Copyright 2013 Trend Micro Incorporated. All rights reserved.

Transcription

1

2

3 Tred Micro reserves the right to make chages to this documet ad to the products described herei without otice. Before istallig or usig the software, please review the readme files, release otes, ad the latest versio of the applicable user documetatio, which are available from the Tred Micro website: Tred Micro, Safe Lock, Portable Security, ad TredLabs are trademarks or registered trademarks of Tred Micro Icorporated. All other product or compay ames may be trademarks or registered trademarks of their owers. Copyright 2013 Tred Micro Icorporated. All rights reserved. Documet Part No.: SLEM15951_ Release Date: May 2013 i

4 The documetatio for Tred Micro Safe Lock describes the mai features of the software ad istallatio istructios for your productio eviromet. Read through it before istallig or usig the software. Detailed iformatio about how to use specific features are available i the olie Kowledge Base at the Tred Micro website. Tred Micro always seeks to improve its documetatio. If you have questios, commets, or suggestios about this or ay Tred Micro documet, please cotact us at docs@tredmicro.com. Please evaluate this documet at the followig site: ii

5 Table of Cotets Preface Preface... vii What's New i This Versio... viii Tred Micro Safe Lock 1.1 Features ad Ehacemets... viii Safe Lock Documetatio... viii Audiece... ix Documet Covetios... ix Termiology... x Chapter 1: Itroductio About Tred Micro Safe Lock Features ad Beefits Applicatio Lockdow Exploit Protectio Easy Maagemet Small Footprit Role Based Admiistratio Graphical ad Commad Lie Iterfaces Tred Micro Portable Security Compatible Process Overview Accout Types Chapter 2: Cofigurig Mai Cosole Settigs Settig Up the Approved List Uderstadig the Mai Cosole Status Icos Uderstadig the Approved List iii

6 Tred Micro Safe Lock Admiistrator's Guide Cofigurig the Approved List Addig or Removig Files Updatig or Istallig Usig the Trusted Updater Exportig or Importig the Approved List Uderstadig Hashes Checkig or Updatig Hashes Cofigurig Passwords Cofigurig Settigs Exploit Protectio Settigs Eablig or Disablig Exploit Protectio Settigs Exportig or Importig a Cofiguratio File Chapter 3: Usig the Commad Lie Iterpreter Workig with the Commad Lie Iterpreter Commad Lie Iterpreter ad Mai Cosole Fuctio Compariso Opeig the Commad Lie Commad Lie Iterpreter Commads Feature Abbreviatios Workig with the Cofiguratio File Chagig Advaced Settigs Cofiguratio File Sytax Cofiguratio File Parameters Chapter 4: Troubleshootig Frequetly Asked Questios (FAQ) What if the computer becomes ifected by a threat? Where ca I get more help with Tred Micro Safe Lock? Workig with the Diagostic Toolkit Loggig Issues with Tred Micro Safe Lock About Self Protectio Diagostic Toolkit Commads Evet Log Descriptios Error Code Descriptios iv

7 Table of Cotets Chapter 5: Gettig Help Techical Support Multi-Year Cotracts Idex Idex... IN-1 v

8

9 Preface Preface This Admiistrator's Guide itroduces Tred Micro Safe Lock ad guides admiistrators through istallatio ad deploymet. Topics i this chapter iclude: What's New o page viii Safe Lock Documetatio o page viii Audiece o page ix Documet Covetios o page ix Termiology o page x vii

10 Tred Micro Safe Lock Admiistrator's Guide What's New i This Versio This sectio lists the ew features ad ehacemets available i each release. Tred Micro Safe Lock 1.1 Features ad Ehacemets Tred Micro Safe Lock 1.1 icludes the followig ew features ad ehacemets FEATURE DLL/Driver Lockdow Script Lockdow Predefied Trusted Updater List DESCRIPTION Prevets uapproved DLL or drivers from beig loaded ito memory Prevets uapproved script files from beig ru Allows istallers or updaters to be ru without the eed for a user to ru the Trusted Updater Safe Lock Documetatio Tred Micro Safe Lock documetatio icludes the followig: TABLE 1. Tred Micro Safe Lock Documetatio DOCUMENTATION Istallatio Guide Admiistrator's Guide Readme file DESCRIPTION A PDF documet that discusses requiremets ad procedures for istallig Safe Lock. A PDF documet that discusses gettig started iformatio ad Safe Lock usage ad maagemet. Cotais a list of kow issues ad basic istallatio steps. It may also cotai late-breakig product iformatio ot foud i the prited documetatio. viii

11 Preface DOCUMENTATION Kowledge Base DESCRIPTION A olie database of problem-solvig ad troubleshootig iformatio. It provides the latest iformatio about kow product issues. To access the Kowledge Base, go to the followig website: Dowload the latest versio of the PDF documets ad Readme at: Audiece Tred Micro Safe Lock documetatio is iteded for admiistrators resposible for Safe Lock maagemet, icludig istallatio. These admiistrators are expected to have advaced computer maagemet kowledge. Documet Covetios The followig table provides the official termiology used throughout the Tred Micro Safe Lock documetatio: TABLE 2. Documet Covetios CONVENTION UPPER CASE Bold Italics Moospace DESCRIPTION Acroyms, abbreviatios, ad ames of certai commads ad keys o the keyboard Meus ad meu commads, commad buttos, tabs, ad optios Refereces to other documets Sample commad lies, program code, web URLs, file ames, ad program output ix

12 Tred Micro Safe Lock Admiistrator's Guide CONVENTION Navigatio > Path Note DESCRIPTION The avigatio path to reach a particular scree For example, File > Save meas, click File ad the click Save o the iterface Cofiguratio otes Tip Recommedatios or suggestios Importat Iformatio regardig required or default cofiguratio settigs ad product limitatios WARNING! Critical actios ad cofiguratio optios Termiology The followig table provides the official termiology used throughout the Tred Micro Safe Lock documetatio: TABLE 3. Safe Lock Termiology TERMINOLOGY DESCRIPTION ASLR Admiistrator CLI Cosole Address Space Layout Radomizatio/memory radomizatio The perso resposible for istallig ad/or maagig Safe Lock. Commad lie iterpreter. The user iterface for cofigurig ad maagig Safe Lock. x

13 Chapter 1 Itroductio Tred Micro Safe Lock delivers a simple, o-maiteace solutio to lock dow ad protect fixed-fuctio computers, helpig protect busiesses agaist security threats ad icrease productivity. Topics i this chapter iclude: About Tred Micro Safe Lock o page 1-2 Features ad Beefits o page 1-2 Process Overview o page 1-3 Accout Types o page

14 Tred Micro Safe Lock Admiistrator's Guide About Tred Micro Safe Lock Tred Micro Safe Lock protects fixed-fuctio computers like Idustrial Cotrol Systems (ICS), Poit of Sale (POS) termials, ad kiosk termials from malicious software ad uauthorized use. By usig fewer resources ad without the eed for regular software or system updates, Safe Lock ca reliably secure computers i idustrial ad commercial eviromets with little performace impact or dowtime. Features ad Beefits Tred Micro Safe Lock icludes the followig features ad beefits. Applicatio Lockdow By prevetig programs, DLL files, drivers, ad scripts ot specifically o the Approved List of applicatios from ruig (also kow as applicatio white listig), Safe Lock provides both improved productivity ad system itegrity by blockig malicious software ad prevetig uiteded use. Exploit Protectio Kow targeted threats like Dowad ad Stuxet, as well as ew ad ukow threats, are a sigificat risk to ICS ad kiosk computers. Systems without the latest operatig system updates are especially vulerable to targeted attacks. Safe Lock provides both itrusio prevetio, which helps prevet threats from spreadig to the computer, ad executio prevetio, which helps prevet threats from spreadig to the computer or from ruig. Easy Maagemet Whe software eeds to be istalled or updated, the Trusted Updater ad Pre-approved Trusted Updater List provide a easy way to make chages to the computer ad 1-2

15 Itroductio automatically add ew or modified files to the Approved List, all without havig to ulock Tred Micro Safe Lock. Small Footprit Compared to other edpoit security solutios that rely o large patter files that require costat updates, applicatio lockdow uses less memory ad disk space, without the eed to dowload updates. Role Based Admiistratio Tred Micro Safe Lock provides separate Admiistrator ad Restricted User accouts, providig full cotrol durig istallatio ad setup, as well as simplified moitorig ad maiteace after deploymet. Graphical ad Commad Lie Iterfaces Ayoe who eeds to check the software ca easily use the Widows mai cosole, while system admiistrators ca take advatage of the commad lie iterface to access all of the features ad fuctios available. Tred Micro Portable Security Compatible Out-of-the-box compatibility with Tred Micro Portable Security esures straightforward removal of ay threats that do get oto the computer, without the eed to update the Approved List or ulock the computer. Process Overview Tred Micro Safe Lock is a whitelist solutio that locks dow computers, prevetig all applicatios ot o the Approved List from ruig. Safe Lock ca be cofigured ad maitaied though either the mai cosole or the commad lie iterpreter (CLI), while system updates ca be applied without ulockig the computer through the Preapproved Trusted Updater List or by usig the Trusted Updater. 1-3

16 Tred Micro Safe Lock Admiistrator's Guide Cosider this typical use case sceario: 1. Set up the Approved List ad lock the computer so that uapproved applicatios caot be ru. 2. Use the Trusted Updater to update or istall software whose istaller is ot o the Pre-approved Trusted Updater list. 3. Cofigure ad eable the Restricted User accout for later maiteace. If someoe tries to ru a applicatio ot specifically o the Approved List, the followig message displays: FIGURE 1-1. Tred Micro Safe Lock blockig message Accout Types Tred Micro Safe Lock provides role-based admiistratio, allowig admiistrators to grat users access to certai features o the mai cosole. Through the cofiguratio file, admiistrators ca specify the features available to the Restricted Users accout. TABLE 1-1. Safe Lock Accouts ACCOUNT DETAILS Admiistrator Default accout Full access to Safe Lock fuctios Ca use both the mai cosole ad commad lie iterface 1-4

17 Itroductio ACCOUNT DETAILS Restricted User Secodary maiteace accout Limited access to Safe Lock fuctios Ca oly use the mai cosole To eable the Restricted User accout, see Workig with Passwords o page To sig i with a specific accout, specify the password for that accout. To chage which features the Restricted User ca access, see Workig with the Cofiguratio File o page

18

19 Chapter 2 Cofigurig Mai Cosole Settigs This chapter describes how to cofigure Tred Micro Safe Lock Widows usig the mai cosole. Topics i this chapter iclude: Settig Up the Approved List o page 2-2 Uderstadig the Mai Cosole o page 2-6 Uderstadig the Approved List o page 2-9 Cofigurig the Approved List o page 2-11 Cofigurig Passwords o page 2-16 Cofigurig Settigs o page

20 Tred Micro Safe Lock Admiistrator's Guide Settig Up the Approved List Before Tred Micro Safe Lock ca protect the computer, it must check the computer for existig applicatios ad istallers ecessary for the system to ru correctly. Procedure 1. Ope the Safe Lock cosole usig the desktop ico (if available) or the Start meu by clickig All Programs > Tred Micro Safe Lock. 2. Provide the password ad click Logi. 2-2

21 Cofigurig Mai Cosole Settigs 3. At the otificatio widow, select Yes. Set up the Approved List ow ad click OK. 4. Whe the check is complete, Safe Lock provides a list of applicatios curretly o the computer. Deselect ay applicatios that should ot be added to the Approved List, ad click OK. 2-3

22 Tred Micro Safe Lock Admiistrator's Guide Note Whe Tred Micro Safe Lock is locked, ay applicatios that are ot added to the Approved List will o loger be able to ru. 5. Cofirm the listed applicatios to be added to the Approved List, ad click Approve. 2-4

23 Cofigurig Mai Cosole Settigs 6. Oce the applicatios have bee added, click Close. 2-5

24 Tred Micro Safe Lock Admiistrator's Guide Uderstadig the Mai Cosole The mai cosole provides easy access to commoly used features i Tred Micro Safe Lock. To cofigure which features the Restricted User accout ca access, see Workig with the Cofiguratio File o page

25 Cofigurig Mai Cosole Settigs FIGURE 2-1. The Safe Lock mai cosole The followig table describes the features available o the mai cosole. 2-7

26 Tred Micro Safe Lock Admiistrator's Guide TABLE 2-1. Mai Cosole Feature Descriptios # ITEM DESCRIPTION 1 Left-had avigatio Overview: displays the software status Approved List: displays applicatios allowed to ru ad lets users maage the list Password: chages the Admiistrator Restricted User passwords (oly available to admiistrators) Settigs: eables or disables vulerability protectio settigs ad export or import the system cofiguratio About: displays the product ad compoet versio umbers 2 Status iformatio Displays the curret status of the software. 3 Lock System/Ulock System 4 Locked sice/ulocked Sice Lockig the system prevets applicatios ot o the Approved List from ruig. Displays the date whe the software was last locked or ulocked. 5 Exploit Protectio Eabled: all Exploit Protectio features are eabled Eabled (Partly): some Exploit Protectio features are eabled Disabled: o Exploit Protectio features are eabled Click the status to ope the Settigs page. 6 Approved List status Click the umber of Approved List items or last updated date to ope the Approved list. Click the last applicatio blocked date to ope the Blocked Applicatio Evet Log. 7 Expiratio date Displays whe the software expires. Click the date to provide a ew Activatio Code. 2-8

27 Cofigurig Mai Cosole Settigs Status Icos Use the status icos for a visual idicatio of the curret status of Safe Lock. Note System Tray icos display if they were eabled durig istallatio. TABLE 2-2. Status Ico Descriptios MAIN CONSOLE ICON SYSTEM TRAY ICON STATUS DESCRIPTION Locked The Approved List is beig eforced. Uauthorized applicatios caot be ru. Ulocked The Approved List is ot beig eforced. Uauthorized applicatios ca be ru.. N/A Expired Whe the Safe Lock licese has expired, the system caot be locked. Update the Activatio Code by clickig o the expiratio date. Uderstadig the Approved List Use the Approved List to display the files that Safe Lock allows to ru or make chages to the computer. To cofigure which features are available to the Restricted User accout, see Workig with the Cofiguratio File o page

28 Tred Micro Safe Lock Admiistrator's Guide FIGURE 2-2. The Safe Lock Approved List The followig table describes the features available o the Approved List. TABLE 2-3. Approved List Item Descriptios # ITEM DESCRIPTION 1 Add Item/Delete Item Adds or removes selected items to or from the Approved List. 2 Search bar Searches the Applicatio ad File Path colums. 3 Check Hash/Update Hash Checks or updates the hash values for applicatios i the Approved List. 4 Export/Import Exports or imports the Approved List usig a SQL database (.db) file. 2-10

29 Cofigurig Mai Cosole Settigs # ITEM DESCRIPTION 5 Copy to Clipboard Copies the Approved List to the clipboard i the comma separated values (CSV) format for easy review or reportig. Cofigurig the Approved List After settig up the Approved List, users ca add ew programs by clickig Add File, which shows the optios i the followig table. TABLE 2-4. Methods for Addig Applicatios to the Approved List OPTION Add existig files ad folders Ru a istaller or updater (Trusted Updater) WHEN TO USE Choose this optio whe the software already exists o the computer ad is up-to-date. Addig a file grats permissio to ru the file, but does ot alter the file or the system. For example, if Widows Media Player (wmplayer.exe) is ot i the Approved List after iitial setup, users ca add it to the list usig the cosole. Choose this optio to ope the Trusted Updater whe updatig the computer or istallig ew software. For example, if Mozilla Firefox eeds to be istalled or updated, use the Trusted Updater. Tred Micro Safe Lock adds or updates ay files modified by a istaller to the Approved List. Addig or Removig Files Procedure 1. Ope the Tred Micro Safe Lock cosole usig the desktop ico (if available) or the Start meu by clickig All Programs > Tred Micro Safe Lock. 2. Provide the password ad click Logi. 2-11

30 Tred Micro Safe Lock Admiistrator's Guide 3. Click the Approved List meu item to ope the list. To add a item: a. Click Add Item, select Add existig files ad folders, ad click Next. b. I the widow that opes, choose File, Folder, or Folder ad sub folders from the drop-dow list. c. Select the desired applicatio or folder to add, ad click Ope. d. I the widow that opes, click OK. Cofirm the items to be added, ad click Approve. e. After addig the desired items to the Approved List, click Close. To remove a item: a. Search the Approved List for the applicatio to remove. b. Select the check box ext to the file ame to be removed, ad click Delete Item. c. Whe asked to remove the item, click OK. d. Click OK agai to close the cofirmatio widow. Updatig or Istallig Usig the Trusted Updater Tred Micro Safe Lock automatically adds applicatios to the Approved List after the Trusted Updater adds or modifies the program files. Procedure 1. Ope the Tred Micro Safe Lock cosole usig the desktop ico (if available) or the Start meu by clickig All Programs > Tred Micro Safe Lock. 2. Provide the password ad click Logi. 3. Click the Approved List meu item to ope the list. 2-12

31 Cofigurig Mai Cosole Settigs 4. To istall or update a applicatio, select the istaller that the Trusted Updater should temporarily allow to ru: a. Click Add Item, select Ru a istaller or updater, ad click Next. b. I the widow that opes, choose File, Folder, or Folder ad sub folders from the drop-dow list. c. Select the desired istallatio package or folder to add, ad click Ope. Note Oly existig.exe ad.msi files ca be added to the Trusted Updater. d. Check that the correct items appear o the list, ad click Start. The Safe Lock Trusted Updater widow displays. FIGURE 2-3. The Safe Lock Trusted Updater 5. Istall or update the program as usual. Whe fiished, click Stop o the Trusted Updater. 2-13

32 Tred Micro Safe Lock Admiistrator's Guide 6. Check that the correct items appear o the Approved List, ad click Approve, ad the click Close. Exportig or Importig the Approved List Users ca export or import the as a database (.db) file for reuse i mass deploymet situatios. Copy to Clipboard creates a CSV versio of the list o the Widows clipboard. Procedure 1. Ope the Tred Micro Safe Lock cosole usig the desktop ico (if available) or the Start meu by clickig All Programs > Tred Micro Safe Lock. 2. Provide the password ad click Logi. 3. Click the Approved List meu item to ope the list. To export the Approved List: a. Click Export, ad choose where to save the file. b. Provide a fileame, ad click Save. To import a Approved List: a. Click Import, ad locate the database file. b. Select the file, ad click Ope. Uderstadig Hashes Tred Micro Safe Lock calculates a uique hash value for each file i the Approved List. This value ca be used to detect ay chages made to a file, sice ay chage results i a differet hash value. Comparig curret hash values to previous values ca help detect file chages. The followig table describes the hash check status icos. 2-14

33 Cofigurig Mai Cosole Settigs TABLE 2-5. Hash Check Status Icos ICON DESCRIPTION The calculated hash value matches the stored value. The calculated hash value does ot match the stored value. There was a error calculatig the hash value. Movig or overwritig files maually (without usig the Trusted Updater) ca result i the hash values ot matchig, but the mismatch could result from other applicatios (icludig malware) alterig or overwritig existig files. If usure why a hash value mismatch has occurred, sca the computer for threats with Tred Micro Portable Security. Checkig or Updatig Hashes Checkig the hash value of files i the Approved List ca help verify the itegrity of files curretly permitted to ru. Procedure 1. Ope the Tred Micro Safe Lock cosole usig the desktop ico (if available) or the Start meu by clickig All Programs > Tred Micro Safe Lock. 2. Provide the password ad click Logi. 3. Click the Approved List meu item to ope the list. To check the file hash values: a. Select the files to check. To check all files, select the check box at the top of the Approved List. b. Click Check Hash. To update the file hash values: 2-15

34 Tred Micro Safe Lock Admiistrator's Guide a. Select the files to update. b. Click Update Hash. Importat If usure why a hash value mismatch has occurred, sca the computer for threats. Cofigurig Passwords While the Admiistrator ad Restricted User passwords ca be chaged from the mai cosole, oly the Admiistrator ca chage passwords. To log o with the Admiistrator accout, provide the Admiistrator password. Importat The Admiistrator ad Restricted User passwords caot be the same. Procedure 1. Ope the Tred Micro Safe Lock cosole usig the desktop ico (if available) or the Start meu by clickig All Programs > Tred Micro Safe Lock. 2. Provide the password ad click Logi. 3. Click the Password meu item to display the Admiistrator password page. To chage the Admiistrator password: a. Provide the curret password, specify ad cofirm the ew password, ad click Save. WARNING! The oly way to recover the Admiistrator password is by reistallig the operatig system. To create a Restricted User password: 2-16

35 Cofigurig Mai Cosole Settigs a. Click Restricted User at the top of the mai cosole. b. Select the Use Restricted User check box. c. Specify ad cofirm the password, ad click Save. To chage a existig Restricted User password: a. Specify ad cofirm the ew password, ad click Save. Cofigurig Settigs Admiistrators ca eable or disable specific Exploit Protectio features depedig o the eeds of their orgaizatio. However, ot all settigs are available through the mai cosole. See Workig with the Cofiguratio File o page 3-10 for iformatio about advaced cofiguratio. Exploit Protectio Settigs Safe Lock offers the followig protectio features. 2-17

36 Tred Micro Safe Lock Admiistrator's Guide FIGURE 2-4. Safe Lock settigs scree TABLE 2-6. Itrusio Prevetio Mechaisms SETTING USB Malware Protectio DESCRIPTION USB Malware Protectio prevets threats o USB or remote drives from ifectig the local computer. Just viewig the cotets of the drive may be eough to pass alog a ifectio. Eable this feature to prevet files o USB devices from ifectig the computer. 2-18

37 Cofigurig Mai Cosole Settigs SETTING Network Virus Protectio DESCRIPTION Network Virus Protectio scas icomig ad outgoig etwork traffic, blockig threats from ifected computers or other devices o the etwork. Eable this feature to prevet threats o the etwork from ifectig the computer. TABLE 2-7. Executio Prevetio Mechaisms SETTING Memory Radomizatio DESCRIPTION Address Space Layout Radomizatio (ASLR) helps prevet shellcode ijectio by radomly assigig memory locatios for importat fuctios, forcig a attacker to guess the memory locatio of specific processes. Eable this feature o older operatig systems such as Widows XP or Widows Server 2003, which may lack or offer limited ASLR support. Note The computer must be restarted to eable or disable Memory Radomizatio. DLL Ijectio Prevetio API Hookig Prevetio DLL Ijectio Prevetio detects ad blocks API call behaviors used by malicious software. Blockig these threats helps prevet malicious processes from ruig. Never disable this feature except i troubleshootig situatios sice it protects the system from a wide variety of serious threats. API Hookig Prevetio detects ad blocks malicious software that tries to itercept ad alter messages used i critical processes withi the operatig system. Never disable this feature except i troubleshootig situatios sice it protects the system from a wide variety of serious threats. 2-19

38 Tred Micro Safe Lock Admiistrator's Guide Eablig or Disablig Exploit Protectio Settigs Note By default, Tred Micro Safe Lock eables all Exploit Protectio settigs. If Network Virus Protectio was ot icluded i the iitial istallatio, it caot be selected. Reistall Tred Micro Safe Lock if Network Virus Protectio is ot available. Procedure 1. Ope the Tred Micro Safe Lock cosole usig the desktop ico (if available) or the Start meu by clickig All Programs > Tred Micro Safe Lock. 2. Provide the password ad click Logi. 3. Click the Settigs meu item to cofigure Exploit Protectio settigs. 4. Eable or disable the desired features. 5. Click Save. Exportig or Importig a Cofiguratio File Tred Micro Safe Lock ecrypts the cofiguratio file before export. Users must be decrypt the cofiguratio file before modifyig the cotets. See Workig with the Commad Lie Iterpreter o page 3-2 for iformatio about decryptig the file. See Workig with the Cofiguratio File o page 3-10 for iformatio about modifyig the system cofiguratio. Procedure 1. Ope the Tred Micro Safe Lock cosole usig the desktop ico (if available) or the Start meu by clickig All Programs > Tred Micro Safe Lock. 2. Provide the password ad click Logi. 3. Click the Settigs meu item to access the Export/Import Cofiguratio sectio. 2-20

39 Cofigurig Mai Cosole Settigs To export the cofiguratio file as a database (.xe) file: a. Click Export, ad choose the locatio to save the file. b. Provide a fileame, ad click Save. To import the cofiguratio file as a database (.xe) file: a. Click Import, ad locate the database file. b. Select the file, ad click Ope. Tred Micro Safe Lock overwrites the existig cofiguratio settigs with the settigs i the database file. 2-21

40

41 Chapter 3 Usig the Commad Lie Iterpreter This chapter describes how to cofigure ad use Tred Micro Safe Lock usig the commad lie iterpreter. Topics i this chapter iclude: Workig with the Commad Lie Iterpreter o page 3-2 Workig with the Cofiguratio File o page

42 Tred Micro Safe Lock Admiistrator's Guide Workig with the Commad Lie Iterpreter Admiistrators ca work with Tred Micro Safe Lock directly from the commad lie usig the commad iterpreter SLCmd.exe, located i the Tred Micro Safe Lock istallatio folder. By default, it appears here: c:\program Files\Tred Micro\Tred Micro Safe Lock\ Note To use SLCmd.exe, ope a commad lie prompt with Widows admiistrator privileges. Commad Lie Iterpreter ad Mai Cosole Fuctio Compariso The followig table lists the Tred Micro Safe Lock features available i each iterface.. TABLE 3-1. Commad Lie Iterpreter ad Mai Cosole Fuctio Compariso FUNCTION COMMAND LINE INTERPRETER MAIN CONSOLE Accout Maagemet Yes Yes Approved List Maagemet Yes Yes Decrypt/Ecrypt cofiguratio file Yes No Display the blocked log Yes Yes Export/Import Approved List Yes Yes Export/Import cofiguratio Yes Yes Istall Yes Yes Lock/Ulock Yes Yes Licese Maagemet Yes Yes Settigs Limited Limited 3-2

43 Usig the Commad Lie Iterpreter FUNCTION COMMAND LINE INTERPRETER MAIN CONSOLE Start/Stop Trusted Updater Yes Yes Start/Stop the service Yes No Uistall No No Not all settigs are available through the commad lie iterpreter or mai cosole. See Workig with the Cofiguratio File o page 3-10 for iformatio about modifyig the system cofiguratio. Opeig the Commad Lie Procedure 1. Choose oe of the followig ways to ope a commad prompt with Widows admiistrator privileges. Usig the Search Bar oly: a. Ope the Start meu ad type cmd.exe. b. Hold dow the CTRL ad SHIFT keys, ad press ENTER. c. Whe prompted for permissio, press ENTER. Usig the Search Bar ad mouse: a. Ope the Start meu ad type cmd.exe. b. Right click cmd.exe ad select Ru as admiistrator. c. Whe prompted for permissio, click OK. Usig the Ru... dialog: a. Hold dow the Widows key ad press R. b. I the widow that opes, type ruas /user:admiistrator cmd.exe ad press ENTER. 3-3

44 Tred Micro Safe Lock Admiistrator's Guide c. Whe promoted for the Admiistrator password, type the Widows admiistrator password (ot the Tred Micro Safe Lock Admiistrator password). 2. Navigate to the Tred Micro Safe Lock istallatio folder usig the CD commad. To reach the default locatio, type the followig commad: cd c:\program Files\Tred Micro\Tred Micro Safe Lock\ ad press ENTER. 3. Type SLCmd ad press ENTER to display the list of available commads. Commad Lie Iterpreter Commads To use a commad, type SLCmd ad the desired commad. The followig table lists the commads available usig the commad lie iterpreter, SLCmd.exe. Note Oly the Tred Micro Safe Lock Admiistrator ca use the commad lie iterpreter, ad SLCmd.exe will prompt for the Admiistrator password before ruig a commad. TABLE 3-2. SLCmd Commads COMMAND DESCRIPTION -p [password] Autheticates the user so the commad will ru. start service stop service status show settigs versio set lock [eable disable] Starts the Safe Lock service. Stops the Safe Lock service. Displays the curret Safe Lock status. Displays the curret settigs. Displays versio iformatio. Locks or ulocks Safe Lock. If o optio is specified, the curret status displays. 3-4

45 Usig the Commad Lie Iterpreter COMMAND set dlldriverlockdow [eable disable] set script [eable disable] set user [eable disable] set userpassword [ew password] set admipassword [ew password] add approvedlist [path] add approvedlist -r [path] remove approvedlist [path] show approvedlist check approvedlist check approvedlist -f check approvedlist -q check approvedlist -v import approvedlist [path] DESCRIPTION Eables or disables DLL/driver lockdow. If o optio is specified, the curret status displays. Eables or disables script lockdow. If o optio is specified, the curret status displays. Eables or disables the Restricted User accout. If o optio is specified, the curret status displays. Creates or chages the Restricted User password. Chages the Admiistrator password. Adds a file or folder to the Approved List. Adds a folder ad related subfolders to the Approved List. Removes a file from the Approved List. Lists the files o the Approved List. Checks files o the Approved List, prompts to update hash mismatches, ad displays simple results. Checks files o the Approved List, automatically updates hash mismatches, ad displays detailed results. Checks files o the Approved List, automatically updates hash mismatches, ad displays simple results. Checks files o the Approved List, prompts to update hash mismatches, ad displays detailed results. Imports the Approved List from the specified path ad appeds the existig list. 3-5

46 Tred Micro Safe Lock Admiistrator's Guide COMMAND import approvedlist -o [path] export approvedlist [path] add script [path] [iterpreter 1] [iterpreter2]... remove script [path] [iterpreter 1] [iterpreter2]... show script add predefiedtrustedupdater -e [path] add predefiedtrustedupdater -u [path] add predefiedtrustedupdater -t [process file folder folderadsub] DESCRIPTION Imports the Approved List from the specified path ad overwrites the existig list. Exports the Approved List to the specified path. Adds a script rule. More tha oe script iterpreter ca be specified usig spaces betwee iterpreter ames. Removes a script rule. More tha oe script iterpreter ca be specified usig spaces betwee iterpreter ames. Displays all script rules. Adds a path to the Trusted Updater exceptio list. Adds a path ad all subfolders to the Trusted Updater exceptio list. Adds the followig rules to the Trusted Updater exceptio list: process: process lauch file: file access by the appropriate script iterpreter or istaller folder: process lauch or file access folderadsubfolder: process lauch or file access add predefiedtrustedupdater -p [path] add predefiedtrustedupdater -al [eable disable] add predefiedtrustedupdater -l [label] Adds a path ad paret process usig backward match. If o path is specified, ay paret process will match. Sets the status of the Approved List check. The default value is eable. Adds a label to the specified rule. If ot specified, a label is assiged automatically. 3-6

47 Usig the Commad Lie Iterpreter COMMAND remove predefiedtrustedupdater -e [path] remove predefiedtrustedupdater -l [label] show predefiedtrustedupdater show predefiedtrustedupdater -e start trustedupdater [path] stop trustedupdater show blockedlog set usbmalwareprotectio [eable disable] set memoryradomizatio [eable disable] set apihookigprevetio [eable disable] set dllijectioprevetio [eable disable] set etworkvirusprotectio [eable disable] set predefiedtrustedupdater [eable disable] import cofiguratio [path] export cofiguratio [path] DESCRIPTION Removes a path from the Predefied Trusted Updater exceptio list. Removes a label to the specified rule. If ot specified, a label is assiged automatically. Lists the Predefied Trusted Updater rules Lists the items of the Predefied Trusted Updater exceptio list. Allows istallers from the specified path to ru. Adds files created or modified by the allowed istallers to the Approved List. Lists the applicatios that have bee preveted from ruig. Eables or disables USB Malware Protectio. Eables or disables Memory Radomizatio. Eables or disables API Hookig Prevetio. Eables or disables DLL Ijectio Prevetio. Eables or disables Network Virus Protectio. Eables or disables the Predefied Trusted Updater. Imports the cofiguratio file from the specified path. Exports the cofiguratio file to the specified path. 3-7

48 Tred Micro Safe Lock Admiistrator's Guide COMMAND import predefiedtrustedupdater [path] export predefiedtrustedupdater [path] ecrypt cofiguratio [source] [target] decrypt cofiguratio [source] [target] ecrypt predefiedtrustedupdater [source] [target] decrypt predefiedtrustedupdater [source] [target] show licese activate [Activatio Code] help DESCRIPTION Imports the Predefied Trusted Updater list to the specified path ad overwrites the existig list. Exports the Predefied Trusted Updater list to the specified path. Ecrypts the cofiguratio file i the specified path. Decrypts the cofiguratio file i the specified path. Ecrypts the cofiguratio file i the specified path. Decrypts the cofiguratio file i the specified path. Displays the software licese iformatio. Activates the software. Displays the help file. Feature Abbreviatios To make usig the commad lie iterpreter easier, use these abbreviatios for regular features: TABLE 3-3. CLI Feature Abbreviatios FEATURE ABBREVIATION service user srv us 3-8

49 Usig the Commad Lie Iterpreter FEATURE ABBREVIATION userpassword admipassword approvedlist trustedupdater cofiguratio dlldriverlockdow script predefiedtrustedupdater blockedlog lock list licese settigs usbmalwareprotectio memoryradomizatio dllijectioprevetio apihookigprevetio etworkvirusprotectio up ap al tu co dd scr ptu bl lo li lcsrv set usb mr dll api et 3-9

50 Tred Micro Safe Lock Admiistrator's Guide Workig with the Cofiguratio File The cofiguratio file allows admiistrators to create ad deploy a sigle cofiguratio across multiple machies. See Exportig or Importig a Cofiguratio File o page 2-20 for more iformatio. Chagig Advaced Settigs Some settigs ca oly be chaged though the cofiguratio file usig the commad lie iterpreter. See Workig with the Commad Lie Iterpreter o page 3-2 for more iformatio. Procedure 1. Export the cofiguratio file. 2. Decrypt the cofiguratio file. 3. Edit the cofiguratio file with Widows Notepad or aother text editor. 4. Ecrypt the edited cofiguratio file. 5. Import the edited cofiguratio file. Cofiguratio File Sytax The cofiguratio file uses the XML format to specify the ecessary parameters to deploy Safe Lock. Refer to the followig example of the cofiguratio file: <?xml versio=1.0" ecodig="utf-8"?> <Cofiguratios versio=" " xmls:xsi=" xsi:onamespaceschemalocatio="wkcofig.xsd" <Cofiguratio> <AccoutGroup> <Accout Id="{24335D7C d1-9CBB-332D688C85B6}" Eable="yes"> 3-10

51 Usig the Commad Lie Iterpreter <Password>Mb4mhJHBUxvDT9JfjVQOGLmGojNgdYCYMGZ5jTa7Q49 Ia0mPWpL6sjXBcrkSfKtGC48rKEVLc2r98jeVqzS6g== </Password> </Accout> </AccoutGroup> <UI> <SystemTaskTrayIco Eable="o"/> </UI> <Feature> <ApplicatioLockDow LockDowMode="2"> <WhiteList RecetHistoryUapprovedFilesLimit="50"/> <DllDriverLockdow Eable="yes"/> <ScriptLockdow Eable="yes"> <Extesio Id="vbe"> <Iterpreter>cscript.exe</Iterpreter> <Iterpreter>wscript.exe</Iterpreter> </Extesio> <Extesio Id="bat"> <Iterpreter>cmd.exe</Iterpreter> </Extesio> <ScriptLockdow/> <TrustedUpdater> <PredefiedTrustedUpdater Eable="yes"> <RuleSet> <Coditio Id="AllowOlyCertaiParetProcess"> <ParetProcess Path="WKSrv.exe"/> <ApprovedListCheck Eable="yes"/> </Coditio> <Rule><Updater Type="Process" Path="bar.exe"/></Rule> <Rule><Updater Type="File" Path="foo.msi"/></Rule> <Rule><Updater Type="Folder" Path="C:\bar" CoditioRef="AllowOlyCertaiParetProcess"/></Rule> <Exceptio Path="hoge.exe"/> </RuleSet> </PredefiedTrustedUpdater> </TrustedUpdater> </ApplicatioLockDow> <DeviceAccessCotrol Eable="yes" ActioMode="1"/> <DllIjectioPrevetio Eable="yes" ActioMode="1"/> <ApiHookigPrevetio Eable="yes" ActioMode="1"/> <MemoryRadomizatio Eable="yes"/> <NetworkSca Eable="yes" ActioMode="0"/> 3-11

52 Tred Micro Safe Lock Admiistrator's Guide <Log> <EvetLog Eable="yes"> <BlockedAccessLog Eable="yes"/> <ApprovedAccessLog Eable="yes"/> <DllDriverLog Eable="yes"> <TrustedUpdaterLog Eable="yes"> </ApprovedAccessLog> <SystemEvetLog Eable="yes"/> <ListLog Eable="yes"/> <DeviceAccessCotrolLog Eable="yes"/> <ExecutioPrevetioLog Eable="yes"/> <NetworkScaLog Eable="yes"/> </EvetLog> <DebugLog Eable="yes"/> </Log> </Feature> </Cofiguratio> <Permissio> <AccoutRef Id="{24335D7C d1-9CBB-332D688C85B6}"> <UICotrol Id="DetailSettig" State="yes"/> <UICotrol Id="LockUlock" State="yes"/> <UICotrol Id="LauchUpdater" State="yes"/> <UICotrol Id="RecetHistoryUapprovedFiles" State="yes"/> <UICotrol Id="ImportExportList" State="yes"/> <UICotrol Id="ListMaagemet" State="yes"/> </AccoutRef> </Permissio> </Cofiguratios> Cofiguratio File Parameters The cofiguratio file cotais sectios for cofigurig the followig iformatio: The Restricted User accout Specific Safe Lock features Log files Mai cosole cotrols available to the Restricted User accout 3-12

53 Usig the Commad Lie Iterpreter Importat The cofiguratio file oly supports UTF-8 ecodig. Accout Cofiguratio Parameters Use the accout cofiguratio parameters to cofigure the Restricted User accout ad cotrol the display of the system tray ico. TABLE 3-4. Accout Cofiguratio Parameters CATEGORY PARAMETER VALUE DESCRIPTION id GUID Restricted User accout GUID. Accout Eable yes, o Eables or disables the Restricted User accout. Password - The Admiistrator ad Restricted User passwords caot be the same. SystemTaskTrayIco Eable yes, o Turs the system tray ico ad otificatios o or off. Feature Cofiguratio Parameters Use the feature cofiguratio parameters cofigure the mai features as ecessary. Use the ActioMode parameter to block applicatios or oly record evets i the correspodig logs. See Exploit Protectio Settigs o page 2-17 for more iformatio o specific features. TABLE 3-5. Feature Cofiguratio Parameters CATEGORY PARAMETER VALUE S DESCRIPTION ApplicatioLockDow LockDowMod e 1-2 1=locked, 2=ulocked 3-13

54 Tred Micro Safe Lock Admiistrator's Guide CATEGORY PARAMETER VALUE S DESCRIPTION WhiteList RecetHistoryU approvedfiles Limit Specifies the maximum umber of items i the Blocked applicatios log. DLLDriverLockdow Eable yes, o ScriptLockDow Eable yes, o Eables or disables DLL/Driver Lockdow. Eables or disables Script Lockdow. ScriptLockDow > Extesio ScriptLockDow > Extesio > Iterpreter Id ay Specifies the file extesio of the script. /a /a Specifies the file ame of the iterpreter. TrustedUpdater /a /a Cotaier for PredefiedTrustedUpdater. TrustedUpdater > PredefiedTrustedUpd ater Eable yes, o Eables or disables the PredefiedTrustedUpdater. TrustedUpdater > PredefiedTrustedUpdat er > RuleSet TrustedUpdater > PredefiedTrustedUpdat er > RuleSet > Coditio /a /a Cotaier for Coditio. Id ay Specifies a uique ame for the rule set. TrustedUpdater > PredefiedTrustedUpdat er > RuleSet > Coditio > ApprovedListCheck Eable yes, o Eables or disables hash check for the Trusted Updaters. TrustedUpdater > PredefiedTrustedUpdat er > RuleSet > Coditio > ParetProcess Path ay Specifies the paret process path for the added updater. 3-14

55 Usig the Commad Lie Iterpreter CATEGORY PARAMETER VALUE S DESCRIPTION TrustedUpdater > PredefiedTrustedUpdat er > RuleSet > Exceptio TrustedUpdater > PredefiedTrustedUpdat er > RuleSet > Rule Path ay Specifies the process path. Label ay Specifies a uique ame for the rule. TrustedUpdater > PredefiedTrustedUpdat er > RuleSet > Rule > Updater Type Proce ss, File, Folder, Folder AdSu bfold er Specifies the type of updater for the curret rule: Process: the rule matches a process creatio evet File: the rule matches a file accessed by the specified iterpreter or msiexec Folder: the rule matches ay process, script, iterpreter or msi withi the folder FolderAdSubFolder: the rule matches ay process, script, iterpreter or msi withi the folder or subfolders Path ay Specifies the path to the updater. CoditioRef ay Specifies the Coditio Id to provide a more detailed rule for the updater. UsbMalwareProtectio Eable yes, o Eables or disables USB Malware Protectio. ActioMode 0-1 0=allow, 1=block 3-15

56 Tred Micro Safe Lock Admiistrator's Guide CATEGORY PARAMETER VALUE S DESCRIPTION DllIjectioPrevetio ApiHookigPrevetio Eable yes, o Eables or disables DLL Ijectio Prevetio. ActioMode 0-1 0=allow, 1=block Eable yes, o Eables or disables API Hookig Prevetio. ActioMode 0-1 0=allow, 1=block MemoryRadomizatio Eable yes, o Eables or disables ASLR. NetworkVirusProtectio Eable yes, o Eables or disables Network Virus Protectio. ActioMode 0-1 0=allow, 1=block Log Cofiguratio Parameters Use the log cofiguratio parameters to cofigure idividual log types. See Evet Log Descriptios o page 4-7 for more iformatio about the Tred Micro Safe Lock evet log. TABLE 3-6. Log Cofiguratio Parameters CATEGORY PARAMETER VALUE DESCRIPTION EvetLog Eable yes, o BlockedAccessLog Eable yes, o ApprovedAccessLog Eable yes, o Displays all software. Displays applicatios that were preveted from ruig by the software. Displays applicatios that were allowed to ru by the software. ApprovedAccessLog > DLLDriverLog Eable yes, o Eables or disables the DLL/ Driver approved access log. 3-16

57 Usig the Commad Lie Iterpreter CATEGORY PARAMETER VALUE DESCRIPTION ApprovedAccessLog > TrustedUpdaterLog Eable yes, o Eables or disables the Trusted Updater approved access log. SystemEvetLog Eable yes, o ListLog Eable yes, o Displays all evets related to the system. Displays evets related to the Approved list. UsbMalwareProtectioL og Eable yes, o Displays evets where USB Malware Protectio was activated. ExecutioPrevetioLog Eable yes, o Displays evets where Executio Prevetio was activated. NetworkVirusProtectioL og Eable yes, o Displays evets where Network Virus Protectio was activated. DebugLog Eable yes, o Displays debuggig iformatio for the software. Permissio Cofiguratio Parameters Use the permissio cofiguratio parameters to determie which mai cosole cotrols are available to the Restricted User accout. TABLE 3-7. Permissio Cofiguratio Parameters CATEGORY PARAMETER VALUE DESCRIPTION UICotrol Id DetailSettig, LockUlock, LauchUpdater, RecetHistoryUapprovedFIles, ImportExportList, ListMaagemet Specifies the feature that is eabled or disabled. State yes, o yes=eable, o=disable 3-17

58 Tred Micro Safe Lock Admiistrator's Guide TABLE 3-8. Permissio Cofiguratio Parameter Value Descriptios VALUE DetailSettig DESCRIPTION Cotrols the availability of all features ad fuctios o the Settigs page: Chages Exploit Protectio settigs Exports or imports a cofiguratio file LockUlock LauchUpdater RecetHistoryUapprov edfiles ImportExportList ListMaagemet Locks or ulocks the software o the Overview page. Cotrols the availability of the Ru a istaller or updater optio whe the Restricted User clicks Add Item o the Approved List page. Cotrols the availability to view the Blocked Access Log if the Restricted User clicks the Last applicatio blocked status o the Overview page. Cotrols the availability of the Import List ad Export List buttos. Cotrols the availability of these Approved List page items: Delete Item butto Update Hash butto Add Item > Add Files/Folders Note The Password page is ot available to the Restricted User accout. 3-18

59 Chapter 4 Troubleshootig This chapter describes troubleshootig techiques ad frequetly asked questios about Tred Micro Safe Lock. Topics i this chapter iclude: Frequetly Asked Questios (FAQ) o page 4-2 Workig with the Diagostic Toolkit o page 4-2 Evet Log Descriptios o page 4-7 Error Code Descriptios o page

60 Tred Micro Safe Lock Admiistrator's Guide Frequetly Asked Questios (FAQ) What if the computer becomes ifected by a threat? Use Tred Micro Portable Security to remove the threat without havig to update the Approved List or ulock the computer. Where ca I get more help with Tred Micro Safe Lock? Get the most up-to-date iformatio ad support from the Tred Micro support website at: Workig with the Diagostic Toolkit The Tred Micro Safe Lock Diagostic Toolkit offers admiistrators the ability to perform a umber of diagostic fuctios, icludig: Create, collect, ad delete debuggig logs Eable or disable Self Protectio 4-2

61 Troubleshootig FIGURE 4-1. The Tred Micro Safe Lock Diagostic Toolkit Debug tab 4-3

62 Tred Micro Safe Lock Admiistrator's Guide FIGURE 4-2. The Tred Micro Safe Lock Diagostic Uistall tab 4-4

63 Troubleshootig FIGURE 4-3. The Tred Micro Safe Lock Diagostic Toolkit Others tab Loggig Issues with Tred Micro Safe Lock If Tred Micro Safe Lock experieces problems, geerate a complete set of applicatio ad driver debug logs for aalysis, or sed them to to Tred Micro Techical Support. Both the Admiistrator ad Restricted User accouts ca collect the logs. Procedure 1. Ope the Diagostic Toolkit ad eable full loggig: a. Ope the Tred Micro Safe Lock istallatio folder ad ru WKSupportTool.exe. 4-5

64 Tred Micro Safe Lock Admiistrator's Guide Note The default istallatio locatio is C:\Program\Files\Tred Micro \Tred Micro Safe Lock\. b. Provide the Admiistrator or Restricted User password ad click OK. c. O the [A] Debug tab, select Output error logs ad debug iformatio ad Output driver debug iformatio, ad click Apply. 2. Reproduce the problem. 3. Collect the debug logs: a. Reope the Diagostic Toolkit. b. O the [A] Debug tab, click Browse to choose the locatio where Tred Micro Safe Lock saves the logs. Note The default locatio for saved logs is: C:\Program Files\Tred Micro \Tred Micro Safe Lock\Log\Archive\. c. Click OK whe fiished. d. Click Collect Debug Log. e. Oce the Debug Logs have bee collected, click Ope Folder to access the zipped log files for review, or to sed them to Tred Micro Techical Support. About Self Protectio Self Protectio provides ways for Tred Micro Safe Lock to defed the processes ad other resources required to fuctio properly. Self Protectio helps thwart attempts by programs or actual users to disable the software. Self Protectio blocks all attempts to termiate the followig services: Tred Micro Safe Lock Service (WkSrv.exe) 4-6

65 Troubleshootig Tred Micro Uauthorized Chage Prevetio Service (TMBMSRV.exe) Tred Micro Persoal Firewall (TmPfw.exe) Diagostic Toolkit Commads The followig table lists the commads available usig the Diagostic Toolkit, WKSupportTool.exe. Note Oly the Tred Micro Safe Lock Admiistrator ca use the Diagostic Toolkit, ad WKSupportTool.exe will prompt for the Admiistrator password before ruig a commad. TABLE 4-1. Diagostic Toolkit Commads COMMAND DESCRIPTION -p [password] Autheticates the user so the commad will ru. debug [o off] [verbose ormal] [-drv o] [-drv off] collect [path] selfprotectio [o off] deletelogs uistall Turs the debug logs o or off, specifies the log detail level, ad if driver logs are icluded. Collects debuggig iformatio ad creates a zip file to the specified path. If o path is specified, the default log locatio <istallatio directory> \Log\Archive is used. Turs o or off Safe Lock self protectio. Deletes all Safe Lock logs. Uistalls Tred Micro Safe Lock. Evet Log Descriptios Tred Micro Safe Lock leverages the Widows Evet Viewer to display the Safe Lock evet log. Access the Evet Viewer at Start > Cotrol Pael > Admiistrative Tools. 4-7

66 Tred Micro Safe Lock Admiistrator's Guide TABLE 4-2. Widows Evet Log Descriptios EVENT ID TASK CATEGORY LEVEL DESCRIPTION 1000 System Iformatio 1001 System Iformatio 1002 System Iformatio 1003 System Iformatio 1005 System Iformatio 1006 System Iformatio 1007 System Iformatio 1008 System Iformatio 1009 System Iformatio 1011 System Iformatio 1012 System Iformatio 1013 System Iformatio 1014 System Iformatio 1015 System Iformatio Service started. Service stopped. Locked. Ulocked. Admiistrator password chaged. Restricted User password chaged. Restricted User accout eabled. Restricted User accout disabled. Product activated. Licese expired. Grace period eabled. Licese expired. Grace period eded. Product cofiguratio import started: <file_path> Product cofiguratio import complete: <file_path> Product cofiguratio exported to: <file_path>. 4-8

67 Troubleshootig EVENT ID TASK CATEGORY LEVEL DESCRIPTION 1016 System Iformatio 1017 System Iformatio 1018 System Iformatio 1019 System Iformatio 1020 System Iformatio 1021 System Iformatio 1022 System Iformatio 1023 System Iformatio USB Malware Protectio set to Allow. USB Malware Protectio set to Block. USB Malware Protectio eabled. USB Malware Protectio disabled. Network Virus Protectio set to Allow. Network Virus Protectio set to Block. Network Virus Protectio feature was eabled. Network Virus Protectio feature was disabled. 4-9

68 Tred Micro Safe Lock Admiistrator's Guide EVENT ID TASK CATEGORY LEVEL DESCRIPTION 1024 System Iformatio 1025 System Iformatio 1026 System Iformatio 1027 System Iformatio 1028 System Iformatio 1029 System Iformatio 1030 System Iformatio 1031 System Iformatio Evet log settigs chaged. [Details] Widows Evet Log: <ON OFF> System Log: <ON OFF> List Log: <ON OFF> Approved Access Log: <ON OFF> DLL Driver Log: <ON OFF> Trusted Updater Log: <ON OFF> Blocked Access Log: <ON OFF> USB Malware Protectio Log: <ON OFF> Network Virus Protectio Log: <ON OFF> Debug Log: <ON OFF> Memory Radomizatio eabled. Memory Radomizatio disabled. API Hookig Prevetio set to Allow. API Hookig Prevetio set to Block. API Hookig Prevetio eabled. API Hookig Prevetio disabled. DLL Ijectio Prevetio set to Allow. 4-10