Symantec EH Notes
Content
SYMANTEC EH Product Training Notes - by Claudine C. Loteyro EH Wave 17 - Sutherland Global Services Davao SECURITY THREATS 1. Worms: replicates themselves from system to system without the use of the host file 2. Virus: attaches itself to a program or file so it can spread from one computer to another, leaving infections as it travelled 3. Trojan Horse: impostors; files that claim to be something desirable but in fact are malicious; it contains viruses or spywares which may lead to loss of data 4. Backdoor: trapdoor; an undocumented way of gaining access to a program, online service or an entire computer system 5. Dropper: executable file that when ran "drops" a virus and has the capability to create or run a virus and infect the user's system when it is executed. When a dropper file is scanned, the scan may not detect it as a true virus because the viral code has not yet been created. Heuristics scanning often detects dropper before regular scanning 6. Joke Programs: change or interrupt the normal behavior of your computer, creating a general distraction or nuisance 7. Spyware: is a generic term for a class of software designed to either gather information for marketing purposes or to deliver activities to web pages 8. Adware: type of program that displays an advertisement of some sort, usually related to a specific web site cached in the web browser 9. Dialers: contains adult content 10. Hack Tools: keystroke loggers; used by a hacker to gain unauthorized access to your computer 11. Remote Access: programs that allow another computer to gain information or to attack or alter your computer, usually over the internet. Remote access programs detected in virus scans maybe recognizable commercial software which are brought to user's attention during scan 12. Security Risks: threats which do not conform as a trojan, virus, spyware, etc. THE EH CALL FLOW - Greeting - Customer gives out the Problem - Paraphrasing - Reassurance - Gather information - Probing (POCE) - Resolve - Closing Script CUSTOMER EDUCATION * Use WSC What is the Issue? Steps taken to resolve the Issue Consent of the Customer CLF (Closed Loop Feedback) - process of identifying and giving feedback about the types of issues customers are calling for - has a document ID: YrMoDayHrMinSecLang CMS (Content Management System) - the right tool used to get CLFs Case Tagging
- to be able to retrieve an information from a customer - to properly sort out the different cases so that it will properly be addressed * Case Tagging Essential Horizon 1. Closed a. Resolved: resolved issues; mostly technical and not refunding issues b. Placed a CD Replacement: given a CD to replace a downloadable product because of a slow connection or for customer satisfaction like customer has a broken CD c. Retail Refund: customer bought a product from a retail store and wants a refund; support would ask the customer to fill out a retail refund form @ norton.com/returns d. Symantec Store Refund: refunds for the order placed @ symantecstore.com e. Subscription Refund: subscription purchased by the customer is refunded f. Other Refunds: other refunds; refund for premium services charged or if a customer calls for refund of processing fees, etc. 2. Pending a. Solution Given: solution is given but the resolution is not yet confirmed on the call and the troubleshooting has to be kept pending due to some reasons; e.g. when a customer is not willing to stay on the line and says he will call us back * Note: Customer will be able to receive an email within 24-48hours b. Pending Email Sent: to be used when the issue is not resolved on the call and an email with resolution is sent to the customer. This might be because the customer is only asking for steps in an email with the document link or the steps for resolution c. Pending Single Phone Line: have a dial up connection with a single phone line and resolution cannot be completed on call because of this d. Fax Expected: customer's purchase details are not found in our order tools like DRCC or NITRO and we request the customer to fax us those details e. Pending Callback Attempt 1,2,3: you called back the customer but the line is busy, no one is answering or you reached an answering machine; 24,48,72hours respectively 3. Transfer a. Internal EH: customer's concern is not part of our support; e.g. not using windows OS, norton system works product b. Supervisor/Symantec Case Manager c. Elite Team d. CR e. Only available for Symantec 4. Non Polled * Note: before tagging a case as non polled, you should ask an SME or TL; non polled is when a customer will not receive any surveys a. SPS FE: customer wants to go for the premium services such as expert install but has not paid yet b. SPS BE: customer wants to avail of the paid services c. Enterprise Product: enterprise software (products which starts with Symantec) * To tag a case as Non Polled enterprise the following requirements must be met: - ask the correct name and version of the enterprise product - ask the number he dialed to contact support - provide the correct number: 18003420652 ext 2 - enterprise support availability: Mondays to Fridays from 7am to 6pm EST - refer customer to enterprise department d. Referred to ISP: norton product is already removed but customer still cannot connect to the internet or cannot send or receive mails
e. Referred to Vendor: norton product is uninstalled but there is problem with the hardware or software f. Call Disconnect: customer disconnected the call; tell the SME because they/you need to call back the customer within 15mins g. Other Scenarios - calling to get another number for support - resolve virus removal issue and does not want to pay h. Transfer to VSS: transfer virus removal services and customer will pay i. No Permission to Poll: customer does not want to receive any surveys * Case Tagging for Visa Queue 1. Closed a. Enquiry - when a customer wants to know in detail about the charge for autorenewal appearing on the credit card - when the days are not reflecting on the software so we need to sync - customer wants to know or change the billing profile - customer calls since he is informed that the autorenewal refund will be credited back in __ number of days but he did not get the money that was supposed to be credited in his account - customer wants to know about the products registered on his norton account - customer has purchased a new upgrade version and also received a prebilling notification of autorenewal for the old norton product, calls to know whether he could cancel the autorenewal feature to avoid change (not yet charged for autorenewal) - any other scenarios where the customer wants some information b. Retail Refund: customer bought a product from a retail store and wants a refund; support would ask the customer to fill out a retail refund form @ norton.com/returns c. Symantec Store Refund: refunds for the order placed @ symantec store d. Other Refunds: : other refunds; refund for premium services charged or if a customer calls for refund of processing fees, etc. e. Subscription Refund - customer insisting on getting a refund - not satisfied by the autorenewal feature or not satisfied with the product/support and wants a refund for autorenewal - customer company pays for the antivirus subscription so wants a refund for autorenewal - refund is processed for autorenewal and the customer is no longer using norton f. Retained Resolved - calling for a refund and agent was able to convince to stay with norton - upgraded the norton software and was charged for autorenewal of his old product, agent was able to convince the customer and full refund is not processed - manually renewed but charged for autorenewal, agent was able to convince the customer to keep the subscription and full refund was not processed - uses a norton software and not using the one that he was charged for autorenewal, agent was able to convince the customer to adjust the number of days g. Retained - No Longer Using the Product - refund as he is using a 3rd party software - customer is using ISP software but still has norton subscription left with hum; has been charged for renewal and he was convinced to use the norton product again - no security software but has norton subscription left *Note: Other case tagging is same with EH NORTON PRODUCTS 1. FULL SUPPORT
a. Norton AntiVirus 2004 and above b. Norton Internet Security 2004 and above c. Norton 360 d. Norton 360 Premier e. Norton Online Back Up f. Norton Online Family g. Norton Utilities Premier 2. PARTIAL SUPPORT - Customer Service (transferred to other departments if for technical support) a. Norton System Works Premier b. Norton Save and Restore c. Norton Utilities 3. TRANSFER TO OTHER DEPARTMENTS a. Norton System Works Standard b. Norton Save and Restore c. Norton Ghost d. Norton GoBack e.Norton Partition Magic f. Norton PC Anywhere g. Norton Mobile Security h. Norton for Mac i. Norton Utilities 4. NO LONGER in the MARKER - SEMI SUPPORT (renewal and upgrades only) a. Norton AntiVirus 2003 and below b. Norton Internet Security 2003 and below c. Norton AntiBot d. Norton AntiSpam e. Norton Personal Firewall f. Norton Confidential g. Norton Password Manager h. Norton System Works Basic SUBSCRIPTION - something that you have to pay for so that you can avail of the latest virus definition and updates (live update) * CD: from a retail store or symantec store; 1 year subscription; can be renewed or upgraded * Download: from a reseller (Winferno, Amazon, Dell) or symantec store; 1-3years subscription * Trialware: 15 or 30days subscription (30days subscription will ask for the credit card number and automatically charges the customer after 30days) * OEM: preinstalled in newly purchased computers; 60-180days subscription; comes with limited (cannot be renewed) and prepaid (renewable) * Symantec Online Service: provided by ISP; depends on how long the customer will subscribe to ISP * Configure to Order: depends on how long they paid for; expensive NORTON ANTIVIRUS 2003-2007 * Anti virus: protects computer from threats * Features: a. Traditional: depends on virus definitions b. Heuristics: depends on changes in the behavior * Internet Worm Protection - works like a firewall but is not a firewall; more considerate * Email Scan - does not work on web based emails (yahoo mail, gmail, etc.) -- protected by phishing protection and autoprotect - works on client based emails (windows mail, outlook express, etc.)
- Single Mail Transfer Protocol: Port # 25; Post Office Protocol 3: Port # 110 * Intrusion Prevention - checks on hackers through certain behavioral traits; false positive identification will be reviewed by symantec NORTON ANTIVIRUS 2008 * Network Security Map - views the status of Norton on another computer within a network - works when you have multiple computers installed with norton products and you can see on each computers the status of the Norton product * One Click Support - pop out window that will know the problem and will run the hot fix tool to fix it right away - if problem is not fixed, it will tell you to contact chat, email or voice support NORTON INTERNET SECURITY 2003-2006 - Two Way Firewall: keeps intruders out and sensitive information in - embedded Parental Control, Norton Password Manager, Norton AntiSpam 2007 - Norton Confidential: comes with Norton Password Manager, AutoFill feature, credit card information, phishing protection 2007 - 2008 - AntiSpam is given as an add on pack 2009 - AntiSpam is embedded again because of the new Brightmail technology which fixed all issues on the previous antispam feature - Parental Control and Privacy Control were offered as add ons 2008 - 2010 - Confidential Information Management/ Identity Safe Protection 2009 - 2010 - SafeWeb * Network Security Map: same with the antivirus but it is connected to a firewall so you can tag the PC: full trust, protected, shared or restricted NORTON SYSTEM WORKS a. Basic: basic tune up services (deleting windows and internet temp files, disk optimization) b. Standard: with antivirus c. Premier: with antivirus and save&restore NORTON SAVE and RESTORE - creates back up of your files (pictures, music and videos) - saved on another partition, CD/DVD, USB - files will be minimized and encrypted NORTON GHOST - creates a virtual copy of your hard disk NORTON GoBACK - works like system restore - note: do not uninstall if it is still enabled or the computer will crash NORTON ONLINE BACK UP - creates a back up online - 5GB for trial and 25GB for purchased - if product expired, recover the files within 30days
- additional memory can be purchased (5GB - 29.99, 10GB - 49.99, 25GB - 69.99) NORTON UTILITIES - upgrade of the norton system works - Norton Utilities Premier: plus Norton Online BackUp - Start Up Manager NORTON ANTIBOT - heuristics based NORTON 360 * almost all features are present * with backup set: records computer name and the formula that reads the back up (0,1,multiple backups) * Norton 360 comes with free 2GB online back up storage; 360 Premier has 25GB online back up storage Rules: - No home and home office products are compatible with windows xp 32bit - 32 bit OS will support 32bit and 64bit apps, while 64bit OS will only support 64bit apps Over and Under Install a. Allow: a newer version over an old version or an upgrade version of the product (e.g. NIS 07 over NAV 07) b. Soft Block: a new version/product will be replaced by an old version/product c. Hard Block: over installation will not proceed; e.g. other products cannot over install norton360 d. Add Remove Program link: a new product over another product Important! 1. Activation - Product Key 2005 and below a. CD: 24 characters alphanumeric CAPS b. DL: 26 characters alphanumeric U&L case 2006 - 2010 a. CD and DL: 25 characters alphanumeric CAPS NAV PK: V, NIS PK: J, N360 PK: T * product key can be used for newer versions free of charge 2. Subscription and Renewal 2005 and below a. Manual Renewal: add and deduct b. Subscription Key: given by agent, different every month 2006 - 2010 a. Manual Renewal: add and revoke (product key cannot be used anymore with zero subscription days) b. Renewal Code: 19 characters alphanumeric CAPS 3. Account ID 2005 and below - 9-11 numeric characters 2006-2008 - serial no.: 12 characters alphanumeric CAPS (check on help and support button -- about) 4. Live Update 2005 - 2008 - can be ran manually through user interface or type the run command line: Luall.exe
- Mode: automatic or manual - in the add/remove programs, you can see the name of the product and a different program for the live update (product engine and live update engine) - update starts 4hours after the computer booted up - 2005 v2.5, 2006 v2.7, 2007 v3.1/3.2, 2008 v3.4 2009 - 2010 - only has the product engine (live update engine is integrated) - in the add/remove programs, you can only see the name of the product - manual update can be done only through the user interface - Mode: standalone or integrated - updates every 5minutes and downloads files by chunks - lightning scan feature: scans only for a particular virus definition 5. Installation 2005 - 2008 - dependent on the Microsoft Installer - runs for 8-12mins 2009 - 2010 - Distribution and Installation Next Generation - not dependent on MSI - 1min to install/uninstall and 2min to upgrade
- to be able to retrieve an information from a customer - to properly sort out the different cases so that it will properly be addressed * Case Tagging Essential Horizon 1. Closed a. Resolved: resolved issues; mostly technical and not refunding issues b. Placed a CD Replacement: given a CD to replace a downloadable product because of a slow connection or for customer satisfaction like customer has a broken CD c. Retail Refund: customer bought a product from a retail store and wants a refund; support would ask the customer to fill out a retail refund form @ norton.com/returns d. Symantec Store Refund: refunds for the order placed @ symantecstore.com e. Subscription Refund: subscription purchased by the customer is refunded f. Other Refunds: other refunds; refund for premium services charged or if a customer calls for refund of processing fees, etc. 2. Pending a. Solution Given: solution is given but the resolution is not yet confirmed on the call and the troubleshooting has to be kept pending due to some reasons; e.g. when a customer is not willing to stay on the line and says he will call us back * Note: Customer will be able to receive an email within 24-48hours b. Pending Email Sent: to be used when the issue is not resolved on the call and an email with resolution is sent to the customer. This might be because the customer is only asking for steps in an email with the document link or the steps for resolution c. Pending Single Phone Line: have a dial up connection with a single phone line and resolution cannot be completed on call because of this d. Fax Expected: customer's purchase details are not found in our order tools like DRCC or NITRO and we request the customer to fax us those details e. Pending Callback Attempt 1,2,3: you called back the customer but the line is busy, no one is answering or you reached an answering machine; 24,48,72hours respectively 3. Transfer a. Internal EH: customer's concern is not part of our support; e.g. not using windows OS, norton system works product b. Supervisor/Symantec Case Manager c. Elite Team d. CR e. Only available for Symantec 4. Non Polled * Note: before tagging a case as non polled, you should ask an SME or TL; non polled is when a customer will not receive any surveys a. SPS FE: customer wants to go for the premium services such as expert install but has not paid yet b. SPS BE: customer wants to avail of the paid services c. Enterprise Product: enterprise software (products which starts with Symantec) * To tag a case as Non Polled enterprise the following requirements must be met: - ask the correct name and version of the enterprise product - ask the number he dialed to contact support - provide the correct number: 18003420652 ext 2 - enterprise support availability: Mondays to Fridays from 7am to 6pm EST - refer customer to enterprise department d. Referred to ISP: norton product is already removed but customer still cannot connect to the internet or cannot send or receive mails
e. Referred to Vendor: norton product is uninstalled but there is problem with the hardware or software f. Call Disconnect: customer disconnected the call; tell the SME because they/you need to call back the customer within 15mins g. Other Scenarios - calling to get another number for support - resolve virus removal issue and does not want to pay h. Transfer to VSS: transfer virus removal services and customer will pay i. No Permission to Poll: customer does not want to receive any surveys * Case Tagging for Visa Queue 1. Closed a. Enquiry - when a customer wants to know in detail about the charge for autorenewal appearing on the credit card - when the days are not reflecting on the software so we need to sync - customer wants to know or change the billing profile - customer calls since he is informed that the autorenewal refund will be credited back in __ number of days but he did not get the money that was supposed to be credited in his account - customer wants to know about the products registered on his norton account - customer has purchased a new upgrade version and also received a prebilling notification of autorenewal for the old norton product, calls to know whether he could cancel the autorenewal feature to avoid change (not yet charged for autorenewal) - any other scenarios where the customer wants some information b. Retail Refund: customer bought a product from a retail store and wants a refund; support would ask the customer to fill out a retail refund form @ norton.com/returns c. Symantec Store Refund: refunds for the order placed @ symantec store d. Other Refunds: : other refunds; refund for premium services charged or if a customer calls for refund of processing fees, etc. e. Subscription Refund - customer insisting on getting a refund - not satisfied by the autorenewal feature or not satisfied with the product/support and wants a refund for autorenewal - customer company pays for the antivirus subscription so wants a refund for autorenewal - refund is processed for autorenewal and the customer is no longer using norton f. Retained Resolved - calling for a refund and agent was able to convince to stay with norton - upgraded the norton software and was charged for autorenewal of his old product, agent was able to convince the customer and full refund is not processed - manually renewed but charged for autorenewal, agent was able to convince the customer to keep the subscription and full refund was not processed - uses a norton software and not using the one that he was charged for autorenewal, agent was able to convince the customer to adjust the number of days g. Retained - No Longer Using the Product - refund as he is using a 3rd party software - customer is using ISP software but still has norton subscription left with hum; has been charged for renewal and he was convinced to use the norton product again - no security software but has norton subscription left *Note: Other case tagging is same with EH NORTON PRODUCTS 1. FULL SUPPORT
a. Norton AntiVirus 2004 and above b. Norton Internet Security 2004 and above c. Norton 360 d. Norton 360 Premier e. Norton Online Back Up f. Norton Online Family g. Norton Utilities Premier 2. PARTIAL SUPPORT - Customer Service (transferred to other departments if for technical support) a. Norton System Works Premier b. Norton Save and Restore c. Norton Utilities 3. TRANSFER TO OTHER DEPARTMENTS a. Norton System Works Standard b. Norton Save and Restore c. Norton Ghost d. Norton GoBack e.Norton Partition Magic f. Norton PC Anywhere g. Norton Mobile Security h. Norton for Mac i. Norton Utilities 4. NO LONGER in the MARKER - SEMI SUPPORT (renewal and upgrades only) a. Norton AntiVirus 2003 and below b. Norton Internet Security 2003 and below c. Norton AntiBot d. Norton AntiSpam e. Norton Personal Firewall f. Norton Confidential g. Norton Password Manager h. Norton System Works Basic SUBSCRIPTION - something that you have to pay for so that you can avail of the latest virus definition and updates (live update) * CD: from a retail store or symantec store; 1 year subscription; can be renewed or upgraded * Download: from a reseller (Winferno, Amazon, Dell) or symantec store; 1-3years subscription * Trialware: 15 or 30days subscription (30days subscription will ask for the credit card number and automatically charges the customer after 30days) * OEM: preinstalled in newly purchased computers; 60-180days subscription; comes with limited (cannot be renewed) and prepaid (renewable) * Symantec Online Service: provided by ISP; depends on how long the customer will subscribe to ISP * Configure to Order: depends on how long they paid for; expensive NORTON ANTIVIRUS 2003-2007 * Anti virus: protects computer from threats * Features: a. Traditional: depends on virus definitions b. Heuristics: depends on changes in the behavior * Internet Worm Protection - works like a firewall but is not a firewall; more considerate * Email Scan - does not work on web based emails (yahoo mail, gmail, etc.) -- protected by phishing protection and autoprotect - works on client based emails (windows mail, outlook express, etc.)
- Single Mail Transfer Protocol: Port # 25; Post Office Protocol 3: Port # 110 * Intrusion Prevention - checks on hackers through certain behavioral traits; false positive identification will be reviewed by symantec NORTON ANTIVIRUS 2008 * Network Security Map - views the status of Norton on another computer within a network - works when you have multiple computers installed with norton products and you can see on each computers the status of the Norton product * One Click Support - pop out window that will know the problem and will run the hot fix tool to fix it right away - if problem is not fixed, it will tell you to contact chat, email or voice support NORTON INTERNET SECURITY 2003-2006 - Two Way Firewall: keeps intruders out and sensitive information in - embedded Parental Control, Norton Password Manager, Norton AntiSpam 2007 - Norton Confidential: comes with Norton Password Manager, AutoFill feature, credit card information, phishing protection 2007 - 2008 - AntiSpam is given as an add on pack 2009 - AntiSpam is embedded again because of the new Brightmail technology which fixed all issues on the previous antispam feature - Parental Control and Privacy Control were offered as add ons 2008 - 2010 - Confidential Information Management/ Identity Safe Protection 2009 - 2010 - SafeWeb * Network Security Map: same with the antivirus but it is connected to a firewall so you can tag the PC: full trust, protected, shared or restricted NORTON SYSTEM WORKS a. Basic: basic tune up services (deleting windows and internet temp files, disk optimization) b. Standard: with antivirus c. Premier: with antivirus and save&restore NORTON SAVE and RESTORE - creates back up of your files (pictures, music and videos) - saved on another partition, CD/DVD, USB - files will be minimized and encrypted NORTON GHOST - creates a virtual copy of your hard disk NORTON GoBACK - works like system restore - note: do not uninstall if it is still enabled or the computer will crash NORTON ONLINE BACK UP - creates a back up online - 5GB for trial and 25GB for purchased - if product expired, recover the files within 30days
- additional memory can be purchased (5GB - 29.99, 10GB - 49.99, 25GB - 69.99) NORTON UTILITIES - upgrade of the norton system works - Norton Utilities Premier: plus Norton Online BackUp - Start Up Manager NORTON ANTIBOT - heuristics based NORTON 360 * almost all features are present * with backup set: records computer name and the formula that reads the back up (0,1,multiple backups) * Norton 360 comes with free 2GB online back up storage; 360 Premier has 25GB online back up storage Rules: - No home and home office products are compatible with windows xp 32bit - 32 bit OS will support 32bit and 64bit apps, while 64bit OS will only support 64bit apps Over and Under Install a. Allow: a newer version over an old version or an upgrade version of the product (e.g. NIS 07 over NAV 07) b. Soft Block: a new version/product will be replaced by an old version/product c. Hard Block: over installation will not proceed; e.g. other products cannot over install norton360 d. Add Remove Program link: a new product over another product Important! 1. Activation - Product Key 2005 and below a. CD: 24 characters alphanumeric CAPS b. DL: 26 characters alphanumeric U&L case 2006 - 2010 a. CD and DL: 25 characters alphanumeric CAPS NAV PK: V, NIS PK: J, N360 PK: T * product key can be used for newer versions free of charge 2. Subscription and Renewal 2005 and below a. Manual Renewal: add and deduct b. Subscription Key: given by agent, different every month 2006 - 2010 a. Manual Renewal: add and revoke (product key cannot be used anymore with zero subscription days) b. Renewal Code: 19 characters alphanumeric CAPS 3. Account ID 2005 and below - 9-11 numeric characters 2006-2008 - serial no.: 12 characters alphanumeric CAPS (check on help and support button -- about) 4. Live Update 2005 - 2008 - can be ran manually through user interface or type the run command line: Luall.exe
- Mode: automatic or manual - in the add/remove programs, you can see the name of the product and a different program for the live update (product engine and live update engine) - update starts 4hours after the computer booted up - 2005 v2.5, 2006 v2.7, 2007 v3.1/3.2, 2008 v3.4 2009 - 2010 - only has the product engine (live update engine is integrated) - in the add/remove programs, you can only see the name of the product - manual update can be done only through the user interface - Mode: standalone or integrated - updates every 5minutes and downloads files by chunks - lightning scan feature: scans only for a particular virus definition 5. Installation 2005 - 2008 - dependent on the Microsoft Installer - runs for 8-12mins 2009 - 2010 - Distribution and Installation Next Generation - not dependent on MSI - 1min to install/uninstall and 2min to upgrade
