AVIRA ANTIVIR SERVER FOR WINDOWS User manual

User Manual
www.avira.com
Windows Server

Trademarks
AntiVir is a registered trademark of the Avira GmbH.
Windows is a registered trademark of the Microsoft Corporation in the United States and other countries.
All other brand and product names are trademarks or registered trademarks of their respective owners.
Protected trademarks are not marked as such in this manual. This does not mean, however that they may be used freely.
Copyright information
The purpose of this information is to acknowledge and recognize the code from third-party suppliers used for Avira
AntiVir Server. We would like to thank the copyright owners for allowing us to use their code.
MD5-Code
The MD5 code used for security reasons was written by the Information Science Institute of the University of Southern
California and derived from the Message-Digest algorithm from RSA Data Security, Inc.
Copyright (C) 1991-2, RSA Data Security, Inc., Created in 1991.
All rights reserved.
The license to copy and use this software is distributed with the stipulation that it is designated as the "RSA Data Security,
Inc. MD5 Message-Digest Algorithm" in all materials mentioned by this software or which refer to this software or these
functions.
The license is also granted for the creation of works deriving from this, with the stipulation that these works are
designated as "derived from the RSA Data Security, Inc. MD5 Message-Digest Algorithm" in all materials which mention
the derived work or refer to it.
RSA Data Security, Inc. provides no warranty whatsoever regarding the marketability of this software or the suitability of
this software for a particular purpose. It is provided without any guarantee in its present form. This applies to expressed
or implied guarantees.
This information must be contained in every copy of each part of this documentation and/or software.
Expat
Copyright (c) 1998, 1999, 2000 Thai Open Source Software Center Ltd
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated
documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to
use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to
whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the
Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING
BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
NONINFRINGEMENT.
IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
ScewXML
Copyright (C) 2002, 2003 Aleix Conchillo Flaque: SCEW is free software; you can redistribute it and/or modify it under the
terms of the GNU Lesser General Public License as published by the Free Software Foundation; either version 2.1 of the
License, or (at your option) any later version: http://www.gnu.org/copyleft/lesser.html

Table of Contents
Table of Contents
1Introduction .......................................................................................................... 4
2Symbols, emphases and terms................................................................................. 5
3Product information............................................................................................... 6
3.1 Functionality..........................................................................................................................6
3.2 Delivery scope........................................................................................................................7
3.2.1 Main features: ..........................................................................................................7
3.3 System requirements.............................................................................................................8
3.4 Licensing ................................................................................................................................9
3.4.1 License models .........................................................................................................9
4Installation and Uninstallation............................................................................. 10
4.1 Installation...........................................................................................................................10
4.2 Uninstallation......................................................................................................................11
5User interface and operation ................................................................................ 12
5.1 User interface.......................................................................................................................12
5.2 Quickstart ............................................................................................................................14
6Configuration....................................................................................................... 15
6.1 Configuration.......................................................................................................................15
7Scanning .............................................................................................................. 16
7.1 Creating a new scan profile .................................................................................................16
7.2 Customizing and using a scan profile (manual selection) .................................................16
7.3 Creating a new scan job.......................................................................................................17
7.4 Reacting to found viruses and malware .............................................................................18
7.5 Handling files in quarantine ...............................................................................................18
7.5.1 To handle files in quarantine (*.qua) ....................................................................18
7.5.2 Restoring files in quarantine.................................................................................19
8Updating.............................................................................................................. 20
8.1 Updating Avira AntiVir Server............................................................................................20
8.2 Updating Avira AntiVir Server automatically ....................................................................21
9Service ................................................................................................................. 22
9.1 First Aid................................................................................................................................22
9.1.1 Checking System Configuration............................................................................22
9.1.2 Checking Guard Configuration .............................................................................22
9.2 Support ................................................................................................................................23
9.3 Forum...................................................................................................................................23
9.4 Service ..................................................................................................................................23
9.4.1 Service hotline........................................................................................................23
9.4.2 Preparing your request ..........................................................................................23
9.5 Online-Shop.........................................................................................................................24
Avira GmbH Avira AntiVir Server 3

Introduction
1Introduction
Avira AntiVir Server from Avira GmbH protects your computer from viruses, malware,
adware and spyware, undesired programs and other dangers. These will be referred to as
viruses and malware in this manual.
The manual describes the installation and use of the program.
On our website, http://www.avira.com, you can download the manual for Avira AntiVir
Server as a PDF file, update Avira AntiVir Server or renew your license.
Our website also contains information such as the telephone number for technical
support and our newsletter, for which you can sign up there.
Your Avira GmbH team
4 Avira AntiVir Server Avira GmbH

Symbols, emphases and terms
2Symbols, emphases and terms
The following symbols are used:
Symbol Explanation
Appears before a condition which must be met before an action is carried
out.
Appears before a step you carry out.
Appears before a result that follows the preceding action.
Appears before a warning of the danger of critical data loss.
Appears before a note with especially important information or a tip
which makes it easier to understand and use the Avira AntiVir Server.
The following emphases are used:
Emphasis Explanation
File name or path.
Italic
Elements of the software interface which are displayed (e.g., window
title, window area or option).
Bold Elements of the software interface which are clicked (e.g., menu item,
tab or button).
Avira GmbH Avira AntiVir Server 5

Product information
3Product information
3.1 Functionality
The protection package Avira AntiVir Server consists of the Avira AntiVir Server service
and AntiVir Server Console. The Avira AntiVir Server service protects your Windows
server against viruses and malware. AntiVir Server Console is used for administration,
control and monitoring of the servers to be protected or of the AntiVir services on the
servers to be protected. You can access any number of servers via AntiVir Server Console.
The Avira AntiVir Server service
... protects your servers against viruses and malware. You install the service on all
Windows servers to be protected in the network.
The AntiVir Server service provides comprehensive functions to protect your system in
one package with several program components and other help programs. Overview of
the main components:
•The Scanner scans your computer system for viruses and unwanted programs (on-
demand scan). Affected files are deleted, repaired or moved to quarantine depending
on the configuration. Scans of the Scanner are carried out automatically. The interval
and scope of scans can be configured.
•The Guard runs in the background. It monitors and repairs files, if necessary, during
operations such as opening, writing and copying in real time.
•The Scheduler supports you in planning regular tasks such as scans and updates via
the Internet or Intranet.
•The Avira AntiVir Server Updater always keeps your program up to date via an
Internet or Intranet connection.
•The quarantine manager conveniently manages and monitors the files placed in
quarantine.
6 Avira AntiVir Server Avira GmbH

Product information
AntiVir Server Console
... provides a desktop for AntiVir Server services with which you can control, configure
and monitor AntiVir Server services. You install AntiVir Server Console on at least one
computer with a network connection to the servers to be protected. AntiVir Server
Console can also be installed on the servers to be protected.
AntiVir Server Console can be connected to any number of servers to be connected and
offers access to components, reports, events and to the AntiVir Server Configuration of
the connected AntiVir Server service.
3.2 Delivery scope
3.2.1 Main features:
•Console for monitoring, administration and control of the whole program
•Simple, keyword-based configuration: support of configuration through integrated
assistant and context-sensitive help
•Configuration and operation from separate computer possible: desktop (AntiVir
Server Console) can be installed separately from the AntiVir server service
•Network administration via the Avira Security Management Center (SMC)
•Scanner (Direct scan or on-demand scan) with profile-controlled and configurable
scan for all known types of viruses and malware
•Resident virus guard (real-time scan or on-access scan) for constant monitoring of all
file accesses
•Extremely high virus and malware detection via innovative scanning technology
(scan engine) including heuristic scanning method
•Innovative AHeAD (Advanced Heuristic Analysis and Detection) technology for
detection of unknown or fast changing attackers for proactive security
•Detection of all conventional archive types including detection of nested archives
and smart extension detection
•Comprehensive filter functions and file caching to increase scanning speed
•"Multi-threading capability;: simultaneous scanning of many files at high speed
•Configurable reactions to a detection: repair, deletion, moving to a quarantine
directory, blocking, renaming and isolation of programs or files; automatic removal
of viruses and malware
•Quarantine manager: affected files can be deleted in the quarantine directory or
restored at their place of origin
•Integrated scheduler for planning one-off or recurring jobs such as updates or scans
•Automatable updating via the Internet or network-wide distribution (without
system interruption)
•Comprehensive logging, warning and messaging functions for the administrator;
sending of warnings in Windows networks and by email (SMTP), SMTP-
authentication possible
•Protection against modifications of the program files via intensive self-test
Avira GmbH Avira AntiVir Server 7

Product information
•Can run in 32-bit mode on Microsoft Windows Server 2003, x64 Edition incl. real-
time scanning (on-access scanning)
•Extended terminal server support
3.3 System requirements
Avira AntiVir Server has the following requirements for successful use of the Avira
AntiVir Server service and AntiVir Server Console:
Avira AntiVir Server service
•Windows 2000 Server (Service Pack 2 recommended) or
•Windows 2000 Server with enabled terminal services (Service Pack 2 recommended)
or
•Windows Server 2003 or
•Windows Server 2003 with enabled terminal services or
•Windows Advanced Server 2003
•Citrix Metaframe (Presentation Server) up to Version 3
•Windows Server 2008
•at least 40 MB free RAM
•at least 40 MB free memory on the hard disk (temporarily considerably more); for
installation: 100 MB free memory on the hard disk; in addition free memory for
quarantine
The release of Windows Server 2008 is probably in February 2008.
Support for Windows Server 2008 of AntiVir Server was developed and
tested on the basis of Windows Server 2008 Release Candidate 0.
AntiVir Server Console
•Windows 2000 or higher
•at least 4 MB free RAM (temporarily up to 6 MB)
•at least 4 MB free memory on the hard disk
Internet access
For regular updates it is necessary for a server of your network to have Internet access.
Alternatively, the updates can also be downloaded from a file or HTTP server in the
Intranet. For more information see chapter Update.
8 Avira AntiVir Server Avira GmbH

Product information
3.4 Licensing
You require a license to use Avira AntiVir Server. Activate your license for Avira AntiVir
Server with the license file hbedv.key. You can obtain the license file by email from Avira
GmbH. The license file contains the license for all products that you have ordered in one
order process. You hereby accept the license terms (for details, visit:
http://www.avira.com/documents/general/pdf/en/avira_eula_en.pdf).
3.4.1 License models
Demo version Evaluation
version
Full version
On-
demand
scan
Only files and directories
on drive C:\ are scanned.
The same
functionality as the
full version - but
with a time limit.
Full functionality
On-access
scan
100,000 files are scanned
on drive C:\; then the
Guard is disabled.
Update No automatic updates
possible.
Avira GmbH Avira AntiVir Server 9

Installation and Uninstallation
4Installation and Uninstallation
4.1 Installation
Before installing Avira AntiVir Server, certain conditions must be met:
3During installation of the service and of the AntiVir Server Console on the server:
3Ensure that Windows NT Server, Windows 2000 Server or Windows Server 2003 is
installed on the server and started.
3Ensure that the system requirements are met (see System requirements).
3Ensure that you are logged in on the server as an administrator or as a user with
administrator rights.
3Ensure that an Internet connection or network connection to a download server
exists for updating AntiVir Server. If you use a file server, you may require a user
name and a password for server login.
3When installing the full version: ensure that a valid license file hbedv.key exists and
is stored in a local directory on the server.
3When installing the service Avira AntiVir Server: If you want to connect remotely
with AntiVir Server Console to the server, ensure that the following ports are
opened:
139 (NetBIOS SSN)
137 (NetBIOS NS)
138 (NetBIOS DGM)
Danger of data loss and damage to the operating system of the computer!
fDo not install any other virus protection programs or comparable
services on the computer on which Avira AntiVir Server is installed.
fIf necessary, deinstall any such programs or services.
fClose all running programs before installation.
Installation types
During installation you can select a setup type in the installation assistant:
–Full
The installation assistant opens
AntiVir Server is fully installed with the Avira AntiVir Server and the console
AntiVir Server Console. No target folder for the program files to be installed can
be selected.
–User-defined
You can select whether you want to install the Avira AntiVir Server service and/or
the console AntiVir Server Console. A target folder can be selected for the
program files to be installed.
10 Avira AntiVir Server Avira GmbH

Installation and Uninstallation
Carry out installation
How to install AntiVir Server:
fStart the setup by double-clicking on the installation file that you have downloaded
from the Internet or insert the program-CD.
The installation assistant opens.
fThe installation assistant opens.
4.2 Uninstallation
Carry out uninstallation via the control panel of the operating system or via the setup of
AntiVir Server.
During uninstallation, the AntiVir services are stopped, all report files and infected files
(in quarantine) are deleted.
During uninstallation you can specify that the directories with the report files and the
quarantine are not deleted.
Avira GmbH Avira AntiVir Server 11

User interface and operation
5User interface and operation
5.1 User interface
The Avira AntiVir Server service that is installed on the servers to be protected is
administered via AntiVir Server Console. AntiVir Server Console is a snap-in of the
Microsoft Management Console (MMC). You can create any number of servers to be
protected on AntiVir Server Console in order to configure and monitor them on AntiVir
Server Console.
Please note that only the proprietary elements of AntiVir Server Console
are documented in this help. For information on the MMC and on manual
integration of a snap-in, please refer to the user's manual or the online
help of the operating system.
Starting and ending AntiVir Server Console
How to start AntiVir Server Console:
fStart AntiVir Server Console via the link Avira AntiVir Server Remote Control in the
Windows Start menu or under Programs.
- OR -
fYou can also load AntiVir Server Console directly in the MMC.
You can find the pre-configured AntiVir Server Console in the installation directory
of AntiVir Server Console.
If you want to end AntiVir Server:
fTo end AntiVir Server Console, you must close MMC.
12 Avira AntiVir Server Avira GmbH

User interface and operation
Operation
•Navigate via the console structure in the left-hand window of the MMC. Navigation
elements are also displayed as objects in the right-hand detail window of the MMC.
Open these objects in the detail window by double-clicking. The AntiVir Server
Configuration is located under the node Settings. You can select various
configuration sections in the detail window: the window Settings is opened in which
you can configure the selected section.
•Commands and actions are available via icons in the detail window and via context
menus of the individual console nodes or of objects in the detail window.
•When configuring a server, you must confirm information in the window Settings
with the button OK or Accept in order to accept the new settings. Your settings are
cancelled with the button Cancel.
Overview of AntiVir Server Console
–Avira AntiVir Server
Display of the created servers with connection status
Actions: add server
–Server
Display of server status
Actions: Start product update, update license file, reload configuration, display
report file, rename server, disconnect server, connect server, delete server
–Statistic
Display of statistical data of the on-access scan of the Guard and of the on-
demand scan of the Scanner, version information, contact and support addresses
Actions: delete statistics
–Profiles
Display of the default profiles and of the profiles created for the on-demand scan
Actions: create new profiles, rename profiles, delete profiles
–Quarantine
Display of the objects in quarantine
Actions: display object properties, restore object, add file to quarantine, send
object to Avira Malware Research Center, delete object
–Scheduler
Display of all created scanning and update jobs
Actions: insert new jobs, display job properties, edit job, delete job
–Reports
Display reports of scans of on-demand scan and updates
Actions: Display report, display report file, print report, delete report
–Events
Display all events of the Avira AntiVir Server service on the server to be protected
Actions: display events, export events, delete events
Avira GmbH Avira AntiVir Server 13

User interface and operation
–Settings
Configuration of the Avira AntiVir Server service on the server to be protected
Configuration sections:
–Scanner: Configuration of on-demand scan
–Guard: Configuration of on-access scan
–General: Extended risk categories for on-demand and on-access scan, password
protection for the server on AntiVir Server Console, security alerts for outdated
AntiVir Server, directories used, restriction of reports and of event log
–Update: Download method (via web server or file server), product updates,
configuration of connection to the download server
–Alerts: configuration of network alerts of the Guard and of the Scanner
–Email: configuration of email alerts via SMTP of the modules Guard, Scanner,
Avira AntiVir Server Updater
5.2 Quickstart
Carry out these steps if you are using Avira AntiVir Server for the first time:
1. Installation
fInstall the Avira AntiVir Server service on the servers that you want to protect
against viruses and unwanted programs.
fInstall AntiVir Server Console on at least one computer in your network.
2. Administration on AntiVir Server Console
fAdd server
Add all servers on AntiVir Server Console that you want to administer on AntiVir
Server Console.
Carry out the following steps for every server added:
fConfiguration
fConfigure the Avira AntiVir Server service on the server to be protected.
fAssign a password for the server on AntiVir Server Console.
fCarry out update and system scan
fFirst carry out one update of AntiVir Server. For this create an update job in the
Scheduler. Select "Immediately" as the start time. Carry out a complete system scan.
For this create a scan job in the Scheduler. For the scan job, select "Local hard disks"
as the profile and "Immediately" as the start time.
fDefine scans and update jobs
fDefine scans and update jobs. To configure scans of the Scanner, first create where
appropriate user-defined profiles under Profile. In the next step you can create the
scans and update jobs under Scheduler.
14 Avira AntiVir Server Avira GmbH

Configuration
6Configuration
6.1 Configuration
The AntiVir Server Configuration is displayed under the node Settings. Under Settings
you configure the service Avira AntiVir server on the server to be protected. You have
the following options:
•Scanner: Configuration of on-demand scan
•Guard: Configuration of on-access scan
•General: Extended threat categories, password protection for the server on AntiVir
Server Console, alerts if AntiVir Server needs to be updated, used directories,
limitation of reports and event logs
•Update: Download method (via web server or file server), product updates,
configuration of the connection to the download server
•Alerts: Configuration of network alerts for Guard and Scanner
•Email: Configuration of email alerts via SMTP. The transmission of emails is
supported by the modules Guard, Scanner, Avira AntiVir Server Updater
Avira GmbH Avira AntiVir Server 15

Scanning
7Scanning
7.1 Creating a new scan profile
To create a new scan profile and use it to scan for viruses and malware:
fClick on Profiles in the AntiVir Server Console.
Predefined scan profiles are displayed.
fClick the Create new profile symbol.
The New profile profile is displayed among the previously existing profiles.
fRename the scan profile, if necessary, by clicking the symbol.
fSelect the nodes and directories to be scanned by clicking the box of the respective
directory level.
You have the following options for selecting directories:
–Directory, including subdirectories (black check mark)
–Directory, without subdirectories (green check mark)
–Only the subdirectories in a directory (gray check, subdirectories have black check
marks)
–No directories (no check marks)
fCreate a new job under Scheduler and start the scan job.
7.2 Customizing and using a scan profile (manual selection)
You can start a scan based on your needs very quickly with a customized scan profile
(manual selection) without having to create a new scan profile.
To customize a scan profile and use it to scan for viruses and malware:
fClick on Profiles in the AntiVir Server Console.
Predefined scan profiles are displayed.
fOpen the file tree in the Manual Selection scan profile until all drives and
directories to be scanned are open:
–Click the + sign: The next directory level is displayed.
–Click the - sign: The next directory level is hidden.
fSelect the nodes and directories to be scanned by clicking the respective box of the
respective directory level:
You have the following options for selecting directories:
–Directory, including subdirectories (black check mark)
–Directory, without subdirectories (green check mark)
–Only the subdirectories in a directory (gray check, subdirectories have black check
marks)
–No directory (no check marks)
fCreate a new job under Scheduler and start the scan job.
16 Avira AntiVir Server Avira GmbH

Scanning
7.3 Creating a new scan job
To create a job which scans for viruses and malware automatically:
fClick on Profiles in the AntiVir Server Console.
fClick the Insert new job symbol.
The Name and description of the job dialog box is displayed.
fName the job and describe it, if necessary.
fClick Next.
The Type of job dialog box is displayed.
fSelect the Scan job.
fClick Next.
The Time of the job dialog box is displayed.
fSelect the time at which the scan is to be performed:
–Immediately
–Daily
–Weekly
–Interval
–Single
fEnter the date, if appropriate, for your selection.
fClick Next.
The Selection of the profile dialog box is displayed.
fSelect the profile to be scanned.
fClick Finish.
The job is started immediately.
– OR –
The job is inserted in the scheduler and is carried out in a certain interval.
You can edit jobs further via the following symbols:
View properties of a job
Modify job
Delete job
Avira GmbH Avira AntiVir Server 17

Scanning
7.4 Reacting to found viruses and malware
If correctly configured, Avira AntiVir Server has already automatically carried out all
important tasks on your computer:
•The infected file is repaired or at least deleted.
•If it could not be repaired, access to the file is blocked and, according to the
configuration, the file is deleted, moved to quarantine, renamed or the access on the
file is denied.
•An email or network alerts were sent.
You should do the following:
fTry to detect the way the virus / unwanted program infiltrated your system.
fPerform targeted scanning on the data storage supports you used.
fInform your team, superiors or partners.
fInform your system administrator and security provider.
7.5 Handling files in quarantine
The Quarantine Manager controls affected files. AntiVir Server is able to move affected
files to quarantine directory in a specific format. These files cannot be executed or
opened afterwards.
7.5.1 To handle files in quarantine (*.qua)
fClick on Quarantine in the AntiVir Server Console.
fCheck which files are affected so that you can reload the originals back onto your
computer from another source, if necessary.
If you would like to view more detailed information on a file:
fSelect the file and click .
The Properties dialog box with additional information on the file is displayed.
If you would like to delete a file:
fSelect the file and click .
The file is deleted from quarantine. It will not be restored.
If you want to move a suspicious file to quarantine manually:
fClick
The default Windows dialog box for selection of the file is displayed. The
suspicious file is moved to quarantine.
18 Avira AntiVir Server Avira GmbH

Scanning
7.5.2 Restoring files in quarantine
To restore files in quarantine:
Danger of data loss and damage to the operating system of the computer!
fUse the Restore selected object function only in exceptional cases.
fOnly restore files which could be repaired by a repeated scan.
3File re-scanned and repaired.
fClick on Quarantine in the AntiVir Server Console.
If you would like to restore a file at its original location:
fSelect the file and click .
You are asked whether you want to restore the file.
fClick Yes.
This file is restored to the directory from which it was moved into quarantine.
Avira GmbH Avira AntiVir Server 19

Updating
8Updating
8.1 Updating Avira AntiVir Server
The effectiveness of anti-virus software depends entirely on the scanning engine and the
virus definitions being up to date. For this reason, regularly download updates for
AntiVir Server from our download servers. To carry out regular updates, the component
Avira AntiVir Server Updater is integrated in AntiVir Server. Avira AntiVir Server
Updater is updating the following program components:
•Virus definition file
•Scanning engine
•Program files (product update)
On the AntiVir Server Console under Scheduler you can create update jobs that are
carried out at the specified intervals by Avira AntiVir Server Updater. With every update
order, the status of the virus definition files and the scanning engine is checked and
updated if necessary, product updates are carried out in accordance with the
configuration. On AntiVir Server Console you can start a product update manually in the
context menu of a server node. After an update, AntiVir Server does not have to be
restarted.
You can obtain updates via the following servers:
•directly from the Internet via a web server of Avira GmbH
•via a web- or file server in the Intranet, which downloads the update files from the
Internet as the master server and supplies them to other servers. This is useful if you
want to update AntiVir Server on more than one computer in a network. By setting
up a master server, it can be ensured that AntiVir Server on the servers to be
protected is up to date in a resource-saving way.
If a web server is used, download is carried out via HTTP-protocol. If a file server is used,
the update files are accessed via the network. You configure the update on the AntiVir
Server Console.
You can use AntiVir Internet Update Manager (file or web server under
Windows) or AntiVir Mirror Script (file server under Linux) as web- or file
servers in the Intranet. These programs mirror download servers of
AntiVir products (e.g. AntiVir Server) and can be obtained in the Internet
on http://www.avira.com. However, you can also update AntiVir Server by
cascading via a central file server in the Intranet on the servers to be
protected.
20 Avira AntiVir Server Avira GmbH