SYMANTEC EH Product Training Notes

- by Claudine C. Loteyro EH Wave 17

- Sutherland Global Services Davao

SECURITY THREATS
1. Worms: replicates themselves from system to system without the use of the host
file
2. Virus: attaches itself to a program or file so it can spread from one computer
to another, leaving infections as it travelled
3. Trojan Horse: impostors; files that claim to be something desirable but in fact
are malicious; it contains viruses or spywares which may lead to loss of data
4. Backdoor: trapdoor; an undocumented way of gaining access to a program, online
service or an entire computer system
5. Dropper: executable file that when ran "drops" a virus and has the capability
to create or run a virus and infect the user's system when it is executed. When a
dropper file is scanned, the scan may not detect it as a true virus because the
viral code has not yet been created. Heuristics scanning often detects dropper
before regular scanning
6. Joke Programs: change or interrupt the normal behavior of your computer,
creating a general distraction or nuisance
7. Spyware: is a generic term for a class of software designed to either gather
information for marketing purposes or to deliver activities to web pages
8. Adware: type of program that displays an advertisement of some sort, usually
related to a specific web site cached in the web browser
9. Dialers: contains adult content
10. Hack Tools: keystroke loggers; used by a hacker to gain unauthorized access to
your computer
11. Remote Access: programs that allow another computer to gain information or to
attack or alter your computer, usually over the internet. Remote access programs
detected in virus scans maybe recognizable commercial software which are brought
to user's attention during scan
12. Security Risks: threats which do not conform as a trojan, virus, spyware, etc.

THE EH CALL FLOW

- Greeting
- Customer gives out the Problem
- Paraphrasing
- Reassurance
- Gather information
- Probing (POCE)
- Resolve
- Closing Script

CUSTOMER EDUCATION
* Use WSC
What is the Issue?
Steps taken to resolve the Issue
Consent of the Customer

CLF (Closed Loop Feedback)

- process of identifying and giving feedback about the types of issues customers
are calling for
- has a document ID: YrMoDayHrMinSecLang

CMS (Content Management System)

- the right tool used to get CLFs

Case Tagging
- to be able to retrieve an information from a customer
- to properly sort out the different cases so that it will properly be addressed

* Case Tagging Essential Horizon

1. Closed
a. Resolved: resolved issues; mostly technical and not refunding issues
b. Placed a CD Replacement: given a CD to replace a downloadable product because
of a slow connection or for customer satisfaction like customer has a broken CD
c. Retail Refund: customer bought a product from a retail store and wants a
refund; support would ask the customer to fill out a retail refund form @
norton.com/returns
d. Symantec Store Refund: refunds for the order placed @ symantecstore.com
e. Subscription Refund: subscription purchased by the customer is refunded
f. Other Refunds: other refunds; refund for premium services charged or if a
customer calls for refund of processing fees, etc.

2. Pending
a. Solution Given: solution is given but the resolution is not yet confirmed on
the call and the troubleshooting has to be kept pending due to some reasons; e.g.
when a customer is not willing to stay on the line and says he will call us back
* Note: Customer will be able to receive an email within 24-48hours
b. Pending Email Sent: to be used when the issue is not resolved on the call and
an email with resolution is sent to the customer. This might be because the
customer is only asking for steps in an email with the document link or the steps
for resolution
c. Pending Single Phone Line: have a dial up connection with a single phone line
and resolution cannot be completed on call because of this
d. Fax Expected: customer's purchase details are not found in our order tools like
DRCC or NITRO and we request the customer to fax us those details
e. Pending Callback Attempt 1,2,3: you called back the customer but the line is
busy, no one is answering or you reached an answering machine; 24,48,72hours
respectively

3. Transfer
a. Internal EH: customer's concern is not part of our support; e.g. not using
windows OS, norton system works product
b. Supervisor/Symantec Case Manager
c. Elite Team
d. CR
e. Only available for Symantec

4. Non Polled
* Note: before tagging a case as non polled, you should ask an SME or TL; non
polled is when a customer will not receive any surveys
a. SPS FE: customer wants to go for the premium services such as expert install
but has not paid yet
b. SPS BE: customer wants to avail of the paid services
c. Enterprise Product: enterprise software (products which starts with Symantec)
* To tag a case as Non Polled enterprise the following requirements must be met:
- ask the correct name and version of the enterprise product
- ask the number he dialed to contact support
- provide the correct number: 18003420652 ext 2
- enterprise support availability: Mondays to Fridays from 7am to 6pm EST
- refer customer to enterprise department
d. Referred to ISP: norton product is already removed but customer still cannot
connect to the internet or cannot send or receive mails
e. Referred to Vendor: norton product is uninstalled but there is problem with the
hardware or software
f. Call Disconnect: customer disconnected the call; tell the SME because they/you
need to call back the customer within 15mins
g. Other Scenarios
- calling to get another number for support
- resolve virus removal issue and does not want to pay
h. Transfer to VSS: transfer virus removal services and customer will pay
i. No Permission to Poll: customer does not want to receive any surveys

* Case Tagging for Visa Queue

1. Closed
a. Enquiry
- when a customer wants to know in detail about the charge for autorenewal
appearing on the credit card
- when the days are not reflecting on the software so we need to sync
- customer wants to know or change the billing profile
- customer calls since he is informed that the autorenewal refund will be credited
back in __ number of days but he did not get the money that was supposed to be
credited in his account
- customer wants to know about the products registered on his norton account
- customer has purchased a new upgrade version and also received a prebilling
notification of autorenewal for the old norton product, calls to know whether he
could cancel the autorenewal feature to avoid change (not yet charged for
autorenewal)
- any other scenarios where the customer wants some information
b. Retail Refund: customer bought a product from a retail store and wants a
refund; support would ask the customer to fill out a retail refund form @
norton.com/returns
c. Symantec Store Refund: refunds for the order placed @ symantec store
d. Other Refunds: : other refunds; refund for premium services charged or if a
customer calls for refund of processing fees, etc.
e. Subscription Refund
- customer insisting on getting a refund
- not satisfied by the autorenewal feature or not satisfied with the
product/support and wants a refund for autorenewal
- customer company pays for the antivirus subscription so wants a refund for
autorenewal
- refund is processed for autorenewal and the customer is no longer using norton
f. Retained Resolved
- calling for a refund and agent was able to convince to stay with norton
- upgraded the norton software and was charged for autorenewal of his old product,
agent was able to convince the customer and full refund is not processed
- manually renewed but charged for autorenewal, agent was able to convince the
customer to keep the subscription and full refund was not processed
- uses a norton software and not using the one that he was charged for
autorenewal, agent was able to convince the customer to adjust the number of days
g. Retained - No Longer Using the Product
- refund as he is using a 3rd party software
- customer is using ISP software but still has norton subscription left with hum;
has been charged for renewal and he was convinced to use the norton product again
- no security software but has norton subscription left

*Note: Other case tagging is same with EH

NORTON PRODUCTS
1. FULL SUPPORT
a. Norton AntiVirus 2004 and above
b. Norton Internet Security 2004 and above
c. Norton 360
d. Norton 360 Premier
e. Norton Online Back Up
f. Norton Online Family
g. Norton Utilities Premier
2. PARTIAL SUPPORT - Customer Service (transferred to other departments if for
technical support)
a. Norton System Works Premier
b. Norton Save and Restore
c. Norton Utilities
3. TRANSFER TO OTHER DEPARTMENTS
a. Norton System Works Standard
b. Norton Save and Restore
c. Norton Ghost
d. Norton GoBack
e.Norton Partition Magic
f. Norton PC Anywhere
g. Norton Mobile Security
h. Norton for Mac
i. Norton Utilities
4. NO LONGER in the MARKER - SEMI SUPPORT (renewal and upgrades only)
a. Norton AntiVirus 2003 and below
b. Norton Internet Security 2003 and below
c. Norton AntiBot
d. Norton AntiSpam
e. Norton Personal Firewall
f. Norton Confidential
g. Norton Password Manager
h. Norton System Works Basic

SUBSCRIPTION
- something that you have to pay for so that you can avail of the latest virus
definition and updates (live update)
* CD: from a retail store or symantec store; 1 year subscription; can be renewed
or upgraded
* Download: from a reseller (Winferno, Amazon, Dell) or symantec store; 1-3years
subscription
* Trialware: 15 or 30days subscription (30days subscription will ask for the
credit card number and automatically charges the customer after 30days)
* OEM: preinstalled in newly purchased computers; 60-180days subscription; comes
with limited (cannot be renewed) and prepaid (renewable)
* Symantec Online Service: provided by ISP; depends on how long the customer will
subscribe to ISP
* Configure to Order: depends on how long they paid for; expensive

NORTON ANTIVIRUS 2003-2007

* Anti virus: protects computer from threats
* Features:
a. Traditional: depends on virus definitions
b. Heuristics: depends on changes in the behavior
* Internet Worm Protection
- works like a firewall but is not a firewall; more considerate
* Email Scan
- does not work on web based emails (yahoo mail, gmail, etc.) -- protected by
phishing protection and autoprotect
- works on client based emails (windows mail, outlook express, etc.)
- Single Mail Transfer Protocol: Port # 25; Post Office Protocol 3: Port # 110
* Intrusion Prevention
- checks on hackers through certain behavioral traits; false positive
identification will be reviewed by symantec

NORTON ANTIVIRUS 2008

* Network Security Map
- views the status of Norton on another computer within a network
- works when you have multiple computers installed with norton products and you
can see on each computers the status of the Norton product
* One Click Support
- pop out window that will know the problem and will run the hot fix tool to fix
it right away
- if problem is not fixed, it will tell you to contact chat, email or voice
support

NORTON INTERNET SECURITY

2003-2006
- Two Way Firewall: keeps intruders out and sensitive information in
- embedded Parental Control, Norton Password Manager, Norton AntiSpam
2007
- Norton Confidential: comes with Norton Password Manager, AutoFill feature,
credit card information, phishing protection
2007 - 2008
- AntiSpam is given as an add on pack
2009
- AntiSpam is embedded again because of the new Brightmail technology which fixed
all issues on the previous antispam feature
- Parental Control and Privacy Control were offered as add ons
2008 - 2010
- Confidential Information Management/ Identity Safe Protection
2009 - 2010
- SafeWeb
* Network Security Map: same with the antivirus but it is connected to a firewall
so you can tag the PC: full trust, protected, shared or restricted

NORTON SYSTEM WORKS

a. Basic: basic tune up services (deleting windows and internet temp files, disk
optimization)
b. Standard: with antivirus
c. Premier: with antivirus and save&restore

NORTON SAVE and RESTORE

- creates back up of your files (pictures, music and videos)
- saved on another partition, CD/DVD, USB
- files will be minimized and encrypted

NORTON GHOST
- creates a virtual copy of your hard disk

NORTON GoBACK
- works like system restore
- note: do not uninstall if it is still enabled or the computer will crash

NORTON ONLINE BACK UP

- creates a back up online
- 5GB for trial and 25GB for purchased
- if product expired, recover the files within 30days
- additional memory can be purchased (5GB - 29.99, 10GB - 49.99, 25GB - 69.99)

NORTON UTILITIES
- upgrade of the norton system works
- Norton Utilities Premier: plus Norton Online BackUp
- Start Up Manager

NORTON ANTIBOT
- heuristics based

NORTON 360
* almost all features are present
* with backup set: records computer name and the formula that reads the back up
(0,1,multiple backups)
* Norton 360 comes with free 2GB online back up storage; 360 Premier has 25GB
online back up storage

Rules:
- No home and home office products are compatible with windows xp 32bit
- 32 bit OS will support 32bit and 64bit apps, while 64bit OS will only support
64bit apps

Over and Under Install

a. Allow: a newer version over an old version or an upgrade version of the product
(e.g. NIS 07 over NAV 07)
b. Soft Block: a new version/product will be replaced by an old version/product
c. Hard Block: over installation will not proceed; e.g. other products cannot over
install norton360
d. Add Remove Program link: a new product over another product

Important!
1. Activation
- Product Key
2005 and below
a. CD: 24 characters alphanumeric CAPS
b. DL: 26 characters alphanumeric U&L case
2006 - 2010
a. CD and DL: 25 characters alphanumeric CAPS
NAV PK: V, NIS PK: J, N360 PK: T
* product key can be used for newer versions free of charge
2. Subscription and Renewal
2005 and below
a. Manual Renewal: add and deduct
b. Subscription Key: given by agent, different every month
2006 - 2010
a. Manual Renewal: add and revoke (product key cannot be used anymore with
zero subscription days)
b. Renewal Code: 19 characters alphanumeric CAPS
3. Account ID
2005 and below
- 9-11 numeric characters
2006-2008
- serial no.: 12 characters alphanumeric CAPS (check on help and support
button -- about)
4. Live Update
2005 - 2008
- can be ran manually through user interface or type the run command line:
Luall.exe
 - Mode: automatic or manual
- in the add/remove programs, you can see the name of the product and a
different program for the live update (product engine and live update engine)
- update starts 4hours after the computer booted up
- 2005 v2.5, 2006 v2.7, 2007 v3.1/3.2, 2008 v3.4
2009 - 2010
- only has the product engine (live update engine is integrated)
- in the add/remove programs, you can only see the name of the product
- manual update can be done only through the user interface
- Mode: standalone or integrated
- updates every 5minutes and downloads files by chunks
- lightning scan feature: scans only for a particular virus definition
5. Installation
2005 - 2008
- dependent on the Microsoft Installer
- runs for 8-12mins
2009 - 2010
- Distribution and Installation Next Generation
- not dependent on MSI
- 1min to install/uninstall and 2min to upgrade