SAV 9 - Symantec AntiVirus 9.0

[smc1979]

Well I got ahold of build 9.0.2.1000 and the pagefile problem still hasnt been fixed.

I had to get this build off another tech (not sure why it isnt on there site)

And of course still no reply to my comments on the page file from symantec

I even sent them an email!!

It is just so hard to think that symantec is acting like this. You would think they wouldnt.

This is VERY dissapointing.

[RogueSpear]

I got a hold of the change log. Goes from V9.0.0.1300 to current.

Release_notes.7z

[smc1979]

Well belive it or not I got the pagefile problem fixed, but I dont know if the fix is wise to use.

Basicly it is still a bug in SAV cause the pagefile works fine if it is on a different drive other than C:.

Now when you go to config the auto protect and tell it to exclude certain files the pagefile isnt listed. So the only option was to tell it to ignore all files with the extension sys so dont scan any files *.sys.

I rebooted and it my pagefile was fixed. By the way this problem is even on XP sp1.

Now I am not sure or not but is it wise to ingore sys files?

since I have now seen what is causing this problem it would be such a easy fix for symantec but for some reason I cant see them fixing it.

[RogueSpear]

You can tell SAV to ignore individual files, such as pagefile.sys. I know this works because I have it ignoring a couple of files related to DameWare Mini Remote. I'll have to give this a try.

[smc1979]

well with my SAV when I go to tell it the certain files to ignore pagefile.sys isnt listed :-(

[smc1979]

RogueSpear, is 9.0.2.1000 a officle release, they just simply havent updated there site?

I like to use the latest build at all times, so if this build is safe I would like to use it, but if it is a beta of some kind then it would be nice to know.

I read the release notes you put up, but it only says 9.0.2.1000 but nothing about it.

HHMM maybe I need coffee

[RogueSpear]

You have to click on the + symbol to expand the details. I don't remember right now, but there may not have been any changes to the firewall component of SCS.

[smc1979]

Well there is no way to set the pagefile inside the program. But you can from the reg.

here is the reg fix for the pagefile problem B)

And it works ok. so now you can run this as part of your XP setup and the pagefile will be ok.

At least it has for my tests.

EDIT:

I updated the reg file later in this thread.

[RogueSpear]

Beat me to the punch! I was just going to make one of those too!

On a side note: I think its strange that you can see IO.SYS, ntldr, etc in the exclusions dialog box, but not pagefile.sys.

Well done on the fix! Now if we could just figure out my terminal services problem, maybe Symantec would hire us as lead engineers.

[smc1979]

Holy pizza toppings batman!!!

I got a reply from symantec and they are going to fix the problem hehe;

I can understand your frustration with this issue, Shane. If it is

any consolation Symantec is actually aware of the problem, which has

been entered as a defect and is currently being analysed by

development. We have created a Knowledge Base article which is still

a work in progress and is not yet publicly available. I have

submitted a request to publish the document as soon as possible. When

the document is available, you can access it and book mark the

following URL:

Title: 'After installing SAV CE 9.0 the pagefile size has changed.'

Document ID: 2004042913251448

> Web URL: http://service1.symantec.com/support/ent-s...rc=ent_gold_nam

When a solution is found, it will be implemented in a maintenance

release of Symantec AntiVirus Corporate Edition (SAVCE) 9.0, and the

document will be updated. Configuring Auto-Protect to load as a

service rather than a device driver has resolved the issue for most

customers.

Workaround:

It is possible to configure Auto-Protect to load at service startup,

instead of at system startup. This causes a small window of

vulnerability when the system starts up and shuts down, during which

Auto-Protect is not enabled.

Use the procedure that applies to your server or type of client.

To delay the loading of Auto-Protect until service startup on managed

clients:

1. In the left pane of the Symantec System Center console, right-click

the server group that you want to change, and then click Unlock Server

Group.

2. Right-click the desired server or server group, and then click All

Tasks > Symantec AntiVirus > Client Auto-Protect Options.

3. Click Advanced.

4. Under Startup Options, click Symantec AntiVirus start.

5. Click OK, then click Reset All to propagate the change to clients.

To delay the loading of Auto-Protect until service startup on

unmanaged clients:

1. Start Symantec AntiVirus.

2. On the Configure menu, click File System Auto-Protect.

3. Click Advanced.

4. Under Startup Options, click Symantec AntiVirus start.

5. Click OK in both open dialog boxes, and then exit Symantec

AntiVirus.

To delay the loading of Auto-Protect until service startup on

antivirus servers:

1. In the left pane of the Symantec System Center console, right-click

the server group that you want to change, and then click Unlock Server

Group.

2. Right-click the desired server or server group, and then click All

Tasks > Symantec AntiVirus > Server Auto-Protect Options.

3. Click Advanced.

4. Under Startup Options, click Symantec AntiVirus start.

5. Click OK to save the change.

6. In the Server Auto-Protect Options dialog box, click OK to apply

this change to the specified servers.

Please let us know if you need additional assistance.

Sincerely,

Barbara Coleman

Symantec Technical Support

[smc1979]

Also on one note I replyed back to that with our fix LOL.

Maybe they will get it fixed faster now.

This is great news to hear. And you have resotre my faith back into

symantec by your responce. Much better than heraing there is nothing

wrong (that is what makes me mad)

I understand programs have bugs, but hearing that you are aware of it

and working on it makes me feel great about the problem.

As for now I have found a temp solution and seems to be working.

Right now you can not select the pagefile to be excluded. but you can

manuly add it in the reg and reboot. (of course the check mark has to

be on exclude files in SAV) and this has seems to have fixed the

issuse.

On another note this problem only happens to the C: drive. if you

where to move or add the pagefile to a different drive letter there

is no problem for those.

Very strange. But when it comes down to it it possibly could be a

easy fix as to simply leave the pagefile alone by default.

Of course I dont know how well this fix works that I have done so

far, but everything seems ok. But of course shouldnt need to be done

in the first place.

Thank you for your help and I will keep checking back for updates.

If anyone reading this would like to try the fix I made just email

me. webmaster@croftssoftware.com

Thank you again for your reply.

Shane

[boredwithxp1234]

This is a great site here.

I've been browsing through here and didn't see any postings on doing a silent live update after installing Symantec AV 9.0.

So hopefully this isn't a repost.

I'm not sure if all versions have a .msi file with them but mine does. This code will work with either the setup.exe or .msi but the .exe will return immediately, that is why I put in the waiting part. Using .msi you can do the AV install and the definitions right after each other with no problems.

The key thing that makes the live update work is making sure that your current working directory is the symantec folder. Without that it will never run. This is likely a security feature or just Symantec being picky and not wanting anyone else running their update. Weird huh?

Someone more into batch files than I could do this in a FOR loop since that is basically what I am doing anyway.

rem Number of tries to run live update
SET TRIES=2
SET COUNT=0

echo Installing Symantec Anti-Virus 9.0...
echo.

start /wait msiexec /i "Symantec Antivirus.msi" /qb REBOOT=ReallySuppress RUNLIVEUPDATE=0

echo Attempting virus definition update...

rem THIS IS THE MOST IMPORTANT PART!!
rem Without this then the exe will refuse to run.
rem I think this is a security thing as the main exe that calls it is in same folder.
cd "C:\Program Files\Symantec AntiVirus"

:START
IF %COUNT% == %TRIES% GOTO SKIP

IF EXIST .\VPDN_LU.exe. (GOTO DOWNLOAD) ELSE (GOTO WAIT)

:DOWNLOAD
echo Virus definitions downloading...

start /wait .\VPDN_LU.exe /s /silent

echo virus defs should be finished...wait a bit to be sure
ping -n 5 127.0.0.1>nul
GOTO DONE

:WAIT
echo Waiting for installer to finish...
SET /A COUNT = COUNT + 1
ping -n 60 127.0.0.1>nul
GOTO START

:SKIP
echo Unable to download virus definitions at this time.
rem GOTO END

:DONE
echo Virus definitions downloaded.

:END

rem do whatever ....

So, if not something old I missed, hope that helps some of you.

[smc1979]

Sorry guys, but the pagefile fix wont work if the exclude check box isnt checked. so this fixed reg file will take care of it. sorry I didnt see it last time.

Just simply run this reg file after you install sav once you reboot the settings will take effect.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Intel\LANDesk\VirusProtect6\CurrentVersion\Storages\Filesystem\RealTimeScan]
"ExcludedByExtensions"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Intel\LANDesk\VirusProtect6\CurrentVersion\Storages\Filesystem\RealTimeScan\FileExceptions]
"C:\\Pagefile.sys"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Intel\LANDesk\VirusProtect6\CurrentVersion\Storages\Filesystem\RealTimeScan\NoScanDir]
@=dword:00000000

pagefilefix.reg

[RogueSpear]

@boredwithxp You seem to have a pretty good handle on available command line switches in SAV. Do you happen to know of any for ALEScan.exe that is a part of the Symantec Client Firewall (part of SCS)?

[boredwithxp1234]

Nope I just knew that Symantec AV CE was doing silent live update everytime I start windows and I knew the program it was using to do it so I just played around with it and got it to work.

Now all my Symantec installs do live updates automatically (assuming they have net access during install). This I think is a much better solution than dealing with extra definition files that take up extra space.

This is only my second posting on this site anyway, I'm a newbie at this silent install stuff. Right now I am working on a unattended DVD with XP Pro, Office 2k3, Symantec, Nero, Zonealarm, and whatever else I can make unattended. Visual studio doesn't want to be unattended or I would put that on there too.

Very useful site with lots of info I've already refered a friend here and he is working on his own unattended install now.