AntiSpywre Enterprise Module 8.5 Product Guide Aout the AntiSpywre Enterprise Module The McAfee AntiSpywre Enterprise Module 8.5 is n dd-on to the VirusScn Enterprise 8.5i product tht extends its ility to detect nd tke ction on potentilly unwnted spywre nd cookies. Where cn I get the module? AntiSpywre Enterprise Module 8.5 is ville from the product CD or the McAfee downlod wesite t: http://www.mcfee.com/us/downlods/ How does the module work? The module uses the VirusScn Enterprise on-ccess scnner, ondemnd scnner, nd unwnted progrms policy with the scnning engine nd detection definition (DAT) file to protect you from potentilly unwnted spywre-relted files, registry entries, nd cookies in the cookies folder. Contents Aout the AntiSpywre Enterprise Module 1 Pre-instlltion informtion 2 Instlling the AntiSpywre Enterprise Module 2 Configuring the AntiSpywre Enterprise Module 5 Viewing scn results 7 Removing the AntiSpywre Enterprise Module 8 Sumitting smples to McAfee Avert Ls 8 Resources 9 Icon Conventions Cution Tip When detections occur, the ction tken depends on which component detected the thret, wht you configured, nd wht is defined in the DAT file. For exmple, if the scnner ction is set to clen ut the detected item cnnot e clened ecuse there is no clener or it is dmged eyond repir, the DAT file might delete the item even though you set the ction to clen. For security purposes, deleting the file is the sfest wy to protect your environment. Component On-Access Scnner On-Demnd Scnner Unwnted Progrms Policy The on-ccess scnner provides the primry protection y detecting items s they re ccessed. Enle unwnted progrm detection nd configure primry nd secondry ctions The ction tken depends on the type of detection: Clen files utomticlly. The ction depends on wht is detected: Cookies The detected cookie is clened. Files nd registry items If the file or registry item cnnot e clened, the DAT file my tke n lterntive ction. This cn include killing processes, removing injected.dll files, deleting files, nd/or deleting registry keys. In most cses with spywre, the user will only notice tht files hve een deleted s tht ction is the most visile. Delete files utomticlly. The detected item is deleted. The on-demnd scnner detects cookies nd spywre-relted registry entries tht were not previously clened. Enle unwnted progrm detection nd configure primry nd secondry ctions. The ction tken depends on the type of detection: Clen files. The ction depends on wht is detected: Cookies The detected cookie is clened. Registry items If the registry item cnnot e clened, the DAT file my tke n lterntive ction. This cn include clening or deleting registry vlues or keys. Delete files. The detected file, registry item, or entire cookie is deleted. s nd Tips All other ctions re treted s Continue scnning. Specify dditions or exclusions to the list of detection items: User-defined detections Items tht re not eing detected y the current DAT file. Exclusions Items tht you legitimtely use or do not wnt to detect. When items re clened or deleted, they re cked up to the qurntine directory nd cn e restored using the Qurntine Mnger Policy. 1
Pre-instlltion informtion Tke these ctions efore you strt the instlltion process. 1 Verify tht your computer meets these requirements: A server or worksttion tht meets the system requirements s detiled in the VirusScn Enterprise 8.5i Instlltion Guide. A server or worksttion with n instlled, licensed version of VirusScn Enterprise 8.5i. Cution This relese of AntiSpywre Enterprise Module 8.5 does not work with erlier versions of VirusScn Enterprise. 2 Review the product Relese s (Redme.txt) for: Specil requirements Known issues Lst minute dditions or chnges 3 Get the instlltion files: Retrieve the AntiSpywre Enterprise Module 8.5.ZIP file from the product CD or the McAfee downlod wesite t: http://www.mcfee.com/us/downlods/ Extrct the files from the product.zip file to temporry loction on the hrd drive. The product.zip file includes these files: MAS850DET.MCS PACKING.LST PKGCATALOG.Z VSE85MAS.EXE VSEMAS850.NAP README.TXT (A file for ech lnguge) Instlling the AntiSpywre Enterprise Module When you instll the module, it dds nti-spywre protection to VirusScn Enterprise. The module instlltion process utomticlly chnges some of the VirusScn Enterprise 8.5i configurtion settings to ensure tht you receive the full enefit of the module s cpilities: Unwnted Progrms Policy: The ctegories on the Detection t in the Unwnted Progrms Policy re selected differently sed on these scenrios: If no ctegories were previously selected, ll ctegories re utomticlly selected. If some or ll ctegories were previously selected, no chnge is mde. On-Access Scn Properties: Scn cookie files ppers nd is enled on the Generl t. Detect unwnted progrms is enled on the Unwnted Progrms t, if it ws not lredy enled. On-Demnd Scn Properties: Detect unwnted progrms is enled on the Unwnted Progrms t, if it ws not lredy enled. The defult Full Scn tsk includes two new Registry nd Cookies scn items: The Registry nd Cookies scn items re dded to every existing nd every new on-demnd scn tsk. A new Trgeted Scn tsk hs een dded to the VirusScn Console. The defult tsk includes Registry nd Cookies scn items. It cn e configured to meet your requirements. This new tsk is not ville in epolicy Orchestrtor. If you re instlling the module from the commnd line or using n instlltion pckge tht you creted with McAfee Instlltion Designer, you cn dd the /NC option to prevent utomtic chnges to VirusScn Enterprise 8.5i configurtion settings. This guide descries these instlltion methods: Setup Utility on pge 3. Windows Commnd Line on pge 3. epolicy Orchestrtor on pge 4. McAfee Instlltion Designer on pge 4 2
Method Setup Utility Windows Commnd Line To dd the module to the VirusScn Enterprise product using the Setup utility: 1 From the temporry folder where you extrcted the instlltion files, doule-click VSE85MAS.EXE. 2 Click Next, then click Finish when the instlltion completes. 3 After instlltion, view the VirusScn Enterprise Aout dilog ox to confirm it displys VirusScn Enterprise + AntiSpywre Enterprise 8.5.0i. s nd Tips If you do not wnt to chnge the configurtion settings s result of instlltion, use one of the other instlltion methods. To dd the module to the VirusScn Enterprise product from the commnd line: 1 Select Strt Run to open the Windows commnd-line component. 2 Browse to the temporry folder where you extrcted the files, then type the commnd line to instll the module. Use these commnd-line options to customize the instlltion: /LOGFILE filenme Records instlltion ctivity in the specified file. /SILENT Run the setup utility in silent mode. /REBOOT Restrt the computer if required. Use the =F option to force restrt, the =R option to prevent restrt, nd the =A option to lwys restrt. /PROMPT Disply the prompt dilog ox efore restrting the computer. /NC Prevent the VirusScn Enterprise configurtion settings from utomticlly chnging when the module is instlled. /E Extrct the product instlltion files to the loction you specify. DIR The pth, directory, or folder where you wnt to plce the extrcted instlltion files. For exmple, to instll the module silently: VSE85MAS [[/LOGFILE filenme][/silent][/reboot][/prompt][/e DIR]] For exmple, to instll the module silently without chnging ny existing configurtion settings: VSE85MAS [[/LOGFILE filenme][/silent][/reboot][/prompt][/nc][/e DIR]] 3 After instlltion, view the VirusScn Enterprise Aout dilog ox to confirm it displys VirusScn Enterprise + AntiSpywre Enterprise 8.5.0i. s nd Tips For more informtion out using commnd-line options for instlltion, see the VirusScn Enterprise Instlltion Guide. 3
Method epolicy Orchestrtor McAfee Instlltion Designer To plce the module under epolicy Orchestrtor mngement nd deploy it to client computers: 1 Add the PkgCtlog.z file to the repository: From the epolicy Orchestrtor console, select Repository then select Check in pckge in the detils pne. Click Next to continue. c Select Products or updtes, then click Next. d Specify the pth to the module PkgCtlog.z file, or click Browse to locte nd select it. If you used McAfee Instlltion Designer to crete n instlltion pckge, you cn select it t this time. e Click Next, then click Finish to check the pckge in. 2 Add the VSEMAS850.NAP file to the repository: From the epolicy Orchestrtor console, select Repository then select Check in NAP in the detils pne. Click Next to continue. c Select Add new softwre to e mnged, then click Next. d From the Select Softwre Pckge dilog ox, locte the VSE850.NAP file, then select it nd click Open. 3 Confirm tht McAfee Anti-Spywre Enterprise Module 8.5.0 hs een dded to the Mnged Products in the Repository. 4 Use the deployment tsk to instll the product on client computers. s nd Tips If you do not wnt to chnge the configurtion settings when you instll the product on client computers, use McAfee Instlltion Designer to crete n instlltion pckge using the /NC commnd-line option. See Windows Commnd Line on pge 3 for informtion out using this option. For more informtion out using epolicy Orchestrtor, see the product documenttion. To use McAfee Instlltion Designer to crete n instlltion pckge, then deploy it: 1 From McAfee Instlltion Designer, configure the instlltion pckge to include the AntiSpywre Enterprise Module nd ny other products you wnt to include. 2 Deploy the instlltion pckge from epolicy Orchestrtor or using the tool of your choice. 3 After instlltion, view the VirusScn Enterprise Aout dilog ox to confirm it displys VirusScn Enterprise + AntiSpywre Enterprise 8.5.0i. s nd Tips If you do not wnt to chnge the configurtion settings s result of instlltion, use the /NC commnd-line option when creting the instlltion pckge. See Windows Commnd Line on pge 3 for informtion out using this option. If the instlltion pckge includes oth VirusScn Enterprise nd the AntiSpywre Enterprise Module, the module instlls fter VirusScn Enterprise. For more informtion out using McAfee Instlltion Designer, see the product documenttion. 4
Configuring the AntiSpywre Enterprise Module This guide descries these configurtion methods: From the VirusScn Console. From the epolicy Orchestrtor console on pge 6. From the VirusScn Console Updte DAT files, configure unwnted progrms policy nd the on-ccess scnner, then crete nd/or configure on-demnd scn tsks.. Updte the DAT file Perform n updte tsk immeditely fter instlling the module to ensure tht you hve the most current spywre nd cookie definitions. From the VirusScn Console, right-click AutoUpdte, then click Strt. Unwnted progrms policy Specify exclusions or user-defined detections. You must specify the exct detection nme; do not use the file nme, the registry key, or the cookie. From the VirusScn Console, open the Unwnted Progrms Policy dilog ox. 1 On the Detection t: Under Detection from DATs, review the ctegory selections nd mke chnges s required. Click Exclusions to specify items tht you do not wnt to detect. Exclusions cn e specified for files, registry keys/ vlues, or cookies. Type the exct detection nme or click Browse to locte nd select it, then click OK. You cn find the exct detection nme y looking in the Detected s section of the log file. Repet this step for ech exclusion you wnt to dd. 2 On the User-Defined Detection t, specify files tht re not included in the current DAT file. User-defined detections pply only to files; they do not pply to registry keys/vlues, or cookies. Click Add. Type the exct detection nme. Type the description tht you wnt to pper in the notifiction, then click OK. Repet this step for ech user-defined detection you wnt to dd. On-ccess scnner From the VirusScn Console, open the On-Access Scn Properties dilog ox. 1 On the Generl t, confirm tht Scn cookie files is selected. 2 Select All Processes in the left pne. 3 On the Unwnted Progrms t: Confirm tht Detect unwnted progrms is selected. Review the ctions on the Unwnted Progrms t to ensure they meet your needs. See How does the module work? on pge 1 for informtion out how ctions re pplied. On-demnd scn tsks From the VirusScn Console, open the On-Demnd Scn Properties dilog ox. 1 On the Unwnted Progrms t: Confirm tht Detect unwnted progrms is selected. Review the ctions on the Unwnted Progrms t to ensure they meet your needs. See How does the module work? on pge 1 for informtion out how ctions re pplied. 2 On the Where t, crete nd/or configure Registry or Cookies scn. To dd scn item, click Add, then select Registry or Cookies from the drop-down list. You cn specify unwnted progrm detection to e the sme for ll processes or individully for defult, low-risk, nd/or high-risk processes. The Registry or Cookies scn item is lredy dded to the tsk if you instlled the module y method tht chnged the configurtion settings. Crete nd configure s mny scn tsks s necessry. These tsk settings do not pply to registry nd cookie scns: The Heuristics options on the Advnced t. The options on the Actions t. 5
From the epolicy Orchestrtor console Configure the module from the VirusScn Enterprise 8.5 policy pges ecuse the module is n dd-on to VirusScn Enterprise. Updte DAT files, configure policies for unwnted progrms detection nd on-ccess scnning, then crete nd/or configure on-demnd scn tsks. Updte the DAT file Perform n updte tsk to ensure tht you hve the most current spywre nd cookie definitions. 1 From the epolicy Orchestrtor console, select the Tsk t in the detils pne. 2 Configure n updte tsk to updte the DAT file nd run immeditely. Unwnted progrms policy Specify exclusions or user-defined detections. You must specify the exct detection nme; do not use the file nme, the registry key, or the cookie. From the epolicy Orchestrtor console, select the Policies t in the detils pne, then expnd the VirusScn Enterprise 8.5.0 policies: 1 Select Unwnted Progrm Policies. 2 In Settings for, select Worksttion (defult) or Server from the dropdown list. 3 On the Detection t: c Deselect Inherit. Under Detection from DATs, review the ctegory selections nd mke chnges s required. Click Exclusions to specify items tht you do not wnt to detect. Exclusions cn e specified for files, registry keys/ vlues, or cookies. Type the exct detection nme, then click OK. You cn find the exct detection nme y looking in the Detected s section of the log file. Repet this step for ech exclusion you wnt to dd. 4 On the User-Defined Detections t, specify files to detect tht re not included in the current DAT file. User-defined detections pply only to files. They cnnot e specified for registry keys/ vlues, or cookies. Deselect Inherit. Click Add. Type the exct detection nme. Type the description tht you wnt to pper in the notifiction, then click OK. Repet this step for ech user-defined detection you wnt to dd. 5 Repet this procedure to configure settings for the worksttion or the server. On-ccess scnner policies From the epolicy Orchestrtor console, select the Policies t in the detils pne, then expnd the VirusScn Enterprise 8.5.0 policies: 1 Select On-Access Defult Processes Policies, On-Access Low-Risk Processes Policies, or On-Access High-Risk Processes Policies 2 In Settings for, select Worksttion (defult) or Server from the dropdown list. 3 On the Unwnted Progrms t: c Deselect Inherit. Confirm tht Detect unwnted progrms is selected. Review the ctions on the Unwnted Progrms t to ensure they meet your needs. See How does the module work? on pge 1 for informtion out how ctions re pplied. 4 Repet this procedure to configure settings for the worksttion or the server nd for defult, low-risk, nd high-risk processes. On-demnd scn tsks To crete new tsk: 1 From the epolicy Orchestrtor console, right-click Directory or the desired site, group, or computer, then click Schedule Tsk. 1 Type the New Tsk Nme for the scn tsk. 2 Select VirusScn Enterprise 8.5 On-Demnd Scn from the Softwre Tsk Type list, then click OK to crete the tsk. To configure tsk: 1 From the epolicy Orchestrtor console, select the Tsk t in the detils pne. 2 Right-click the tsk nd select Edit Tsk to open the epolicy Orchestrtor Scheduler dilog ox. 3 Click Settings. 4 On the Unwnted Progrms t: c Deselect Inherit. Confirm tht Detect unwnted progrms is selected. Review the ctions on the Unwnted Progrms t to ensure they meet your needs. See How does the module work? on pge 1 for informtion out how ctions re pplied. 5 On the Where t: Deselect Inherit. To dd scn item, click Add, then select Registry or Cookies from the drop-down list. If you re configuring new tsk, the Registry nd Cookies scn items re lredy dded to the tsk. Crete nd configure s mny scn tsks s necessry. These tsk settings do not pply to registry nd cookie scns: The Heuristics options on the Advnced t. The options on the Actions t. 6
Viewing scn results View scn results from VirusScn Enterprise or epolicy Orchestrtor. Informtion Source VirusScn Enterprise epolicy Orchestrtor On-Access Scnner View detection results in: The On-Access Scn Messges dilog ox. The On-Access Scn Sttistics dilog summry. The ctivity log. On-Demnd Scn Tsks View detection results in: The On-Demnd Scn Progress dilog ox while the scn is in progress. The On-Demnd Scn Sttistics dilog summry. The ctivity log. Reports The results of scns performed y the AntiSpywre Enterprise Module re ville in the epolicy Orchestrtor reports under Anti-Virus VirusScn Enterprise. The module is n dd-on to VirusScn Enterprise, so VirusScn Enterprise collects nd reports the dt. Use the Coverge reports to see how mny computers hve the AntiSpywre Enterprise Module instlled. Use the VirusScn Enterprise reports, such s the Top 10 Unwnted Progrms nd the vrious Unwnted Progrm Detections reports to view detection informtion. Filtering reports In ddition to using stndrd reports, you cn filter report results to exclude cookies or include specific types of threts. Some filter exmples follow. Filter out cookie detections: Dt Filter T = Detection Condition = Not Strting With Term/Vrile = Cookie Filter out ll detections except Adwre: Dt Filter T = Type Condition = Equl to Term/Vrile = Adwre Filter out ll detections except Adwre nd Remote Admin tools: Dt Filter T = Type Condition = Equl to Term/Vrile = Adwre Term/Vrile = Remote Admin s nd Tips Some filter terms re cse sensitive; for exmple Cookie. The Unwnted Progrm Detections reports do not disply virus ctivity even if you filter on it. 7
Removing the AntiSpywre Enterprise Module Use one of these methods to remove the AntiSpywre Enterprise Module. Removl Method Windows Add or Remove Progrms epolicy Orchestrtor Use the Windows Add or Remove Progrms utility to remove the AntiSpywre Enterprise Module. Use the deployment tsk to remove the AntiSpywre Enterprise Module. Cution Do not use the VirusScn Enterprise Repir Instlltion feture to remove the AntiSpywre Enterprise Module. Using this feture my not remove ll of the necessry files. You must use one of the methods descried here. Sumitting smples to McAfee Avert Ls If you find spywre ppliction or cookie tht is not eing detected with the current DAT file, you cn sumit smple of it to McAfee Avert Ls through WeImmune. The smple is nlyzed nd considered for inclusion in the DAT file. If the module detects something tht you think it should not detect, you cn lso sumit smple of it to McAfee Avert Ls through WeImmune. The smple is nlyzed nd considered for exclusion from the DAT file. To sumit smple: Method to sumit WeImmune E-mil Stndrd Mil This is the preferred method to sumit smples ecuse it provides the fstest turnround time on smple reviews, nd provides historicl informtion for ll smples tht you sumitted. By ccessing https:/ /www.weimmune.net/defult.sp nd creting free ccount you cn uplod files directly to McAfee Avert Ls utomted systems for review. If the utomted system is unle to determine thret exists the issue will e esclted to the nlysts. Access https://www.weimmune.net/fqs.sp to get more informtion out WeImmune. You cn send e-mils directly to McAfee Avert Ls utomted systems for review. If the utomted system is unle to determine thret exists, the issue will e esclted to nlysts. To sumit smple vi e-mil, send it to the glol e-mil ddress t virus_reserch@vertls.com, or get dditionl regionl ddresses from the WeImmune wesite. This is the lest preferred method. Sumitting smples in this wy cuses the longest turnround time for review of your smple. 8
Resources Getting informtion Wht product documenttion is ville? The product documenttion is ville in PDF formt on the product CD nd lso on the McAfee downlod wesite. AntiSpywre Enterprise Module 8.5 Relese s RedMe. Product informtion, ny known issues, nd lst minute dditions or chnges to the product or its documenttion. Product Guide This guide. Instlltion, configurtion, nd operting procedures. VirusScn Enterprise 8.5i Relese s RedMe. Product informtion, resolved issues, ny known issues, nd lst minute dditions or chnges to the product or its documenttion. Instlltion Guide System requirements nd instructions for instlling nd removing the softwre using the Setup utility nd the commnd line. Product Guide Product introduction nd fetures, detiled instructions for configuring the softwre, informtion on deployment, recurring tsks, nd operting procedures. Configurtion Guide For use with epolicy Orchestrtor. Configuring, deploying, nd mnging VirusScn Enterprise through epolicy Orchestrtor. Quick Reference Crd Product informtion tht is printed nd ccompnies the product CD. epolicy Orchestrtor 3.5 or 3.6 Relese s RedMe. Product informtion, resolved issues, ny known issues, nd lst minute dditions or chnges to the product or its documenttion. Product Guide Product introduction nd fetures, detiled instructions for configuring the softwre, informtion on deployment, recurring tsks, nd operting procedures. McAfee Instlltion Designer 8.5 Relese s RedMe. Product informtion, resolved issues, ny known issues, nd lst minute dditions or chnges to the product or its documenttion. Product Guide Product introduction nd fetures, detiled instructions for configuring the softwre, informtion on deployment, recurring tsks, nd operting procedures. How do I contct technicl support? By phone For list of current product support phone numers: http://www.mcfee.com/us/out/contct/index.html From the we Log on to the SecurityCenter wesite with your user nme nd pssword. Click the Help t, then select Contct Support. Copyright 2006 McAfee, Inc. All Rights Reserved. DBN-002-EN mcfee.com 9