Remerciements0

SafeMode scans/activity in History logs ?

Envoyé le: 2010-05-09 | 13:30 · 4 Replies · · Traduction:

Hi Norton Ideas

I've observed (at least on my box) NIS Full System scans ~ run from SafeMode do not populate info to History logs.

I'll assume NIS detections/activity from SafeMode do not populate info to History logs. 

I've observed MBAM Full System scans ~ run from SafeMode render scan results/info to AppData\Roaming\.

I'll assume if MBAM has the capability to save scan info/activity from SafeMode and/or thinks SafeMode scan info is relevant for the user than perhaps NIS should also have the capability. 

My preference would be for NIS SafeMode scans/activity to populate info to NIS History logs... but, scan/activity info to AppData or temp folder would be great.   Just in case the SafeMode info is required for additional user activity. 

Thanks

Thématiques: New Feature

Réponses

Remerciements0

Re: SafeMode scans/activity in History logs ?

Envoyé le: 2010-05-17 | 14:31 · Permalien

This is what I find strange: If a Threat is Detected during a Safe-Mode Scan, it will appears in the Norton Security History, but the Full System Scan won't, i.e. the "Last Run:" Date will not change, and it is not Logged in the N.S.H. that a Full System was Completed.  I would also like to see Safe Mode Scans being logged in the Norton Security History (N.S.H.).

Thursday, November 21, 2013: The THREATCON was changed to Level 1: Normal | Tue., Nov. 05, 2013: Zero-Day Vulnerability: Microsoft Security Advisory 2896666 | Saturday, November 09, 2013: Cyber-Criminals Serve Up A Veritable Smorgasbord Of Threats For South Koreans | Wednesday, October 09, 2013: New Internet Explorer Zero-Day Targeted In Attacks Against Korea And Japan [C.V.E.-2013-3897]
Remerciements0

Re: SafeMode scans/activity in History logs ?

Envoyé le: 2010-05-18 | 11:18 · Permalien

Hi Floating_Red

So, in your experience... I should expect to see detected threats populate to Norton Security History...but, as I have observed you do confirm that scan results are not logged in the HSH. 

Thank you for your info and comments..

Remerciements0

Re: SafeMode scans/activity in History logs ?

Envoyé le: 2010-06-08 | 05:10 · Permalien

In safemode Norton runs only the basic components for scanning so it may not log all the events. I will have to check with our engineering team for the details on this. You may also find this thread useful: http://community.norton.com/t5/Norton-Internet-Security-Norton/Scanning-for-threat-s-etc-in-Safe-Mode/m-p/54107/highlight/true#M28401
Remerciements0

Re: SafeMode scans/activity in History logs ?

Envoyé le: 2010-06-08 | 08:08 · Permalien

Hello athena
Thanks, for your interest and of course the very useful thread link...
I presumed since Scans were not logged in safemode that.. If a Threat is Detected during a safemode scan, it will also not appear in the Norton Security History.
Floating_Red wrote: If a Threat is Detected during a Safe-Mode Scan, it will appear in the Norton Security History [..]
athena wrote: In safemode Norton runs only the basic components for scanning so it may not log all the events. [..] check with our engineering team for the details [..]

My concerns and answers then... may be in the details.  I imagined a Threat that may need to be Quarantined / Unresolved or a potential False Positive I would need to investigate further and or submit to Symantec...or, a Threat that may require manual remediation / etc.... and having no concept of how I would then proceed due to the absence of the event logged in the Security History.   Prompted my "New Idea" post.  I remain concerned, confused and very interested - as to, how do I proceed if a Threat is detected in safemode and the event is not logged to Security History.  How would I retain the event data for furthur investigation, for submission to Symantec or for manual remediation.  Granted, there are Pro`s and Con`s on scanning in safemode.  But, I may have to scan in safemode...then, "what if's" and "how to's" logically follow and I imagined having the events logged would be beneficial for users as well as Symantec.
Appreciate, your continued interest and reman most interested to learn all the "details".  
Respectfully