Loading...Are you a home/consumer customer? Visit the Home/Consumer Support Site |
FAQs for GetSusp
Technical Articles ID:
KB69385
Last Modified: 12/31/2019 EnvironmentMcAfee GetSusp
SummaryThis article is a consolidated list of common questions and answers. It is intended for users who are new to the GetSusp tool, but can be of use to all users.
Contents
What is GetSusp?
GetSusp is a free tool that helps you find and log undetected malware, and allows you to automatically submit samples to McAfee Labs. To find suspicious files, GetSusp uses heuristics and compares samples against the Global Threat Intelligence (GTI) database of known clean files. When you analyze a suspect computer, use GetSusp first. For the GetSusp Product Guide, see KB91941. How is GetSusp different from other antimalware tools? There are many free diagnostic tools available. But, you must analyze their output, isolate a suspect sample, and work out how to submit the files to the antivirus vendor. With GetSusp, there is no need for advanced technical knowledge to isolate undetected malware. What is the difference between GetSusp and GetClean? GetSusp helps you find and isolate undetected malware, and is available to all McAfee customers. GetClean is a tool that helps you minimize false positives in your environment. This reduction minimizes the number of files you have to submit to McAfee Labs and eliminates duplicate submissions. For more details about GetClean, see KB73044. Where can I get information about upcoming releases of GetSusp and more release information? See the GetSusp Community Forum page at: https://community.mcafee.com/t5/Malware/bd-p/malware. Where can I send feedback regarding GetSusp? You can provide feedback on the GetSusp Community Forum page at: https://community.mcafee.com/t5/Malware/bd-p/malware. Back to Contents What are the connectivity requirements for GetSusp?
GetSusp requires an internet connection to perform optimally. Outbound UDP port 53 and TCP port 80 must be allowed for GTI and known file database lookups to happen. The known file database is a McAfee Labs IT supported back-end server. Where can I download the latest version of GetSusp? The latest version is available from http://www.mcafee.com/us/downloads/free-tools/getsusp.aspx. Can I deploy GetSusp.exe to my end nodes with ePolicy Orchestrator? Yes. You can download the ePolicy Orchestrator deployable version from http://downloadcenter.mcafee.com/products/mcafee-avert/getsusp/getsusp-ePO.zip. For more details about how to deploy the tool, see KB70405. Back to Contents How do I use GetSusp?
For instructions, see http://www.mcafee.com/us/downloads/free-tools/how-to-use-getsusp.aspx. Does GetSusp support command-line switches? Yes. For a list of all GetSusp switches, type After I start GetSusp, it creates a GetSusp.opt file. What is this file? When you start GetSusp, it creates a What do I do if GetSusp does not run as expected, and you see the following message: GetSusp.exe is digitally signed and does an integrity check before it runs. To run GetSusp on a computer infected with a file infector, run it using the What user or system details are collected?
The following information is collected:
Some users might not want to transmit samples, system data, or share their email address with McAfee Labs. Those users can choose the option in the GetSusp tool to not submit results to McAfee Labs. Your email address enables McAfee Labs to communicate with you regarding the results of the scan.
Can I prevent GetSusp from sending samples or information from my computer? GetSusp connects to Global Threat Intelligence (GTI) to match files found on your computer. If you do not want files and logs to be submitted to McAfee Labs, run the scan in offline mode. The files and logs harvested will not be uploaded to McAfee Labs. But, because there are no online lookups to the allow list database, results are degraded. How does GetSusp complete most system scans in three to five minutes?
System scans generally take between three and five minutes. This timing is irrespective of the size of the hard disk. The scans are fast because GetSusp scans are limited to running processes, the Windows registry, and file locations used by malware. Why does GetSusp not identify my suspected malware? The malware must be actively running on your computer or have an associated registry startup entry for GetSusp to identify it. GetSusp identifies only suspicious executable files. GetSusp does not scan documents, scripts, media, and other file formats. McAfee plans to add Rootkit scanning to GetSusp in a future release. Back to Contents How can I send a GetSusp submission larger than 10 MB to McAfee Labs?
McAfee Labs supports only How can I manually submit a file using GetSusp? You can use the UPLOAD option in GetSusp to manually point to suspect files and send the files to McAfee Labs. How do I follow up with McAfee Labs for support on a GetSusp submission? For tracking purposes, you receive an email with a Reference Work Item ID from Virus_Research@avertlabs.com. McAfee Labs uses the email address you provided under GetSusp Preferences. Use the Work Item ID to follow up with Technical Support. What is the Service Level Agreement (SLA) for sample submissions using the GetSusp tool? Currently there is no SLA for sample submissions. Related InformationTo contact Technical Support, log on to the ServicePortal and go to the Create a Service Request page at https://support.mcafee.com/ServicePortal/faces/serviceRequests/createSR:
Affected ProductsLanguages:This article is available in the following languages: GermanEnglish United States Spanish Spain French Italian Japanese Portuguese Brasileiro Chinese Simplified Glossary of Technical Terms |
Copyright © McAfee LLC
|
Question?
