Sophos Enterprise Console group, as described in Sophos Anti-Virus for VMware vShield startup guide , your guest VMs become protected and are updated automatically.

We recommend that you use the default settings when possible, as they provide the best balance between protecting your network against threats and overall system performance. You can, however, change the settings in the Anti-virus and HIPS and Updating policies, if you wish.

Other Enterprise Console policies are not supported by Sophos Anti-Virus for VMware vShield.

Note: All guest VMs protected by a security VM use the same Enterprise Console policies as the security VM. If you want to apply a different policy to some of your guest VMs, you will have to move them to a different security VM and put the security VM in a different Enterprise Console group. You can then apply a different policy to that group.

To view a list of all guest VMs managed by a security VM, see

View the protected guest VMs

(page 11).

2.1 Anti-virus and HIPS policy

By default, on-access scanning is running and Sophos Anti-Virus for VMware vShield cleans up any infected files and removes detected threats automatically. If for any reason automatic cleanup fails, access to the infected file is blocked so that your network stays protected.

Please note that not all policy settings are supported by Sophos Anti-Virus for VMware vShield.

This section describes which scanning options apply to Sophos Anti-Virus for VMware vShield and can be configured centrally, and which ones don't apply. For more information about the settings, see the Sophos Enterprise Console Help, in the section about configuring the anti-virus and HIPS policy.

Authorization

Authorization, as well as detection, of adware and other potentially unwanted applications (PUAs) is not supported.

Messaging

Only email messaging is supported.

Sophos Live Protection

Sophos Live Protection is supported, except for file submission.

On-access scanning

On-access scan settings are supported as detailed below. Behavior monitoring is not supported.

configuration guide

To open the on-access scanning settings pages, in the Policies pane of Enterprise Console, double-click Anti-virus and HIPS. Double-click the policy you want to change. In the Anti-Virus

and HIPS Policy dialog box, on the On-access scanning panel, beside the Enable on-access

scanning check box, click Configure. The On-access scan settings dialog box is displayed.

Setting Applies to Sophos

Anti-Virus for

VMware vShield?

Notes

Scanning tab

Check files on

Read/Rename/Write

No Sophos Anti-Virus for VMware vShield always scans files during both "open" and "close" system calls, as long as one or more of the three options—Read, Rename, and

Write—are enabled.

Important: If all three options are disabled, on-access scanning is disabled as a result, and you system is not protected.

Scan for Adware and

PUAs/Suspicious files

Allow access to drives with infected boot sectors

Scan inside archive files

(not recommended)

Yes

Scan system memory No This setting has no effect on Sophos Anti-Virus for VMware vShield. Sophos Anti-Virus for VMware vShield scans system memory during cleanup, if required.

Extensions tab

Scan all files (not recommended)

Yes

Scan only executable and other vulnerable files

Yes

Additional file type extensions to be scanned

Yes

Scan files with no extension

Yes

You can add additional file extensions that Sophos

Anti-Virus for VMware vShield will scan.

Sophos Anti-Virus for VMware vShield: On-Premise Edition

Setting Applies to Sophos

Anti-Virus for

VMware vShield?

Notes

Exclude file types from scanning

Yes

Windows Exclusions tab

Yes To exclude a folder from scanning, you must always specify the full path to the folder, including the drive letter or network share name, for example, "C:\Tools\logs\" or

"\\Server\Tools\logs\". Sophos Anti-Virus for VMware vShield cannot exclude folders based only on their name.

For example, "\Tools\logs\" won't work.

For more information about Windows exclusions, for example, how to use wildcards, see the Sophos Enterprise

Console Help, in the section about configuring the anti-virus and HIPS policy.

Mac Exclusions tab

Cleanup of viruses/spyware

Linux/UNIX Exclusions tab

Cleanup tab

Yes The alternative actions to be applied to infected items if cleanup fails have no effect on Sophos Anti-Virus for

VMware vShield. Sophos Anti-Virus for VMware vShield will always deny access to infected items.

Cleanup of suspicious files

For more information about the settings and which settings to choose, see the Enterprise Console

Help.

Web protection

Not supported.

Scheduled scanning

You can set up or edit a scheduled scan by clicking the Add or Edit button in the Scheduled

scanning panel in the Anti-Virus and HIPS Policy dialog box. You can also specify additional file types to be scanned or exclude items from scanning by clicking Extensions and Exclusions.

Scheduled scan settings are supported as detailed below.

configuration guide

Setting Applies to Sophos

Anti-Virus for

VMware vShield?

Notes

Add/Edit button > Scheduled scan settings dialog box

What to scan

Local hard disks Yes

Yes Floppy disk and removable drives

CD drives Yes

When scan occurs Yes Sophos Anti-Virus for VMware vShield will start the scan at the time and day requested. However, by default, it will scan only two guest VMs at a time, so as not to impact your system's performance. Therefore, it may take longer for the scanning of all guest VMs to complete.

Add/Edit button > Scheduled scan settings dialog box > Configure button > Scanning and cleanup settings dialog box

Scanning tab

Scan files for Adware and

PUAs/Suspicious files/Rootkits

Scan inside archive files Yes

Scan system memory No

Run scan at lower priority No

Cleanup tab

Cleanup of viruses/spyware

Yes Sophos Anti-Virus for VMware vShield doesn't automatically clean up floppy disk drives, CD drives or network locations.

Actions for infected items if cleanup has not taken place have no effect on Sophos Anti-Virus for VMware vShield.

Sophos Anti-Virus for VMware vShield will always log the event when cleanup has not taken place.

Sophos Anti-Virus for VMware vShield: On-Premise Edition

Setting Applies to Sophos

Anti-Virus for

VMware vShield?

Notes

Cleanup of adware and

PUA

Cleanup of suspicious files

Extensions and Exclusions button > Scheduled scan extensions and exclusions dialog box

Extensions tab

Scan all files (not recommended)

Yes

Scan only executable and other vulnerable files

Yes

Additional file type extensions to be scanned

Yes

Scan files with no extension

Yes

Exclude file types from scanning

Yes

Windows Exclusions tab

Yes

You can add additional file extensions that Sophos

Anti-Virus for VMware vShield will scan.

To exclude a folder from scanning, you must always specify the full path to the folder, including the drive letter or network share name, for example, "C:\Tools\logs\" or

"\\Server\Tools\logs\". Sophos Anti-Virus for VMware vShield cannot exclude folders based only on their name.

For example, "\Tools\logs\" won't work.

For more information about Windows exclusions, for example, how to use wildcards, see the Sophos Enterprise

Console Help, in the section about configuring the anti-virus and HIPS policy.

Mac Exclusions tab

Linux/UNIX Exclusions tab

configuration guide

Full system scan

Sophos Anti-Virus for VMware vShield supports an immediate full system scan initiated from

Enterprise Console. To send a full scan request to guest VMs managed by a security VM, select the security VM in the computer list, right-click, and select Full System Scan. Alternatively, on the Actions menu, select Full System Scan.

The full system scan detects but doesn't clean up threats.

Note: Sophos Anti-Virus for VMware vShield will scan only two guest VMs at a time, so as not to impact your system's performance. Therefore, it may take longer for the scanning of all guest

VMs managed by the security VM to complete.

2.1.1 Scanned file extensions

Files with the following extensions are scanned by default, except for archives, which are scanned only if the Scan inside archive files option is enabled in the anti-virus and HIPS policy applied to the security VM. By default, the option is disabled.

You can add additional extensions for scanning or exclude extensions from scanning, as described in the Enterprise Console Help, in the section about configuring the anti-virus and HIPS policy.

Sophos Anti-Virus for VMware vShield: On-Premise Edition arj asp aspx asx bat bin bz2 cab chm class

386

3gr

7zip

??_

a add ani cmd com cpl dbx fot gz hlp hqx ht?

eml exe fas flt fon dex dll dmd doc docm docx dot drv hta html hxs i13 jse lha lnk lsp lzh mnl mod mpd mpp mpt ifs inf ini jar jpeg jpg jpz js mso mui nws o pps ppt pptm pptx prc rar rpm rtf scr sh ocx ov?

pdf pdr php pif pl pot shb shs src swf vlx vs?

vxd wbk wma wmf wsf xl?

xlsm xlsx sys tar taz tbz tbz2 tgz uue vb?

xsn z zip zipx

2.2 Updating policy

All settings in the updating policy are supported by Sophos Anti-Virus for VMware vShield and can be configured centrally in Enterprise Console. For more information, see the Enterprise

Console Help, in the section about updating computers, configuring the updating policy.

configuration guide

3 View the protected guest VMs

You can view all guest VMs that are protected by your security VMs.

You view protected guest VMs by using a feature included in the installer you used to set up your security VMs.

1. Go to the directory to which you downloaded the installer and double-click ssvmtool.exe

A wizard runs.

2. Select View protected guest VMs.

3. Enter your vCenter address and credentials.

4. Enter your vShield Manager address and credentials.

5. Select the host or hosts where you want to view guest VMs.

6. Enter your Support password. This is the password you created when you installed your security VMs.

7. On the Ready to find guest VMs page, click Find.

The wizard begins the search for guest VMs.

8. When the search is finished, click View.

9. A list of Protected guest VMs found is displayed.

The list is also available as a file on your hard disk. To find it, click Show file location.

Sophos Anti-Virus for VMware vShield: On-Premise Edition

4 Scan guest VMs

Sophos Anti-Virus for VMware vShield always scans files on access, that is, when they are opened and closed.

A security VM can also perform a full scan of all guest VMs.You can either run a scan immediately or at set times.

The full system scan detects but doesn't clean up threats.

Note: The security VM cannot run a scan if it is still in the Enterprise Console Unassigned group.

It must be in a group to which you have applied policies.

Note: The security VM staggers scans so that the ESXi host is not placed under a high load. By default, two guest VMs are scanned at a time. Therefore, it may take longer for the scanning of all guest VMs managed by the security VM to complete.

Scan guest VMs now

To run a full scan of all the guest VMs immediately:

1. Go to Enterprise Console and find the security VM in the computer list.

2. Right-click the security VM and select Full System Scan.

Note: Alternatively, on the Actions menu, select Full System Scan.

Scan guest VMs at set times

To run a full scan of all the guest VMs at set times:

1. Go to Enterprise Console.

2. Create a scheduled scan, as explained in the Enterprise Console Help, in the section about configuring the anti-virus and HIPS policy.

To view details of the scan after it has been run:

In Enterprise Console, in the computer list in the lower right part of the window, double-click the security VM to display the Computer details dialog box.

configuration guide

5 Clean up a threat

5.1 Automatic cleanup

The security VM can automatically clean up threats that it detects, provided that automatic cleanup is supported on the guest VM's system, and you have the Sophos Guest VM Agent installed on the guest VM.

Automatic cleanup is supported on:

■

Windows Vista and later.

■

NTFS file systems.

Automatic cleanup is not supported on:

■

Versions of Windows that are earlier than Windows Vista, such as Windows XP and Windows

Server 2003. On those systems, clean up the threats manually, as described in the following sections.

■

ReFS, CDFS, UDF, or FAT file systems.

CDs or read-only file systems and media.

Remote file systems.

What happens when there is an automatic cleanup?

When a threat is detected and cleaned up automatically, Enterprise Console:

■

Shows that the threat has been blocked (see the "History" section of the Computer Details dialog box).

■

Displays an alert that shows what the threat is and whether it is cleanable.

Removes the alert if cleanup is successful.

Occasionally a guest VM needs to be restarted to complete the cleanup. In this case, a "Restart required" alert is displayed for the security VM. To find out which guest VM the alert applies to, double-click the security VM to open the Computer details dialog box and look in the description of the alert in the Outstanding alerts and errors section.

Note: If a guest VM is moved from one physical server to another using VMware vSphere vMotion, or is moved from one security VM to another when cleanup is in progress, the final cleanup status won't be reported back to Enterprise Console and the alert won't disappear from the console even if cleanup was successful. In this case, you will need to clear the alert manually. If cleanup fails, your guest VM will still remain protected - cleanup will be attempted again the next time the threat is detected.

Sophos Anti-Virus for VMware vShield: On-Premise Edition

5.2 Manual cleanup

If automatic cleanup fails or is not supported, or if you don't have it enabled, you can deal with threats manually.

To clean up the affected guest VM:

1. Find out about the threat that has been detected.

This may help you to make the decision whether to restore the guest VM or attempt to clean up the current snapshot.

2. Clean up the affected guest VM by one of these methods:

■

Restore the guest VM.

■

Clean up a threat with Sophos Virus Removal Tool.

The choice of the method depends on whether or not you can accept the loss of data in your current snapshot and how the VM has been affected. Some viruses leave no side-effects.

Others may make changes or corrupt data.

3. Clear the alert about the threat detection from Enterprise Console.

5.2.1 Find out about a threat

To find out more about a threat and how to deal with it:

1. In Enterprise Console, in the computer list in the lower right part of the window, double-click the security VM to display the Computer details dialog box.

In the History section, Items detected are listed. The name of the threat is shown in the Name column and the affected guest VM and file are shown in the Details column.

2. Click the name of the threat.

This connects you to the Sophos website, where you can read a description of the item and advice on what actions to take against it.

5.2.2 Restore a guest VM

If you can accept the loss of data, simply restore the VM. Use one of these methods:

■

Revert the affected guest VM to the previous known clean snapshot.

■

Delete the affected guest VM and reclone it from the template image.

Make sure that the template image has all the required VMware and Sophos tools installed

(see the Sophos Anti-Virus for VMware vShield startup guide for more detail).

Whichever method you use, run a full scan of the guest VM afterwards to ensure that it is clean.

configuration guide

5.2.3 Clean up with Sophos Virus Removal Tool

Usually, you use Sophos Virus Removal Tool to clean up a threat on systems where automatic cleanup is not supported, such as Windows XP or Windows Server 2003.

1. On the affected guest VM, stop the VMware Guest Introspection Agent. As an Administrator, in a Command Prompt window, type:

net stop vsepflt

2. If Sophos Virus Removal Tool is installed on the guest VM, uninstall it.

Note: A newer version of the Virus Removal Tool, with a new threat detection engine or threat data, might have been released since your copy was installed. So you should uninstall it and make a fresh installation.

3. Install the free Sophos Virus Removal Tool on the affected guest VM to remove the threat.

You can download the tool from www.sophos.com/en-us/products/free-tools/virus-removal-tool.aspx

4. Clean up the threat.

5. Restart the VMware Guest Introspection Agent. Type:

net start vsepflt

5.2.4 Clear an alert from Enterprise Console

When you are sure that the affected guest VM is clean, clear the alert from Enterprise Console:

1. In Enterprise Console, in the computer list in the lower right part of the window, right-click the security VM and select Resolve Alerts and Errors.

2. In the Resolve Alerts and Errors dialog box, on the Alerts tab, select the alert and click

Acknowledge.

The alert is no longer displayed in Enterprise Console.

5.3 Recover a cleaned up file

Sophos Anti-Virus for VMware vShield contains Sophos's SafeClean functionality that makes it possible to recover files that have recently been cleaned up. Therefore, you can recover a file that has been cleaned up either automatically or manually.

For an overview of SafeClean, see www.sophos.com/en-us/support/knowledgebase/119988.aspx

Please note that if you extract from the SafeClean bin a file that still contains malware, the security

VM will re-detect it, clean it up again, and the file won't be recovered. If you are sure that you want to recover the file, you will need to disable on-access scanning before recovering the file, and then re-enable it after you have recovered the file.

Important: If you disable on-access scanning, your guest VMs are unprotected until you re-enable it.

For instructions on how to recover a recently cleaned up file, see www.sophos.com/en-us/support/knowledgebase/119981.aspx

Sophos Anti-Virus for VMware vShield: On-Premise Edition

6 Alerting and logging

Alerting

If the security VM detects a threat on one of the guest VMs, it will send an alert to Enterprise

Console. In Enterprise Console an alert is displayed on the dashboard. A red warning icon is displayed in the computer list, on the Status tab, next to the security VM in the Alerts and errors column.

If the security VM detects a threat when a user tries to access a file, a message may also be displayed on the guest VM informing the user that the file cannot be accessed. This depends on the application used to access the file.

If the threat has been cleaned up, the threat alert is cleared from Enterprise Console. The cleanup is also reported in Enterprise Console. To see the report, double-click the security VM in the computer list to open the Computer Details dialog box and look for History.

If the threat has been partially removed, but the guest VM needs to be restarted to complete the cleanup, a "Restart required" alert is displayed.

To find out which guest VM the alert applies to, double-click the security VM in the computer list to open the Computer details dialog box and look in the description of the alert in the Outstanding

alerts and errors section. The name of the datastore the guest VM is on and the name of the guest VM are shown before the path of the threat (and separated from it by a forward slash). For example:

DatastoreName\MachineName/C:\threat.exe

Logging

On a guest VM, the logs are written to the Windows Application event log.

For information about logging in Enterprise Console, see the Enterprise Console Help.

configuration guide

7 Technical support

You can find technical support for Sophos products in any of these ways:

■

Visit the Sophos Community at community.sophos.com/ and search for other users who are experiencing the same problem.

■

Visit the Sophos support knowledgebase at www.sophos.com/en-us/support.aspx

Download the product documentation at www.sophos.com/en-us/support/documentation.aspx

Open a ticket with our support team at https://secure2.sophos.com/support/contact-support/support-query.aspx

Sophos Anti-Virus for VMware vShield: On-Premise Edition

8 Legal notices

2016 Sophos Limited. All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording or otherwise unless you are either a valid licensee where the documentation can be reproduced in accordance with the license terms or you otherwise have the prior permission in writing of the copyright owner.

Sophos, Sophos Anti-Virus and SafeGuard are registered trademarks of Sophos Limited, Sophos

Group and Utimaco Safeware AG, as applicable. All other product and company names mentioned are trademarks or registered trademarks of their respective owners.

Third-party licenses

For third-party licenses that apply to your use of this product, please refer to the following folder on the Sophos Security VM: /usr/share/doc

Hallo! Ich bin ein KI-Chatbot, der speziell dafür ausgebildet wurde, Ihnen bei der Sophos VMware vShield: On-Premise Edition Konfigurationsleitfaden zu helfen. Ich habe das Dokument gründlich gelesen und kann Ihnen helfen, die benötigten Informationen zu finden oder den Inhalt klar und einfach zu erklären. Egal, ob Sie nach Anleitungen zu bestimmten Funktionen, Problemlösungen oder allgemeinen Nutzungshinweisen suchen, zögern Sie nicht, Ihre Fragen zu stellen. Je mehr Details Sie zu Ihren Anliegen oder Bedürfnissen bereitstellen, desto genauer und effektiver kann ich Ihnen helfen!

Assistent tippt

Assistent ist nicht an der Tastatur. Bitte versuchen Sie es später noch einmal.

Inhaltsverzeichnis

Es sieht so aus, als ob Sie ein Dokument erreicht haben, das in mehreren Sprachen verfasst ist, einschließlich einer Sprache, die nicht Ihre Muttersprache ist. Sie können die folgenden Links verwenden, um Seiten ohne die von Ihnen bevorzugte Sprache vorübergehend auszublenden.

Sophos Anti-Virus for

VMware vShield: On-Premise

Edition configuration guide

Product version:

Document date:

2

August 2016

Contents

1 About this guide

2 Configure policies

2.1 Anti-virus and HIPS policy

Authorization

Messaging

Sophos Live Protection

On-access scanning

Web protection

Scheduled scanning

Full system scan

2.1.1 Scanned file extensions

2.2 Updating policy

3 View the protected guest VMs

4 Scan guest VMs

Scan guest VMs now

Scan guest VMs at set times

5 Clean up a threat

5.1 Automatic cleanup

What happens when there is an automatic cleanup?

5.2 Manual cleanup

5.2.1 Find out about a threat

5.2.2 Restore a guest VM

5.2.3 Clean up with Sophos Virus Removal Tool

5.2.4 Clear an alert from Enterprise Console

5.3 Recover a cleaned up file

6 Alerting and logging

Alerting

Logging

7 Technical support

8 Legal notices

Third-party licenses

Verwandt

Sophos Anti-Virus 10.3 Manual | AI Chat & PDF Access

Sophos Anti-Virus for VMware vShield Startup Guide | AI Chat & PDF Download

Sophos Antivirus Home Edition: AI Chat & PDF Download

Sophos Anti-Virus for VMware vShield Startup Guide | AI Chat & PDF Download

Sophos Sophos for Virtual Environments Startup Guide

Sophos Sophos for Virtual Environments Startup Guide

Sophos Anti-Virus 5.0 User Manual

Sophos Sophos for Virtual Environments Startup Guide

Sophos Anti-Virus 7 User Manual: AI Chat & PDF Access

Sophos Anti-Virus 4.5 User Manual

Sophos Anti-Virus Scan for PUAs Manual: AI Chat & PDF

Sophos Control Center User Manual