McAfee free tool GETSUSP.EXE (Cloud scanner for URL and files)

 

Hallo,

 

Es gibt einen neuen Release eines Tools mit welchen man Clients scannen kann und alles was es nicht kennt (spanisch vorkommt) vollautomatisch zu Mcafee GTI sendet. Man kann damit unbekannte Files an McAfee einsenden zur Analyse.

Falls man eine E-Mail Adresse angibt bekommt man am Schluss den Report nach der Analyse. Die Files welche integriert sind kennt Mcafee GTI-CLOUD und alle Produkte «handeln» diese dann als sicherer und effektiver.

 

Das Tool macht 20% der 100% Feature vom grossen ENS und zeigt dann auch wie schnell ENS wäre wenn man nur Muster suchen würde.

 

Einziger Nachteil es sollte jeweils aktuell sein. Also wenn man es braucht dann bitte neu downloaden. Dafür ist es ein Single EXE und man kann damit URL, Office/PDF oder CUSTOM Directory scannen.

 

https://www.mcafee.com/enterprise/en-us/downloads/free-tools/terms-of-use.html?url=https://downloadcenter.mcafee.com/products/mcafee-avert/getsusp/getsusp64.exe

 

  • Was Mcafee GTI nicht kennt frägt er am Schluss und macht automatisch (Ohne Mcafee NAI Vertrag) ein Upload zu Mcafee.
  • Falls man es im Enterprise Bereich braucht bitte unter Preference den Proxy eintragen.

 

Falls die Files in Ordnung sind kennen dann Mcafee und alle Security Alliance Partner das File (Trend, Symantec). Ebenso die Firmen welche von den drei grossen Echtzeit Patterns einkaufen und tauschen. Mcafee VSE ENS kennt dann die Files

und stuft diese sicherer ein.

 

 

How to Use GetSusp | McAfee Free Tools

https://www.mcafee.com/enterprise/en-in/downloads/free-tools/how-to-use-getsusp.html

 

 

 

 

Proxy und wenn Ihr Infos wollt WANN McAfee die Files analysiert hat….

 

McAfee Security for Exchange 8.6, Display Bug warning Dat out of date

EPO integrated McAfee Security for Exchange 8.6 SP2

If you have a fully integrated Mcafee Security for Exchange which you manage the POLICY and SETTINGS from the EPO (Not on the Exchange itself)

you may see an error in the GUI where it says "Your Anti-Virus DAT may be out of DATE".

That is just the warning if check the DAT it's fine and up to date.

DAT Update Button in GUI on Exchange itself does not seem to update

The server actually has the latest DAT. As example on the left side below you see 9730 which is the DAT from 31.08.2020 as example.

Just the Update function does not understand the server received the DAT from the EPO instead from WAN.

Often Exchange behind Load Balancer like Kemp or F5 have limited WAN Internet access.

Some Tips:

  • On smaller Exchange > Sometimes you can solve this by changing the Schedule like from 08:00 to 08:01 (Just add a minute) And update > Maybe fine
  • If not behind Load Balancer > You may have to check your WAN access from the Exchange Server and if he can get the DAT from Mcafee
  • If you download the DAT manual from Mcafee and try to install you will see that you already have the newest version.

Screenshot from 1. September 2020

Check in EPO under Products

If you can't get it to working for whatever reason, PUSH the DAT from McAfee EPO direct to the Exchange Server

where McAfee Security for Exchange runs. The Error in the GUI will stay.

McAfee ENS WEB CONTROL outlook.exe chart.dll crash

 

01.09.2020, this is solved in 10.7.0.1607 JULY 2020 Release

Produktversion (Endpoint Security Platform)

10.7.0.1961 JUL 2020 Release

Produktversion (Endpoint Security Threat Prevention)

10.7.0.2021 JUL 2020 Release

Web Control

10.7.0.1607 JUL 2020 Release

 

 

 

On several W10 machines we have seen Outlook.exe crash with Mcafee ENS Endpoint Security 10.7 Web Control active.

This behavior is seen up to Release 10.7.0.1675 and HOTFIX 10.7.0.1733 on 19.05.2020 and is because of the function "E-Mail annotations" in Mcafee Web Control Module from ENS (Endpoint security).

This function will check existing URL in existing E-Mail and if the URL is Malicious Block or warn the user WITHIN the E-Mail.

For Mcafee to draw that warning it needs chart.dll. On some systems there is know old story with mix of chart.dll (We are unsure of 32/64 or language MIX like German and English lead finally MS side to this error but Google is full of it). Mainly it's because Windows itself has a chart.dll and there is a version from Office. Those are different.

Error your see:

"Required file chart.dll not found in your path. Install Microsoft Outlook again"

"Die erfoderliche Datei chart.dll wurde"

Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

 

Event

Name der fehlerhaften Anwendung: OUTLOOK.EXE, Version: 16.0.4954.1000, Zeitstempel: 0x5df956bf

Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 10.0.18362.628, Zeitstempel: 0x54734dee

Ausnahmecode: 0xc06d007e

Fehleroffset: 0x00113db2

ID des fehlerhaften Prozesses: 0x2bac

Startzeit der fehlerhaften Anwendung: 0x01d5e67e5d8b1520

Pfad der fehlerhaften Anwendung: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXE

Pfad des fehlerhaften Moduls: C:\WINDOWS\System32\KERNELBASE.dll

Berichtskennung: 55ace164-ec8b-4166-8170-8616d13f0366

Vollständiger Name des fehlerhaften Pakets:

Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

 

Version 16.0.4924.1000 +"chart.dll"

 

For Mcafee to draw that warning it needs chart.dll. On some systems there is know old story with mix of chart.dll (We are unsure of 32/64 or language MIX like German and English lead finally MS side to this error but Google is full of it). Mainly it's because Windows itself has a chart.dll and there is a version from Office. Those are different.

You can see what happens here. The YELLOW is when it does not find the chart.dll at that certain path.

 

 

SOLUTION:

McAfee ENS > Web Control > Optionen > Advanced Options > TURN off the FIRST OPTION (Uncheck)

View German Mcafee ENS

View EPO Policy English

 

This is what the function does. It highlights malicious URL. Here a sample from a Mcafee SECURITY FOR Exchange

Alert warning which had a malicious URL link. (This is a double alert but just to show what we talk about)

 

 

 

 

You don't have to reinstall Outlook.exe, Office, or ENS Modules. Just turn off the option.

Some Links with chart.dll (Not related to McAfee)

https://answers.microsoft.com/en-us/office/forum/office_2016-outlook/2016-outlook-has-error-message-required-file/772b47c6-ead1-4d6f-9ad1-41da627cb9c7

Links with Mcafee at askwoody.com

https://www.askwoody.com/forums/topic/outlook-2016-and-chart-dll-error-multiple-pcs/

https://community.mcafee.com/t5/Endpoint-Security-ENS/Outlook-2016-and-chart-dll-error/m-p/651239

McAfee EPO Server SQL Server Performance tips

 

 

McAfee EPO Server SQL Server Performance tips

This is based on McAfee Information for their McAfee EPO DB running under SQL 2005/2008R2/2012 upwards

The EPO Database itself should be:

Autoshrink = False

Auto Close = False

Auto update Statistics = True

 

Auto shrink and auto close are database options that should be set to false. Auto update statistics should be set to true, except for very rare circumstances where the update of statistics is hindering the query performance and there is a customized manner to update statistics on a different interval. See the Performance Optimizer Product Guide for details on how to configure these database options.

 

File auto growth DB Files 256MB, unlimited

File auto growth DB Log files 128MB, unlimited

 

This is just a base recommandation. We learned back with NT4 and RAID Setup that this is important to calculate blocksize. Ask your Storage, VMware people if they still know anything about it. You will be suprised how much they know or not.

 

The file growth settings for the ePO and tempdb databases should be set to auto-grow by 256MB for data files and 128MB for log files. The maximum size should be set to unlimited. It is not recommended to use the auto-grow by percent as it can lead to subsequently larger file growths. See the Performance Optimizer Product Guide for more details.

 

Yes we know, spend CHF 20'000.- for another SSD Raid or shelf and ask your Manager.

Data files and log files should be placed onto separate disks for maximum I/O throughput. See the Performance Optimizer Product Guide for more details.

 

Index and Fragmentation

Indexes with fragmentation greater than 30% should be rebuilt. Fragmentation between 20%-30% requires that the index be reorganized. Optimal index performance is achieved when fragmentation is removed on a regular schedule. See KB67184 and the Performance Optimizer Product Guide for more information.

Review the server task action settings. See the McAfee ePO Product Guide for the chapter on configuring server tasks. If the server task has been provided by a point product, review the guide for that product to ensure that all configuration settings are correct.

Review the scheduled server tasks. If too many server tasks are scheduled to run at the same time, reschedule some for a different time. See the McAfee ePO Product Guide for the chapter on configuring server tasks.

Please see our other McAfee EPO Enterprise PRO Tips

http://www.butsch.ch/post/MCAFEE-EPO-SQL-shrink-large-files-in-small-steps.aspx

http://www.butsch.ch/post/Mcafee-EPO-Server-4X-Database-or-Space-growing-EPOevents.aspx

http://www.butsch.ch/post/Mcafee-EPO-Server-45-Upgrade-to-46-mit-SQL-Express-2005-SP2-to-SP4.aspx

If you need commercial help with McAfee EPO/TIE/DLP/ATD Migration contact us.

 

Spectre – Meltdown - MS Bluescreen - Microsoft says AV producer has to Set Registry Flag

06.01.2018, 01:33 CET, Europe

Do not set the specific Registry key that Microsoft announced a few days ago manual until you checked 100% and understood what it does. This was wrongly interpreted and understood by several blogs and even larger news agencies. The way it should be done (As seen by Microsoft on Friday) is that the Antivirus producer will set the specific registry flag key which will make the Update available to you by download from Windows Update direct. You can also download from Windows Update catalog if you did this THEN (This weekend) on one machine. We recommend waiting with patching W7/W10 until Monday and this is clearer.

From our point of view it's unclear as example what people with W10, 1709 Fall Creators Update with Edge in Hypervisor Sandbox and Windows Defender should do (And thus no other AV software)?

There all comes from Microsoft? Anybody seen that update there?

 

Attention:

Microsoft clearly states that there have been Bluescreen on some machines. A thing most of you forgot and did not see since years. Several blogs the specific update caused problems even while installing. They only way to install it via wusa.exe and command line PLUS at the end kill server hanging tasks with scripts.

 

Note Customers will not receive the January 3, 2018, security updates and will not be protected from current security vulnerabilities unless their antivirus software sets the following registry key:

Microsoft has identified a compatibility issue with a small number of antivirus software products.

The compatibility issue arises when antivirus applications make unsupported calls into Windows kernel memory. These calls may cause stop errors (also known as blue screen errors) that make the device unable to boot. To help prevent stop errors that are caused by incompatible antivirus applications, Microsoft is only offering the Windows security updates that were released on January 3, 2018, to devices that are running antivirus software that is from partners who have confirmed that their software is compatible with the January 2018 Windows operating system security update.

If you have not been offered the security update, you may be running incompatible antivirus software, and you should consult the software vendor.

Microsoft is working closely with antivirus software partners to ensure that all customers receive the January Windows security updates as soon as possible.

More Information

Note Customers will not receive the January 3, 2018, security updates and will not be protected from current security vulnerabilities unless their antivirus software sets the following registry key:

Do not set the Specific Registry key that Microsoft announced a few days ago manual and if so ONLY if you validated that all your security products are compatible and listed on producer special KB or blog entry.

As per MS the producer of the AV Software has to do so after final testing

Key=HKEY_LOCAL_MACHINE

key=SOFTWARE\Microsoft\Windows\CurrentVersion\QualityCompat

Value=cadca5fe-87d3-4b96-b7fb-a231484277cc

Type=REG_DWORD

 

Since we recommend Mcafee here is there actual list which runs fine with the Update.

Mcafee 06.01.2018

The following products have been tested and are confirmed as compatible

Testing is ongoing for all McAfee products and no compatibility issues with the Microsoft update have been found so far. We expect all of our testing to be complete on endpoint products by End of Day Monday, January 8th.

 

* Data Exchange Layer (DXL) 3.1.0 and later

* Data Loss Prevention 9.4 and later

* Drive Encryption 7.0 and later

* ePolicy Orchestrator 5.9 and later (Sadly no Enterprise runs 5.9 ;-)

* Endpoint Security 10.2 and later

* File and Removable Media Protection 5.0.4 and later

* Host IPS 8.0 Patches 4, 7, 9, 10

* McAfee Active Response 1.1 and later

* McAfee Agent 4.8 Patch 3 and later

* McAfee Application Control 6.2.0 and later

* McAfee Client Proxy 1.2 and later

* MOVE 4.5 and later

* Native Encryption (MNE) 4.0 and later

* SiteAdvisor Enterprise 3.5 Patch 5 and later

* System Information Reporter (SIR) 1.0.1 and later

* Threat Intelligence Exchange (TIE) Client for VSE 1.0.2 and later

* VirusScan Enterprise 8.8 Patches 4, 8, 9, and 10

* VirusScan Enterprise for Storage 1.2 and later