Symantec Endpoint Protection 11.0.5 64-Bit Full Version
Sibyl Piccuillo
if so try :
not exists keys whose (value "DisplayName" of it as string as lowercase contains "symantec endpoint protection") of keys "hklm\software\microsoft\windows\currentversion\uninstall" of (x64 registries;x32 registries)
If you are trying to get machines that have Symantec installed and are below a certain version then try:
exists keys whose (value "DisplayName" of it as string as lowercase contains "symantec endpoint protection" AND value "DisplayVersion" of it as string as version < "14.0.3897.1101" as version) of keys "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" of (x64 registries;x32 registries)
Compare the true/false values with the raw version data. You may find some discrepancies which could be due to needing the pad of inspector added to pad out the version. A screenshot of the analysis results showing both the raw version, the results, and the relevance will help me understand what is going on.
I'm french so sorry for my bad english... i will try to explain one problem that i've got since 1 month. I've got a lot of autoit scripts that run on my LAN (compile scripts). I use the last version of autoit.
One month ago, my virus protection was "symantec endpoint portection 11" and now it's "symantec endpoint portection 12" (exactly : "12.1.1000.157 RU1"). Since this change there is something that is very strange : when i copy one of those scripts (it's the same thing with all my scripts) on a workstation with windows or dos, the copy takes 1 or 2 minutes (before it was immediate) but there no problem with others programs...
I've called the symantec enpoint support and given one my program : there is no virus... so they anwser me to do exceptions in the configuration of the proection but i don't want to do that (for a lot of reason : lot of programs and this is not a solution for me).
Now it's really better with all my scripts (the scans run now fast in one or two seconds when it took one or two minutes before) except for the first script that i've posted where it takes again one minute when i copy the exe to the disk (with "@copy myscript.exe c:temp*.* /y")...
We found that disabling the "Use Upx" option did not resolve this issue when using AutoIt version v3.3.8.1. However, disabling the "Use Upx" option did resolve the issue for us when we went back and tested with the v3.3.6.1 and v3.3.0.0 versions of AutoIt.
I always had false positives and slow exe launch times with UPX compression enabled with SEP 12 and 12.1. Issues were resolved after disabling UPX compression on compiled exes. I think the issue is from the new Sonar Engine (introduced in version 12) not being able to find a reputable match on the files with UPX compression enabled.
The new 12.1.1101.401 RU1 MP1 version is what we are testing now... The x64-bit install seems to perform fine with no issues on our Windows 7 64-bit machines. It's the x32 install on Windows XP we are having the issue even when compiling without UPX compression in Auto v3.3.8.1. If you go to Client Management settings and turn off their new "Insight lookups" function, the performance problems go away altogether (this is not recommended though - can lead to more false positives). Seems like Symantec could make this work similar between x32 and x64, but when we opened a ticket with them they also suggested doing exceptions. We are looking at that, but this is causing us problems with other executables besides compiled AutoIt scripts.
You can also troubleshoot this by disabling the "Allow Insight lookups for threat detection (recommended)" option in the client under "Change Settings"; "Client Management"; "Configure Settings" button; Submissions tab.
Symantec Endpoint Protection is security software to defend against ransomware and other emerging threats with multilayered protection that fuses signatureless technologies like advanced machine learning, behavior analysis and exploit prevention with proven protection capabilities like intrusion prevention, reputation analysis and more.Symantec Endpoint Protection can be used to shield commonly used applications against vulnerability exploits and isolate suspicious applications from malicious activity.
Features of Symantec Endpoint Protection
- Advanced threat detection: Utilize advanced detection techniques to identify and stop sophisticated threats.
- Antivirus and antimalware: Detect and block viruses, malware, ransomware and other malicious software.
- Application control: Control and manage the execution of applications to prevent unauthorized software.
- Behavioral analysis: Analyze and identify suspicious behaviors to detect and stop emerging threats.
- Centralized management: Manage and configure security policies from a centralized console.
- Device control: Monitor and manage connected devices to prevent data leaks and unauthorized access.
- Email security: Scan and filter email attachments and links for potential threats.
- Endpoint encryption: Encrypt sensitive data on endpoints to protect against data breaches.
- Endpoint protection: Safeguard endpoints, such as desktops, laptops and servers, from security threats and attacks.
- Firewall protection: Monitor and control network traffic to prevent unauthorized access and data breaches.
- Intrusion prevention system (IPS): Detect and block intrusion attempts in real-time.
- Multi-layered protection: Deploy multiple layers of defense to provide comprehensive endpoint security.
- Reporting and analytics: Generate reports and gain insights into security events and threats.
- Security updates and patches: Stay protected with regular updates and patches for vulnerabilities.
- Web protection: Filter and block malicious websites and online threats.
- $$ Cost:Trial
During September and October 2018 we continuously evaluated 16 endpoint protection products using settings as provided by the vendor. We always used the most current publicly-available version of all products for the testing. They were allowed to update themselves at any time and query their in-the-cloud services. We focused on realistic test scenarios and challenged the products against real-world threats. Products had to demonstrate their capabilities using all components and protection layers.
7fc3f7cf58