SOA and Virus Notifications / Alerts

Avast Business Avast Endpoint Protection
1

Hello,

What should I expect to see within the SOA Console when avast! detects a virus on a managed workstation?

During a routine scan yesterday, avast! “discovered” a virus, yet there is nothing to indicate this within the console - although a dialog box appeared on the workstation itself.

The only thing I see within SOA => Jobs => History is “Succeeded”; “Failed”; or “Suceeded with Warnings”. Nothing to indicate the discovery of a virus.

I’m more than a little concerned by this, as I would like to see this information within the console (not just relying upon the users to advise me) - they may be reluctant to do this for obvious reasons.

Anyone have any thoughts on this? Maybe I’m missing something in the settings…

Thanks in advance,
Stephen

2

You can see the reports under: Reports → Shields log or Reports → Scan log

3

Ah, Excellent!

I also spotted these “Expert” Settings in the FAQ - now getting alerts through my email.

How can i get email alerts back? http://forum.avast.com/index.php?topic=82263.0 This comes from VLK

avastcfg://avast5/Common/NetAlert SMTP:yourname@domain.com
avastcfg://avast5/Communication/SMTPFrom from_address@domain.com
avastcfg://avast5/Communication/SMTPPort 25
avastcfg://avast5/Communication/SMTPServer yoursmtpserver.domain.com

Please note that this change becomes effective only after the shields are restarted (e.g. computer rebooted).

4

I received the following email notification regarding an email virus:

avast! [MKXP2008]: File "Mail\Inbox\\picture_{SYBOL}.zip|>picture_FPO83G.jpeg.exe" is infected by "Win32:Filename-A [Susp]" virus. "Mail Shield" task used Version of current VPS file is 130122-1, 22/01/2013

However, I can’t see anything to state how avast! dealt with the issue (or if the machine is compromised in any way).

Any thoughts?

Kind regards,
Stephen

5

I too have the same issue that the OP has. I have not received any data in the reports section of the SOA console… This seems like a big oversight or something isn’t set right. Even if the machine is clean, I’d expect that we should still be getting some useful information such as start/end times of the scan to determine if a specific machine is taking longer than normal to scan.

Am I missing something with the SOA and its reporting? Only have 1 server and 13 machines, nothing fancy. OP, did you managed to get reports inside the console, not just the emails?