Phishing & BotNets
Back to list
RE: Worm Origin
Oct 24 2005 07:06AM
dave kleiman (dave isecureu com)
> Since Norton AV should have restricted the download itself
> (or at least the RUNNING OF virus) that implicitly admit user
> tampered with AV.
> I don't know (maybe someone more expert than me here) if
> there is such a thing as a Norton AV eventlog entry for
> manual STOP and RESTART of AV, but I hoper there is one...
> If you're able to demonstrate that:
Symantec writes events to the application log for disabling and enabling
Auto Protect it is event ID 23 and 24 on the corporate editions.
[ reply ]
Copyright 2010, SecurityFocus