Phishing & BotNets
RE: Worm Origin Oct 24 2005 07:06AM
dave kleiman (dave isecureu com)

> Since Norton AV should have restricted the download itself
> (or at least the RUNNING OF virus) that implicitly admit user
> tampered with AV.
> I don't know (maybe someone more expert than me here) if
> there is such a thing as a Norton AV eventlog entry for
> manual STOP and RESTART of AV, but I hoper there is one...
> If you're able to demonstrate that:

Symantec writes events to the application log for disabling and enabling
Auto Protect it is event ID 23 and 24 on the corporate editions.

Dave

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus