Admin Arsenal Blog

I've been playing with Sunbelt Software's CounterSpy lately. I think the product does what it claims to do fairly well however the management console is somewhat lacking.

I ended up writing my own CounterSpy inventory scanner to extract CounterSpy configurations from target systems. I can use this scanner to easily determine which systems need to be updated with either a new client or new C0unterSpy definitions.

I admit that I was excited when I came across the SBAMCommandLineScanner.exe utility. I thought, "Sweet, I can just use this little guy to find out the agent version, definition version, apply new updates, etc". Unfortunately I froze the CounterSpy service on two of my lab systems when I attempted to use this utility to  A) extract the definitions version, and B) apply new definitions.

Anyway, I digress. Here is an easy way to extract the following information from CounterSpy agents.

To find out which CounterSpy Policy Service Server is assigned to a target  go to the Registry path HKLM\SOFTWARE\SBAMSvc. The value of  "PolicyServiceMachineName" will be your CounterSpy server.

To find out the version of the CounterSpy agent go to HKLM\Software\Sunbelt Software\Sunbelt Enterprise Agent and select (no surprise) "Version". I also use this location to extract the Install path of Sunbelt.

To find out the current definitions version I append the "Definitions" directory to the InstallPath value I extracted from the registry. For most of my systems the value is

C:\Program Files\Sunbelt Software\SBEAgent\Definitions

I parse the DefVer.txt file to extract the Definitions version as well as the date the new defs were applied.

You can also run the utility "SBAMCommandLineScanner.exe" and then extract the output however, as I mentioned earlier, I ran into problems where this very simple command wouldn't return at all and within a few minutes the CounterSpy service was hanging. Since I ultimately want to have this data extracted automatically via an inventory scan the last thing I want is to run an external process (SBAMCommandlineScanner) that doesn't return control.

Here is the very simple output of my utility. (I actually have it output into XML which ultimately goes into my database however I modified the output for this example). It gives me a one stop shop for my desired data.

CounterSpy really has proven to be a great product for finding and killing Adware and Malware. I just needed to streamline the available management capabilities a little bit.

VMWware Fusion 3 has only been released for a few days, but I wanted to give a quick first impression. I downloaded it the day after it came out and am pleased that I did. This release, on the surface, doesn't appear to be worthy of a full major version number change, but it's still a worthwhile upgrade.

The big new features are support for Snow Leopard, Windows 7, and better Aero graphics. I was already running VMWare 2 on Snow Leopard with a Windows 7 guest (though not for very long) so I assume that this is only important if you've been experiencing problems. The Aero support, though, still seems sluggish even on one of the new 3 GHz 27-inch iMacs. It's better, definitely, but it still seems to be somewhat for show.

What I do like about it is that everything seems to work just a little better. Drag/drop and copy/paste seem to work more smoothly as does the resizing of the window. Unity, in particular, seems to be better integrated. Again, not in any astounding way, just tweaked for the better. I also like that you can now cancel an accidental resume, that's bitten me more than once in the past. The new full screen menu is a nice touch, too.

The  one problem I did have was with the VMWare tools. For some reason it was preventing me from left-clicking. I could right-click and the hover of the mouse worked correctly, but left-click did nothing. I fixed it by uninstalling the tools and reinstalling the tools, but it took me a couple of tries because the uninstall from within the Windows control panel didn't seem to actually uninstall. I had to use the uninstall option from the Virtual Machine menu in VMWare. This may be the normal way to uninstall the tools (I've never had to do it before) but it was still frustrating for a while.

All-in-all I say it's a good enough upgrade for the $40, even though it feels more like it's a 2.1 update. There are enough small things in there to add up to a better experience.

Now, if I can get enough time to play with the new Parallels 5 I can blog a comparison review, on paper it looks like a bigger update.

I'm horrible at predictions. The more that I think about something the worse my predictions become. Movies, sports, politics, even my personal life. During my wife's four pregnancies I failed to predict the gender each time.

One of my predictions made long ago (probably around '97-98) was that Microsoft would soon get into the anti-virus business. Microsoft was expanding it's core offerings with each release of Windows, be it Internet browsers or print drivers. But for some reason they were walking very gingerly around anti-virus.

When my prediction failed to come true I started wondering if Symantec and McAfee had members on the Microsoft's board. Even when some of the prolific virus' made headway (Mellisa, anyone?) Microsoft still was found in the periphery. They did make headway soon thereafter with regular patches specific to their core security, but all-in-all it became the users responsibility to purchase a 3rd party app to find any one of a gazillion viruses.

Enter MSE. Microsoft Security Essentials is working. No doubt it has the complete attention of its many competitors, as noted by The Windows Club blog.

Microsoft’s free antivirus offering, Microsoft Security Essentials downloads have crossed 2.6 million since its launch two weeks back.

And its doing well! Users of MSE are indeed very satisfied with its performance! Given this scenario, the security companies with a view to holding on to their existing users and getting new ones, have resorted to giving away free 6m/12m licenses of their paid versions.

The anti-virus community is going to watch MSE very closely. Interestingly it seems, to me at least, that AV has become a commodity. Users notice the resource requirements of daily scans more than they consider the quality of the signature base. If this is the case then MSE is in a very good position.

Still, many will be watching.