Difference between revisions of "MSSecurityEssentials"

Revision as of 14:26, 9 May 2011

Microsoft Security Essentials, available from http://www.microsoft.com/security_essentials/, protects from viruses, spyware, and other malicious software.

Microsoft Security Essentials is licensed for use only by home users, and "small businesses" that install it on up to 10 devices (see http://www.microsoft.com/security_essentials/eula.aspx#mainNav). For other use cases Microsoft's equivalent product is Forefront Client Security.

WPKG Package

This is a silent installer and uninstaller for Microsoft Security Essentials (Windows XP, US English, 32-bit version), different binaries are available for other systems.

<package
	id="microsoft-security-essentials"
	name="Microsoft Security Essentials"
	revision="3"
	reboot="false"
	priority="1">

	<check
		type="uninstall"
		condition="exists"
		path="Microsoft Security Essentials"/>

	<install
		cmd='%SOFTWARE%\microsoft-security-essentials\mssefullinstall-x86fre-en-us-xp.exe /s /runwgacheck' />

	<upgrade
		cmd='%SOFTWARE%\microsoft-security-essentials\mssefullinstall-x86fre-en-us-xp.exe /s /runwgacheck /o' />

	<remove
		cmd='%SOFTWARE%\microsoft-security-essentials\mssefullinstall-x86fre-en-us-xp.exe /s /u'/>
</package>

Note that an upgrade line is required because although the program updates itself automatically using Windows Automatic Updates, if you bump the revision number then WPKG will want to run an 'upgrade'.

Installer command-line switches

• /s - perform a silent installation

• /runwgacheck - automatically perform a Windows Genuine Advantage check

• /o - don't automatically run the updater and the system scan after installation - when you then login it may then give a red indicator and say that real time protection is off because virus definition files are out of date. I've had a few differing experiences at this point, either it updates them quickly automatically, or if you click on the notification area icon it tells you it's out of date but then updates it quickly, or it displays this then just waits for you to manually press the 'Update' button. This is as both an Administrator and as a Limited User.

• /u - uninstall

Error Codes

• -2147156138 - Windows XP SP2, extra package required - http://support.microsoft.com/kb/914882?mkt=en-us
• -2147156213 - Windows hasn't been activated or WGA validation failed
• 327426 - program already installed

White-listing

See http://www.microsoft.com/security_essentials/HelpTopic.aspx?mkt=en-tt&assetid=f1b60a57-20d6-466e-b817-9e998a7d8a8c.

Soon after installation MSE can recognise potentially useful software as a threat. For example if you have UltraVNC installed it will flag up UltraVNC.exe. There's a risk that a user, when prompted, will choose to remove or quarantine such files and remove the administrator's ability to connect. Administrative users can allow, quarantine or remove suspicious files where as Limited users can only remove or quarantine suspicious files. Administrators will want to white-list any such programs that should not be considered a threat, upon installation.

White-listing can be performed manually using: Show details → Recommendation → Select an action → Allow → Apply actions (note that Close means 'don't take any action at this point') → Close. This is saved system-wide.

White-listing is saved in the registry so can be automated in any of the usual ways, see the registry editing section.

Relevant white-listing registry settings are:

• Excluded processes.

"Exclude files that are accessed by processes such as programs ... For example, if you don't want Microsoft Security Essentials to scan files that are accessed by Windows Live Messenger, add Messenger.exe to the list of excluded processes.". Add .exe, .cmd, .bat, .pif, .scf or .scr files.
The registry key is HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Processes

• Excluded paths.

Exclude particular files and/or locations from the scan.
The registry key is HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Paths

• Excluded file types.

Exclude particular files types / extensions from the scan.
The registry key is HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Extensions

For a list of recommended files and file types to exclude see Virus scanning recommendations for Enterprise computers that are running currently supported versions of Windows.

Continuing with the above example to allow UltraVNC, a .reg registry file would look like this:

Windows Registry Editor Version 5.00

; Set an exclusion path for winvnc.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Paths]
"C:\\Program Files\\UltraVNC\\winvnc.exe"=dword:00000000

Permissions

Note that 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware' is read-only for all users apart from SYSTEM. If you use a script, such as a batch file, to alter Microsoft Antimalware registry settings then it will need to run as SYSTEM, which WPKG Client does.

References

* Silent Install 
* how to uninstall MSE if need arises?

Updates

Virus Definition Updates

Virus definition updates for MSE are automatically downloaded and incorporated by the program, or via Windows Automatic Updates.

To download the Microsoft Forefront Client Security antimalware definition update file (Mpam-fe.exe) for 32-bit (x86-based) versions of Windows, go to http://go.microsoft.com/fwlink/?LinkID=87342&clcid=0x409 and for 64-bit versions of Windows go to http://go.microsoft.com/fwlink/?LinkID=87341&clcid=0x409

To run the Microsoft Forefront Client Security antimalware definition update file in silent mode: Mpam-fe.exe -q

Program Updates

For minor updates, the Microsoft Security Essentials program updates itself or is updated through Windows Automatic Updates. for Major upgrades, such as from version 1.x to version 2.0, the program must be upgraded manually by an Administrator (not sure about Power User), not by a Restricted / Limited user. After being on for an amount of time, the software will prompt for an upgrade, choosing this as a Restricted / Limited user does nothing.