Symantec Mobile AntiVirus for Windows Mobile Implementation Guide

Transcription

1 Symantec Mobile AntiVirus for Windows Mobile Implementation Guide

2

3 Contents Chapter 1 Introducing Symantec Mobile AntiVirus... 7 About Symantec Mobile AntiVirus... 7 Components of Symantec Mobile AntiVirus... 8 How Symantec Mobile AntiVirus works... 9 How the devices are protected How threat protection and Symantec Mobile AntiVirus are updated How events are logged Where to get more information Chapter 2 Installing Symantec Mobile AntiVirus Before you install System requirements for administration tools System requirements for devices Installing the management components of Symantec Mobile AntiVirus Installing the wireless administration tools Installing the Symantec System Center tools Installing Symantec Mobile AntiVirus on the devices Installing Symantec Mobile AntiVirus on devices by using the installation wizard Installing Symantec Mobile AntiVirus on devices by using Symantec System Center Installing Symantec Mobile AntiVirus on devices by copying and transferring installation files Testing the installation Uninstalling the Symantec Mobile AntiVirus client software on the devices Uninstalling Symantec Mobile AntiVirus administration tools Chapter 3 How Symantec Mobile AntiVirus protects devices About scanning for and responding to threats About Auto-Protect scans... 23

4 4 Contents About compressed file scans About remote threat scans About scan configuration options About the Activity Log Threat-related activities LiveUpdate-related activities When the Activity Log is full About SMS AntiSpam Configuring SMS AntiSpam Numbers and number matching Chapter 4 Updating devices About updating devices About LiveUpdate Wireless About LiveUpdate Repackager Using LiveUpdate Repackager About LiveUpdate Repackager command-line syntax Checking the version numbers of the products on devices About updates using multiple versions of a product About scheduled updates or reminders About transferring update files Chapter 5 Configuring Symantec Mobile AntiVirus on the devices About configuring Symantec Mobile AntiVirus Creating configuration files by using Symantec Settings Builder About the output files About troubleshooting configuration files Creating configuration files by using Symantec System Center Configuring Symantec AntiVirus settings Configuring LiveUpdate Wireless settings About transferring configuration files to the devices About testing a new configuration Chapter 6 Event log management and reporting About event logging and reporting Viewing event logs in an MDM About the symlog.xml file Viewing histories and event logs in Symantec System Center Configuring event log forwarding in Symantec System Center... 46

5 Contents 5 Appendix A Communicating directly with devices over the air About the Short Message Service (SMS) Listener SMS message format SMS message payload fields Authenticating and sending SMS messages About the command-line program Initiating remote operations by using SMS or the command-line program Index... 53

6 6 Contents

7 Chapter 1 Introducing Symantec Mobile AntiVirus This chapter includes the following topics: About Symantec Mobile AntiVirus Components of Symantec Mobile AntiVirus How Symantec Mobile AntiVirus works Where to get more information About Symantec Mobile AntiVirus Symantec Mobile AntiVirusprovides secure mobile computing through comprehensive, reliable protection against malicious attacks that are directed at devices. The AntiVirus and LiveUpdate functions of Symantec Mobile AntiVirus can be managed by either Symantec System Center or another Mobile Device Management system. You can configure devices remotely to pick up virus definitions and product updates. These can be obtained either directly from the Symantec LiveUpdate servers or from an internal LiveUpdate server in your network. Figure 1-1 describes the components of Symantec Mobile AntiVirus.

8 8 Introducing Symantec Mobile AntiVirus Components of Symantec Mobile AntiVirus Figure 1-1 Symantec Mobile AntiVirus Administrator Installation files Configuration files SMS messaging Device user Internal LiveUpdate Server Virus definitions files Internet Symantec LiveUpdate Although Symantec Mobile AntiVirus is designed for wireless management, you can also install, configure, and update the client software by synchronizing with a desktop system. You can transfer installation, configuration, and update files to your organization s devices by using Symantec System Center or any TCP/IP connection on an existing MDM system. Components of Symantec Mobile AntiVirus Table 1-1 describes the components of Symantec Mobile AntiVirus.

9 Introducing Symantec Mobile AntiVirus How Symantec Mobile AntiVirus works 9 Table 1-1 Symantec Mobile AntiVirus components Component What it does Where it resides Wireless administration tools Allow administrators to perform the following tasks: Repackage updates that are obtained by running the LiveUpdate Administration Utility, to distribute to devices. Create configuration files to set and lock Symantec AntiVirus and LiveUpdate Wireless configuration settings on devices. On the administrator's computer or on an MDM system Symantec System Center Plugin tool You can run MDM software to distribute files to devices, or you can distribute files over any TCP/IP connection. Allows administrators to create configuration files to set and lock Symantec AntiVirus and LiveUpdate Wireless configuration settings on devices. On the administrator's computer or a computer with Symantec System Center installed Symantec System Center Client tool Provides communication between Symantec System Center client computers and the devices that synchronize with them. On the Symantec AntiVirus server or client with which the devices synchronize Symantec AntiVirus software LiveUpdate Wireless software Provides on-demand virus scans on devices and logs antivirus activities. Scheduled scans on the devices are possible only if they are configured by the administrator. Symantec AntiVirus software is installed when the installation files are transferred to the devices and run. Allows users to update virus definitions files and product software over a wireless Internet connection. LiveUpdate Wireless obtains updates from the Symantec LiveUpdate server or from an internal LiveUpdate server. The LiveUpdate Wireless installation is part of the client software installation. On the device On the device How Symantec Mobile AntiVirus works The Symantec Mobile AntiVirus components work together to protect the devices from threats. To understand how Symantec Mobile AntiVirus works, you need to know the following: How the devices are protected

10 10 Introducing Symantec Mobile AntiVirus How Symantec Mobile AntiVirus works How threat protection and Symantec Mobile AntiVirus are updated How events are logged How the devices are protected Symantec Mobile AntiVirus uses virus definitions files to identify known threats. As files are accessed on the device, Auto-Protect provides automatic, real-time threat scanning. Users can also perform on-demand scans. By default, when Auto-Protect detects a suspicious file, it sends the file to the Quarantine. Infected files in the Quarantine are secure and cannot spread threats into other areas of the device. Table 1-2 describes the types of scans that Symantec Mobile AntiVirus supports. Table 1-2 Types of scans Scan type Auto-Protect Description Real-time scanning continuously inspects files as users access them on the devices. Real-time protection is enabled by default. Administrators can lock Auto-Protect settings to enforce a threat policy. See About Auto-Protect scans on page 23. Post-synchronization Expansion card scanning Scan after update On-demand/scheduled Files are scanned after each synchronization. This setting is disabled by default. Administrators can lock this setting to prevent users from cancelling scans. Files are scanned as expansion cards are inserted into the device. This setting is disabled by default. Administrators can lock this setting to enforce a scanning policy. Files are scanned after virus definitions updates. This setting is enabled by default. Administrators can lock this setting to prevent users from cancelling scans. On-demand (manual) and scheduled scans inspect files and folders on the device. Administrators can lock this setting to enforce a scanning policy. Note: Users cannot change options that the administrator locks. See About configuring Symantec Mobile AntiVirus on page 37.

11 Introducing Symantec Mobile AntiVirus Where to get more information 11 How threat protection and Symantec Mobile AntiVirus are updated Symantec TM Security Response provides administrators and users with regular updates to virus definitions files to keep their virus protection current. Symantec can also provide software updates to Symantec Mobile AntiVirus. Symantec Mobile AntiVirus offers the following methods of obtaining updates: LiveUpdate Wireless that connects to the Symantec LiveUpdate server LiveUpdate Wireless that connects to an internal LiveUpdate server LiveUpdate Wireless, then repackage and transfer update files Device users obtain virus definitions and product updates from the LiveUpdate server. Administrators initiate and schedule virus definitions updates by using Symantec System Center. For more information, see the Symantec System Center Administrator's Guide. Device users obtain virus definitions and product updates from the internal LiveUpdate server. Administrators initiate and schedule virus definitions updates by using Symantec System Center. For more information, see the Symantec System Center Administrator's Guide. Administrators repackage the LiveUpdate files that they obtain by running the LiveUpdate Administration Utility. They transfer the updates to the devices by using MDM software or any TCP/IP-based network connection. See About updating devices on page 29. How events are logged The Symantec Mobile AntiVirus software on the device records information about the antivirus activities that are performed on the device. It also records information about the updates. See About the Activity Log on page 25. Administrators can retrieve event logs from the devices for analysis and reporting. See About event logging and reporting on page 43. Where to get more information On-device Help is installed with the product software on the devices. For late-breaking news, you can read the Readme.txt file, which is located in the product layout in the root directory.

12 12 Introducing Symantec Mobile AntiVirus Where to get more information On the Symantec Support Web site, you can find the latest protection and program updates, patches, online tutorials, Knowledge Base articles, and threat removal tools. Go to the following Web address:

13 Chapter 2 Installing Symantec Mobile AntiVirus This chapter includes the following topics: Before you install System requirements for administration tools System requirements for devices Installing the management components of Symantec Mobile AntiVirus Installing Symantec Mobile AntiVirus on the devices Testing the installation Uninstalling the Symantec Mobile AntiVirus client software on the devices Uninstalling Symantec Mobile AntiVirus administration tools Before you install If you're planning on setting up an internal LiveUpdate server, you will need to produce update files for the devices using the LiveUpdate Administration Utility. You use the files that are produced by the LiveUpdate Administration Utility as the input to LiveUpdate Repackager. The files that LiveUpdate Repackager creates are then transferred to the devices to update them. LiveUpdate Repackager requires that you have LiveUpdate and the LiveUpdate Administration Utility installed on a computer. If you're using Symantec System Center as your mobile device management system, LiveUpdate is already installed as part of Symantec Client Security or Symantec AntiVirus Corporate Edition.

14 14 Installing Symantec Mobile AntiVirus System requirements for administration tools Note: LiveUpdate is not the same as the LiveUpdate Wireless component that is part of Symantec Mobile AntiVirus. The LiveUpdate Administration Utility (LUAU.exe) is available on the Symantec AntiVirus 10.1 Corporate Edition CD and the Symantec Client Security 3.0 CD in the Tools\LiveUpdate folder. The latest version of the LiveUpdate Administration Utility, and supporting documentation are available by searching on LU Admin in the Symantec Knowledge Base at the following URL: System requirements for administration tools You use the wireless administration tools together with a mobile device management system (MDM) or with any custom management tools that you have developed. Table 2-1 describes the wireless administration tools system requirements. Table 2-1 Wireless administration tools system requirements Operating system or software Minimum requirements Windows 2000 Server/Advanced Server/Professional with Service Pack 2 Windows XP Home/Professional with Service Pack 2 Windows 2003.NET Server Intel Pentium or compatible processor, 400 MHz or greater 256 MB of RAM 120 MB of hard disk space for the software; 250 MB for the required SQL Server database LiveUpdate and the LiveUpdate Administration Utility Must be installed to provide input to LiveUpdate Repackager tool. Refer to your LiveUpdate Administrator's Guide for these system requirements. You use the Symantec System Center tools if you already use Symantec System Center to manage other client systems in your organization. Table 2-2 lists the Symantec System Center tools requirements.

15 Installing Symantec Mobile AntiVirus System requirements for devices 15 Table 2-2 Symantec System Center tools requirements Symantec System Center tool Symantec System Center Plugin Symantec System Center Client Requirements Symantec System Center installed with either Symantec AntiVirus 10.1, Symantec AntiVirus 10.1 Corporate Edition, or Symantec Client Security 3.0. Symantec AntiVirus 10.1, Symantec AntiVirus 10.1 Corporate Edition, or Symantec Client Security 3.0. System requirements for devices Table 2-3 lists system requirements for devices. Table 2-3 Device requirements Component Operating system on the device Minimum requirements Windows Mobile 5.0/6.0 Operating system on the client computer Windows XP Home Edition/Professional Edition with Service Pack 2 Windows Vista Memory on the device (installation footprint) Synchronization software on the client computer 2.5 MB RAM On computers running Windows XP: To synchronize with Windows Mobile 5 devices: ActiveSync 4.1 or later To synchronize with Windows Mobile 6 devices: ActiveSync 4.5 or later On computers running Windows Vista: Windows Mobile Device Center 6.0 LiveUpdate Wireless Wireless Internet support that uses the built-in TCP/IP stack. The following terms are used throughout this document to represent the devices running Windows Mobile: WM Professional: represents Windows Mobile 6 Professional and Windows Mobile 5 Pocket PC

16 16 Installing Symantec Mobile AntiVirus Installing the management components of Symantec Mobile AntiVirus WM Standard: represents Windows Mobile 6 Standard and Windows Mobile 5 Smartphone Installing the management components of Symantec Mobile AntiVirus To install the management components of Symantec Mobile AntiVirus, you need to perform the following tasks: If you're using Settings Builder with your MDM system, install the wireless administration tools. See Installing the wireless administration tools on page 16. If you're using Symantec System Center, install the Symantec System Center tools. See Installing the Symantec System Center tools on page 16. Installing the wireless administration tools You need to copy the administration tools files to an administrator's computer or to the computer that hosts your MDM system. Although LiveUpdate and the LiveUpdate Administration Utility can reside on a different computer than LiveUpdate Repackager, it is convenient to have all of these tools on the same computer so that you do not need to move files or type long paths when you use the tools. To install the wireless administration tools 1 Insert the Symantec Mobile AntiVirus CD into the CD-ROM drive. 2 Click Browse CD. 3 Open the TOOLS folder. 4 Copy the following files to any directory on your computer: lur.exe ssb.exe sb.ini Installing the Symantec System Center tools You install the plugin tool on the computer that hosts Symantec System Center. You install the client tool on the Symantec AntiVirus server or client computer

17 Installing Symantec Mobile AntiVirus Installing Symantec Mobile AntiVirus on the devices 17 with which the devices synchronize. The client computer can be managed or unmanaged. To install the Symantec System Center plugin 1 Insert the Symantec Mobile AntiVirus CD into the CD-ROM drive. 2 Click Symantec System Center Plugin for Mobile AntiVirus. 3 In the welcome panel, click Next. 4 In the license panel, click I accept the license agreement, and then click Next. 5 In the destination panel, to accept the default location, click Next. 6 In the ready to install panel, click Next. 7 To complete installation, click Finish. To install the Symantec System Center client 1 Insert the Symantec Mobile AntiVirus CD into the CD-ROM drive. 2 Click Symantec System Center Client for Mobile AntiVirus. 3 In the welcome panel, click Next. 4 In the license panel, click I accept the license agreement, and then click Next. 5 In the destination panel, to accept the default location, click Next. 6 In the ready to install panel, click Next. 7 To complete installation, click Finish. Installing Symantec Mobile AntiVirus on the devices The Symantec Mobile AntiVirus client software can be installed on your organization's devices in any of the following ways, depending on the tools that you use. Installation to the default directory in RAM is the only supported installation configuration. You can have your users install by using the installation wizard on the CD, and then synchronizing the devices with their desktop computers. See Installing Symantec Mobile AntiVirus on devices by using the installation wizard on page 18. If you use Symantec System Center, you can install to devices by using the ClientRemote Install Tool. See Installing Symantec Mobile AntiVirus on devices by using Symantec System Center on page 19.

18 18 Installing Symantec Mobile AntiVirus Installing Symantec Mobile AntiVirus on the devices You can install by copying the installation files to a computer, and then transferring the files by using your MDM software, or any TCP/IP-based network connection in your existing infrastructure. See Installing Symantec Mobile AntiVirus on devices by copying and transferring installation files on page 19. Note: When you install Symantec Mobile AntiVirus to Windows Mobile 5.0 devices, an unknown publisher message may appear. Users should tap Yes to continue with installation. Installing Symantec Mobile AntiVirus on devices by using the installation wizard Appropriate synchronization software must be installed on the computer that you are using for installation. You must also have administrator privileges on the computer. Symantec Mobile AntiVirus installation software determines whether you have appropriate synchronization software installed, and installs Symantec Mobile AntiVirus for your devices. To install on devices by using the installation wizard 1 Insert the Symantec Mobile AntiVirus CD into the CD-ROM drive. The installation should start automatically. If the installation does not start, navigate to the root of the CD, and double-click Start.exe. 2 Follow the on-screen instructions to install to your device. 3 After installation completes, ensure that the following folders appear on the device:..\program Files\Symantec\ AntiVirus\.....\Program Files\Symantec\ LiveUpdate\.....\Program Files\Symantec SymEvent\.....\Program Files\Openbit\... On the device, the Programs > Symantec folder contains the following software: Symantec Mobile AntiVirus and LiveUpdate Wireless.

19 Installing Symantec Mobile AntiVirus Installing Symantec Mobile AntiVirus on the devices 19 Installing Symantec Mobile AntiVirus on devices by using Symantec System Center If you use Symantec System Center, you can install Symantec Mobile AntiVirus to devices by using the ClientRemote Install tool. To install Symantec Mobile AntiVirus to devices by using Symantec System Center 1 In Symantec System Center, on the Tools menu, click ClientRemote Install. 2 In the welcome panel, click Next. 3 In the location panel, click Browse. Do not use the default location, which points to Symantec Client Security file locations. 4 Navigate to the Symantec Mobile AntiVirus folder, and then click Next. For example: C:\Program Files\Symantec\Symantec System Center Plugin for Mobile AntiVirus\Client Install 5 In the Select Computers panel, in the left pane, select the Symantec AntiVirus client computer to which you want to install Symantec Mobile AntiVirus. 6 In the right pane, select the Symantec AntiVirus server that you want to act as the parent server for Symantec Mobile AntiVirus, and then click Finish. Installing Symantec Mobile AntiVirus on devices by copying and transferring installation files You can install Symantec Mobile AntiVirus by copying the installation files, and then pushing them to the devices by using MDM software. You can also transfer them by using any other TCP/IP-based network connection in your existing infrastructure. To copy the Symantec Mobile AntiVirus installation files for your devices 1 Insert the Symantec Mobile AntiVirus CD into the CD-ROM drive. 2 Click Browse CD. 3 Open the INSTALL folder. 4 Copy SAVCE.arm.cab to the location from which you usually push files to your devices. 5 Under Attributes, ensure that Read-only is unchecked, and then click OK.

20 20 Installing Symantec Mobile AntiVirus Testing the installation 6 Configure your MDM system or other mechanism to put the SAVCE.arm.cab file in any location on the devices, and to launch the file automatically. Or, if you plan to have users install Symantec Mobile AntiVirus on their own devices, you can the file to users or have them pick up the file from a central server. 7 After installation, an icon for Symantec Mobile AntiVirus appears on the device's Programs screen. Installing Symantec Mobile AntiVirus silently on devices You can also install Symantec Mobile AntiVirus on your organization's devices without displaying the End User License Agreement (EULA) or the installation progress bar on the devices. This is sometimes called a silent installation. To install Symantec Mobile AntiVirus silently on devices 1 Create a blank text file and name it bfsilent.txt. 2 Configure your MDM system or other mechanism to put the file in the root folder of each device. 3 Run the following command to start the installer: wceload.exe /silent <path>\symmss.cab 4 After the installation finishes, the device automatically restarts. You may want to warn users about an unexpected restart. Testing the installation You can verify that Symantec Mobile AntiVirus is active by downloading the standard European Institute for Computer Anti-Virus Research (EICAR) test file, and copying it to the device. To test the installation 1 Download the EICAR test file from the following URL: You may need to temporarily disable threat scanning on your computer to access the EICAR test file. Make sure that you re-enable threat scanning on your computer after you are finished. 2 Copy the EICAR file to the device. A successful installation of Symantec Mobile AntiVirus displays a dialog box when the EICAR test file is copied to the device.

21 Installing Symantec Mobile AntiVirus Uninstalling the Symantec Mobile AntiVirus client software on the devices 21 Uninstalling the Symantec Mobile AntiVirus client software on the devices At some point, you may need to uninstall the Symantec Mobile AntiVirus client software on your organization's devices. First, delete or remove the Symantec Mobile AntiVirus files from the devices. To uninstall Symantec Mobile AntiVirus on the devices 1 Tap Start > Settings. 2 At the bottom of the screen, on the System tab, tap Remove Programs. 3 Tap Symantec Mobile AntiVirus, and then tap Remove. Uninstalling Symantec Mobile AntiVirus administration tools To uninstall thesymantec Mobile AntiVirus administration tools, do the following: If you're using Settings Builder, delete the wireless administration tool files from the administrator's computer or the computer that hosts your MDM system If you're using Symantec System Center, uninstall the client and plugin for Symantec Mobile AntiVirus. To uninstall the wireless administration tools files 1 Locate and delete the following wireless administration tool files from the administrator's computer: lur.exe ssb.exe sb.ini 2 Locate and delete any *.cfg, and *.zip files that were generated by running the tools. To uninstall the Symantec System Center client 1 On the Windows Start menu, click Settings > Control Panel > Add/Remove Programs. 2 Click Symantec System Center Client for Mobile AntiVirus, and then click Remove.

22 22 Installing Symantec Mobile AntiVirus Uninstalling Symantec Mobile AntiVirus administration tools To uninstall the Symantec System Center plugin 1 On the Windows Start menu, click Settings > Control Panel > Add/Remove Programs. 2 Click Symantec System Center Plugin for Mobile AntiVirus, and then click Remove.

23 Chapter 3 How Symantec Mobile AntiVirus protects devices This chapter includes the following topics: About scanning for and responding to threats About Auto-Protect scans About compressed file scans About remote threat scans About scan configuration options About the Activity Log About SMS AntiSpam About scanning for and responding to threats When Symantec Mobile AntiVirus detects a threat, the user can take an action. The type of action that the user takes depends on the nature of the threat and the options that you configure for the devices. You can configure and lock scan settings by using a configuration file that is pushed to the devices. See About configuring Symantec Mobile AntiVirus on page 37. About Auto-Protect scans As users access files on the devices, Auto-Protect provides real-time threat scanning. By default, when Auto-Protect detects a suspicious file, it moves the

24 24 How Symantec Mobile AntiVirus protects devices About compressed file scans file to the Quarantine. Infected files in the Quarantine are secure and cannot spread threats into other areas of the device. If the automatic action fails, the next action is Deny Access. Table 3-1 describes the automatic actions that are available. Table 3-1 Action Log Only Deny Access Delete Quarantine Automatic actions Description Adds a log entry Does not allow any application to open the infected file. Deletes the infected file and is the recommended action (Default) Moves the infected file to the Quarantine Note: Even if you have turned on Auto-Protect in the configuration file, if you have not locked it, users can turn it off. Users should know that it is very important not to disable Auto-Protect for more than a short period of time. Users should disable Auto-Protect temporarily only if they need to perform a task that might generate a warning from Symantec Mobile AntiVirus. See About configuring Symantec Mobile AntiVirus on page 37. About compressed file scans Compressed files (.jar and.zip files) may contain infected files. When users open a compressed file, the files that it contains are not scanned by Auto-Protect until they are extracted and then accessed. Users must extract and scan all files; repair the infected files; and if possible, delete and re-create the compressed file. About remote threat scans You can initiate interactive and non-interactive threat scans on a device remotely. See Initiating remote operations by using SMS or the command-line program on page 51.

25 How Symantec Mobile AntiVirus protects devices About scan configuration options 25 About scan configuration options Users can configure scan options on the devices, unless you configure and lock the options. You can push configuration files to the devices by using an MDM system, Symantec System Center, or any TCP/IP-based network connection in the existing network infrastructure. Table 3-2 describes the scan configuration options. Table 3-2 Platform Device Administrator's computer Scan configuration options Options If not locked by the administrator, a user can configure Auto-Protect scan settings on the device. The administrator can configure the following scan settings on the administrator's computer and transfer the configuration file to the devices: Enable, disable, and lock Auto-Protect and scans after updates. Enable and set scheduled scans or reminders to scan. Specify automatic actions to take on infected files for both Auto-Protect and on-demand scans. Note: If you do not lock the Auto-Protect setting, users can turn off Auto-Protect, even if you enable Auto-Protect in the configuration file. You can use Symantec Settings Builder to configure scan options. See About configuring Symantec Mobile AntiVirus on page 37. About the Activity Log The device maintains a local history of threat-related and LiveUpdate activities. Threat-related activities The following threat-related activities are recorded by the device: Partial scan Full scan An entry is added when users cancel a scan or scan only part of the device. A full scan entry is added when the device, including storage cards, is scanned.

26 26 How Symantec Mobile AntiVirus protects devices About the Activity Log Found threat A found threat entry is added whenever Symantec Mobile AntiVirus identifies a file that is infected with a threat. Included in this entry is the action that was taken on the infected file. Symantec Mobile AntiVirus logs the following Quarantine events: Quarantine add Quarantine delete Quarantine restore For each Quarantine event, the following details are provided: Date Time Event (for example, add, delete, or restore) Source (for example, scanner, Auto-Protect, or Quarantine) File Status (for example, successful or unsuccessful) LiveUpdate-related activities The following LiveUpdate-related activities are recorded by the device: Application Update Virus Definition Update Provides information on updates to antivirus, firewall, and LiveUpdate components. Also includes information on SMS AntiSpam, such as date and time, component name, before and after version numbers, and status of operation. Provides information on old virus definitions version and new virus definitions version. Details include date and time, before and after sequence number, and status of operation. When the Activity Log is full When the Activity Log reaches 300 KB in size, Symantec Mobile AntiVirus first compacts the log file, which creates more space. If compacting the log file does not create enough space, entries are deleted (oldest first) until the size drops below 300 KB. Users can select and delete individual entries, or delete all the entries in the Activity Log.

27 How Symantec Mobile AntiVirus protects devices About SMS AntiSpam 27 About SMS AntiSpam Administrators can manage the log size on a device by retrieving logged events. When an event is retrieved, it is removed from the Activity Log on the device. SMS AntiSpam works by allowing the user to maintain either an acceptable phone number list or a blocked phone number list against which incoming messages are filtered. If the user runs a blocked list and the incoming message is from a number in that list, or if the user runs an acceptable list and the incoming message phone number is not on the list, the messages are routed to a Spam folder. The user can maintain a separate acceptable list and blocked list; only one list is active at a time. Note: SMS AntiSpam filters spam for SMS messages, not for . Configuring SMS AntiSpam You can add and delete numbers, and import numbers from the contacts list or storage card on the device. Also, in the Message Center on the device, the current message number can be blocked or allowed. To configure SMS AntiSpam 1 Open Symantec Security > Symantec AntiVirus. 2 Do one of the following: On a Windows Mobile for PocketPC or Windows Mobile Professional device, select Menu > Options > AntiSpam tab. On a Windows Mobile for Smartphone or Windows Mobile Standard device, select Menu > Options > AntiSpam Options. 3 Configure the following from the list at the top of the screen: Blocked Numbers: Block messages that come from the numbers in the list. If Block Numbers is selected, you can also select Block SMS without number. This item blocks all incoming messages that do not have a number specified. This feature is carrier-specific; some carriers take messages without a number and change them to Accepted Numbers: Accept messages only from the numbers on the list. Disable SMS AntiSpam: Disables anti-spam functionality. 4 To add a number from the address book to the AntiSpam filter list, place a check mark next to the number, and then select Done.

28 28 How Symantec Mobile AntiVirus protects devices About SMS AntiSpam Numbers and number matching Phone numbers in the United States and in other parts of the world typically consist of a prefix and a main number. In some areas, the prefix is not necessary to send a message to the device. For example, if your device is registered in the (818) area code in the United States, dialing (818) and results in dialing the same location. Incoming messages follow this same rule, depending on the carrier. If a message is sent from (818) , the number may show up as either , , or on the receiver device. The filter process attempts to resolve this problem by first obtaining the phone number of the current device, then looking to see what prefix digits exist on the device s own number, to fill in the missing prefix components if an incoming message number is short. For example, if an incoming message is received from , and the device is registered in the (818) area code, this number will match , , or in the AntiSpam blocked number list. Note: If the program cannot obtain the phone number of the device being used, numbers are matched as they are received. An incoming message from only matches against , but not against , because the local area code cannot be obtained. For international messages where the number of digits in a phone number varies from country to country, a message received from one country with a short number of digits may confuse the string compare routine from a second country which uses more digits in the phone number.

29 Chapter 4 Updating devices This chapter includes the following topics: About updating devices About LiveUpdate Wireless About LiveUpdate Repackager Using LiveUpdate Repackager Checking the version numbers of the products on devices About scheduled updates or reminders About transferring update files About updating devices You should make sure that devices are regularly updated with the latest virus definitions files and product updates. Updates can be performed manually, or by scheduling automatic updates. You can also schedule reminders to update. Users need to know that when they update certain products, their device may automatically restart for the update to take effect. If the device is going to restart, a message displays that notifies the user. If you want your users to use an HTTP proxy for LiveUpdate Wireless, you need to tell them the address and port to use, and the user name and password that is required for authentication, if necessary. Because proxy settings are set through the OS software and not through Symantec Mobile AntiVirus, users should refer to their OS documentation for information about how to add these settings. Symantec Mobile AntiVirus supports the following types of updates:

30 30 Updating devices About LiveUpdate Wireless Virus definitions file updates Software updates Engine updates Symantec products use virus definitions files to identify threats. Symantec Security Response researches and responds to new threats and provides customers with updates of virus definitions files as new threats emerge. Symantec occasionally provides software updates for Norton AntiVirus, AntiSpam for SMS, and LiveUpdate. Symantec occasionally provides antivirus scan engine updates to take into account new types of threats that have been identified. LiveUpdate connects to the Symantec LiveUpdate server, where it searches for available virus definitions files, software, and engine updates. After you update your device with the latest virus definitions file, your device is protected from the most current threats. About LiveUpdate Wireless Administrators and users can access Symantec Mobile AntiVirus updates by using LiveUpdate Wireless. Table 4-1 describes each LiveUpdate Wireless update method. Table 4-1 Method LiveUpdate Wireless update methods How it works When to use it LiveUpdate Wireless using the HTTP protocol on the Internet A pull operation that is initiated by the device users or a push operation that is initiated by the administrator on a device on which LiveUpdate Wireless is being used. LiveUpdate Wireless downloads the updates directly from the Symantec LiveUpdate server. Use this method when you want updates to come directly from Symantec. LiveUpdate Wireless using an internal server A pull operation that is initiated by the device users or a push operation that is initiated by the administrator on a device on which LiveUpdate Wireless is being used. LiveUpdate Wireless requests the updates directly from an internal LiveUpdate server that is configured by an administrator. Use this method when you want to control the updates that the devices can retrieve.

31 Updating devices About LiveUpdate Repackager 31 Table 4-1 LiveUpdate Wireless update methods (continued) Method How it works When to use it LiveUpdate using the LiveUpdate Administration Utility and the LiveUpdate Repackager administration tool A manual push operation that is initiated when the administrator does any of the following: Runs the LiveUpdate Administration Utility Repackages the update files using LiveUpdate Repackager Transfers the updates to the devices by using MDM software or any existing TCP/IP network connection Use this method when you want to control both the updates and the timing of the updates to users' devices. You can also initiate LiveUpdate Wireless remotely by using the SMS Listener feature. See About the Short Message Service (SMS) Listener on page 47. If the device is configured to update using LiveUpdate Wireless but does not have an active Internet connection, LiveUpdate Wireless creates a network connection. The connection fails if the device is not configured with an Internet access point. About LiveUpdate Repackager Symantec Mobile AntiVirus provides the LiveUpdate Repackager administration tool for updating devices. LiveUpdate Repackager is a command-line tool that lets administrators repackage updates that are obtained from running the LiveUpdate Administration Utility for distribution to devices. Before you use LiveUpdate Repackager, you must run the LiveUpdate Administration Utility to obtain the latest updates. See Before you install on page 13. LiveUpdate Repackager is used to specify the Symantec products that you want to update and to produce a file, symupdates_ppc.zip, for updating devices. The files can be transferred to devices by using MDM software, or any TCP/IP-based network connection in your existing infrastructure. For example, you could copy the installation files to a central server or them to users, and have the users transfer the Symantec AntiVirus installation files directly by synchronizing their devices with their desktops. You may want to create a batch file that you can execute periodically to run LiveUpdate and repackage its updates for the devices, and then push the updates to the devices. Once the update files are in place, they automatically take effect.

32 32 Updating devices Using LiveUpdate Repackager Using LiveUpdate Repackager You can use LiveUpdate Repackager to repackage updates for distribution to your devices. To use LiveUpdate Repackager 1 Run the LiveUpdate Administration Utility to obtain the latest updates from Symantec. 2 If your tools are not all in the same directory, change to the directory where you copied the LiveUpdate Repackager executable file, lur.exe. 3 If the files that you obtained from running the LiveUpdate Administration Utility are in the current directory, and you want your output files to be placed in the current directory as well, at the command prompt, type the following: lur /product av_pocketpc english You can type more than one product on the command line, separated by spaces. If updates are found, output similar to the following appears: Found update for av_pocketpc, english, target version Created package C:\updates\symupdates_ppc.zip This file can now be copied to \Symantec Data\Updates on Pocket PC devices. If no update is found for a product, no output file is created and a message appears stating that no updates were found. If there is an error, no output files are created and no message appears. 4 Use Symantec System Center, an MDM system, or any TCP/IP-based network connection to transfer the files to the devices as follows: On devices, the \Program Files\Symantec AntiVirus\Symantec Data\Updates folder is created during installation. You must put the symupdates_ppc.zip file into this Updates folder. Once the files are on the devices, they are automatically detected and take effect. About LiveUpdate Repackager command-line syntax LiveUpdate Repackager command-line syntax is as follows: lur [/in <file input directory>]

33 Updating devices Using LiveUpdate Repackager 33 [/out_pocketpc <Pocket PC file output directory>] /product <product name> <language> <version number> Note: Command-line options are not case-sensitive. Table 4-2 describes the command-line options that are used by LiveUpdate Repackager. Table 4-2 Option LiveUpdate Repackager command-line options Description /in <input directory> The path to the directory where the LiveUpdate Administration Utility downloads files. This should match the Download Directory setting of the LiveUpdate Administration Utility. The directories in the path must already exist. You can use mapped drives or Universal Naming Convention format, \\servername\sharename\path\filename. If you exceed the permitted length of the path for your platform, an error message appears. This is optional; if not specified, the current directory (where LiveUpdate Repackager is located) is used. /out_pocketpc <output directory> The path to the directory where you want to put the device update file that is produced when you run LiveUpdate Repackager. The directories in the path must already exist. You can use mapped drives or Universal Naming Convention format, \\servername\sharename\path\filename. If you exceed the permitted length of the path for your platform, an error message appears. This is optional; if not specified, the current directory (where LiveUpdate Repackager is located) is used.

34 34 Updating devices Using LiveUpdate Repackager Table 4-2 Option LiveUpdate Repackager command-line options (continued) Description /product <product name> <language> <version number> All arguments to the /product option are required. <product name> is the name of the LiveUpdate product that you want to update. Possible product name arguments for Pocket PC include the following: av_pocketpc (Symantec AntiVirus for Pocket PC devices) av_defs_pocketpc (Virus definitions for Pocket PC devices) wlu_pocketpc (LiveUpdate Wireless for Pocket PC devices) <language> is the target language for the update. You can determine the name to use for the language option by checking the <tri_file_name> tag value for the appropriate package in the livetri.zip file (obtained by running the LiveUpdate Administration Utility). Values that may be available include ChineseSimplified, Chinese, Czech, Danish, Dutch, English, French, Finnish, German, Hungarian, Italian, Japanese, JapaneseNec, Korean, Norwegian, Polish, Portuguese, Russian, Spanish, and Swedish, but check your livetri.zip file to be sure. <version number> is the two-digit version number of the product that currently resides on the devices that you are going to update. Note that this is not the version that you are updating to with the new file. See Checking the version numbers of the products on devices on page 35. You may put multiple /product options on the command line, separated by spaces. You may put the same product name multiple times to create packages for different languages or version numbers. See Using LiveUpdate Repackager on page 32. /? /h Displays Help text.

35 Updating devices Checking the version numbers of the products on devices 35 Checking the version numbers of the products on devices The version number that you use as input to the LiveUpdate Repackager /product option is the version number of the product that currently resides on the devices that you want to update. It is not the version number that you update to when you push or transfer the new update files. You can check the version numbers of the threat definitions and the Symantec AntiVirus software that are currently running on your devices. To check the version number for the threat definitions 1 On the Start menu, select Programs > Symantec Security> Symantec AntiVirus. 2 Select Menu > Threat Definitions. Use the version number only. Do not include the date. To check the version number for Symantec AntiVirus 1 On the Start menu, select Programs > Symantec Security > Symantec AntiVirus. 2 Select Menu>AboutAntiVirus. Use the first two digits of the version number at the top of the screen. Do not use version numbers for individual components. About updates using multiple versions of a product Although you can include multiple versions of a single product in your update file, it is easier to track the product versions that you are updating if you include only one version of a product at a time in your update files. If you have put multiple versions of a single product into your update file, each device updates to the version that is appropriate for it. For example, if you have a device that is running version 2.0 of the virus definitions and you transfer updates for both version 2.1 and version 2.2, the device updates to use version 2.1. To get that device to update to version 2.2, you must transfer the file to it a second time. It then updates from version 2.1 to version 2.2. About scheduled updates or reminders Scheduled updates automatically check for and install virus definitions file updates on devices. Reminders prompt users to check for updates. The default setting is to remind users to check for updates.

36 36 Updating devices About transferring update files Configure scheduled updates by using Settings Builder. See Creating configuration files by using Symantec Settings Builder on page 38. Note: During a scheduled LiveUpdate session, product updates are not retrieved. To check for product updates, a device owner must run a manual LiveUpdate session. About transferring update files You can use Symantec System Center, an MDM system, or any TCP/IP-based network connection to transfer update files to the devices. For example, you could put the update files on a central server or them to users, and then have the users synchronize their desktop computers with their devices to transfer the Symantec AntiVirus update files. When placing the files on the devices, note that on Pocket PC devices, a \Symantec Data\Updates folder is created under root during installation. You must put the update files into this Updates folder. Once the files are on the devices, they are automatically detected and take effect.

37 Chapter 5 Configuring Symantec Mobile AntiVirus on the devices This chapter includes the following topics: About configuring Symantec Mobile AntiVirus Creating configuration files by using Symantec Settings Builder Creating configuration files by using Symantec System Center About transferring configuration files to the devices About testing a new configuration About configuring Symantec Mobile AntiVirus Symantec Mobile AntiVirus lets you create configuration files for the devices in your organization by using Symantec System Center, if you have it installed, or by using the Symantec Settings Builder administration tool. Symantec Settings Builder is a command-line tool that lets you create configuration files to set and lock antivirus and LiveUpdate Wireless parameters on the devices. You can distribute files to devices by using Symantec System Center or your MDM system. You may want to communicate the following information to your device users: Some settings may be unavailable on the devices because you have locked them. Users cannot configure locked settings. Users may receive messages from you in the Admin Msg area of Symantec Mobile AntiVirus and LiveUpdate Wireless. Users should check there for

38 38 Configuring Symantec Mobile AntiVirus on the devices Creating configuration files by using Symantec Settings Builder messages periodically, if you plan to use this feature to communicate with them. See Creating configuration files by using Symantec System Center on page 39. See Creating configuration files by using Symantec Settings Builder on page 38. Creating configuration files by using Symantec Settings Builder You can use Symantec Settings Builder to create the configuration files that you need to set and lock Symantec AntiVirus and LiveUpdate Wireless settings on the devices in your organization. You then push the configuration files to the devices by using an MDM system, or any TCP/IP network connection. Settings Builder command-line syntax is as follows: ssb <config_file> where <config_file> is the name of the input configuration file. The input file name may include a full or relative path. To create a configuration file by using Symantec Settings Builder 1 Go to the directory where you copied the Symantec Settings Builder files, ssb.exe and sb.ini. 2 Copy the sample sb.ini file and give it a new name, for example, my_config.ini. 3 Edit and save this file to set the Symantec AntiVirus and LiveUpdate Wireless configuration settings that you want. The sample sb.ini file is annotated with comments that explain the various parameters and how to set them. 4 At the command line, type the following: ssb my_config.ini Depending on how you edited your version of the.ini file, this produces one or more of the following files: av.cfg lu.cfg Symantec Mobile AntiVirus configuration file for configuring Symantec Mobile AntiVirus on devices LiveUpdate Wireless configuration file for configuring Symantec Mobile AntiVirus on devices