Introducing Vulnerability Scanner

Use Vulnerability Scanner to detect installed antivirus solutions, search for unprotected computers on your network, and install OfficeScan™ clients on your network. To determine if computers are protected, Vulnerability Scanner pings ports normally used by antivirus solutions.

Vulnerability Scanner can perform the following functions:

  • Monitor the network for Dynamic Host Configuration Protocol (DHCP) requests so that when computers first log on to the network, Vulnerability Scanner can determine their status.

  • Ping computers on your network to check their status and retrieve their computer names, platform versions, and descriptions.

  • Determine the antivirus solutions installed on the network. Vulnerability scanner can detect Trend Micro™ products and third-party antivirus solutions (including Norton AntiVirus™ Corporate Edition and McAfee™ VirusScan™ ePolicy Orchestrator™).

  • Send scan results through email or export results to a comma-separated value (CSV) data file.

You can also automate Vulnerability Scanner by creating a scheduled scan. For information on how to automate Vulnerability Scanner, see Creating scheduled tasks.

Notes:

  • You cannot run Vulnerability Scanner on computers running the following operating systems:

  • Windows™ NT 4

  • Windows XP Home and Professional Editions

  • Windows 2000 with Terminal Server

  • To run Vulnerability Scanner on a computer other than the OfficeScan server computer, go to the server computer and copy the TMVS folder in \PCCSRV\Admin\Utility to the other computer.

  • Vulnerability Scanner does not install the OfficeScan client on computers that already has the OfficeScan server or other antivirus products installed.

Copyright © 1998-2007 Trend Micro Incorporated. All rights reserved.


Running Vulnerability Scanner

Select the products to check for on your network. To prevent false alarms, Trend Micro recommends selecting all check boxes. Click Settings next to the product name to verify the port number that Vulnerability Scanner will check.

You can manually configure the port settings for each product (except ServerProtect™ for Linux™ and McAfee VirusScan ePolicy Orchestrator).

How OfficeScan checks antivirus products:

a. OfficeScan client

Vulnerability Scanner uses the OfficeScan client port to check if OfficeScan client is installed or not. It also checks if the TMListen.exe process is running. It retrieves the port number automatically if executed from its default location.

If TMVS is run on a different computer, check and then use the computer's communication port.

b. ServerProtect for Windows NT

Vulnerability Scanner uses RPC endpoint to check if SPNTSVC.exe is running. It returns information including operating system, and Virus Scan Engine, Virus Pattern and product versions. Vulnerability Scanner cannot detect the ServerProtect Information Server and ServerProtect Management Console.

c. ServerProtect for Linux

If the target computer does not run Windows, Vulnerability Scanner checks if it has ServerProtect for Linux installed by trying to connect to port 14942.

d. ScanMail™ for Microsoft Exchange

Vulnerability Scanner loads the Web page http://ipaddress:port/scanmail.html to check for ScanMail installation. By default, ScanMail uses port 16372. If ScanMail uses a different port number, specify the port number. Otherwise, Vulnerability Scanner cannot detect ScanMail for Exchange.

e. InterScan™ family

Vulnerability Scanner loads each Web page for different products to check for product installation.

InterScan Messaging Security Suite 5.x: http://localhost:port/eManager/cgi-bin/eManager.htm

InterScan eManager 3.x: http://localhost:port/eManager/cgi-bin/eManager.htm

InterScan VirusWall 3.x: http://localhost:port/InterScan/cgi-bin/interscan.dll

f. PortalProtect

Vulnerability Scanner loads the Web page http://localhost:port/PortalProtect/index.html.

g. Norton Antivirus Corporate Edition

Supported versions include 7.5, 7.6 and 8.0.

Vulnerability Scanner sends a special token to UDP port 2967, the default port of Norton Antivirus Corporate Edition RTVScan. The computer with this antivirus product replies using a special token type. Since Norton Antivirus Corporate Edition communicates by UDP, the accuracy rate is not guaranteed. Furthermore, network traffic may influence UDP waiting time.

h. McAfee VirusScan ePolicy Orchestrator

Supported versions include 6.0, 6.01 and 6.02.

Vulnerability Scanner sends a special token to TCP port 8081, the default port of ePolicy Orchestrator for providing connection between the server and client. The computer with this antivirus product replies using a special token type. Vulnerability Scanner cannot detect the standalone McAfee VirusScan.

Protocol consideration:

RPC: Detects ServerProtect for NT

UDP: Detects Norton AntiVirus Corporate Edition clients

TCP: Detects McAfee VirusScan ePolicy Orchestrator

Detects computers by sending ICMP packets

HTTP: Detects OfficeScan clients

DHCP: If it detects a DHCP request, Vulnerability Scanner checks if antivirus software has already been installed on the requesting computer.

Quick retrieval retrieves only the computer name. Normal retrieval takes longer to complete since it retrieves both domain and computer information. If you select Normal retrieval, set Vulnerability Scanner to try to retrieve computer descriptions, if available.

To automatically send the results to yourself or to other administrators in your organization, select Email results to the system administrator, and then click Configure to specify your email settings.

  • In To, type the email address of the recipient.

  • In From, type your email address. This will let the recipient know who sent the message.

  • In SMTP server, type your SMTP server address. For example, you can type smtp.company.com. The SMTP server information is required.

  • In Subject, type a new subject for the message or accept the default subject.

Click OK to save your settings.

You can also choose to Display a notification on unprotected computers. Click Customize to set the notification message. In the Notification Message screen, type a new message or accept the default message. Click OK.

You can choose to Automatically save the results to a CSV file. To change the default folder for saving the CSV file, click Browse, select a target folder on your computer or on the network, and then click OK.

Enable Vulnerability Scanner to ping computers on the network to get their status. To specify how Vulnerability Scanner will send packets to the computers and wait for replies, select Allow Vulnerability Scanner to ping computers on your network to check their status, then accept the default settings or type new values in the Packet size and Timeout text boxes.

You can also allow Vulnerability Scanner to Detect the type of operating system using ICMP OS fingerprinting.

Type the OfficeScan server name and port number. You can allow Vulnerability Scanner to Auto-install OfficeScan Client on unprotected computer.

Click Install to Account to configure the account. In the Account Information screen, type a user name and password that permits installation. Click OK.

You can also allow Vulnerability Scanner to Send logs to the OfficeScan server.

DHCP settings configurable in the TMVS.ini file:

DhcpThreadNum=x

Specify the thread number for DHCP mode.

The minimum is 3, maximum is 100. The default value is 3.

DhcpDelayScan=x

This is the delay time in seconds before checking the requesting computer for installed antivirus software.

The minimum is 0 (do not wait), maximum is 600. The default value is 60.

[OfficeScan Server Setting]

LogReport=x

0 disables log, 1 enables log. Vulnerability Scanner sends the results of the scan to the OfficeScan server and the logs display in the System Event Logs screen of the Web console.

OsceServer=x

This is the OfficeScan server's IP address or DNS name.

OsceServerPort=x

This is the Web server port on the OfficeScan server.

Running Vulnerability Scanner

You can use Vulnerability Scanner on computers running Windows 2000 and Server 2003. However, the computers should not run Terminal Server.

Vulnerability Scanner sometimes uses ports to detect installed antivirus software. Verify that the antivirus port is not protected by a personal or application firewall.

To run Vulnerability Scanner:

  1. In the drive where you installed OfficeScan server, go to OfficeScan\PCCSRV\Admin\Utility\TMVS.

  2. Double-click TMVS.exe. The Trend Micro Vulnerability Scanner console appears.

  3. To modify any of the Vulnerability Scanner settings, click Settings.

  4. Product query. More >>

  5. Method for retrieving computer descriptions. More >>

  6. Notifications. More >>

  7. Save results. More >>

  8. Ping settings. More >>

  9. OfficeScan server settings. More >>

  4. Click OK to save your settings.

To run a manual vulnerability scan on a range of IP addresses:

  1. Under Manual Scan, type the IP address range of the computers you want to check.

  2. Note: Vulnerability Scanner only supports a class B IP address range, for example, 168.212.1.1 to 168.212.254.254.

  2. Click Start. The vulnerability scan results appear in the Results table under the Manual Scan tab.

  3. To save the results to a comma-separated value (CSV) file, click Export, locate the folder where you want to save the file, type the file name, and click Save.

To run a vulnerability scan on computers requesting IP addresses from a DHCP server:

Vulnerability Scanner listens on port 67 (DHCP Server listening port for DHCP requests). If it detects a DHCP request, Vulnerability Scanner can check for the presence of antivirus software on the requesting computer. You may configure DHCP settings in the TMVS.ini file. More >>

  1. In the Results table, click the DHCP Scan tab.

  2. Click Start. Vulnerability Scanner begins listening for DHCP requests and performing vulnerability checks on computers as they log on to the network.

When it detects an unprotected computer and verifies that the computer's IP address belongs to the defined IP address range, Vulnerability Scanner runs remote installation to install the OfficeScan client.

  3. To save the results to a comma-separated value (CSV) file, click Export, locate the folder where you want to save the file, type the file name, and click Save.

Copyright © 1998-2007 Trend Micro Incorporated. All rights reserved.


Creating a Scheduled Task

Scheduling tasks in Vulnerability Scanner allows you to periodically check the network for installed antivirus solutions. This is a convenient way of running tasks automatically, without having to configure Vulnerability Scanner every time.

To create a scheduled task:

  1. Under Scheduled Scan, click Add/Edit. The Scheduled Scan screen appears.

  1. Name: Type a name for the scheduled scan.

  2. IP address range: Type the IP address range of the computers you want to check.

  3. Start time: Type or select the time when the scan will run. Use the 24-hour clock format.

  4. Frequency: Select how often the scan will run.

If you click Weekly, you must select a day from the list.

If you click Monthly, you must select the day of the month the scan will run.

  5. Settings: Click Use current settings to use your existing settings, or click Modify settings.

If you click Modify settings, click Settings to change the configuration.

  6. Click OK to save your settings. The scheduled scan you created appears under Scheduled Scan.

  2. To execute the scheduled scan immediately, click Run Now.

Copyright © 1998-2007 Trend Micro Incorporated. All rights reserved.


Configuring Other Settings

You can only configure the following settings by modifying TMVS.ini:

  • Debug: Enable or disable the debug log

  • EchoNum: Set the number of computers that Vulnerability Scanner simultaneously pings

  • ThreadNumManual: Set the number of computers that Vulnerability Scanner simultaneously checks for antivirus software

  • ThreadNumSchedule: Set the number of computers that Vulnerability Scanner simultaneously checks for antivirus software when running scheduled tasks

To modify the settings:

  1. Open the TMVS folder and look for TMVS.ini.

  2. Open TMVS.ini using Notepad or any text editor.

  3. To enable the debug log, change the value from Debug=0 to Debug=1.

  4. To set the number of computers that Vulnerability Scanner simultaneously pings, change the value for EchoNum. Specify a value between 1 and 64.

For example, type EchoNum=60 if you want Vulnerability Scanner to ping 60 computers at the same time.

  5. To set the number of computers that Vulnerability Scanner simultaneously checks for antivirus software, change the value for ThreadNumManual. Specify a value between 8 and 64.

For example, type ThreadNumManual=60 if you want Vulnerability Scanner to check 60 computers for antivirus software at the same time.

  6. To set the number of computers that Vulnerability Scanner simultaneously checks for antivirus software when running scheduled tasks, change the value for ThreadNumSchedule. Specify a value between 8 and 64.

For example, type ThreadNumSchedule=60 if you want Vulnerability Scanner to check 60 computers for antivirus software at the same time whenever it runs a scheduled task.

  7. Save TMVS.ini.

Copyright © 1998-2007 Trend Micro Incorporated. All rights reserved.


Considerations When Using Vulnerability Scanner

Setup | Effectiveness of Vulnerability Scanner
Administration with strict security policy | Very effective. Vulnerability Scanner reports whether or not all computers have antivirus software installed.
Administrative responsibility distributed across different sites | Moderately effective
Centralized administration | Moderately effective
Outsource service | Moderately effective
Users administer their own computers | Not effective. Because Vulnerability Scanner scans the network for antivirus installation, it is not feasible to have users scan their own computers.

Setup | Effectiveness of Vulnerability Scanner
Single location | Very effective. Vulnerability Scanner allows you to scan an entire IP segment and install OfficeScan client easily on the LAN.
Multiple locations with high speed connection | Moderately effective
Multiple locations with low speed connection | Not effective. You need to run Vulnerability Scanner on each location and OfficeScan client installation must be directed to a local OfficeScan server.
Remote and isolated computers | Not effective. Vulnerability Scanner cannot scan computers not connected to the network.

Setup | Effectiveness of Vulnerability Scanner
Windows NT-based operating systems | Very effective. Vulnerability Scanner can easily install the OfficeScan client remotely to computers running NT-based operating systems, except Windows XP Home.
Mixed operating systems | Moderately effective. Vulnerability Scanner can only install to computers running Windows NT-based operating systems.
Desktop management software | Not effective. Vulnerability Scanner cannot be used with desktop management software. However, it can help track the progress of OfficeScan client installation.

Setup | Effectiveness of Vulnerability Scanner
Microsoft Active Directory™ | Very effective. You can specify the domain administrator account in Vulnerability Scanner to allow remote installation of the OfficeScan client.
Workgroup | Not effective. Vulnerability Scanner may have difficulty installing to computers using different administrative accounts and passwords.
Novell™ Directory Service | Not effective. Vulnerability Scanner requires a Windows Domain account to install the OfficeScan client.
Peer-to-peer | Not effective. Vulnerability Scanner may have difficulty installing to computers using different administrative accounts and passwords.

Setup | Effectiveness of Vulnerability Scanner
LAN connection | Very effective
512 Kbps | Moderately effective
T1 connection and higher | Moderately effective
Dialup | Not effective. It will take a long time to finish installing the OfficeScan client.

Setup | Effectiveness of Vulnerability Scanner
Very large enterprise | Very effective. The bigger the network, the more the need to use Vulnerability Scanner to check for OfficeScan client installation.
Small and medium business | Moderately effective. For small networks, Vulnerability Scanner can be an option to install the OfficeScan client. Other client installation methods may prove much easier to implement.

Considerations When Using Vulnerability Scanner

Consider the following factors when deciding to use Vulnerability Scanner.

Network Administration

Network Topology and Architecture

Software/Hardware Specifications

Domain Structure

Network Traffic

Network Size

Copyright © 1998-2007 Trend Micro Incorporated. All rights reserved.