CERN settings for Norton AntiVirus 7.6

Transcription

1 Page 1 of 7 1. The system tray CERN settings for Norton AntiVirus 7.6 To show a good behaviour of the software Norton AntiVirus 7.6 (NAV), a yellow icon must appeared below, in the right place of the screen (red circled). It also shows that the realtime protection is activated, which corresponds with the Cern standard settings. Also, the same icon, red circled, may show a bad functionality of the scan engine or either the local administrator or a user with admin priviligees or the NAV admin have disabled the service. A normal user with no administrator rights cannot disable the realtime protection or stop the service. In all cases, it is a good idea to verify the event viewer/applications and report the errors and warnings to the helpdesk. As soon as we launch the NAV software by double-clicking the NAV icon in the system tray or by selectionning Start -> Programs -> Norton AntiVirus Corporate Edition -> Norton AntiVirus Corporate Edition, the window below appears. The red-circled informations are important to verify.

2 Page 2 of 7 2. The realtime protection Obviously, the best solution would be to provide the most comprehensive protection against viruses with least percentage of performance degradation. It is very important to keep disabled the item Drive types : network. All the systems are protected locally. The home directories servers, the profile servers and the applications servers are protected. So, the network drive scanning can be disabled without any risk of opening up security holes, it will improve the transfer times. If this option is enabled and because the realtime protection is enabled on the servers, that s may reduce the network performances. Selected Extensions scans files with the most common document and program extensions that include the extensions will improve performance and will avoid all main virus attacks. In order to have a good and interesting compromise between the security, the user comfort and performance, the choice to scan only the local files when they are created or during their modifications is the minimum needed. For a maximum protection, the user would choose to scan all types of files. When set to scan on modified only, NAV CE will only monitor and scan a file to being created, changed, or moved. It will not scan files that are being accessed or executed.

3 Page 3 of 7 3. Scheduled scans By default with the cern settings, daily scans are scheduled. Every managed PCs with NAV client installed are scanned every nights, the hour depends on the server the PC is attached to (image picture 3). Regularly, the user can verify the different historic files and can call the helpdesk in case of problems.

4 Page 4 of 7 4. The services The first service to verify is defwatch which is LiveUpdate, responsible for the virus definitions files updates. The version of this type of file is written on the right of NAV client console (picture 3). The second important service is the scan engine itself and is also responsible for the exchange of the informations with its server, of course its good behaviour is very important, all bad functionalities must be forwarded to the helpdesk. Only the users with admin priviligees can stop manually and restart the service. By default, both services, defwatch and Nav Client are started at reboot time.

5 Page 5 of 7 5. Manual Scans For any reasons, the local user or the remote NAV admin can start a file specific scanning. This operation is encouraged as soon as the user has some doubts concerning the security of few files. 6. Problems/Troubleshooting sdsdsd RTVscan consuming cpu : The RTVscan process may take a lot of system resources for no reason. For example after a pattern file update, the process may loop. The problem may be solved by stopping and restarting the service.

6 Page 6 of 7 Scan engine does not start : Also, the end users may meet another rare problem which may occur after an automatic update of the definitions file. If you try to start a manual scan you get the message that the scan engine cannot be loaded. In the system event viewer you can see the following messages : - Could not start Service Engine err=cc Norton antivirus services failed to start. Virus definition file is invalid (CC001000) In this case, first stop the defwatch and Norton services and then delete all *.vdb files in C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\*.vdb and./i2_ldvp.vdb/*.vdb in the same directory. Browse to the NAV directory, and delete all files with the extension VDB. Empty the contents of the folder I2_LDVP.VDB After that, with liveupdate utility refetch the virus definition file via Internet and Symantec ftp site. Restart the norton AntiVirus and Defwatch services. Norton AntiVirus Realtime Protection failed to load: The situation is that you tried to install Norton AntiVirus 7.5 on another previous version or perhaps on IntelLANDesk. As many problems, Norton knows but cannot explain the problem but several users have solved the problem by :

7 Page 7 of 7 1. Have you deleted correctly LANDesk? 2. reinstall the software. 3. If you are used with the regitry editor, check if the key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Symevent exists? If not, download the correct version of the program sevinst.exe, sevinst for Windows 95, sevinst for Windows NT/2000. Save the file sevinst-os.exe program, with os is your platform, on your local disk C:\TEMP or another. And then, For Windows 95 (Nice 95) : double click on sevinst and reboot For Windows NT/2000 (Nice NT/2000), type : C:\TEMP\sevinst2000.exe /q /log /r /nt And reboot. 4. If it fails again you can uninstall and reinstall NAV 7.5 And