SAV 9 - Symantec AntiVirus 9.0

[prathapml]

I didn't add it to my guide because I thought it was off the course of AIP.

Nopes, I wasn't kidding.

In fact, that sentence (quoted here) looked like an abbreviation for something else. I'd heard of AIO's (All-in-one), but not of anything like All-in-P?????. Hence my question. (its late night now, so maybe I'm getting a bit slack in mind).

[mazin]

AIP is a documented abbreviation on Microsoft sites, not my invention really.

And P <> P????, hah, naughty boy!

[mazin]

New version out v9.0.1.1100

I think this is the licensed version, not ours! Am I correct?

[prathapml]

No, you can pre-order it right now. And the one many are already having is licensed too (v9.0.338). So there's no difference in the two. Licensed and "ours" is the same. Also, maybe symantec will release a patch for upgrading to v9.0.1 once its finalised. Because it is not a new version (like v8.1 was to v8.0), a patch SHOULD be available - I'll wait and get that instead of running to buy a pre-packaged version of the updated SAV.

BTW, what I meant was "All-in-what????". I mean, what word that starts from letter "P". Sheesh, this is getting a bit funny now...... might be wiser to finish up with it.

[1chaoticadult]

nocheebo you are right. I tried /a on the latest version and its a no go.

[mazin]

An unlicensed copy is legal, I know. Probably, I've been confused by this post:

http://www.msfn.org/board/index.php?showto...ndpost&p=178184

[prathapml]

@drthawhizkid

You could try this in the CMD window:

msiexec /a whatever.msi

Might work that way (same was the case with .NET framework).

Also, if you have the original licensed package, you will be able to run "/A" with no problems. The warez download sites seem to give out a single-file installer which is pretty problematic as mentioned by you.

[jbourgui]

This document is for people wishing to silently customize their SAV Corp 9 settings

after a silent installation.

**

a batch file to make these changes is included at the end; it's also possible to add

these changes to your .msi file, using the MaSaI Editor, but I was feeling lazy

**

It took a little while to find all of this in the registry, as well as figuring out the

settings, but here it is... Many thanks to prathapml, who encouraged me to dig it up!

Tweak the settings in the batch file to whatever you need, then run it after SAV is

installed...

(added _'s to try to space out entries for readability..)

There are many options in this key that you can change which will become the new defaults for all virus scans.

Here are a few of them detailed:

[HKEY_CURRENT_USER\Software\INTEL\LANDesk\VirusProtect6\CurrentVersion\Custom Tasks
\Default Scan Options]

DWords	__________My Settings __________ Description

ScanForGreyware ______1______Turn this on to scan for "expanded threats" (eg. spyware, adware, etc)
ScanProcesses_________1______Scan memory by default
FirstGreywareAction_____3______First action to take with greyware, 3=delete 4=log only
SecondGreywareAction___4______Second action to take with greyware, 3=delete 4=log only

If you wish to customize the default settings of liveupdate like I wanted to,

here is the key:

[HKEY_LOCAL_MACHINE\SOFTWARE\INTEL\LANDesk\VirusProtect6\CurrentVersion\PatternManager
\Schedule]

DWords	______My Settings______	Description

Created	______1093971976______Looks necessary;  number of seconds since 01/01/1970
DayOfMonth______1______Day of month to run on, if monthly.
DayOfWeek______3______What day to run on; Sun=0 ... Sat=6 
                                         (I like wednesday, personally..)
Enabled	________1______Enable automatic liveupdates
LastStart________0______Necessary; can be 0
MinOfDay_______780______The time to start, counted in minutes since midnight. 
_______________________(1pm=13hours*60mins=780)
MissedEventEnabled___1______Handle missed events
RandomizeDayEnabled__0______Enable randomizing the minute of day LU runs on
RandomizeDayRange___60______Randomize LU to within x minutes of MinOfDay
RandomizeMonthEnabled__0______Both of these look necessary, even if set to 0
RandomizeWeekEnabled__0______Both of these look necessary, even if set to 0
SkipEvent________0______0=Don't skip
TimeWindowDaily______4______Handle missed events within x hours
TimeWindowMonthly______5______Handle missed events within x days
TimeWindowWeekly______3______Handle missed events within x days
Type______2______Daily=1, Weekly=2, Monthly=3

If you wish to include a weekly scan by default on new machines, the code is included in the batch file below; I didn't detail all of the settings for it since they're pretty redundant with what I've already documented...

Please PM me with any corrections to this post, as I have only been able to test it on

my own machines, and I'm not positive that it'll work for everybody yet.

Thanks for helping test!

-joe

Here is my batch file to make the changes detailed above:

(NOTE: reg.exe versions before 2.0 do not support the /f flag, instructions to get version 2.0 are here)

:: batch by jhb
:: THIS SECTION WILL CHANGE THE DEFAULT SETTINGS OF SAV

SET KEY="HKEY_CURRENT_USER\Software\INTEL\LANDesk\VirusProtect6\CurrentVersion\Custom Tasks\Default Scan Options"

REG ADD %KEY% /v ScanForGreyware /d 1 /t REG_DWORD /f
REG ADD %KEY% /v ScanProcesses /d 1 /t REG_DWORD /f
REG ADD %KEY% /v FirstGreywareAction /d 3 /t REG_DWORD /f
REG ADD %KEY% /v SecondGreywareAction /d 4 /t REG_DWORD /f

:: THIS SECTION WILL SCHEDULE LIVEUPDATE TO RUN AUTOMATICALLY, WITH THE SETTINGS YOU CHOOSE

SET KEY="HKEY_LOCAL_MACHINE\SOFTWARE\INTEL\LANDesk\VirusProtect6\CurrentVersion\PatternManager\Schedule"

REG ADD %KEY% /v Created /d 1093971976 /t REG_DWORD /f
REG ADD %KEY% /v DayOfMonth /d 1 /t REG_DWORD /f
REG ADD %KEY% /v DayOfWeek /d 3 /t REG_DWORD /f
REG ADD %KEY% /v Enabled /d 1 /t REG_DWORD /f
REG ADD %KEY% /v LastStart /d 0 /t REG_DWORD /f
REG ADD %KEY% /v MinOfDay /d 780 /t REG_DWORD /f
REG ADD %KEY% /v MissedEventEnabled /d 1 /t REG_DWORD /f
REG ADD %KEY% /v RandomizeDayEnabled /d 0 /t REG_DWORD /f
REG ADD %KEY% /v RandomizeDayRange /d 60 /t REG_DWORD /f
REG ADD %KEY% /v RandomizeMonthEnabled /d 0 /t REG_DWORD /f
REG ADD %KEY% /v RandomizeWeekEnabled /d 0 /t REG_DWORD /f
REG ADD %KEY% /v SkipEvent /d 0 /t REG_DWORD /f
REG ADD %KEY% /v TimeWindowDaily /d 4 /t REG_DWORD /f
REG ADD %KEY% /v TimeWindowMonthly /d 5 /t REG_DWORD /f
REG ADD %KEY% /v TimeWindowWeekly /d 3 /t REG_DWORD /f
REG ADD %KEY% /v Type /d 2 /t REG_DWORD /f

:: THIS SECTION IS TO ADD A WEEKLY SCAN TO YOUR NEW INSTALLATION

SET KEY="HKEY_CURRENT_USER\Software\INTEL\LANDesk\VirusProtect6\CurrentVersion\Custom Tasks\b18edc0c-652f-4811-a66c-a4c4a7e2303f"
REG ADD %KEY% /v FirstMacroAction /d 5 /t REG_DWORD /f 
REG ADD %KEY% /v SecondMacroAction /d 1 /t REG_DWORD /f 
REG ADD %KEY% /v FirstAction /d 5 /t REG_DWORD /f 
REG ADD %KEY% /v SecondAction /d 1 /t REG_DWORD /f 
REG ADD %KEY% /v FirstOehAction /d 1 /t REG_DWORD /f 
REG ADD %KEY% /v SecondOehAction /d 3 /t REG_DWORD /f 
REG ADD %KEY% /v MessageBox /d 1 /t REG_DWORD /f 
REG ADD %KEY% /v FileType /d 1 /t REG_DWORD /f 
REG ADD %KEY% /v HaveExceptionDirs /d 0 /t REG_DWORD /f 
REG ADD %KEY% /v HaveExceptionFiles /d 0 /t REG_DWORD /f 
REG ADD %KEY% /v ExcludedByExtensions /d 0 /t REG_DWORD /f 
REG ADD %KEY% /v ScanWhenIdle /d 1 /t REG_DWORD /f 
REG ADD %KEY% /v ScanWhenNotIdle /d 1 /t REG_DWORD /f 
REG ADD %KEY% /v ThrottleNetWare /d 0 /t REG_DWORD /f 
REG ADD %KEY% /v ScanWhenIdlePriority /d 3 /t REG_DWORD /f 
REG ADD %KEY% /v ScanWhenNotIdlePriority /d 3 /t REG_DWORD /f 
REG ADD %KEY% /v ThrottleNetWareTargetLoad /d 40 /t REG_DWORD /f 
REG ADD %KEY% /v ScanThreadCount /d 2 /t REG_DWORD /f 
REG ADD %KEY% /v ScanThreadsPerCPU /d 1 /t REG_DWORD /f 
REG ADD %KEY% /v ScanForGreyware /d 1 /t REG_DWORD /f 
REG ADD %KEY% /v ScanProcesses /d 1 /t REG_DWORD /f 
REG ADD %KEY% /v FirstGreywareAction /d 3 /t REG_DWORD /f 
REG ADD %KEY% /v SecondGreywareAction /d 4 /t REG_DWORD /f 
REG ADD %KEY% /v ScanAllDrives /d 0 /t REG_DWORD /f 
REG ADD %KEY% /v NeedAccessToNetwork /d 0 /t REG_DWORD /f 
REG ADD %KEY% /v StatusDialogTitle="Symantec AntiVirus - Weekly Scan"
REG ADD %KEY% /v DisplayStatusDialog /d 0 /t REG_DWORD /f 

SET KEY="HKEY_CURRENT_USER\Software\INTEL\LANDesk\VirusProtect6\CurrentVersion\Custom Tasks\b18edc0c-652f-4811-a66c-a4c4a7e2303f\Directories"
REG ADD %KEY% /v C: /d 1 /t REG_DWORD /f 

SET KEY="HKEY_CURRENT_USER\Software\INTEL\LANDesk\VirusProtect6\CurrentVersion\Custom Tasks\b18edc0c-652f-4811-a66c-a4c4a7e2303f\Files"
REG ADD %KEY% /f

SET KEY="HKEY_CURRENT_USER\Software\INTEL\LANDesk\VirusProtect6\CurrentVersion\Custom Tasks\b18edc0c-652f-4811-a66c-a4c4a7e2303f\Schedule"
REG ADD %KEY% /v Type /d 2 /t REG_DWORD /f 
REG ADD %KEY% /v Enabled /d 1 /t REG_DWORD /f 
REG ADD %KEY% /v DayOfWeek /d 4 /t REG_DWORD /f 
REG ADD %KEY% /v MinOfDay /d 900 /t REG_DWORD /f 
REG ADD %KEY% /v MissedEventEnabled /d 0 /t REG_DWORD /f 
REG ADD %KEY% /v Created /d 1093978089 /t REG_DWORD /f
REG ADD %KEY% /v SkipEvent /d 0 /t REG_DWORD /f 
REG ADD %KEY% /v LastStart /d 0 /t REG_DWORD /f

[mazin]

HKEY_USERS\S-1-5-21-1085031214-1645522239-839522115-500\...

Is this key supposed to be the same on all PCs?

[jbourgui]

Mazin, I edited the script so that it'll handle all of it in HKEY_CURRENT_USER.

Thanks for pointing out the mistake!

-joe

[mazin]

hmm!  you're absolutely right about that... is there a good way to extract it, maybe with a "reg query"?

Let me check the MSI first. Or it may be written to the registry bu LiveUpdate package?

Let me check that, first.

Thanks.

EDIT:

Well! Thanks. I recieved your PM about that.

Edited September 1, 2004 by mazin

[1chaoticadult]

@prathapml, I got SAV to make an Admin Install. I just run the single exe and it extracted the setup files to a directory, then I use those extracted setup files to make an Admin install.

[mazin]

Mazin, I edited the script so that it'll handle all of it in HKEY_CURRENT_USER.

Thanks for pointing out the mistake!

-joe

Good news. I'll give it a go and post back when ready.

Thanks.

[mazin]

Well!

Now the beast is under control! Watch for news. EVERYTHING is solved.

Another Symantec product is smashed by mazin©.

WOOHOO.

[mazin]

i extracted the lusetup and ran start /wait %systemdrive%\install\Applications\sav\Lusetup\lsetup.exe /Q- and it worked silently

Without extraction, run this command directly on the downloaded lusetup.exe:

lusetup.exe /c

This should install it silently.

CHEERS!

EDIT: Guide updated.