Kaseya 2 Anti-Malware User Guide Version 1.1 July 11, 2011
About Kaseya Kaseya is a global provider of IT automation software for IT Solution Providers and Public and Private Sector IT organizations. Kaseya's IT Automation Framework allows IT Professionals to proactively monitor, manage and maintain distributed IT infrastructure remotely, easily and efficiently with one integrated Web based platform. Kaseya's technology is licensed on over three million machines worldwide. Copyright 2000-2011 Kaseya International Limited. All Rights Reserved.
Contents Anti-Malware Overview... 1 Anti-Malware System Requirements... 1 Machines... 2 Page Layout... 2 Explorer Grid... 2 Control Panel... 3 Anti-Malware Columns... 5 Details Panel... 6 Dashboards... 7 Detections... 7 Profiles... 8 Anti-Malware Statistics in the Executive Summary Report... 9 Anti-Malware - Anti-Malware Installation Statistics... 10 Index... 11 i
Anti-Malware Overview Anti-Malware (KAM) provides Malwarebytes' Anti-Malware Pro endpoint security for managed machines. Anti-Malware can be installed independently of Endpoint Security or Antivirus. Anti-Malware is particularly adept at detecting and preventing ScareWare or Rogue Antivirus spyware that installs a virus, then attempts to bill the user to remove it. Anti-Malware quickly detects, destroys, and blocks malicious software. Every process is monitored and malicious processes are stopped before they even start. Scanning and realtime protection both use advanced heuristic scanning technology to keep systems safe and secure against even the latest malware threats. Support for Windows 2000, XP, Vista, and 7 (32-bit and 64-bit). Light speed quick scanning. Ability to perform full scans for all drives. Database updates released daily protect against the newest malware in-the-wild. Intelligent heuristics detect even the most persistent malware while remaining light on system resources. Realtime protection monitors filesystem and internet traffic. Scheduler to keep protection up-to-date automatically. Quarantine to hold threats and restore them at your convenience. Ignore list for both the scanner and the protection module. Note: See KAM System Requirements (page 1). Functions Machines (page 2) Dashboards (page 7) Detections (page 7) Profiles (page 8) Description Installs and uninstalls Anti-Malware software on selected machines and provides a detailed view of the Anti-Malware status of any selected machine. Displays a dashboard view of the status of all machines installed with Anti-Malware. Displays virus threats you can take action on. Manages Anti-Malware profiles that are assigned to machine IDs. Anti-Malware System Requirements KServer The Anti-Malware module installs on VSA 6.0.1 or later Note: See general System Requirements. Requirements for Each Managed Machine Anti-Malware can be installed on any Kaseya managed machine, excluding Mac and Linux machines. Microsoft Windows 2000 Service Pack 4 or higher. 500MHZ processor. 256 MB of RAM. 1
15 MB free disk space. Machines Anti-Malware > Machines The Machines page installs and uninstalls Anti-Malware software on selected machines. This same page also provides a detailed view of the Anti-Malware status of any selected machine. Page Layout (page 2) Explorer Grid (page 2) Control Panel (page 3) KAM Columns (page 5) Detail Panel (page 6) Page Layout The layout of the Machines (page 2) page comprises the following main panels: C o n tr o l P a n e l S e le c te d C o lu m n S e t M a c h in e ID / G r o u p ID filte r N a v ig a tio n P a n e l M a c h in e H e a d e r M a c h in e A n ti- M a lw a r e D e ta ils E x p lo r e r G r id P a g e B r o w s e r R o w s P e r P a g e Navigation Panel - Used to navigate to the Anti-Malware module. There are four functions: Machines (page 2), Dashboards (page 7), Detections (page 7), and Profiles (page 8). Explorer Grid - Each managed machine in the VSA is listed in this panel. Page Browser - If more than one page of devices displays, pages forwards and back. Rows Per Page - Sets the number of devices displayed per page: 10, 30 or 100. Machine ID / Group ID Filter - Filters the list of machines ID listed in the Explorer Grid. Control Panel - Executes tasks, either for the entire Explorer Grid or for a single selected machine. Details Panel - This expandable/collapsible panel displays the properties and status of a single machine. The Details Panel (page 6) has two sections. Header - Identifies the selected machine in the Explorer Grid. Anti-Malware - Displays a summary of the Anti-Malware status of a machine. Explorer Grid The Explorer Grid of the Machines (page 2) page lists each machine currently installed with a KAM client and included in the machine ID / group ID filter. 2
Note: The only exception is when the Installation column set is selected. In this case all machines included the machine ID /group ID filter are displayed, whether or not the KAM client is installed. The set of columns displayed is determined by the Column Set selection in the Control Panel (page 3). The currently selected column set displays in the bar just above the Explorer Grid. Note: See KAM Columns (page 5) for a description of each column available to display in any Explorer Grid column set. Page forward using the Page Browser to display multiple pages of machines. Machines per page sets the number of rows on each page. Control Panel The Control Panel at the top of the Machines (page 2) page executes tasks, either for the entire Explorer Grid (page 2) or for a single selected machine. Actions Open - Display machine Anti-Malware information in a new window. You can also double-click a machine in the Explorer Grid to open this same window. Cancel Pending Action - Cancel pending actions on selected machines. Open new window - Opens the Anti-Malware module in a new window. Reboot - Reboot selected machines. Column Sets Selecting a column set displays a predefined set of columns. Modify Columns - Customize the set of columns displayed by any column set. Or, select one of the following pre-defined sets of column listings. Installation - Display a installation columns in the Explorer Grid for all agent machines. Scan - Display scan columns in the Explorer Grid for all agent machines installed with a KAM client. Update - Display update columns in the Explorer Grid for all agent machines installed with a KAM client. Status - Display status columns in the Explorer Grid for all agent machines installed with a KAM client. Version - Display version columns in the Explorer Grid for all agent machines installed with a KAM client. Licensing - Display licensing columns in the Explorer Grid for all agent machines installed with a KAM client. Detections - Display threat detection columns in the Explorer Grid for all agent machines installed with a KAM client. Profile - Display profile columns in the Explorer Grid for all agent machines installed with a KAM client. 3
Assign Scan Update Install Assign an Anti-Malware configuration profile (page 8) to selected machines. Schedules an Anti-Malware scan on selected machines. Start Date - Start date of the scan. Time - Start time of the scan. Distribution Window - Use the Immediate option to scan at the start date and time. Or reschedule the task to a randomly selected time no later than the specified number of periods from the start date and time, to spread network traffic and server loading. There are three types of scan: Flash - A flash scan analyzes memory and auto-run objects. Quick - A quick scan uses fast scanning technology to scan systems for malicious software. Full - A full scan scans all files on the selected drives. A quick scan is recommended in most cases. Updates selected machines with the latest Anti-Malware definitions. Start Date - Start date of the update. Time - Start time of the update. Distribution Window - Use the Immediate option to scan at the start date and time. Or reschedule the task to a randomly selected time no later than the specified number of periods from the start date and time, to spread network traffic and server loading. Install - Installs the Anti-Malware client on selected machines. Uninstall - Uninstalls the Anti-Malware client on selected machines. Verify - Installs a KAM client when a standalone version of Malwarebytes' Anti-Malware is already installed on a managed machine. Auto Extend Enables and disables Auto-Extend for machines installed with Anti-Malware. Displays the total number of licenses purchased and expired, and the number of full and partial licenses available. When Auto-Extend is enabled and a KAM license expires, a new, full license is pulled from your license pool automatically. This ensures the endpoint does not go without antimalware protection at any point, as long as you have available licenses. Auto-Extend always uses a full license. In the event you uninstall KAM from an endpoint, that license goes into a partial license pool. When KAM is deployed to a new endpoint, Kaseya License Manager always checks the partial license pool first. If a partial license is available, the partial license is used on the endpoint with the new install. If no partial licenses are available, Kaseya uses a full KAM license. Licenses begin their clock ticking on the first day they are installed. If uninstalled, the clock continues to tick on that license. By deploying these partial licenses for new installations of KAM, you can get the most out of each 1-year license. 4
Anti-Malware Columns The following columns are available to select when modifying any column set in the Explorer Grid (page 2). Select Column Set in the Control Panel (page 3) to modify a column set. Anti-Malware Active Detections - If Yes, detections exist that could not be automatically disinfected or deleted and require user attention. Agent Guid Str - The unique GUID of the Kaseya agent, in string format. Auto Extend - If checked, Auto Extend is enabled. Auto Extend automatically extends licensed security protection for the managed machine. If Anti-Malware is uninstalled from the machine and its licensed time period partially used, its partially-used license is automatically assigned to the next machine installed with Anti-Malware instead of a unused license. Components - Identifies the status of Anti-Malware components installed on this machine. Database Date - The date and time of the Anti-Malware definition database currently being used by this machine. Database Version - The version of the Anti-Malware definition database currently being used by this machine. Date Installed - The date Anti-Malware was installed. FileExecutionBlocking Status - Running or Stopped. The Enable protection when windows starts checkbox must be checked to Enable File Execution Blocking in the Profiles (page 8) page. Flags - Possible flags include: Definitions out of date Id - The unique GUID of the Kaseya agent, in numerical format. Install Phase Icon - If checked, Anti-Malware is installed on the machine. Install Schedule Date - The date Anti-Malware is scheduled to be installed. Install Status - Not Installed, Script Scheduled, Installed Installed - If checked, the Anti-Malware client is installed. Kam Assign Completed - If Yes, a KAM profile is assigned to the machine. Kam Protection Enabled - If Yes, protection is enabled on this machine. Last Updated - The date the Anti-Malware definition database was last updated. License Date - The date Anti-Malware security is scheduled to expire. Log File - Click the View Log link to display the log file from the last scan. Login Name - The currently logged on user. Name - The machine ID.group ID.organization ID of the machine. No Action - The number of detections in the scan that required not user action. Online Status - These icons indicate the agent check-in status of each managed machine. Hovering the cursor over a check-in icon displays the agent quick view window. Online but waiting for first audit to complete Agent online Agent online and user currently logged on. Agent online and user currently logged on, but user not active for 10 minutes Agent is currently offline Agent has never checked in Agent is online but remote control has been disabled The agent has been suspended Other - Number of detections that cannot be classified under any other category. Applies when Malwarebytes creates a new detection category that Anti-Malware does not yet recognize. Pending Actions - Icons representing install, assign, update and scan. 5
Profile - The Anti-Malware profile assigned to this machine. Profile Assignment Status - If Yes, a Anti-Malware profile is assigned to the machine. Program Version - The Malwarebytes version number of the Anti-Malware client installed on this machine. Protect Service Status - If Yes, the Malwarebytes service is running. Protection Status - If checked, protection is enabled. Reboot Needed - If Yes, a reboot is required. Resolved - The number of detections resolved automatically by Anti-Malware. Scan Phase - Scheduled, Running, Error, Complete, Processing Result Scan Scheduled Date - The date the next scan is scheduled to run. Service Status - The status of the Anti-Malware client. Service Version - The version of the Anti-Malware client. Show Tool Tip - If 1, then Show Tool Tips is enabled. If 0, Show Tool Tips is not enabled. See Agent > Edit Profile. Time Zone Offset - Displays the number of minutes. See System > Preferences. Tool Tip Notes - Displays the notes assigned to an agent. See Agent > Edit Profile. Transition Time - (obsolete - this column is being removed) Uninstall Schedule Date - The date/time the Anti-Malware client is scheduled to be uninstalled. Update Phase - The status of the update. Update Schedule Date - The date/time the Anti-Malware database definitions are scheduled to be updated. WebSiteBlocking Status - Running or Stopped. The Enable protection when windows starts checkbox must be checked to Enable Web Site Blocking in the Profiles (page 8) page. Details Panel Header Name - The machine ID.group ID.organization ID of the machine. OS - The operating system of the machine. Network - The subnetwork the machine is on. Anti-Malware tab Anti-Malware Summary Install Status - If checked, Anti-Malware security is installed. Select view log to view the log for the machine. Last Updated - The date and time the Anti-Malware client was last updated. Auto Extend - If checked, Auto Extend is enabled. Auto Extend automatically extends licensed security protection for the managed machine. If KAM is uninstalled from the machine and its licensed time period partially used, its partially-used license is automatically assigned to the next machine installed with KAM instead of a unused license. Profile - The Anti-Malware configuration profile assigned to this machine. License Expiration - The date Anti-Malware security is scheduled to expire. Installed On - The date the Kaseya agent was installed. MalwareBytes Status Component Status - Identifies the status of Anti-Malware components installed on this machine. Database Version - The version number of the Anti-Malware definition database. 6
Database Date - The date and time of the Anti-Malware definition database currently being used by this machine. Program Version - The Kaspersky version number of the Anti-Malware client installed on this machine. Messages If a failure/error occurs during the installation of Malwarebytes, the message displays here. Dashboards Actions Anti-Malware > Dashboards The Dashboards page provides a dashboard view of the status of machines installed with Anti-Malware. New - Creates a new dashboard. Save - Saves changes to the currently displayed dashboard. Dashboard - Selects a dashboard to display. Add Parts - Add sections to currently displayed dashboard. Dashboard Parts Add or delete individual parts to create custom dashboard views. KAM Automatic License Extension - A bar chart displays the number of machines that have autoextend applied to their license in 30, 60, 90 or 91+ days. KAM License Count - A bar chart displays the number of Anti-Malware licenses used and the number of machines pending an install. KAM License Expiration - A bar chart displays the number of machines that have expired licenses or will have expired licenses in 30, 60, 90 or 91+ days. KAM License Summary - A chart displays the number of machines that are Available, Expired, In Use, Partials and Pending Install. KAM Machines Needing Attention - A bar chart displays the number of Anti-Malware managed machines needing attention, by category. Categories include No AM Installed, With Uncured Threats, Out of Date, Reboot Needed, Component Status. KAM Machines with Detections - A bar chart displays the number of detections. KAM Protection Status - A pie chart displays percentage categories of machines with Anti-Malware protection. Percentage categories include Not Installed, Out of Date, Not Enabled, and Up to Date. KAM Top Threats - Lists the machines with the greatest number of threats. Clicking a hyperlinked machine ID displays the threats belonging to that machine ID in the Detections (page 7) page. Detections Anti-Malware > Detections The Detections page displays malware threats not automatically resolved by Anti-Malware. Use the information listed on this page to investigate threats further and manually remove them. Machine - The machine ID. Name - The name of the threat. Time - The date and time the threat was detected. 7
Status - The status of the threat. Type - The category of threat. Path - The location of the threat on the managed machine. Profiles Actions Anti-Malware > Profiles The Profiles page manages Anti-Malware profiles. Each profile represents a different set of enabled or disabled options. Changes to a profile affect all machine IDs assigned that profile. A profile is assigned to machine IDs using Anti-Malware > Machines (page 2). Typically different types of machines or networks require different profiles. A sample profile is provided for you. New - Creates a new profile. Open - Opens an existing profile for editing and review. Delete - Deletes an existing profile. Save - Saves changes to the currently selected profile. Adding / Editing Profiles Click New to display the New Profile window, or click an existing profile, then click Open to display the Edit Profile window. Summary Name - The name of the profile. Description - A description of the profile. Protection Options Enable Protection When Windows Starts - If checked, start protection module with windows. Enable File Execution Blocking - If checked, start file execution blocking when protection module starts. Enable Website Blocking - If checked, start malicious website blocking when protection module starts. Show tooltip when IP blocked - If unchecked, a tooltip balloon does not display to the user when a when a malicious website is blocked. Scan Options Restart the computer if needed as part of threat removal - If checked, restarts the computer to complete the removal of threats, if necessary. Automatically remove threats - If checked, automatically removes threats. Wake from sleep - If checked, attempts to wake the computer from sleep to perform a scheduled scan. Enable Advanced Heuristics engine - If checked, adds another layer of protection to detect new and unknown malware. Schedule Enabled - If checked, schedules a recurring scan. Frequency - Hourly, Daily, Weekly, Monthly, Once, On Reboot. Starting On - Date to start recurring scans. Time - Time to start recurring scans. Scan Type Flash - A flash scan analyzes memory and autorun objects. 8
Quick - A quick scan uses fast scanning technology to scan systems for malicious software. Full - A full scan scans all files on the selected drives. A quick scan is recommended in most cases. Recover if Missed by - The number of hours to attempt to run the scan again if the machine was unavailable to scan at the scheduled time. Repeating every - The number of weeks to repeat Recovery if Missed by if the machine remains unavailable to scan. Update Options Download and install program update if available - If checked, updates are downloaded and installed, if available. Use proxy server to download updates - If checked, uses a proxy server to download updates. Proxy server - Enter a valid proxy server name or IP address. Port - Enter a port number. Use Authentication - If checked, proxy authentication is required. Username - If Use Authentication is checked, enter a valid username. Password - If Use Authentication is checked, enter a valid password. Schedule Enabled - If checked, schedules a recurring update. Frequency - Hourly, Daily, Weekly, Monthly, Once, On Reboot. Starting On - Date to start recurring updates. Time - Time to start recurring updates. Recover if Missed by - The number of hours to attempt to run the update again if the machine was unavailable to update at the scheduled time. Repeating every - The number of days to repeat Recovery if Missed by if the machine remains unavailable to update. Wake computer from sleep to perform task - If checked, the machine will be wakened, if necessary, to perform the update. Run flash scan after successful update - If checked, runs a flash scan just after the update. Anti-Malware Statistics in the Executive Summary Report Info Center > Reports > Executive Summary The Executive Summary report includes a section called Anti-Malware for the following statistics. If no filtering is selected, statistics are for all machines in all groups in all organizations. The number of days is specified in the report definition. Summary Statistics Machine Installation Ratio - The number of machines installed with Anti-Malware compared to the total number of machines. Machines with full scans last <N> Days - The number of machines with Anti-Malware installed that have performed a full scan within <N> number of days. Machines needing attention - The number of machine requiring attention. Reasons machines may require attention include Anti-Malware not installed, uncured threats, out of date, reboot needed, missing component. Machines with unhandled detections - The number of machines that have at least one unhandled threat displayed in the Detections page. 9
Datebase Version and Date - The latest date of Anti-Malware definitions uploaded to the set of machines specified by this report. Performance Statistics Last <N> Days Total Objects Scanned - The number of files and system objects scanned. Total Detections - The number of handled and unhandled threats. Total New Installations - The number of new Anti-Malware installations. Total Flash Scans Completed - A flash scan analyzes memory and auto-run objects. Total Quick Scans Completed - A quick scan includes operating system startup objects. Total Full Scans Completed - A full scan includes system memory, programs loaded on startup, system backup, email databases, hard drives, removable storage media and network drives. Total Updates Completed - An update updates the Anti-Malware definitions on a machine. The Network Health Score of the Executive Summary includes an Anti-Malware category. The Anti-Malware rating is a composite score weighted as follows for each individual machine: Anti-Malware install percentage - 40% - Is Anti-Malware installed on the machine? Full scans run during the period - 40% - Has at least one Anti-Malware scan run during the period? Active threats - 20% - Has zero threats been detected during the period? After each machine Anti-Malware rating is determined, they are grouped into the following percentage buckets, which can be customized: 100%, 75%, 50%, 25%. You can adjust how heavily each category effects the total Network Health Score by adjusting the weight value for each category. Weights range from 0 to 100. Set the weight to zero to turn off that category. Anti-Malware - Anti-Malware Installation Statistics Info Center > Reports > Anti-Malware Displays only if the Anti-Malware add-on module is installed. The Anti-Malware Installation Statistics report definition generates reports for the following types of Anti-Malware data maintained by the VSA. Show Summary Table - Displays the number of machines installed with Anti-Malware per machine group. Installation details include the install date and version installed, per machine in each machine group. Show Installation Month Bar Chart - Displays a count of the number of machines installed with Anti-Malware, per month. 10
Index Index A Anti-Malware - Anti-Malware Installation Statistics 10 Anti-Malware Columns 5 Anti-Malware Overview 1 Anti-Malware Statistics in the Executive Summary Report 9 Anti-Malware System Requirements 1 C Control Panel 3 D Dashboards 7 Details Panel 6 Detections 7 E Explorer Grid 2 M Machines 2 P Page Layout 2 Profiles 8 11