Symantec 20032623 - Endpoint Protection Small Business Edition, Руководство по внедрению

Страница: 135 / 351

To identify infected computers
1 In the console, click Home and view the Virus and Risks Activity Summary.
Still Infected is a subset of Newly Infected, and the Still Infected count goes
down as you eliminate the risks from your network. Computers are still
infected if a subsequent scan would report them as infected. For example,
Symantec Endpoint Protection Small Business Edition might have been able
to clean a risk only partially from a computer, so Auto-Protect still detects
the risk.
2
In the console, click Reports.
3
In the Report type list box, click Risk.
4 In the Select a report list box, click Infected and At Risk Computers.
5 Click Create Report and note the lists of the infected and at-risk computers
that appear.
Checking the scan action and rescanning the identified computers
If you have infected and at-risk computers, you should identify why the computers
are still infected or at risk. Check the action that was taken for each risk on the
infected and at risk computers. It may be that the action that was configured and
taken was Left Alone. If the action was Left Alone, you should either clean the
risk from the computer, remove the computer from the network, or accept the
risk. For Windows clients, you might want to edit the Virus and Spyware Protection
policy and change the scan action for this category of risks, or for this specific
risk.
See “Remediating risks on the computers in your network” on page 132.
To identify the actions that need to be changed and rescan the identified computers
1 In the console, click Monitors.
2 On the Logs tab, select the Risk log, and then click View Log.
From the Risk log event column, you can see what happened and the action
that was taken. From the Risk Name column, you can see the names of the
risks that are still active. From the Domain Group User column you can see
which group the computer is a member of.
If a client is at risk because a scan took the action Left Alone, you may need
to change the Virus and Spyware Protection policy for the group. From the
Computer column, you can see the names of the computers that still have
active risks on them.
See “Changing the action that Symantec Endpoint Protection Small Business
Edition takes when it makes a detection” on page 190.
135 Managing Virus and Spyware Protection
Remediating risks on the computers in your network