question about Symantec Antivirus 10

question about Symantec Antivirus 10
Secure Home | Search | About
Login Password
Register Now! Lost Password?
 Microsoft Antivirus Discussions    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
question about Symantec Antivirus 10 Brian Wood 01-16-2006
Posted by Brian Wood on January 16, 2006, 11:37 am
If you were  Registered and logged in, you could reply and use other advanced thread options
This may not be the proper forum to post this, but please humor me. We are
running Symantec CLient Security 3 in our environment (which the Antivirus
component piece is Symantec Antivirus 10). Whenever it does a scheduled
scan of a server, it modifies the "Last Accessed Date" of every file it
scans. We have an HSM product which relies on the Last Accessed Date, so
Symantec is basically making our HSM product worthless.

Anyone have any knowledge how to fix Symantec Antivirus 10 scan and/or
autoprotect settings so it does not modify the "Last Accessed Date" time on
files that it scans? I have scoured the net and Symantec's website and
haven't found anything yet.

Thanks



Posted by =?Utf-8?B?UGFuZGFfbWFu?= on January 16, 2006, 1:03 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
What you are asking depends on your antivirus software.If you can change the
software ,do it.
You are corporate clients and the best would be to contact Symantec which
will help you .More info how to can be found in their site.

Another option ,change the antivirus...<stupid and really expensive>

:-)

Panda_man
--
Prevention is always better than cure !
Panda TruPrevent - the most intelligent technology to combat unknown malware
http://www.pandasoftware.com
http://free.hit.bg/fightmalware/homepage_en.htm



"Brian Wood" wrote:

> This may not be the proper forum to post this, but please humor me. We are
> running Symantec CLient Security 3 in our environment (which the Antivirus
> component piece is Symantec Antivirus 10). Whenever it does a scheduled
> scan of a server, it modifies the "Last Accessed Date" of every file it
> scans. We have an HSM product which relies on the Last Accessed Date, so
> Symantec is basically making our HSM product worthless.
>
> Anyone have any knowledge how to fix Symantec Antivirus 10 scan and/or
> autoprotect settings so it does not modify the "Last Accessed Date" time on
> files that it scans? I have scoured the net and Symantec's website and
> haven't found anything yet.
>
> Thanks
>
>
>

Posted by Leythos on January 16, 2006, 2:57 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
scripts.com says...
> This may not be the proper forum to post this, but please humor me. We are
> running Symantec CLient Security 3 in our environment (which the Antivirus
> component piece is Symantec Antivirus 10). Whenever it does a scheduled
> scan of a server, it modifies the "Last Accessed Date" of every file it
> scans. We have an HSM product which relies on the Last Accessed Date, so
> Symantec is basically making our HSM product worthless.
>
> Anyone have any knowledge how to fix Symantec Antivirus 10 scan and/or
> autoprotect settings so it does not modify the "Last Accessed Date" time on
> files that it scans? I have scoured the net and Symantec's website and
> haven't found anything yet.

Why would you want to NOT have the last accessed date be true?

I understand your idea, but it's a bad idea. You need to look at other
methods or learn how to deal with AV scanners.

Last accessed has little to do with the av scanner, it's how the OS
handles it.

Call Symantec, as an owner of their Corp product you get at least a
little support.

--

spam999free@rrohio.com
remove 999 in order to email me

Posted by Michael Bednarek on January 16, 2006, 10:10 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
On Mon, 16 Jan 2006 10:37:39 -0600, Brian Wood wrote in
microsoft.public.security.virus:

>This may not be the proper forum to post this, but please humor me. We are
>running Symantec CLient Security 3 in our environment (which the Antivirus
>component piece is Symantec Antivirus 10). Whenever it does a scheduled
>scan of a server, it modifies the "Last Accessed Date" of every file it
>scans. We have an HSM product which relies on the Last Accessed Date, so
>Symantec is basically making our HSM product worthless.
>
>Anyone have any knowledge how to fix Symantec Antivirus 10 scan and/or
>autoprotect settings so it does not modify the "Last Accessed Date" time on
>files that it scans? I have scoured the net and Symantec's website and
>haven't found anything yet.

"There's nothing new under the sun".

See this article from 1995: <http://www.strom.com/pubwork/iwhsm95.html>;
Quote:
"But the virus scanning software was an even bigger issue. The bank
(ABN-Amro Chicago] used Central Point/Symantec's virus protection
products, and when these scanned their disk drives, they would change
the access date of the files on the disk. This would setup what is
called a "runaway recall," meaning that the HSM software [Cheyenne]
thinks all these files have been opened by real humans. It then tries to
recall all these files back to magnetic storage. It was a pitiful thing
to watch as all these unneeded files were brought back on-line, filling
up the magnetic disks."

This "caused the bank's staff to reject this solution".

Declaration of bias: I have always had
"NtfsDisableLastAccessUpdate"=dword:00000001 on all my servers.

--
Michael Bednarek http://mbednarek.com/ "POST NO BILLS"

Posted by Leythos on January 17, 2006, 6:17 am
If you were  Registered and logged in, you could reply and use other advanced thread options
zo@gtz.pbz.nh says...
> On Mon, 16 Jan 2006 10:37:39 -0600, Brian Wood wrote in
> microsoft.public.security.virus:
>
> >This may not be the proper forum to post this, but please humor me. We are
> >running Symantec CLient Security 3 in our environment (which the Antivirus
> >component piece is Symantec Antivirus 10). Whenever it does a scheduled
> >scan of a server, it modifies the "Last Accessed Date" of every file it
> >scans. We have an HSM product which relies on the Last Accessed Date, so
> >Symantec is basically making our HSM product worthless.
> >
> >Anyone have any knowledge how to fix Symantec Antivirus 10 scan and/or
> >autoprotect settings so it does not modify the "Last Accessed Date" time on
> >files that it scans? I have scoured the net and Symantec's website and
> >haven't found anything yet.
>
> "There's nothing new under the sun".
>
> See this article from 1995: <http://www.strom.com/pubwork/iwhsm95.html>;
> Quote:
> "But the virus scanning software was an even bigger issue. The bank
> (ABN-Amro Chicago] used Central Point/Symantec's virus protection
> products, and when these scanned their disk drives, they would change
> the access date of the files on the disk. This would setup what is
> called a "runaway recall," meaning that the HSM software [Cheyenne]
> thinks all these files have been opened by real humans. It then tries to
> recall all these files back to magnetic storage. It was a pitiful thing
> to watch as all these unneeded files were brought back on-line, filling
> up the magnetic disks."
>
> This "caused the bank's staff to reject this solution".
>
> Declaration of bias: I have always had
> "NtfsDisableLastAccessUpdate"=dword:00000001 on all my servers.

But he said his application uses the last accessed date, your fix would
disable it.

http://www.microsoft.com/resources/documentation/Windows/2000/server/res
kit/en-us/Default.asp?
url=/resources/documentation/Windows/2000/server/reskit/en-
us/regentry/46656.asp

--

spam999free@rrohio.com
remove 999 in order to email me

Similar ThreadsPosted
Re: question about Symantec Antivirus 10 January 26, 2006, 12:41 am
Symantec AntiVirus Corp X problems October 11, 2005, 4:58 pm
Migration of Symantec AntiVirus Server from version 10.0 to 10.1 problem September 28, 2006, 3:49 am
Symantec Antivirus Corporate 10 not scanning all files on the drive January 22, 2007, 11:35 am
How to completely remove Symantec Antivirus Corporate edition September 28, 2007, 2:57 am
Symantec Client Security and Symantec Anti Virus Elevation of Privilege June 13, 2006, 5:25 pm
Anyone using CA Antivirus 2007; a question October 5, 2006, 12:28 am
symantec June 14, 2008, 3:19 am
Symantec Liveupdate September 26, 2007, 4:44 pm
There were no new updates available for any of your Symantec products. July 15, 2005, 8:12 am

The site map in XML format XML site map

Contact Us | Privacy Policy