/build/static/layout/Breadcrumb_cap_w.png

Blog Posts tagged with K1000 Smart Labels

Ask a question

Updating an Asset Field with a Smart Label on every inventory

Let's pretend that every time a specific computer checked in you wanted to update the location field in it's computer asset record. Since there is no location field by default let us pretend that you have a location field in your MACHINE record.  It could be a custom data field but for this we'll just assume the location is in the MACHINE.SYSTEM_DESCRIPTION field (which is the computer description on windows).

You could do this with a ticket rule but then it would be on a schedule and it would update every asset. This only updates what is needed when the inofrmation changes -- on inventory. 

  1. download this chrome extension I wrote ( https://chrome.google.com/webstore/detail/kbox-javascript-demo/domgdoodlbgoeblglfokpbchcfjnecoa
  2. open the detail of an example computer asset (note: URL will be something like http://k1000/adminui/asset.php?ID=113 )  
  3. launch the chrome extension running the "assetClarity" demo
  4. hover over the location field you are using
  5. find out what the query is the reveals it.  If you're using mostly OEM asset settings for location then the query will be very similar to this (but not exactly the same):    
    select A5.ID, A5.NAME, AA.ASSET_FIELD_ID, A5assoc.ID "Associated ID", A5assoc.NAME "Associated Name", A5assoc.ASSET_TYPE_ID "Associated Type ID", ASSET_TYPE.NAME "Associated Type Name" 
    from ASSET_DATA_5 D5
    join ASSET A5 on A5.ASSET_DATA_ID = D5.ID and A5.ASSET_TYPE_ID=5
    left join ASSET_ASSOCIATION AA on AA.ASSET_FIELD_ID=19 and AA.ASSET_ID = A5.ID
    left join ASSET A5assoc on A5assoc.ID = AA.ASSOCIATED_ASSET_ID and A5assoc.ASSET_TYPE_ID=1
    left join ASSET_DATA_1 D5assoc on D5assoc.ID = A5assoc.ASSET_DATA_ID
    left join ASSET_TYPE on ASSET_TYPE.ID = A5assoc.ASSET_TYPE_ID
    where A5.ID = 2 /* this will be difference */
     If you have a vastly different query then this process is not for you 
  6. Because we're dealing with the more complex case of an asset related to an asset we'll need two smart labels.  This one is a smart label that runs (at order 1) to remove any existing location references.  
    delete from AA 
    using  MACHINE
    join ASSET A on A.MAPPED_ID=MACHINE.ID 
    join ASSET_FIELD_DEFINITION F on F.FIELD_TYPE='ASSET_1' and F.ASSET_TYPE_ID=5
    join ASSET_ASSOCIATION AA on AA.ASSET_ID=A.ID and AA.ASSET_FIELD_ID=F.ID 
    where 1=1
  7. Use the query in step #5 to create a smart label to update the asset information (actually an insert).  If we're talking about the OEM location field then the query would be exactly as follows. Updates of other asset fields may be unique to your kbox.
insert ignore into ASSET_ASSOCIATION (ASSET_ID, ASSET_FIELD_ID, ASSOCIATED_ASSET_ID) select C.ID , F.ID, L.ID from ASSET C join MACHINE on MACHINE.ID=C.MAPPED_ID and C.ASSET_TYPE_ID=5 join ASSET L on L.ASSET_TYPE_ID=1 and L.NAME=MACHINE.SYSTEM_DESCRIPTION join ASSET_FIELD_DEFINITION F on F.ASSET_TYPE_ID=C.ASSET_TYPE_ID 
and F.FIELD_TYPE='ASSET_1' left join ASSET_ASSOCIATION AA on AA.ASSET_ID=C.ID and AA.ASSET_FIELD_ID=F.ID where AA.ASSET_ID is null /* did not already exist any relationship from this machine to location */
 
disclaimer: all of my posts are my own personal opinion (and sometimes even insight).  I give this information to the community to support. Even though I work for Dell Kace there is no implied contract between Dell Kace and you over the support of this information.  I will often refer to core features of the product that are supported by engineering and technical support but I will also often refer to information that pushes the product beyond its specification. Any technical documents that I write about supported information I will continue to do so via our infrastructure for officially supported material (e.g. knowledge base articles) which is at http://www.kace.com/support.  You are welcome to contact me directly about this information but you will have the most success by responding with comments directly on my posts where I or the community can help you.
View comments (1)

K1000 - IP Based Smart Labels using REGEX

The most consistent way to label your machines by IP ranges is to use the KACE smart labeling tool and REGEX (Regular Expressions).  A regular expression (REGEX for short) is a special text string for describing a search pattern. You can think of regular expressions as wildcards on steroids. 

In this guide we will be using a Google Analytics tool to assist us in creating our REGEX search string.  The tool can be found here:  http://support.google.com/analytics/bin/answer.py?hl=en&answer=1034771

Now lets create a smart label using this tool.  Start by going to your computer inventory on the K1000.  Then click on Create Smart Label on the right hand side of your screen. 

You should now see the Smart Labeling Wizard.  Choose "IP Address" from the first drop down box.  Choose "matches REGEX" from the second.  The third box is where we will paste the REGEX from the Google Analytics tool.  It should look like the diagram below.

In another tab or window, pull up the Google Analytics tool.  Enter the start and end of your IP range in the boxes provided.   Click "Generate REGEX" when done.  This will populate 3rd box on the Google tool.  It should look similar to the diagram below.

Copy the contents of the 3rd box and paste it in to the third box that says PASTE REGEX HERE.  It should look similar to the diagram below.

Now click the "Test Smart Label" button.  You should see a list of all machines in that IP range.  Give your label a name in the "Choose label:" box and click save.  Now as your machines check in the label will be validated and applied to  any machine in the IP range. 

***TROUBLESHOOTING*** 

The third field of the smart label creator has a character limit.  If you have a large IP range that doesn’t seem to be working correctly when you test it in the wizard you can create the smart label by putting "REPLACEME" in the third field. 

Create the label and then go to Home > Labels  > Smart Labels.  Find your smart label and click on it.   You will now see the SQL query that the label is using.  Take the output REGEX from the Google Analytics tool and replace the REPLACEME with the REGEX.  Make sure to keep the single quotes around the string.

Save the smart label and it will start applying as machines check in.

View comments (2)

Creating a smart label to group newly imaged machines

When a machine checks into the K1000 you might want to set an aggressive patch schedule to get the patches installed after a scripted installation.  In the K1000 we need to define what machines have been imaged recently and then we can set a patch schedule to run more frequently on that group of machines.  This SQL statement should allow you to identify machines that have been imaged within the past 2 days.  Create a smart label with any criteria...then edit the label using the old editor (not the one that created it) and paste in this SQL code.

select * from MACHINE where OS_INSTALLED_DATE >= (CURRENT_TIMESTAMP()-INTERVAL 2 DAY)

View comments (1)

Smart label for Old Adobe Flash Player

I developed a smart label that automatically detects Windows machines with an old version of Adobe Flash Player installed. The nice thing about the label is that it performs a query for the highest version in the inventory instead of having a version hard coded. Because of this as soon as one computer in the inventory gets the latest version of Flash Player any machines without that version will get the label the next time the check in.

Here's the SQL query for the label:

SELECT MACHINE.NAME AS SYSTEM_NAME, SYSTEM_DESCRIPTION, MACHINE.IP, MACHINE.MAC, MACHINE.ID as TOPIC_ID 
FROM MACHINE
LEFT JOIN MACHINE_SOFTWARE_JT ON (MACHINE_SOFTWARE_JT.MACHINE_ID = MACHINE.ID)
LEFT JOIN SOFTWARE ON (SOFTWARE.ID = MACHINE_SOFTWARE_JT.SOFTWARE_ID and SOFTWARE.DISPLAY_NAME like "Adobe Flash Player 11%")
WHERE
((SOFTWARE.DISPLAY_VERSION != (SELECT MAX(DISPLAY_VERSION) from SOFTWARE WHERE DISPLAY_NAME like "Adobe Flash Player 11%")))
GROUP BY MACHINE.ID

This is limited to Flash Player 11 so once version 12 is released down the road the smart label will need to be updated.

To get this label setup in your environment you'll need to first create a smart label and then edit it to change the SQL code. The wizard will not allow you to enter the query.

View comments (1)

Massive Malware Smart Label (and K1000 Scripting Practices)

(AUTHOR'S NOTE: Check out my other two queries for VPNs/Proxies and P2P/Torrent Clients over here! Also, you might want to follow this post, as I'll update the query as I change it and find more signatures to track!)

So a few months ago I was tasked with tracking down some Conduit malware infections in my enterprise setting. I was provided with this nice little print out of IP addresses and was told to track them down manually and fix the problem. I knew I could do a more efficient job by using KACE inventory tracking and reports.

Since I was assigned that little malware-cleanup job, I've hand-filtered through over 16,750 software signatures gathered from over 9000 workstations in our enterprise. I wanted to share this massive smart-label script I created. I also think it's a good example of how to produce a well-documented script that is easily understood by newcomers. Not that KACE SQL is that complicated... But still!

The query catches all malware names that I could find based on Vendor and Display fields. This pastes right into the smart label script - you can use the wizard to create one and paste this in there. Everything is commented to hell and back, so it largely explains itself. Remember when creating scripts you should comment everything so that new people coming in can make sense of what you've written. Changelogs, while bloating the line count, are useful for troubleshooting if something goes wrong. Since KACE editor is not monospaced font the layout gets a little funky. I chose to keep it functional for monospaced editors because I do all my editing in Notepad++.

This script catches approximately 270 different software names and publishers, with about 10 exludes built in to avoid common false-positives I ran across, and a switch to only put softwares in the Malware label if they aren't rated with Threat 5. Essentially what this does is creates a nice little label that only shows up in my list if NEW malware comes onto my network, and anything I've already identified and flagged Threat 5 is ignored. So any time I see the Malware label in my list, I know there's new malware I need to categorize. If you want the label to stick all the time, you can just comment out or remove the last line.

The intention here is to use the Reporting features to generate a report that shows machines with Threat 5 software (see link below for example report). You can design the report with the wizard so that it shows machines by IP and even username logged in, so you can see exactly who and where the infections are. If your enterprise uses VNC or something similar, you can easily track users down and clean up the infection.

You can change little things here and there. Most of my signatures will catch the words between the parens if they show up ANYWHERE in that field. That's why, for example, I commented out "Converter" because there were lots of legit files with the word converter in them. If you know a file started with the word Converter, you could remove the first % so it read "... like 'Converter%')" for example.

Below I've linked an image gallery to show how I used the KACE Report Wizard to set up the report I use in conjunction with the Smart Label query I've pasted into the code box below that. Just keep in mind that Report won't show anything until you go into Software Inventory, use "View All" to view the Malware label, and classify it all as Threat 5, since the report operates off the Threat rating, and not the Malware label itself. Enjoy! :)

Report Wizard Gallery here: (link outdated with updated KACE release... Sorry folks, don't have time to fix it!)

/* ##################################################### */
/* # PURPOSE: Flags Software Inventory items with the # */
/* # Malware label for quick flagging and reporting. # */
/* ##################################################### */ /* ##### COMMENTS ##### */
/* Display and Vendor names are encased in single quotes. Percents are wildcards. First block is names, second is publishers, third is excludes.
Please keep new entries alphabetical first, then search function second.
Please verify changes for false positives & update changelog. Suggested parsing editor is something monospaced. This editor is trash. */ /* ##### CHANGELOG ##### */
/*
04.22.2014 Real Name <email>
* Created query.

04.23.2014 Real Name <email>
* Added 100+ more signatures.

04.24.2014 Real Name <email>
* Added 100+ more signatures.
* Fixed formatting for ease of reading.
* Added comment blocks & changelog. 05.05.2014 Real Name <email>
* Change 'File Type Assistant' to 'File Type' for broader catch.
* Added 2 new signatures.
* Removed filter for 'IOBit' signature.
* Moved commented lines and added "Disabled Entries" section. 05.06.2014 Real Name <email>
* Added 2 new signatures. 05.07.2014 Real Name <email>
* Added 11 new signatures.
* Removed 1 signature. 05.08.2014 Real Name <email>
* Added 3 new signatures.

05.08.2014 Real Name <email>
* Cleaned up the script a little for uniformity.
*/ /* ##### BEGIN QUERY ####### */
/* # Leave this part alone. # */
/* ########################## */ SELECT ID FROM SOFTWARE WHERE /* ########## START NAME INCLUDES ######### */
/* # These all need to be "OR" and "like" # */
/* # New signature = add another paren! # */
/* # Parens in groups of 10, lines of 30. # */
/* ############################################# */
(((((((((( (((((((((( ((((((((((
(((((((((( (((((((((( ((((((((((
(((((((((( (((((((((( ((((((((((
(((((((((( (((((((((( ((((((((((
(((((((((( (((((((((( ((((((((((
(((((((((( (((((((((( ((((((((((
(((((((((( (((((((((( ((((((((((
(((((((((( (((((((((( ((((((((((
(((((((((( (((((((((( ((((((((((
(((((((((( ( /* # DISABLED ENTRIES # */
/* ##################### */
/*((
OR SOFTWARE.DISPLAY_NAME like '%Convert%')
OR SOFTWARE.DISPLAY_NAME like '%Microsoft Search Enhancement Pack%') */
/* ##################### */ SOFTWARE.DISPLAY_NAME like '%24x7 Help%')
OR SOFTWARE.DISPLAY_NAME like '%advanced registry optimizer%')
OR SOFTWARE.DISPLAY_NAME like '%Advanced System Protector%')
OR SOFTWARE.DISPLAY_NAME like '%Allyrics-22%')
OR SOFTWARE.DISPLAY_NAME like '%appbar%')
OR SOFTWARE.DISPLAY_NAME like '%appgraffiti%')
OR SOFTWARE.DISPLAY_NAME like '%Babylon%')
OR SOFTWARE.DISPLAY_NAME like '%backupdutylite%')
OR SOFTWARE.DISPLAY_NAME like '%BitGuard%')
OR SOFTWARE.DISPLAY_NAME like '%Blitz Media Player%')
OR SOFTWARE.DISPLAY_NAME like '%Browse For Change%')
OR SOFTWARE.DISPLAY_NAME like '%BrowserProtect%')
OR SOFTWARE.DISPLAY_NAME like '%browsersafeguard%')
OR SOFTWARE.DISPLAY_NAME like '%browsetosave%')
OR SOFTWARE.DISPLAY_NAME like '%Buzz-it%')
OR SOFTWARE.DISPLAY_NAME like '%BuzzSearch%')
OR SOFTWARE.DISPLAY_NAME like '%cioolsalecooupon%')
OR SOFTWARE.DISPLAY_NAME like '%clean water action%')
OR SOFTWARE.DISPLAY_NAME like '%Community Smartbar%')
OR SOFTWARE.DISPLAY_NAME like '%Conduit%')
OR SOFTWARE.DISPLAY_NAME like '%consumer input%')
OR SOFTWARE.DISPLAY_NAME like '%ConvertHelper%')
OR SOFTWARE.DISPLAY_NAME like '%Coupon%')
OR SOFTWARE.DISPLAY_NAME like '%Crawler%')
OR SOFTWARE.DISPLAY_NAME like '%crossreader%')
OR SOFTWARE.DISPLAY_NAME like '%Deal Boat%')
OR SOFTWARE.DISPLAY_NAME like '%Dealio%')
OR SOFTWARE.DISPLAY_NAME like '%DealPly%')
OR SOFTWARE.DISPLAY_NAME like '%Deals%')
OR SOFTWARE.DISPLAY_NAME like '%DefaultTab%')
OR SOFTWARE.DISPLAY_NAME like '%Delta%')
OR SOFTWARE.DISPLAY_NAME like '%Dictionaryboss%')
OR SOFTWARE.DISPLAY_NAME like '%Dmuninstaller%')
OR SOFTWARE.DISPLAY_NAME like '%Driver Performer%')
OR SOFTWARE.DISPLAY_NAME like '%driverupdate%')
OR SOFTWARE.DISPLAY_NAME like '%facemoods%')
OR SOFTWARE.DISPLAY_NAME like '%Fast Free Converter%')
OR SOFTWARE.DISPLAY_NAME like '%Fast Search%')
OR SOFTWARE.DISPLAY_NAME like '%File Type%')
OR SOFTWARE.DISPLAY_NAME like '%Files Opened%')
OR SOFTWARE.DISPLAY_NAME like '%free file viewer%')
OR SOFTWARE.DISPLAY_NAME like '%free opener%')
OR SOFTWARE.DISPLAY_NAME like '%Free Video Player%')
OR SOFTWARE.DISPLAY_NAME like '%freemake%')
OR SOFTWARE.DISPLAY_NAME like '%Funmoods%')
OR SOFTWARE.DISPLAY_NAME like '%Gaming Extension%')
OR SOFTWARE.DISPLAY_NAME like '%genieo%')
OR SOFTWARE.DISPLAY_NAME like '%genieoExtra%')
OR SOFTWARE.DISPLAY_NAME like '%highlightly%')
OR SOFTWARE.DISPLAY_NAME like '%Hoopla%')
OR SOFTWARE.DISPLAY_NAME like '%I Want This%')
OR SOFTWARE.DISPLAY_NAME like '%IB Updater%')
OR SOFTWARE.DISPLAY_NAME like '%iLivid%')
OR SOFTWARE.DISPLAY_NAME like '%IM completer%')
OR SOFTWARE.DISPLAY_NAME like '%image converter%')
OR SOFTWARE.DISPLAY_NAME like '%Iminent%')
OR SOFTWARE.DISPLAY_NAME like '%InboxAce%')
OR SOFTWARE.DISPLAY_NAME like '%Incredibar%')
OR SOFTWARE.DISPLAY_NAME like '%installconverter%')
OR SOFTWARE.DISPLAY_NAME like '%installmac%')
OR SOFTWARE.DISPLAY_NAME like '%InstallX Search Protect%')
OR SOFTWARE.DISPLAY_NAME like '%Internet Turbo%')
OR SOFTWARE.DISPLAY_NAME like '%InternetHelper%')
OR SOFTWARE.DISPLAY_NAME like '%Iwebar%')
OR SOFTWARE.DISPLAY_NAME like '%level quality%')
OR SOFTWARE.DISPLAY_NAME like '%Linksicle%')
OR SOFTWARE.DISPLAY_NAME like '%Lpt System Updater%')
OR SOFTWARE.DISPLAY_NAME like '%LTCM Client %')
OR SOFTWARE.DISPLAY_NAME like '%Lyri%')
OR SOFTWARE.DISPLAY_NAME like '%Mega Browse%')
OR SOFTWARE.DISPLAY_NAME like '%MixiDJ%')
OR SOFTWARE.DISPLAY_NAME like '%mobogenie%')
OR SOFTWARE.DISPLAY_NAME like '%mplayer%')
OR SOFTWARE.DISPLAY_NAME like '%muvic%')
OR SOFTWARE.DISPLAY_NAME like '%My Scrap Nook%')
OR SOFTWARE.DISPLAY_NAME like '%My Web Search%')
OR SOFTWARE.DISPLAY_NAME like '%MyPC Backup%')
OR SOFTWARE.DISPLAY_NAME like '%Mysearchdial%')
OR SOFTWARE.DISPLAY_NAME like '%NetAssistant%')
OR SOFTWARE.DISPLAY_NAME like '%Netzero%')
OR SOFTWARE.DISPLAY_NAME like '%Online Vault%')
OR SOFTWARE.DISPLAY_NAME like '%Open It!%')
OR SOFTWARE.DISPLAY_NAME like '%openfreely%')
OR SOFTWARE.DISPLAY_NAME like '%Optimizer Pro%')
OR SOFTWARE.DISPLAY_NAME like '%ParetoLogic%')
OR SOFTWARE.DISPLAY_NAME like '%pc clean%')
OR SOFTWARE.DISPLAY_NAME like '%pc health%')
OR SOFTWARE.DISPLAY_NAME like '%PC Optimizer%')
OR SOFTWARE.DISPLAY_NAME like '%PC Performer%')
OR SOFTWARE.DISPLAY_NAME like '%playbryte%')
OR SOFTWARE.DISPLAY_NAME like '%Plus-hd%')
OR SOFTWARE.DISPLAY_NAME like '%PriceGong%')
OR SOFTWARE.DISPLAY_NAME like '%PricePeep%')
OR SOFTWARE.DISPLAY_NAME like '%privacy safeguard%')
OR SOFTWARE.DISPLAY_NAME like '%quiknowledge%')
OR SOFTWARE.DISPLAY_NAME like '%qwiklinx%')
OR SOFTWARE.DISPLAY_NAME like '%regcure%')
OR SOFTWARE.DISPLAY_NAME like '%RegCurePro%')
OR SOFTWARE.DISPLAY_NAME like '%regcurePro%')
OR SOFTWARE.DISPLAY_NAME like '%registry dr%')
OR SOFTWARE.DISPLAY_NAME like '%registrydr%')
OR SOFTWARE.DISPLAY_NAME like '%regwork%')
OR SOFTWARE.DISPLAY_NAME like '%re-markit%')
OR SOFTWARE.DISPLAY_NAME like '%Savekeep%')
OR SOFTWARE.DISPLAY_NAME like '%savesense%')
OR SOFTWARE.DISPLAY_NAME like '%SaveValet%')
OR SOFTWARE.DISPLAY_NAME like '%Savings%')
OR SOFTWARE.DISPLAY_NAME like '%Search module%')
OR SOFTWARE.DISPLAY_NAME like '%Search Protect%')
OR SOFTWARE.DISPLAY_NAME like '%Search Settings%')
OR SOFTWARE.DISPLAY_NAME like '%searchassist%')
OR SOFTWARE.DISPLAY_NAME like '%Searchqu%')
OR SOFTWARE.DISPLAY_NAME like '%SearchYa%')
OR SOFTWARE.DISPLAY_NAME like '%Selectionlinks%')
OR SOFTWARE.DISPLAY_NAME like '%Shop To Win%')
OR SOFTWARE.DISPLAY_NAME like '%Shopop%')
OR SOFTWARE.DISPLAY_NAME like '%Shopper%')
OR SOFTWARE.DISPLAY_NAME like '%shopping%')
OR SOFTWARE.DISPLAY_NAME like '%siteranker%')
OR SOFTWARE.DISPLAY_NAME like '%smartbar%')
OR SOFTWARE.DISPLAY_NAME like '%snap.do%')
OR SOFTWARE.DISPLAY_NAME like '%Softsafe%')
OR SOFTWARE.DISPLAY_NAME like '%software version updater%')
OR SOFTWARE.DISPLAY_NAME like '%speed%')
OR SOFTWARE.DISPLAY_NAME like '%speedypc%')
OR SOFTWARE.DISPLAY_NAME like '%strongvault%')
OR SOFTWARE.DISPLAY_NAME like '%surf%')
OR SOFTWARE.DISPLAY_NAME like '%swag%')
OR SOFTWARE.DISPLAY_NAME like '%swagbucks%')
OR SOFTWARE.DISPLAY_NAME like '%television%')
OR SOFTWARE.DISPLAY_NAME like '%The Sea App %')
OR SOFTWARE.DISPLAY_NAME like '%tube dimmer%')
OR SOFTWARE.DISPLAY_NAME like '%tuneupmymac%')
OR SOFTWARE.DISPLAY_NAME like '%uninstall helper%')
OR SOFTWARE.DISPLAY_NAME like '%url assistant%')
OR SOFTWARE.DISPLAY_NAME like '%VO Package%')
OR SOFTWARE.DISPLAY_NAME like '%video player%')
OR SOFTWARE.DISPLAY_NAME like '%videoconverter%')
OR SOFTWARE.DISPLAY_NAME like '%videoplayer%')
OR SOFTWARE.DISPLAY_NAME like '%visualbee%')
OR SOFTWARE.DISPLAY_NAME like '%w3i%')
OR SOFTWARE.DISPLAY_NAME like '%wajam%')
OR SOFTWARE.DISPLAY_NAME like '%weather channel%')
OR SOFTWARE.DISPLAY_NAME like '%weatherbug%')
OR SOFTWARE.DISPLAY_NAME like '%web assistant%')
OR SOFTWARE.DISPLAY_NAME like '%web layers%')
OR SOFTWARE.DISPLAY_NAME like '%web protect%')
OR SOFTWARE.DISPLAY_NAME like '%Web-cake%')
OR SOFTWARE.DISPLAY_NAME like '%webcake%')
OR SOFTWARE.DISPLAY_NAME like '%websteroids%')
OR SOFTWARE.DISPLAY_NAME like '%wildtangent%')
OR SOFTWARE.DISPLAY_NAME like '%yontoo%')
OR SOFTWARE.DISPLAY_NAME like '%youtube downloader%')
OR SOFTWARE.DISPLAY_NAME like '%ytd%')
OR SOFTWARE.DISPLAY_NAME like 'saver%')
OR SOFTWARE.DISPLAY_NAME like 'Shop%') /* ########## START PUBLISHER INCLUDES ######### */
/* # These all need to be "OR" and "like" # */
/* # New signature = add another paren! # */
/* ############################################# */
OR SOFTWARE.PUBLISHER like '%215 apps%')
OR SOFTWARE.PUBLISHER like '%adpeak%')
OR SOFTWARE.PUBLISHER like '%Alactro%')
OR SOFTWARE.PUBLISHER like '%ALOT%')
OR SOFTWARE.PUBLISHER like '%apn%')
OR SOFTWARE.PUBLISHER like '%aws convergence%')
OR SOFTWARE.PUBLISHER like '%backupdutylite%')
OR SOFTWARE.PUBLISHER like '%Bandoo%')
OR SOFTWARE.PUBLISHER like '%betwikx%')
OR SOFTWARE.PUBLISHER like '%bitberry%')
OR SOFTWARE.PUBLISHER like '%blue labs%')
OR SOFTWARE.PUBLISHER like '%browsersafeguard%')
OR SOFTWARE.PUBLISHER like '%compete%')
OR SOFTWARE.PUBLISHER like '%compuclever%')
OR SOFTWARE.PUBLISHER like '%Conduit%')
OR SOFTWARE.PUBLISHER like '%creative island media%')
OR SOFTWARE.PUBLISHER like '%crossreader%')
OR SOFTWARE.PUBLISHER like '%dealply%')
OR SOFTWARE.PUBLISHER like '%delta%')
OR SOFTWARE.PUBLISHER like '%DomaIQ%')
OR SOFTWARE.PUBLISHER like '%download freely%')
OR SOFTWARE.PUBLISHER like '%DownloadHelper%')
OR SOFTWARE.PUBLISHER like '%Ellora%')
OR SOFTWARE.PUBLISHER like '%exent%')
OR SOFTWARE.PUBLISHER like '%ez freeware%')
OR SOFTWARE.PUBLISHER like '%facemoods%')
OR SOFTWARE.PUBLISHER like '%fast free converter%')
OR SOFTWARE.PUBLISHER like '%freeze.com%')
OR SOFTWARE.PUBLISHER like '%funmoods%')
OR SOFTWARE.PUBLISHER like '%gigaclicks%')
OR SOFTWARE.PUBLISHER like '%GreenTree%')
OR SOFTWARE.PUBLISHER like '%growth systems%')
OR SOFTWARE.PUBLISHER like '%highlightly%')
OR SOFTWARE.PUBLISHER like '%Honlyn Limited%')
OR SOFTWARE.PUBLISHER like '%ibrytre%')
OR SOFTWARE.PUBLISHER like '%image converter%')
OR SOFTWARE.PUBLISHER like '%iminent%')
OR SOFTWARE.PUBLISHER like '%incredibar%')
OR SOFTWARE.PUBLISHER like '%incredimail%')
OR SOFTWARE.PUBLISHER like '%innovative apps%')
OR SOFTWARE.PUBLISHER like '%installconverter%')
OR SOFTWARE.PUBLISHER like '%InstallX%')
OR SOFTWARE.PUBLISHER like '%internethelper%')
OR SOFTWARE.PUBLISHER like '%iwebar%')
OR SOFTWARE.PUBLISHER like '%jdi backup%')
OR SOFTWARE.PUBLISHER like '%jenkat media%')
OR SOFTWARE.PUBLISHER like '%level quality%')
OR SOFTWARE.PUBLISHER like '%linksicle%')
OR SOFTWARE.PUBLISHER like '%linkury%')
OR SOFTWARE.PUBLISHER like '%Lyri%')
OR SOFTWARE.PUBLISHER like '%mediatechsoft%')
OR SOFTWARE.PUBLISHER like '%Mindspark Interactive%')
OR SOFTWARE.PUBLISHER like '%mixidj%')
OR SOFTWARE.PUBLISHER like '%my pop%')
OR SOFTWARE.PUBLISHER like '%my scrap nook%')
OR SOFTWARE.PUBLISHER like '%my web search%')
OR SOFTWARE.PUBLISHER like '%mypc backup%')
OR SOFTWARE.PUBLISHER like '%mysearchdial%')
OR SOFTWARE.PUBLISHER like '%omega partners%')
OR SOFTWARE.PUBLISHER like '%ooo industry%')
OR SOFTWARE.PUBLISHER like '%openit%')
OR SOFTWARE.PUBLISHER like '%Paretologic%')
OR SOFTWARE.PUBLISHER like '%pc health%')
OR SOFTWARE.PUBLISHER like '%pc optimizer pro%')
OR SOFTWARE.PUBLISHER like '%pc utilities%')
OR SOFTWARE.PUBLISHER like '%pcrx.com%')
OR SOFTWARE.PUBLISHER like '%performersoft%')
OR SOFTWARE.PUBLISHER like '%pinwid%')
OR SOFTWARE.PUBLISHER like '%playbryte%')
OR SOFTWARE.PUBLISHER like '%plus hd%')
OR SOFTWARE.PUBLISHER like '%pricegong%')
OR SOFTWARE.PUBLISHER like '%privacy safeguard%')
OR SOFTWARE.PUBLISHER like '%quiknowledge%')
OR SOFTWARE.PUBLISHER like '%qwiklinx%')
OR SOFTWARE.PUBLISHER like '%regcure%')
OR SOFTWARE.PUBLISHER like '%re-markit%')
OR SOFTWARE.PUBLISHER like '%rightsurf%')
OR SOFTWARE.PUBLISHER like '%savings%')
OR SOFTWARE.PUBLISHER like '%search module%')
OR SOFTWARE.PUBLISHER like '%search results%')
OR SOFTWARE.PUBLISHER like '%selectionlinks%')
OR SOFTWARE.PUBLISHER like '%shop to win%')
OR SOFTWARE.PUBLISHER like '%shopperreports%')
OR SOFTWARE.PUBLISHER like '%shoppingchip%')
OR SOFTWARE.PUBLISHER like '%showpass%')
OR SOFTWARE.PUBLISHER like '%slimware%')
OR SOFTWARE.PUBLISHER like '%speedypc software%')
OR SOFTWARE.PUBLISHER like '%spigot%')
OR SOFTWARE.PUBLISHER like '%strongvault%')
OR SOFTWARE.PUBLISHER like '%suprasavings%')
OR SOFTWARE.PUBLISHER like '%surf canyon%')
OR SOFTWARE.PUBLISHER like '%suurfkeepit%')
OR SOFTWARE.PUBLISHER like '%sweetpacks%')
OR SOFTWARE.PUBLISHER like '%systemspeedup%')
OR SOFTWARE.PUBLISHER like '%systweak%')
OR SOFTWARE.PUBLISHER like '%television%')
OR SOFTWARE.PUBLISHER like '%tuguu%')
OR SOFTWARE.PUBLISHER like '%Uniblue systems%')
OR SOFTWARE.PUBLISHER like '%video player%')
OR SOFTWARE.PUBLISHER like '%visual tools%')
OR SOFTWARE.PUBLISHER like '%visualbee%')
OR SOFTWARE.PUBLISHER like '%volonet%')
OR SOFTWARE.PUBLISHER like '%w3i%')
OR SOFTWARE.PUBLISHER like '%wajam%')
OR SOFTWARE.PUBLISHER like '%wajam%')
OR SOFTWARE.PUBLISHER like '%We-care.com%')
OR SOFTWARE.PUBLISHER like '%web cake%')
OR SOFTWARE.PUBLISHER like '%web layers%')
OR SOFTWARE.PUBLISHER like '%web protect%')
OR SOFTWARE.PUBLISHER like '%webcake%')
OR SOFTWARE.PUBLISHER like '%wildtangent%')
OR SOFTWARE.PUBLISHER like '%xportsoft%')
OR SOFTWARE.PUBLISHER like '%yontoo%')
OR SOFTWARE.PUBLISHER like 'resoft%')
/* ############### START EXCLUDES ############## */
/* # These all need to be "AND" and "not like" # */
/* # New signature = add another paren! # */
/* ############################################# */
AND SOFTWARE.PUBLISHER not like '%Aimersoft%')
AND SOFTWARE.PUBLISHER not like '%DivX%')
AND SOFTWARE.DISPLAY_NAME not like '%canon%')
AND SOFTWARE.DISPLAY_NAME not like '%deltagraph%')
AND SOFTWARE.DISPLAY_NAME not like '%Keyspan High Speed USB Serial Adapter%')
AND SOFTWARE.DISPLAY_NAME not like '%MAGIX Speed burnR%')
AND SOFTWARE.DISPLAY_NAME not like '%panasonic%')
AND SOFTWARE.DISPLAY_NAME not like '%speedstudy%')
AND SOFTWARE.DISPLAY_NAME not like '%SpeedswitchXP%')
AND SOFTWARE.DISPLAY_NAME not like '%VPN%') /* ######################### The Label Switch ######################### */
/* # Comment this to ID ALL software listed above as malware. # */
/* # Uncomment this to only ID software that haven't been categorized. # */
/* ###################################################################### */
AND SOFTWARE.THREAT != '5') /* ##### END QUERY ####### */
View comments (10)
Showing 1 - 5 of 13 results

Top Contributors

Talk About KACE Free Tools