MSSecurityEssentials

From WPKG | Open Source Software Deployment and Distribution
Jump to: navigation, search

Microsoft Security Essentials, available from http://www.microsoft.com/security_essentials/, protects from viruses, spyware, and other malicious software.

Microsoft Security Essentials is licensed for use only by home users, and "small businesses" that install it on up to 10 devices (see http://www.microsoft.com/security_essentials/eula.aspx#mainNav). For other use cases Microsoft's equivalent product is Forefront Client Security.

Contents

[edit] WPKG Package

This is a silent installer and uninstaller for Microsoft Security Essentials (Windows XP, US English, 32-bit version), different binaries are available for other systems.

<package
	id="microsoft-security-essentials"
	name="Microsoft Security Essentials"
	revision="4"
	reboot="false"
	priority="1">
 
	<check
		type="uninstall"
		condition="exists"
		path="Microsoft Security Essentials"/>
 
	<install
		cmd='%SOFTWARE%\microsoft-security-essentials\mseinstall.exe /s /runwgacheck' />
 
	<upgrade
		cmd='%SOFTWARE%\microsoft-security-essentials\mseinstall.exe /s /runwgacheck /o' />
 
	<remove
		cmd='%SOFTWARE%\microsoft-security-essentials\mseinstall.exe /s /u'/>
</package>

Note that an upgrade line is required because although the program updates itself automatically using Windows Automatic Updates (though only for minor updates, not upgrades such as from version 1 to 2), if you bump the revision number then WPKG will want to run an 'upgrade'.

[edit] Alternate package with registry edits and 64-bit aware

This is an alternate installation package with the following changes:

<package
        id="microsoftsecurityessentials"
        name="Microsoft Security Essentials"
        revision="4.3.0219"
        reboot="false"
        priority="1">
 
        <check
                type="uninstall"
                condition="exists"
                path="Microsoft Security Essentials"/>
 
        <variable name="INSTALLER_NAME" value="mseinstall.exe" />
        <variable name="INSTALLER_NAME" value="mseinstall_64.exe" architecture="x64" />
 
        <install cmd='%SOFTWARE%\microsoftsecurityessentials\%INSTALLER_NAME% /s /o /runwgacheck' />
 
        <!-- Change the registry permissions to allow Administrator to edit these registry entries.  Unneeded if you're running as SYSTEM (e.g. wpkg client) -->
        <install cmd='%SOFTWARE%\microsoftsecurityessentials\SetACL.exe -on "hklm\software\Microsoft\Microsoft Antimalware\Scan" -ot reg -actn ace -ace "n:Administrators;p:full"' />
        <install cmd='%SOFTWARE%\microsoftsecurityessentials\SetACL.exe -on "hklm\software\Microsoft\Microsoft Antimalware\Exclusions\Paths" -ot reg -actn ace -ace "n:Administrators;p:full"' />
 
        <!-- Change registry settings on these registry entries -->
        <install cmd='%COMSPEC% /C REG ADD "HKLM\Software\Microsoft\Microsoft Antimalware\Scan" /v ScheduleDay /t REG_DWORD /d 0x00000000 /f' />
        <install cmd='%COMSPEC% /C REG ADD "HKLM\Software\Microsoft\Microsoft Antimalware\Scan" /v ScheduleTime /t REG_DWORD /d 0x000003c0 /f' />
        <install cmd='%COMSPEC% /C REG ADD "HKLM\Software\Microsoft\Microsoft Antimalware\Scan" /v ScanOnlyIfIdle /t REG_DWORD /d 0x00000000 /f' />
        <!-- This whitelists UltraVNC.exe -->
        <install cmd='%COMSPEC% /C REG ADD "HKLM\Software\Microsoft\Microsoft Antimalware\Exclusions\Paths" /v "C:\Program Files\UltraVNC\winvnc.exe" /t REG_DWORD /d 0x00000000  /f' />
        <install cmd='%COMSPEC% /C REG ADD "HKLM\Software\Microsoft\Microsoft Antimalware\Exclusions\Paths" /v "C:\Program Files\uvnc bvba\UltraVNC\winvnc.exe" /t REG_DWORD /d 0x00000000  /f' />
 
        <!-- Set the registry permissions back the way they were -->
        <install cmd='%SOFTWARE%\microsoftsecurityessentials\SetACL.exe -on "hklm\software\Microsoft\Microsoft Antimalware\Scan" -ot reg -actn ace -ace "n:Administrators;p:read"' />
        <install cmd='%SOFTWARE%\microsoftsecurityessentials\SetACL.exe -on "hklm\software\Microsoft\Microsoft Antimalware\Exclusions\Paths" -ot reg -actn ace -ace "n:Administrators;p:read"' />
 
        <upgrade include="install" />
 
 
        <remove
                cmd='%SOFTWARE%\microsoftsecurityessentials\%INSTALLER_NAME% /s /u'/>
</package>


[edit] Installer command-line switches

--80.36.75.112 18:13, 30 August 2013 (CEST)==Error Codes==

[edit] White-listing

See http://www.microsoft.com/security_essentials/HelpTopic.aspx?mkt=en-tt&assetid=f1b60a57-20d6-466e-b817-9e998a7d8a8c.

Soon after installation MSE can recognise potentially useful software as a threat. For example if you have UltraVNC installed it will flag up UltraVNC.exe. There's a risk that a user, when prompted, will choose to remove or quarantine such files and remove the administrator's ability to connect. Administrative users can allow, quarantine or remove suspicious files where as Limited users can only remove or quarantine suspicious files. Administrators will want to white-list any such programs that should not be considered a threat, upon installation.

White-listing can be performed manually using: Show details → Recommendation → Select an action → Allow → Apply actions (note that Close means 'don't take any action at this point') → Close. This is saved system-wide.

White-listing is saved in the registry so can be automated in any of the usual ways, see the registry editing section.

Relevant white-listing registry settings are:

"Exclude files that are accessed by processes such as programs ... For example, if you don't want Microsoft Security Essentials to scan files that are accessed by Windows Live Messenger, add Messenger.exe to the list of excluded processes.". Add .exe, .cmd, .bat, .pif, .scf or .scr files.
The registry key is HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Processes

Exclude particular files and/or locations from the scan.
The registry key is HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Paths

Exclude particular files types / extensions from the scan.
The registry key is HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Extensions

For a list of recommended files and file types to exclude see Virus scanning recommendations for Enterprise computers that are running currently supported versions of Windows.

Continuing with the above example to allow UltraVNC, a .reg registry file would look like this:

Windows Registry Editor Version 5.00
 
; Set an exclusion path for winvnc.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Paths]
"C:\\Program Files\\UltraVNC\\winvnc.exe"=dword:00000000

[edit] Permissions

Note that 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware' is read-only for all users apart from SYSTEM. If you use a script, such as a batch file, to alter Microsoft Antimalware registry settings then it will need to run as SYSTEM, which WPKG Client does.

[edit] References

* Silent Install 
* how to uninstall MSE if need arises?

[edit] Updates

[edit] Virus Definition Updates

Virus definition updates for MSE are automatically downloaded and incorporated by the program, or via Windows Automatic Updates.

To download the Microsoft Forefront Client Security antimalware definition update file (Mpam-fe.exe) for 32-bit (x86-based) versions of Windows, go to http://go.microsoft.com/fwlink/?LinkID=87342&clcid=0x409 and for 64-bit versions of Windows go to http://go.microsoft.com/fwlink/?LinkID=87341&clcid=0x409

To run the Microsoft Forefront Client Security antimalware definition update file in silent mode: Mpam-fe.exe -q

[edit] Program Updates

For minor updates, the Microsoft Security Essentials program updates itself or is updated through Windows Automatic Updates. for Major upgrades, such as from version 1.x to version 2.0, the program must be upgraded manually by an Administrator (not sure about Power User), not by a Restricted / Limited user. Either using Help → Check for software updates, or after being on for an amount of time, the software will prompt for an upgrade, choosing this as a Restricted / Limited user does nothing.

I don't know of a way to determine the installed version, to base WPKG updates off.

Personal tools
Namespaces
Variants
Actions
Navigation
ideas?
Toolbox