Symantec System Center Console- threats not shown

[Myke 0]

Our network uses Symantec AntiVirus Corporate Edition 10.2 on all servers (2003 and 2000 SP4) and clients (XP SP3). We use the Symantec System Center Console (SSC) to manage and monitor all clients/servers. Whenever a threat is detected, the SSC is supposed to show the a warning/threat icon on the client and its parent server, which helps to know if a virus has been detected.

 

At some point last year (we're uncertain), the SSC stopped displaying the alert icon when a threat was detected. Because of this, we were unaware of any potential threats. Now, I have to pull a threat log of all clients/servers each day to ensure that nothing is at risk. While this isn't a huge chore, the SSC should be functioning properly. All of the updates and sheduled scans are functioning as they should and communication between the clients and servers is not a problem. TCP port 2967 has been set as an exception in the clients' firewalls to allow proper communication.

 

I've uninstalled and reinstalled the SSC, but to no avail. I plan on calling Symantec, but haven't had time for the minimum 3 hours that I know I'll be spending on the phone with them. Was hoping that anyone in here might have encountered this problem before, or possibly have any clues or hints that I may not have thought of or seen before.

 

As always, thanks in advance.

[DavidG 0]

I just ran into this today. The problem was an un-checked setting in the console.

 

When connected and logged in to the console, select the Tools menu, then Symantec System Center Console Options. At the bottom of the first tab (Virus Alert Filter), check the box to display the infected state of each client.

 

Because I have the console loaded directly on my desktop (as opposed to running it on the server), I had to save the settings for them to stick AND the SSCC had to be run as an administrator or it wouldn't save any of the settings at all.

 

Now I'm dealing with a situation where I can't take action on items (like deleting an infected file) because it won't let me do it from the console on my desktop, even when running as an admin. I can still perform the functions on the server, but that defeats the purpose of having it installed on my desktop.

 

Hope this helps you.

 

David

[Myke 0]

Thanks, DavidG. The box was unchecked, but it will take a possible threat to test this out. What's odd is that nothing really changed for the SSC that I can remember; it just stopped doing that.

 

In regards to your issue, are you setup as an admin on your network? I have the SSC installed on my desktop and don't have any problems running those tasks.

[Myke 0]

Following up on this, anyone know of malware which would/could disable the feature to display the infected state of each client?

 

Neither my boss nor myself remember unchecking this... why would we? Now I know that there are viruses and malware which attempt to disable AV products, but if there's one out there which can actually disable the SSC's ability to show the infected status, that'd be pure genious... evil, but genious.

 

I'm having trouble searching the net for anything like this. Was wondering if anyone has come across something like this.