> Since Norton AV should have restricted the download itself
> (or at least the RUNNING OF virus) that implicitly admit user
> tampered with AV.
> I don't know (maybe someone more expert than me here) if
> there is such a thing as a Norton AV eventlog entry for
> manual STOP and RESTART of AV, but I hoper there is one...
> If you're able to demonstrate that:
Symantec writes events to the application log for disabling and enabling
Auto Protect it is event ID 23 and 24 on the corporate editions.
> Since Norton AV should have restricted the download itself
> (or at least the RUNNING OF virus) that implicitly admit user
> tampered with AV.
> I don't know (maybe someone more expert than me here) if
> there is such a thing as a Norton AV eventlog entry for
> manual STOP and RESTART of AV, but I hoper there is one...
> If you're able to demonstrate that:
Symantec writes events to the application log for disabling and enabling
Auto Protect it is event ID 23 and 24 on the corporate editions.
Dave
[ reply ]