Symantec CentralQuarantine ImplementationGuideSymantecCentral Quarantine Implementation GuideThe software described inthis book is furnished under a license agreement and may be usedonly in accordance with the terms of the agreement.Legal NoticeCopyright 2010 Symantec Corporation. All rights reserved.Symantec, the Symantec Logo, Bloodhound, Confidence Online, Digital Immune System,LiveUpdate, Norton, Sygate, and TruScan are trademarks or registered trademarks ofSymantec Corporation or its affiliates in the U.S. and other countries. Other names may betrademarks of their respective owners.This Symantec product may contain third party software for which Symantec is requiredto provide attribution to the third party (Third Party Programs). Some of the Third PartyPrograms are available under opensource or free software licenses. The License Agreementaccompanying the Software does not alter any rights or obligations you may have underthose opensource or free software licenses. Please see the ThirdParty Legal Notice Appendixto this Documentation or TPIP ReadMe File accompanying this Symantec product for moreinformation on the Third Party Programs.The product described in this document is distributed under licenses restricting its use,copying, distribution, and decompilation/reverse engineering. No part of this documentmay be reproduced in any form by any means without prior written authorization ofSymantec Corporation and its licensors, if any.THEDOCUMENTATIONISPROVIDED"ASIS" ANDALLEXPRESSORIMPLIEDCONDITIONS,REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OFMERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT,ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TOBELEGALLYINVALID. SYMANTECCORPORATIONSHALLNOTBELIABLEFORINCIDENTALOR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING,PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE INFORMATION CONTAINEDIN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE.The LicensedSoftware andDocumentationare deemedto be commercial computer softwareas defined inFAR12.212 and subject to restricted rights as defined inFARSection52.227-19"Commercial Computer Software - Restricted Rights" and DFARS 227.7202, "Rights inCommercial Computer Software or Commercial Computer Software Documentation", asapplicable, and any successor regulations. Any use, modification, reproduction release,performance, display or disclosure of the Licensed Software and Documentationby the U.S.Government shall be solely in accordance with the terms of this Agreement.Symantec Corporation350 Ellis StreetMountain View, CA 94043http://www.symantec.comTechnical SupportSymantec Technical Support maintains support centers globally. TechnicalSupports primary role is to respond to specific queries about product featuresandfunctionality. The Technical Support groupalso creates content for our onlineKnowledge Base. The Technical Support group works collaboratively with theother functional areas within Symantec to answer your questions in a timelyfashion. For example, the Technical Support groupworks withProduct Engineeringand Symantec Security Response to provide alerting services and virus definitionupdates.Symantecs support offerings include the following: A range of support options that give you the flexibility to select the rightamount of service for any size organization Telephone and/or web-based support that provides rapid response andup-to-the-minute information Upgrade assurance that delivers software upgrades Global support purchased on a regional business hours or 24 hours a day, 7days a week basis Premium service offerings that include Account Management ServicesFor information about Symantecs Maintenance Programs, you can visit our Website at the following URL:www.symantec.com/business/support/Contacting Technical SupportCustomers with a current support agreement may access Technical Supportinformation at the following URL:www.symantec.com/business/support/Before contacting Technical Support, make sure you have satisfied the systemrequirements that are listed in your product documentation. Also, you should beat the computer onwhichthe problemoccurred, incase it is necessary to replicatethe problem.When you contact Technical Support, please have the following informationavailable: Product release level Hardware information Available memory, disk space, and NIC information Operating system Version and patch level Network topology Router, gateway, and IP address information Problem description: Error messages and log files Troubleshooting that was performed before contacting Symantec Recent software configuration changes and network changesLicensing and registrationIf your Symantec product requires registrationor alicense key, access our technicalsupport web page at the following URL:www.symantec.com/business/support/Customer serviceCustomer service information is available at the following URL:www.symantec.com/business/support/Customer Service is available to assist with non-technical questions, such as thefollowing types of issues: Questions regarding product licensing or serialization Product registration updates, such as address or name changes General product information (features, language availability, local dealers) Latest information about product updates and upgrades Information about upgrade assurance and support contracts Information about the Symantec Buying Programs Advice about Symantec's technical support options Nontechnical presales questions Issues that are related to CD-ROMs or manualsSupport agreement resourcesIf you want to contact Symantec regarding an existing support agreement, pleasecontact the support agreement administration team for your region as follows:customercare_apac@symantec.com Asia-Pacific and Japansemea@symantec.com Europe, Middle-East, and Africasupportsolutions@symantec.com North America and Latin AmericaAdditional enterprise servicesSymantec offers a comprehensive set of services that allowyou to maximize yourinvestment in Symantec products and to develop your knowledge, expertise, andglobal insight, which enable you to manage your business risks proactively.Enterprise services that are available include the following:Managed Services remove the burden of managing and monitoring securitydevices and events, ensuring rapid response to real threats.Managed ServicesSymantec Consulting Services provide on-site technical expertise fromSymantec andits trustedpartners. Symantec ConsultingServices offer a varietyof prepackaged and customizable options that include assessment, design,implementation, monitoring, and management capabilities. Eachis focused onestablishing andmaintaining the integrity andavailability of your ITresources.Consulting ServicesEducationServices provide a full array of technical training, security education,security certification, and awareness communication programs.Education ServicesTo access more information about enterprise services, please visit our Web siteat the following URL:www.symantec.com/business/services/Select your country or language from the site index.Technical Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4Chapter 1 Introducing Symantec Central Quarantine. . . . . . . . . . . . . . . . . . . . . 9About Symantec Central Quarantine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9About Central Quarantine components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10How Central Quarantine works . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11About identifying and quarantining viruses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11About analyzing viruses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12What you can do with Central Quarantine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12Where to get more information about Central Quarantine . . . . . . . . . . . . . . . . . . . 13Chapter 2 Installing and configuring the CentralQuarantine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15Before you install . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15System requirements for the Central Quarantine Server . . . . . . . . . . . . . . . . . . . . . 16System requirements for the Quarantine Console . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16Installing the Central Quarantine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17Chapter 3 Using the Central Quarantine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19About the Central Quarantine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19Enabling the Quarantine Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20Configuring the Quarantine Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20Configuring an Antivirus and Antispyware Policy to use theQuarantine Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21About Central Quarantine properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22Managing quarantined files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24Viewing the quarantined items . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24Deleting the quarantined files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25Restoring quarantined files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25Submitting samples for analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26Setting an automatic sample submission policy . . . . . . . . . . . . . . . . . . . . . . . . . . . 26Submitting files manually . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26Reviewing sample submission status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27Viewing attributes for a sample . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27ContentsReviewing the actions that were taken on a sample . . . . . . . . . . . . . . . . . . . . . . 27Reviewing the submission errors for a sample . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28Configuring events and alerts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28Specifying the events that trigger alerts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28Appendix A Sample processing reference. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .31About sample processing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31Sample Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31Sample State . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32Final states . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32Transit states . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .34Pending states . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34Active states . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35Sample errors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36Index. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39Contents 8Introducing SymantecCentral QuarantineThis chapter includes the following topics: About Symantec Central Quarantine About Central Quarantine components How Central Quarantine works What you can do with Central Quarantine Where to get more information about Central QuarantineAbout Symantec Central QuarantineWhenSymantec Endpoint Protectionfinds aninfecteditemthat cannot be repairedwith the current virus definitions, it blocks access to the item. The products thenpackage the itemalong with any affected systemfiles and settings, and move thepackage to the local Quarantine. The local Quarantine is a special location that isreserved for infected files and related systemside effects. After viruses and otherthreats are isolated in a local Quarantine, they are unable to damage or spreadon the computer.Symantec Endpoint Protection can automatically forward the packages thatcontain the infected files and their related side effects froma local Quarantine tothe Central Quarantine. The Central Quarantine is a central repository. The CentralQuarantine consists of two components: the Quarantine Server and the MicrosoftManagement Console (MMC) snap-in.In addition to scanning files for viruses, Symantec Endpoint Protection clientsscan files for security risks, which include spyware, adware, hacking tools, andjoke programs. Youcanalso forwardthese infectedfiles to the Central Quarantine.1ChapterThreats that are detected and quarantined with Proactive Threat Protection,however, are submitted with a different mechanism.About Central Quarantine componentsTable 1-1 describes the Symantec Central Quarantine components.Table 1-1 Central Quarantine componentsDescription ComponentThe automated analysis center that reviews and analyzessubmissions and creates and distributes updated virusdefinitions.Symantec SecurityResponseThe intermediarybetweenSymantec SecurityResponse andtheCentral Quarantine. Samples areanalyzedandforwardedto Symantec Security Response only if they cannot berepaired with definitions on the gateway. If the sample canbe repaired, definitions are returned from the gateway tothe Central Quarantine.GatewayThe Central Quarantine user interface that is used toconfigure Quarantine Server operations, communicate withthe gateway, and manage definitions updates.Quarantine ConsoleThe component that accepts infected files and side effectsfrom servers and clients and communicates with theQuarantine Console. Items that arrive inthe Quarantine arescanned withthe Quarantine Server's set of definitions andsubmittedif theycannot be repaired. The Quarantine Servershould be configured to listen on specific ports on IPprotocols. Aforwardingclient must be configuredtoforwardto the port that corresponds to the client's forwardingprotocol.Quarantine ServerThe component that handles communications between theQuarantine Server andthe gateway, andtriggers the Defcastmechanism. The Quarantine Agent ensures that the CentralQuarantine has the latest set of definitions from thegateway.Quarantine AgentThe component that scans submitted files with theQuarantine Server's set of definitions. Samples that arrivein the Central Quarantine must be scanned before they canbe submitted.Quarantine ScannerIntroducing Symantec Central QuarantineAbout Central Quarantine components10Table 1-1 Central Quarantine components (continued)Description ComponentThe component that queries servers and clients for theirvirus definitions sequence number.DefcastHow Central Quarantine worksCentral Quarantine uses the Digital Immune Systemtomanage the entire antivirusprocess. The Digital Immune System eliminates many of the manual tasks thatare involved in the submission processes and analysis processes. Automationreduces the time betweenwhena virus is first found and whena repair is deployedwith LiveUpdate.The Digital Immune System does the following: Identifies and quarantines: Rapidly identifies new threats by using powerfulheuristic and behavioral detection. Suspicious items are isolated inthe CentralQuarantine and samples are automatically submitted to Symantec SecurityResponse for analysis. Analyzes: Submits the files to Symantec Security Response for analysis, repair,and testing.About identifying and quarantining virusesThe first goal of the Digital Immune System is to detect new or unknown threatsat the desktop, server, and gateway. Symantec uses Bloodhound heuristicstechnology, whichis designedto detect a majority of newor unknownviral strains.Youcanconfigure clients to automatically sendsuspect files andtheir side effectsto a local Quarantine. A local Quarantine may be located on the desktop, server,or gateway. The local Quarantine packages suspicious files withinformationaboutthe submitting computer, then forwards the files to the corporate CentralQuarantine for further analysis.Since the Central Quarantine may have more up-to-date virus definitions thanthe submitting computer, it scans files by using its own set of virus definitions.If the Central Quarantine cannot fix a file, it strips the file of potentially sensitivedata if configured to do so, and then encrypts it. The Digital Immune Systemthentransmits the file over the Internet to a Symantec gateway for further analysis.Administrators canconfigure the Digital Immune Systemto automatically do thefollowing: Detect and quarantine new and unknown viruses.11 Introducing Symantec Central QuarantineHow Central Quarantine works Filter and forward encrypted samples to Symantec Security Response foranalysis. The Digital Immune System can strip out sensitive content. Check for new virus definitions and status updates.About analyzing virusesThe Quarantine Agent handles the communicationbetweenthe Central Quarantineand the Symantec gateway. If the Central Quarantine cannot repair an infectedfile, the Quarantine Agent forwards it to the gateway. The Quarantine Agent thenqueries the gateway to see if the repair is ready.If the repair is ready, the Quarantine Agent downloads the new virus definitionsset and installs the newdefinitions on the Central Quarantine. If the repair is notready, the Quarantine Agent polls the gateway every 60 minutes for a repair.Whenthe Digital Immune Systemreceives a newsubmission, it does the following: Adds the submission to a tracking database. Filters the submission to eliminate clean files, false positives, known viruses,and expanded threats. Filtering is quick, and because most submissions areresolved by filtering, the response time for filtered items is fast. Analyzes the virus and side effects, generates a repair, and then tests therepair. In most cases, analysis and repair are automatically generated, butsome viruses may require the intervention of Symantec Security Responseresearchers. Builds a new virus definitions set, which includes the new fingerprint, andreturns the new definitions to the gateway.What you can do with Central QuarantinePrevious versions of the Central Quarantine pushed newly received virus andthreat definitions to all the legacy clients that sent quarantined submissions tothe Central Quarantine. This versionof Central Quarantine still sends submissionsto Symantec Security Response and receives updates for those submissions.However, this versiondoes not pushthese definitions to clients that runSymantecEndpoint Protection.Nevertheless, Central Quarantine provides a single source to co-locate allquarantined items on your network. All quarantined items appear in one windowandtheyare automaticallysubmittedtoSymantec SecurityResponse. This windowalso provides information about the submitted threats, such as the user and thecomputer that caught the threat. This windowalso shows the status of definitionsthat are created to detect the unknown threats that you submit.Introducing Symantec Central QuarantineWhat you can do with Central Quarantine12The Digital Immune System feeds the information about the submitted threatsto the Symantec Global Intelligence Network, whichprovides unparalleled insightinto the Internet security landscape. Symantec Global Intelligence Networkconsists of more than 150 million desktop antivirus sensors, 40,000 intrusiondetectionandfirewall sensors, and4,300monitoredandmanagedsecurity devicesworldwide. This informationis combined withSymantec's vulnerability databaseof 13,000 entries, whichis the world's largest. These entries cover 30,000 versionsof applications and operating systems from more than 4,000 vendors.Where to get more information about CentralQuarantineYou can find the primary documentation about Central Quarantine in the Docsfolder on the installation CDs. Some individual component folders containcomponent-specific documentation. Updates to the documentation are availablefrom the Symantec Technical Support and Platinum Support Web sites.Table 1-2 lists the additional information that is available from the SymantecWeb sites.Table 1-2 Symantec technical support Web sitesWeb address Types of informationhttp://www.symantec.com/business/support/index.jsp Public Knowledge BaseReleases and updatesManuals and documentationContact optionshttp://securityresponse.symantec.com Virus andother threat informationandupdateshttp://enterprisesecurity.symantec.com Product news and updateshttps://www-secure.symantec.com/platinum/login.html Platinum Support Web access13 Introducing Symantec Central QuarantineWhere to get more information about Central QuarantineIntroducing Symantec Central QuarantineWhere to get more information about Central Quarantine14Installing and configuringthe Central QuarantineThis chapter includes the following topics: Before you install System requirements for the Central Quarantine Server System requirements for the Quarantine Console Installing the Central QuarantineBefore you installBefore you install the Central Quarantine, you must consider the following: Administrator rights are required to install the Quarantine Console and theQuarantine Server. Make sure that you have proper rights before installing. Before installingCentral Quarantine, make sure that youuninstall anypreviousversion of Central Quarantine that exists on the computer. The Central Quarantine is composed of the Quarantine Server and theQuarantine Console. Youcaninstall the Quarantine Server andthe QuarantineConsole on the same computers or different computers with Windows2000/XP/2003. The Quarantine Console must share a network protocol (TCP/IP) with theQuarantine Server to configure it. Products that use quarantine canforward files to the Quarantine Server usingTCP/IP. Ensure that this networkprotocol is installedonthe Quarantine Server.2ChapterSystem requirements for the Central QuarantineServerInstalling the Central Quarantine Server requires the following systemrequirements: Windows 2000Professional/Server/AdvancedServer, XPProfessional, Server2003 Web/Standard/Enterprise/Datacenter Microsoft Internet Explorer 5.5, Service Pack 2, 128-bit encryption, or laterIf you install Symantec Endpoint Protection on this computer, MicrosoftInternet Explorer 6.0 or later is required. 128 megabytes (MB) of RAM Minimum swap file size of 250 MB 40 MB of available disk space 500 MB to 4 GB of available disk space for quarantined itemsNote: If you run Windows XP, system disk space usage is increased if the SystemRestore functionality is enabled. For more information on how System Restorefunctionality is enabled, see the Microsoft operating system documentation.System requirements for the Quarantine ConsoleInstalling the Quarantine Console requires the following system requirements: Windows 2000Professional/Server/AdvancedServer, XPProfessional, Server2003 Web/Standard/Enterprise/Datacenter Microsoft Internet Explorer 5.5, Service Pack 2, 128-bit encryption, or laterIf you install Symantec Endpoint Protection on this computer, MicrosoftInternet Explorer 6.0 or later is required. 64 MB RAM 35 MB of disk space Microsoft Management Console 1.2Note: If Microsoft Management Console is not installed, you need 3 MB of freedisk space (10 MB during installation).Installing and configuring the Central QuarantineSystem requirements for the Central Quarantine Server16Installing the Central QuarantineInstalling the Central Quarantine consists of the following tasks: Install the Quarantine Console Install the Quarantine ServerNote: You can install the console and the server in any order.To install the Quarantine Console1 Start the installation from the Tools product disc, and then click InstallCentral Quarantine Console.2 In the Welcome dialog box, click Next.3 In the License Agreement dialog box, select I accept the terms inthe licenseagreement.4 Click Next.5 In the Destination Folder dialog box, select one of the following: Next: To install to the default folder. Change: To select a different folder.Do not install the Quarantine Console on a network drive.6 Follow the on-screen directions to complete the installation.To install the Quarantine Server1 Start the installation from the Tools product disc, and then click InstallCentral Quarantine Console.2 In the Welcome dialog box, click Next.3 In the License Agreement dialog box, select I accept the terms inthe licenseagreement.4 Click Next.5 In the Destination Folder dialog box, select one of the following: Next: To install to the default folder. Change: To select a different folder.The Quarantine Server should not be installed on a network drive.6 In the Setup Type dialog box, click Internet based (Recommended).7 Click Next.17 Installing and configuring the Central QuarantineInstalling the Central Quarantine8 In the Maximum Disk Space dialog box, either accept the default disk spaceof 500 megabytes, or type a new value (in megabytes) in the Disk space box,then click Next.9 In the Contact Information dialog box, type your company's name, accountnumber (if available), contact name, contact telephone, and contact email.10 Click Next.11 In the Web Communication dialog box, either accept the default gatewayaddress, or type another address (if provided by Symantec) in the GatewayName box. Then click Next.12 Follow the on-screen directions to complete the installation.Installing and configuring the Central QuarantineInstalling the Central Quarantine18Using the CentralQuarantineThis chapter includes the following topics: About the Central Quarantine Enabling the Quarantine Server Configuring the Quarantine Server Configuring anAntivirus and Antispyware Policy to use the Quarantine Server About Central Quarantine properties Managing quarantined files Submitting samples for analysis Reviewing sample submission status Configuring events and alertsAbout the Central QuarantineThe Central Quarantine is composed of two primary components, the QuarantineServer andthe Quarantine Console. The Quarantine Server stores infectedsamplesand communicates with Symantec Security Response. The Quarantine Console,whichsnaps into Microsoft Management Console, lets youmanage the QuarantineServer.To use the Central Quarantine, do the following actions: Enable the Quarantine Server. Configure the Quarantine Server.3Chapter Configure the clients to forward samples to the Quarantine Server.Enabling the Quarantine ServerYou can enable the Quarantine Server on the local computer and on a remotecomputer.To enable the Quarantine Server on the local computer1 In the Symantec Central Quarantine Console, in the left pane, right-clickSymantec Central Quarantine, and then click Attachto server.2 In the Select Computer dialog box, click This computer, and then click OK.To enable the Quarantine Server on a remote computer1 In the Symantec Central Quarantine Console, in the left pane, right-clickSymantec Central Quarantine, and then click Attachto server.2 In the Attach to Quarantine Server dialog box, type the server name.3 Type the user name and password to log on to the server.4 If the server is part of a domain, type the domain name as well.Configuring the Quarantine ServerYou configure the Quarantine Server with the following information: The folder location to store files on the Quarantine Server The protocol and port on which to listenAfter the Quarantine Server is configured, you configure clients to send copiesof the files that are contained in their local Quarantines.Note: The Quarantine Console user interface lets youselect the IPor SPXprotocoland specify the port number to configure. This IP protocol and port number isTCP and is the listening port. Do not select SPX. Also, the TCP port number thatyou enter is not what appears when the ports are displayed with tools like netstat-a. For example, if you enter port number 33, netstat -a displays TCP port 8448.The hexadecimal and decimal numbers transpose and improperly convert. Fordetails, see http://entsupport.symantec.com/docs/n2000081412370148.Using the Central QuarantineEnabling the Quarantine Server20To configure the Quarantine Server1 In the Symantec Central Quarantine Console, in the left pane, right-clickSymantec Central Quarantine, and then click Properties.2 In the Symantec Central Quarantine Properties dialog box, on the Generaltab, type the folder location for the Central Quarantine.3 Under Maximumallowable size, specifythe maximumsize for the Quarantine.4 Under Protocols, check ListenonIP (TCP/IP).Make sure that Listen on SPX is unchecked.5 In the Port box, type the port number on which to listen.The default port number is 33.6 Click OK.Configuring an Antivirus and Antispyware Policy touse the Quarantine ServerSymantec Endpoint Protection clients in a group or a group's location must usean Antivirus and Antispyware Policy that forwards the Quarantine samples tothe Quarantine server. The policy requires youto enter the fully-qualified domainname (recommended) or IP address of the Quarantine server. The policy alsorequires you to enter the protocol and port number that you specified for theQuarantine server's listening port.To configure an Antivirus and Antispyware Policy to use the Quarantine Server1 In the Symantec Endpoint Protection Manager Console, click Policies.2 Under View Policies, click Antivirus and Antispyware Policy.3 Under Tasks, click Add anAntivirus and Antispyware Policy.You can also edit an existing policy.4 On the policy page, click Submissions.5 Under Quarantined Items, check Allowclient computers to automaticallysubmit quarantined items to a Quarantine Server.6 In the Server name box, type the fully-qualified domain name or IP addressof the Quarantine Server.7 In the Port number box, accept or change the default port number.21 Using the Central QuarantineConfiguring an Antivirus and Antispyware Policy to use the Quarantine Server8 Inthe Retry box, accept or change the retry interval whenclient to QuarantineServer communications fail.9 Click OK.About Central Quarantine propertiesYou use the Properties dialog box to configure various settings for the CentralQuarantine.Note: Central Quarantine's default settings use the information that is providedduring the installation to offer comprehensive protection without furtherconfiguration. You do not need to change any of these settings.Table 3-1 Central Quarantine propertiesDescription PropertyThis property lets you specify the primary quarantinesettings, such as the folder location of the Quarantine.This property also lets you specify the settings for themaximum size of the folder's contents, the listeningprotocol for communication with clients, and the consoleauto-refresh interval.GeneralThis property lets you specify communication settings,including the computer name of the Symantec gatewayand the following security settings: Secure submission sends virus samples to Symantecby using secure sockets Layer (SSL). Secure download uses SSL to receive updateddefinitions from Symantec. Symantec Immune System Gateway specifies thegateway computer that communicates withSymantecSecurity Response.Web CommunicationUsing the Central QuarantineAbout Central Quarantine properties22Table 3-1 Central Quarantine properties (continued)Description PropertyThis property lets you specify how to communicate withandthrougha proxy firewall, if your network uses a proxyfirewall: Firewall name is the IP address or the name of thefirewall. Firewall port is the port onwhichto communicate withthe firewall. Firewall user name is the user name to communicatewith the firewall. Firewall password is the password to communicatewith the firewall.FirewallThis property lets youspecify howsamples are submittedand processed: Automatic sample submission automatically queuesvirus samples for analysis. Queue check interval is the frequency at which theQuarantine is checked for new items. Strip user data from sample maintains security byremoving potentially sensitive data from samplesubmissions. Status query interval is the frequency at which thegateway is polled for status changes about submittedsamples.Sample PolicyThis property lets you specify how antivirus andantispyware definitions are processed: Active sequence number is the sequence number ofthe currently installed definitions on the QuarantineServer. Sequence numbers are used only by Symantecantivirus products, are assigned to signature setssequentially, and are always cumulative. A signatureset with a higher sequence number supersedes asignature set with a lower sequence number. Certified definitions interval is the frequency, inminutes, for polling the gateway for updated certifieddefinitions. The default setting is three times a day.Definition PolicyThis property lets youedit the customer informationthatyouenteredduring the installation. All fields are required.Customer Information23 Using the Central QuarantineAbout Central Quarantine propertiesTable 3-1 Central Quarantine properties (continued)Description PropertyThis property lets you configure the alerting for specificevents.AlertingThis property lists the history of the Quarantine Servererrors.General ErrorsManaging quarantined filesBy default, Symantec Endpoint Protection clients isolate the infected items thatcannot be repaired with their current sets of virus definitions. Clients that havebeenconfiguredto forwardthese infectedfiles andtheir side effects automaticallysend copies to the Central Quarantine Server.Viewing the quarantined itemsFiles are added to the Central Quarantine when client computers are configuredto forward the infected items to the Quarantine Server.Table 3-2 Quarantined file informationDescription PropertyName of the infected item File nameUser whose file was infected User nameComputer on which the infected item wasdiscoveredComputerIndicates whether the sample was analyzed AnalyzedDate that the sample was quarantined AgeCurrent state of the sample Sample stateSee Sample State on page 32.Sequence number of the definitions set that isneeded to resolve the virusDefinitions NeededProcessing state of the sample StatusSee Sample Status on page 31.Name of the virus that is identified VirusUsing the Central QuarantineManaging quarantined files24Table 3-2 Quarantined file information (continued)Description PropertySample processing errors ErrorsSee Sample errors on page 36.To view the quarantined items1 Inthe Symantec Central Quarantine Console, inthe left pane, click SymantecCentral Quarantine.Quarantined items are listed in the right pane.2 In the right pane, right-click a quarantined item, and then click Properties.Deleting the quarantined filesAlthough you can delete any item that is in the Central Quarantine, reserve thisoption for the files that you no longer need. After you confirm that the updateddefinitions have detected and eliminated the virus, it is safe to delete thequarantined item.To delete the quarantined files1 Inthe Symantec Central Quarantine Console, inthe left pane, click SymantecCentral Quarantine.2 In the right pane, right-click one or more files, and then click Delete.Restoring quarantined filesWhen you choose to restore a file, no attempt is made to repair it. Use this optionwithdiscretionto avoid the risk of infecting your system. For example, youshouldrestore a file only whenSymantec Security Response notifies youthat a submittedfile is not infected. Restoring a potentially infected file is not safe. Restored filesare copied to a folder location that you specify.To restore quarantined files1 Inthe Symantec Central Quarantine Console, inthe left pane, click SymantecCentral Quarantine.2 In the right pane, right-click one or more files, and then click All Tasks >Restore Item.3 If you are sure that you want to restore the file, click Yes.4 In the Browse for Folder dialog box, select a location to restore the file, andthen click OK.25 Using the Central QuarantineManaging quarantined filesSubmitting samples for analysisSample Policy settings determine whether or not the virus samples are submittedautomatically to the gateway. If automatic sample submission is not selected,each sample in the Quarantine must be manually released to the gateway.The Policy settings for automatic sample submissioncanbe overridden. Generally,the samples are submitted manually only when a submission error or a changeto the queue priority of selected samples is desired.Setting an automatic sample submission policySample Policy settings determine whether or not the virus samples are submittedautomatically to the gateway. If automatic sample submission is not selected, thesamples in the Quarantine must be released to the gateway individually.For additional security, youcanspecify that user data be stripped fromthe samplebefore submission.Note: You can supersede the Policy submission settings on an item-by-itembasiswhen you view the Actions tab for a selected item in the Quarantine.To set an automatic sample submission policy1 In the Symantec Central Quarantine Console, in the left pane, right-clickSymantec Central Quarantine, and then click Properties.2 In the Symantec Central Quarantine Properties dialog box, on the SamplePolicy tab, set the sample policy.Submitting files manuallySuspect files can be manually submitted for virus analysis. Samples that can berepaired with the definitions that reside on the Quarantine Server or the gatewayare not sent to Symantec Security Response.Tobe eligible for manual submission, a sample must meet the followingconditions: The sample cannot already be eligible for automatic submission(X-Sample-Priority must be 0). The sample has not already been submitted (X-Date-Submitted is missing or0). The sample has not already been analyzed (X-Date-Finished is not present or0).You must set the priority for a sample before you can submit files manually.Using the Central QuarantineSubmitting samples for analysis26To set the priority for a sample manually1 Inthe Symantec Central Quarantine Console, inthe left pane, click SymantecCentral Quarantine.2 In the right pane, right-click an item, and then click Properties.3 In the Symantec Central Quarantine Properties dialog box, on the Actionstab, set the submission priority.To submit items manually to Symantec Security Response1 Inthe Symantec Central Quarantine Console, inthe left pane, click SymantecCentral Quarantine.2 In the right pane, right-click one or more files, and then click All Tasks >Queue itemfor automatic analysis.Reviewing sample submission statusYou can determine a sample's status by reviewing the actions and the attributesthat were set during the communications between the Quarantine Server and thegateway.Viewing attributes for a sampleThe request andthe response messages that clients andservers exchange containnumerous attributes that describe a sample's completely and status. Theseproprietary attributes always start with the X- characters.To view attributes for a sample1 In the Symantec Central Quarantine Console, in the left pane, right-clickSymantec Central Quarantine.2 In the right pane, right-click an item, and then click Properties.3 In the Properties dialog box, on the Sample Attributes tab, double-click adisplayed attribute for a brief definition of the attribute.Reviewing the actions that were taken on a sampleThe actions that were taken on a sample include a selected sample's submissionand virus definitions delivery status.You can override the default sample submission policy settings for the selectedsample. You can manually queue a sample for submission to Symantec SecurityResponse, as well as query for updated virus definitions files for the selectedsample.27 Using the Central QuarantineReviewing sample submission statusTo review actions on samples1 Inthe Symantec Central Quarantine Console, inthe left pane, click SymantecCentral Quarantine.2 In the right pane, right-click an item, and then click Properties.3 In the Properties dialog box, on the Actions tab, reviewthe actions that weretaken on the sample.Reviewing the submission errors for a sampleSubmission errors, if any, are reported for each sample. Review the entries todetermine what action is required for the sample.To review the submission errors for a sample1 In the Symantec Central Quarantine Console, in the left pane, right-clickSymantec Central Quarantine.2 In the right pane, right-click an item, and then click Properties.3 In the Properties dialog box, on the Errors tab, reviewthe submission errors.Configuring events and alertsYou can specify the events that you want to know about. You send the eventinformation to the NT event log.Specifying the events that trigger alertsYou can send different types of events to the NT event log.Table 3-3 Events that trigger alertsDescription EventThe Quarantine Agent cannot connect to theDigital Immune System gateway.Unable to connect to the GatewayDefcast is the service that distributes newdefinitions fromthe Quarantine Server totargetcomputers.Defcast errorThe distribution of newdefinitions failed. Alsoindicates that definitions are available fornonmanaged clients.Cannot install definitions on targetcomputersUsing the Central QuarantineConfiguring events and alerts28Table 3-3 Events that trigger alerts (continued)Description EventThe Quarantine Server cannot find thedefinitions directory.Unable to access definition directorySamples cannot be scanned in the Quarantineand are not forwarded to the gateway.Cannot connect to Quarantine ScannersvcThe Quarantine cannot communicate with thegateway.The Quarantine Agent service hasstoppedDefinitions have not yet arrived from thegateway.Waiting for needed definitionsNew certified definitions have arrived on theQuarantine Server.New certified definitions arrivedNew non-certified definitions have arrived onthe Quarantine Server in response to a samplesubmission.New non-certified definitions arrivedThe Quarantine folder is nearly full. Disk quota remaining is low forQuarantine dirThe Quarantine folder is set to a maximumsizethat is greater thanthe available free diskspace.Disk free space is less than Quarantinemax sizeEither a sample was not repairedor a repair wasnot necessary.Sample: was not repairedNew definitions could not be installed, usuallydue to a corrupted definitions set.Sample: unable to install definitionsAn error occurred while this sample wasprocessed.Sample: processing errorThe sample could not be processedautomatically. Contact Tech Support for helpwith the sample.Sample: needs attention from TechSupportThe sample is held on the Quarantine Serverinstead of being automatically submitted.Sample: held for manual submissionNew definitions should have been installed(status is distribute), but were not.Sample: too long without installing newdefs29 Using the Central QuarantineConfiguring events and alertsTable 3-3 Events that trigger alerts (continued)Description EventNewdefinitions have arrivedfromthe gateway,but confirmation that they were installed onthe client has not yet been received at theQuarantine.Sample: too long with Distributed StatusDefinitions have not yet been pulled from thegateway.Sample: too long with Needed statusThe gateway has not yet responded. Sample: too long with Released statusThe gateway has not yet accepted the sample. Sample: too long with Submitted statusThe sample has not yet been scanned initiallyat the Quarantine.Sample: too long withQuarantinedstatusNew definitions are held on the QuarantineServer instead of being delivered.Sample: newdefinitions heldfor deliveryTo specify the events that trigger alerts1 In the Symantec Central Quarantine Console, in the left pane, right-clickSymantec Central Quarantine, and then click Properties.2 In the Symantec Central Quarantine Properties dialog box, on the Alertingtab, check NTevent log.3 Under Configure Event Notification, do one or both of the following: Check the events that you want know about. Uncheck the events that you do not want to know about.4 Click OK.Using the Central QuarantineConfiguring events and alerts30Sample processingreferenceThis appendix includes the following topics: About sample processing Sample Status Sample State Sample errorsAbout sample processingThe Digital Immune System provides realtime information about any samplewithin the system, including the processing status and the analysis state of asubmitted sample.Sample StatusTable A-1describes the Sample Status, whichis the processingstatus of the samplewithin the Digital Immune System.Table A-1 Sample StatusDescription StatusThe sample requires intervention from technical support. AttentionNewdefinitions are heldfor delivery to the submitting computer. AvailableAAppendixTable A-1 Sample Status (continued)Description StatusNew definitions are queued for delivery to the submittingcomputer.DistributeNewdefinitions have beendelivered to the submitting computer. DistributedA processing error occurred. ErrorThe sample is withheld from submission. HeldNewdefinitions have beeninstalled onthe submitting computer. InstalledNew definitions are required for the sample. NeededDefinitions cannot be delivered to the submitting computer. Not installedThe Central Quarantine received the sample. QuarantinedThe sample has been queued for analysis. ReleasedSample processing starts again. RestartThe sample has been submitted to Symantec Security Responsefor analysis.SubmittedNew definitions are not required for the sample. UnneededSample StateSample State is the analysis state of the submitted sample within the DigitalImmune System. The state indicates where in the network hierarchy a sample islocated, what stage of the analysis pipeline is currently working on the sample,or its final disposition.Note: Any state that infers that a sample was returned back to a client computeris no longer supported.Final statesSamples that have been finished are in one of the final states. All nodes in theDigital Immune System use the terminal states. After a sample has been placedina terminal state, its state does not change again. The X-Date-Analyzed attributeis set when a sample is placed into a terminal state; its presence means that thevalue of X-Analysis-State is terminal.Sample processing referenceSample State32Table A-2 Final statesDescription StateAninternal programmingerror has derailedtransport or analysisof the sample.abortThe sample requires intervention from technical support. attentionThe sample is infectedwitha virus, but the definitiongenerationservice in the back office reported an error. No virus definitionsfiles are available.brokenThe sample is not acceptable, and has been refused. declinedA processing error occurred. errorThe sample is infected with a virus, and can be repaired withavailable virus definitions files.infectedThe sample has been analyzed and no virus was found, in spiteof a detected infection. A mistake in previous virus definitionsfiles caused the incorrectly detected infection and the mistakeis corrected in newer virus definitions files.misfiredThe sample has not been analyzed, but does not contain anyapparent suspicious code.nodetectThe sample is infected witha virus, but it cannot be repaired withavailable virus definitions files. It should be deleted.norepairThe sample contains no executable code, and therefore cannotbe infected with any virus. The sample may be too small tocontain any executable code, or may contain data only, such asa graphic image or an audio clip.uninfectableThe sample has been analyzed and no virus was found. uninfectedThe sample contains known malicious software, such as a wormor Trojan horse. It should be deleted.unsubmittableCentral Quarantine cannot scan this sample because it isencrypted or password-protected. You need to decrypt it orremove the password protection before resubmitting it.encryptedFiles either created by malicious code or that contain maliciouscode. The only actionyoucantake onthese files is to delete them.delete33 Sample processing referenceSample StateTable A-2 Final states (continued)Description StateFiles that cannot be cleaned. The files may be alteredaccidentallyor by a virus, and they may contain corrupted viral code. Due tothe alterations, it is impossible or unsafe to retain the files. Youshould restore the files from a backup.restoreTransit statesSamples that have not yet reached Symantec Security Response are in one of thetransit states. Only the components outside Symantec Security Response use thetransit states. Asample may remainina pending state indefinitely before it movesto another state.Table A-3 Transit statesDescription StateA gateway accepted the sample, but the sample is not yetimported into Symantec Security Response.acceptedSymantec Security Response imported the sample. importingA gateway received the sample. receivingPending statesSamples that wait for analysis within Symantec Security Response are in one ofthe pending states. Only the components withinSymantec Security Response usethe pending states. A sample may remain in a pending state indefinitely beforeit moves to another state.Table A-4 Pending statesDescription StateThe sample cannot be analyzed automatically, and is deferredfor analysis by experts.deferThe sample cannot be analyzed automatically, and is deferredfor analysis by experts.deferredThe sample cannot be analyzed automatically, and is deferredfor analysis by experts.deferringSample processing referenceSample State34Table A-4 Pending states (continued)Description StateThe sample has beenimportedinto Symantec Security Response,but has not yet been analyzed.importedThe sample must be rescanned because newer virus definitionsfiles have become available withinSymantec Security Response.rescanActive statesSamples that are being analyzed within Symantec Security Response are in oneof the active states. Only the dataflow component within Symantec SecurityResponse uses the active states. A sample may remain in an active state for onlya few seconds or for many minutes before it moves to another state.Table A-5 Active statesDescription StateThe sample is waiting to archive the automated analysis files. archiveThe sample is archiving the automated analysis files. archivingThe sample has beenclassifiedas a binaryprogram, andis waitingfor the binary controller.binaryThe binary controller is determining starting conditions for thebinary replication.binaryControllingThe sample is being executed by a binary replication engine. binaryReplicatingThe sample infected other binary programs, and the binaryscoring engine is selecting signatures for detecting and repairingthe virus.binaryScoringThe sample is waiting for a binary replication engine to becomeavailable.binaryWaitThe sample is being classified to determine its data type. classifyingA new set of virus definitions files incorporating the signaturesthat are selected for the new virus are being built.fullBuildingThe full virus definitions files are being unit-tested. fullUnitTestingThe signatures that are selectedfor the newvirus are being addedto the current virus definitions files.incrBuilding35 Sample processing referenceSample StateTable A-5 Active states (continued)Description StateThe incremental virus definitions files are being unit-tested. incrUnitTestingExclusive access to the definition generation service in the backoffice is being acquired.lockingThe sample has been classified as a document or a spreadsheetthat contains executable macros, and is waiting for the macrocontroller.macroThe macrocontroller is determiningstartingconditions for macroreplication.macroControllingThe sample is being executed by a macro replication engine. macroReplicatingThe sample infected other documents or spreadsheets, and themacro scoring engine is selecting signatures for detecting andrepairing the virus.macroScoringThe sample is waiting for a macro replication engine to becomeavailable.macroWaitThe sample is infected with a newvirus, signatures for detectingand repairing it have been selected, and the sample is waitingfor the build process to become available.signaturesExclusive access to the definition generation service is beingreleased.unlockingSample errorsSample processing errors include those listed in the following table.Table A-6 Sample errorsDescription ErrorA signature sequence number has been abandoned, usuallybecause unit-testing of the corresponding definitions set hasfailed.abandonedThe sample's content checksum does not match its content. contentThe sample's tracking cookie has not been assigned by thegateway.crumbledSample processing referenceSample errors36Table A-6 Sample errors (continued)Description ErrorThe sample that was submitted for analysis has been declinedby the gateway. The user should contact technical support forassistance.declinedAn internal failure occurred while processing a sample. internalThe sample was not completely receiveddue to a network failure. lostAn essential attribute of the sample was malformed. malformedAn essential attribute of the sample was missing. missingThe content of this sample exceeds its expected length. Thisoverrun may be due to a transmission error in the transportnetwork.overrunThe sample's sample checksum does not match its content. sampleThis signature sequence number has been superseded by newercertified definitions and is no longer available from the server.The client should download the current certified definitionsinstead of the superseded definitions.supersededThe sample's type is not supported. typeThe signature sequence number has not yet been published. unavailableThe expected length of the sample exceeds its content. underrunThe sample or signature cannot be unpacked. unpackageThe signature set cannot be published. unpublished37 Sample processing referenceSample errorsSample processing referenceSample errors38Aactive state samples35CCentral Quarantineinstalling17properties22certified definitions23, 29Customer Informationproperties23window18DDefcast 11Digital Immune Systemabout 11analysis12and sample processing31automation11components10Eerrorsevents that trigger28general 24reviewing submissions28submission26eventsconfiguring28that trigger alerts28Ffile submission11final states, samples32Firewall tabname23password23port 23user name23Ggatewayabout 10computer name of 22default address18defined10detecting unknown threats11polling12, 23submitting files to11Symantec Immune System Gateway22unable to connect to28Iinfected file restoration25installationCentral Quarantine17Quarantine Console17Quarantine Server17MMaximum Disk Space window18Nnoncertified definitions29NT event log28Ppending state samples34policiesdefinitions23setting for an automatic sample submission26setting for sample26ports and network protocols20protocolsnetwork20sharing between the Quarantine Console andthe Quarantine Server15TCP/IP15IndexQQuarantinedefault settings22deleting files from25general properties22local 9viewing25Quarantine Agent 10Quarantine Consoleabout 10as part of the Central Quarantine19installing17Quarantine Scanner10, 29Quarantine Serverabout 10as part of the Central Quarantine19configuringInternet-based Scan and Deliver2021enablingon another machine20on the local machine20installing17quarantined files25restoring25Queue check interval 23Ssamplesactive states35attributesviewing27errors36final states32pending states34policy26automatic sample submission23properties23settings26processing31reviewing actions on27reviewing submission status27states32status27, 31submitting automatically26viewing actions28sequence number23statesactive35final 32states (continued)pending34sample32Status query interval 23submissionsinterpreting attributes27reviewing errors28Symantec Immune System Gateway22Symantec Security Response10, 19system requirements16Vvirus definitions andcertifieddefinitions interval 23WWeb Communicationproperties22window18XX- characters27Index 40