Showing posts with label Symantec. Show all posts
Showing posts with label Symantec. Show all posts

Thursday, February 14, 2008

How to delete Symantec Antivirus Logs

Because there are no locks on Symantec logs, they can be easily deleted. The logs are stored in two different places in WinXp: \Documents and Settings\\Local Settings\Application Data\Symantec\Symantec AntiVirus Corporate Edition\\Logs and \Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\\Logs. This may not seem very important but it can be used by an attacker to cover up failed attempts to use hack tools on a machine.

Solution


Deny write and delete access to non-system/administrative users.