text:
News from WTOP
News from the AP
Mike Causey
Shows & Panels
Shows & Panels
- Agency of the Month
- Business of Government Hour
- The CFO Agenda: Delivering value from financial transparency and audit efforts in the public and private sector
- Cloud-Driven Data Insights in Government
- CXO Surveys
- Disaster Resilience for America
- Federal News Countdown
- Government Perspectives on Mobility and the Cloud
- Reducing Risk in the Cloud
- Reimagining the Next Generation of Government
Shows & Panels
- AFCEA Answers
- American Readiness: Renewable Power and Efficiency Technologies
- Ask the CIO
- The Business Case for Cloud Computing in Government
- Cloud-Driven Data Insights in Government
- Connecting the Dots: Digital Authentication in Government
- Data-Centric Approaches to Government in the Cloud
- Delivering the Digital Government Mission
- Federal Executive Forum
- Federal News Radio's National Cyber Security Awareness Month Special Panel Discussion
- Federal Tech Talk
- The Future of Government Data Centers
- Government Perspectives on Mobility and the Cloud
- Industrialized, Interoperable and Insight-driven Federal Health Panel
- Innovation and Tech Superiority through Acquisition Reform
- Mitigating Insider Threats in Virtual & Cloud Environments
- Moving Agency Applications to the Cloud with PaaS
- Reducing Risk in the Cloud
- Security in the Age of Targeted Attacks
- Air Traffic Management Transformation Report
- The Business of Cloud
- Cloud First Report
- Data Driven Cloud Series
- Disaster Resilience for America
- General Dynamics IT Enterprise Center
- Gov Cloud Minute
- Government in Technology Series
- Homeland Security Cybersecurity Market Report
- The Intersection: Where Technology Meets Transformation
- Modern Mission Critical Series
- National Cybersecurity Awareness Month
- The New IP for Federal IT
- The Social Platform Solution for the Department of Veterans Affairs
- Technology Insights
- The Cyber Security Report
- The Next Generation Cyber Security Experts
Shows & Panels
- Cloud-Driven Data Insights in Government
- Disaster Resilience for America
- F-35 Lightning II Program
- Government Perspectives on Mobility and the Cloud
- On DoD
- Pentagon Solutions
- Reducing Risk in the Cloud
- Reimagining the Next Generation of Government
- Transforming Business Operations at the Defense Department
DorobekInsider: White House names Leeds as GSA's new acting administrator
Tuesday - 12/22/2009, 11:50am EST
We told you about it first right here last week — and it will be official today — the White House has accepted the resignation of GSA acting administrator Paul Prouty and has designated Stephen R. Leeds as GSA's new acting administrator pending confirmation of Martha Johnson as the GSA administrator.
Prouty will return home to his family in Denver — he hasn't been shy about deeply missing his family, which you just have to respect. Prouty will continue to serve as the Regional Commissioner of Public Buildings and he will continue to serve the agency in a senior advisory capacity.
Leeds has been serving as Senior Counselor to the Administrator. In that role, he has played an integral role at GSA helping to guide GSA's Recovery Act programs and to lead GSA's green efforts as the Senior Sustainability Officer, insiders say.
Prouty is generally given very high marks for his tenure as acting administrator, but there are ongoing concerns within the agency about the lack top political leadership because of the hold by Sen. Kit Bond (R-MO) on the nomination of Martha Johnson. Sen. Kit Bond (R-MO) has a hold on the Johnson nomination ostensibly about the development of a federal facility in Kansas City.
GSAers are also saying that GSA is also confirming the resignation early next year of deputy administrator Barnaby (Barney) L. Brasseux, who has been serving in that post since September 2008. We hear that administration officials had offered him the opportunity to return to be deputy commissioner at GSA's Federal Acquisition Service, a post that will be vacated by Tyree Varnado starting in January, but Brasseux has decided to retire. (Hear our delightful exit interview with Varnado from Federal News Radio 1500 AM's Daily Debrief with Chris Dorobek and Amy Morris here.) And we continue to hear that the deputy administrator post will be filled by Susan Brita, who is a staff director on Capitol Hill. Look for an announcement early next year.
FCW's Matthew Weigelt reports that the Brita announcement was awaiting the Johnson confirmation, but I'm hearing that, with no end in sight to the Johnson fight, they may announce her appointment regardless. But I'm still hearing Senate Majority Leader Harry Reid may attempt a cloture vote on Johnson's nomination — among others.
Here is what Weigelt reported:
Brita currently is staff director for the House Transportation and Infrastructure Committee's Economic Development, Public Buildings and Emergency Management Subcommittee. Brita was waiting to make the move to GSA when Johnson was confirmed, but the appointment has stalled since spring 2009. The move is expected to happened despite Senate's inaction on Johnson's nomination.
Other changes are likely in the coming months. We'll stay tuned.


text:
Explore BMC Biophysics
Computational and theoretical biophysics
Section edited by Rebecca Wade and Dimitrios Morikis
This section incorporates all aspects of computational and theoretical biophysics including: theory, modeling, simulation and nanotechnology.
Membrane biophysics
Section edited by Huan-Xiang Zhou and Emad Tajkhorshid
This section incorporates all aspects of membrane biophysics including: structure and dynamics of model and cell membranes, structure and function of membrane proteins, mechanisms and transport properties of channels and transporters, and protein-membrane interactions.
Mesoscale cellular processes
Section edited by Gerhard Gompper and Joe Howard
This section incorporates all aspects of mesoscale biophysical processes including: analysis of soft condensed matter, polymers, subcellular oscillations, actin cytoskeleton and molecular motors.
Novel biophysical methods
Section edited by Werner Kremer and Alberto Diaspro
This section incorporates all aspects of novel advanced biophysical methods including fluorescence, NMR, microscopy, spectroscopy, X-ray, single molecule biophysics, nanoscale biophysics, high pressure biophysics and related biophysical techniques.
Nucleic acids
Section edited by Jörg Langowski and Sanford Leuba
This section incorporates all aspects of nucleic acid biophysics including: analysis of chromatin, genome biophysics, DNA replication, repair, and transcription.
Signaling and interaction networks
Section edited by Volkhard Helms and Matti Weckstrom
This section incorporates all aspects of the biophysical analysis of signaling, interaction networks and gene regulatory networks including: enzymatic networks, intercellular signalling, neurobiology and neuronal signaling.
Structural stability and dynamics
Section edited by Dave Thirumalai and Terry Oas
This section incorporates all aspects of structural biophysics including: structural determination and modeling, dynamics characterization by NMR and other techniques, proteins, polysaccharides, carbohydrates, DNA, RNA, and crowding effects.
Thermodynamics, energy transduction and kinetics
Section edited by Wei Yang and Garegin A. Papoian
This section incorporates all aspects of biophysical thermodynamics including: free energy methods, bioenergetics, rates of unimolecular, bimolecular, and complex reactions including protein folding and protein biosynthesis.

subset: commoncrawl


text:
Choosing Your Currency?
SWELL offers you the choice to shop in your preferred currency. Choose between a range of different choices and shop with converted pricing and easy checkout.
Exchange Rate
The exchange rates provided are updated by XE.com. It is important to note that the exchange rates fluctuate and converted prices are indicative only.
What Currency Will I Be Charged In?
No matter what currency you choose to view pricing in, you will be charged in US Dollars on SWELL.com. This amount is visible during the checkout process.
For questions or comments please call us at 1-800-255-7873.
Reviewed by 1 customer
Best Uses
Comments about DESIREE EMBROIDERED LS DRESS:
I was going to use this dress for portraits but it was shorter than expected. The colors were also darker in person. But I liked it anyway.


text:
Shop Sections
Shop Owner
Houston, TX United States
Have a question?Contact the shop owner.
Need a custom order?Request Custom Order
Shop Info
Opened on Jan 7, 2010
- About
- Policies
- Reviews
- 1,396 sales
- 5,957 admirers
Designs From A Casual Perspective
My designs are unique, fun, casual clothes and leather accessories. I mostly make Eco-friendly knit tops, leggings, dresses and fashion accessories. I also make linen hoodies, wide leg pants and dresses. I believe all women are beautiful. I believe clothes should be about how we really live our lives. I design with comfort in… read more
This shop accepts Etsy Gift Cards.
Featured items from FineThreadz


text:
Online Piracy The Subject Of Senate Bill
US law enforcement authorities could have more tools to help them crack down on websites pirating movies, TV shows and music, after the US Senate introduced a new bill on Monday.
Senator Patrick Leahy, a Democrat from Vermont, and Senator Orrin Hatch, a Republican from Utah, introduced and supported the bill from the Combating Online Infringement and Counterfeits Act.
The bill will give authorities the tools needed "to track and shut down websites devoted to providing access to unauthorized downloads, streaming or sale of copyrighted and counterfeit material," Leahy's office said.
The illegal products offered by websites, many of which are from non-US sources, range from movies to pharmaceutical products, it said in a statement.
Online piracy and the sale of counterfeit material "cost American businesses billions of dollars, and result in hundreds of thousands of lost jobs," said Leahy.
"In today's global economy the Internet has become the glue of international commerce — connecting consumers with a wide-array of products and services worldwide," said Hatch.
"But it's also become a tool for online thieves to sell counterfeit and pirated goods, making hundreds of millions of dollars off of stolen American intellectual property," he added.
The bill is critical to the continuing fight against online piracy and counterfeiting, Hatch said.
The bill will give the Justice Department an accelerated process for cracking down on websites engaged in illegal activity including having a court issue an order against a domain name that makes pirated goods available.
The Congressional International Anti-Piracy Caucus condemned Canada, China, Mexico, and Russia and in May for failing to crack down on piracy and said theft of intellectual property in those countries was at shocking levels.
The websites singled out by the caucus, were Chinas"˜ Baidu, Canada's isoHunt, Ukraine's MP3fiesta, Sweden's Pirate Bay, Germany's Rapidshare and Luxembourg's RMX4U.
On the Net:


text:
He was once as crazy as they came. In the '70s, Iggy Pop encouraged crowds to throw bottles at him, rolled around in broken glass, and smeared himself with peanut butter in concert. These days he's less unpredictable and his shock shtick has been upstaged by artists like Marilyn Manson and Slipknot. But at least least Iggy Pop hasn't lost his sense of humor.
In an new comedic video to promote the new Stooges album Ready to Die (out April 30 on Fat Possum), Pop is depicted surrounded by beautiful women at a posh pool, complaining on the phone about being on a major label and "losing touch with the common man." After insisting that his manager find him a new label he says, "I have got to get off this major-label system before it kills me. I don't care about the money. Where's my integrity?"
Later, he's shot picking up litter in a park, desperately saying into a phone, "Hey, listen. You have got to get me off of this indie label," adding. "I handed [the record] in a month ago. Haven't heard from them. The check bounced!" As Pop gripes, "They're from Mississippi!" a banner pops up that reads "Proudly released on Fat Possum Records from Oxford, Mississippi."
As the old saying goes, you're damned if you do and you're damned if you don't. In today's music industry climate, sales of 35,000 can get you in the top 10 on the Billboard album chart, but it's not gonna boost your royalty rate or net you the kind of income established artists used to make when top-charting albums routinely sold at least five times as much as they do now.
Because of this, major labels are shedding some of their more expensive artists and some musicians are seeking to sign with indie labels, where they'll be the proverbial big fish in a smaller pond and, perhaps receive more money and better treatment since they're presence raises the profile of the label. It's unclear how the business will ultimately sort itself out since the chess game is still being played by both sides, but it's interesting to watch who winds up where.
While it's not so surprising that the Stooges are now on an indie, it's interesting that they chose to sign with Fat Possum, a label best known for releasing Mississippi blues acts; though in recent years, the company has put out records by more contemporary groups, including Black Keys, Wavves, and Crocodiles.
Ready to Die is the follow up the Iggy and the Stooges' 2007 album, The Weirdness, which was the band's first full album together since 1973's Raw Power. The disc came out on Virgin, received mixed reviews and sales were less than spectacular. Then again, as legendary as they are, The Stooges--like the Velvet Underground--have never landed a gold record. It's also interesting to note that Iggy and the Stooges were one of the first unruly, nihilistic pre-punk/proto-metal bands on a major label. Their self-titled debut came out on Elektra in 1969.
Maybe by next month fans will know whether signing to Fat Possum was a good move for the Stooges, but ultimately the success or failure of Ready to Die will be determined by the quality of the music. The album was produced by the band's guitar player James Williamson at Fantasy Studios in San Francisco; Pop recorded his vocals in Miami, no doubt surrounded by gorgeous women.


text:
singlehanding without cockpit routed lines
View Single Post
Senior Member
Join Date: Nov 2010
Posts: 2,858
Thanks: 41
Thanked 115 Times in 97 Posts
Rep Power:
You will always need to head up to the foredeck anyway so its not obligitory to have everything run to the cockpit.
I am forever having to go forward to help the reefing lines when reefing. And the jib pole etc.
To make it safer you could set up jack lines.
I have one in the cockpit I can clip onto that lets me get to every place in the cockpit but not so far as to fall overboard
Going solo I just go a bit slower, think a bit more, and rehearse what I am going to do before I do it.
I just did the Med from France, Atlantic to Caribbean by myself and I did the video below for a bit of fun.
Have fun going solo
Sea Life
Notes on a Circumnavigation:
To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
View Public Profile
Send a private message to MarkofSeaLife
Visit MarkofSeaLife's homepage!
Find all posts by MarkofSeaLife


text:
In political news, the French seem ready to elect Socialist Francois Hollande to be their president, although much of the news coverage has focused on the rise of far right racist Marine Le Pen, who received nearly 18 percent of the vote, nationwide. Hollande has campaigned against the austerity that has stifled the French economy, with stalled factory output and declining business confidence, and ten consecutive months of rising unemployment. Le Pen is the French version of the tea party Republicans, mixing racism and xenophobia with economic populism, and her modest (and somewhat overblown) success represents the inevitable embrace of extremism by some voters in the face of economic uncertainty. But the political implosion of French President Nicolas Sarkozy is proof that the French overall are ready to try a new economic approach.
In Holland, meanwhile, the center-right government of Prime Minister Mark Rutte on Monday tendered its collective resignation, which became inevitable when coalition partner, the Dutch extremist Party for Freedom (PVV), refused to support Rutte's plans for more of the austerity that already has punished the Dutch economy, people, and culture, has led to a real estate and building crisis, and risks backfiring even more. Polls show that while the left is not yet ready to recapture the Dutch government, the Socialists could double their seats in Parliament while the PVV will lose more than 20 percent of theirs.
In Monday's economic news, the Spanish austerity that has led to falling industrial output and deepening debt, with record unemployment and a stunning rate of 50 percent youth unemployment, now has the country officially back in recession.
So with austerity again and again proving a failure, and governments responsible for austerity finally beginning to fall, how are the markets reacting? They collapsed. Because nothing could be worse for the markets than a change from the economic policies that have been destroying economies. In the United States, it's political orthodoxy that Republican policies of tax cuts and budget cuts are better for the markets, but history proves exactly the opposite. The markets do better under Democrats. They are doing better under President Obama. And yet you still see supposed experts claiming that the markets will suffer should the president be reelected. It's one of those great mysteries of modern political and economic messaging, and it was summarized by Paul Krugman:
If Sarkozy somehow pulls off an upset win, it will mean more of the same European economic orthodoxy — the insistence that fiscal responsibility is the only virtue and austerity the universal answer. This orthodoxy somehow retains its grip despite overwhelming evidence that it's wrong and disastrous failures in practice.This orthodoxy retains its grip only because the investor class has lost its grip. The facts speak for themselves. Austerity is a disaster. It's time for something different, something that actually works. If the investor class had any sense at all, the markets on Monday would have soared. Because France soon may be leading the way out of the European economic disaster. And the White House, unlike the new Republican leader, already seems to understand that austerity isn't the way out of the U.S. economic disaster.
An Hollande victory would shake things up, and offer at least the possibility of something better.


text:
Congress on Wednesday confirmed that it has received the Income Tax notice, asking them to explain diversion of funds exempted from the tax net, to the National Herald and thereby Young Indian, who made money out of it, by leasing and renting out their properties.
The funds generated by political parties to conduct political activities are exempted from the tax net but cannot be diverted for profiteering business. Congress President Sonia Gandhi called the Income Tax notice to her 'political vindictiveness'.
She said that the 'witch-hunt' will help the Congress come back to power."We have been issued notices by the Income Tax department, it's political vindictiveness. Such political witch-hunt will help us come back faster," a visible disturbed Sonia told reporters in the Parliament House premises.
A senior minister here said the Congress had broken the law by diverting funds meant for political activity to a firm where the majority stake is owned by the Gandhis. "Political parties cannot give loans for commercial transactions," he explained.
If this diversion is proved, the Income Tax authorities may impose a heavy fine on all transactions and donations, the Congress may have received over the years. But the Congress leaders say, they were just bailing out their organ National Herald, by helping to pay liabilities and arrears of its employees. The Associated Journals Limited, the publisher of three newspapers, including the National Herald, an English daily founded and edited by Jawaharlal Nehru before he became India's first prime minister was shut down in 2008.
Sonia Gandhi and Congress Vice President Rahul Gandhi have been also summoned by a Delhi court on August 7 in the National Herald case. The summons have been issued on the plea of the maverick Bharatiya Janata Party (BJP) leader Subramanian Swamy who has been alleging that the Congress gave an unsecured loan to Sonia-owned Young Indian Ltd to acquire National Herald's holding company Associated Journals.
Swamy has alleged misappropriation of assets worth Rs 2000 crore of the National Herald newspaper. He had accused Sonia and Rahul Gandhi and others of conspiring to cheat and misappropriate funds by just paying Rs 50 lakh by which Young Indian obtained the right to recover Rs 90.25 crore which the Associated Journals had owed to the Congress party.
He alleged that in the present scenario over Rs 2,000 crore worth of assets also got transferred to Young Indian , whose 76% of shareholding vests with Sonia and Rahul Gandhi and the remaining shareholding of 24% vests with the other accused.


text:
They've both been married before.
So you can understand why Angelina Jolie and Brad Pitt are being extra cautious with their finances before they tie the knot.
The superstar couple have reportedly drawn up a 101-page document that states that, even if they split, he will keep the entirety of his £110m fortune, while she will keep her £90m assets.
"He's a romantic guy, but also very practical, and given they're worth £200 million between them, with six children and a lot of property across the globe, it definitely makes sense.
"Both Brad and Angelina have been married before so they know how messy a divorce can get.
"It's even more important this time because there are children involved and Brad wants them to cover all eventualities."
Brad, 49, divorced Jennifer Aniston, 44, in 2005 while Angelina Jolie, 38, went through a divorce from Billy Bob Thornton, 58, in 2003.
The couple had planned on marrying in France but due to no being residents of the country, they are now said to be planning a blessing at their French home following a ceremony in Hawaii, Angelina's late mother Marcheline Bertrand's favourite place.
A source told the mag: "Hawaii means that her mother can be a part of a small ceremony on her favourite beach.
"Then the main event will be a wintery-themed bash in France with all of their closest friends and family. Everyone, especially the children, is very excited.
"They love the idea of a Christmas wedding at their French home, Chateau Miraval, with a big roaring fire and lots of festive decorations."
Sounds like Brad and Ange could be planning the wedding of the year.
[Angelina Jolie takes her brood to Legoland for fun day out]
[Angelina Jolie and Brad Pitt 'always knew they would be together']


text:
ROCCAT doesn't look to be the only company set to show off a new mechanical keyboard at CES; Rosewill's jumping on board as well, with its Helios RK-9200. Rosewill has become a bit of a de facto standard as far as mechanical offerings are concerned, as the company doesn't focus too much on bling but rather simply delivering a well-built, easy-to-use keyboard that feels great to type on. The RK-9200 follows in these footsteps, but does add a bit of flavor.
Rosewill touts the RK-9200 as being the "first" dual LED backlit mechanical keyboard, although that's a statement we can't immediately back up ourselves. Still, this tackles a problem I've had with keyboards as a whole for a while, where you may like the looks of a model but not the color of backlighting the company chose. With the RK-9200, users will be able to choose between red or green and choose between five brightness levels. Sounds good to me.
While not quite as advanced as ROCCAT's mechanical we talked about earlier, Rosewill's latest offering does look sharp, and it should appease those who've wanted either an RK-9000 or RK-9100 but preferred different backlighting. Not surprisingly, pricing is not yet available, but should be in the weeks to come.


text:
Cheap TOY to Sondre Stromfjord flights
Popular Flights from Toyama, Japan
Top Toyama Flights to US Destinations
Top Toyama International Destinations
Popular Flights from Sondre Stromfjord, Greenland
Top Sondre Stromfjord Flights to US Destinations
Top Sondre Stromfjord International Destinations
TOY to SFJ Route Map
Toyama to Sondre Stromfjord Flights, Stats and Airplanes
Route information for flights from Toyama to Kangerlussuaq.
5,262.18 miles
TOY - Toyama Airlines
Browse the most popular airlines servicing the Toyama (TOY) airport. Visit their flights pages to learn more about the most popular routes these carriers fly.


text:
In a huge step for the industry today, YouTube announced perhaps the boldest new innovation for the online video industry since its start....The ability to watch and collect your favorite online videos, offline, on DVD.
That's right. Even though people are starting to watch videos online and the interwebs are beginning to see some growth in bandwidth coming from video, we all know that DVD's are still a more popular video consumption platform. And the greatest part about physical media, is that you don't have to wait for the Internet. Thankfully, the 4th largest online video site in the world, YouTube, gets this.
Get The Magic of YouTube, on DVD
You can actually order the magic of YouTube right now, at http://www.youtube.com/theyoutubecollection/. YouTube put a ton of thought into the ordering process and they've thought through quite a few of the common issues that might happen when providing physical copies of the YouTube collection.
1) Multiple Genre's Available.
Whether you're into sports, comedy, education, or "Stuff people say," they've got it. You can choose between these genres, or order the complete collection of 508,575 discs.
2) Multiple Shipping Options.
Their default shipping method is shipping trucks, but you don't have to go that route. They even have options for something called the Postal Service (Note--keep in mind that shipping trucks and freight Vessel options are much quicker).
3) Don't have a DVD Player?
If you're not a rich person and haven't upgraded to the latest in home entertainment (the DVD), YouTube will ship you other formats, including Laser Disc, Video Cassettes, and Betamax Tape.
However, there are 2 things that may hold this new offering back.
1) They are charging around $5 USD per disc. When you order the complete collection, you'll be spending upwards of $2 million dollars. I'm in no way debating the value of this as it's clear that the value is priceless, but I'm a few dollars short.
2) Apparently, YouTube was not prepared for this new offering to be as popular as it has become. Orders taken today have anticipated delivery times that are a bit longer than one might ordinarily expect.
Order Your DVDs Today - April 1st, 2012 (Hint Hint)
OK, so we've announced other April Fools Day fun in the past and had to clarify afterwards that they were NOT real announcements. So, just to make absolutely sure - THIS IS AN APRIL FOOLS JOKE FROM YOUTUBE. Fun stuff.


text:
Home > Archives
Tuesday April 1, 2008
By ROYCE CHEAH
PETALING JAYA: The leaders of PKR, DAP and PAS have proposed to consolidate the cooperation between the three parties by forming the "Pakatan Rakyat".
PKR adviser Datuk Seri Anwar Ibrahim said that the Pakatan Rakyat would be led collectively by all three parties and pledged to uphold the rights and interests of all Malaysians.
"We will work towards common principles such as justice, good governance, human rights, accountability and transparency.
"With the results of the recent elections, the state governments of Kelantan, Kedah, Penang, Perak and Selangor will also be known as Pakatan Rakyat state governments," he said Tuesday at a press conference after meeting DAP and PAS leaders.
Also present at the press conference was DAP adviser Lim Kit Siang, PKR president Datin Seri Dr Wan Azizah Wan Ismail and PAS president Datuk Seri Abdul Hadi Awang.
Anwar said the policies of the state governments would be adopted in accordance with the policies of the Pakatan Rakyat and that a joint secretariat would be tasked with building the foundation and framework of the Pakatan Rakyat.
He added that a convention for all Pakatan Rakyat MPs and state assemblymen would be held on April 27 and that the name Pakatan Rakyat was still pending confirmation by the respective parties.
When asked how the different ideologies of PAS and DAP would be approached in the new coalition, Anwar said he did not see any difficulty.
Anwar and Abdul Hadi however were pressed on the significance of PAS wanting to form an Islamic state to which they both replied it was an issue that should not be made contentious anymore.
"It was not mentioned in the PAS manifesto and has not been mentioned for a long time. It is no longer an issue," Anwar said.
Abdul Hadi said that the issue should not be raised just to create trouble and that the truth was that Islam as a religion supported basic principles such as fighting corruption and creating good governance.
When asked who would lead the coalition, Anwar said no one person or party would have a greater standing and that it was the rakyat who would be the dominant party.
"The agenda is clear. Whoever is the Mentri Besar or Chief Minister, it makes no difference as they are tied to policies determined by the Pakatan Rakyat," he said.
It was also pointed out that a similar coalition was attempted and then scrapped in 1999 to which Lim said the parties had learnt from that, and that a new political scenario would emerge if the parties come together on principles that the people can support.
Neighbours heard cries of children being beaten
RM1mil reward offer for information on Dr M's alleged misdeeds
Body of child found buried in kitchen
'Wild' party ends for 51 at popular mall
Money down the drain
Image on Google Street View may be that of missing boy
Copyright © 1995-2015 Star Media Group Berhad (ROC 10894D)(Formerly known as Star Publications (Malaysia) Berhad)


text:
The magic 42, I'm so glad we made it, I was going to be very disappointed if we didn't have enough participants for this round.
Should be fun, I've been shooting a lot of 35mm lately and have lots of images to choose from. I have also joined the Harvey Milk Photo Center in San Francisco so I have consistent affordable access to a darkroom. Translates to I shouldn't be so late this round.
I would also like to extend a big THANK YOU to Ruediger for facilitating yet another round.


text:
use the following search parameters to narrow your results:
e.g. subreddit:aww site:imgur.com dog
subreddit:aww site:imgur.com dog
see the search faq for details.
advanced search: by author, subreddit...
20,158 users here now
If your submission does not appear, do not delete it. If it hasn't shown up after more than 5 minutes, simply message the moderators and ask us to look into it.
Submissions must be directly gaming-related.
Following the Rules of Reddit is required. Following Reddiquette is encouraged.
No bandwagon or direct reply posts.
No piracy.
Mark your spoilers and NSFW submissions, comments and links. Spoiler tags are [X Kills Y](/spoiler) .
[X Kills Y](/spoiler)
No product requests or giveaways.
Submit only the original source of the content. No general URL shorteners (bitly, tinyurl, etc).
Follow Reddit's rules of promotion.
This is not the place to spam your channel. No referral, affiliate and/or survey links.
No Kickstarter, Steam Greenlight, et al project "reminder" posts.
Posts and comments, whether in jest or with malice, that contain racist, sexist, homophobic content, or threats will be removed, regardless of popularity or relevance.
TIL Noble team Commander Carter's Spartan Tag, S259, is a reference to the element Nobelium (Atomic Mass 259) (halo.wikia.com)
submitted 2 years ago by Metroidude47
[–]Metroidude47[S] 0 points1 point2 points 2 years ago (0 children)
Scroll down to Trivia to see, sorry, I have no idea how to link to an article section.
Use of this site constitutes acceptance of our User Agreement and Privacy Policy {Genitive}. © 2015 reddit inc. All rights reserved.
REDDIT and the ALIEN Logo are registered trademarks of reddit inc.
π Rendered by PID 31899 on app-91 at 2015-06-03 22:13:20.172518+00:00 running e2aae7f country code: US.


text:
Butler Hospital Leads National Study of Deep Brain Stimulation for Obsessive-Compulsive Disorder
PROVIDENCE, R.I., Oct. 5 /PRNewswire/ — Butler Hospital in Providence, R.I., is leading a clinical study evaluating the effectiveness and safety of deep brain stimulation (DBS) for severe obsessive-compulsive disorder (OCD). Benjamin D. Greenberg, MD, PhD, associate professor of psychiatry at Butler Hospital and the Alpert Medical School of Brown University, is the lead investigator. He noted, "In the most severe cases, OCD causes profound impairment in work and social life, as well as tremendous suffering. Our work, plus that of colleagues in Europe, shows that DBS is a promising treatment for patients with OCD who remain very ill and debilitated despite the best available standard treatments, which are cognitive behavioral therapy and medications."
In DBS, thin wires are implanted in brain circuits that are involved in OCD. The wires are connected under the skin to a battery-powered stimulating device, which is implanted in the patient's chest. These are the same kinds of devices that have become an FDA-approved standard of care for people with Parkinson's disease and other movement disorders. Pilot studies at Butler's OCD Research Clinic, Massachusetts General Hospital, and the other centers that are part of this trial have found that stimulation in this area reduced OCD symptoms.
More information about these studies is available at (http://clinicaltrials.gov/ct2/show/NCT000640133).
According to the World Health Organization, OCD is one of the most disabling medical conditions. DBS offers people who have not been helped by specific behavior therapy for OCD and medications another potential treatment option.
The U.S. Food and Drug Administration has approved DBS for humanitarian use for patients with OCD. The study is working closely with other scientists and physicians who were just awarded funding by the National Institute of Mental Health to establish the Silvio O. Conte Center to carry out research to understand more about DBS in OCD. Suzanne Haber, PhD, heads this center at the University of Rochester Medical Center, and Dr. Greenberg at Butler Hospital and Brown University is its co-director.
Dr. Greenberg says that there is also a companion study of brain functioning in OCD that does not involve surgery.
For more information about these research studies, visit Butler Hospital's OCD Research Program at www.butler.org or call 401-455-6209.
SOURCE Butler Hospital


text:
Budget is based on Obamacare taxes coming in
Paul Ryan's budget "keeps the Obamacare taxes and spending cuts that paid for Obamacare, but then cuts all of the benefits."
He's right on two, close on the third
The tax-cut deal "adds more than $800 billion to the deficit over two years -- more than the cost of TARP and more than the cost of the Recovery Act" and about the same as health care reform.
He's close on the cost for the next decade
Republicans "created a trillion dollar prescription drug entitlement program without paying for it."
© 2015 • All Rights Reserved • Tampa Bay Times
490 First Avenue South • St. Petersburg, FL 33701 • 727-893-8111
About PolitiFact | Contact Us | Advertise
Privacy Policy | Terms, Conditions & Copyright


text:
PRLog - Nov. 11, 2011 - CARLSBAD, Calif. -- LovinLife MultiMedia to host 3 year anniversary mixer party in Corona Del Mar this Sunday, November 13th, 2011.
Along with the music by Quetzal Guerrero and the Warriors, MTV's K-Von, treats, goodies and the distinct Corona Del Mar beach vibe, one of Orange county's own top junior women surfring talent, ShelbyDetmers will be in the mix and available for press interviews.
Shelby's journey through her senior year at Newport Harbor High School while competing on the NSSA circuit, participating in the world qualifying series (WQS), and balancing her life as a student/athlete is the subject of a documentary film and book project titled 'SurferGirl Diary: the Long Ride'. Attendees will have the opportunity to meet Shelby and view the video posted to Kickstarter.
A clip that features a mashup of stills from Shelby's recent surfing heats, and practice sessions is below:
Thanks to LovinLife Multimedia, we have a limited number of first come first serve invites to extend, please reply via Twitter @surfgeekTV or @SurferGirlDiary.
For event details: http://surfgeek.tv/
# # #
Xanate Media is a digital media marketing design, and communications pioneer. We the deploy interactive digital media tools in service of company, organizational or cause branding or community engagement.


text:
EndPoint consistently allows fake AV malware
We've had several customers lately who have had to buy Malwarebytes to clean up their systems because SEP 11.06a allows Fake AV malware to install and run. I've had to clean up a dozen or more machines like this in the past month or two. SEP seems quit adept a keeping out traditional viruses, but when it comes to malware like Fake AV products it's lacking in many skills to detect or remove them. Is it time to dump SEP, use MS Security Essentials for AV and have customers buy Malwarebytes which seems to do a far superior job at keeping malware at bay or will Symantec be stepping up its diligence and fix this deficiency?
Comments 65 Comments • Jump to latest comment
Our security group has the same views as you. We can have a PC that has the latest SEP defs on it, it get's infected with malware and SEP can't fix it.
Then we load Malwarebytes on this already infected PC, run it, and it cleans it. This is very depressing. We pay Symantec a lot of money to do this job and it can't!
Step it up Symantec!
Title: 'Does Symantec Endpoint Protection protect me from fake anti-virus programs?'
Document ID: 2010020116202748
> Web URL: http://service1.symantec.com/support/ent-security....
Title: 'Scanning a file with a competitor's antivirus program detects a virus, but scanning with Symantec AntiVirus or Symantec Endpoint Protection does not'
Document ID: 2000100610314948
> Web URL: http://service1.symantec.com/support/ent-security.nsf/docid/2000100610314948?Open&seg=ent
MCT MCSE-2012 Symantec Technical Specialist (SCTS)
Sorry, that's a lame excuse. Malwarebytes catches MANY more threats than SEP does and does this consistently and regularly. This article was clearly written by your PR or marketing team. Let's actually look into the problem and find a solution that doesn't involve feeding us marketing's answers. Look at Brook's statement, it's obvious that I'm not alone here. Either this is fixed or our customers are leaving SEP & Symantec even faster than they already are.
BTW, I can take an infected HDD with one of the fake av malwares installed, connect it via an external HDD chassis, scan it with a clean system running 11.06a and it will NOT find it! Then turn around and scan with Malwarebytes and it will find it. Let's stop trying to excuse this away and find out what's going on and fix it. SEP has been a disappointment from day 1 and it's not much better 6+ major builds later.
In the first article, it explains that the FakeAV variants are constantly being modified to avoid detection by traditional antivirus programs, whose definitions are based on submissions received. I don't know much about Malwarebytes; I do know that a friend performed a test putting a blank text file with the right name in the right location (i.e a common file name of a FakeAV variant in one of the places FakeAV likes to plant itself), and that tool erased it as a threat.
If your customers are not using all three protection components of SEP, have not increased the sensitivity of the heuristic scanners, and do not use IPS, this is going to continue to happen. I've pasted these in other threads before, but here they are again:
- You can increase the sensitivity of the heuristic detection in Antivirus/Antispyware:
Title: 'How to enable, disable, or configure Bloodhound (TM) heuristic virus detection in Endpoint Protection.'
- You can also increase the sensitivity of the heuristic scanner of Proactive Threat Protection (PTP), which is shipped with a relatively low setting so as not to trigger false positives in a production environment. I recommend testing on a small group set to "log only" so that you can create exclusions for system critical processes that are detected.
Title: 'How to increase the sensitivity of Proactive Threat Protection in Symantec Endpoint Protection 11.x'
If you are not using Network Threat Protection (NTP) because you don't want to use the firewall, it is recommended to install it anyway to reap the benefits of Intrusion Prevention. Unknown threats can be stopped and prevented from infecting system in the first place based on the method by which it is trying to get on the system.
Title: 'Best practices regarding Intrusion Prevention System technology'
- Other best security practices are to ensure systems have critical Windows patches in place:
Microsoft Baseline Security Analyzer
- Missing critical updates for third party programs can be a vector of infection. Current versions to the best of my knowledge:
- Adobe Reader: 9.3.3 - anything earlier is vulnerable and those vulnerabilities are actively exploited
- QuickTime for Windows: 7.6.6; iTunes: 9.1
- Java: Version 6 Update 21
- Flash: 10.1
These are user-contributed suggestions via the Symantec forums, for your information:
- Using Application and Device Control to protect against browser hijackers and fake AV
- Setting recommendations for different technologies
I hope this helps.
Symantec, Senior Information Developer
Enterprise Security, Mobility, and Management - Endpoint Protection
Don't forget to mark your thread as 'solved' with the answer that best helps you!
No! Symantec should not buy them. All too often Symantec has bought products only to ruin them. I offer BackupExec as one. WinFax/TalkWorks Pro as another. Or worse, they buy a product like Brightmail and force users of their own code to use the new code that's far inferior. What Symantec needs to do is learn to admit they have a problem (that is, of course, the first step to any solution) and then work with Partners to find one. SEP has been a lousy product form day one, using 10x more RAM on servers than SAV 10.1.7 did and they've only managed to reduce the RAM hogging footprint to about 5-6x the load that 10.1.7 had. They continue to use numerous 3rd party and open source apps in their products that cause many problems (try installing and admistering SEP from an RDP session, worked fne in 10.1.7, they specifically say you're not allowed in 11.x).
IMHO, if SEP 13 (12 was for SMBs but it wastes more RAM than 11.06a does) isn't 50% smaller with all the malware detection/cleaning probems fixed Symantec better hope their other products continue to sell well or they'll have serious financial problems
BTW, I know someone very close to me who works for a Fortune 40 company and they have SEP and they also have Malwarebytes deployed!!! Now, what does that tell you about the expectations that Fortune 40 companies have that SEP can or will protect them???
Malwarebytes ALWAYS, I repeat ALWAYS, find the Fake AV junk and SEP NEVER, I repeat NEVER, finds it. As I've stated I can take an infected HDD out of a machine, put it in an external USB chassis, plug that drive into a known clean system, scan it with SEP with the latest defs (either normal or rapid release) and it won't find it and then turn around and scan with Malwarebytes with a week old defs and it will find and remove it.
Also, do not insult your Partners by suggesting we don't know how to update systems. I am more than happy to let you have at my personal desktop which I guarantee has the latest Flash, Acrobat, Java, & Quicktime (I don't do iTunes and very few of our business customers do either). Furthermore, if you want to talk about vectos, there are MANY more avenues of infection than the ones you've mentioned.
We are absolutely use NTP as well as all the other technology provided by SEP on all our customer LANs. The fact remains that a free product like Malwarebytes finds malware that SEP simply doesn't in any form with any definitions.
Finally, with regards to your other suggestions, increasing Bloodhound detection, sensitvity (you're joking here, right, your false positive rate is a bit too high for that), and App Device Control, they're all unacceptable. Again, with ZERO changes to the DEFAULT settings for Malwarebytes and a week or more old definitions (often with Fake AV you can install Malwarebytes but not update it without a manual file) Malwarebytes will kill it the first time where SEP won't find it at all.
Now, let's stop excusing away the problems and find a solution. Monday I'll send this information on to the PM and we'll get his input, but I can assure you the next time I have to clean a customers FULL patched and FULLY updated (as well as FULLY managed) SEP-protected system from FakeAV or anythign else that Malwarebytes finds that SEP doesn't it'll be the last install of SEP we do.
You would be surprised how many people I talk to who are still running Windows XP SP2, have Adobe Reader 7 and Macromedia Flash installed. It's a valid concern, and I'm sorry if that offends you. That was not my intent.
Finally, with regards to your other suggestions, increasing Bloodhound detection, sensitvity (you're joking here, right, your false positive rate is a bit too high for that), and App Device Control, they're all unacceptable.
I explained that sensitivity is set low to prevent false positives, and you say that upping the sensitivity makes the false positive rate is a bit too high -- if it were to ship with the higher sensitivity settings, this is exactly what would happen. That's where testing comes in to ensure neither knocks out a mission-critical application or process.
Definitions are based on samples received. Traditional antivirus (aside from heuristics) is and always has been reactive in this way. I don't know what Malwarebytes is using to make detections, but with the rate at which the code on FakeAV changes, it can't be based on sample code received. My limited experience with it suggests it's partially brute force, looking for specific file names in specific locations. (I have to wonder what Malwarebytes' false positive rate is.)
My solution was noted above--upping the sensitivity the proactive heuristics, using Application and Device Control--and not rely on default settings, but you're admitting that you don't find this acceptable. I'm honestly not sure what more to suggest. Let us know what the PM has to say.
Symantec, Senior Information Developer
Enterprise Security, Mobility, and Management - Endpoint Protection
Don't forget to mark your thread as 'solved' with the answer that best helps you!
I'm not surprised that people still run old versions of products, but XP SP2 isn't the infection reason (all patches for SP3 are available for SP2 as well). As for Adobe and Flash, they're also not a major source of infection. People clicking on popups that claim their PC is infected (anyone can write HTML code to say that, people are just too dumb to know that) is the cause. Having Win7, the latest patches, latest Adobe, Flash, and every other possible patch will not stop that.
The other problems with your solutions is they shouldn't be needed. What you're suggesting would be like Cisco shipping enterprise firewalls like their ASA line with most ports open to the world and then them asking companies to lock it down tighter until they achieve a level of security that's acceptable. Smaller businesses also will not have the expertise to setup app/device control without breaking their entire LAN. You don't provide any predefined apps (the top 500 by sales should be predefined). Furthermore, the FAQ presented by another user here is laughable as it provides as examples C:\windows\*.exe and %windir\system32\*. I can't count how many times a virus or other malware placed itself in one of these folders. You're not providing ANY level of safety with examples like this.
In the end, your programmers have spent more time on fluff and bloatware (500-600MB on the server for AV counts as bloatware in any book I've seen) in the past few years rather than keeping up with the times and a tiny 6MB program kicks SEP around the block day in and day out. I think it's time to move on if we can't get Symantec to admit it has a problem. I'm betting we won't be alone.
You use app and device control and it's still not stopping FakeAV?
I haven't seen an infection of this kind since I implemented it so I'm curious as to what you have in place.
Also, do you use Proactive Threat Protection?
I have it set to quarantine with a sensitivity of 100. There are some false positives (plus I give the users the option to add exceptions), which I set exceptions for, but it does catch FakeAV as well.
The fact remains that there is no such thing as an AV that catches everything (as noted above AV is reactive and based on samples). I agree MBAM is good but I've also seen it miss some things that others have caught. I've seen MSSE, Norman Malware Scanner, McAfee, Avast, etc, etc, miss things.
If configured properly, I have a hard time believing App and Device control is not working for you.
Just offering my two cents
Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.
FIrst, app & device control are NOT part of Malwarebytes and yet they manage to stop it and in my experience 100% of the time. I've yet to have a customer runnig paid Malwarebytes get FakeAV (and I've tried to get it installed and it failed) and yet I can take a customer's HDD that's been infected for a week or more, remove it, and scan it with in extenal HDD USB chassis and even with the most recent defs (a week older than the infection) and SEP simply doesn't find it.
Yes, you are right in that there is no 100% prevention solution, but the fact remains that other tools prevent (or find and remove if they're not using the paid version) far more often than SEP does even a week out from the initial infection. SEP is supposed to have tamper proteciton as well so the Symantec rep's assertion that they can modify SEP to stop it tells me SEP's tamper proteciton isn't vey tamper resistent.
As for app control, I don't know how big your orginization is, but we have customers with hundreds of employees with potentially hundreds of apps. How long does Symantec expect these companies to spend making their SEP functional? At the very least, IMHO, the top 500 or so apps (by sales volume) should come preconfgured. Also, does anyone at Symantec expect the SMB with say < 50 users and no IT admin to configure App & Device control?
BTW, the funny thing about the document you mention is on page 16. It shows an exmaple of C:\windows\*.exe. I can't even begin to name the # of viruses that plant themselves in C:\windows or %windir%\system32 so I can't imagine how many SEP owners just follow the examples!
Furthermore, how does App control stop FakeAV from installing from a Web site without preventing an admin from installing new software/patches/updates from other web sites?
Honestly, this strikes me as the hocus pocus AV vendors used to try in the 80's when they tacked code onto the end of .exe's to keep (or try anyway) viruses from infecting them. It often prevented the app from working, made installing new apps a pain (the AV product would whine that the .exe wasn't immunized), and just created hassles that weren't worth the potential rewards.
In the end, Symantec needs to stop excusing this away, study how others catch Fake AV (and that was just an example, there are many more that Malwarebytes catches that SEP doesn't) and fix SEP to catch it at least occassionally.
Symantec, why don't you try this on your own. Get a machine, isolate it, deliberatly infect it, remove the HDD, take it to another machine with current defs, attach the drive via USB in an external chassis, and scan it. When SEP doesn't find it scan it with Malwarebytes and your machine will be fixed.
Finally, It's not just SEP from Symantec that doesn't catch this, Norton 360 doesn't either so I'm of the belief it's the scanning engine not the lack of app control.
I have 10k+ employees but then again, my main focus right now is SEP so I spend most of my time in the SEPM console. Yes, it requires a lot of tweaking as out of the box settings don't cut it.
I don't have the issues you do, but it also sounds like you work with a wide variety of customers from different companies. I'm able to manage my users and tweak settings, policies, etc. and lock them down as I see fit.
What MBAM needs to do is figure out how to make it's product centrally managed. Until then, it's just another product to me, used on a case by case basis. I can't not have visibility of all my users.
You make good points but SEP works for me. Maybe it just doesn't work for some, I don't know. I've always though App and Device control is the bread and butter of SEP. Sure I have my complaints, as I do with most products I use but it works so I'm not going to try and fix what isn't broken, for me anyways.
Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.
Yep, in a controlled environment like you have where you have total control and you only answer to one set of bosses I can see how A/D control would work, but if it's what SEP relies on to secure systems then it's not really an antivirus/antimalware product it's really a user permissions product. The kicker is SEP files regularly, and I'm obviously not alone, with its out of the box settings and no SMB will take the time to hack settings into place to protect themselves. SEP 12 Smal Biz Edition isn't any better than 11 so that's not the solution. Symantec either needs to fix it or admit they have a problem so their customers can buy another product that will protect themselves.
The say MBAM is centrallyed managed will be the day SEP loses a huge % of customers. Their product is 1/100th the size of SEP, far faster, and, in my experience, much better than SEP at removing everything but traditional viruses.
We were in the same boat as the original poster as well as some others that have replied. This all changed when we turned on the IPS option and updated the end points client. I did weeks of testing with current SEP with out IPS that were infected from known good sites pushing out the Fake AV crap and then tested the same exact site with SEP with IPS installed and the Fake AV was blocked.
In the past 3 months since we have turned on IPS and made no major tweaks we have had 2 Fake AV infect 2 users machine compared to 35 the previous 3 months. The issue was due to IPS not being enabled on their machine, they were notebooks that were never updated.
The beauty of the IPS is that it blocks more then just Fake AV, it blocks Eleonore Kit, Nukesploit, Malicious Toolkit IFrame Injection and alot more!
Turn on IPS and dont look back!
This from malwarebytes:
"As far as why MBAM is very good at dealing with this infection ,that is simple . MBAM is designed to be very good at dealing with malware that the AVs seem to be having problems with . I do not spend my time making MBAM detect millions of infections that any decent AV already detects as MBAM is DESIGNED to work alongside antivirus software , not replace it . A huge chunk of the research that goes into MBAM revolves around what we see making it into HJT threads as the vast majority of these threads involve antivirus software that was in some way bypassed ."
"Lastly, I note that Malwarebytes is specifically a removal tool, NOT a protection tool - it is far easier to identify and remove something that is running on a PC than it is to prevent it from getting there in the first place - which is our goal."
If you follow my recommendations on a thread called "SEP Secret sauce," as well as get to a SEP version of RU5 or better, you will minimize your infections down to nothing.
Google/bing/yahoo search it.
The above quote from Gary_L is from the author/owner of Malwarebytes himself! He had posted on this forum a while back to defend his product and Symantec's.
There is an online portal, save yourself the long hold times. Create ticket online, then call in with ticket # in hand :-) http://mysupport.symantec.com "We backup data to restore, we don't backup data just to back it up."
You create too many limitations. For example, how do you expect one to install, say MS Office, if you prevent running programs from removable drives? If I read it right that includes CD/DVD drives.
As for Gary's oft quoted quote, the thread is 2½ years old and is actually FALSE. I'd like to see the original quote but all I seem to find are Symantec employees and then others blinding quoting it with no reference to the original post. The fact is it is absolutely false. Their pro version is real time, their free/home version is removal only. If you have a link to the original post I'd sure like to read it, but in the end, until Symantec provides a product that an SMB can use without spending weeks testing SEP will continue to be a 3rd rate security product.
BTW, we've gotten off topic. The fact remains, once you're infected SEP with the most recent defnitions can't even find Fake AV let alone reomve it and yet MBAM with a week old set of defs finds and removes it 100% of the time. Let's get back on topic. SEP can't remove what MBAM can and when Symatec admits to that we can move forward with finding a solution.
SEP includes a product called Power Eraser, a similar product to MBAM. It's a separate download found on the client.
SEP includes an iSO you can boot off to scan machines offline. It can be found on fileconnect with a valid support contract.
And most likely you are configuring SEP wrong, and using out of the box policies and assuming that is sufficient for security.
Network Threat Protection, Bloodhound set to maximum, and TruScan PTP all need to be tweaked from their defaults... Not to mention they have to be installed as a feature!
There is an online portal, save yourself the long hold times. Create ticket online, then call in with ticket # in hand :-) http://mysupport.symantec.com "We backup data to restore, we don't backup data just to back it up."
You continue to miss the point. SEP FAILS to remove items that MBAM removes. Period. You haven't disputed that as it's really not in dispute. Furthermore, we are doing FULL deployments of every option including PTP and NTP but if SEP's default settings don't catch modern nasties why is it shipped that way? Symantec is assuming, wrongfully so, that small biz's are going to know how to jury rig their product to protect their systems (but of course they will sell you an install session with a rep to do it for you!).
Again, let's get back to the real debate. SEP, in a running system out of the box, FAILS to remove nasties other products remove. Period. Furthermore, if I remove a HDD from an infected system and connect it to a non-infected but fully updated box with SEP it won't remove it either. Let's stop excusing away the initial config and focus on the problem, removal.
"Again, let's get back to the real debate. SEP, in a running system out of the box, FAILS to remove nasties other products remove. Period. Furthermore, if I remove a HDD from an infected system and connect it to a non-infected but fully updated box with SEP it won't remove it either. Let's stop excusing away the initial config and focus on the problem, removal."
The fail here is assuming out of the box is sufficient (in all aspects of security products, not just limited to Symc). And Power Eraser is a removal tool. So lock down SEP so that it blocks the stuff, and it can reduce the infections by a large magnitude, and when it does get through, you have the PowerEraser at your disposal to try to further eradicate it.
There's something to be said if you continually bash a product that you cant get to work... Perhaps it's time for you to invest in something you are more comfortable with?
There is an online portal, save yourself the long hold times. Create ticket online, then call in with ticket # in hand :-) http://mysupport.symantec.com "We backup data to restore, we don't backup data just to back it up."
There really isn't much to debate. SEPs default configurations don't cut it, as we all know, hence they need to be tweaked.
Administrators who work with SEP day in and day out are probably (should be) more aware of this.
SEP is more taylored to the enterprise meaning it will give you default configurations (which don't really work for most), and I think they try to take the safer approach of not breaking things out of the box, less false positives, etc etc. This allows for the admins to test and tweak to make it work for their enterprise.
MBAM is not an enterprise product.
Either way, I'm not defending anything. I'm just giving my two cents.
I take a multi-layer approach when trying to protect the enterprise, with the main purpose of trying to stop anything from even getting to the workstations in the first place.
As I've said, SEP works for some and not others just like McAfee works for some and not others and Kaspersky, and all other AV vendors.
Maybe it is time for you to look into other suppliers.
Regardless, this thread and others like it, have run their course.
On another note, Symantec Power Eraser is designed to detect and remove:
FakeAV and other Rogueware
New variants of existing threats
System setting which have been tampered with
Don't ask me why SEP doesn't do this but it is a nice tool as I've used it a few times and it has gotten things SEP hasn't picked up. Same with the SERT.
Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.
"BTW, we've gotten off topic. The fact remains, once you're infected SEP with the most recent defnitions can't even find Fake AV let alone reomve it and yet MBAM with a week old set of defs finds and removes it 100% of the time. Let's get back on topic. SEP can't remove what MBAM can and when Symatec admits to that we can move forward with finding a solution."
Absolutely incorrect. I talk to customers all day who have told me that MBAM fails to remove malware as well. In the 10+ years I have working in this industry I have found that nothing works 100%, and you will never find an AV product that works 100%. I have even had MBAM fail on my machine at home to remove a fake AV.
Bottom line is this; If you expect SEP to work out of the box and not have to configure it to work in your environment, you are failing to use the product corectly. It doesn't get any more plain or simple than that. As the previous poster said. We designed it to be the least disruptive to the environment as possible when installed. At that point it's up to the user, whoever that may be, to configure it to work properly in their environment. That includes days/weeks of testing before full deployment, etc.
"Days/weeks of testing" would be laughable if it weren't so tragically off-base in a SMB environment. Your statement suggests to me that Symantec has little insight into how an SMB operates. SMBs don't' have the manpower, time, or $ to do what you suggest. Fortune 500's do, but then again at least one of them doesn't truest SEP entirely either. SEP 12 only emphasizes that problem for SMBs and certainly doesn't go very far toward fixing it. Something well over half of all seats in the business world are in SMBs but Symantec's focus is on the Fortune 500 seat. As I said before I know of a Fortune 40 company who has BOTH SEP and Malwarebytes deployed. Makes you wonder why a company that size would need both too?
Symantec does miss malware. We are not alone in that, but it is cold comfort to someone with an infected system. I understand why people get upset.
I disagree that MalwareBytes is a better desktop security product than SEP. Rather than prolong the argument by making my own case for why this is wrong, I'd like to propose a real world test.
Take half of your machines and install MalwareBytes on them. Configure them any way you wish. Take the other half and install SEP with the recommended settings. Now leave the machines for a week or better yet a month. And then go see which ones have the most infections. You could even then run a SEP scan on the MalwareBytes machines and a MalwareBytes scan on the SEP machines. But make sure you don't count the tmp files and registry entries that MalwareBytes counts as viruses.
This would be a fair way to compare the two products.
Actually, that's not a fair way. The fair way is to infect a machine with one of the Fake AV variants, remove the HDD, clone the HDD, and then using the latest defs let each product scan one of the drives. My experience is SEP won't remove much of these types of malware products and MBAM will remove the vast majority.
Also, if you fail to remove registry entries that malware/viruses install you're just asking for re-infection so I don't know why you want to ignore these registry keys. Are you saying that SEP would or should leave a malware's registry keys during removal?
Next, it's appears from this side of the street that you have multiple divisions at Symantec pulling in different directions. The developers appear content to ship SEP as-is without Security Response's recommendations and Security Response appears intent on telling everyone what's wrong with the way SEP is designed and shipped.
Let me ask it this way. If you take a brand new computer with an unformatted HDD, and by using NOTHING but defaults install Windows 7 and then install Microsoft Office what changes from the defaults in Windows/Office do you have to make before they're usable in the manner in which they were advertized? The answer is NO changes. Yes, they can be customized to change the way they behave, but to have the standard functionality that will allow for 99.9% of folks to use them efficiently, the out-of-the-box configuration is just fine.
SEP, on the other hand, apparently isn't. SR disagrees with the out-of-the-box configuration and suggests major configuration changes in order for SEP to provide the "advanced threat prevention to deliver unmatched defense against malware for laptops, desktops and servers" (quoted right off your web site). Nowhere on http://www.symantec.com/business/endpoint-protection does it speak about the only way to actually achieve this "advanced threat prevention" does one have to make MAJOR configuration changes to the product after installation. At the very least the statement is misleading.
The same page goes on to state:
Key Benefits:
Stops malware such as viruses, worms, Trojans, spyware, adware, bots, zero-day threats and rootkits.
That's simply not my experience with the out-of-the-box configuration (others here have agreed and given SR's FAQs on how they believe SEP should be configured, it's pretty clear we're not alone). Now if you want to add an * to those statements and then add a disclaimer at the bottom that might say something like:
* Please note that the out-of-the-box configuration may not provide acceptable levels of protection. Significant amounts of time may be required to configure SEP and then to maintain it as usage changes.
That might get the job done, but as it stands now I find MBAM removes what SEP fails to find, more often than not.
Finally, much here has focused around using SEP's management tools to setup policies. How do you handle the unmanaged LAN of 5-10 PCs or other unmanaged client PCs? The MAJOR drawback of SEP is SEPM requires the wasting of 500MB+ RAM on the management server as well as significant amounts of CPU time. SAV 10.1.7 was perfect for this type of LAN. It used <100MB on the management box and ran wonderfully. SEP, on the other hand, is unmanageable in a small environment. SEP really fails these customers all around and SEP 12.0 doesn't solve it at all. SEP 13 or whatever you call it, had better be back to 100MB on the management side or you will lose huge numbers of small businesses to another product.
"Actually, that's not a fair way. The fair way is to infect a machine with one of the Fake AV variants, remove the HDD, clone the HDD, and then using the latest defs let each product scan one of the drives."
Sorry, but that's just silly. Yes, if the ONLY thing you care about is exactly one version of the Fake AV virus, this might be a good test. If you care about the overall effectiveness of malware protection, Kevin's suggestion of running two groups of parallel computers is far more reasonable. Despite your frustrations with this particular weakness (and I have some of the same frustrations), I think overall effectiveness is a far better metric.
There hasn't been a time in the last decade where I haven't kept a backup cleanup program (or three) to supplement the primary program. That's just how this business works. The virus writers write and test specifically against the well-known AV software. AV software for the most part has to wait until a virus is released in the wild before they can build in protections. Having multiple sources of protection is a necessity -- some software is better at certain types of virus than others, or identifies new outbreaks sooner.
From what I've seen in other places, the Fake AV is the #1 type of virus recently, with something like 30,000 different versions released in the past 12 months. Is it any surprise at all that a few of those versions get by the SEP defenses? Is it any surprise those are the ones you see the most, if they're the most common?
There was a good webcast on the FakeAV issue back in April. You can find it here:
And this thread was extremely helpful:
But, no security product is 100% full proof. So, I have told and retold the users to not click links from people they don't know. And, believe it or not this has helped (but you have to them over and over). Also, I think it is important to have gateway security as well. We use Trendmicro CSC at the hardware level, but Symantec has a gateway product as well.
I've already pointed out Teiva-Boy's flaws. App & Device control is all well nice and good for large enterprises where they have precise control over what users may and may not have installed. SMBs don't have this level of control if for no other reason than they don't have individuals responsible for nothing but SEP. Furthermore, blocking external devices prevents the installation of legitimate products from CD/DVD drives.
Furthermore, how does one do this on an unmanaged network or on other unmanged clients?
Now , if one listens to the webcast they say in Oct 2009 they finally put a name on this but they admit it had been going on for "a year and a half"!!! So now we're at late August 2010 making it 2½ years since it first became a problem and we're still being told to jury rig SEP to stop it?!?! How many builds of SEP have their been in 2.5 years and they couldn't have included better "rogue security products" (to use their term) defenses in 2.5 years?
To those of you who are defending Symantec here, 2.5 years is an eternity in the IT world. It took MS less time to dump Vista for Windows 7. That there is no native, out-of-the-box protection for this type of malware is simply not acceptable, not 2.5 years after initial detection.
BTW, the video was very humorous! About 1/2 way through he showed a slide admitting the default settings aren't cutting it so the question is why hasn't development fixed this??? We're 6 or more versions of SEP 11. Time to make some changes at the development level.
"Actually, that's not a fair way. The fair way is to infect a machine with one of the Fake AV variants, remove the HDD, clone the HDD, and then using the latest defs let each product scan one of the drives. My experience is SEP won't remove much of these types of malware products and MBAM will remove the vast majority."
Malware Bytes is designed as a Malware removal tool. To have SEP try and compete with Malware Bytes on a pure removal basis would be absurd unless you also wanted to account for false positives. Malware Bytes doesn't use traditional "definitions" to remove threats. Take any executable, name it Antivirus2010.exe, and throw it into C:\Program Files\Antivirus 2010\ and it will probably get detected.
SEP on the other hand uses actual definitions based on specific samples to remove threats. So if SEP detects Antivirus2010.exe, the cleanup engine will remove the specific registry values and files for that variant. SEP is precise in its removal. Malware Bytes uses a shotgun approach. If you want a product that uses the shotgun approach, then use Power Eraser. It is a free tool provided with SEP designed to remove Malware with the "shotgun" approach that you're looking for.
Now if you actually want to prevent these things from installing on your system in the first place, I would recommend following some of the suggestions already provided. (Application and Device Control + NTP mainly) Ultimately the current model for detecting and removing these things will have to change. Bottom line is that the whole security model will need to go white listing anyways. There are something like 1200 new versions of these fake AV programs a day. Traditional AV software regardless of the vendor won't be able to keep up with that without white listing of some sort.
I'd like to weigh in.
I keep seeing Symantec employees reference that "Does SEP detect FakeAV" article as though there's really any value in it. The answer is "no". SEP doesn't typically detect FakeAV instances. That being said, it can be used to proactively prevent FakeAV and similar threats. Application Control is the key. ShadowsPapa has a great thread here https://www-secure.symantec.com/connect/articles/h... that basically tells us how to set it up. It's reasonable and helps a lot.
I've got two concerns though. One: Application Control doesn't work with unmanaged clients. That's completely, totally, and utterly unacceptable. Huge feature-hole. I should be able to drop a config file applying a policy on any box, not just fully managed clients. Two: out of the box it's a pain to set up. I'd like to see a pre-defined policy, perhaps on by default that prevents execution of EXE and DLL code in user profiles. Suddenly even for clueless administrators SEP would just magically block spyware. If it notified users visually when something was blocked, it would be EASY to adjust any overzealous blocking.
Bottom line is that somehow Malwarebytes manages to make a highly reliable definitions-based malware detection and removal package. SEP doesn't have that, which upsets a lot of people because we KNOW the definitions exist. Regardless of how many new variants are released each day, MBAM mysteriously manages to have defs that are massively more applicable than Symantec's. Symantec just doesn't have them. Let's say it another way: Symantec's threat definitions aren't NEARLY as good as Malwarebytes' for purposes of spyware remediation. On the up-side, SEP has some tools which are more useful at prevention.
So. Symantec, here's my advice. Get your hands on better defs AND make your prevention tools more friendly. I can handle setting the stuff up (in a managed environment) but there's no excuse for "you're doing it wrong" being a default answer when you're told SEP doesn't work against FakeAV. It's an AV tool for crying out loud. It shouldn't require high degrees of intervention and tweaking and fiddling and research to make it actually work against digital threats.
"That's completely, totally, and utterly unacceptable. Huge feature-hole. I should be able to drop a config file applying a policy on any box, not just fully managed clients"
You can. Help and Support>Troubleshooting>Policy Profile>Import.
"I'd like to see a pre-defined policy, perhaps on by default that prevents execution of EXE and DLL code in user profiles."
If I remember correctly, We tried that when the product was new. Got way too many complaints that SEP was locked down too tight. Now there are three default AV/AS policies you can use along with App and device control. They still need to be adjusted for each environment since no two are extactly the same.
"Bottom line is that somehow Malwarebytes manages to make a highly reliable definitions-based malware detection and removal package."
Incorrect, MBAM is only definitions based if you pay for it. Other than that, it's a brute force removal utility.
Ted, SEP doesn't support Application Control in an unmanaged format. I can't import a policy because it isn't permitted. Or am I simply wrong? I'm willing to entertain that, but my understanding to date had been that AC isn't an unmanaged feature, which is what I was refering to there. If AC is supported unmanaged, I'd be fascinated to learn that because it'd be hugely useful to a couple of my customers. This is one where I'd love to be wrong.
As for the complaints you got, I'd like to point to my suggestion that the product could offer visible alerts and explanations as to when and why something is blocked. You can't stop developing features simply because it's hard to do so. Application and Device Control are really, really cutting-edge technologies and it's awesome that an endpoint license includes those features. That being said, usability is king. If you got complaints that things were "locked down too tight", the proper answer isn't necessarily to disable useful features. It's to make those lockdown features intelligent and easily managed. Much like adding Windows Firewall into XP, as long as there's a simply way to manage the product you're golden. Forcing a systems administrator to crawl through pages of ProcMon and SEP logs to figure out what's going wrong isn't the ideal approach. A nice pop-up saying "I blocked PATH\EXECUTABLE because REASON and click HERE to understand how to change this" would go a long way towards letting you ship SEP in a secure format.
MBAM is definitions-based, period. It's not heuristics. I download the free product, I download the definitions update, I scan, it finds, it cleans. That's definitions-based. What the payed product (which I have pitched to ZERO of my customers) gets you is realtime protection. My point is that moments after an infection, I can download the free product, the free defs, and find and remove nasties in huge quantities that SEP doesn't recognize. By definition (pun intended) SEP could have the same definitions and use them both in on-demand scans and realtime scans. But it doesn't.
Please understand, I'm not going elsewhere. I'm not Symantec-bashing. I'm explaining the context of why there are so many complaints. I know how and why to use things like Application Control. It isn't an option for many of my customers (I do out-sourced IT for dozens of small & medium businesses so I maintain a couple dozen servers and probably a thousand or so desktops in different environments). That bugs me. The fact that SEP could be better simply by having access to the identification definitions I know another product has... that too bugs me. I'm not disgruntled. I'm just explaining that the complainers have good cause and the spin that's being put on the situation isn't valid. "Just roll out AC" doesn't explain why SEP doesn't detect that which MBAM does. Sorry.
"Ted, SEP doesn't support Application Control in an unmanaged format. I can't import a policy because it isn't permitted."
Actually, it does, and yes you can. You can't import a policy from the SEPM into an unmanaged client However, you can export the policy from a managed client and import that policy into the unmanaged client. The client will then use that policy. The problem with that is you cannot make changes to the policy on the unmanaged client very easily. You'd have to change it on the managed client and re-import it to the unmanaged client.
MBAM may appear to download what they call "definitions" but I don't think they are definitions in the same sense as what SEP or SAV uses, since SEP and SAV look for specific code strings in files rather than specific file names and/or registry keys like MBAM does. Like previous posters have said, try naming a file after a known fake AV executeable and more likely than not MBAM will detect it as a threat.
Really? This is beyond being jury rigged. How do you expect this be accomplished in a 10 user peer-to-peer environment where SEPM is so overtly bloated that there's no way they can run it? You're grasping at straws here trying to defend an undefendable problem.
Let's focus on the issue again. I posted screen shots of Malwarebytes finding junk that your "Power Eraser" didn't. I've now tested this on multiple other machines, ALL with the same finding! Apparently nothing Symantec has can reliably detect or clean modern nasties. I'd sure like to hear the explaination as to why when it clealy states that it's designed to hunt down Fake AV and variants.
Yeah really. Look, I'm done talking to you because you are clearly only out for an argument and do not really want any help. All I have to say to you is; if you do not want to use the product the way it's designed to be used, then your clients are going to keep getting these fake AV's, PERIOD. And ultimately who's fault is that? Yours.
All right. We had another infection this weekend so I used Power Eraser. Guess what, it removed a legitimate program, GE Healthcare's Logician EMR and left the Fake AV junk. You'll also noitice that the latest defs for Power Eraser are 10 days old. An eternity in the malware world.
See attached screen shot of the results from both scans. Power Eraser was run BEFORE Malwarebytes.
I will have to agree with the above in that SEP does not do a great job in removing Fake AV's. However it is a very solid product when configured correctly and also offers good performance both on the server and clients. it is option ladden and I would not be too quick to call it a "unacceptable" product.
I've administered our SEP environment for 2 years now. At first I felt that we were loosing the war on malware. We started patching our workstations better, configured policy and reconfigured policy in SEP. Now we are on 11.0.6000.550 and only have about 2 or 3 detections of fake AV variants. Over 1 year ago we were getting 40 or 50 per day.
SEP has come a long way. I'm happy with it now.
Its not only SEP but Malwarebytes is the best at the moment when it comes to Fake Antivirus.
If you would have scanned those files in Virustotal.com you might have found very less to none detecting it other than MBAM..
Vikram Kumar
Symantec Consultant
The most helpful part of entire Symantec connect is the Search button..do use it.
Terabyte, you have more than made your point. You're not happy with how SEP deals with detecting Fake AV, and you keep finding things with Malwarebytes that SEP can't touch or doesn't see. Fine, fair. In all sincerity, I can understand this being hugely frustrating and your wanting to vent your feelings on the subject.
So moving forward... what's next?
Rather than detect and remove after the fact, we'd prefer to try to help you lower the incidence of infection in the first place. We have collectiively offered configuration and preventative suggestions. To the best of my recollection, most of the suggestions we have had to offer have been met with resistance; that the product out of the box should work with little to no configuration; that tools like Application & Device Control are beyond small shops' capabilities to handle... and so forth. (Forgive me--this is a long thread and I can't remember if you said you have already adjusted the heuristics to greater sensitivity, installed NTP for Intrusion Prevention, and so on.)
For a good deal of individuals I've talked to, simply upping the sensitivity of PTP and Bloodhound has helped many bring the number of FakeAV infections down considerably.
As for Application and Device Control, which you keep mentioning in the context of SEP Small Business 12 users who don't have access to A&D Control. Fair enough, they don't. However, for those who do have SEP 11 and have A&D Control available, why not use it? Even smaller shops can benefit and testing only needs one mahine. Yes, it's a time investment to configure, but the potential rewards, not having to fight infections, would be worth it. (Ounce of prevention, pound of cure.)
ShadowsPapa wrote an excellent article on using A&D control to stop BHOs and FakeAV, and it doesn't rely on whitelistiing installed apps, but preventing certain types of files from being written to specific locations, locations that FakeAV likes to write to. Testing recommended (in log only mode; the article explains how) so that something you want to allow doesn't get blocked by accident.
Apart from the features that are included as a part of SEP, what about Windows security in general? Postechgeek asked about a week ago in response to one of your comments: "Do you have gateway protection? How is your security policy?" Are end users typically admins on their own boxes? Not all of these apply to Fake AV in specific, but it's a list worth looking over:
Title: 'Security Best Practices for Protecting a Business Environment from Common Threats'
Symantec, Senior Information Developer
Enterprise Security, Mobility, and Management - Endpoint Protection
Don't forget to mark your thread as 'solved' with the answer that best helps you!
These are often very small companies. Gateway protection is expensive and often unrelaible on small biz devices (Trend Micro, for example, offers services via Cisco's Small Biz devices that slows down the Internet so much people would rather live with the risks). In small biz's often the users have to be admins. Intuit, for exmaple, has demanded that users be admins to run Quickbooks and given QB runs 90% or more of the small biz's out there how are you going to tell a company they can't run QB to be safe?
I have no problem upping the threat protection level so long as SEP doesn't create tons of false positives, which has been a major problem in the past for all AV vendors and I've done so on all the managed networks and told unmanged customers how to do it on each machine.
The "solution" offered for App & Device control is simply unacceptable and to have asked that small biz's do that again shows that Symantec has totall clueless when it comes to small businesses.
But in the end, it's clear my original post is still accurate and no one here has show otherwise. SEP and Symantec Power Eraser fail time and time again to detect and remove Fake AV even though Power Eraser specifically states that's what it's for. Let's not blame the way small businesses are forced to run, let's find solutions to clean them up when there are no ways to lock them down. The better solution would be for Symantec to admit there's a problem in your detection engine as-is and release 11.07 with this fixed.
The "solution" offered for App & Device control is simply unacceptable and to have asked that small biz's do that again shows that Symantec has totall clueless when it comes to small businesses.
That's your opinion. Even small businesses are interested in securing their environment, and will find a way to utilize the tools provided to them in the software they purchased, in lieu of massive security infrastructure. If they're paying for Support, guess what? They can call Support if something about A&D Control is not working the way they want or expect it to.
...let's find solutions to clean them up when there are no ways to lock them down
I disagree; I think that prevention is vastly more important then cleanup after the fact. There's ALWAYS a way to lock things down. If someone is responsible for a company's computer network, it behooves them to properly secure it, their financial and private information, their livelihood. If they are not able do it, they need to find someone who can. It is not my intent to be flippant or suggest this would be easy. It can often be expensive too (the cost of consultants, etc), I don't deny that, but compared the cost of a damaging breach of security, private information getting into the wrong hands, loss of trust...
I think you would agree that one's network should be viewed as an investment to protect. I'm not assigning blame to small businesses; rather, I'm not making the assumption that they aren't capable of handling working with the software they have purchased.
Once again, to try to get past this fixation on the AV engine: AV/AS has reactive detections based on code provided--common for traditional antivirus. Fake AV code, which I and others have explained, is CONSTANTLY CHANGING. Antivirus is no longer enough, and that is not just true for Symantec products. Yes, there are heuristic detections and other proactive components that can be amped up to protect against these repackaged threats; false positives, for which Symantec consistently rates as LOWEST in the business, are a possibility, it's true.
I don't know how much simpler I can possibly put this, so I think it's time I stop bothering to try.
Symantec, Senior Information Developer
Enterprise Security, Mobility, and Management - Endpoint Protection
Don't forget to mark your thread as 'solved' with the answer that best helps you!
I've taken many of the recommended steps at customers who have managed SEP, but that still doesn't explain why Power Eraser doesn't find it.
Furthermore, please tell me how Symantec wants me to do this at a customer with no management capabilities? Since App & Device control isn't avialble to an unmanged client other than by exporting from a managed client, does Symantec want me to setup a dummy SEPM console so I can setup management for each one of these PCs? Come on, that's illogical. I'm open to options, but what really needs to happen is Symantec needs to upgrade its engine to work out-of-the-box to stop the infection, as you have said prevention is better than reacting after the fact, but in these networks there aren't many clear choices.
"...but that still doesn't explain why Power Eraser doesn't find it."
We've explained why things get missed many times. Sandra just explained it again, you just aren't listening. There's no need to explain things any further at this point.
"I'm open to options"
No, actually you aren't. You've argued with each and every suggestion that's been made to this point.
"but what really needs to happen is Symantec needs to upgrade its engine to work out-of-the-bo"
No. Again, what really needs to happen is you need to configure the product for your customers environments, Symantec isn't going to do that for you. We could not configure the product to work "out of the box" for every environment out there, it's simply not possible. You do understand how many customers Symantec has and how many thousands of different environments those customers use, right? Again, we tried locking the product down at release and got more complaints than I care to remember. It was a HUGE call generator, so the product was set to a semi-generic state and we left it up to the customer's to configure it for their needs. THIS WAS DONE DUE TO CUSTOMER REQUESTS/COMPLAINTS.
Really? That's not the solution. Our customers, as ever other SEP customer has, have paid a lot of $ for SEP and they have a right to expect it to work. Look, Symantec has FULLY admitted things have changed since SEP shipped and have by default admitted their settings don't cut it any more. They're just in denial that their engine, even Power Eraser doesn't remove this type of junk reliably. What we need and deserve from Symantec is an acknowledgment that this is the case and then a road map for a solution that doesn't require hundreds of hours of initial and ongoing maintenance to keep it running.
Honestly, an acknowledgment from Symantec that their FakeAV detection rate is poor would make you feel better?
I would prefer a fix over anything else and I have found it using the various components within SEP. I've seen it all on this post and all of the suggestions given to you, you find unacceptable for various reasons. And that's fine. But frankly, I'm out of advice for you other than to look for a different product. SEP just doesn't seem to work for. I also get the feeling your customers rely only on AV, which is fine I guess but anyone who does that is in for a rude awakening.
Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.
Security as a framework will not work and should not depend on a single component for achieving the desired results.
I agree with Sandra and Brian that various components deployed in an environment togather protect the machines in your network. So, expecting AV products to do all the work is almost expecting other products to do nothing?
Some of the FAKE AV programs that are coming out are being changed so often that no single company can get them all.
Locking down your system is a great defiense, I do wish more was caught but if no one is sending it in then how will any AV maker make a definition of it.
I get 1 or 2 machines a week to fix for spy ware out of 240, just about as bad as a hard drive going bad on us.
I dont see this being as bad on windows 7 with UAC, but the XP machines that we have to keep for older software are a pain at times with malware out there.
Facebook scam, Myspace links that take over and even the white and yellow pages have it now. It seems a bit worse this year than last year with all these new variants slipping through.
maybe need quad core to run all the scanning software needed.
Doesn't security start at the perimeter of the network and work its way in? If the small companies you deal can not afford a gateway appliance, why not use the built in feature of the NTP with IPS. This will block the FakeAV's via the signature files and will prevent the end user from making the mistake of clicking the FakeAV install button.
You can then make other recommended changes like upping the sensitivity of PTP and Bloodhound and tweaking those settings. As well as some of the other changes other posters have offered as well as the Symantec employees.
In this day and age just an Anti-Virus application is not going to cut, due to the malware/virus writers being one step of ahead of the vendors. You need to take a multi-stage/step defense for your customers, by either using the tools you have available or look at different options.
Don't forget about patch management and updates, this is a key factor in how machines get hit with the drive by downloads and how the FakeAv's get launched in the first place.
If you can use all the available options in SEP, your infection rate will dwindle and you will only need to use malwarebytes in extreme cases and sometimes malwarebytes might not catch all the infected files either.
If you can block the attempts at the network/internet layer, they wont be able to make it to the end user who does not know not to click the button. Take the depth in defense way and you will be much more happy with the SEP product.
As CIO for a hotel chain, I've renewed our Enterprise subscription to the various incarnations of Symantec AV products over the last 8-9 years, and I'd felt comfortable with Symantec's anti-virus protection capabilities. However, over the years AV protection took a back seat to malware protection. For the last two to three years we've be underwhelmed with Symantec's ability to prevent and/or eradicate malware.
Citali comments that MBAM (MalwareBytes) is primarily a removal tool. As a free product, this is true. If you purchase the product, MBAM is also a real time malware infection prevention product, and it is one of the best (out of the box) products we've tested.
TEP / SEP requires extensive monitoring, configuring, and server/client overhead. Our dedicated servers consume huge bandwidth pushing updates to hundreds of client PCs. Unfortunately, today we had yet another group of PCs infected with the fake "Microsoft Security Essentials" malware. TEP did nothing to stop it.
The safest configuration we've found is a combination of TEP running only as an anti-virus product, and MBAM loaded on the same system. The downside is that we're paying many thousands of dollars keeping our TEP / SEP contract current. MBAM is much less expensive and does a far better job of protecting systems from malware than TEP / SEP unless you consume much more administrative overhead in configuring the latter.
When our Symantec TEP expires at the end of the year we're not planning on renewing. We can purchase corporate licensing of MBAM much more inexpensively, and we're reviewing pricing of competing Enterprise AV products such as "G Data" or Avira.
You'll be hard pressed to find any AV product that will protect 100% from threats.
I don't know what TEP is, but SEP will protect you in most cases if it's configured properly. It is a corporate product. We've already commented in this thread extensively as to why it must be configured after installation.
One thing, if you are only using the AV/AS portion of the product, as you can see from the previous posts in the thread, that's not going to cut it. You can't stop these types of threats using only AV/AS. Which is why we included Proactive Threat Protection, Application and Device Control, and Network Threat Protection.
Check this out, Ted. Should fill in TEP
Dr. Woodhall
It was said earlier in the thread but here it is again.
We had this problem. I kept saying that we were not patching enough. We use Altiris and were only patching critcial and important patches. I point out that there were dependancies in the patches and not applying them all caused problems.
We now have 98% of our 4000+ workstations patched with all software being patched including Adobe, all Microsoft patches, and any other programs we can patch. We see very little Fake AV malware. We also eliminated the need for users to be Local Admin.
Our potential for infection is great as we have researchers from China and Russia working at our facility and we really can't block their access to the websites in those countries.
SEP is getting better, it recognizes more malware than it did 1 1/2 years ago.