AntiSpyware Enterprise Module Beta 2

Transcription

1 AntiSpyware Enterprise Module Beta 2 Product Guide About the AntiSpyware Enterprise Module The McAfee AntiSpyware Enterprise Module 8.7 is an add-on to the VirusScan Enterprise 8.7i product that extends its ability to detect and take action on potentially unwanted spyware and cookies. Where can I get the module? AntiSpyware Enterprise Module 8.7 is available from the product CD or the McAfee download website at: How does the module work? The module uses the VirusScan Enterprise on-access scanner, ondemand scanner, and unwanted programs policy with the scanning engine and detection definition (DAT) file to protect you from potentially unwanted spyware-related files, registry entries, and cookies in the cookies folder. Contents About the AntiSpyware Enterprise Module 1 Pre-installation information 2 Installing the AntiSpyware Enterprise Module 2 Configuring the AntiSpyware Enterprise Module 5 Viewing scan results 7 Removing the AntiSpyware Enterprise Module 8 Submitting samples to McAfee Avert Labs 8 Resources 9 Icon Conventions Caution Tip When detections occur, the action taken depends on which component detected the threat, what you configured, and what is defined in the DAT file. For example, if the scanner action is set to clean but the detected item cannot be cleaned because there is no cleaner or it is damaged beyond repair, the DAT file might delete the item even though you set the action to clean. For security purposes, deleting the file is the safest way to protect your environment. Component On-Access Scanner On-Demand Scanner Unwanted Programs Policy The on-access scanner provides the primary protection by detecting items as they are accessed. Enable unwanted program detection and configure primary and secondary actions The action taken depends on the type of detection: Clean files automatically. The action depends on what is detected: Cookies The detected cookie is cleaned. Files and registry items If the file or registry item cannot be cleaned, the DAT file may take an alternative action. This can include killing processes, removing injected.dll files, deleting files, and/or deleting registry keys. In most cases with spyware, the user will only notice that files have been deleted as that action is the most visible. Delete files automatically. The detected item is deleted. The on-demand scanner detects cookies and spyware-related registry entries that were not previously cleaned. Enable unwanted program detection and configure primary and secondary actions. The action taken depends on the type of detection: Clean files. The action depends on what is detected: Cookies The detected cookie is cleaned. Registry items If the registry item cannot be cleaned, the DAT file may take an alternative action. This can include cleaning or deleting registry values or keys. Delete files. The detected file, registry item, or entire cookie is deleted. s and Tips All other actions are treated as Continue scanning. Specify additions or exclusions to the list of detection items: User-defined detections Items that are not being detected by the current DAT file. Exclusions Items that you legitimately use or do not want to detect. When items are cleaned or deleted, they are backed up to the quarantine directory and can be restored using the Quarantine Manager Policy. 1

2 Pre-installation information Take these actions before you start the installation process. 1 Verify that your computer meets these requirements: A server or workstation that meets the system requirements as detailed in the VirusScan Enterprise 8.7i Installation Guide. A server or workstation with an installed, licensed version of VirusScan Enterprise 8.7i. Caution This release of AntiSpyware Enterprise Module 8.7 does not work with earlier versions of VirusScan Enterprise. 2 Review the product Release s (Readme.txt) for: Special requirements Known issues Last minute additions or changes 3 Get the installation files: a Retrieve the AntiSpyware Enterprise Module 8.7.ZIP file from the product CD or the McAfee download website at: b Extract the files from the product.zip file to a temporary location on the hard drive. The product.zip file includes these files: MAS870DET.MCS PACKING.LST PKGCATALOG.Z VSE87MAS.EXE VSEMAS870 EXTENSION README.HTML (A file for each language) Installing the AntiSpyware Enterprise Module When you install the module, it adds anti-spyware protection to VirusScan Enterprise. The module installation process automatically changes some of the VirusScan Enterprise 8.7i configuration settings to ensure that you receive the full benefit of the module s capabilities: Unwanted Programs Policy: The categories on the Detection tab in the Unwanted Programs Policy are selected differently based on these scenarios: If no categories were previously selected, all categories are automatically selected. If some or all categories were previously selected, no change is made. On-Access Scan Properties: Scan cookie files appears and is enabled on the General tab. Detect unwanted programs is enabled on the Unwanted Programs tab, if it was not already enabled. On-Demand Scan Properties: Detect unwanted programs is enabled on the Unwanted Programs tab, if it was not already enabled. The default Full Scan task includes two new Registry and Cookies scan items: The Registry and Cookies scan items are added to every existing and every new on-demand scan task. A new Targeted Scan task has been added to the VirusScan Console. The default task includes Registry and Cookies scan items. It can be configured to meet your requirements. This new task is not available in epolicy Orchestrator. If you are installing the module from the command line or using an installation package that you created with McAfee Installation Designer, you can add the /NC option to prevent automatic changes to VirusScan Enterprise 8.7i configuration settings. This guide describes these installation methods: Setup Utility on page 3. Windows Command Line on page 3. epolicy Orchestrator on page 4. McAfee Installation Designer on page 4 2

3 Method Setup Utility Windows Command Line To add the module to the VirusScan Enterprise product using the Setup utility: 1 From the temporary folder where you extracted the installation files, double-click VSE85MAS.EXE. 2 Click Next, then click Finish when the installation completes. 3 After installation, view the VirusScan Enterprise About dialog box to confirm it displays VirusScan Enterprise + Add-on Module(s). s and Tips If you do not want to change the configuration settings as a result of installation, use one of the other installation methods. To add the module to the VirusScan Enterprise product from the command line: 1 Select Start Run to open the Windows command-line component. 2 Browse to the temporary folder where you extracted the files, then type the command line to install the module. Use these command-line options to customize the installation: /LOGFILE filename Records installation activity in the specified file. /SILENT Run the setup utility in silent mode. /REBOOT Restart the computer if required. Use the =F option to force a restart, the =R option to prevent a restart, and the =A option to always restart. /PROMPT Display the prompt dialog box before restarting the computer. /NC Prevent the VirusScan Enterprise configuration settings from automatically changing when the module is installed. /E Extract the product installation files to the location you specify. DIR The path, directory, or folder where you want to place the extracted installation files. For example, to install the module silently: VSE87MAS [[/LOGFILE filename][/silent][/reboot][/prompt][/e DIR]] For example, to install the module silently without changing any existing configuration settings: VSE87MAS [[/LOGFILE filename][/silent][/reboot][/prompt][/nc][/e DIR]] 3 After installation, view the VirusScan Enterprise About dialog box to confirm it displays VirusScan Enterprise + Add-on Module(s). s and Tips For more information about using command-line options for installation, see the VirusScan Enterprise Installation Guide. 3

4 Method epolicy Orchestrator McAfee Installation Designer To place the module under epolicy Orchestrator management and deploy it to client computers: 1 Add the PkgCatalog.z file to the repository: a From the epolicy Orchestrator console, select Repository then select Check in package in the details pane. b Click Next to continue. c Select Products or updates, then click Next. d Specify the path to the module PkgCatalog.z file, or click Browse to locate and select it. If you used McAfee Installation Designer to create an installation package, you can select it at this time. e Click Next, then click Finish to check the package in. 2 Add the VSEMAS870 extension file to the repository: a From the epolicy Orchestrator console, select Repository then select Check in NAP in the details pane. b Click Next to continue. c Select Add new software to be managed, then click Next. d From the Select a Software Package dialog box, locate the VSEMAS870 extension file, then select it and click Open. 3 Confirm that McAfee Anti-Spyware Enterprise Module has been added to the Managed Products in the Repository. 4 Use the deployment task to install the product on client computers. s and Tips If you do not want to change the configuration settings when you install the product on client computers, use McAfee Installation Designer to create an installation package using the /NC command-line option. See Windows Command Line on page 3 for information about using this option. For more information about using epolicy Orchestrator, see the product documentation. To use McAfee Installation Designer to create an installation package, then deploy it: 1 From McAfee Installation Designer, configure the installation package to include the AntiSpyware Enterprise Module and any other products you want to include. 2 Deploy the installation package from epolicy Orchestrator or using the tool of your choice. 3 After installation, view the VirusScan Enterprise About dialog box to confirm it displays VirusScan Enterprise + Add-on Module(s). s and Tips If you do not want to change the configuration settings as a result of installation, use the /NC command-line option when creating the installation package. See Windows Command Line on page 3 for information about using this option. If the installation package includes both VirusScan Enterprise and the AntiSpyware Enterprise Module, the module installs after VirusScan Enterprise. For more information about using McAfee Installation Designer, see the product documentation. 4

5 Configuring the AntiSpyware Enterprise Module This guide describes these configuration methods: From the VirusScan Console. From the epolicy Orchestrator console on page 6. From the VirusScan Console Update DAT files, configure unwanted programs policy and the on-access scanner, then create and/or configure on-demand scan tasks.. Update the DAT file Perform an update task immediately after installing the module to ensure that you have the most current spyware and cookie definitions. From the VirusScan Console, right-click AutoUpdate, then click Start. Unwanted programs policy Specify exclusions or user-defined detections. You must specify the exact detection name; do not use the file name, the registry key, or the cookie. From the VirusScan Console, open the Unwanted Programs Policy dialog box. 1 On the Detection tab: a b Under Detection from DATs, review the category selections and make changes as required. Click Exclusions to specify items that you do not want to detect. Exclusions can be specified for files, registry keys/ values, or cookies. Type the exact detection name or click Browse to locate and select it, then click OK. You can find the exact detection name by looking in the Detected as section of the log file. Repeat this step for each exclusion you want to add. 2 On the User-Defined Detection tab, specify files that are not included in the current DAT file. User-defined detections apply only to files; they do not apply to registry keys/values, or cookies. a Click Add. Type the exact detection name. Type the description that you want to appear in the notification, then click OK. Repeat this step for each user-defined detection you want to add. On-access scanner From the VirusScan Console, open the On-Access Scan Properties dialog box. 1 On the General tab, confirm that Scan cookie files is selected. 2 Select All Processes in the left pane. 3 On the Unwanted Programs tab: a Confirm that Detect unwanted programs is selected. b Review the actions on the Unwanted Programs tab to ensure they meet your needs. See How does the module work? on page 1 for information about how actions are applied. On-demand scan tasks From the VirusScan Console, open the On-Demand Scan Properties dialog box. 1 On the Unwanted Programs tab: a Confirm that Detect unwanted programs is selected. b Review the actions on the Unwanted Programs tab to ensure they meet your needs. See How does the module work? on page 1 for information about how actions are applied. 2 On the Where tab, create and/or configure a Registry or Cookies scan. a To add a scan item, click Add, then select Registry or Cookies from the drop-down list. You can specify unwanted program detection to be the same for all processes or individually for default, low-risk, and/or high-risk processes. The Registry or Cookies scan item is already added to the task if you installed the module by a method that changed the configuration settings. Create and configure as many scan tasks as necessary. These task settings do not apply to registry and cookie scans: The Heuristics options on the Advanced tab. The options on the Actions tab. 5

6 From the epolicy Orchestrator console Configure the module from the VirusScan Enterprise 8.7i policy pages because the module is an add-on to VirusScan Enterprise. Update DAT files, configure policies for unwanted programs detection and on-access scanning, then create and/or configure on-demand scan tasks. Update the DAT file Perform an update task to ensure that you have the most current spyware and cookie definitions. 1 From the epolicy Orchestrator console, select the Task tab in the details pane. 2 Configure an update task to update the DAT file and run immediately. Unwanted programs policy Specify exclusions or user-defined detections. You must specify the exact detection name; do not use the file name, the registry key, or the cookie. From the epolicy Orchestrator console, select the Policies tab in the details pane, then expand the VirusScan Enterprise policies: 1 Select Unwanted Program Policies. 2 In Settings for, select Workstation (default) or Server from the dropdown list. 3 On the Detection tab: b c Under Detection from DATs, review the category selections and make changes as required. Click Exclusions to specify items that you do not want to detect. Exclusions can be specified for files, registry keys/ values, or cookies. Type the exact detection name, then click OK. You can find the exact detection name by looking in the Detected as section of the log file. Repeat this step for each exclusion you want to add. 4 On the User-Defined Detections tab, specify files to detect that are not included in the current DAT file. User-defined detections apply only to files. They cannot be specified for registry keys/ values, or cookies. b Click Add. Type the exact detection name. Type the description that you want to appear in the notification, then click OK. Repeat this step for each user-defined detection you want to add. 5 Repeat this procedure to configure settings for the workstation or the server. On-access scanner policies From the epolicy Orchestrator console, select the Policies tab in the details pane, then expand the VirusScan Enterprise policies: 1 Select On-Access Default Processes Policies, On-Access Low-Risk Processes Policies, or On-Access High-Risk Processes Policies 2 In Settings for, select Workstation (default) or Server from the dropdown list. 3 On the Unwanted Programs tab: b Confirm that Detect unwanted programs is selected. c Review the actions on the Unwanted Programs tab to ensure they meet your needs. See How does the module work? on page 1 for information about how actions are applied. 4 Repeat this procedure to configure settings for the workstation or the server and for default, low-risk, and high-risk processes. On-demand scan tasks To create a new task: 1 From the epolicy Orchestrator console, right-click Directory or the desired site, group, or computer, then click Schedule Task. 1 Type the New Task Name for the scan task. 2 Select VirusScan Enterprise 8.7 On-Demand Scan from the Software Task Type list, then click OK to create the task. To configure a task: 1 From the epolicy Orchestrator console, select the Task tab in the details pane. 2 Right-click the task and select Edit Task to open the epolicy Orchestrator Scheduler dialog box. 3 Click Settings. 4 On the Unwanted Programs tab: b Confirm that Detect unwanted programs is selected. c Review the actions on the Unwanted Programs tab to ensure they meet your needs. See How does the module work? on page 1 for information about how actions are applied. 5 On the Where tab: b To add a scan item, click Add, then select Registry or Cookies from the drop-down list. If you are configuring a new task, the Registry and Cookies scan items are already added to the task. Create and configure as many scan tasks as necessary. These task settings do not apply to registry and cookie scans: The Heuristics options on the Advanced tab. The options on the Actions tab. 6

7 Viewing scan results View scan results from VirusScan Enterprise or epolicy Orchestrator. Information Source VirusScan Enterprise epolicy Orchestrator On-Access Scanner View detection results in: The On-Access Scan Messages dialog box. The On-Access Scan Statistics dialog summary. The activity log. On-Demand Scan Tasks View detection results in: The On-Demand Scan Progress dialog box while the scan is in progress. The On-Demand Scan Statistics dialog summary. The activity log. Reports The results of scans performed by the AntiSpyware Enterprise Module are available in the epolicy Orchestrator reports under Anti-Virus VirusScan Enterprise. The module is an add-on to VirusScan Enterprise, so VirusScan Enterprise collects and reports the data. Use the Coverage reports to see how many computers have the AntiSpyware Enterprise Module installed. Use the VirusScan Enterprise reports, such as the Top 10 Unwanted Programs and the various Unwanted Program Detections reports to view detection information. Filtering reports In addition to using standard reports, you can filter report results to exclude cookies or include specific types of threats. Some filter examples follow. Filter out cookie detections: Data Filter Tab = Detection Condition = Not Starting With Term/Variable = Cookie Filter out all detections except Adware: Data Filter Tab = Type Condition = Equal to Term/Variable = Adware Filter out all detections except Adware and Remote Admin tools: Data Filter Tab = Type Condition = Equal to Term/Variable = Adware Term/Variable = Remote Admin s and Tips Some filter terms are case sensitive; for example Cookie. The Unwanted Program Detections reports do not display virus activity even if you filter on it. 7

8 Removing the AntiSpyware Enterprise Module Use one of these methods to remove the AntiSpyware Enterprise Module. Removal Method Windows Add or Remove Programs epolicy Orchestrator Use the Windows Add or Remove Programs utility to remove the AntiSpyware Enterprise Module. Use the deployment task to remove the AntiSpyware Enterprise Module. Caution Do not use the VirusScan Enterprise Repair Installation feature to remove the AntiSpyware Enterprise Module. Using this feature may not remove all of the necessary files. You must use one of the methods described here. Submitting samples to McAfee Avert Labs If you find a spyware application or cookie that is not being detected with the current DAT file, you can submit a sample of it to McAfee Avert Labs through WebImmune. The sample is analyzed and considered for inclusion in the DAT file. If the module detects something that you think it should not detect, you can also submit a sample of it to McAfee Avert Labs through WebImmune. The sample is analyzed and considered for exclusion from the DAT file. To submit a sample: Method to submit WebImmune Standard Mail This is the preferred method to submit samples because it provides the fastest turnaround time on sample reviews, and provides historical information for all samples that you submitted. By accessing / and creating a free account you can upload files directly to McAfee Avert Labs automated systems for review. If the automated system is unable to determine a threat exists the issue will be escalated to the analysts. Access to get more information about WebImmune. You can send s directly to McAfee Avert Labs automated systems for review. If the automated system is unable to determine a threat exists, the issue will be escalated to analysts. To submit a sample via , send it to the global address at virus_research@avertlabs.com, or get additional regional addresses from the WebImmune website. This is the least preferred method. Submitting samples in this way causes the longest turnaround time for review of your sample. 8

9 Resources Getting information What product documentation is available? The product documentation is available in PDF format on the product CD and also on the McAfee download website. AntiSpyware Enterprise Module 8.7 Release s ReadMe. Product information, any known issues, and last minute additions or changes to the product or its documentation. Product Guide This guide. Installation, configuration, and operating procedures. VirusScan Enterprise 8.7i Release s ReadMe. Product information, resolved issues, any known issues, and last minute additions or changes to the product or its documentation. Installation Guide System requirements and instructions for installing and removing the software using the Setup utility and the command line. Product Guide Product introduction and features, detailed instructions for configuring the software, information on deployment, recurring tasks, and operating procedures. Configuration Guide For use with epolicy Orchestrator. Configuring, deploying, and managing VirusScan Enterprise through epolicy Orchestrator. Quick Reference Card Product information that is printed and accompanies the product CD. epolicy Orchestrator or 4.0 Release s ReadMe. Product information, resolved issues, any known issues, and last minute additions or changes to the product or its documentation. Product Guide Product introduction and features, detailed instructions for configuring the software, information on deployment, recurring tasks, and operating procedures. McAfee Installation Designer 8.7 Release s ReadMe. Product information, resolved issues, any known issues, and last minute additions or changes to the product or its documentation. Product Guide Product introduction and features, detailed instructions for configuring the software, information on deployment, recurring tasks, and operating procedures. How do I contact technical support? By phone For a list of current product support phone numbers: From the web Log on to the SecurityCenter website with your user name and password. Click the Help tab, then select Contact Support. Copyright 2006 McAfee, Inc. All Rights Reserved. DBN-001-EN mcafee.com 9