detect 5805 signature?

[Guest]

Does anybody know how I can "search" my network remotely for any PCs that
might have the 5805 signature for Microsoft Antispyware that is affecting
Symantec Antivirus? Is there a file, registry key, etc. this info is stored
in? I can get a list of PCs with the Antispyware installed from our SMS
server but have no way of knowing how many of them might be broken. Also,
which registry keys are being removed by Antispyware?

 

[Bill Sanderson]

Your best bet is probably to get in touch with Symantec. This shouldn't
cost you money--and they have a tool to replace the registry keys.

You can call Microsoft via 1-866-pcsafety and see if you can get the
information you are looking for--this is an answer I don't have--I don't
know whether the sig levels are reflected in the registry, or how.

 

[Guest]

OK, so here is the response I got back from Microsoft when asked if there is
a way to tell remotely which signature our PCs are running without visiting
each one...

"Customer just wants to know if it's possible to identify the signature
version of Microsoft Anti Spyware Tool Advised customer to try installing the
Windows Defender in placement of microsoft Anti Spyware Tool"

.....a typical answer with no real help.....

Here is the reponse I got from Symantec:

There is a fix tool provided by Symantec to fix any PC that has been
affected by this "false-positive" it was provided to me once I contacted
their support.
The registry key to check for is
"HKLM\Software\Intel\LanDesk\VirusProtect6".
One of our admins wrote a VBS script for me to detect which PCs are missing
this registry key. I am able to run a report via SMS to see which PCs have MS
Antispyware installed. I will cross reference the two to see which ones need
to be visited.... Voila!, question answered, problem solved!

 

[Bill Sanderson]

Thanks--I agree that the Microsoft response wasn't helpful. Glad Symantec
did better.
--