

  1. In the client, in the sidebar, click Change Settings.

  2. Next to Virus and Spyware Protection, click Configure Settings.

  3. On the Download Insight tab, make sure that Enable Download Insight to detect potential risks in downloaded files based on file reputation is checked.

    If Auto-Protect is disabled, Download Insight cannot function even it it is enabled.

  4. Move the slider to change the malicious file sensitivity.

    Note:

    If you or your administrator installed basic Virus and Spyware Protection, the malicious file sensitivity is set to level 1 automatically and cannot be changed.

    If you set the level higher, Download Insight detects more files as malicious and fewer files as unproven. Higher settings, however, return more false positives.

  5. Check or uncheck the following options to use as additional criteria for examining unproven files:

    • Files with fewer than x users

    • Files known by users for less than x days

      When unproven files meet this criteria, Download Insight detects the files as malicious.

  6. Make sure that Automatically trust any file downloaded from an intranet website is checked.

    This option also applies to Insight Lookup detections.

  7. Click Actions.

  8. Under Malicious Files, specify a first action and a second action.

  9. Under Unproven Files, specify the action.

  10. Click OK.

  11. Click Notifications, and specify whether or not to display a notification when Download Insight makes a detection.

    You can customize the text of the warning message that appears.

  12. Click OK.

More Information

Managing Download Insight detections on your computer


Customizing virus and spyware scan settings

By default, the client gives your computer the protection against the viruses and security risks that you need. If you have an unmanaged client, you may want to configure some of the scan settings.

To customize a user-defined scan

  1. In the client, in the sidebar, click Scan for threats.

  2. In the Scan for threats page, right-click a scan and click Edit.

  3. On the Scan Options tab, do any of the following tasks:

    • To change Insight Lookup settings, click Insight Lookup.

      Insight Lookup settings are similar to Download Insight settings.

      See Customizing Download Insight settings.

    • To specify fewer file types to scan, click Selected extensions, and then click Extensions.

    • To specify which a first and second action that the client takes on an infected file, click Actions.

    • To specify notification options, click Notifications.

    • To configure advanced options for compressed files, backups, and tuning, click Advanced.

      You might want to change the tuning options to improve your client computer performance.

    For more information on the options on each dialog box, click Help.

  4. Click OK.

To change global scan settings

  1. Do one of the following actions:

    • In the client, in the sidebar, click Change settings, and the next to Virus and Spyware Protection, click Configure Settings

    • In the client, in the sidebar, click Scan for Threats, and then click View Global Scan Settings.

  2. On the Global Settings tab, under Scan Options, change settings for Insight or Bloodhound.

  3. To view or create scan exceptions, click View List. Click Close after you view or create exceptions.

  4. Under Log Retention or Internet Browser Protection, make any changes that you want.

  5. Click OK.

To customize Auto-Protect

  1. In the client, in the sidebar, click Change settings.

  2. Next to Virus and Spyware Protection, click Configure Settings.

  3. On any Auto-Protect tab, do the following tasks:

    • To specify fewer file types to scan, click Selected, and then click Extensions.

    • To specify which a first and second action that the client takes on an infected file, click Actions.

    • To specify notification options, click Notifications.

    For more information on the options on each dialog box, click Help.

  4. On the Auto-Protect tab, click Advanced.

    You can change options for the file cache as well as options for Risk Tracer and backups. You might want to change these options to improve your computer performance.

  5. Click Network to change settings for trusting files on remote computers and setting a network cache.

  6. Click OK.

More Information

Managing scans on your computer


Configuring actions for malware and security risk detections

You can configure the actions that you want the Symantec Endpoint Protection client to take when it detects malware or a security risk. You can configure a first action and a second action to take if the first action fails.

Note:

If an administrator manages your computer, and these options display a padlock icon, you cannot change these options because your administrator has locked them.

You configure actions for any type of scan in the same way. Each scan has its own configuration for actions. You can configure different actions for different scans.

Note:

You configure actions for Download Insight and SONAR separately.

You can click Help for more information about the options that are used in the procedures.

To configure actions for malware and security risk detections

  1. In the client, in the sidebar, click Change settings or Scan for Threats.

  2. Do one of the following actions:

    • Next to Virus and Spyware Protection, click Configure Settings, and then on any Auto-Protect tab, click Actions.

    • Select a scan and then right-click and select Edit, and then click Scan Options.

  3. Click Actions.

  4. In the Scan Actions dialog box, in the tree, select the category or subcategory under Malware or Security Risks.

    By default, each subcategory is automatically configured to use the actions that are set for the entire category.

    The categories change dynamically over time as Symantec gets new information about risks.

  5. To configure actions for a subcategory only, do one of the following actions:

    • Check Override actions configured for Malware, and then set the actions for that subcategory only.

      Note:

      There might be a single subcategory under a category, depending on how Symantec currently classifies risks. For example, under Malware, there might be a single subcategory called Viruses.

    • Check Override actions configured for Security Risks, and then set the actions for that subcategory only.

  6. Select a first and second action from the following options:

    Clean risk

    Removes the virus from the infected file. This setting is the default first action for viruses.

    Note:

    This action is only available as a first action for viruses. This action does not apply to security risks.

    This setting should always be the first action for viruses. If the client successfully cleans a virus from a file, you do not need to take any other action. Your computer is free of viruses and is no longer susceptible to the spread of that virus into other areas of your computer.

    When the client cleans a file, it removes the virus from the infected file, boot sector, or partition tables. It also eliminates the ability of the virus to spread. The client can usually find and clean a virus before it causes damage to your computer. By default, the client backs up the file.

    In some instances, however, the cleaned file might not be usable. The virus might have caused too much damage.

    Some infected files cannot be cleaned.

    Quarantine risk

    Moves the infected file from its original location to the Quarantine. Infected files within the Quarantine cannot spread viruses.

    For viruses, moves the infected file from its original location to the Quarantine. This setting is the default second action for viruses.

    For security risks, the client moves the infected files from their original location to the Quarantine and tries to remove or repair any side effects. This setting is the default first action for security risks.

    Quarantine contains a record of all the actions that were performed. You can return the computer to the state that existed before the client removed the risk.

    Delete risk

    Deletes the infected file from your computer's hard drive. If the client cannot delete a file, information about the action that the client performed appears in the Notification dialog box. The information also appears in the Event Log.

    Use this action only if you can replace the file with a backup copy that is free of viruses or security risks. When the client deletes a risk, it deletes the risk permanently. The infected file cannot be recovered from the Recycle Bin.

    Note:

    Use this action with caution when you configure actions for security risks. In some cases, deleting security risks can cause applications to lose functionality.

    Leave alone (log only)

    Leaves the file as is.

    If you use this action for viruses, the virus remains in the infected files. The virus can spread to other parts of your computer. An entry is placed in the Risk History to keep a record of the infected file.

    You can use Leave alone (log only) as a second action for both malware and security risks.

    Do not select this action when you perform large-scale, automated scans, such as scheduled scans. You might want to use this action if you intend to view the scan results and take an additional action later. An additional action might be to move the file to the Quarantine.

    For security risks, this action leaves the infected file as is and places an entry in the Risk History to keep a record of the risk. Use this option to take manual control of how the client handles a security risk. This setting is the default second action for security risks.

    Your administrator might send a customized message that explains how to respond.

  7. Repeat steps these steps for each category for which you want to set specific actions, and then click OK.

  8. If you selected a security risk category, you can select custom actions for one or more specific instances of that security risk category. You can exclude a security risk from scanning. For example, you might want to exclude a piece of adware that you need to use in your work.

  9. Click OK.

More Information

Customizing virus and spyware scan settings

Customizing Download Insight settings

Changing SONAR settings


About excluding items from scans

Exceptions are known security risks, files, file extensions, processes that you want to exclude from a scan. If you have scanned your computer and know that certain files are safe, you can exclude them. In some cases, exceptions can reduce scan time and increase system performance. Typically you do not need to create exceptions.

For managed clients, your administrator may have created exceptions for your scans. If you create an exception that conflicts with an administrator-defined exception, the administrator-defined exception takes precedence. Your administrator can also prevent you from configuring any or all types of exceptions.

Note:

If your email application stores all email in a single file, you should create a file exception to exclude the Inbox file from scans. By default, scans quarantine viruses. If a scan detects a virus in the Inbox file, the scan quarantines the entire Inbox. If the scan quarantines the Inbox, you cannot access your email.

Table: Exception types

Exception Type | Description
File | Applies to virus and spyware scans Scans ignore the file that you select.
Folder | Applies to virus and spyware scans or SONAR or both Scans ignore the folder that you select.
Known risks | Applies to virus and spyware scans Scans ignore any known risk that you select.
Extensions | Applies to virus and spyware scans Scans ignore any files with the specified extensions.
Trusted Web domain | Applies to virus and spyware scans Download Insight ignores the specified trusted Web domain.
Application | Applies to virus and spyware scans and SONAR Scans ignore, log, quarantine, or terminate the application that you specify here.

More Information

Excluding items from scans


Excluding items from scans

Exceptions are known security risks, files, folders, file extensions, Web domains, or applications that you want to exclude from scans. If you have scanned your computer and know that certain files are safe, you can exclude them. In some cases, exceptions can reduce scan time and increase system performance. Typically you do not need to create exceptions.

For managed clients, your administrator may have created exceptions for your scans. If you create an exception that conflicts with an administrator-defined exception, the administrator-defined exception takes precedence.

Security risk exceptions apply across all security risk scans. Application exceptions apply to all security risk scans as well. SONAR folder exceptions apply only to SONAR.

SONAR does not support file exceptions. Use an application exception to exclude a file from SONAR.

Note:

On the Server Core installation of Windows Server 2008, the appearance of the dialog boxes might differ from the ones that are described in these procedures.

For more information on the options on each dialog box, click Help.

To exclude items from security risk scans

  1. In the client, in the sidebar, click Change settings.

  2. Next to Exceptions, click Configure Settings.

  3. In the Exceptions dialog box, under User-defined Exceptions, click Add > Security Risk Exceptions.

  4. Select one of the following exception types:

    • Known Risks

    • File

    • Folder

    • Extensions

    • Web Domain

  5. Do one of the following actions:

    • For known risks, check the security risks that you want to exclude from scans.

      If you want to log an event when the security risk is detected and ignored, check Log when the security risk is detected.

    • For files or folders, select the file or folder that you want to exclude, and then click Add.

      For folders, check or uncheck Include subfolders.

    • For extensions, type the extension that you want to exclude.

      You can only include one extension name in the text box. If you type multiple extensions, the client treats the entry as a single extension name.

    • For domains, enter a Web site that you want to exclude from Download Insight detection.

  6. Click OK.

  7. In the Exceptions dialog box, click Close.

To exclude a folder from SONAR

  1. In the client, in the sidebar, click Change settings.

  2. Next to Exceptions, click Configure Settings.

  3. In the Exceptions dialog box, under User-defined Exceptions, click Add > SONAR Exception > Folder.

  4. Select the folder that you want to exclude, check or uncheck Include subfolders, and then click Add.

    If you select a file instead of a folder, the client uses the parent folder for the exception.

  5. In the Exceptions dialog box, click Close.

To change how all scans handle an application

  1. In the client, in the sidebar, click Change settings.

  2. Next to Exceptions, click Configure Settings.

  3. In the Exceptions dialog box, under User-defined Exceptions, click Add > Application Exception.

  4. Select the filename of the application

  5. In the Action drop-down box, select Ignore, Log Only, Quarantine, or Terminate.

  6. Click Add.

  7. In the Exceptions dialog box, click Close.

More Information

Managing scans on your computer

About excluding items from scans


Managing quarantined files on your client computer

By default, Symantec Endpoint Protection tries to clean a virus from an infected file when it is detected. If the file cannot be cleaned, the scan places the file in the Quarantine on your computer. For security risks, scans move infected files to the Quarantine and repair any side effects of the security risk. Download Insight and SONAR might also quarantine files.

Table: Managing quarantined files on your client computer

Task

Description

Restore a quarantined file to its original location

Occasionally, a clean file does not have a location to which to be returned. For example, an infected attachment may have been stripped from an email and placed in the Quarantine. You must release the file and specify a location.

Manually quarantine an item

You can manually quarantine a file by adding it to the Quarantine or by selecting the file from the virus and spyware or SONAR logs.

See Quarantining a file from the Risk or Scan Log.

Permanently delete files from the Quarantine

You can manually delete the files that you no longer need from the Quarantine. You can also set up a time period by which files are deleted automatically.

Note:

Your administrator may specify a maximum number of days that items are allowed to stay in the Quarantine. Items are automatically deleted from the Quarantine after that time limit.

Rescan files in the Quarantine after you receive new definitions

When you update definitions, files in the Quarantine might get scanned, cleaned, and restored automatically. For some files, the Repair Wizard appears. Follow the on-screen instructions to complete the rescan and repair.

You can also rescan virus-infected files in the Quarantine manually.

Export Quarantine information

You can export the contents of the Quarantine to either a comma-delimited (.csv) file or a Microsoft Access Database (.mdb) file.

Submit infected files in the Quarantine to Symantec Security Response

After items in the Quarantine are rescanned, you might want to submit a file that is still infected to Symantec Security Response for further analysis.

See Manually submitting a potentially infected file to Symantec Security Response for analysis.

Clear backup items

Before trying to clean or repair items, the client makes backup copies of infected items by default. After the client successfully cleans a virus, you should manually delete the item from the Quarantine because the backup is still infected.

Automatically delete files from the Quarantine

You can set up the client to automatically remove items from the Quarantine after a specified time interval. You can also specify that the client removes items when the folder where the items are stored reaches a certain size. This configuration prevents the buildup of files that you may forget to remove manually from these areas.

See Automatically deleting files from the Quarantine.

More Information

About quarantining files


About quarantining files

When the client moves an infected file to the Quarantine, the virus or risk cannot copy itself and infect other files on your computer or other computers in the network. However, the Quarantine action does not clean the risk. The risk stays on your computer until the client cleans the risk or deletes the file. You do not have access to the file. But you can remove the file from the Quarantine.

When you update your computer with new virus definitions, the client automatically checks the Quarantine. You can rescan the items in the Quarantine. The latest definitions might clean or repair the previously quarantined files.

Viruses can be quarantined. Boot viruses reside in the boot sector or partition tables of a computer; these items cannot be moved to the Quarantine. Sometimes the client detects an unknown virus that cannot be eliminated with the current set of virus definitions. If you have a file that you believe is infected but scans do not detect an infection, you should quarantine the file.

Note:

The language of the operating system on which you run the client might not be able to interpret some characters in risk names. If the operating system cannot interpret the characters, the characters appear as question marks in notifications. For example, some unicode risk names might contain double-byte characters. On those computers that run the client on an English operating system, these characters appear as question marks.

More Information

Managing quarantined files on your client computer


Quarantining a file from the Risk or Scan Log

Based on the preset action for a threat detection, the client might or might not be able to perform the action you selected when a detection occurred. You can use the Risk Log or Scan Log to quarantine a file later.

To quarantine a file from the Risk Log or Scan Log

  1. In the client, click View Logs.

  2. Beside Virus and Spyware Protection, click View Log and then select Risk Log or Scan Log.

  3. Select the file that you want to quarantine, and then click Quarantine.

  4. Click OK, and then click Close.

More Information

About quarantining files

Managing quarantined files on your client computer


Manually submitting a potentially infected file to Symantec Security Response for analysis

When you submit an infected item from your quarantine list to Symantec Security Response. Symantec Security Response can analyze this item to make sure that it is not infected. Symantec Security Response also uses this data to protect against new or developing threats.

Note:

The submission option is not available if your administrator disables these types of submissions.

To submit a file to Symantec Security Response from the Quarantine

  1. In the client, in the sidebar, click View Quarantine.

  2. Select the file in the list of quarantined items.

  3. Click Submit.

  4. Follow the on-screen instructions in the wizard to collect the necessary information and submit the file for analysis.

More Information

Managing quarantined files on your client computer


Automatically deleting files from the Quarantine

You can set up your software to automatically remove items from the Quarantine list after a specified time interval. You can also specify that the client removes items when the folder where the items are stored reaches a certain size. This configuration prevents the buildup of files that you may forget to remove manually from these areas.

To automatically delete files from the Quarantine

  1. In the client, in the sidebar, click View Quarantine.

  2. Click Purge Options.

  3. In the Purge Options dialog box, select one of the following tabs:

    • Quarantine Items

    • Backup Items

    • Repaired Items

  4. Check or uncheck Length of time stored exceeds to enable or disable the ability of the client to delete the files after the configured time expires.

  5. If you check the Length of time stored exceeds check box, type or click an arrow to enter the amount of time.

  6. Select the unit of time from the drop-down list. The default is 30 days.

  7. If you check the Total folder size exceeds check box, type in the maximum folder size to allow, in megabytes. The default is 50 megabytes.

    If you check both check boxes, all files that are older than the time that you have set are deleted first. If the size of the folder still exceeds the limit that you set, the client deletes the oldest files individually. The client deletes the oldest files until the folder size does not exceed the limit.

  8. Repeat steps 4 through 7 for any of the other tabs.

  9. Click OK.

More Information

Managing quarantined files on your client computer


About submitting information about detections to Symantec Security Response

You can configure your computer to automatically submit information about detections to Symantec Security Response for analysis.

Symantec Response and the Global Intelligence Network use this submitted information to quickly formulate responses to new and developing security threats. The data that you submit improves Symantec's ability to respond to threats and customize protection. Symantec recommends that you always allow submissions.

See About the Symantec Endpoint Protection client.

You can choose to submit any of the following types of data:

  • File reputation

    Information about files that are detected based on their reputation. The information about these files contributes to the Symantec Insight reputation database to help protect your computers from new and emerging risks.

  • Antivirus detections

    Information about virus and spyware scan detections.

  • Antivirus advanced heuristic detections

    Information about potential threats detected by Bloodhound and other virus and spyware scan heuristics.

    These detections are silent detections that do not appear in the Risk log. Information about these detections is used for statistical analysis.

  • SONAR detections

    Information about threats that SONAR detects, which include high or low risk detections, system change events, and suspicious behavior from trusted applications.

  • SONAR heuristics

    SONAR heuristic detections are silent detections that do not appear in the Risk log. This information is used for statistical analysis.

You can also manually submit a sample to Response from the Quarantine.

See Submitting information about detections to Symantec Security Response.

See How Symantec Endpoint Protection uses reputation data to make decisions about files.

More Information

About the files and applications that SONAR detects


Submitting information about detections to Symantec Security Response

Symantec Endpoint Protection can protect computers by monitoring the information that comes into and out of the computer, and by blocking attack attempts.

You can enable your computer to submit information about detected threats to Symantec Security Response. Symantec Security Response uses this information to protect your client computers from new, targeted, and mutating threats. Any data you submit improves Symantec's ability to respond to threats and customize protection for your computer. Symantec recommends that you submit as much detection information as possible.

You can also manually submit a sample to Symantec Response from the Quarantine page. The Quarantine page also lets you determine how items are submitted to Symantec Security Response.

To configure submissions to Symantec Security Response

  1. Select Change Settings > Client Management.

  2. On the Submissions tab, check Let this computer automatically forward selected anonymous security information to Symantec. This option lets Symantec Endpoint Protection submit information about the threats that are found on your computer.

    Symantec recommends that you keep this option enabled.

  3. Select the types of information to submit:

    • File reputation

      Information about files that are detected based on their reputation. The information about these files contributes to the Symantec Insight reputation database to help protect your computers from new and emerging risks.

    • Antivirus detections

      Information about virus and spyware scan detections.

    • Antivirus advanced heuristic detections

      Information about the potential threats that are detected by Bloodhound and other virus and spyware scan heuristics.

      These detections are silent detections that do not appear in the Risk log. Information about these detections is used for statistical analysis.

    • SONAR detections

      Information about the threats that SONAR detects, which include high or low risk detections, system change events, and suspicious behavior from trusted applications.

    • SONAR heuristics

      SONAR heuristic detections are silent detections that do not appear in the Risk log. This information is used for statistical analysis.

  4. Enable Allow Insight lookups for threat detection to allow Symantec Endpoint Protection to use Symantec's reputation database to make decisions about threats.

    Insight lookups are enabled by default. Symantec recommends that you allow Insight lookups. Disabling this feature disables the Download Insight and may impair the functionality of SONAR and Insight Lookup.

    However, you can disable this option if you do not want to allow Symantec to query Symantec Insight.

More Information

Managing quarantined files on your client computer

About submitting information about detections to Symantec Security Response


About the client and the Windows Security Center

If you use Windows Security Center (WSC) on Windows XP with Service Pack 2 to monitor security status, you can see Symantec Endpoint Protection status in WSC.

Table: WSC protection status reporting shows the protection status reporting in WSC.

Table: WSC protection status reporting

Symantec product condition | Protection status
Symantec Endpoint Protection is not installed | NOT FOUND (red)
Symantec Endpoint Protection is installed with full protection | ON (green)
Symantec Endpoint Protection is installed, and virus and security risk definitions are out of date | OUT OF DATE (red)
Symantec Endpoint Protection is installed and Auto-Protect for the file system is not enabled | OFF (red)
Symantec Endpoint Protection is installed, Auto-Protect for the file system is not enabled, and virus and security risk definitions are out of date | OFF (red)
Symantec Endpoint Protection is installed and Rtvscan is turned off manually | OFF (red)

Table: WSC firewall status reporting shows the Symantec Endpoint Protection firewall status reporting in WSC.

Table: WSC firewall status reporting

Symantec product condition | Firewall status
Symantec firewall is not installed | NOT FOUND (red)
Symantec firewall is installed and enabled | ON (green)
Symantec firewall is installed but not enabled | OFF (red)
Symantec firewall is not installed or enabled, but a third-party firewall is installed and enabled | ON (green)

Note:

In Symantec Endpoint Protection, Windows Firewall is disabled by default.

If there is more than one firewall enabled, WSC reports that multiple firewalls are installed and enabled.


Managing SONAR on your client computer

You manage SONAR as part of Proactive Threat Protection. On managed clients, your administrator might lock some of the settings.

Table: Managing SONAR on your client computer

Task | Description
Make sure that SONAR is enabled | For the best protection on your client computer, SONAR should be enabled. SONAR is enabled by default. You enable SONAR by enabling Proactive Threat Protection. See About enabling and disabling protection.
Make sure that Insight lookups are enabled | SONAR uses reputation data in addition to heuristics to make detections. If you disable Insight lookups (reputation queries), SONAR makes detections by using heuristics only. The rate of false positives might increase, and the protection that SONAR provides is limited. See Submitting information about detections to Symantec Security Response.
Change SONAR settings | You can enable or disable SONAR. You can also change the detection action for some types of threats that SONAR detects. You might want to change the detection action to reduce false positive detections. See Changing SONAR settings.
Create exceptions for applications that you know are safe | SONAR might detect the files or the applications that you want to run on your computer. You can create exceptions for the applications or folders. You can also create an exception from the Quarantine. See Excluding items from scans.
Submit information about SONAR detections to Symantec Security Response | Symantec recommends that you send information about detections to Symantec Security Response. The information helps Symantec address threats. Submissions are enabled by default. See Submitting information about detections to Symantec Security Response.

More Information

Managing scans on your computer

About the types of scans


About SONAR

SONAR is a real-time protection that detects potentially malicious applications when they run on your computers. SONAR provides "zero-day" protection because it detects threats before traditional virus and spyware detection definitions have been created to address the threats.

SONAR uses heuristics as well as reputation data to detect emerging and unknown threats. SONAR provides an additional level of protection on your client computers and complement your existing Virus and Spyware Protection, intrusion prevention, and firewall protection.

Note:

Auto-Protect also uses a type of heuristic that is called Bloodhound to detect suspicious behavior in files.

More Information

Managing SONAR on your client computer

About the files and applications that SONAR detects


About the files and applications that SONAR detects

SONAR uses a heuristics system that leverages Symantec's online intelligence network with proactive local monitoring on your computer to detect emerging threats. SONAR also detects changes or behavior on your computer that you should monitor.

SONAR does not make detections on application type, but on how a process behaves. SONAR acts on an application only if that application behaves maliciously, regardless of its type. For example, if a Trojan horse or keylogger does not act maliciously, SONAR does not detect it.

SONAR detects the following items:

Heuristic threats | SONAR uses heuristics to determine if an unknown file behaves suspiciously and might be a high risk or low risk. It also uses reputation data to determine whether the threat is a high risk or low risk.
System changes | SONAR detects applications or the files that try to modify DNS settings or a host file on a client computer.
Trusted applications that exhibit bad behavior | Some good trusted files might be associated with suspicious behavior. SONAR detects these files as suspicious behavior events. For example, a well-known document sharing application might create executable files.

If you disable Auto-Protect, you limit SONAR's ability to make detections of high and low risk files. If you disable Insight lookups (reputation queries), you also limit the SONAR's detection capability.

More Information

Managing SONAR on your client computer


Changing SONAR settings

You might want to change SONAR actions to reduce the rate of false positive detections. You can also change notifications for SONAR heuristic detections.

Note:

On managed clients, your administrator might lock these settings.

To change SONAR settings

  1. In the client, in the sidebar, click Change settings.

  2. Next to Proactive Threat Protection, click Configure Settings

  3. On the SONAR tab, change the actions for high risk or low risk heuristic threats.

    You can enable aggressive mode for low risk detections. This setting increases SONAR sensitivity to low risk detections. It might increase the false positive detections.

  4. Optionally, change the notification settings.

  5. On the Suspicious Behavior Detection tab, change the action for high risk or low risk detections. SONAR makes these detections when trusted files are associated with suspicious behavior.

  6. On the System Change Events tab, change the scan action for detections of changes to the DNS server settings or a host file.

  7. Click OK.

More Information

Managing SONAR on your client computer


Managing the firewall and intrusion prevention

This section includes the following topics:

  • About Network Threat Protection

  • Managing firewall protection

  • Configuring firewall settings

  • About allowing or blocking applications

  • Viewing network activity

  • About client firewall rules

  • About the firewall rule, firewall setting, and intrusion prevention processing order

  • Changing the order of firewall rules

  • How the firewall uses stateful inspection

  • The elements of a firewall rule

  • Setting up firewall rules

  • Managing intrusion prevention

  • How intrusion prevention works

  • Enabling or disabling intrusion prevention

  • Configuring intrusion prevention notifications


About Network Threat Protection

The Symantec Endpoint Protection client provides Network Threat Protection, which monitors the information that comes in and out of your computer and blocks network attack attempts.

Table: Network Threat Protection features describes the Symantec Endpoint Protection features that you can use to manage Network Threat Protection.

Table: Network Threat Protection features

Tool

Description

Firewall

The firewall protects unauthorized users from accessing your computer and the networks that connect to the Internet. The firewall detects possible hacker attacks, protects personal information, and eliminates unwanted sources of network traffic. The firewall allows or blocks inbound and outbound traffic.

See How a firewall works.

See Managing firewall protection.

Intrusion Prevention System

The Intrusion Prevention System (IPS) automatically detects and blocks network attacks. The IPS scans every packet that enters and exits a computer for attack signatures.

The IPS relies on an extensive list of attack signatures to detect and block suspicious network activity. Symantec supplies the known threat list, which you can update on the client by using Symantec LiveUpdate. The Symantec IPS engine and corresponding set of IPS signatures are installed on the client by default.

See How intrusion prevention works.

See Managing intrusion prevention.


Managing firewall protection

By default, the firewall allows all incoming network traffic and outgoing network traffic. You can configure the firewall to allow or block specific types of traffic.

Your administrator determines the level of interaction that you have with the client by permitting your ability to configure firewall rules and settings. Your administrator can restrict your use such that you can only interact with the client when it notifies you of new network connections and possible problems. Or your administrator can permit you full access to the user interface.

Table: Managing firewall protection describes the firewall tasks you can perform to protect your computer. All of these tasks are optional and can be performed in any order.

Table: Managing firewall protection

Task

Description

Read about how the firewall works

Learn how the firewall protects your computer from network attacks.

See How a firewall works.

Configure firewall settings

In addition to creating firewall rules, you can also enable and configure firewall settings to further enhance your firewall protection.

See Configuring firewall settings.

View firewall logs

You can regularly check the firewall protection status on your computer to determine the following:

  • The firewall rules that you created work correctly.

  • The client blocked any network attacks.

  • The client blocked any applications that you expected to run.

You can use the Traffic Log and the Packet Log to check the firewall protection status.

See About the logs.

Note:

By default, the Packet log is disabled on managed clients.

Configure application settings

You can enhance protection for your computer by customizing application settings. An application is a software program designed to help the user perform a task. For example, Microsoft Internet Explorer is an application. You can configure firewall settings to control the applications that can access the network.

See About allowing or blocking applications.

Monitor network activity

You can view information about inbound traffic and outbound traffic from the client. You can also view a list of applications and services that have run since the client service started.

See Viewing network activity.

Add and customize firewall rules

In addition to enabling firewall settings, you can modify the default firewall rules to further customize your firewall protection. You can also create new firewall rules. For example, you might want to block an application that you do not want to run on your computer, such as an adware application.

See About client firewall rules.

See Setting up firewall rules.

See Enabling and disabling firewall rules.

Enable or disable the firewall

You can disable Network Threat Protection temporarily for troubleshooting purposes. For example, you might need to disable it so that you can open a certain application.

See Enabling or disabling protection on the client computer.

More Information

About Network Threat Protection


How a firewall works

A firewall does all of the following tasks:

  • Prevents any unauthorized users from accessing the computers and networks in your organization that connect to the Internet

  • Monitors the communication between your computers and other computers on the Internet

  • Creates a shield that allows or blocks attempts to access the information on your computers

  • Warns you of connection attempts from other computers

  • Warns you of connection attempts by the applications on your computer that connect to other computers

The firewall reviews the packets of data that travel across the Internet. A packet is a discrete chunk of data that is part of the information flow between two computers. Packets are reassembled at their destination to appear as an unbroken data stream.

Packets contain information about the following:

  • Sending computers

  • Intended recipients

  • How the packet data is processed

  • Ports that receive the packets

Ports are the channels that divide the stream of data that comes from the Internet. Applications that run on a computer listen to the ports. The applications accept the data that is sent to the ports.

Network attacks exploit weaknesses in vulnerable applications. Attackers use these weaknesses to send the packets that contain malicious programming code to ports. When vulnerable applications listen to the ports, the malicious code lets the attackers gain access to the computer.

More Information

About Network Threat Protection

Managing firewall protection


Configuring firewall settings

Table: Firewall settings describes the types of firewall settings that you can configure to further customize your firewall protection.

Your administrator has not given you the appropriate permissions to configure these settings if they do not appear in the user interface or cannot be modified. Modification of firewall settings is optional and can be done in any order.

Table: Firewall settings

Category | Description
Traffic and stealth Web browsing | You can enable various traffic settings and stealth Web browsing settings to protect against certain types of network attacks on the client. You can enable traffic settings to detect and block the traffic that communicates through drivers, NetBIOS, and token rings. You can configure settings to detect the traffic that uses more invisible attacks. You can also control the behavior for the IP traffic that does not match any firewall rules. See Enabling traffic settings and stealth Web browsing settings.
Built-in rules for essential network services | Symantec Endpoint Protection provides the built-in rules that allow for the normal exchange of certain essential network services. Built-in rules eliminate the need to create the firewall rules that explicitly allow those services. During processing, these built-in rules are evaluated before firewall rules so that the packets that match an active occurrence of a built-in rule are allowed. You can define built-in rules for DHCP, DNS, and WINS services. See Automatically allowing communications for essential network services.
Network file and print sharing | You can enable the client to either share its files or to browse for shared files and printers on your local network. To prevent network-based attacks, you can disable network file and printer sharing. See Enabling network file and printer sharing.
Block an attacking computer | When the Symantec Endpoint Protection client detects a network attack, it can automatically block the connection to ensure that the client computer is safe. The client activates an active response. The client then automatically blocks all communication to and from the IP address of the attacking computer for a period of time. The IP address of the attacking computer is blocked for a single location. See Blocking and unblocking an attacking computer.

More Information

About client firewall rules

Setting up firewall rules


Enabling traffic settings and stealth Web browsing settings

You can enable various traffic settings and stealth Web browsing settings to protect against certain types of network attacks on the client. You can enable traffic settings to detect and block the traffic that communicates through drivers, NetBIOS, and token rings. You can configure settings to detect the traffic that uses more invisible attacks. You can also control the behavior for the IP traffic that does not match any firewall rules.

After the firewall has completed certain operations, control is passed to a number of components. Each component is designed to perform a different type of packet analysis.

To enable traffic settings and stealth Web browsing settings

  1. In the client, in the sidebar, click Change settings.

  2. Beside Network Threat Protection, click Configure Settings.

  3. On the Firewall tab, under Traffic Settings, check the boxes for the features that you want to enable as follows:

    Enable NetBIOS protection

    Blocks the NetBIOS traffic from an external gateway.

    You can use Network Neighborhood file and printer sharing on a LAN and protect a computer from NetBIOS exploits from any external network. This option blocks the NetBIOS packets that originate from the IP addresses that are not part of the defined ICANN internal ranges. ICANN internal ranges include 10.x.x.x, 172.16.x.x, 192.168.x.x, and 169.254.x.x, with the exception of the 169.254.0.x and 169.254.255.x subnets. The NetBIOS packets include UDP 88, UDP 137, UDP 138, TCP 135, TCP 139, TCP 445, and TCP 1026.

    Note:

    The NetBIOS protection can cause a problem with Microsoft Outlook if the client computer connects to a Microsoft Exchange Server that is on a different subnet. You can create a firewall rule that specifically allows access to that server.

    Allow token ring traffic

    Allows the client computers that connect through a token ring adapter to access the network, regardless of the firewall rules on the client.

    If you disable this setting, any traffic that comes from the computers that connect through a token ring adapter cannot access the corporate network. The firewall does not filter token ring traffic. It either allows all token ring traffic or blocks all token ring traffic.

    Enable anti-MAC spoofing

    Allows the inbound and the outbound ARP (address resolution protocol) traffic only if an ARP request was made to that specific host. It blocks all other unexpected ARP traffic and logs it in the Security log.

    Some hackers use MAC spoofing to try to hijack a communication session between two computers. Media Access Control (MAC) addresses are the hardware addresses that identify the computers, the servers, the routers, and so forth. When computer A wants to communicate with computer B, it may send an ARP packet to the computer.

    Anti-MAC spoofing protects a computer from letting another computer reset a MAC address table. If a computer sends an ARP REQUEST message, the client allows the corresponding ARP RESPOND message within a period of 10 seconds. All client rejects all unsolicited ARP RESPOND messages.

    Enable network application monitoring

    Allows the client to monitor changes to the network applications that run on the client computer.

    Network applications send and receive traffic. The client detects whether an application's content changes.

    Block all traffic until the firewall starts and after the firewall stops

    Blocks all inbound traffic to and outbound traffic from the client computer when the firewall does not run for any reason.

    The computer is not protected when either of the following events occur:

    • After the client computer turns on and before the firewall service starts

    • After the firewall service and client computer stop

    This time frame is a small security hole that can allow unauthorized communication. This setting prevents unauthorized applications from communicating with other computers.

    Note:

    When Network Threat Protection is disabled, the client ignores this setting.

    Enable denial of service detection

    When this setting is enabled, Symantec Endpoint Protection identifies known attacks based on multiple packets, regardless of the port number or type of Internet protocol.

    The inability to provide this type of detection is a limitation of a signature-based intrusion detection and prevention system.

    Enable port scan detection

    When this setting is enabled, Symantec Endpoint Protection monitors all incoming packets that any security rule blocks. If a rule blocks several different packets on different ports in a short period of time, Symantec Endpoint Protection creates a Security log entry.

    Port scan detection does not block any packets. You must create a security policy to block traffic when a port scan occurs.

  4. Under Unmatched IP Traffic Settings, check the boxes for the features that you want to enable.

    These options control the incoming IP traffic and outgoing IP traffic that does not match any firewall rules. IP traffic includes the data packets that flow through IP networks and that use the TCP, UDP, and ICMP protocols. Applications, mail exchanges, file transfers, ping programs, and Web transmissions are types of IP traffic.

    You can enable one or more of the following IP traffic settings:

    Allow IP traffic

    Allows any incoming traffic and outgoing traffic, unless a firewall rule states otherwise. For example, if you add a firewall rule that blocks VPN traffic, the firewall allows all other traffic except for the VPN traffic.

    Allow only application traffic

    Allows the traffic to and from applications and blocks the traffic that is not associated with any application. For example, the firewall allows Internet Explorer but blocks VPN traffic, unless a rule states otherwise.

    Prompt before allowing application traffic

    Displays a message that asks you whether to allow or block an application. For example, you may want to choose whether or not to block media files. Or, you may want to hide broadcasts from the NTOSKRNL.DLL process. The NTOSKRNL.DLL process can be an indication of spyware, because spyware often downloads and installs the NTOSKRNL.DLL process.

  5. Under Stealth Settings, check the boxes for the features that you want to enable as follows:

    Enable TCP resequencing

    Prevents an intruder from forging or spoofing an individual's IP address.

    Hackers use IP spoofs to hijack a communication session between two computers, such as computer A and B. A hacker can send a data packet that causes computer A to drop the communication. Then the hacker can pretend to be computer A and communicate with and attack computer B. To protect the computer, TCP resequencing randomizes TCP sequence numbers.

    Note:

    OS fingerprint masquerading works best when TCP resequencing is enabled.

    Warning:

    TCP resequencing changes the TCP sequencing number when the client service runs. The sequencing number is different when the service runs and when the service does not run. Therefore, the network connections are terminated when you stop or start the firewall service. TCP/IP packets use a sequence of session numbers to communicate with other computers. When the client does not run, the client computer uses the Windows number scheme. When the client runs and TCP resequencing is enabled, the client uses a different number scheme. If the client service suddenly stops, the number scheme reverts back to the Window number scheme and Windows then drops the traffic packets. Furthermore, TCP resequencing may have a compatibility issue with certain NICs that causes the client to block all inbound traffic and outbound traffic.

    Enable stealth mode Web browsing

    Detects the HTTP traffic from a Web browser on any port and removes the following information: the browser name and version number, the operating system, and the reference Web page. It stops Web sites from knowing which operating system and browser the computer uses. It does not detect HTTPS (SSL) traffic.

    Warning:

    Stealth mode Web browsing may cause some Web sites not to function properly. Some Web servers build a Web page that is based on information about the Web browser. Because this option removes the browser information, some Web pages may not appear properly or at all. Stealth mode Web browsing removes the browser signature, called the HTTP_USER_AGENT, from the HTTP request header and replaces it with a generic signature.

    Enable OS fingerprint masquerading

    Prevents the detection of the operating system of a client computer. The client changes the TTL and identification value of TCP/IP packets to prevent the identification of an operating system.

    Note:

    OS fingerprint masquerading works best when TCP resequencing is enabled.

    Warning:

    TCP resequencing may have a compatibility issue with certain NICs that causes the client to block all inbound traffic and outbound traffic.

  6. Click OK.

See Blocking traffic.

More Information

Configuring firewall settings


Automatically allowing communications for essential network services

Symantec Endpoint Protection provides built-in the rules that allow for the normal exchange of certain essential network services. Built-in rules eliminate the need to create the firewall rules that explicitly allow those services. During processing, these built-in rules are evaluated before firewall rules so that the packets that match an active occurrence of a built-in rule are allowed. You can define built-in rules for DHCP, DNS, and WINS services.

Built-in rules filters allow the packet if a request was made. They do not block packets. The firewall rules allow or block packets.

  1. In the client, in the sidebar, click Change settings.

  2. Beside Network Threat Protection, click Configure Settings.

  3. On the Firewall tab under Built-in Rules check one or more of the following options:

    • Enable Smart DHCP

    • Enable Smart DNS

    • Enable Smart WINS

  4. Click OK.

See Enabling traffic settings and stealth Web browsing settings.

More Information

Configuring firewall settings


Enabling network file and printer sharing

You can enable the client to either share its files or to browse for shared files and printers on your local network. To prevent network-based attacks, you can disable network file and printer sharing.

You can enable network file and print sharing in the following ways:

Automatically enable the network file and printer sharing settings on the Microsoft Windows Networking tab.

If a firewall rule blocks this traffic, the firewall rule takes priority over the settings.

To automatically enable network file and print sharing

Manually enable network file and printer sharing by adding firewall rules.

You can add the firewall rules if you want more flexibility than what the settings provide. For example, when you create a rule, you can specify a particular host rather than all hosts. The firewall rules allow access to the ports to browse and share files and printers.

You can create one set of firewall rules so that the client can share its files. You create a second set of firewall rules so that the client can browse for other files and printers.

To manually enable clients to browse for files and printers

To manually enable other computers to browse files on the client

To automatically enable network file and print sharing

  1. In the client, in the sidebar, click Change settings.

  2. Beside Network Threat Protection, click Configure Settings.

  3. On the Microsoft Windows Networking tab under Settings, click the drop-down menu and select the adapter for which these settings apply.

  4. To browse other computers and printers in the network, click Browse files and printers on the network.

  5. To enable other computers to browse files on your computer, click Share my files and printers with others on the network.

  6. Click OK.

To manually enable clients to browse for files and printers

  1. In the client, in the sidebar, click Status.

  2. Beside Network Threat Protection, click Options > Configure Firewall Rules.

  3. In the Configure Firewall Rules dialog box, click Add.

  4. On the General tab, type a name for the rule and click Allow this traffic.

  5. On the Ports and Protocols tab, in the Protocol drop-down list, click TCP.

  6. In the Remote ports drop-down list, type 88, 135, 139, 445.

  7. Click OK.

  8. In the Configure Firewall Rules dialog box, click Add.

  9. On the General tab, type a name for the rule and click Allow this traffic.

  10. On the Ports and Protocols tab, in the Protocol drop-down list, click UDP.

  11. In the Remote ports drop-down list, type 88.

  12. In the Local ports drop-down list, type 137, 138.

  13. Click OK.

To manually enable other computers to browse files on the client

  1. In the client, in the sidebar, click Status.

  2. Beside Network Threat Protection, click Options > Configure Firewall Rules.

  3. In the Configure Firewall Rules dialog box, click Add.

  4. On the General tab, type a name for the rule and click Allow this traffic.

  5. On the Ports and Protocols tab, in the Protocol drop-down list, click TCP.

  6. In the Local ports drop-down list, type 88, 135, 139, 445.

  7. Click OK.

  8. In the Configure Firewall Rules dialog box, click Add.

  9. On the General tab, type a name for the rule and click Allow this traffic.

  10. On the Ports and Protocols tab, in the Protocol drop-down list, click UDP.

  11. In the Local ports drop-down list, type 88, 137, 138.

  12. Click OK.

More Information

Configuring firewall settings


Blocking and unblocking an attacking computer

When the Symantec Endpoint Protection client detects a network attack, it can automatically block the connection to ensure that the client computer is safe. The client activates an active response, which automatically blocks all communication to and from the IP address of the attacking computer for a set period of time. The IP address of the attacking computer is blocked for a single location.

You can view the IP address of the attacking computer in the security log. You can also unblock an attack by stopping the active response in the security log.

If you do not want to wait the default amount of time to unblock the IP address, you can unblock it immediately.

To block an attacking computer

  1. In the client, in the sidebar, click Change settings.

  2. Beside Network Threat Protection, click Configure Settings.

  3. On the Firewall tab under Active Response Settings, check Number of seconds to automatically block an attacker's IP address, and then enter the number of seconds..

    Enter a number from one second to 999,999 seconds. The default time is 600 seconds (10 minutes).

  4. Click OK.

To unblock an attacking computer

  1. In the client, in the sidebar, click View logs.

  2. Beside Client Management, click View Logs > Security Log.

  3. In the Security Log, select the row that contains Active Response in the Event Type column, and then click Action > Stop Active Response.

    To unblock the blocked IP addresses, click Action > Stop All Active Response. If you unblock an active response, the Event Type column displays Active Response canceled. If the active response times out, the Event Type column displays "Active Response disengaged."

  4. In the message box that appears, click OK.

  5. Click File > Exit.

See Blocking traffic.

More Information

Configuring firewall settings


Blocking traffic

You can configure your computer to block inbound traffic and outbound traffic in the following situations:

When your computer's screen saver is activated.

You can configure your computer to block all the inbound and the outbound network neighborhood traffic when your computer's screen saver is activated. As soon as the screen saver turns off, your computer returns to the previously assigned security level.

To block traffic when the screen saver is activated

When the firewall does not run.

The computer is unprotected after the client computer starts and before the firewall service starts or after the firewall service stops and the computer turns off. This time frame is a small security hole that can allow unauthorized communication.

To block traffic when the firewall does not run

When you want to block all inbound traffic and outbound traffic at any time.

You may want to block all traffic when a particularly destructive virus attacks your company's network or subnet. You would not block all traffic under normal circumstances.

Note:

Your administrator may have configured this option to be unavailable. You cannot block traffic on an unmanaged client.

To block all traffic at any time

You can allow all traffic by disabling Network Threat Protection.

See Enabling or disabling protection on the client computer.

To block traffic when the screen saver is activated

  1. In the client, in the sidebar, click Change settings.

  2. Beside Network Threat Protection, click Configure Settings.

  3. On the Microsoft Windows Networking tab under Screen Saver Mode, click Block Microsoft Windows Networking traffic while the screen saver runs.

  4. Click OK.

To block traffic when the firewall does not run

  1. In the client, in the sidebar, click Change settings.

  2. Beside Network Threat Protection, click Configure Settings.

  3. On the Firewall tab under Traffic Settings, click Block all traffic until the firewall starts and after the firewall stops.

  4. Optionally click Allow initial DHCP and NetBIOS traffic.

  5. Click OK.

To block all traffic at any time

  1. In the client, in the sidebar click Status.

  2. Beside Network Threat Protection, click Options > View Network Activity.

  3. Click Tools > Block All Traffic.

  4. To confirm, click Yes.

  5. To return to the previous firewall settings that the client uses, uncheck Tools > Block All Traffic.

See Blocking and unblocking an attacking computer.

More Information

Configuring firewall settings


About allowing or blocking applications

An application is a software program that you use to accomplish certain tasks. For example, Internet Explorer and iTunes are applications. You can customize the client to control certain applications to protect your network from attacks.

The following describes the tasks you can perform to customize firewall protection for your applications. All of these tasks are optional and can be performed in any order:

  • You can enable the client to allow or block an application from accessing the network.

    See Allowing or blocking applications from accessing the network.

  • You can configure the settings for an application that has run since the client service starts or has asked for permission to access the network. You can also configure restrictions such as the IP addresses and the ports that the application can use. You can view and change the action that the client takes for each application that tries to gain access through your network connection. By configuring the settings for a specific application, you create an application-based firewall rule.

    See Configuring application-specific settings.

  • You can remove the application's restrictions, such as the time of day that the firewall blocks an application. When you remove the restrictions, the action that the client takes on the application is also erased. When the application or the service tries to connect to the network again, you may be asked again whether to allow or block the application. You can also stop an application or service from running until the application tries to access your computer again, such as when you restart the computer.

    See Removing the restrictions from an application.

More Information

Managing firewall protection


Allowing or blocking applications from accessing the network

You can enable the client to allow or block an application from accessing the network.

Table: Actions that the firewall takes when applications access the client or network describes the actions that the client takes on network traffic.

Table: Actions that the firewall takes when applications access the client or network

Action

Description

Allow

Allows the inbound traffic to access the client computer and the outbound traffic to access the network.

If the client receives traffic, the icon displays a small blue dot in the lower left-hand corner. If the client sends traffic, the icon displays the dot in the lower right-hand corner.

Block

Blocks the inbound traffic and the outbound traffic from accessing the network or an Internet connection.

Ask

Asks you whether you want the application to access the network the next time you attempt to run the application.

Terminate

Stops the process.

To allow or block an application from accessing the network

  1. In the client, in the sidebar, click Status.

  2. Beside Network Threat Protection, click Options > View Network Activity.

  3. In the Network Activity dialog box, in the Running Applications field, right-click the application or service, and then click the option that you want.

  4. Click Close.

See Viewing network activity.

See Blocking traffic.

More Information

About allowing or blocking applications


Configuring application-specific settings

You can configure the settings for an application that has run since the client service starts or has asked for permission to access the network.

You can configure restrictions such as the IP addresses and the ports that the application can use. You can view and change the action that the client takes for each application that tries to gain access through your network connection. By configuring the settings for a specific application, you create an application-based firewall rule.

Note:

If there is a conflict between a firewall rule and an application-specific setting, the firewall rule takes precedence. For example, a firewall rule that blocks all traffic between 1:00 A.M. and 8:00 A.M. overrides the schedule for a specific video application.

The applications that appear in the Network Activity dialog box are the applications and the services that have run since the client service started.

To configure application-specific settings

  1. In the client, in the sidebar, click Status.

  2. Beside Network Threat Protection, click Options > View Application Settings.

  3. In the View Application Settings dialog box, select the application you want to configure, and then click Configure.

  4. In the Configure Application Settings dialog box, in the Trusted IPs for the application box, type an IP address or an IP range.

  5. In the Remote server ports or Local ports group boxes, select a TCP or a UDP port.

  6. To specify the direction of the traffic, click one or both of the following items:

    To allow outbound traffic

    Click Allow outgoing connections.

    To allow inbound traffic

    Click Allow incoming connections.

  7. To apply the rule when the screen saver runs, click Allow while screen saver is activated.

  8. To set up a schedule when the restrictions are or are not in effect, click Enable scheduling.

  9. Select one of the following items:

    To specify the time when the restrictions are in effect

    Click During the period below.

    To specify the time when the restrictions are not in effect

    Click Excluding the period below.

  10. Set up the schedule.

  11. Click OK.

  12. In the View Application Settings dialog box, to change the action, right-click the application, and then click Allow or Block.

  13. Click OK.

To stop an application or service

  1. In the client, in the sidebar, click Status.

  2. Beside Network Threat Protection, click Options > View Network Activity.

  3. In the Running Applications field, right-click the application, and then click Terminate.

  4. To confirm, click Yes, and then click Close.

See Adding a firewall rule.

See Viewing network activity.

More Information

About allowing or blocking applications


Removing the restrictions from an application

You can remove the application's restrictions, such as the time of day that the firewall blocks an application. When you remove the restrictions, the action that the client takes on the application is also erased. When the application or the service tries to connect to the network again, you may be asked again whether to allow or block the application.

You can stop an application or service from running until the application tries to access your computer again, such as when you restart the computer.

To remove the restrictions from an application

  1. In the client, in the sidebar, click Status.

  2. Beside Network Threat Protection, click Options > View Application Settings.

  3. In the View Application Settings dialog box, do one of the following actions:

    To remove an application from the list.

    Select the application, and then click Remove.

    To remove all applications from the list.

    Click Remove All.

  4. Click Yes.

  5. Click OK.

See Configuring application-specific settings.

More Information

About allowing or blocking applications


Viewing network activity

You can view information about inbound traffic and outbound traffic from your computer. You can also view a list of applications and services that have run since the client service started.

Note:

The client does not detect network traffic from Personal Digital Assistant (PDA) devices.

You can display the network traffic as either broadcast traffic or unicast traffic. Broadcast traffic is the network traffic that is sent to every computer in a particular subnet, and is not directed specifically to your computer. Unicast traffic is the traffic that is directed specifically to your computer.

To view network activity history

  1. In the client, in the sidebar, click Status.

  2. Beside Network Threat Protection, click Options > View Network Activity.

  3. Click Close.

To show or hide Windows services and broadcast traffic

  1. In the client, in the sidebar, click Status.

  2. Beside Network Threat Protection, click Options > View Network Activity.

  3. In the Network Activity dialog box, right-click Running Applications and do any of the following actions:

    To show or hide Windows services

    Check or uncheck Show Windows Services.

    To display broadcast traffic

    Check Show Broadcast Traffic.

    To display unicast traffic

    Uncheck Show Broadcast Traffic.

  4. Click Close.

To change the way the application information displays

  1. In the client, in the sidebar, click Status.

  2. Beside Network Threat Protection, click Options > View Network Activity.

  3. In the Running Applications field, right-click the application, and then click the view that you want to see. For example, you can click Details.

  4. Click Close.

See Configuring application-specific settings.

See Allowing or blocking applications from accessing the network.

See Blocking traffic.

More Information

Managing firewall protection


About client firewall rules

Table: Topics about client firewall rules describes what you should know about client firewall rules.

Table: Topics about client firewall rules

Topic | Description
Understand how firewall rules, settings, and intrusion prevention settings are processed | You can be more successful in creating effective firewall rules if you understand how the rules, firewall settings, and intrusion prevention settings are processed. Understanding how the rules and settings are processed lets you order your firewall rules accordingly. See About the firewall rule, firewall setting, and intrusion prevention processing order. See Changing the order of firewall rules.
Learn about how the client uses stateful inspection so that you do not have to create specific rules | Symantec Endpoint Protection uses stateful inspection. This means that for the traffic that is initiated in one direction, you do not need a rule to permit the return traffic. Understanding how stateful inspection works eliminates the need for creating rules.
Know the elements of a firewall rule | To create effective firewall rules, you should understand the components that make up a rule.

More Information

How the firewall uses stateful inspection

The elements of a firewall rule

Managing firewall protection


About the firewall rule, firewall setting, and intrusion prevention processing order

Firewall rules are ordered sequentially, from highest to lowest priority, or from the top to bottom in the rules list. If the first rule does not specify how to handle a packet, the firewall inspects the second rule. This process continues until the firewall finds a match. After the firewall finds a match, the firewall takes the action that the rule specifies. Subsequent lower priority rules are not inspected. For example, if a rule that blocks all traffic is listed first, followed by a rule that allows all traffic, the client blocks all traffic.

You can order rules according to exclusivity. The most restrictive rules are evaluated first, and the most general rules are evaluated last. For example, you should place the rules that block traffic near the top of the rules list. The rules that are lower in the list might allow the traffic.

The best practices for creating a rule base include the following order of rules:

1st | Rules that block all traffic.
2nd | Rules that allow all traffic.
3rd | Rules that allow or block specific computers.
4th | Rules that allow or block specific applications, network services, and ports.

Table: Processing order shows the order in which the firewall processes the rules, firewall settings, and intrusion prevention settings.

Table: Processing order

Priority | Setting
First | Custom IPS signatures
Second | Intrusion Prevention settings, traffic settings, and stealth settings
Third | Built-in rules
Fourth | Firewall rules
Fifth | Port scan checks
Sixth | IPS signatures that are downloaded through LiveUpdate

See Changing the order of firewall rules.

See How a firewall works.

More Information

How intrusion prevention works

About client firewall rules


Changing the order of firewall rules

The firewall processes the list of firewall rules from the top down. You can determine how the firewall processes firewall rules by changing their order. When you change the order, it affects the order for the currently selected location only.

Note:

For better protection, place the most restrictive rules first and the least restrictive rules last.

To change the order of a firewall rule

  1. In the client, in the sidebar, click Status.

  2. Beside Network Threat Protection, click Options > Configure Firewall Rules.

  3. In the Configure Firewall Rules dialog box, select the rule that you want to move.

  4. Do one of the following actions:

    • To have the firewall process this rule before the rule above it, click the up arrow.

    • To have the firewall process this rule after the rule below it, click the down arrow.

  5. When you finish moving rules, click OK.

More Information

About the firewall rule, firewall setting, and intrusion prevention processing order

About client firewall rules


How the firewall uses stateful inspection

Firewall protection uses stateful inspection to track current connections. Stateful inspection tracks source and destination IP addresses, ports, applications, and other connection information. Before the client inspects the firewall rules, it makes the traffic flow decisions that are based on the connection information.

For example, if a firewall rule allows a computer to connect to a Web server, the firewall logs the connection information. When the server replies, the firewall discovers that a response from the Web server to the computer is expected. It permits the Web server traffic to flow to the initiating computer without inspecting the rule base. A rule must permit the initial outbound traffic before the firewall logs the connection.

Stateful inspection eliminates the need to create new rules. For the traffic that is initiated in one direction, you do not have to create the rules that permit the traffic in both directions. The client traffic that is initiated in one direction includes Telnet (port 23), HTTP (port 80), and HTTPS (port 443). The client computers initiate this outbound traffic; you create a rule that permits the outbound traffic for these protocols. Stateful inspection automatically permits the return traffic that responds to the outbound traffic. Because the firewall is stateful in nature, you only need to create the rules that initiate a connection, not the characteristics of a particular packet. All packets that belong to an allowed connection are implicitly allowed as being an integral part of that same connection.

Stateful inspection supports all rules that direct TCP traffic.

Stateful inspection does not support the rules that filter ICMP traffic. For ICMP traffic, you must create the rules that permit the traffic in both directions. For example, for the clients to use the ping command and receive replies, you must create a rule that permits ICMP traffic in both directions.

See How a firewall works.

More Information

About client firewall rules


The elements of a firewall rule

Firewall rules control how the client protects your computer from malicious network traffic. When a computer attempts to connect to another computer, the firewall compares the connection type with the firewall rules. The firewall automatically checks all the inbound traffic and outbound traffic packets against the rules. The firewall allows or blocks the packets according to the rules.

You can use triggers such as applications, hosts, and protocols to define the firewall rules. For example, a rule can identify a protocol in relation to a destination address. When the firewall evaluates the rule, all the triggers must be true for a positive match to occur. If any trigger is false for the current packet, the firewall does not apply the rule.

As soon as a firewall rule is triggered, no other firewall rules are evaluated. If no rule is triggered, the packet is automatically blocked and the event is not logged.

A firewall rule describes the conditions in which a network connection may be allowed or blocked. For example, a rule may allow network traffic between remote port 80 and the IP address 192.58.74.0, between 9 A.M. and 5 P.M. daily.

Table: Firewall rule conditions describes the criteria that you use to define a firewall rule.

Table: Firewall rule conditions

Condition

Description

Triggers

The firewall rule triggers are as follows:

  • Applications

    When the application is the only trigger you define in an allow traffic rule, the firewall allows the application to perform any network operation. The application is the significant value, not the network operations that the application performs. For example, suppose you allow Internet Explorer and define no other triggers. Users can access the remote sites that use HTTP, HTTPS, FTP, Gopher, and any other protocol that the Web browser supports. You can define additional triggers to describe the particular network protocols and hosts with which communication is allowed.

  • Hosts

    The local host is always the local client computer and the remote host is always a remote computer that is positioned elsewhere on the network. This expression of the host relationship is independent of the direction of traffic. When you define host triggers, you specify the host on the remote side of the described network connection.

  • Protocols

    A protocol trigger identifies one or more network protocols that are significant in relation to the described traffic.

    The local host computer always owns the local port, and the remote computer always owns the remote port. This expression of the port relationship is independent of the direction of traffic.

  • Network adapters

    If you define a network adapter trigger, the rule is relevant only to the traffic that is transmitted or received by using the specified type of adapter. You can specify either any adapter or the one that is currently associated with the client computer.

You can combine the trigger definitions to form more complex rules, such as to identify a particular protocol in relation to a specific destination address. When the firewall evaluates the rule, all the triggers must be true for a positive match to occur. If any one trigger is not true in relation to the current packet, the firewall cannot apply the rule.

Conditions

Schedule and screen saver state.

The conditional parameters do not describe an aspect of a network connection. Instead, the conditional parameters determine the active state of a rule. The conditional parameters are optional and if not defined, not significant. You may set up a schedule or identify a screen saver state that dictates when a rule is considered to be active or inactive. The firewall does not evaluate the inactive rules when the firewall receives packets.

Actions

Allow or block, and log or do not log.

The action parameters specify what actions the firewall takes when it successfully matches a rule. If the rule is selected in response to a received packet, the firewall performs all actions. The firewall either allows or blocks the packet and logs or does not log the packet.

If the firewall allows traffic, it lets the traffic that the rule specifies to access your network.

If the firewall blocks traffic, it blocks the traffic that the rule specifies so that it does not access your network.

See How the firewall uses stateful inspection.

See Adding a firewall rule.

More Information

About client firewall rules


Setting up firewall rules

Table: How to setup firewall rules describes how to set up new firewall rules.

Table: How to setup firewall rules

Step

Task

Description

1

Add a new firewall rule

Symantec Endpoint Protection installs with default firewall rules. But you can create your own rules.

See Adding a firewall rule.

Another way that you can add a firewall rule is to export existing firewall rules from another Firewall policy. You can then import the firewall rules and settings so that you do not have to re-create them.

See Exporting and importing firewall rules.

2

(Optional) Customize the firewall rule criteria

After you create a new rule, or if you want to customize a default rule, you can modify any of the firewall rule criteria.

See The elements of a firewall rule.

More Information

About client firewall rules

Enabling and disabling firewall rules


Adding a firewall rule

When you add a firewall rule, you must decide what effect you want the rule to have. For example, you may want to allow all traffic from a particular source or block the UDP packets from a Web site.

Firewall rules are automatically enabled when you create them.

To add a firewall rule

  1. In the client, in the sidebar, click Status.

  2. Beside Network Threat Protection, click Options > Configure Firewall Rules.

  3. In the Configure Firewall Rules dialog box, click Add.

  4. On the General tab, type a name for the rule, and then click either Block this traffic or Allow this traffic.

  5. To define the triggers for the rule, click on each tab and configure it as needed.

  6. To define the time period when the rule is active or inactive, on the Scheduling tab, click Enable Scheduling, and then set up a schedule.

  7. When you finish making changes, click OK.

  8. Click OK.

More Information

The elements of a firewall rule

Enabling and disabling firewall rules

Setting up firewall rules


Exporting and importing firewall rules

You can share the rules with another client so that you do not have to recreate them. You can export the rules from another computer and import them into your computer. When you import rules, they are added to the bottom of the firewall rules list. Imported rules do not overwrite existing rules, even if an imported rule is identical to an existing rule.

The exported rules and imported rules are saved in a .sar file.

To export firewall rules

  1. In the client, in the sidebar, click Status.

  2. Beside Network Threat Protection, click Options > Configure Firewall Rules.

  3. In the Configure Firewall Rules dialog box, select the rules you want to export.

  4. Right-click the rules, and then click Export Selected Rules.

  5. In the Export dialog box, type a file name, and then click Save.

  6. Click OK.

To import firewall rules

  1. In the client, in the sidebar, click Status.

  2. Beside Network Threat Protection, click Options > Configure Firewall Rules.

  3. In the Configure Firewall Rules dialog box, right-click the firewall rules list, and then click Import Rule.

  4. In the Import dialog box, locate the .sar file that contains the rules you want to import.

  5. Click Open.

  6. Click OK.

See Adding a firewall rule.


Enabling and disabling firewall rules

You must enable rules so that the firewall can process them. When you add firewall rules, they are automatically enabled.

You can disable a firewall rule if you need to allow specific access to a computer or application.

To enable and disable firewall rules

  1. In the client, in the sidebar, click Status.

  2. Beside Network Threat Protection, click Options > Configure Firewall Rules.

  3. In the Configure Firewall Rules dialog box, in the Rule Name column, check or uncheck the check box beside the rule that you want to enable or disable.

  4. Click OK.

See Adding a firewall rule.


Managing intrusion prevention

You manage intrusion prevention as part of Network Threat Protection.

Table: Managing intrusion prevention

Action

Description

Learn about intrusion prevention

Learn how intrusion prevention detects and blocks network and browser attacks.

See How intrusion prevention works.

Download the latest IPS signatures

By default, the latest signatures are downloaded to the client. However you might want to download the signatures immediately.

See Updating the computer's protection.

Enable or disable network intrusion prevention or browser intrusion prevention

You might want to disable intrusion prevention for troubleshooting purposes or if client computers detect excessive false positives. Typically, you should not disable intrusion prevention.

You can enable or disable the following types of intrusion prevention:

  • Network intrusion prevention

  • Browser intrusion prevention

See Enabling or disabling intrusion prevention.

You can also enable or disable intrusion prevention when you enable or disable Network Threat Protection.

See About enabling and disabling protection.

Configure intrusion prevention notifications

You can configure notifications to appear when Symantec Endpoint Protection detects a network or browser intrusion.

More Information

Configuring intrusion prevention notifications


How intrusion prevention works

Intrusion prevention is part of Network Threat Protection.

Intrusion prevention automatically detects and blocks network attacks and attacks on browsers. Intrusion prevention is the second layer of defense after the firewall to protect client computers. Intrusion prevention is sometimes called the intrusion prevention system (IPS).

Intrusion prevention intercepts data at the network layer. It uses signatures to scan packets or streams of packets. It scans each packet individually by looking for the patterns that correspond to network or browser attacks. Intrusion prevention uses signatures to detect attacks on operating system components and the application layer.

Intrusion prevention provides two types of protection.

Network intrusion prevention

Network intrusion prevention uses signatures to identify attacks on client computers. For known attacks, intrusion prevention automatically discards the packets that match the signatures.

You cannot create custom signatures on the client. But you can import custom signatures that you or your administrator created in Symantec Endpoint Protection Manager.

Browser intrusion prevention

Browser intrusion prevention monitors attacks on Internet Explorer and Firefox. Browser intrusion prevention is not supported on any other browsers.

This type of intrusion prevention uses attack signatures as well as heuristics to identify attacks on browsers.

For some browser attacks, intrusion prevention requires that the client terminate the browser. A notification appears on the client computer.

More Information

Managing intrusion prevention


Enabling or disabling intrusion prevention

Typically when you disable intrusion prevention on your computer, your computer is less secure. However, you might want to disable these settings to prevent false positives or to troubleshoot your computer.

Symantec Endpoint Protection logs intrusion attempts and events in the Security log. Symantec Endpoint Protection might also log intrusion events in the Packet log if your administrator configured it to do so.

You can enable or disable two types of intrusion prevention:

  • Network intrusion prevention

  • Browser intrusion prevention

Note:

You administrator may have configured these options to be unavailable.

See About enabling and disabling protection.

To enable or disable intrusion prevention settings

  1. In the client, in the sidebar, click Change settings.

  2. Beside Network Threat Protection, click Configure Settings.

  3. On the Intrusion Prevention tab, check or uncheck either of the following settings:

    • Enable Network Intrusion Prevention

    • Enable Browser Intrusion Prevention

    For more information on the settings, click Help.

  4. Click OK.

More Information

Managing intrusion prevention

Viewing the logs


Configuring intrusion prevention notifications

You can configure notifications to appear when the client detects a network attack on your computer or when the client blocks an application from accessing your computer. You can set the length of time that these notifications appear and whether the notification occurs with an audio announcement.

You must enable the intrusion prevention system for the intrusion prevention notifications to appear.

Note:

Your administrator may have configured these options to be unavailable.

To configure intrusion prevention notifications

  1. In the client, in the sidebar, click Change settings.

  2. Beside Network Threat Protection, click Configure Settings.

  3. In the Network Threat Protection Settings dialog box, click Notifications.

  4. Check Display Intrusion Prevention notifications.

  5. To hear a beep when the notification appears, check Use sound when notifying users.

  6. Click OK.

More Information

Managing intrusion prevention


Managing Symantec Network Access Control

This section includes the following topics:

  • How Symantec Network Access Control works

  • How the client works with an Enforcer

  • Running a Host Integrity check

  • Remediating your computer

  • Configuring the client for 802.1x authentication

  • Viewing the Symantec Network Access Control logs


How Symantec Network Access Control works

The Symantec Network Access Control client validates and enforces policy compliance for the computers that try to connect to the network. This validation and enforcement process begins before the computer connects to the network and continues throughout the duration of the connection. The Host Integrity policy is the security policy that serves as the basis for all evaluations and actions. Host Integrity is also referred to as "Security Compliance."

Table: How Symantec Network Access Control works describes the process that Network Access Control uses to enforce policy compliance on the client computer.

Table: How Symantec Network Access Control works

Action

Description

The client continuously evaluates its compliance.

You turn on the client computer. The client runs a Host Integrity check that compares the computer's configuration with the Host Integrity policy that was downloaded from the management server.

The Host Integrity check evaluates your computer for compliance with the Host Integrity policy for antivirus software, patches, hot fixes, and other security requirements. For example, the policy may check how recently its virus definitions have been updated, and which were the latest patches applied to the operating system.

A Symantec Enforcer authenticates the client computer and either grants the computer network access or blocks and quarantines non-compliant computers.

If the computer meets all the policy's requirements, the Host Integrity check passes. The Enforcer grants full network access to computers that pass the Host Integrity check.

If the computer does not meet the policy's requirements, the Host Integrity check fails. When a Host Integrity check fails, the client or a Symantec Enforcer blocks or quarantines your computer until you remediate your computer. Quarantined computers have limited or no access to the network.

See How the client works with an Enforcer.

Your administrator may have set up the policy so that a Host Integrity check passes even if a specific requirement fails.

The client may display a notification every time the Host Integrity check passes.

See Types of alerts and notifications.

The client remediates non-compliant computers.

If the client finds that a Host Integrity policy requirement is not met, it installs or requests you to install the required software. After your computer is remediated, it tries to access the network again. If the computer is fully compliant, the network grants the computer network access.

See Remediating your computer.

The client proactively monitors compliance.

The client actively monitors the compliance state for all client computers. If at any time the computer's compliance status changes, so do the network access privileges of the computer.

You can view more information about the Host Integrity check results in the security log.


How the client works with an Enforcer

The client interacts with a Symantec Enforcer. The Enforcer ensures that all the computers that connect to the network that it protects run the client software and have a correct security policy.

See How Symantec Network Access Control works.

An Enforcer must authenticate the user or the client computer before it allows the client computer to access the network. Symantec Network Access Control works with several types of Enforcers to authenticate the client computer. The Symantec Enforcer is the network hardware appliance that verifies Host Integrity results and the client computer's identity before it allows that computer to have access to the network.

The Enforcer checks the following information before it allows a client to access the network:

  • The version of the client software that the computer runs.

  • The client has a unique identifier (UID).

  • The client has been updated with the latest Host Integrity policy.

  • The client computer passed the Host Integrity check.

See Configuring the client for 802.1x authentication.


Running a Host Integrity check

Your administrator configures the frequency that the client uses to run a Host Integrity check. You may need to run a Host Integrity check immediately rather than wait for the next check. For example, a failed Host Integrity check may find that you need to update the virus protection signatures on your computer. The client may allow you to choose whether to download the required software immediately or postpone the download. If you download the software immediately, you must run the Host Integrity check again to verify that you have the correct software. You can either wait until the next scheduled Host Integrity check runs or you can run the check immediately.

To run a Host Integrity check

  1. In the client, in the sidebar, click Status.

  2. Next to Network Access Control, click Options > Check Compliance.

  3. If a message appears that confirms that the Host Integrity check ran, click OK.

    If you had been blocked from network access, you should regain network access when your computer has been updated to comply with the security policy.


Remediating your computer

If the client finds that a Host Integrity policy requirement is not met, it responds in one of the following ways:

  • The client downloads the software update automatically.

  • The client prompts you to download the required software update.

To remediate your computer

  • In the Symantec Endpoint Protection dialog box that appears, do one of the following actions:

    • To see which security requirements that your computer failed, click Details.

    • To immediately install the software, click Restore Now

      You may or may not have the option to cancel the installation after it has started.

    • To postpone the software install, click Remind me later in and select a time interval in the drop-down list.

      The administrator can configure the maximum number of times you can postpone the installation.


Configuring the client for 802.1x authentication

If your corporate network uses a LAN Enforcer for authentication, the client computer must be configured to perform 802.1x authentication. Either you or your administrator can configure the client. Your administrator may or may not have given you permission to configure 802.1x authentication.

The 802.1x authentication process includes the following steps:

  • An unauthenticated client or third-party supplicant sends the user information and compliance information to a managed 802.1x network switch.

  • The network switch relays the information to the LAN Enforcer. The LAN Enforcer sends the user information to the authentication server for authentication. The RADIUS server is the authentication server.

  • If the client fails the user-level authentication or is not in compliance with the Host Integrity policy, the Enforcer may block network access. The Enforcer places the non-compliant client computer in a quarantine network where the computer can be remediated.

  • After the client remediates the computer and brings it into compliance, the 802.1x protocol reauthenticates the computer and grants the computer access to the network.

To work with the LAN Enforcer, the client can use either a third-party supplicant or a built-in supplicant.

Table: 802.1x authentication options describes the types of options you can configure for 802.1x authentication.

Table: 802.1x authentication options

Option

Description

Third-party supplicant

Uses a third-party 802.1x supplicant.

The LAN Enforcer works with a RADIUS server and third-party 802.1x supplicants to perform user authentication. The 802.1x supplicant prompts you for user information. The LAN Enforcer passes that user information to the RADIUS server for user-level authentication. The client sends the client profile and the Host Integrity status to the Enforcer so that the Enforcer authenticates the computer.

Note:

If you want to use the Symantec Network Access Control client with a third-party supplicant, then the Network Threat Protection module of the Symantec Endpoint Protection client must be installed.

Transparent mode

Uses the client to run as an 802.1x supplicant.

You use this method if the administrator does not want to use a RADIUS server to perform user authentication. The LAN Enforcer runs in transparent mode and acts as a pseudo-RADIUS server.

Transparent mode means that the supplicant does not prompt you for user information. In transparent mode, the client acts as the 802.1x supplicant. The client responds to the switch's EAP challenge with the client profile and the Host Integrity status. The switch, in turn, forwards the information to the LAN Enforcer, which acts as a pseudo-RADIUS server. The LAN Enforcer validates the Host Integrity and client profile information from the switch and can allow, block, or dynamically assign a VLAN, as appropriate.

Note:

To use a client as an 802.1x supplicant, you need to uninstall or disable third-party 802.1x supplicants from the client computer.

Built-in supplicant

Uses the client computer's built-in 802.1x supplicant.

The built-in authentication protocols include Smart Card, PEAP, or TLS. After you enable 802.1x authentication, you must specify which authentication protocol to use.

Warning:

Contact your administrator before you configure your client for 802.1x authentication. You must know whether your corporate network uses the RADIUS server as the authentication server. If you configure 802.1x authentication incorrectly, you may break your connection to the network.

To configure the client to use a third-party supplicant

  1. In the client, in the sidebar, click Status.

  2. Beside Network Access Control, click Options > Change Settings > 802.1x Settings.

  3. In the Network Access Control Settings dialog box, click Enable 802.1x authentication.

  4. Click OK.

    You must also set up a firewall rule that allows third-party 802.1x supplicant drivers onto the network.

    See Adding a firewall rule.

    You can configure the client to use the built-in supplicant. You enable the client for both 802.1x authentication and as an 802.1x supplicant.

To configure the client to use either transparent mode or a built-in supplicant

  1. In the client, in the sidebar, click Status.

  2. Beside Network Access Control, click Options > Change Settings > 802.1x Settings.

  3. In the Network Access Control Settings dialog box, click Enable 802.1x authentication.

  4. Click Use client as an 802.1x supplicant.

  5. Do one of the following actions:

    • To select transparent mode, check Use Symantec Transparent Mode.

    • To configure a built-in supplicant, click Allows you to choose the authentication protocol.

      You then need to choose the authentication protocol for your network connection.

  6. Click OK.

To choose an authentication protocol

  1. On the client computer, click Start > Settings > Network Connections and then click Local Area Connection.

    Note:

    These steps are written for computers running Windows XP. Your procedure may vary.

  2. In the Local Area Connection Status dialog box, click Properties.

  3. In the Local Area Connection Properties dialog box, click the Authentication tab.

  4. On the Authentication tab, click the EAP type drop-down list, and select one of the following authentication protocols:

    • Smart Card or other Certificate

    • Protected EAP (PEAP)

    • Symantec NAC Transparent Mode

    Make sure that the Enable IEEE 802.1x authentication for this network check box is checked.

  5. Click OK.

  6. Click Close.


Reauthenticating your computer

If your computer passed the Host Integrity check but the Enforcer blocks your computer, you may need to reauthenticate your computer. Under normal circumstances, you should never need to reauthenticate your computer.

The Enforcer may block the computer when one of the following events have occurred:

  • The client computer failed the user authentication because you typed your user name or your password incorrectly.

  • Your client computer is in the wrong VLAN.

  • The client computer did not obtain a network connection. A broken network connection usually happens because the switch between the client computer and the LAN Enforcer did not authenticate your user name and password.

  • You logged on to a client computer that authenticated a previous user.

  • The client computer failed the compliance check.

You can reauthenticate the computer only if you or your administrator configured the computer with a built-in supplicant.

Note:

Your administrator may not have configured the client to display the Re-authentication command.

To reauthenticate your computer

  1. Right-click the notification area icon.

  2. Click Re-authentication....

  3. In the Re-authenticate dialog box, type your user name and password.

  4. Click OK.


Viewing the Symantec Network Access Control logs

The Symantec Network Access Control client uses the following logs to monitor different aspects of its operation and the results of the Host Integrity check:

Security | Records the results and status of Host Integrity checks.
System | Records all operational changes for the client, such as the connection to the management server and updates to the client security policy.

If you use a managed client, both of the logs may be regularly uploaded to the server. Your administrator can use the content in the logs to analyze the overall security status of the network.

You can export the log data from these logs.

To view Symantec Network Access Control logs

  1. In the client, in the sidebar, click Status.

  2. To view the Security Log, next to Network Access Control, click Options > View Logs.

  3. In the Security Log, select the top log entry.

    In the lower-left corner, the Host Integrity check results appear. If the client was already installed, the predefined firewall requirement passes. If the client was not installed, the predefined firewall requirement fails but is reported as having passed.

  4. To view the System Log, in the Security Log - Symantec Network Access Control Logs dialog box, click View > System Log.

  5. Click File > Exit.

    See About the logs.


CS Help - AV/AS - Client

This section includes the following topics:

  • Virus and Spyware Protection Settings: Auto-Protect

  • Virus and Spyware Protection Settings: Internet Email Auto-Protect

  • Virus and Spyware Protection Settings: Outlook Auto-Protect

  • Virus and Spyware Protection Settings: Notes Auto-Protect

  • Auto-Protect Advanced Options

  • Floppy Settings

  • Network Scanning Settings

  • Selected Extensions

  • Insert Warning

  • Send Email to recipient: Message

  • Send Email to recipient: Email Server

  • Send Email to Others: Others

  • Create a New Scan

  • Create New Scan - What to Scan

  • Create New Scan - When To Scan

  • Create New Scan - Schedule

  • Create New Scan - Select Folders and Files

  • Create New Scan - Scan Options

  • Create New Scan - Scan Name

  • Advanced Scan Options

  • Scan Tuning Options

  • Scan type or Symantec Endpoint Protection Detection Results

  • Outlook Protection Advanced Options

  • Lotus Notes Advanced Options

  • Internet Email Advanced Options

  • Take Action

  • Scan Actions

  • Virus and Spyware Protection Settings: Global Settings

  • Virus and Spyware Protection Settings: Download Insight

  • Download Insight Actions

  • Download Insight Notification Options

  • Insight Lookup Options


CS Help - SONAR - Client

This section includes the following topics:

  • SONAR

  • Suspicious Behavior Detection

  • System Change Detection


CS Help - Exceptions - Client

This section includes the following topics:

  • Exceptions: User-defined Exceptions

  • Add Known Security Risk Exceptions

  • Add Security Risk Extension Exceptions

  • Trusted Web Domain Exception


CS Help - Quarantine - Client

This section includes the following topics:

  • Purge Options: Quarantine Items

  • Purge Options: Backup Items

  • Purge Options: Repair Items


CS Help - FW - Client

This section includes the following topics:

  • Network Activity

  • View Application Settings

  • Configure Application Settings

  • Network Threat Protection Settings: Firewall

  • Network Threat Protection: Notifications

  • Network Threat Protection Settings: Microsoft Windows Networking

  • Configure Firewall Rules

  • Add or Edit Firewall Rule: General

  • Add or Edit Firewall Rule: Hosts

  • Add or Edit Firewall Rule: Ports and Protocols

  • Add or Edit Firewall Rule: Applications

  • Add or Edit Firewall Rule: Scheduling

  • View Firewall Rules


CS Help - IPS - Client

This section includes the following topics:

  • Network Threat Protection Settings: Intrusion Prevention


CS Help - HI - Client

This section includes the following topics:

  • 802.1x Authentication


CS Help - Notifications - Client

This section includes the following topics:

  • Scan Notification Options

  • Scan Notification Options

  • Scan Notification Options

  • Scan Notification Options

  • Notification options


CS Help - Logs - Client

This section includes the following topics:

  • Troubleshooting: Logs

  • Virus and Spyware Protection Logs: Scan Log

  • Virus and Spyware Protection Logs: Risk Log

  • Virus and Spyware Protection Logs: System Log

  • Proactive Threat Protection Logs: Threat Log

  • Proactive Threat Protection Logs: System Log

  • Filter System Log

  • Client Management Logs: System Log

  • Client Management Logs: Security Log

  • Tamper Protection Log

  • Network Threat Protection Settings: Logs

  • Client Management Logs: Control Log

  • Network Threat Protection Logs: Traffic Log

  • Network Threat Protection Logs: Packet Log

  • Back Trace Information

  • Troubleshooting: Debug Logs

  • Symantec Endpoint Protection Debug Log Settings

  • Client Management Debug Log Settings


CS Help - Troubleshooting - Client

This section includes the following topics:

  • Troubleshooting: Management

  • Troubleshooting: Versions

  • Troubleshooting: Windows Account

  • Troubleshooting: Computer

  • Troubleshooting: Connection Status

  • Client Management Settings: General

  • Client Management Settings: Submissions

  • Proxy Server Settings

  • Restart Options

  • Client Management Settings: LiveUpdate Proxy Server Settings: FTP

  • Client Management Settings: LiveUpdate Proxy Server Settings: HTTP


CS Help: Tamper Protection - Client

This section includes the following topics:

  • Client Management Settings: Tamper Protection

  • Tamper Protection: Display message


CS Help - LiveUpdate - 12.1

This section includes the following topics:

  • Client Management Settings: LiveUpdate


CS Help - What is X Help - AV/AS

This section includes the following topics:

  • File Reputation

  • Bloodhound

  • Insight

  • Risk Categories

  • Insight Lookup


CS Help - What is X Help - SONAR

This section includes the following topics:

  • SONAR


Proxy Server Settings

You may want to use a proxy server for external communications. No action is needed if you plan to use the default setting, which is to use your Windows Internet Options settings for a proxy server.

Note:

The proxy that you configure here is used for all external communications except LiveUpdate. If you want to use your default Windows Internet Options settings as the proxy settings for LiveUpdate, no action is needed. If you want to set up a proxy for LiveUpdate that does not use your defaults, you must configure it from the LiveUpdate tab.

Use the proxy server settings to indicate the following information:

  • You do not want to use an HTTPS proxy server.

  • You want to use your default Windows Internet Options settings for a proxy server.

  • You want to customize the HTTPS settings for the proxy server that you want to use.

Table: HTTPS proxy settings

Option | Description
Host proxy | Enter the proxy server address, if needed.
HTTPS Port | Enter the port on the server to use for the HTTPS.
Authentication required | If your proxy server requires a user name and password, you should check this option.
User name | Enter the user name of the account to use for the proxy server.
Password | Enter the password of the account to use for the proxy server.


Restart Options

The following table provides use-cases to help you understand which options to use in various situations.

Note:

Mac client computers always perform a hard restart. The Restart type and Other options settings apply only to Windows clients.

Table: Restart options

Option

Description

Restart Computer

  • Immediately

    Use this option when the client computer must be restarted without delay. Situations that may require an immediate restart include malware remediation, schedule urgency, and proactive threat protection against an imminent threat.

  • At this time

    Use this option when an immediate restart may affect work, or the restart can be safely delayed. Be sure that you understand the implications of delaying a restart when an active threat is present.

  • Randomize start time

    Use this option to avoid conflicts with other scheduled tasks. Use the "Randomization hours" setting to control the behavior of this option.

  • Randomization hours

    Use this control to change the behavior of the "Randomize start time" option. You can alter the default randomization setting within a range of one to eight hours.

Restart type

  • Do not restart

    Not recommended. This option places the responsibility for restarting the computer with the user. Be sure that you understand the implications of using this option, especially if an active threat is present.

  • No prompt

    This option is typically used with the At this time option to suppress the restart prompt during times when the user is away from the computer.

  • Prompt with a countdown up to

    Use this option to display a prompt informing the user that a restart is imminent. This option is especially useful when used with the Immediately and At this time settings.

  • Prompt and allow up to

    Use this option when the client computer must be restarted within a given period of time. This option gives the user a chance to save data and exit programs, and ensures that the computer is restarted.

Restart Message

You can specify a message that lets the user know that the computer must be restarted.

Other options

These options control the behavior of the client computer as it relates to other programs that may be running at the time of the restart.

These options apply only to Windows clients. Mac clients always perform a hard restart.

  • Hard restart

    This option forces the client computer to restart regardless of any other activity occurring on the client computer. In most cases, this option is not used except in extreme circumstances.

  • Restart immediately if the user is not logged in

    If the user is not logged in when the restart request is sent, this option forces an immediate restart and overrides other pending restart actions.


Client Management Settings: LiveUpdate Proxy Server Settings: FTP

You may want to use a proxy server for LiveUpdate. No action is needed if you plan to use your Windows Internet Options settings for a proxy server.

Use the proxy server settings to indicate the following information:

  • You want to disable the use of an FTP proxy server.

  • You want to use your default Windows Internet Options settings for a proxy server.

  • You want to customize the settings for the proxy server that you want to use.

Table: FTP proxy settings

Option | Description
FTP host proxy | Enter the address to use for the proxy server.
Port | Enter the port to use for the proxy server.


Client Management Settings: LiveUpdate Proxy Server Settings: HTTP

You may want to use a proxy server for LiveUpdate. No action is needed if you plan to use your Windows Internet Options settings for a proxy server.

Use the proxy server settings to indicate the following information:

  • You want to disable the use of an HTTP or HTTPS proxy server.

  • You want to use your default Windows Internet Options settings for a proxy server.

  • You want to customize the settings for the proxy server that you want to use.

Table: HTTP or HTTPS proxy settings

Option | Description
Server address | Enter the proxy server address, if needed.
HTTP Port HTTPS Port | Depending on whether you use the HTTP protocol or the HTTPS protocol, enter the port to use in the appropriate text box.
Authentication required | If your proxy server requires a user name and password, you should check this option.
User name | Enter the user name of the account to use for the proxy server.
Password | Enter the password of the account to use for the proxy server.


Create a New Scan

You can create new, custom scans for your computer that can run on demand, at a specified time, or at startup.

Table: Scan startup options

Startup option | Description
On demand | Run the selected scan only on demand.
At specified times | Run the scan only at the specified days and times.
At startup | Run the scan only when the system boots up or when a new user logs on.

Table: What to scan options

Scan option | Description
Active | Scans the memory and other common infection locations on this computer for viruses and security risks.
Full | Scans the entire computer for viruses and security risks. Use this scan to look in the boot sector, in the programs that are loaded into memory, and in all files and folders. A password may be required to scan network drives.
Custom | Scans only the specified files and directories.


Trusted Web Domain Exception

You can exclude a Web domain from Download Insight detections. When you exclude a Web domain, files that you download from the Web domain are always allowed. Any allowed files, however, are scanned by Auto-Protect and any administrator- or user-defined scans.

By default, Symantec Endpoint Protection excludes intranet Web domains. You can change the intranet setting in the Virus and Spyware Protection policy.

You specify a URL when you specify a trusted Web domain exception. HTTPS or FTP URLs are not supported. You must create individual exceptions for files or applications that users might download from an HTTPS or FTP URL


Exceptions: User-defined Exceptions

Use this tab to exclude files, folders, risks, and processes from being scanned. For example, you might want to exclude a file that you know is safe. Excluding a file from being scanned can improve the performance of a scan.

Table: Exception options

Exception

Definition

Security Risk Exceptions

Select from a list of known risks, files, folders, and extensions to exclude from virus and spyware scans. You can also exclude a trusted Web domain.

SONAR Exception

Select a folder to exclude from SONAR. If you want to exclude a particular process, specify an application exception instead.

Application Exception

Select an application to which you want to apply an action. The action overrides the default scan action for the application. The exception applies to all scans.

You can specify any of the following actions:

  • Ignore

    Excludes the application from detection by future scans.

  • Log only

    Adds an entry in the scan logs when the application is detected. This action is the default action.

  • Quarantine

    Quarantines the application.

  • Terminate

    Stops the application but does not remove it from the computer.

  • Remove

    Stops the application and removes it from the computer.


Add Security Risk Extension Exceptions

Use this dialog box to specify the file types that scans should exclude. You can add only one extension at a time. You can include a space in an extension name.

If you want to add multiple extensions, type a single extension name and then add the extension. Repeat this step for each extension that you want to add. Do not type multiple extensions in the Add text box. If you type multiple extensions, the client treats the entry as a single extension name.

Table: Extension exceptions

Option

Description

Add

Adds an extension to the list of extensions that you want to exclude from the scans.

Note:

Do not type the leading dot (.). For example, type exe instead of .exe

Remove

Removes an extension from the list.


Add Known Security Risk Exceptions

Use this dialog box to select the known security risks that scans should exclude. Higher ratings indicate higher risk.

Table: Security risk exception options

Option

Description

Security risk table

The columns in the known security risk table display the following column headings

  • Security Risk

    The names of known security risks. If you want to exclude a security risk, check the check box adjacent to its name.

  • Overall Rating

    The general assessment of the security risk's severity. This assessment is based on the combination of the security risk's privacy rating, its performance rating, its stealth rating, and its removal rating.

  • Privacy Impact Rating

    The degree to which the security risk threatens your private information.

  • Performance Impact Rating

    The degree to which the security risk affects your computer's performance.

  • Stealth Rating

    The degree to which the security risk tries to hide to prevent detection and removal.

  • Removal Rating

    The degree to which the security risk makes itself easy to remove.

  • Dependent Program

    Whether or not programs that rely on the security risk to function properly.

Log when the security risk is detected

When the scan detects a known security risk, the scan records the detection in the Risk Log. The scan logs the detection even if the risk is excluded from the scan.


Virus and Spyware Protection Logs: System Log

The System Log contains daily records of the virus and security risk activities that are related to protection on your computer. These records, called events, include configuration changes, errors, and virus and security risk definitions file information, and are displayed with additional information. Actions that are inappropriate or that your administrator does not allow are unavailable.

By using the information in the System Log, you can track the trends that are related to the viruses and security risks on your computer. If several people use the same computer, you might be able to identify who introduces risks and help that person to use better precautions.

You can perform the following tasks in the System Log:

Table: System Log options

Option | Description
Export | Saves the data as a comma-separated value (.csv) file.
Filter | Lets you filter the display so that you see only one or a few types of events. You can check the types of events that you want to display in your view of the log. All types of events continue to be written to the System log.

You can also right-click an entry to view its properties.

Table: System Log columns

Column name | Description
Event | The event that occurred.
Computer | The computer that initiated or was responsible for the event.
User | The user that was logged onto the responsible computer.
Logged by | The entity that was responsible for the logging of the event.
Description | A description of the event that occurred.
Date and Time | The date and time that the event was logged.


Virus and Spyware Protection Logs: Risk Log

The Risk Log displays a list of the viruses and security risks that have infected your computer and additional information about each infection. A status icon in the first column shows whether the risk is still present on the computer or has been successfully removed. If the risk is still present, a red x appears. If a risk was removed, a green check appears.

You can perform the following tasks in the Risk Log:

Table: Risk Log options

Option | Description
Export | Lets you save the log data to a comma-delimited text file that can be imported into other applications, such as a spreadsheet.
Clean | Lets you clean up the side effects of a risk that was found during a scan. This action effectively removes the risk from your computer.
Delete | Lets you delete a risk from your computer, if possible.
Undo | Lets you undo an action, if possible.
Quarantine | Lets you quarantine a risk that is found, if possible.

You can also right-click an entry to view its details.

Note:

Risk details for a Download Insight detection show only the first portal application that attempted the download.

Table: Risk Log columns

Column name | Description
Filename | The name of the file involved, if applicable.
Risk | The name of the risk that was found.
Action | The action that was taken on the risk.
Risk Type | The type of risk that was found, such as adware, spyware, or dialer.
Original Location | The location where the risk was found, if applicable.
Computer | The computer that logged the risk detection. For example, if you work on a local computer and Auto-Protect finds a virus in a remote file, Computer is your local computer.
User | The user that was logged onto the computer when the risk was found.
Status | The current infection status of the file. For example, the status can be infected, cleaned, or deleted. A file that is quarantined usually has a status of infected, but the file is unable to harm your computer.
Current Location | The location of the risk now. For example, the location can be In Quarantine.
Primary Action | The first action that is configured to take for this risk or category of risks.
Secondary Action | The second action that is configured to take for this risk or category of risks. The second configured action is taken if the first action is unsuccessful.
Logged By | The type of scan that was responsible for logging the event, such as Auto-Protect or Startup.
Action Description | A description of the action that was taken on the risk.
Date and Time | The date and time that the risk was logged.


Virus and Spyware Protection Logs: Scan Log

The Scan log uses data from the System Log to provide a complete picture of the scans that have been performed on your computer. The information shows how frequently your computer has been scanned and which types of scans are run on your computer. Actions that are inappropriate or that your administrator does not allow are unavailable.

You can use this log to see if a scan was stopped or interrupted in some way.

You can use this information to find infection trends, which you can respond to with better detection tactics. For example, your job might involve a lot of time on the Internet on Fridays, and you might notice that infections occur most often on Monday morning. You can then schedule a full scan to run every Monday at 8:00 A.M.

You can perform the following tasks in the Scan log:

  • View a list of the scans that have occurred on your computer over time. Scans are displayed with additional relevant information about the scans.

  • Export the data in the log to a comma-delimited text file, for use in other applications.

  • Right-click an entry and view its properties.

Table: Scan Log columns

Column name | Description
Started On | The date and time that the scan started.
Completed | The date and time that the scan ended.
Computer | The computer from which the scan was run. For example, if you scan a network drive from your local computer, this field contains the name of your local computer. It is not the computer on which the drive is physically located.
Status | The current status of the scan, such as Scan Complete, Scanning, or Scan Aborted.
Total Files | The total number of files that were scanned.
Infected | The number of infections or anomalies that were found.
Logged By | The type of scan that was run. For example, if this scan is a Startup scan, this column says Startup.


Tamper Protection Log

You can use this log to view information about Tamper Protection events. You can view this log to see details about Tamper Protection detection when a tamper attempt occurs.

You can perform the following tasks in the Tamper Protection Log:

  • View the list of the Tamper Protection-related events.

  • Export the data in the log to a comma-delimited text file, for use in other applications.

  • Right-click an entry and view its properties.

Actions that are inappropriate or that your administrator does not allow are unavailable.

Table: Tamper Protection log columns

Option | Description
Computer | The computer on which the tamper attempt occurred.
User | The name of the user that was logged onto the computer at the time of the tamper attempt.
Action Taken | The action that Tamper Protection took.
Object Type | The type of object involved, if appropriate.
Event | The event that took place.
Actor | The identity of the entity that attacked, if applicable.
Target | The entity that was the target of the tamper attempt, if applicable.
Target Process | The process that was the target of the tamper attempt, if applicable.
Date and Time | The date and time that the tamper attempt was logged.


Notification options

Use this window to select notification and remediation options.

Table: Notification options

Option | Description
Detection options | Displays a customized message on an infected computer.
Remediation options | Automatically terminates processes or stops services when a virus is found.


Purge Options: Backup Items

Use this dialog box to schedule the Symantec Endpoint Protection client to automatically purge backed up files.

Table: Backup purge options

Option | Description
Length of time stored exceeds | Enable this check box to delete backed up items after the specified amount of time. You can adjust the number of days, months, or years to wait before the client deletes an item.
Total folder size exceeds | Enable this check box to automatically purge backed up items to keep the directory within its defined size limit. When the directory exceeds its limit, the client deletes the oldest files in the directory until the size returns to its limit.


Purge Options: Quarantine Items

Use this dialog box to schedule the Symantec Endpoint Protection client to automatically purge quarantined files.

Table: Quarantine purge options

Option | Description
Length of time stored exceeds | Enable this check box to delete quarantined items after the specified amount of time. You can adjust the number of days, months, or years to wait before the client deletes an item.
Total folder size exceeds | Enable this check box to automatically purge quarantined items to keep the directory within its defined size limit. When the directory exceeds its limit, the client deletes the oldest files in the directory until the size returns to its limit.


Purge Options: Repair Items

Use this dialog box to schedule the Symantec Endpoint Protection client to automatically purge repaired files.

Table: Repair purge options

Option | Description
Length of time stored exceeds | Enable this check box to delete repaired items after the specified amount of time. You can adjust the number of days, months, or years to wait before the client deletes an item.
Total folder size exceeds | Enable this check box to automatically purge repaired items to keep the directory within its defined size limit. When the directory exceeds its limit, the client deletes the oldest files in the directory until the size returns to its limit.


Create New Scan - Select Folders and Files

Use this window to define one or more targets for your scan. You can define an entire computer, a local disk, one or more directories, or individual files.


Create New Scan - Scan Options

Use this dialog box to select scan options.

Table: Scan options

Option | Description
File Types | Use to select whether you want to scan all file types or only selected file extensions.
Actions | Use to configure actions for security risks when they are encountered.
Notifications | Use to configure notification message options and remediation options for an infected computer.
Advanced | Use to set advanced scan options such as scanning compressed files, backup options, dialog options, and storage migration options.
Scan Enhancements | Additional locations to search for viruses and security risks before scanning selected files and folders.
Exceptions | Use to add, edit, or delete user-defined exceptions.


Insight Lookup Options

You can enable or disable Insight Lookup as well as set the malicious file sensitivity for Insight Lookup. You might want lower the sensitivity level to decrease false positive detections. Increase the sensitivity level for more protection; however, you might increase the rate of false positives.

Table: Insight Lookup options

Option

Description

Enable Insight Lookup

You can enable or disable Insight Lookup for this scheduled scan.

When you enable this option, Insight Lookup detects the files that might not typically be detected as risks. Insight Lookup sends the files to Symantec for evaluation. If Symantec determines that the files are risks, the client computer then handles the files as risks.

Symantec uses the latest virus definitions as well as reputation data to evaluate the files. Reputation data is the information that Symantec collects about the potential maliciousness of a file. You can use the slider to set how sensitive Insight Lookup is to file reputation. A lower sensitivity level might reduce false positive detections.

Specify the protection level

Sets the sensitivity for Insight Lookup detection of malicious files based on their reputation. The protection level setting is similar to the sensitivity level for Download Insight detections.

When you set the sensitivity level higher, Insight Lookup detects more files as malicious and considers fewer files as unproven. At higher levels, Insight Lookup returns more false positive detections. Only the files with the best reputations are allowed.

At lower sensitivity levels, Insight Lookup detects fewer files as malicious and returns fewer false positive detections. However, more files are considered unproven.

Specify actions for reputation detections

Sets the action that Insight Lookup takes when it detects malicious files.

You can specify the first action if the second action fails.


Create New Scan - Scan Name

Use this window to enable, name, and describe the scan.

Table: General scan information

Field name

Description

Scan name

Type the name of the scan in this field.

Scan description

Type a description of the scan in this field.

Enable the scan

Check this check box to allow the scan to run at its appointed time.

Note:

This check box is not available for On-demand scans.


Create New Scan - Schedule

You can set scan times, randomize scan start times, and specify the retry interval if scans are missed.

Table: Schedule options

Option

Description

Enable

Enables or disables the scan schedule

Scanning Schedule

Specifies the frequency of the scan.

  • Daily lets you select the time the scan runs each day.

  • Weekly lets you select the time and day the scan runs each week.

  • Monthly lets you select the time and day the scan runs each month.

You can also enable or disable Perform this scan even when no users are logged on.

The frequency that you select (Daily, Weekly, Monthly) affects the scan duration and missed scheduled scan options.

Scan Duration

Specifies how long a scan should run. You can specify any of the following options:

  • Scan until finished

    This setting is recommended in most cases to optimize scan performance.

  • Scan for up to n hours

    This setting lets you control scan times in environments where resources may be limited. If a scan does not finished within the time period that is specified, the scan resumes at the next scheduled time. For randomized scans, the scan resumes at a randomized time during the specified interval.

    For example, if you configure the scan to run at 8:00pm and set the duration for up to 4 hours, a non-randomized scan starts or resumes at 8:00pm. For randomized scans, the scan starts or resumes at a randomly selected minute between 8:00pm and midnight.

    If you set the frequency to Daily, the maximum scan duration is 23 hours. If you set the frequency to Weekly, the maximum scan duration is 167 hours. If you set the frequency to Monthly, the maximum scan duration is 671 hours.

If you choose to limit the scan time, you can also specify Randomize scan start time within this period. Use this setting to scan virtual machines. Randomizing scans minimizes the chance of multiple scans starting at the same time and requiring high resource use on the host computer.

Missed Scheduled Scans

If the computer does not start a scan when it is supposed to, specifies when to restart a scan.

Retry the scan within specifies the number of hours or days to wait before the scan runs again. (Windows only). A scan may be missed because the computer was off or unable to start the scan for some other reason.

If you set the frequency to Daily, the maximum retry interval is 8 hours. If you set the frequency to Weekly, the maximum retry interval is 3 days. If you set the frequency to Monthly, the maximum retry interval is 11 days.


Create New Scan - What to Scan

Define the type of scan you want to run.

Table: Scan types

Scan type

Definition

Active Scan

Scans the memory and other common infection locations on the computer for viruses and security risks.

You should run an active scan every day.

Full Scan

Scans the entire computer for viruses and security risks, such as adware and spyware. Use this scan to look in the boot sector, in the programs that are loaded into memory, and in all files and folders. A password may be required to scan network drives.

You might want to run a full scan once a week or once a month. Full scans might impact your computer performance.

Custom Scan

Scan only the files and directories that you specify.


Create New Scan - When To Scan

The first thing you need to choose when you create a new scan is one of the following scan startup options.

Table: Scan startup options

Option | Definition
At specified times | Run this scan periodically on specified days and times.
At startup | Run this scan when the system boots up or when a new user logs in. Your administrator may have configured this option to be unavailable.
On demand | Do not automatically run this scan. Run this scan only when instructed.


Scan type or Symantec Endpoint Protection Detection Results

When the client does not detect any viruses in scanned files, the progress bar shows that the scan is complete.

If the client detects a virus during the scan, then the infection details appear in the results list.

Table: Infection details

Option

Description

Icon

The icon that indicates whether or not a file or risk is still a threat. A green check mark indicates that a risk or file is no longer a threat. A red "x" indicates that a risk or file is still a threat.

Filename

The name of the infected file.

Note:

The language of the operating system on which you run the client might not be able to interpret some characters in virus names. If the operating system cannot interpret the characters, the characters appear as question marks in notifications. For example, some unicode virus names might contain double-byte characters. On those computers that run the client on an English operating system, these characters appear as question marks.

Risk

The name of the detected risk.

You can click on the risk name to display more information about the risk on the Symantec Security response Web site.

Exclude

For certain risks, a check box appears in this column. You can click this check box if you want the client to ignore this risk during all future scans.

Note:

Check this option only if you know that the item is not a virus or a security risk or that it is otherwise safe. Fox example, the detected risk might be an adware application that you need to use another application.

Action

The action that the client performed on the risk, if any.

Risk Type

The category of the detected risk.

Original Location

The path to the directory where the client detected the risk.

Computer

The name of the computer where the client detected the risk.

User

The name of the active user when the client detected the risk.

Status

The state of the detected file.

Current Location

The path to the directory of the infected file if it remains on the computer.

Primary Action

The configured First Action for the detected risk.

Secondary Action

The configured Second Action for the detected risk.

Logged By

The type of scan that detected the risk.

Action Description

An explanation of the action that the client performed on the detected risk, if any.

Date and Time

Displays the date and time that the client detected the risk.

When a virus is detected, the client tries to complete the action that you designated. If the action fails, the client performs the second action that was designated for that type of virus and scan.

You can right-click on the name of a detected risk to display a list of post-scan actions. Not all actions apply to every type of risk.

Table: Actions

Option

Description

Exclude or Unexclude

Ensures that the virus or risk is ignored by future scans. Unexclude ensures that the client scans the file.

Clean

Removes the virus from the infected file.

If the client successfully cleans a virus from a file, you don't need to take any other action. Your computer is free of viruses and is no longer susceptible to the spread of that virus into other areas of your computer.

When the client cleans a file, it removes the virus from the infected file, boot sector, or partition tables. This removal process eliminates the ability of the virus to spread.

In some instances the cleaned file might not be usable. This unusable state is a result of the virus infection and not a result of the clean action.

Some infected files cannot be cleaned.

Delete Permanently

Deletes the infected file from your computer's hard drive.

Use this action only if you can replace the file with a backup copy that is free of viruses or security risks. After the file is permanently deleted, it cannot be recovered from the Recycle Bin.

Note:

Use this action with caution when you configure actions for security risks, because deleting security risks might cause applications to lose functionality.

Undo action taken

Reverts the action that the client performed on the detected risk.

This reversal is not always possible. For example, the client cannot restore a file that it deleted.

Move to Quarantine

Does one of the following:

  • For viruses, moves the infected file from its original location to the Quarantine. Infected files within the Quarantine cannot spread viruses.

  • For security risks, moves the infected files from their original location to the Quarantine and tries to remove or repair any side effects.

    Quarantine contains a record of all actions that were performed. This record lets you return the computer to the state that existed before the client removed the risk.

Properties

Displays more details about the detected risk.


Virus and Spyware Protection Settings: Download Insight

You can enable or disable Download Insight and change how sensitive Download Insight is to potentially malicious files. Use these settings to control the rate of false positive detections.

Table: Download Insight settings

Option

Description

Enable Download Insight to detect potential risks based on file reputation

Enables or disables Download Insight. Download Insight detects a malicious file or potentially malicious file when you try to download the file from a browser or a text messaging client.

Note:

Download Insight requires Auto-Protect. If Auto-Protect is disabled and Download Insight is enabled, Download Insight cannot function. On the status page, the status details indicate the Download Insight malfunction.

Specify download protection level

Sets the sensitivity for Download Insight detection of malicious files. You might want to adjust the slider to change the overall number of detections as well as the number of false positive detections.

Note:

If you or your administrator installed basic Virus and Spyware Protection only, Download Insight always uses sensitivity level 1. You cannot change the setting.

Download Insight determines that a downloaded file might be a risk based on evidence about the file's reputation. Symantec collects information about files to determine their reputation and makes the information available to Download Insight. The slider indicates a range of reputations, from most likely to be malicious to least likely to be malicious.

You can adjust the slider to change the reputation level at which files are considered malicious or unproven.

When you set the sensitivity level higher, Download Insight detects more files as malicious and considers fewer files as unproven. At higher levels, Download Insight returns more false positive detections. Only the files with the best reputations are allowed.

At lower sensitivity levels, Download Insight detects fewer files as malicious and returns fewer false positive detections. However, more files are considered unproven.

Note:

Move the slider to view a description of each level. Each description provides information about how the level allows or blocks files and its potential false positive rate.

Click Actions to set the action that Download Insight takes on malicious files or unproven files.

Also detect files as malicious based on their use in the Symantec Community

Sets the additional requirements for the downloaded files that have the reputations that are higher than the configured sensitivity setting. The files are considered unproven but are detected as malicious if they meet the additional requirements.

The additional requirements enable Download Insight to consider file usage in the Symantec Community. Files that are used by fewer users might be potentially more harmful. Files that have recently appeared in the Symantec Community also might be more potentially harmful.

The following options are available:

  • Files with fewer than

    Specifies the maximum number of users who use the file. The client detects any downloaded files that are used by fewer than the specified number of users.

  • Files known by users for less than

    Specifies the maximum number of days that the file has been known in the Symantec community. The client detects any downloaded files that are known by Symantec for less than the number of specified days.

Automatically trust any file downloaded from an intranet website

By default, Download Insight does not examine any files that you download from a trusted Internet or intranet site. You configure trusted sites and trusted local intranet sites on the Windows Control Panel > Internet Options > Security tab.

When this option is enabled, Symantec Endpoint Protection allows any file that a user downloads from one of the trusted sites. After the file is downloaded, other protection features can detect and take action on the file if necessary.

You can also create exceptions for specific Web domains.

Download Insight recognizes explicitly configured trusted sites only. Wildcards are allowed, but non-routable IP address ranges are not supported. For example, Download Insight does not recognize 10.*.*.* as a trusted site. Download Insight also does not support the sites that the Internet Options > Security > Automatically detect intranet network option discovers. FTP sites are also not supported.

Note:

Insight Lookup also uses this option to trust files. Even if you disable Download Insight and this option appears grayed out, Insight Lookup uses this option if it is enabled.


Download Insight Actions

You can specify how Download Insight responds to malicious file detections and unproven file detections. You can change what level of file reputation Download Insight uses to determine if a file is malicious or unproven by adjusting the sensitivity slider.

Table: Download Insight actions

Option

Description

Malicious files

Configures the actions for the detections that Download Insight makes based on the protection level slider setting. You can configure a first action to take and a second action to take if the first action fails.

The options available for If first action fails are based on the current selection for First action.

You can specify the following actions:

  • Quarantine risk: Tries to move the file to the Quarantine on the client computer as soon as it is detected. If notifications are enabled, you can choose to allow the file. If you choose to allow the file, you can run the file from your temporary Internet folder. After a file is moved to the Quarantine, you cannot run the file.

  • Delete risk: Tries to delete the file. The file is permanently deleted and cannot be recovered from the recycle bin.

    If Download Insight cannot delete the file, detailed information about the action appears in the System log.

  • Leave alone (log only): Allows access to the file and logs the event.

Unproven files

Configures an action for Download Insight to take when it detects an unproven file.

The actions for unproven files are the same as for malicious files (Quarantine risk, Delete risk, Leave alone (log only), with the following two additional possible actions:

  • Prompt

    Prompts the user to allow or block the downloaded file.

  • Ignore

    Allows the file on the client computer.


Download Insight Notification Options

You can configure notification options for Download Protection. The notification includes information about the security risk detected.

Table: Download Insight notification options

Option

Description

Display a notification message on the infected computer

Enables or disables the display of a notification message on an infected computer when Download Protection makes a detection.

When this option is enabled, you can modify the default message that appears when you allow a file that Download Insight detects.


Virus and Spyware Protection Settings: Outlook Auto-Protect

Auto-Protect can scan attachments to Microsoft Outlook email.

For managed clients, your administrator may lock some of these settings.

Table: Auto-Protect options for Microsoft Outlook

Option

Description

Enable Microsoft Outlook Auto-Protect

Enables or disables Auto-Protect for attachments to Microsoft Outlook email.

File Types

Specifies whether Auto-Protect should scan all file types or selected file extensions.

File types includes the following options:

  • All types: Scans all files on the computer, regardless of type.

  • Selected: Select this option to scan only files with certain extensions.

  • Extensions: Specifies that only certain file extensions should be included in the scan. You can add entries for programs and the documents that use unlisted extensions. Only the file extensions that you specify are scanned. Files with unlisted extensions are not scanned.

Actions

Configures the actions for Auto-Protect to take when it detects macro viruses, non-macro viruses, and security risks.

Notifications

Specifies whether or not Auto-Protect should display a message when it detects a virus or security risk. Also specifies what the contents of the message should be.

Advanced

Sets the advanced scan options such as compression and connection settings.

Email Messages

You can configure the following types of email messages:

  • Insert warning into the email message: Adds an email warning to infected messages. You can change the default text.

  • Send email to the sender: Notifies the senders of infected messages. You can change the default text of the message.

  • Send email to others: Notifies any designated email addresses of infected messages. You can change the default text of the message.


Virus and Spyware Protection Settings: Global Settings

You can configure global virus and spyware options for the client.

Table: Global settings

Option

Description

Scan Options

You can configure the following options to apply to both manual scans and Auto-Protect:

  • Enable Insight for

    The Insight feature allows scans to skip digitally signed files and trusted files. You can configure the level of trust. Symantec and Community Trusted is the higher level of trust. Symantec Trusted is the lower level.

    You might want to keep this option enabled to improve scan performance.

  • Enable Bloodhound™ heuristic virus detection

    Bloodhound isolates and locates logical regions of a file to detect a high percentage of unknown viruses. In addition, the client detects unknown viruses by monitoring activity on your computer for the behaviors that viruses typically perform. When a suspicious activity is detected, the client prevents the action from continuing.

    You can set the Bloodhound sensitivity level.

    • Automatic is the default and uses advanced heuristics to make detections. It also uses some experimental heuristics if detection submissions are enabled.

    • Aggressive increases the sensitivity of the automatic Bloodhound Detection. If you select this level, you are likely to see more false positive detections. This option is recommended only for advanced users.

  • Exceptions

    You can view any exceptions that you create for scans by clicking View List.

Log Retention

Specifies the time period after which items are deleted from the client logs

This option does not affect any log events that are sent to the management console. Use this parameter to reduce the size of the logs on your computer.

Internet Browser Protection

Specifies a URL to use as the home page when a security risk hijacks your computer's home page

The client uses this URL when it repairs the risk.


Virus and Spyware Protection Settings: Internet Email Auto-Protect

Auto-Protect can scan attachments to Internet email.

For managed clients, your administrator may lock some of these settings.

Note:

Use exceptions if you want to exclude files or directories from scans.

Table: Auto-Protect options for Internet email

Option

Description

Enable Internet Email Auto-Protect

Enables or disables Auto-Protect for Internet email.

File types

Specifies whether Auto-Protect should scan all file types or selected file extensions.

File types includes the following options:

  • All types: Scans all files on the computer, regardless of type.

  • Selected: Select this option to scan only files with certain extensions.

  • Extensions: Specifies that only certain file extensions should be included in the scan. You can add entries for programs and the documents that use unlisted extensions. Only the file extensions that you specify are scanned. Files with unlisted extensions are not scanned.

Actions

Configures the actions for Auto-Protect to take when it detects macro viruses, non-macro viruses, and security risks.

Notifications

Specifies whether or not Auto-Protect should display a message when it detects a virus or security risk. Also specifies what the contents of the message should be.

Advanced

Sets the advanced scan options, such as the compression settings and connection settings.

Email Messages

You can configure the following types of email messages:

  • Insert warning into the email message: Adds a warning to infected messages. You can change the default text.

  • Send email to sender: Notifies the senders of infected messages in Internet email applications. You can change the default text of the message.

  • Send email to others: Notifies any designated email addresses of infected messages in Internet email applications. You can change the default text of the message.


Virus and Spyware Protection Settings: Notes Auto-Protect

Auto-Protect can scan attachments to Lotus Notes email.

For managed clients, your administrator may lock some of these settings.

Note:

Use exceptions if you want to exclude files or directories from scans.

Table: Auto-Protect options for Lotus Notes

Option

Description

Enable Lotus Notes Auto-Protect

Enables or disables Auto-Protect for Lotus Notes

This option is not available if Lotus Notes is not installed on the client computer.

File types

Specifies whether Auto-Protect should scan all file types or selected file extensions

File types include the following options:

  • All types: Scans all files, regardless of type.

  • Selected: Select this option to scan only files with certain extensions. You can click Extensions to add entries for programs and the documents that use unlisted extensions. You can also reset the extensions list to its default value.

Extensions

Specifies that only certain file extensions should be included in the scan

You can add or remove file extensions to scan. Only the file extensions that you specify are scanned. Files with unlisted extensions are not scanned.

Note:

If you want to exclude files or directories from scans, create an exception. The exception applies to all the virus and spyware scans that you run.

Advanced

Sets the advanced scan options such as compression and connection settings

Actions

Configures the actions for Auto-Protect to take when it detects macro viruses, non-macro viruses, and security risks

Notifications

Specifies whether or not Auto-Protect should display a message when it detects a virus or security risk

You can also specify what should be the contents of the message.

Email messages

You can configure the following types of email messages:

  • Insert warning into email message: Adds a warning to infected messages. You can change the default text.

  • Send email to sender: Notifies the senders of infected messages. You can change the default text of the message.

  • Send email to specified recipients: Notifies any designated email addresses of infected messages. You can change the default text of the message.


Virus and Spyware Protection Settings: Auto-Protect

Auto-Protect provides real-time protection for files on your computer. Whenever you access, copy, save, move, open, or close a file, Auto-Protect scans it to ensure that a virus or security risk is not present. Auto-Protect is a powerful way to guard your data against infection.

For managed clients, your administrator may lock some of these settings.

Note:

Use exceptions if you want to exclude files or folders from scans.

Table: Auto-Protect file system options

Option

Description

Enable File System Auto-Protect

You can enable or disable Auto-Protect for file protection.

If you disable Auto-Protect, you also change the following protections:

  • Download Insight does not function even if Download Insight is enabled.

  • SONAR does not detect heuristic threats and appears to malfunction. SONAR detection of system changes or host file changes, however, continues to function.

File Types

Specifies whether Auto-Protect should scan all file types or selected file extensions.

File types includes the following options:

  • All types: Scans all files on the computer, regardless of type.

  • Selected: Select this option to scan only files with certain extensions.

  • Extensions: Specifies that only certain file extensions should be included in the scan. You can add entries for programs and the documents that use unlisted extensions. Only the file extensions that you specify are scanned. Files with unlisted extensions are not scanned.

    If you want to exclude files or folders from scans, create an exception. The exception applies to all the scans that you run.

  • Determine file types by examining file contents: Scans a specific, configurable group of the file extensions that contain executable code, and all .exe and .doc files. The client reads each file's header to determine its file type. It scans .exe and .doc files even if a virus changes their file extensions.

Actions

Configures the actions for Auto-Protect to take when it detects macro viruses, non-macro viruses, and security risks.

Notifications

Specifies whether or not Auto-Protect should display a message when it detects a virus or security risk. Also specifies what the contents of the message should be.

Advanced

Sets the advanced scan options such as startup and backup options, and file cache and Risk Tracer options.

Options

Options include the following:

  • Scan for security risks

    You can disable this option to stop Auto-Protect from scanning security risks.

  • Block security risks from being installed

    If Auto-Protect determines that it is not harmful to a computer to block a security risk, it blocks the risk.

  • Scan files on remote computers

    Enables or disables Auto-Protect scans for files on remote computers. By default Auto-Protect scans files on remote computers only when files are executed.

  • Only when files are executed

    Disable this option to run Auto-Protect on all files on remote computers. If you disable this option, however, you might affect your client computers' performance.


Client Management Settings: Submissions

You can use the Submission page to enable or disable the submission of information about detected threats to Symantec Security Response. You can also select the types of submissions you want to send.

Using the information that you submit, Symantec can customize its ability to detect threats, limit false positives, and provide enhanced detection effectiveness for your particular environment. Any data you submit improves Symantec's ability to respond to threats and customize protection for your computer. Symantec recommends that you submit this information.

Table: Submissions options

Option

Description

Let this computer automatically forward selected anonymous security information to Symantec

Symantec Endpoint Protection submits information about the threats that are detected on your computer to Symantec Security Response. Symantec and the Global Intelligence Network use this information to address new threats.

Symantec recommends that you enable this option.

Select additional types of information to submit

You can choose to submit any of the following data.

  • File reputation

    Information about detected threats that is based on queries to the reputation database. The collected information forms a database that is called Symantec Insight. Symantec uses to protect your computers from new and changing threats.

    See How Symantec Endpoint Protection uses reputation data to make decisions about files.

  • Antivirus detections

    Information about virus and spyware scan detections.

  • Antivirus advanced heuristic detections

    Information about the potential threats that are detected by Bloodhound and other virus and spyware scan heuristics.

    These detections are silent detections that do not appear in the Risk log. Information about these detections is used for statistical analysis.

  • SONAR detections

    Information about the threats that SONAR detects, such as high or low risk detections, system change events, and suspicious behavior from trusted applications.

  • SONAR heuristics

    SONAR heuristic detections are silent detections that do not appear in the Risk log. This information is used for statistical analysis.

    See About the logs.

Allow Insight lookups for threat detection

Lets Symantec Endpoint Protection use Symantec's reputation database to make decisions about threats. The reputation database is called Symantec Insight. Queries to the database are called Insight lookups.

Download Insight, Insight Lookup, and SONAR use Insight lookups for threat detection. Symantec recommends that you allow Insight lookups if possible. Disabling Insight lookups disables Download Insight and may impair the functionality of SONAR and Insight Lookup.

However, you can disable this option if you do not want to allow Symantec to query Symantec Insight. For example, your company may require you to turn off external communications with the network so that data never leaves your computer.

This option is enabled by default.

See How Symantec Endpoint Protection uses reputation data to make decisions about files.

More Information

About SONAR


Client Management Settings: Tamper Protection

Tamper Protection provides real-time protection for the Symantec applications that run on servers and clients. It protects Symantec processes and internal objects from the attacks that non-Symantec processes such as worms, Trojan horses, viruses, and security risks may make. Tamper Protection can block or log the attempts to modify the Symantec processes or the internal software objects that synchronize Symantec threads and processes.

You can configure a message to appear on your computer when Tamper Protection detects a tamper attempt.

Note:

If you enable the notifications for Tamper Protection, affected computers may receive notifications about Windows processes as well as Symantec processes.

Table: Tamper Protection options

Option

Description

Protect Symantec security software from being tampered with or shut down

Enables or disables Tamper Protection.

Action to take if an application attempts to tamper with or shut down Symantec security software

Specifies the actions to take if Tamper Protection detects a problem.

Select from the following actions:

  • Block it and log the event

    This action blocks the unauthorized activity and logs the occurrence.

  • Log the event only

    This action logs the occurrence of unauthorized activity but lets the activity proceed.

Display a notification message when tampering is detected

Specifies that you want to see a message when Tamper Protection detects unauthorized activity.

You can use the default message for a notification, or you can type in additional text and variable fields. When the message appears, the values that identify characteristics of the attack automatically populate the variable fields.

To configure a Tamper Protection message, you can use the default message or you can delete the text and type in your own text. You can also type the predefined variable fields into the message. When the message appears, the values that identify characteristics of the attack automatically populate the variable fields.

Note:

You must type the variables exactly as they appear.

Table: Tamper Protection message variable names and descriptions

Variable | Description
[ActionTaken] | The action that Tamper Protection performed to respond to the attack.
[ActorProcessID] | The ID number of the process that attacked a Symantec application.
[ActorProcessName] | The name of the process that attacked a Symantec application.
[Computer] | The name of the computer that was attacked.
[DateFound] | The date on which the attack occurred.
[EntityType] | The type of target that the process attacked.
[Filename] | The name of the file that attacked protected processes.
[Location] | The area of the computer hardware or software that Tamper Protection protected from tampering. In Tamper Protection messages, this area is Symantec applications.
[PathAndFilename] | The complete path and name of the file that attacked protected processes.
[SystemEvent] | The type of tamper attempt that occurred.
[TargetPathname] | The location of the target that the process attacked.
[TargetProcessID] | The process ID of the target that the process attacked.
[TargetTerminal SessionID] | The ID of the terminal session during which the event occurred.
[User] | The name of the logged on user when the attack occurred.


Tamper Protection: Display message

You can configure Tamper Protection to display a message on your computer when a tamper attempt is detected. You can use the default message or you can delete the text and type in your own text. You can also type the predefined variable fields into the message.When the message appears, the values that identify characteristics of the attack automatically populate the variable fields.

Note:

You must type the variables exactly as they appear.

Table: Tamper Protection message variable names and descriptions

Variable | Description
[ActionTaken] | The action that Tamper Protection performed to respond to the attack.
[ActorProcessID] | The ID number of the process that attacked a Symantec application.
[ActorProcessName] | The name of the process that attacked a Symantec application.
[Computer] | The name of the computer that was attacked.
[DateFound] | The date on which the attack occurred.
[EntityType] | The type of target that the process attacked.
[Filename] | The name of the file that attacked protected processes.
[Location] | The area of the computer hardware or software that was protected from tampering. In Tamper Protection messages, this area is Symantec applications.
[PathAndFilename] | The complete path and name of the file that attacked protected processes.
[SystemEvent] | The type of tamper attempt that occurred.
[TargetPathname] | The location of the target that the process attacked.
[TargetProcess ID] | The process ID of the target that the process attacked.
[TargetTerminalSessionID] | The ID of the terminal session during which the event occurred.
[User] | The name of the logged on user when the attack occurred.


SONAR

You can change how SONAR handles certain types of detections. You might want to change these settings to reduce the number of false positive detections.

Table: SONAR settings

Option

Description

Enable SONAR

Enables or disables SONAR. Typically you should enable SONAR.

Note:

If Auto-Protect is disabled and SONAR is enabled, a SONAR malfunction error appears on the status page. When Auto-Protect is disabled, SONAR loses some functionality but it can still detect heuristic threats. For complete SONAR protection, you should enable Auto-Protect.

High risk detection

Low risk detection

Configures the action for SONAR detections of heuristic threats. Heuristic threats are categorized as more likely to be malicious (high risk) or less likely to be malicious (low risk).

For low risk detections, you can disable any action. SONAR then only detects the applications that are most likely malicious.

You can set the following actions:

  • Quarantine

    Moves or tries to move the file that is associated with the detection to the local Quarantine on the infected computer.

  • Log

    Ignores the detection but logs the event.

  • Remove

    Terminates the application and deletes it from the computer. Use this action with caution. In some cases, you can cause an application to lose needed functionality.

  • Disabled

    Applies to low risk detections only. When you select this option, all detections are considered high risk detections.

Enable aggressive mode

Lowers the threshold for low risk detections.

When this option is enabled, SONAR is more sensitive to low risk detections, however the false positive rate might be higher.

When detection found

You can alert the user when SONAR makes a detection and the action is Quarantine or Remove.

  • Show alert upon detection

  • Prompt before terminating a process

  • Prompt before stopping a service

Note:

These settings also control notifications for TruScan proactive threat scans.


Suspicious Behavior Detection

You can configure the action that SONAR takes when it detects a DNS change or a host file change.

Table: Suspicious behavior detection options

Option

Description

High confidence detection

Low confidence detection

Configures the action that SONAR takes when it detects a trusted application that exhibits suspicious behavior. For example, a trusted application might create executable files or download an untrusted driver.

You can configure the following actions:

  • Ignore

    Ignores the detection.

  • Prompt

    Prompts the user to allow or block the application.

  • Log

    Allows the application but creates a log entry for the event.

  • Block

    Blocks the change.


System Change Detection

You can configure how SONAR reacts when they detect DNS or host file changes.

Note:

SONAR does not take any action when an entity tries to open or access a host file. SONAR only takes action when an entity, such as Internet Explorer, modifies a host file.

Table: System change detection options

Option

Description

DNS change detected

Host file change detected

You can configure the following actions for SONAR to take when an application tries to change the DNS settings or a host file on the client computer:

  • Ignore

    Ignores the detection.

  • Prompt

    Prompts the user to allow or block the change.

  • Log

    Allows the change but creates a log entry for the event.

  • Block

    Blocks the change.

Note:

If you set the action to Block for a DNS change, you might block access to important applications such as a VPN client.


Client Management Settings: LiveUpdate

You can use this dialog box to determine when and how to update content, such as virus definitions and IPS signatures.

On managed clients, you can only schedule LiveUpdate to run if your administrator has enabled you to do so.

Table: Options for the LiveUpdate update schedule

Option

Description

Enable automatic updates

Enables the client to run LiveUpdate at scheduled intervals.

Frequency and Time

Indicates how often the client downloads protection updates and product updates.

The options that are available depends on the frequency you selected:

  • Continuously: No selection is available.

  • Every: You can select the number of hours between updates.

  • Daily: You can select the time of day at which the update starts.

  • Weekly: You can select the day of the week and the time of day to start the update.

Retry Window

If LiveUpdate fails, you can specify the time interval during which the client tries to run LiveUpdate again. If the time interval is later than the next scheduled LiveUpdate download, the LiveUpdate waits to try to run until the next scheduled time.

If LiveUpdate succeeds, LiveUpdate does not run again at the time interval that is specified here.

Randomization Options

Enables you to minimize the effect of multiple clients trying to download updates at the same time. You can configure the clients to download updates at random times. You can specify a range of time before or after the update is scheduled to start for the download to occur. The range of time can be days or hours, which depends on the frequency you selected.

Idle Detection

Delays the scheduled updates until the computer is idle. Overdue jobs eventually run unconditionally.

If disabled, scheduled LiveUpdate sessions always run at the scheduled time, regardless of how busy the computer is.

Configure Proxy Options

Enables to you set up a custom proxy server to use for LiveUpdate.


Client Management Settings: General

You can use this tab to display the notification area icon, change your location, and update your user information.

Table: General options

Option | Description
Show Symantec security icon in notification area | Displays or hides the product icon that appears in the Windows notification area. See How to determine whether the client is connected and protected.
Configure Proxy Options | Enables you to set up a proxy server to use for external communications. If you use a proxy server, the client is more secure, because the client does not communicate directly with the Internet.
Configure Reboot Options | Enables you to configure a schedule for restarting the computer.
Current location | Enables you to select the appropriate location.
Update User Information | Enables you to edit the user information.
Enable Application Device Control | You can enable or disable Application and Device Control . Application control protects your computer by controlling the behavior of applications on your client computer. Device control protects your computer from the hardware devices that you might plug into the computer, such as USB devices. In rare cases, application control might interfere with some safe applications that you run and you might want to temporarily disable this option. On managed computers, your administrator might prevent you from changing this option.


Outlook Protection Advanced Options

Use this dialog box to determine whether to scan the contents of compressed files that are attached to Microsoft Outlook messages. You can also set the depth at which to scan compressed files within compressed files.


Scan Notification Options

You can configure notification options for Auto-Protect scans of Outlook email. You can enable or disable the display of a message when Auto-Protect finds a virus or a security risk.

For managed clients, your administrator may lock these settings.

Table: Notification and remediation options

Option

Description

Detection options

Display a notification message when a risk is detected

Enables or disables notifications on infected computers when Auto-Protect or a user-defined scan finds a virus or a security risk.

You can modify the type of information that you want to appear in the message. You can use the default text or you can delete text and type in your own text. If you right-click inside of the text box, you can insert variable fields into the notification text. In the message itself, the relevant text automatically replaces the variable fields.

Table: Message variables displays the default message variables and the variables that you can add.

Remediation options

The client might need to terminate a process or stop a service to remove or repair a risk.

The following options are available:

  • Terminate processes automatically

    If you enable this option, the client terminates processes automatically. If you disable this option, Symantec Endpoint Protection prompts you before it takes action on a process.

  • Stop services automatically

    If you enable this option, the client stops services automatically. If you disable this option, the client prompts you before it takes action on a service.

Note:

You are always notified when a restart is required. You can then save data and close open applications or opt out of the restart.

Table: Message variables

Field | Description
LoggedBy | The type of scan that detected the virus or security risk.
Event | The type of event, such as "Risk Found."
SecurityRiskName | The name of the virus or security risk that was found.
PathAndFilename | The complete path and name of the file that the virus or the security risk has infected.
Location | The drive on the computer on which the virus or security risk was located.
Computer | The name of the computer on which the virus or security risk was found.
User | The name of the user who was logged on when the virus or security risk occurred.
ActionTaken | The action that was taken in response to detecting the virus or security risk. This action can be either the first action or second action that was configured.
DateFound | The date on which the virus or security risk was found.
Status | The state of the file: Infected, Not Infected, or Deleted.
Filename | The name of the file that the virus or the security risk has infected.
StorageName | The affected area of the application, such as File System Auto-Protect or Internet Email Auto-Protect.
ActionDescription | A full description of the actions that were taken in response to detecting the virus or security risk.


Internet Email Advanced Options

You can configure advanced options for Internet email scanning.

Table: Advanced options for Internet email

Option

Description

Compressed files options

Scans the contents of compressed files that are attached to Internet email messages. You can also set the depth at which to scan compressed files within compressed files.

Connection settings

Enables the following options:

  • Incoming mail server (POP3): The port on which to listen for incoming messages.

  • Outgoing mail server (SMTP): The port on which to listen for outgoing messages.

  • Allow encrypted POP3 connections: Allows your email client to receive messages over encrypted connections.

  • Allow encrypted SMTP connections: Allows your email client to send messages over encrypted connections.

    Note:

    The client cannot scan any messages that are sent or received over encrypted connections. If you disable the encrypted options, Auto-Protect blocks the messages. The change does not take effect until you log off Windows and log on again.

Mass Mailing Worm Heuristics

Enables the following options:

  • Outbound worm heuristics: Enable or disable this option to scan outgoing messages for suspicious behavior.

  • First action: Select an action to take when the scan detects suspicious behavior. You can choose to quarantine the threat, delete the threat, or to log the detection but take no action on the threat.

  • If first action fails: Select an action to take when the scan cannot perform the first action on the detected threat. You can choose to delete the threat or to log the detection but take no action on the threat.

    Note:

    If the First action is set to Leave alone (log only), then this option is not available.

Progress notifications

Enables the following options:

  • Display a progress indicator when email is being sent: Displays a progress status pop-up window when scanning messages.

  • Display a notification area icon: Displays an icon in the Windows notification area when scanning messages.


Scan Notification Options

You can configure notification options for Auto-Protect scans of Internet email. You can enable or disable the display of a message when Auto-Protect finds a virus or a security risk.

Table: Notification and remediation options

Option

Description

Detection options

Display a notification message when a risk is detected

Enables or disables notifications on infected computers when Auto-Protect or a user-defined scan finds a virus or a security risk.

You can modify the type of information that you want to appear in the message. You can use the default text or you can delete text and type in your own text. If you right-click inside of the text box, you can insert variable fields into the notification text. In the message itself, the relevant text automatically replaces the variable fields.

Table: Message variables displays the default message variables and the variables that you can add.

Remediation options

The client might need to terminate a process or stop a service to remove or repair a risk.

The following options are available:

  • Terminate processes automatically

    If you enable this option, the client terminates processes automatically. If you disable this option, Symantec Endpoint Protection prompts you before it takes action on a process.

  • Stop services automatically

    If you enable this option, the client stops services automatically. If you disable this option, the client prompts you before it takes action on a service.

Note:

You are always notified when a restart is required. You can then save data and close open applications or opt out of the restart.

Table: Message variables

Field | Description
LoggedBy | The type of scan that detected the virus or security risk.
Event | The type of event, such as "Risk Found."
SecurityRiskName | The name of the virus or security risk that was found.
PathAndFilename | The complete path and name of the file that the virus or the security risk has infected.
Location | The drive on the computer on which the virus or security risk was located.
Computer | The name of the computer on which the virus or security risk was found.
User | The name of the user who was logged on when the virus or security risk occurred.
ActionTaken | The action that was taken in response to detecting the virus or security risk. This action can be either the first action or second action that was configured.
DateFound | The date on which the virus or security risk was found.
Status | The state of the file: Infected, Not Infected, or Deleted.
Filename | The name of the file that the virus or the security risk has infected.
StorageName | The affected area of the application, such as File System Auto-Protect or Lotus Notes Auto-Protect.
ActionDescription | A full description of the actions that were taken in response to detecting the virus or security risk.


Selected Extensions

When you configure a scan to scan only selected extensions, you can add extensions to the list or remove extensions from the list.

Table: Extensions options

Option

Description

Use Defaults

Returns the extensions list to its default state

Any extensions you added are removed, and any default extensions you removed are added.

Add common extension types for

The following options are available:

  • Programs: Selects all extensions for common programs.

  • Documents: Selects all extensions for common documents.


Filter System Log

Use this dialog box to specify the types of events that you want to view in the System Log for viruses and security risks. Entry types with unchecked check boxes do not appear in the System Log. This filter controls only your display of the log. All types of events continue to be written into the log.


Send Email to Others: Others

You can automatically notify others about a virus or security risk infection.

Type the email addresses of the individuals who should be notified about a virus or security risk. The client sends an email message that contains information about the virus infection to the addressees in the list. Click Add to add an email address, or select the email addresses that you want to remove, and then click Remove.


Send Email to recipient: Message

For supported email software, you can automatically send a message to the sender of an infected email message. This message states that the client detected a virus in the original message. It also includes information about the infection, including the action that the client took.

You can use this dialog box to customize the message subject and its contents. You can use the default message or you can delete text and type in your own text. If you right-click inside of a text box, you can insert variable fields into the message. In the message itself, the relevant text automatically replaces the variable fields.

Note:

Not all variable fields are available in each text box.

Table: Email message text boxes

Option

Description

Subject

The subject of the infected message and overwrites the original subject.

Message body

This content of the message, which appears at the top of the message.

Infection information

The following infection information is listed for each infected file:

  • Name of the file attachment

  • Name of the security risk

  • Action taken (such as cleaned, moved to the Quarantine, Deleted, or left alone)

  • File status (infected or not infected)

Table: Email variable fields

Field | Description
OriginalAttachmentName | The name of the attachment that contains the virus or security risk.
SecurityRiskName | The name of the virus or security risk that was found.
ActionTaken | The action that was taken in response to detecting the virus or security risk. This action can be either the first action or second action that was configured.
Status | The state of the file: Infected, Not Infected, or Deleted.
Filename | The name of the file that the virus or security risk infected.
PathAndFilename | The complete path and name of the file that the virus or security risk infected.
Computer | The name of the computer on which the virus or security risk was found.
User | The name of the user who was logged on when the virus or security risk occurred.
DateFound | The date on which the virus or security risk was found.
EmailSender | The email address that sent the email with the infected attachment.
EmailRecipientList | The list of addresses to which the email with the infected attachment was sent.
StorageName | The affected area of the application. For example, Auto-Protect for files and processes or Lotus Notes Auto-Protect.
EmailSubject | The subject of the original message.


Send Email to recipient: Email Server

To notify the sender of an infected message that was sent using Internet email, you must specify the email server to send to the message.

Table: Email server options

Option | Description
Mail server | Name of the mail server
Mail port | Mail port to use to send the message
User name | User name that is required to access the mail server and send messages
Password | Password that the mail server requires
Reverse-path | Reverse path information for your mail server. The reverse path is usually not necessary, but the email server might require it. You can insert the DNS name of the computer that should generate the message.


Scan Actions

You can configure actions when scans detect malware or security risks.

Table: Scan action options

Detection type

Action option

Malware

You can configure a first action to take and a second action to take if the first action fails.

Actions for viruses include the following:

  • Clean risk: Tries to clean the infected file when a virus is found (first action only).

  • Quarantine risk: Tries to move the infected file to the Quarantine on the infected computer as soon as it is detected. When a file is in the Quarantine, you cannot execute it until you move the file back to its original location.

  • Delete risk: Tries to delete the file. Use this option only if you can replace the infected file with a virus-free backup copy. After the file is permanently deleted, you cannot recover it from the recycle bin .

    If the scan cannot delete the file, detailed information about the action appears in the Notification dialog box and the client Risk Log.

  • Leave alone (log only): Denies any access to the file, displays a notification, and logs the event. Use this option to take manual control of how the scan handles a virus.

    You can specify an action for the risk in the Risk Log.

Security Risks

You can configure security risk actions as follows:

  • Configure the same actions to take for all security risks.

  • Configure the same actions for a whole category of security risks.

    Click the risk and then click Override actions configured for Security Risks.

  • Configure individual security risk exceptions to the actions that you set for specific categories.

You can configure a first action to take and a second action to take if the first action fails. Actions for security risks include the following:

  • Quarantine risk: Tries to move any infected files to the Quarantine on the infected computer as soon as the security risk is detected or completes its installation. The scan removes or repairs any side effects of the risk. Side effects might include additional registry keys, modified registry key values, additions to .ini or .bat files, or extra entries in hosts files. They might also include errors in a Layered Service Provider (LSP) system driver or the effects of a rootkit. You can restore the security risk items that are quarantined to their original state on the system. In some instances, you might need to restart the computer to complete the removal or repair.

  • Delete risk: Tries to delete security risk files. Use this option only if you can replace the files with a security risk-free backup copy. You cannot recover permanently deleted files from the recycle bin .

    Use this action with caution. The deletion of security risks can cause applications to lose functionality.

    If the client cannot delete files, detailed information about the actions that the client takes appears in the Notification dialog box and the Risk Log.

  • Leave alone (log only): The risk is left alone and its detection is logged. Use this option to take manual control of how the client handles a security risk. You can specify an action for the risk in the Risk Log.

Note:

In some instances, you might unknowingly install an application that includes a security risk such as adware or spyware. If Symantec has determined that blocking the risk does not harm the computer, then by default the client blocks the risk. If the block action might make the computer unstable, the client waits after the application installation. The client then performs the configured action on the security risk.

Note:

Other is a category of programs that might pose a security risk but do not fit into other security risk categories.


Insert Warning

You can insert a warning into the body of an email message that is associated with an infected attachment. This warning states that the client detected a virus in the original message. It also includes information about the infection, including the action that the client took.

You can use this dialog box to customize the warning. You can use the default warning settings or you can delete text and type in your own text. If you right-click inside of a text box, you can insert variable fields into the warning. In the warning itself, the relevant text automatically replaces the variable fields.

Table: Warning text boxes

Option

Description

Change the subject of the original message to

Enables or disables the modification of the subject of the messages that are associated with infected file attachments.

Message body

Specifies the text to include in the message body.

Infection information

Specifies what infection information should be included in the email message:

This infection information is also listed for each infected file:

  • Name of the file attachment

  • Name of the security risk

  • Action taken (such as cleaned, moved to the Quarantine, Deleted, or left alone)

  • File status (infected or not infected)

Table: Email variable fields displays the variables you can add to a message.

Table: Email variable fields

Field | Description
OriginalAttachmentName | The name of the attachment that contains the virus or security risk.
SecurityRiskName | The name of the virus or security risk that was found.
ActionTaken | The action that was taken in response to detecting the virus or security risk. This action can be either the first action or second action that was configured.
Status | The state of the file: Infected, Not Infected, or Deleted.
Filename | The name of the file that the virus or security risk infected.
PathAndFilename | The complete path and name of the file that the virus or security risk infected.
Computer | The name of the computer on which the virus or security risk was found.
User | The name of the user who was logged on when the virus or security risk occurred.
DateFound | The date on which the virus or security risk was found.
EmailSender | The email address that sent the email with the infected attachment.
EmailRecipientList | The list of addresses to which the email with the infected attachment was sent.
StorageName | The affected area of the application. For example, Auto-Protect for files and processes or Lotus Notes Auto-Protect.
EmailSubject | The subject of the original message.


Floppy Settings

You can monitor for boot record viruses on floppy disks when they are first accessed. The safest setting is to clean the virus from an infected floppy disk.

Table: Settings for checking floppies

Option

Description

Floppy settings

The following option is available:

  • Check floppies for boot viruses when accessed: Enables or disables floppy disk scanning when floppy disks are accessed for data.

  • When a boot virus is found: When Auto-Protect finds a boot virus, select whether to clean a virus from the boot record or leave it alone.

    If you click Leave alone (log only), an alert is sent when a virus is detected but no action is taken.

Computer shutdown settings

The following option is available:

  • Check floppies when the computer shuts down: Enables and disables scanning floppies when the computer is turned off.


Advanced Scan Options

Use these options to customize your scan settings.

Table: Advanced scan options

Advanced Option

Definition

Compressed files options

You can set the following options:

  • Scan files inside compressed files

    Enables the scanning of containers, such as Files.zip, and the contents of the containers, which are the individual compressed files.

    Symantec Endpoint Protection scans compressed files during on-demand, email, and scheduled scans. Because of the significant processing overhead, Auto-Protect does not scan the files that are within compressed files on Windows computers. However, the files are scanned when they are extracted from compressed files.

    Note:

    You cannot stop a scan that is in progress on a compressed file. If you choose to stop the scan, the Symantec Endpoint Protection client stops the scan only after it has finished scanning the compressed file.

  • Number of levels to expand if there are compressed files within compressed files

    Specifies the number of levels of nesting scans should support.

Backup options

Automatically backs up a file before Symantec Endpoint Protection tries to repair it.

Dialog options

Specifies whether or not a scan progress dialog box appears. You can also specify whether or not the scan progress dialog box closes when the scan finishes.

When you select Show scan progress or Show scan progress if risk detected, the following options appear:

  • When a scan runs, the message link scan in progress appears.

    You can click the link to display the scan progress.

  • A link to reschedule the next scheduled scan also appears.

Tuning options

Balances the scan performance optimization and its affect on other applications.

You can select one of the following options:

  • Best Scan Performance

    Optimizes the performance of the scan that run on your computer. Scans take less time to complete, but other applications may run more slowly during scans. For computers with four or more CPUs, use this option for the best overall performance.

  • Balanced Performance

    Balances the performance of a scan against the performance of other applications. Balances the scan performance and the performance of other applications that run during scans.

  • Best Application Performance

    Optimizes the performance of other applications that are running on the computer. Scans take longer to complete, but other applications on the computer may perform better during a scan. When this option is set, scans can start but they only run when the client computer is idle.

    If you configure an Active Scan to run when new definitions arrive, the scan is delayed for up to 15 minutes if the user is using the client computer.

Storage migration options

Specifies the options for the files that Hierarchical Storage Management (HSM) and offline backup systems maintain.

Note:

For all of these options, consult your HSM or backup vendor to select the appropriate settings.


Network Scanning Settings

You can configure options for Auto-Protect scans of network drives.

Table: Network scanning settings

Option

Description

Trust files on remote computers running Auto-Protect

Prevents Auto-Protect from performing duplicate scans on read-access files when network scanning is enabled.

If this option is enabled on two clients, each client checks to see that the other's Auto-Protect settings are as secure as its own. Each client then trusts the Auto-Protect scan on the other and does not rescan any files.

For example, when client A accesses a file on a network drive on client B, client A's Auto-Protect checks client B's Auto-Protect settings. If client B's Auto-Protect is trustworthy, client A Auto-Protect does not scan the file. If client B's Auto-Protect is not trustworthy, client A's Auto-Protect scans the file.

When you read files on a remote computer, however, Auto-Protect might not scan the files. By default, Auto-Protect tries to trust remote versions of Auto-Protect. If the trust option is enabled on both computers, the local Auto-Protect checks the remote computer's Auto-Protect settings. If the remote Auto-Protect settings provide at least as high a level of security as the local settings, the local Auto-Protect trusts the remote Auto-Protect. When the local Auto-Protect trusts the remote Auto-Protect, the local Auto-Protect does not scan the files that it reads from the remote computer. The local computer trusts that the remote Auto-Protect already scanned the files.

Disable this setting if you want to allow duplicate scanning.

Note:

This functionality applies only to read access. When client A requests write access from client B, client A's Auto-Protect scans the file regardless of this setting.

The local Auto-Protect always scans the files that you copy from a remote computer

Network cache

This option prevents Auto-Protect from scanning the same file more than once and may improve system performance. You can set the number of files (entries) that Auto-Protect scans and remembers. You can also set the timeout before the files are removed from the cache. After the timeout expires, Auto-Protect scans the network files again if the client requests them from the network server.


Scan Notification Options

You can configure notification and remediation options for Auto-Protect or user-defined scans.

For managed clients, your administrator may lock some of these settings.

Table: Notification and remediation options

Option

Description

Detection options

The following options are available:

  • Display a notification message when a risk is detected

    Enables or disables notifications on infected computers when Auto-Protect or a user-defined scan finds a virus or a security risk.

    You can modify the type of information that you want to appear in the notification. You can use the default text or you can delete text and type in your own text. If you right-click inside of the text box, you can insert variable fields into the notification text. In the notification itself, the relevant text automatically replaces the variable fields.

    Table: Message variables displays the default message variables and the variables that you can add.

  • Display the Auto-Protect results dialog

    Enables or disables the display of results on infected computers. This option is only available for Auto-Protect protection of file systems.

Remediation options

The client might need to terminate a process or stop a service to remove or repair a risk.

The following options are available:

  • Terminate processes automatically

    If you enable this option, the client terminates processes automatically. If you disable this option, Symantec Endpoint Protection prompts you before it takes action on a process.

  • Stop services automatically

    If you enable this option, the client stops services automatically. If you disable this option, the client prompts you before it takes action on a service.

Note:

You are always notified when a restart is required. You can then save data and close open applications or opt out of the restart.

Table: Message variables

Field | Description
LoggedBy | The type of scan that detected the virus or security risk.
Event | The type of event, such as "Risk Found."
SecurityRiskName | The name of the virus or security risk that was found.
PathAndFilename | The complete path and name of the file that the virus or the security risk has infected.
Location | The drive on the computer on which the virus or security risk was located.
Computer | The name of the computer on which the virus or security risk was found.
User | The name of the user who was logged on when the virus or security risk occurred.
ActionTaken | The action that was taken in response to detecting the virus or security risk. This action can be either the first action or second action that was configured.
DateFound | The date on which the virus or security risk was found.
Status | The state of the file: Infected, Not Infected, or Deleted.
Filename | The name of the file that the virus or the security risk has infected.
StorageName | The affected area of the application, such as File System Auto-Protect or Internet Email Auto-Protect.
ActionDescription | A full description of the actions that were taken in response to detecting the virus or security risk.


Auto-Protect Advanced Options

You can configure advanced options for Auto-Protect scans of the file system.

Table: Advanced options for File System Auto-Protect

Option

Description

Changes requiring Auto-Protect reload

Specifies when Auto-Protect should be reloaded

The following options are available:

  • Wait until the computer is restarted

    Stops and reloads Auto-Protect when the computer restarts.

  • Stop and reload Auto-Protect

    Stops and reloads Auto-Protect immediately.

Scan files when

The following options are available:

  • Scan when a file is accessed or modified

    Scans the files when they are written, opened, moved, copied, or run. You can use this option for more complete file system protection. This option might have a performance impact because Auto-Protect scans files during all types of operations.

  • Scan when a file is modified

    Scans the files when they are written, modified, or copied. You can use this option for slightly faster performance.

  • Scan when a file is backed up

    Scans the files when they are accessed during a backup operation. You can use this option when you have not run a scan on the files that you want to back up. By using this option, you can significantly slow backup operations, because Auto-Protect scans each file that is included in the backup.

    This setting applies only to files that are backed up. Auto-Protect scans the files that are restored from backup regardless of this setting.

  • Do not scan files when trusted processes access the files

    Skips the files that are accessed by Windows Search indexer and other safe processes.

Other options

The following options are available:

  • Delete newly created infected files if the action is 'Leave alone (log only)'

    Enable this option to delete a new file that is infected with a type of risk that you configured Auto-Protect to leave alone. Auto-Protect does not delete such files if they already exist.

  • Preserve file times

    Enable this option if you do not want the file system to change the last access time. When you select this option, the software does not back up unchanged files.

File cache

The following options are available:

  • Disable the file cache

    File caching decreases Auto-Protect's memory usage and can help you to track problems. Auto-Protect adds a 16-byte entry to the cache index, which remains until Auto-Protect detects a change to the file.

    You might want to disable the file cache to troubleshoot problems.

  • Use the default file cache size

    The default file cache size is based on typical file usage patterns.

  • Specify a custom file cache size (in files): Uses a specified number of file cache entries rather than the default size. You can specify the number of custom file cache entries to include. This option is useful for file servers or Web servers on which you want to cache a large number of files.

  • Rescan the cache when new definitions load

    Rescans the file cache when new definitions arrive on the client computer. If you disable this option, the file cache does not persist after the client computer shuts down. When the client computer restarts, Auto-Protect rescans all files.

Risk Tracer

The following options are available:

  • Enable Risk Tracer

    Enables or disables Risk Tracer.

  • Resolve the source computer IP address

    If this option is enabled, Auto-Protect looks up and records only the computer's NetBIOS name. Auto-Protect also reports who was logged on to the computer at delivery time.

    This feature is supported on Windows XP systems only.

  • Poll for network sessions every

    Enables or disables polling for network sessions.

Automatic enablement

Specifies whether or not Auto-Protect is re-enabled after a certain number of minutes

The following option is available:

  • When Auto-Protect is disabled, enable after

    Enables Auto-Protect if it is disabled for the specified number of minutes. This option is useful if you want to disable Auto-Protect on occasion. Valid values for the time range are 3 minutes to 60 minutes.

Backup options

The following option is available:

  • Back up files before attempting to repair them

    As a data safety precaution, before you try to repair a file, you should enable this option. The original virus-infected file is encrypted and then copied into the Quarantine directory. You can use this unrepaired backup file to return the file to its original, infected state.

    Note:

    Uncheck this option with caution, since it means the files that contain viruses are not backed up before repairs are tried.

    This setting applies only to virus-infected files. The client always backs up the files that it quarantines and repairs, regardless of this setting.

Additional advanced options

The following command options are available:

  • Floppies: Configures the options for scans of floppy disks.

  • Network: Configures the network scanning settings.


Scan Tuning Options

Use this window to select a performance level for your scan.

Table: Performance levels

Performance level | Definition
Best Scan Performance | Optimizes the performance of the scans that run on the client computer If you choose the top of the slider, scans take less time to complete, but other applications may run more slowly during scans. For computers with four or more CPUs, use this option for the best overall performance.
Balanced Performance | Balances the performance of a scan against the performance of other applications The middle of the slider balances scan performance the performance of other applications that run during scans.
Best Application Performance | Optimizes the performance of other applications that are running on the computer If you choose the bottom of the slider, scans take longer to complete, but other applications on the computer may perform better during a scan.


Lotus Notes Advanced Options

Use this dialog box to determine whether to scan the contents of compressed files that are attached to Lotus Notes messages. You can also set the depth at which to scan compressed files within compressed files.


Scan Notification Options

You can configure notification options for Auto-Protect scans of Lotus Notes email. You can enable or disable the display of a message when Auto-Protect finds a virus or a security risk.

For managed clients, your administrator may lock the setting.

Table: Notification and remediation options

Option

Description

Detection options

Display a notification message when a risk is detected

Enables or disables notifications on infected computers when Auto-Protect or a user-defined scan finds a virus or a security risk.

You can modify the type of information that you want to appear in the message. You can use the default text or you can delete text and type in your own text. If you right-click inside of the text box, you can insert variable fields into the notification text. In the message itself, the relevant text automatically replaces the variable fields.

Table: Message variables displays the default message variables and the variables that you can add.

Remediation options

The client might need to terminate a process or stop a service to remove or repair a risk.

The following options are available:

  • Terminate processes automatically

    If you enable this option, the client terminates processes automatically. If you disable this option, Symantec Endpoint Protection prompts you before it takes action on a process.

  • Stop services automatically

    If you enable this option, the client stops services automatically. If you disable this option, the client prompts you before it takes action on a service.

Note:

You are always notified when a restart is required. You can then save data and close open applications or opt out of the restart.

Table: Message variables

Field | Description
LoggedBy | The type of scan that detected the virus or security risk.
Event | The type of event, such as "Risk Found."
SecurityRiskName | The name of the virus or security risk that was found.
PathAndFilename | The complete path and name of the file that the virus or the security risk has infected.
Location | The drive on the computer on which the virus or security risk was located.
Computer | The name of the computer on which the virus or security risk was found.
User | The name of the user who was logged on when the virus or security risk occurred.
ActionTaken | The action that was taken in response to detecting the virus or security risk. This action can be either the first action or second action that was configured.
DateFound | The date on which the virus or security risk was found.
Status | The state of the file: Infected, Not Infected, or Deleted.
Filename | The name of the file that the virus or the security risk has infected.
StorageName | The affected area of the application, such as File System Auto-Protect or Lotus Notes Auto-Protect.
ActionDescription | A full description of the actions that were taken in response to detecting the virus or security risk.


Take Action

You can use this dialog box to execute the desired action on detected risks. When you try to take an action on a risk that appears in the Symantec Endpoint Protection Detection Results dialog box, the client determines if the action is possible. If the action is possible, then the risk appears in the Take Action dialog box. If you want to execute the action, you must click the button in the upper right corner of the dialog box. The button label depends on the desired action and may be one of the following:

  • Start Undo

  • Start Clean

  • Start Delete

  • Quarantine

If the action does not appear for a risk, then the risk does not appear in the dialog box. You can close the dialog box to return to the Symantec Endpoint Protection Detection Results dialog box.


Proactive Threat Protection Logs: System Log

In the System Log, you can view the system events that are related to SONAR. Actions that are inappropriate or that your administrator does not allow are unavailable.

You can perform the following tasks in the Proactive Threat Protection System Log:

Table: System Log options

Option | Description
Export | Saves the data as a comma-separated value (.csv) file.
Filter | Filters the System Log data. When you select this option, the Filter Events dialog box appears. You can select the items that you want to appear in the System Log.

You can also right-click an entry to view its properties.

Table: System Log columns

Column name | Description
Event | A description of the event that occurred.
Computer | The computer that initiated or was responsible for the event.
User | The user that was logged onto the responsible computer at the time of the event.
Logged by | Shows SONAR as the Symantec Endpoint Protection feature that was responsible for logging the event.
Description | A description of the action that was taken on the threat.
Date and Time | The date and time that the event was logged.


Proactive Threat Protection Logs: Threat Log

The Threat Log lists the threats that a proactive threat scan has been detected and prevented on your computer, along with additional information. Actions that are inappropriate or that your administrator does not allow are unavailable.

Note:

The action options that are active depend on the actions that are appropriate for the selected log entry.

You can perform the following tasks in the Threat Log:

Table: Threat Log options

Option | Description
Export | Saves the data as a comma-separated value (.csv) file.
Terminate | Ends a program or process that has been found on your computer.
Restore | Restores the selected threat from the Quarantine. This option is only active when you select a threat that has been quarantined.
Quarantine | Moves the selected file to the Quarantine.

You can also right-click an entry to view its properties.

Table: Threat Log columns

Column name | Description
Filename | The name of the file involved, if applicable.
Risk | The name of the threat that was found.
Action | The action that was taken on the threat.
Risk Type | The type of threat that was found.
Original Location | The location where the threat was found, if applicable.
Computer | The computer on which the threat occurred.
User | The user that was logged onto the computer when the threat was found.
Status | The current status of the threat. For example, the current status can be terminated or quarantined.
Current Location | The location of the threat now. For example, the location can be In Quarantine.
Primary Action | The action that was configured to take for this threat.
Secondary Action | This column does not apply to proactive threat scan threats.
Logged By | The type of scan that was responsible for logging the event. This type of scan is a proactive threat scan.
Action Description | A description of the action that was taken on the threat.
Date and Time | The date and time that the threat was logged.


Troubleshooting: Connection Status

Use this dialog box to check the communication between the client and the server and to connect to the server.

You might need to check the communication for any of the following reasons:

  • The client might not receive security policy updates.

  • The client does not to be appear to connect to the server. The green dot does not appear in the client icon on the Windows notification area.

  • Your virus definitions have not been updated in a long time.

  • You want to check whether your client is managed or unmanaged.

    A managed client connects to the server but might be offline. A unmanaged client never connects to a server.

To test whether or not the client is connected, click Connect Now.

If you have trouble with client and server communication, you should first check to make sure that there are no network problems. You should also check network connectivity before you call Symantec Technical Support.

You only need to view these settings if an administrator or Symantec Technical Support tells you to.

Table: Connection status options

Option

Description

Status

Displays whether or not the client is currently connected to a server. The Status field displays the following settings:

  • Connected

    The client is connected to a server.

  • Not Connected

    The client is not currently connected to a server.

Connect Now

Tries to connect to the server.

Last Attempted Connection

Displays the day and time that the client last tried to connect to the server. For example, the client reconnects to the server each time that you restart the computer.

Last Successful Connection

Displays the day and time that the client last connected to the server successfully.

Server Name

Displays the IP address or DNS name of the server.

Port Number

Displays the port number through which the server connects to the client. The Windows firewall might block the port number.

If the client is not connected you can find out why by clicking Error Details. You can also see when the client last tried to connect to the server, and when the client last successfully connected. This pane also displays the server's address or DNS name and which port the server connects through.


Troubleshooting: Debug Logs

You can use this panel to configure and view the contents of the debug logs. Your administrator uses the information in the logs to record information about the client and about the protection of your computer.

See Client Management Debug Log Settings.

Note:

Use this panel only if directed to do so by your administrator or by Symantec Technical Support.


Troubleshooting: Logs

Use this panel to view the log for each type of protection. You can expand or condense each category of logs.

Note:

If you are logged on to a managed client, some options in some of the logs may be unavailable. The availability of these options depends on what your administrator allows.

Options that are inappropriate for a particular entry in any log may be unavailable.

Table: Client logs and description contains information about the types of events.

Table: Client logs and description

Log | Description
Scan Log | The scans that have run on your computer over time.
Risk Log | The viruses and security risks that have infected your computer. Security risks include a link to the Symantec Security Response Web page that provides additional information.
Virus and Spyware Protection System Log | The system activities on your computer that are related to viruses and security risks. This information includes configuration changes, errors, and definitions file information.
Threat Log | The threats that SONAR detected on your computer. These include the commercial applications that can be used for malicious purposes. Examples are Trojan horses, worms, or keyloggers, or mass-mailing worms, macro viruses, and script-based threats.
Proactive Threat Protection System Log | The system activities on your computer that are related to SONAR.
Tamper Protection Log | The attempts to tamper with the Symantec applications on your computer. These entries contain information about the attempts that Tamper Protection detected or detected and thwarted.
Traffic Log | The connections that your computer makes through the network.
Packet Log | The packets of data that enter or leave through the ports on your computer.
Control Log | The registry keys, files, and DLLs that an application accesses, as well as the applications that your computer runs.
Security Log | The activities that were directed toward your computer that can potentially pose a threat. Activities such as denial-of-service attacks, port scans, and executable file alterations are examples.
Client Management System Log | The operational changes that have occurred on your computer. Examples include activities such as when a service starts or stops, the computer detects network applications, or software is configured.


Symantec Endpoint Protection Debug Log Settings

You can use this dialog box to enable the client to collect troubleshooting information about scans. The log file name is a text file called vpdebug.log.

Warning:

If you specify a setting, the log can increase in size very quickly. Therefore, only specify a setting if an administrator or Symantec Technical Support tells you to.

Table: Symantec Endpoint Protection debug log options displays the levels of information in the Debug log records.

Table: Symantec Endpoint Protection debug log options

Option | Description
all | All possible events
1 | Info
2 | Warning
3 | Fatal


Client Management Debug Log Settings

You can use this dialog box to configure a debug log to collect troubleshooting information about the following areas of the client:

  • Connection with the server

  • Firewall events

  • Location switching

  • Host Integrity compliance

  • EAP 802.1x issues

You send this information to your administrator or Symantec Technical Support. The log file name is a text file called debug.log.

Warning:

If you enable this debug log, the log can increase in size very quickly. Therefore, only specify a setting if an administrator or Symantec Technical Support tells you to.

Table: Client Management debug log settings

Option | Description
Debug On | Enables the log to start recording data.
Debug level | Records the scan events. The default value is 0 and is usually recommended for troubleshooting.
Log level | Records the firewall events. The log records information about blocked packets, including which rule that is applied and which application sent the packet. The default value is 0 and records all possible events.
Log file size (KB) | Increases or decreases the size of the log file. The default slog size is 256 KB. You might want to keep the file size small to save space on the computer.


Troubleshooting: Management

You can use this panel to view information about the client and the client's protection. You can also manage a communication file, a policy file, and a troubleshooting file. Your administrator might ask you to relate any of the information on this panel.

Note:

Use this panel only if directed to do so by your administrator or Symantec Technical Support.

Table: Management information

Option

Description

General Information

Displays the following information about the client:

  • The server's IP address or DNS name. If the server is connected, the address appears. If the client is managed but not currently connected to the server, the status appears as Offline. If the client is unmanaged, the status appears as Self-managed.

    See About managed clients and unmanaged clients.

  • The group to which the client belongs and from which it gets its protection.

  • Serial number of the security policy.

  • Whether or not the client receives virus definitions and other protection updates from the server.

Communication Settings

Lets you import a communication file so that you can convert a managed client to an unmanaged client.

Policy Profile

Lets you update, import, or export the policy file on an unmanaged client. The policy file contains the settings for protecting your computer.

Troubleshooting Data

Lets you save information about the client and the computer in a text file. The file also includes data about general policy information, version numbers for definition files, and other information. You can email this file to your administrator or Symantec Technical Support to help solve a problem you may have with the client or computer.


Troubleshooting: Computer

You can use this panel to view configuration information for your computer.

Note:

Use this panel only if directed to do so by Symantec Technical Support.

Table: Computer information

Option | Description
Operating System | Displays the type and the version of the client operating system.
Computer | Lists the total number of processors on the client computer along with the manufacturer and the type of each processor.
Memory | Lists the total and the available physical memory and virtual memory on the client computer.
Drive Space | Lists each drive on the client computer along with its corresponding total drive space and free drive space.


Troubleshooting: Windows Account

You can use this panel to view the profile of the current user.

Note:

Use this panel only if directed to do so by Symantec Technical Support.

Table: Windows Account

Option | Description
User | The name, domain, and SID information of the user who is currently logged on.
Groups | A list of the names, domains, and attributes of the Active Directory groups to which the user belongs.
Privileges | A list of the names, display names, and attributes of the Active Directory privileges, or actions, that the user can perform.


Troubleshooting: Versions

You can use this panel to view the version numbers of the client's protection engines and the protection definition files.

Note:

Use this panel only if directed to do so by an administrator or Symantec Technical Support.

Table: Versions information

Option | Description
Engines | Displays the version numbers of installed components.
Definitions | Displays the version number, sequence data, and moniker of the currently installed virus definition files and other definitions files.


Configure Application Settings

You can configure the settings for a specific application or service that runs on your computer. To configure settings for a specific application is the same as when you create a firewall rule. The difference is that it uses simpler criteria and applies to one application only.

Note:

If there is a conflict between a firewall rule and these settings, the firewall rule setting has priority. For example, you might allow Internet Explorer in this dialog box but block Internet Explorer in a firewall rule. Therefore, the client always blocks Internet Explorer.

Table: Configuring application-specific settings

Option

Description

Application name

Displays the name of the selected application or service.

Trusted IP(s) for the application

Specifies the IP address or the IP address ranges that the application can access.

Note:

If you leave the Trusted IP(s) or port text fields blank, all traffic is allowed.

Remote server ports

Specifies the remote TCP or the UDP ports or the ranges of remote ports that can be used for this application.

The client blocks any unlisted ports.

Allow outgoing connections

Lets the application access the network.

Local ports

Specifies the local TCP or the UDP ports or the ranges of local ports that can be used for this application.

The client blocks any unlisted ports.

Allow incoming connections

Lets the application run on the computer.

Allow ICMP traffic

Allows an outbound ICMP echo request (type:8, code:0) and an inbound ICMP echo reply (type:0, code:0).

Allow while screen saver is activated

Allows an application to access the network when the client computer runs the screen saver.

Enable scheduling

Specifies the time periods when the restrictions for the application are either in effect or are ignored.

  • During the period below

    Enables the rule only during the specified time period.

  • Excluding the period below

    Enables the rule at any time except for the specified time period.

  • Beginning at

    Specifies the month, day, hour, and minutes that the time period starts.

  • Duration

    Specifies the number of days, hours, and minutes that the time period lasts.


Configure Firewall Rules

Use this dialog box to add, edit, enable, delete, and change the order of the firewall rules that you create.

The firewall automatically checks all inbound traffic and outbound traffic against these rules, and allows or blocks the traffic accordingly. Each rule specifies the conditions that must exist for the rule to take effect as well as the effect the rule has. These conditions include designated applications, ports and protocols, hosts, and designated time periods.

Note:

If there is a conflict between a firewall rule and a specific application's setting that you configure in the View Applications List dialog box, the firewall rule setting has priority. For example, if you allow Internet Explorer in the applications list but you block it in a firewall rule, then the client always blocks Internet Explorer.

See Adding a firewall rule.

See About the firewall rule, firewall setting, and intrusion prevention processing order.


View Application Settings

The Applications list displays the applications and services that have accessed the network connection. The application appears in the list if the client asks the user to allow or block the application.

You can also add an application if you right-click it in the Network Activity dialog box and click either Allow or Block.

See Network Activity.

You can configure restrictions for the application, such as specifying the IP addresses and ports that an application uses. You can remove the restrictions on the application by removing the application from the list. When that application tries to connect to the network again, a message appears that asks you to allow or block the application.

Note:

If there is a conflict between a firewall rule and these settings you configure for an application in this list, the firewall rule setting has priority.

Table: Application-specific settings

Option

Description

Application Settings

Displays the file name, version number, action, and path for the application or service.

You can configure the client to take one of the following actions on the application:

  • Allow

    Gives an application full access to the network.

  • Block

    Prevents any access by an application to the computer or the network.

Configure

Lets you configure additional settings for the selected application.


Back Trace Information

Use this dialog box to find detailed information about the IP address of the hop from which the traffic event started. Note that the originating hop's IP address lists the owner of the router through which the traffic connected. It does not necessarily list the true IP address.

Note:

Your network configuration can cause the back trace feature not to work.

Table: Back tracing fields

Option | Description
Hop | Hop number A hop is a transition point that a packet of data travels through from one computer to another on a network. A router is a common transition point.
IP Address | IP address of each computer or router through which the traffic traveled.
Name | Computer that originated the traffic event.
Time (ms) | Time, in milliseconds, it took to find the hop's IP address.
Who is >> | More detailed information about the remote IP address, such as the organization name and contact information.


View Firewall Rules

Server rules are the rules that the administrator has configured for the client. Client rules are the rules that you create on the client. The firewall processes server rules and client rules and settings in a particular order.

You can view the server rules, client rules, and client settings in one place. You can modify or change the order of a client rule or client setting, but not a server rule. For server rules, you can view whether the client blocks, allows, or asks the user to allow or block a specified type of traffic only.

You can only view this dialog box if the administrator has made that option available.

Table: Order that the firewall processes server rules and client rules

Priority | User type
First | Server rules with high priority levels as assigned by your administrator
Second | Client rules
Third | Server rules with lower priority levels
Fourth | Client Network Threat Protection settings
Fifth | Client application-specific settings


Client Management Logs: Control Log

The Control Log records the results of the Application and Device Control policy that is applied to the client. The Application and Device Control policy protects the registry and the specific files or directories. It also controls processes, DLLs, and application execution.

The Control Log records the activities specific to an application's behavior. It records the registry keys, files, and DLLs that an application accesses as well as the applications that it runs. If an application performs an activity that is not allowed, it is blocked. For example, a Web server that serves Web pages should not copy files to your system folder.

Note:

Two log entries might appear in the Control log for a single event. For example, two entries might appear if an application reads and then tries to write a file. Two entries also appear if an application writes and then tries to delete a file.

You can perform the following tasks in the Control Log:

  • View a list of the control events.

  • Clear all the entries from the log.

  • Export the data in the log to a tab-delimited text file, for use in other applications.

  • Switch between a local view and a source view.

  • Filter the entries by selecting a time range.

Table: Control Log columns

Column

Description

Date and Time

Specifies the date and the time that the event was logged.

Severity Level

Specifies the severity of the behavior.

The severity ranges from 1 to 15.

Action

Specifies the action the client takes if the rule is not met.

When a system process tries to perform an operation on the target, the client takes one of the following actions on the application or device:

  • Block

  • Allow

  • Continue

    The rule is triggered but the client ignores the event and logs it.

  • Terminate

    The client terminates the process.

Test Mode

Test or Production. Administrators may use this information.

Description

Description of the behavior on the client.

API

Specifies the name of the API that caused the logging of this behavior.

Rule Name

Specifies the name of the rule that caused the logging of this behavior.

IP Address

Specifies the IP address from which the application or process triggered the rule.

Caller Process ID

Specifies the ID of the application or process that triggers the logging.

Caller Process

Specifies the name of the application or process that sent the error.

Device Instance ID

Specifies the parameters that were used in the API call.

The parameters are converted to STRING and separated by a space character.

Target

Specifies the target that the process or the application acted upon.

File Size

The size of the file upon which the application or process acted.

The file size might appear as 0 bytes rather than the actual file size. Typically, the file size appears as 0 bytes when the application control rule triggers before a process creates or writes a file

User

Specifies the name of the computer or the user.

User Domain

Specifies the name of the server domain where the client is logged on.

Location

Specifies the name of the location where the application has logged on.


Network Threat Protection Logs: Packet Log

The Packet Log captures every packet of data that enters or leaves a port on your computer. The Packet Log displays intrusion attempts.

You can perform the following tasks in the Packet Log:

  • View a list of the incoming traffic events and the outgoing traffic events whenever your computer is connected to a network.

  • Clear all the entries from the log.

  • Export the data to a tab-delimited text file, network monitor format, or NetXray format, for use in other applications.

  • Access the Network Threat Protection settings and change the settings that are available to you.

  • Switch between a local view and a source view. To view the columns for source ports and hosts and destinations ports and hosts, you can select Source View from the View menu.

  • Filter the entries by selecting a time range.

  • Back trace the data packets that were used in attempted attacks to locate their origin. Note that not every entry can be back traced.

The log view includes information in the lower left pane about the actual data packet. The pane in the lower right corner shows the data on the type of packet that is logged.

If you or your administrator disables the Packet Log, the log stops recording information. The Packet Log is disabled by default.

On a managed client, you might not be able to access all of these features. Actions that are inappropriate for a particular entry are unavailable.

Note:

You can only enable the Packet Log on an unmanaged client.

Table: Packet Log columns

Column or field

Description

Date and Time

The date and time that the packet was logged.

Remote Host or Source Host

The computer that hosts the current view, which includes the following fields:

  • Remote Host (Local View)

    Name of the remote computer.

  • Source Host (Source View)

    Name of the source computer.

Remote Port or Source Port

The port in the current view, which includes the following fields:

  • Remote Port (Local View)

    Port on the remote host that sent the packet or received the packet.

  • Source Port (Source View)

    Port on the source host that sent the packet or received the packet.

Local Host or Destination Host

The IP address in the current view, which includes the following fields:

  • Local Host (Local View)

    IP address of the local computer.

  • Destination Host (Source View)

    IP address of the destination computer.

Local Port or Destination Port

The port in the current view, which includes the following fields:

  • Local Port (Local View)

    Port that is used on the computer for this packet.

  • Destination Port (Source View)

    Port that is used on the destination computer for this packet.

Direction

The direction in which the packet traveled:

  • Incoming

  • Outgoing

Action

The action that the computer took.

  • Blocked

  • Allowed

Application

The name of the application that is associated with the packet.

Rule

The information about the intrusion prevention rule or the firewall rule that was applied to this packet.


Client Management Logs: Security Log

The Security Log records suspicious activity, such as port scanning, virus attacks, or denial-of-service attacks. The Security Log is the most important log on the client.

You can perform the following tasks in the Security Log:

  • View security-related events.

  • Clear all the entries from the log.

  • Export the data in the log to a tab-delimited text file, for use in other applications.

  • Switch between a local view and a source view. To view the columns for source ports and hosts and destinations ports and hosts, you can select Source View from the View menu.

  • Filter the entries, either based on a time range or based on severity.

  • Back trace the data packets that were used in attempted attacks to locate their origin. Note that not every entry can be back traced.

  • Stop the client from blocking the attacks from other computers.

Table: Security Log columns

Column

Description

Date and Time

The date and time that the event was logged.

Event Type

The type of security alert, such as a denial-of-service attack, executable file, or virus attack.

Severity

The severity level of the attack, which includes the following options:

  • Critical

  • Major

  • Minor

  • Information

Direction

The direction in which the traffic traveled relative to the client computer:

  • Incoming

    Most attacks are inbound because they originate on another computer.

  • Outgoing

    Attacks like Trojan horses are considered outbound because they have been downloaded to your computer and are already present.

  • Unknown

    Traffic that has been blocked or dropped from an active response or because the application executable changed.

Protocol

The type of protocol. For example, the protocol can be UDP, TCP, or ICMP.

Remote Host or Source Host

The host of the current view, which includes the following fields:

  • Remote Host (Local View)

    IP address of the remote computer.

  • Source Host (Source View)

    IP address of the source computer.

Remote port

The TCP port number, UDP port number, or ICMP type or code of the remote computer.

Remote MAC or Source MAC

The MAC address of the current view, which includes the following fields:

  • Remote MAC (Local View)

    MAC address of the remote computer. If the address is outside the subnet, it is the MAC address of the router.

  • Source MAC (Source View)

    MAC address of the source computer.

Local Host or Destination Host

The host of the current view, which includes the following fields:

  • Local Host (Local View)

    IP address of the local computer

  • Destination Host (Source View)

    IP address of the destination computer.

Local Port

The TCP port number, UDP port number, or ICMP type or code of the local computer.

Local MAC or Destination MAC

The MAC address of the current view, which includes the following fields:

  • Local MAC (Local View)

    MAC address of the local computer.

  • Destination MAC (Source View)

    MAC address of the destination computer.

Application

The name of the application that is associated with the attack.

Signature ID

The ID of the intrusion prevention signature that the attack triggered. You can use the signature ID to look up the signature online.

Signature Sub-ID

The sub-ID of the intrusion prevention signature that the attack triggered.

Signature name

The name of the signature that the attack triggered.

Intrusion URL

The URL that is associated with a browser attack.

X-Intrusion-Payload URL

The URL to which the attack redirected the browser.

User

The user or the computer that sent or received the traffic.

User Domain

The name of the server domain where the client is logged on.

Location

The location that was in effect at the time of the attack.

For example, the location can be Office, Home, or VPN.

Occurrences

The number of occurrences of the attack method.

Begin Time

The time that the attack began.

End Time

The time that the attack ended.


Client Management Logs: System Log

The System Log records all operational changes, such as service start times and stop times, network application detection, software configuration modifications, and software execution errors. It also logs communication with the server, including connections and downloads. All the information that is provided in the System Log also appears in real time in the message area. The System Log is especially useful for troubleshooting problems with the client.

You can perform the following tasks in the System Log:

  • View a list of the system events whenever your computer is connected to a network.

  • Clear all the entries from the log.

  • Export the data in the log to a tab-delimited text file, for use in other applications.

  • Filter the entries, either based on a time range or based on severity.

Table: System Log columns

Column

Description

Date and Time

Specifies the date and the time that the event was logged.

Severity

Specifies the following levels of severity information:

  • Error

    Indicates a problem with the source computer.

  • Warning

    Indicates a potential problem.

  • Information

    Provides the additional information about an event that involves the client, or provides the information about the communication with the server.

Summary

Describes the event.


Network Threat Protection Logs: Traffic Log

Use the Traffic Log to view information about firewall events, including a network attack or an intrusion attempt. The log displays a list of the incoming traffic and the outgoing traffic whenever your computer is connected to a network.

Table: Traffic Log menu commands displays the tasks that you can perform by using the Traffic Log menu commands.

Table: Traffic Log menu commands

Menu

Description

File

Lets you perform the following tasks:

  • Clear

    Removes all the entries from the log.

  • Export

    Saves all of the log entries to a tab-delimited text file, for use in other applications.

  • Change Settings (unmanaged client only)

    Displays the dialog box that enables you to modify the Network Threat Protection settings.

  • Options (managed client only)

  • Exit

    Closes the log.

Edit

Lets you perform the following tasks:

  • Copy

    Copies the selected log entries to the Clipboard.

  • Select All

    Selects the displayed log entries. You can then copy and paste the entries to another application.

View

Lets you switch between different logs or different views by using the following commands:

  • Traffic Log or Packet Log

    Displays either log.

  • Local View and Source View

    The columns in the log change depending on whether you choose the local view or source view. The local view shows the content from the perspective of the local port and the remote port. This perspective is more commonly used in a host-based firewall. The source view displays the content from the perspective of the source port and the destination port. This perspective is more commonly used in a network-based firewall.

    Table: Local view and source view displays the columns that appear in both Local View and Source View.

Filter

Displays the log entries that were recorded within a certain number of days or by severity.

Action

Lets you perform the following tasks:

  • BackTrace

    Locates the origin of the data packets. You might want to locate the originating host in the data packets that were used in attempted attacks. Note that not every entry can be back traced.

  • Stop Active Response

    Allows the traffic that the client previously blocked from the selected host.

  • Stop All Active Response

On a managed client, you might not be able to access all of these features. Actions that are inappropriate for a particular entry are unavailable.

Table: Local view and source viewdisplays the table columns that appear in both the local view and source view.

Table: Local view and source view

Column

Description

Date and Time

The date and time that the event was logged.

Action

The action that the client takes on the traffic. The client either blocks or allows traffic.

Severity

The severity level of the traffic, from 1 to 10.

Direction

The direction of the traffic, either incoming or outgoing.

Protocol

The type of protocol, either UDP, TCP, or ICMP.

Remote Host or Source Host

The computer that hosts the current view, which includes the following fields:

  • Remote Host (Local View)

    Name of the remote computer.

  • Source Host (Source View)

    Name of the source computer.

Remote MAC or Source MAC

The MAC address of the current view, which includes the following fields:

  • Remote MAC (Local View)

    MAC address of the remote computer. If outside the subnet, it is the MAC address of the router.

  • Source MAC (Source View)

    MAC address of the source computer.

Remote Port or Source Port

The port of the current view, which includes the following fields:

  • Remote Port (Local View)

    Port and ICMP type on the remote computer (appears only in Local View).

  • Source Port (Source View)

    Port and ICMP type on the source computer (appears only in Source View).

Local Host or Destination Host

The host of the current view, which includes the following fields:

  • Local Host (Local View)

    IP address of the local computer.

  • Destination Host (Source View)

    IP address of the destination computer.

Local MAC or Destination MAC

The MAC address of the current view, which includes the following fields:

  • Local MAC (Local View)

    MAC address of the local computer. If outside the subnet, it is the MAC address of the router.

  • Destination MAC (Source View)

    MAC address of the destination computer.

Local Port or Destination Port

The port of the current view, which includes the following fields:

  • Local Port (Local View)

    Port that is used on the computer for this packet.

  • Destination Port (Source View)

    Port that is used on the destination computer for this packet.

Application

The path and name of the application that is associated with the traffic.

User

The user's logon name.

User Domain

Specifies the name of the server domain where the client is logged on.

Location

The Location, such as Office, Home, or VPN, that was in effect at the time of the traffic.

Occurrences

The number of packets that the traffic sends between the start time and end time.

Begin Time

The time that the traffic starts to match the rule.

End Time

The time that the traffic no longer matches the rule.

Rule

The rule that determined the passing or blockage of this traffic.

If entries in the Network Threat Protection Logs and the Client Management Logs have more information available, it appears in the following locations:

  • Description information appears in the lower left-hand pane of the log view.

  • Data information appears in the lower right-hand pane of the log view.


Network Activity

Use the Network Activity dialog box to view the applications and the services that run on the client and that access the network.

Table: Network Activity menu commands or right-click options

Option

Description

Tools menu commands

Displays the following menu command:

Test Network Security: Displays the Symantec Security site, where you can scan your computer for viruses and risks.

Your administrator might have configured this menu command to not appear.

View menu commands

Displays items in the Running Applications panel in several formats. You can also display the following additional information about an application:

  • Applications Details

    Displays the information about the application, such as the path and the version number.

  • Connection Details

    Displays the information about the application's connection with the network.

You can display the following additional types of traffic:

  • Show Windows Services

    Displays or hides the Windows services that the client runs.

  • Show Broadcast Traffic

    Displays the broadcast traffic. If you uncheck Show Broadcast Traffic, it displays the unicast traffic. Broadcast traffic is the network traffic that is sent to every computer in a particular subnet, and is not directed specifically to your computer. Unicast traffic is the traffic that is directed specifically to your computer.

Incoming and Outgoing graphs

Displays the volume of the inbound traffic and the outbound traffic.

Incoming and Outgoing Traffic History graphs

Displays real-time data about the last two minutes of the inbound traffic and the outbound traffic.

This display includes the traffic that is allowed and the traffic that is blocked. The green lines and bars indicate the allowed traffic, and the red coloring indicates the blocked traffic.

Attack History Graph

Displays the number of attacks against your computer.

Running Applications panel

Displays a list of the applications and services that currently access the network.

You can right-click the panel to get the same menu commands as in the View menu.

On an unmanaged client, if you right-click an application in this list, you can also run the following commands on the application:

  • Allow

    The client allows the application to access the network.

  • Ask

    A notification asks you whether you want the application to access the network the next time you attempt to run the application.

  • Block

    The client blocks the application from accessing the network.

  • Terminate

    The client stops the process.

If you click either Allow or Block, the application is added to the list in the View Application Settings dialog box.


802.1x Authentication

A LAN Enforcer enforces Host Integrity on the client. The LAN Enforcer connects to a switch or a wireless access point and can connect to a RADIUS server for additional authentication. You can use the 802.1X Authentication tab to connect your client with a Symantec LAN Enforcer. To work with the LAN Enforcer, the client must be enabled for 802.1x authentication.

Warning:

Check with your administrator before you configure these options. If you configure these options incorrectly, you may not be able to connect to the network.

Table: 802.1x authentication options

Option

Description

Enable 802.1x authentication

Connects a LAN Enforcer to a switch or a wireless access point and to connect to a RADIUS server for additional authentication.

Note:

To use the Symantec Network Access Control client with a third-party supplicant, the Network Threat Protection module of the Symantec Endpoint Protection client must be installed.

Use the client as an 802.1x supplicant

Enables the client to run as an 802.1x supplicant.

This option is applicable if your computer has no 802.1x supplicant and the LAN Enforcer runs as a RADIUS proxy in transparent mode.

You can configure the following options:

  • Use Symantec Transparent Mode

    Enables the client to ignore RADIUS authentication.

  • Allows you to choose the authentication protocol

    Enables you to choose the authentication protocol (PEAP or TLS).

Hold the Windows logon before 802.1x authentication completes

Enables you to delay the Windows logon for a variable number of seconds. This permits the 802.1x authentication to complete before running the normal Windows logon, which might include running specialized logon scripts.


Network Threat Protection Settings: Intrusion Prevention

Use this tab to configure Intrusion Prevention System settings. These settings help detect and protect the client from the attacks that match known intrusion patterns.

Table: Intrusion prevention settings

Option

Description

Enable Network Intrusion Prevention

Applies network IPS signatures and exceptions to IPS signatures to inbound and outbound traffic on the client.

Network attacks are logged in the Security log. You can configure notifications to appear if the client computer detects an attack.

Typically, you should always enable this option. This option is enabled by default.

Enable Browser Intrusion Prevention

Applies IPS Web browser signatures to inbound and outbound browser traffic on the client.

When this option is enabled, the client compares the browser signatures to inbound and outbound traffic from browsers.

Browser attacks are logged in the Security log.

For some browser attacks, intrusion prevention requires that the client terminate the browser. A notification appears on the client computer.

Typically, you should always enable this option. This option is enabled by default.


Network Threat Protection Settings: Logs

Use this tab to configure the Control Log, Packet Log, Client Management Security Log, Client Management System Log, and Traffic Log. You can set the log size, specify how many days that entries are recorded in each log and clear the logs.

Table: Log tab options

Option

Description

Maximum log file size

Specifies the maximum size for the log file, in kilobytes (KB). After you reach the maximum size, the oldest entries are removed and replaced with the most current entries. You can set the size from 64 KB to 15,000 KB (or 15 MB).

Note:

It is recommended to keep the log file size as small as possible.

Save each log entry for

Specifies the number of days to keep the entries in the log before removal.

Clear Log

Clears all entries from the log.

Enable Packet Log

Records the packet information in the Packet Log.


Network Threat Protection Settings: Microsoft Windows Networking

Use this tab to specify the network adapter and network browsing rights.

Table: Microsoft Windows Networking options

Option

Description

Select the adapter you wish to configure

Specifies the network interface card through which the network traffic passes.

Browse files and printers on the network

Enables you to browse other computers, devices, and printers in your network.

Note:

If you disable this option, you cannot copy files from network locations.

Share my files and printers with others on the network

Allows other users in your network to browse files and folders on your computer.

Block Microsoft Windows Networking traffic while the screen saver runs

Automatically blocks all Network Neighborhood traffic when your computer's screen saver is activated. As soon as you use the computer again, the protection returns to the previously assigned level.


Network Threat Protection: Notifications

You can enable or disable Intrusion Prevention notifications. You can also enable or disable whether or not an audible alert plays when the notification appears.

On managed clients, your administrator might prevent you from configuring these settings.

Table: Network Threat Protection notifications settings

Option | Description
Display Intrusion Prevention notifications | Displays the notifications every time an IPS signature detects an intrusion prevention attempt. If the client detects a second attack when a previous notification is displayed, you continue to see one notification only.
Use sound when notifying users | Triggers a sound when the notifications appear.


Network Threat Protection Settings: Firewall

Use this tab to enable firewall settings. These settings help detect and protect the client from the attacks that occur through network traffic.

Table: Firewall settings

Options

Description

Enable Smart DHCP

Allows only the outbound DHCP requests and inbound DHCP replies. Smart DHCP also allows DHCP renew.

Alternatively, to use DHCP you must create a firewall rule that allows UDP traffic on remote ports 67 (bootps) and 68 (bootpc).

The Dynamic Host Configuration Protocol (DHCP) is a protocol that assigns a dynamic IP address to a device on a network. Dynamic addresses enable a device to have a different IP address every time it connects to an enterprise network. DHCP supports both the static IP addresses and the dynamic IP addresses. Dynamic addresses simplify network administration because the software keeps track of IP addresses. Otherwise, the administrator must manually assign a unique IP address every time a computer is added to an enterprise network. If a client moves from one subnet to another, DHCP can make the appropriate adjustments to a client's IP configuration.

Enable Smart DNS

Allows the outbound DNS requests to and the corresponding inbound replies from assigned DNS servers only.

If a computer sends out a DNS request and the response comes back within five seconds, the communication is allowed. All other DNS packets are dropped.

To use DNS, you can also create a firewall rule that allows UDP traffic for remote port 53 (domain).

Enable Smart WINS

Allows the outbound WINS requests to and the corresponding inbound replies from assigned WINS servers only.

If a computer sends out a WINS request and the response comes back within five seconds, the communication is allowed. All other WINS packets are dropped.

Alternatively, to use WINS you must create a firewall rule that allows UDP packets on remote port 137.

WINS provides a distributed database that registers and queries dynamic mappings of NetBIOS names for the computers and the groups that a network uses. WINS maps the NetBIOS names to the IP addresses. WINS is used for NetBIOS name resolution in the routed networks that use NetBIOS over TCP/IP. The NetBIOS names are a requirement to establish networking services in earlier versions of Microsoft operating systems. The NetBIOS naming protocol is compatible with network protocols other than TCP/IP, such as NetBEUI or IPX/SPX. However, WINS was designed specifically to support NetBIOS over TCP/IP (NetBT). WINS simplifies the management of the NetBIOS namespace in TCP/IP-based networks.

Enable NetBIOS protection

Blocks the NetBIOS traffic from an external gateway.

You can use Network Neighborhood file and printer sharing on a LAN and protect a computer from NetBIOS exploits from any external network. This option blocks the NetBIOS packets that originate from the IP addresses that are not part of the defined ICANN internal ranges. ICANN internal ranges include 10.x.x.x, 172.16.x.x, 192.168.x.x, and 169.254.x.x, with the exception of the 169.254.0.x and 169.254.255.x subnets. The NetBIOS packets include UDP 88, UDP 137, UDP 138, TCP 135, TCP 139, TCP 445, and TCP 1026.

Note:

The NetBIOS protection can cause a problem with Microsoft Outlook if the client computer connects to a Microsoft Exchange Server that is on a different subnet. You can create a firewall rule that specifically allows access to that server.

Allow token ring traffic

Allows the client computers that connect through a token ring adapter to access the network, regardless of the firewall rules on the client.

If you disable this setting, any traffic that comes from the computers that connect through a token ring adapter cannot access the corporate network. The firewall does not filter token ring traffic. It either allows all token ring traffic or blocks all token ring traffic.

Enable anti-MAC spoofing

Allows the inbound and the outbound ARP (Address Resolution Protocol) traffic only if an ARP request was made to that specific host. It blocks all other unexpected ARP traffic and logs it in the Security log.

Some hackers use MAC spoofing to try to hijack a communication session between two computers. Media access control (MAC) addresses are the hardware addresses that identify the computers, the servers, the routers, and so forth. When computer A wants to communicate with computer B, it may send an ARP packet to the computer.

Anti-MAC spoofing protects a computer from letting another computer reset a MAC address table. If a computer sends an ARP REQUEST message, the client allows the corresponding ARP RESPOND message within a period of 10 seconds. All client rejects all unsolicited ARP RESPOND messages.

Enable network application monitoring

Allows the client to monitor changes to the network applications that run on the client computer.

Network applications send and receive traffic. The client detects whether an application's content changes.

Block all traffic until the firewall starts and after the firewall stops

Blocks all inbound traffic to and outbound traffic from the client computer when the firewall does not run for any reason.

The computer is not protected:

  • After the client computer turns on and before the firewall service starts

  • After the firewall service stops and the client computer stops

This time frame is a small security hole that can allow unauthorized communication. This setting prevents unauthorized applications from communicating with other computers.

Note:

When Network Threat Protection is disabled, the client ignores this setting.

Allow initial DHCP and NetBIOS traffic

Allows the initial traffic that enables network connectivity. This traffic includes the initial DHCP and NetBIOS traffic that allows the client to obtain an IP address.

Unmatched IP Traffic Settings

Controls the incoming IP traffic and outgoing IP traffic that does not match any firewall rules. IP traffic includes the data packets that flow through IP networks and that use the TCP, UDP, and ICMP protocols. Applications, mail exchanges, file transfers, ping programs, and Web transmissions are types of IP traffic.

You can configure the following IP traffic settings:

  • Allow IP traffic

    Allows any incoming traffic and outgoing traffic, unless a firewall rule states otherwise. For example, if you add a firewall rule that blocks VPN traffic, the firewall allows all other traffic except for the VPN traffic.

  • Allow only application traffic

    Allows the traffic to and from applications and blocks the traffic that is not associated with any application. For example, the firewall allows Internet Explorer but blocks VPN traffic, unless a rule states otherwise.

  • Prompt before allowing application traffic

    Displays a message that asks you whether to allow or block an application. For example, you may want to choose whether or not to block media files. Or, you may want to hide broadcasts from the NTOSKRNL.DLL process. The NTOSKRNL.DLL process can be an indication of spyware, because spyware often downloads and installs the NTOSKRNL.DLL process.

Number of seconds to automatically block an attacker's IP address

Automatically blocks the IP address of a known intruder for a configurable number of seconds.

If Symantec Endpoint Protection detects a network attack, it can automatically block the connection to ensure that the client computer is safe. The client activates an Active Response, which automatically blocks all communication to and from the attacking computer for a configurable period of time.

The IP address of the attacking computer is blocked for a single location.

Enable stealth mode Web browsing

Detects the HTTP traffic from a Web browser on any port and removes the following information: the browser name and version number, the operating system, and the reference Web page. It stops Web sites from knowing which operating system and browser the computer uses. It does not detect HTTPS (SSL) traffic.

Warning:

Stealth mode Web browsing may cause some Web sites not to function properly. Some Web servers build a Web page that is based on information about the Web browser. Because this option removes the browser information, some Web pages may not appear properly or at all. Stealth mode Web browsing removes the browser signature, called the HTTP_USER_AGENT, from the HTTP request header and replaces it with a generic signature.

Enable TCP resequencing

Prevents an intruder from forging or spoofing an individual's IP address.

Hackers use IP spoofs to hijack a communication session between two computers, such as computer A and B. A hacker can send a data packet that causes computer A to drop the communication. Then the hacker can pretend to be computer A and communicate with and attack computer B. To protect the computer, TCP resequencing randomizes TCP sequence numbers.

Note:

OS fingerprint masquerading works best when TCP resequencing is enabled.

Warning:

TCP resequencing changes the TCP sequencing number when the client service runs. The sequencing number is different when the service runs and when the service does not run. Therefore, the network connections are terminated when you stop or start the firewall service. TCP/IP packets use a sequence of session numbers to communicate with other computers. When the client does not run, the client computer uses the Windows number scheme. When the client runs and TCP resequencing is enabled, the client uses a different number scheme. If the client service suddenly stops, the number scheme reverts back to the Window number scheme and Windows then drops the traffic packets. Furthermore, TCP resequencing may have a compatibility issue with certain NICs that causes the client to block all inbound traffic and outbound traffic.

Enable OS fingerprint masquerading

Prevents the detection of the operating system of a client computer. The client changes the TTL and identification value of TCP/IP packets to prevent the identification of an operating system.

Note:

OS fingerprint masquerading works best when TCP resequencing is enabled.

Warning:

TCP resequencing may have a compatibility issue with certain NICs that causes the client to block all inbound traffic and outbound traffic.


Add or Edit Firewall Rule: Applications

You can specify an application that triggers the firewall rule. For example, if you want to allow your computer to open Internet Explorer and search for Web pages, you add iexplore.exe to the list. You must add the applications that are likely to access your network connection or that you need to run regularly.

Table: Application options

Option

Description

Display selected applications only

Displays only the applications that are checked in the File Name column.

These applications trigger the rule.

Applications

Lists the file name, version number, and path and executable name of the application or service you want to allow or block.

The File Name column includes a check box. If you check the check box for the selected application, the client either allows or blocks the application. The firewall rule ignores applications when the check box is unchecked.


Add or Edit Firewall Rule: General

Use this dialog box to set the rule name, the rule action, the network adapter trigger, and several other general options.

Table: General firewall rule options

Option

Description

Rule name

Name of the rule.

Be specific when you name the rule. For instance, "Block After 1 AM" is a better name for a rule than "Rule1."

Block this traffic

Blocks the traffic that is specified by the rule so that it does not access your network.

Allow this traffic

Lets the traffic that is specified by the rule to access your network.

Apply this rule to the following network adapter

Applies the rule to the selected network adapter.

Apply this rule while the screen saver is

Activates the rule depending on the state of the screen saver:

  • On

    The rule is activated only when the screen saver is on.

  • Off

    The rule is activated only if the screen saver is off and all other conditions are satisfied.

  • Either On or Off

    The rule is unaffected by the screen saver.

Record this traffic in the Packet Log

Records the traffic that is affected by this rule in the Packet log.

You do not have to enable the Packet log for the client to record traffic.

See Network Threat Protection Settings: Logs.


Add or Edit Firewall Rule: Hosts

Use the host options to specify the source of the traffic that triggers the firewall rule. For example, you may want to allow only the traffic from the computers that have an IP address range of 192.168.0.1 to 198.168.0.76.

Table: Host options

Option

Description

All hosts

Any IP address, MAC address, or subnet address and subnet mask.

MAC address

The unique hardware address that identifies computers, servers, routers, and other network devices.

The 12-character MAC address uses the hexadecimal format of xx-xx-xx-xx-xx-xx. The xx represents 0-9 and A-F or a-f.

IP addresses

IP address or IP address range.

Separate multiple IP addresses and multiple IP address ranges by using a comma (,). For example, 10.0.0.1, 192.168.0.1-198.168.0.76.

Subnet

Specifies the following information about the subnet:

  • Subnet IP address

    IP address of the subnet.

  • Subnet mask

    Network and node parts of the address. The subnet mask format is nnn.nnn.nnn.nnn. For example, you might use 255.255.255.0.


Add or Edit Firewall Rule: Ports and Protocols

You can define the network service that triggers the firewall rule. The service is based on its protocol, port, and the direction of the traffic.

Table: Port and protocol options

Option

Description

Protocol

Applies the rule to one of the following protocols:

  • All IP Protocols

    Applies to any protocols on any port, for both the inbound and the outbound traffic.

  • TCP

    Packet filters that use TCP and UDP require you to define the originating and target port numbers of inbound and outbound traffic. The port number identifies the application that runs over TCP and UDP. In the client, you can define the remote ports and the local ports. Local and remote ports are commonly used to set up host-based firewalls.

  • UDP

    For UDP communications, the client analyzes the first UDP datagram and applies the action that is taken on the initial datagram to all subsequent UDP datagrams for the current program session. Inbound or outbound traffic between the same computers is considered part of the UDP connection.

    If you specify either the TCP or the UDP protocol, configure the local port, remote port, and traffic direction.

    • Remote ports

      Computer that communicates with the client computer.

    • Local ports

      Client computer.

      When the client computer connects to a remote desktop, the remote port is 3389 on port TCP. The local port is the same, for both inbound traffic and outbound traffic.

      If you do not select a port number, all ports trigger the rule. If you enter a port number for the local port, but not for the remote port, then the specific local port you entered and all remote ports trigger the rule.

    • Stateful UDP

      For stateful UDP traffic, when a UDP connection is made, the inbound UDP communication is allowed, even if the firewall rule blocks it. The firewall uses stateful inspection to track the connection information. For example, if a rule blocks inbound UDP communications for a specific application, but you choose to allow an outbound UDP datagram, all inbound UDP communications are allowed for the current application session. For stateless UDP, you must create a firewall rule to allow the inbound UDP communication response. For the traffic that is initiated in one direction, you do not have to create the rules that permit the traffic in both directions. TCP automatically includes stateful inspection.

    A UDP session times out after 40 seconds if the application closes the port.

  • ICMP

    Controls the messages that report the errors in traffic communication, such as Echo Reply.

  • Specific IP Protocol

    Any type and code between 0 and 255.

  • Ethernet

    Ethernet protocols are the group of LANs that the IEEE 802.3 covers.

Traffic direction

Specifies the direction that the network traffic goes, in reference to your computer.

  • Incoming

    The traffic that goes to your computer.

  • Outgoing

    The traffic that comes from your computer.

  • Both

    The traffic that goes both to your computer and from your computer.


Add or Edit Firewall Rule: Scheduling

Use scheduling options to configure a time period when a rule is active or not active. For example, you may want the rule to be inactive when you install new applications.

Table: Scheduling options

Option | Description
Enable Scheduling | Enables the scheduling feature.
During the time period below | Enables the rule to take place during a certain time period.
Excluding the time period below | Enables the rule to take place outside of a certain time period.
Beginning At | Specifies the month, day, hour, and minute that the schedule begins.
Duration | Specifies the number of days, hours, and minutes that a time period lasts. For example, you may want the time period to start at 8 A.M. and end at 10 A.M. In the Beginning At group box, set the Hour field to 08 (for 8 A.M.). In the Duration group box, set Hours to 2.


Insight Lookup

Insight Lookup detects the files that might not typically be detected as risks and sends the files to Symantec for evaluation. If Symantec determines that the files are risks, the client computer then handles the files as risks.

Symantec uses the latest virus definitions as well as reputation data to evaluate the files. Reputation data is the information that Symantec collects about the potential maliciousness of a file. You can change how sensitive Insight Lookup is to file reputation. A lower sensitivity level might reduce false positive detections.

Note:

Insight Lookup does not run on right-click scans of folders or drives. It does run on right-click scans of selected files.


Bloodhound

Bloodhound isolates and locates the logical regions of a file to detect a high percentage of unknown viruses. Bloodhound then analyzes the program logic for virus-like behavior.


File Reputation

The file reputation indicates how potentially harmful or not harmful a file might be. Symantec determines a file's reputation by collecting information about the file's characteristics.


Insight

Insight allows scans to skip trusted good files. Some files contain typical vulnerabilities. After those files are scanned initially, subsequent scans can skip the files since vulnerability definitions rarely change. Insight also uses file reputation data to skip the files that Symantec trusts as good (more secure) or the community trusts as good (less secure). Using the Insight option might improve scan performance.


SONAR

SONAR is the real-time protection that detects potentially malicious applications when they run on your computers. SONAR uses heuristics as well as reputation data to detect emerging and unknown threats. SONAR provides "zero-day" protection because it detects threats before traditional virus and spyware detection definitions have been created to address the threats.


Risk Categories

There are different categories for risk types. The Malware category includes a subcategory called Virus. Macro and non-macro virus categories were included in earlier versions of the product. Macro and non-macro viruses are now detected as part of the Virus subcategory.

Security risks include spyware, adware, and other applications that can put a computer at risk. The Security risks subcategories change dynamically over time as Symantec gets new information about risks.