Endpoint Protection

Dear All,

I use Symantec Endpoint Protection Version 12.x.x.x for my office, i have problem with trojan that acces url http://realtime.services.disqus.com/api/2/thread/, all computer user in my office access this URL and this high traffic. Because in log squid, access this URL  continuously

This log my squid :

.....

.....

.....

Hi,

Could you please confirm name of the Trojan?

SEP is detecting it? Do you see any action against it?

Make sure SEP clients are updated with latest definitions & machines are having latest microsoft patches and service packs.

Run a full scan in safe mode with latest defs on one of the affected machines.

Hi 

I agree above comments.

you can try symantec tool

Is your system infected? Symantec tools to help clear an infection

https://www-secure.symantec.com/connect/forums/remove-malware-httprealtimeservicesdisquscom

You can download the latest Rapid defintion and after that scan the system in safe mode.

Link

http://www.symantec.com/security_response/definitions/download/detail.jsp?gid=rr

Disqus is used for commenting systems on many reputable websites. Is the traffic to this site the only thing that makes you think there's a trojan, or is there other suspicious behaviour? (Is it possible your end users are visiting and heavily commenting on one or more websites?)

sandra

I don't know name of trojan, because SEP no detect this trojan. and SEP client use latest definitions & machines are having latest microsoft patches and service pack.

Hi Moh

If symantec antivirus not detect virus you can submit the file symantec

Using Symantec Support Tool, how do we Collect the Suspicious Files and Submit the same to Symantec Security Response Team. 

https://www-secure.symantec.com/connect/articles/using-symantec-support-tool-how-do-we-collect-suspicious-files-and-submit-same-symantec-sec

More information

https://www-secure.symantec.com/connect/forums/whats-process-submit

Never heard this... but have you checked the browser add-ons ?

It could be the unwanted one...

HI Moh

If any suspicious files symantec antivirus not detect you can submit file in symantec

Using Symantec Support Tool, how do we Collect the Suspicious Files and Submit the same to Symantec Security Response Team. 

https://www-secure.symantec.com/connect/articles/using-symantec-support-tool-how-do-we-collect-suspicious-files-and-submit-same-symantec-sec