Protecting Windows Network from Malware Infection

Common File Extension for Ransomeware

Ports needed by ePO 4.x and ePO 5.x for communication through a firewall

The following tables display the ports needed by ePO for communication through a firewall:

Bi-directional means that a connection can be initiated from either direction
Inbound means the connection is initiated by a remote system
Outbound means the connection can be initiated by the local system

ePO 4.6.x and 5.x

Port	Default	Description	Traffic Direction
Agent-server communication port	80	TCP port used by the ePO Server service to receive requests from agents.	Inbound connection to the Agent Handler and the ePO server from the McAfee Agent. Inbound connection to the ePO server from the remote Agent Handler.
Agent-server communication secure port (4.5 and later agents only) Software Manager	443	TCP port used by the ePO Server service to receive requests from agents and remote Agent Handlers. TCP port used by the ePO server's Software Manager to connect to McAfee.	Inbound connection to the Agent Handler and the ePO server from the McAfee Agent. Inbound connection to the ePO server from the remote Agent Handler.
Agent wake-up communication port SuperAgent repository port	8081	TCP port used by agents to receive agent wakeup requests from the ePO server or Agent Handler. TCP port used by SuperAgents configured as repositories to receive content from the ePO server during repository replication, and to serve content to client machines.	Inbound connection from the ePO server/Agent Handler to the McAfee Agent. Inbound connection from client machines to SuperAgents configured as repositories.
Agent broadcast communication port	8082	UDP port used by SuperAgents to forward messages from the ePO server/Agent Handler.	Outbound connection from the SuperAgents to other McAfee Agents.
Console-to-application server communication port	8443	TCP port used by the ePO Application Server service to allow web browser UI access.	Inbound connection to the ePO server from ePO Console.
Client-to-server authenticated communication port	8444	Used by the Agent Handler to talk to the ePO server to get required information (like LDAP servers).	Outbound connection from remote Agent Handlers to the ePO server.
SQL server TCP port	1433	TCP port used to communicate with the SQL server. This port is specified or determined automatically during the setup process.	Outbound connection from the ePO server/Agent Handler to the SQL server.
SQL server UDP port	1434	UDP port used to request the TCP port that the SQL instance hosting the ePO database is using.	Outbound connection from the ePO server/Agent Handler to the SQL server.
LDAP server port	389	TCP port used to retrieve LDAP information from Active Directory servers.	Outbound connection from the ePO server/Agent Handler to an LDAP server.
SSL LDAP server port	636	TCP port used to retrieve LDAP information from Active Directory servers.	Outbound connection from the ePO server/Agent Handler to an LDAP server.

ePO (Ports/Traffic Quick Reference)

ePO Server

Default	Protocol	Traffic Direction
80	TCP	Inbound connection to the ePO server
389	TCP	Outbound connection from the ePO server
443	TCP	Inbound/Outbound connection to/from the ePO server
636	TCP	Outbound connection from the ePO server
1433	TCP	Outbound connection from the ePO server
1434	UDP	Outbound connection from the ePO server
8081	TCP	Outbound connection from the ePO server
8443	TCP	Inbound connection to the ePO server
8444	TCP	Inbound connection to the ePO server

Remote Agent Handler(s)

Default Port	Protocol	Traffic Direction
80	TCP	Inbound/Outbound connection to/from the Agent Handler
389	TCP	Outbound connection from the ePO server
443	TCP	Inbound/Outbound connection to/from the Agent Handler
636	TCP	Outbound connection from the ePO server
1433	TCP	Outbound connection from the ePO server
1434	UDP	Outbound connection from the ePO server
8081	TCP	Outbound connection from the ePO server
8443	TCP	Outbound connection from the ePO server
8444	TCP	Outbound connection from the ePO server

McAfee Agent

Default Port	Protocol	Traffic Direction
80	TCP	Outbound connection to the ePO server/Agent Handler
443	TCP	Outbound connection to the ePO server/Agent Handler
8081	TCP	Inbound connection from the ePO server/Agent Handler. If the agent is a SuperAgent repository then inbound connection from other McAfee Agents.
8082	TCP	Inbound connection to Agents. Inbound/Outbound connection from/to SuperAgents

SQL Server

Default Port	Protocol	Traffic Direction
1433	TCP	Inbound connection from the ePO server/Agent Handler
1434	UDP	Inbound connection from the ePO server/Agent Handler

Uninstalling Symantec Endpoint Protection without the uninstall password

First, go ahead and uninstall Symantec Endpoint Protection via the Add/Remove Programs. When the Uninstall password box comes up, right click on your task bar and open “Task Manager”. Go to the processes tab and look for msiexec.exe. There is probably more than one of them – one of them is for the password box. Just go ahead and pick one, and hopefully it will be for the password box (if not just restart the uninstall process). Once you kill the password box, the uninstall will continue as normal.

Of course, one wonders how “secure” the uninstall password really is since it can be “hacked” so easily.