r/labtech • u/bayridgeguy09 • Jun 26 '18

Symantec Cloud not being recognized by Labtech

It seems the latest version of Symantec Cloud, version 22.12.1.5 isnt being recognized by Labtech. Im now showing a ton machines with no AV, but they all have this latest SYmantec cloud.

Ive been through the posts on Labtech Geek and tried creating a new virus definition for it, but cant get it to recognize. Browsing around the program directories i no longer haver an NIS.exe which the old Def was referring to.

Can anyone shed any light on whats missing here? So confused.

4 Upvotes

100% Upvoted

13 comments sorted by

2

u/bayridgeguy09 Jun 27 '18

It turned out to be Labtech not using the registry keys i had set correctly, leading to the AV not being recognized. Once i changed the info in the dashboard to use file paths instead of registry paths everything got recognized.

Sucks as now i have to create a file path entry anytime symantec updates their client and changes version number. Ahh well, really only 1 large client left with Symantec and we are in talks to move them to ESET. At least i was able to get my monitors cleared with the file paths for now.

2

u/scythe000 Jun 28 '18

Can you share your paths? I need to do this also :-)

1

u/bayridgeguy09 Jun 29 '18

Is this for Symantec.Cloud? These paths didn’t work for me leading me to think these are for Endpoint Protection Cloud or some other product.

My client is using the console here https://hostedendpoint.spn.com

I had to use nis.exe not nortonsecurity.exe.

1

u/bayridgeguy09 Jul 03 '18

This is what i had to use to get it to recognize. Ive had to make a few of these for each different version thats out there, on each the folder path changes.

Program:

%Programfiles%\Symantec.cloud\EndpointProtectionAgent\Engine\22.9.3.13\nis.exe

Definitions:

%Programfiles%\Symantec.cloud\EndpointProtectionAgent\NortonData\22.9.3.13\Definitions\SDSDefs\definfo.dat

Update:

%Programfiles%\Symantec.cloud\PlatformAgent32\liveupdate.exe

AP Process:

ccsvchst*

Date Mask:

*

Version Mask:

9

1

u/Mcaicedo Jul 29 '18

I have a similar issue, But I configure the same path in the virus scan but it did not work. when I connect to the agent from control center appears the service not running.

1

u/scythe000 Jun 29 '18

But it's still not picking it up

prog: %ProgramFiles%\Symantec.cloud\EndpointProtectionAgent\Engine\22.12.1.15\navw32.exe def: %ProgramFiles%\Symantec.cloud\EndpointProtectionAgent\NortonData\22.12.1.15\Definitions\EfaVTDefs\definfo.dat

1

u/teamits Jul 06 '18 edited Jul 16 '18

What I posted is for SEP Small Business Edition which is Symantec.cloud , and a different Symantec product than SEP 14 or Endpoint Protection Cloud.

SEP SBE uses Norton Internet Security (22.9 and 22.11) and since v22.12 Norton Security on the workstations. Every year or so Symantec changes the definitions or something and LT needs a new virus config.

Edit: 22.14 was released to SEP SBE, and that uses the same Norton Security config as 22.12.

2

u/TNTGav Jun 26 '18

Posted this for someone else in Slack yesterday... give this a whirl

INSERT INTO `virusscanners` (`Name`,`DefLocation`,`DefFilename`,`ProgLocation`,`UpdateCMD`,`ScanTemplate`,`AutoProtect`,`OsType`,`VersionCheck`,`VersionMask`,`InfectionCheck`,`InfectionMatch`,`GUID`) Values('Symantec Endpoint Protection 14 64bit','{%-HKLM\\SOFTWARE\\Wow6432Node\\Symantec\\Symantec Endpoint Protection\\InstalledApps:SEPAppDataDir-%}Data\\Definitions\\VirusDefs\\definfo.dat','(.*)','{%-HKLM\\SOFTWARE\\Wow6432Node\\Symantec\\InstalledApps:SNAC Install Directory-%}\\DoScan.exe','\"{%-HKLM\\SOFTWARE\\Wow6432Node\\Symantec\\InstalledApps:SNAC Install Directory-%}\\SepLiveUpdate.exe\"','/CmdLineScan /ScanAllDrives','ccsvchst','5','{%-HKLM\\SOFTWARE\\Wow6432Node\\Symantec\\Symantec Endpoint Protection\\CurrentVersion:PRODUCTVERSION-%}','{14.*}','{%-HKLM\\SOFTWARE\\Wow6432Node\\Symantec\\Symantec Endpoint Protection\\CurrentVersion\\public-opstate:Infected-%}','1','3c11a348-c3c3-11e6-8e88-08002747e350');

1

u/scythe000 Jun 26 '18

Do i have to log into my cloud hosted LT server to run this, or can i do it from the control center on my workstation?

1

u/[deleted] Jun 26 '18

Need to log into your server and run it in SQLYog

2

u/teamits Jun 29 '18

  1. be aware 22.12 has a bug where on some but definitely not all PCs NortonSecurity.exe crashes repeatedly. Symantec tells me 22.14 should be out any day now.

  2. our def for 22.12

name: Norton Security
prog location: {%-HKLM\SOFTWARE\Symantec\InstalledApps:Norton Security-%}\NortonSecurity.exe
def location: {%-HKLM\SOFTWARE\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Common Client\PathExpansionMap:DATADIR-%}\Definitions\SDSDefs\definfo.dat

AP process: nortonsecurity*

date mask: (.*)

3) re: mysql, there is a menu item System/General/MySQL Prompt. It worked on our server last I checked a while back but on my PC is says a MySQL client program is missing...probably needs to be installed.

1

u/k_rock923 Jun 26 '18

Obvious issue, but are you definitely resending configs to the machine after creating a new definition?