AVIRA ANTIVIR SHAREPOINT User manual

User Manual
SharePoint
www.avira.com

Copyright information
The purpose of this information is to acknowledge and recognize the code from third-party suppliers used for Avira
AntiVir SharePoint. We would like to thank the copyright owners for allowing us to use their code.
MD5 Code
The MD5 code used for security reasons was written by the Information Science Institute of the University of Southern
California and derived from the Message-Digest algorithm from RSA Data Security, Inc.
Copyright (C) 1991-2, RSA Data Security, Inc. Created in 1991.
All rights reserved.
The license to copy and use this software is distributed with the stipulation that it is designated as the "RSA Data Security,
Inc. MD5 Message-Digest Algorithm" in all materials mentioned by this software or which refer to this software or these
functions.
The license is also granted for the creation of works deriving from this, with the stipulation that these works are
designated as "derived from the RSA Data Security, Inc. MD5 Message-Digest Algorithm" in all materials which mention
the derived work or refer to it.
RSA Data Security, Inc. provides no warranty whatsoever regarding the marketability of this software or the suitability of
this software for a particular purpose. It is provided without any guarantee in its present form. This applies to expressed
or implied guarantees.
This information must be contained in every copy of each part of this documentation and/or software.

Table of Contents
Table of Contents
1Introduction .......................................................................................................... 4
2Symbols ................................................................................................................. 5
3Product information............................................................................................... 6
3.1 Overview of functions...........................................................................................................6
3.2 Delivery scope........................................................................................................................7
3.3 System requirements.............................................................................................................7
3.4 Licensing ................................................................................................................................8
4Installation and Uninstallation............................................................................... 9
4.1 Installation.............................................................................................................................9
4.2 Uninstallation......................................................................................................................10
5User interface and operation ................................................................................ 11
5.1.1 User interface .........................................................................................................11
5.1.2 Operation ...............................................................................................................11
6Virus detection..................................................................................................... 12
7Status .................................................................................................................. 13
7.1.1 AntiVir SharePoint Service....................................................................................13
7.1.2 SharePoint anti-virus settings...............................................................................14
7.1.3 Last update.............................................................................................................15
7.1.4 Last virus ................................................................................................................16
8Settings ............................................................................................................... 17
8.1 AntiVir configuration ..........................................................................................................17
8.2 SharePoint anti-virus settings ............................................................................................19
8.3 Updater configuration.........................................................................................................20
9Updates................................................................................................................ 23
10 Info and Service ................................................................................................... 24
10.1.1 Suspicious files .......................................................................................................24
10.1.2 False positive..........................................................................................................24
Avira GmbH Avira AntiVir SharePoint 3

Introduction
1Introduction
Avira AntiVir SharePoint from Avira GmbH is an anti-virus solution specially developed
for Microsoft SharePoint and prevents the distribution of viruses, malware, undesired
programs and other dangers via SharePoint Team pages.
Viruses, malware, undesired programs and other dangers will be referred to as viruses
and malware in this manual.
The manual describes the installation and use of the program.
On our website, http://www.avira.com, you can download the manual for Avira AntiVir
SharePoint as a PDF file, update Avira AntiVir SharePoint or renew your license.
Our website also contains information such as the telephone number for technical
support and our newsletter, for which you can sign up there.
Your Avira GmbH team
4 Avira AntiVir SharePoint Avira GmbH

Symbols
2Symbols
The following symbols are used:
Symbol Explanation
Appears before a condition which must be met before an action is carried
out.
Appears before a step you carry out.
Appears before a warning of the danger of critical data loss.
Appears before a note with especially important information or a tip
which makes it easier to understand and use the Avira AntiVir SharePoint.
Avira GmbH Avira AntiVir SharePoint 5

Product information
3Product information
3.1 Overview of functions
AntiVir SharePoint is an anti-virus solution specially developed for Microsoft SharePoint
and supports both Microsoft SharePoint Services and Microsoft SharePoint Portal Server
2003.
Microsoft SharePoint technologies provide users with documents of a company at a
central point and manage these with a version control. Documents are accessed via a web
desktop – the SharePoint Team pages - via upload and download. The documents or files
are stored centrally in an MS SQL database. This represents a serious security problem,
as the data cannot be protected against virus protection with a conventional anti-virus
solution such as an on-demand or on-access virus scanner: on-demand and on-access
virus scanners require the data to be scanned to be available as files in the file system.
AntiVir SharePoint scans documents for viruses and malware when uploading and
download to and from the SharePoint Team pages. In the event of a virus detection,
transfer is prevented if a repair of the document is not possible.
Architecture:
6 Avira AntiVir SharePoint Avira GmbH

Product information
In the SharePoint technologies, use of external anti-virus programs is controlled via the
Antivirus Manager (AVM). Virus protection functions can be enabled in the SharePoint
anti-virus settings. If the virus functions are enabled, AVM transfers the data requested
for upload or download to an external anti-virus program.
AntiVir is integrated in the SharePoint technologies via a plug-in. The AntiVir
SharePoint plug-in processes requests for scanning for viruses by SharePoint and
forwards these to the AntiVir SharePoint service. The AntiVir SharePoint service
forwards requests for scanning to the AVSharePoint Scan service, starts the AntiVir
update service and processes the settings of the AntiVir administration. This is
integrated in the SharePoint central administration as a web desktop. The scan for
viruses and malware is carried out by the AVSharePoint scan service.
3.2 Delivery scope
AntiVir SharePoint offers comprehensive anti-virus protection for company data that
you manage and provide with SharePoint technologies. In this way you also protect the
computer systems used for SharePoint. AntiVir SharePoint is easy to install and has the
following configuration possibilities:
•Settings to scan for viruses and malware:
Archive scan
Macro-virus heuristic
WIN 32 heuristic
•Settings for automatic update (update of the scanning engine and of the virus
definition file):
Update of web server or fileserver possible
Update via proxy server possible
Email notification function
•Report settings:
Limit size of report file
3.3 System requirements
Avira AntiVir SharePoint supports the SharePoint technologies:
•Windows SharePoint Services
•Windows SharePoint Portal Server 2003
The following system requirements exist:
•Windows SharePoint Services or Windows SharePoint Portal Server 2003
•.NET Framework Version 2 or 3
•from Intel Pentium III compatible or x64 compatible 64-bit processor
•at least 512 MB RAM
•at least 100 MB free hard disk memory
Avira GmbH Avira AntiVir SharePoint 7

Product information
3.4 Licensing
You require a license to use Avira AntiVir SharePoint. The license is available in the form
of a digital license key, the file hbedv.key. You can obtain the license file by email from
Avira GmbH. The license file contains the license for all products that you have ordered
in an order process.
With the license file hbedv.key you can activate your license for Avira AntiVir
SharePoint. During installation you are asked to download this license file. To extend
your license to download the license after installation, save the license file to the
installation directory.
8 Avira AntiVir SharePoint Avira GmbH

Installation and Uninstallation
4Installation and Uninstallation
4.1 Installation
Before installing AntiVir SharePoint, check the following conditions:
3Ensure that the system requirements are met (see System requirements).
3Ensure that you are logged in on the computer as an administrator or as a user with
administrator rights.
3Ensure that an Internet connection or a network connection to a download server
exists for updating AntiVir SharePoint. If you use a fileserver, you may require a user
name and a password for serve login.
3Ensure that a valid license file hbedv.key exists and is stored in a local directory on
the server.
In order for the web-based SharePoint administration to function correctly, the
following settings are required in the Internet Information Service (IIS):
fSet the web service extensions .NET Framework 2.x or 3.x to the value 'Allowed'.
You can find the web service extensions in the Internet Information Service Manager
in the section Web service extensions.
fSet the ASP.NET Version used by the SharePoint central administration to Version
2.x or 3.x. Navigate in the Internet Information Service Manager to Websites ::
SharePoint central administration :: Properties :: ASP.NET :: ASP.NET-
Version.
You can make the settings either before or after installation of AntiVir
SharePoint.
How to install Avira AntiVir SharePoint:
fRun the file setup.exe. An installation assistant is started
fFollow the instructions of the installation assistant:
fConfirm stopping of the WWW publishing service.
fConfirm that you accept the license agreements.
fEnter a user with access rights to a released AntiVir SharePoint update directory It is
necessary to enter a user account if updates are carried out via a fileserver and access
rights are required for the fileserver. You can reconfigure this setting after
installation in the AntiVir SharePoint Administration.
fDownload the license file hbedv.key.
fStart installation.
fComplete installation with Finish.
Avira GmbH Avira AntiVir SharePoint 9

Installation and Uninstallation
4.2 Uninstallation
Carry out uninstallation via the control panel of the operating systems:
fUnder Control panel :: Software search for Avira AntiVir SharePoint and click on
the option Remove.
fConfirm uninstallation.
During uninstallation the AntiVir services are stopped, all program and report files are
deleted.
10 Avira AntiVir SharePoint Avira GmbH

User interface and operation
5User interface and operation
5.1.1 User interface
SharePoint has a web-based desktop, AntiVir Administration, which is integrated in the
SharePoint central administration.
You can access the AntiVir administration via the SharePoint central administration:
Start :: Programs :: Administration :: SharePoint central administration ::
AntiVir administration
The AntiVir administration has the following sections:
–Status: Status information on the AntiVir SharePoint service, SharePoint
Antivirus settings and the status of AntiVir SharePoint.
–Configuration: Configuration pages to define the scope of the virus scan of
AntiVir SharePoint, for setting the SharePoint anti-virus settings, to set the
automatic update
–Information: Information on the current version and on contact and support
addresses
5.1.2 Operation
AntiVir administration corresponds to the standards of a web-based desktop:
–You can navigate in the AntiVir administration via links. Commands are available
via links and buttons.
–During configuration you must confirm your inputs on the relevant
configuration page with the button OK in order to accept the settings. The
settings are accepted without a restart.
Avira GmbH Avira AntiVir SharePoint 11

Virus detection
6Virus detection
During upload or download of documents to or from SharePoint Team pages, AntiVir
SharePoint scans these documents for viruses and malware. If AntiVir finds viruses or
malware in a document, SharePoint is informed. The transfer of the document is
prevented by SharePoint. The user of the SharePoint Team page receives a message:
You can specify behavior in the event of a virus detection under
SharePoint anti-virus settings. In this way, for example, you can permit
the download of infected files to allow users to scan infected documents
on their own computer system for viruses and malware.
12 Avira AntiVir SharePoint Avira GmbH

Status
7Status
The status and statistical information are displayed under the section Status :
7.1.1 AntiVir SharePoint Service
The connection status to the AntiVir SharePoint service is displayed:
Symbol Info Status description
Connected to the
service Enabled A connection exists to the AntiVir
SharePoint service.
No connection to the
service Disabled A connection exists to the AntiVir SharePoint service.
If no connection to the AntiVir service exists, files cannot be scanned for
viruses and malware during uploads and downloads! Check in the operating
system under Services whether the AntiVir SharePoint service is started
and if necessary restart the service.
Avira GmbH Avira AntiVir SharePoint 13

Status
7.1.2 SharePoint anti-virus settings
The status of the SharePoint anti-virus settings is displayed:
Symbol Info Status Action description
During
uploads and
downloads
Secure Change
The virus protection
functions for uploads AND
downloads are enabled in the
SharePoint anti-virus
settings. You can access the
SharePoint anti-virus settings
directly via the link Change.
During
upload
-OR-
During
download
Not
secure Change
The virus protection
functions for uploads OR
downloads are disabled in the
SharePoint anti-virus
settings. You can access the
SharePoint anti-virus settings
directly via the link Change.
Not enabled Not
secure Change
The virus protection
functions for uploads AND
downloads are disabled in the
SharePoint anti-virus
settings. You can access the
SharePoint anti-virus settings
directly via the link Change.
If the status of the SharePoint anti-virus-settings is not secure, documents
are not scanned for viruses and malware during uploads or downloads.
Navigate to the SharePoint anti-virus settings via the link Change and
enable the virus protection during uploads AND downloads.
14 Avira AntiVir SharePoint Avira GmbH

Status
7.1.3 Last update
Information on the last update of the scanning engine and the virus definition file is
displayed:
–Status information on the update with date of the last update
–Version of the virus definition file (VDF)
–Version of the scanning engine
Symbol Status Action description
Date of the
last update,
e.g.
05.11.2007
Start
update
The last VDF update was less than
one day ago. The update status is
secure. You can start an update via
the link Start update.
Date of the
last update,
e.g.
05.11.2007
Start
update
The last VDF update was more than 1
day and less than 3 days ago. The
update status is not secure. You can
start an update manually via the link
Start update.
Date of the
last update,
e.g.
05.11.2007
Start
update
The last update was more than 3 days
ago or was not carried out. The
update status is not secure. You can
start an update manually via the link
Start update.
If the update status is not secure, you should update AntiVir immediately.
Anti-virus protection can only be ensured with an up-to-date virus
definition file and scanning engine. Start an update via the link Start
update. Configure the automatic update function in the section
Configuration :: Updater configuration.
Avira GmbH Avira AntiVir SharePoint 15

Status
7.1.4 Last virus
Information on detected viruses is displayed:
–Last virus detected
–Number of files scanned
Symbol Info Status description
Reset No viruses were detected
Name of the last
virus detected
Number of files
scanned
Reset
Viruses were detected
You can reset the statistics by
clicking on the link Reset.
16 Avira AntiVir SharePoint Avira GmbH

Settings
8Settings
8.1 AntiVir configuration
Under AntiVir configuration you can configure the size of the report files and the
behavior of AntiVir SharePoint.
Settings for the report
–Limit size of the report file
Enter the maximum size of the report files in KB in this input box. If the
maximum size of the report file is exceeded, the oldest entries are automatically
deleted. The default setting is 1000 KB and is recommended. With this entry you
limit the size of the report file savapi.log of the service AntiVir SharePoint
Scan Service. The report file is stored in the following directory:
C:\Documents and Settings\All Users\Application
Data\Avira\AntiVir SharePoint\LOGFILES
Settings for scanning archives
–Scanning archives
If this option is enabled, archives are scanned. The archives are unpacked and
scanned. The archive scan is enabled by default and is recommended. As the
archive scan may require more computer resources, you have further options to
limit scanning in archives or to configure the behavior of the scan in archives.
–Smart extensions
If this option is enabled, AntiVir SharePoint detects whether a file is a packed file
format (archive), even if the file extension differs from usual extensions, and
scans the archive. Each file must be opened to check the file formats. This slows
down the scanning speed. This setting is enabled by default and is recommended.
–Limit recursion depth of the scan
When scanning in archives, AntiVir SharePoint uses a recursive scan: archives in
archives are unpacked and scanned for viruses and unwanted programs. Limit the
recursion depth. Permitted values are 1 to 99. The default value for the recursion
depth is 5 and is recommended. Example: the recursion depth is 2. All archives
located directly in the main archive are unpacked and scanned.
–Alarm with archive nestings via
You can prevent the transfer of deeply nested archives. Deeply nested archives,
so-called 'archive bombs', are a popular method of concealing viruses and
infiltrating systems. The transfer of archives that are more deeply nested than
the specified value is prevented on the SharePoint Team pages. Permitted values
are 1 to 300. The default value is 150 and is recommended.
–Maximum size of files to be scanned
Restrict the scan to a maximum size of archive to be unpacked. Permitted values
are 1 to 600 MB. The default value is 300 MB and is recommended.
Avira GmbH Avira AntiVir SharePoint 17

Settings
Extended scan settings
–Macro heuristic
AntiVir contains a very powerful macro-virus heuristic. If this option is enabled,
documents are scanned for unknown macro-viruses. In an affected document, all
macro-viruses are deleted if repair is possible.
–Win 32 heuristic
AntiVir contains a very powerful heuristic for Windows file viruses, worms and
Trojans that can also detect unknown viruses, worms and Trojans. If this option
is enabled, you can set here how "strict" this heuristic should be:
Detection level low
If this option is enabled, AntiVir detects fewer viruses, worms and Trojans, the
risk of possible false positives is low here.
Detection level medium
This setting is enabled by default if you have selected application of this heuristic.
Detection level high
If this option is enabled, AntiVir detects a very large number of unknown viruses,
worms and Trojans, but you must also expect false positives.
18 Avira AntiVir SharePoint Avira GmbH

Settings
8.2 SharePoint anti-virus settings
Under SharePoint Anti-virus settings you can configure the anti-virus protection
settings of the SharePoint Antivirus Manager. With the SharePoint Antivirus Manager
you can control the behavior of the anti-virus program used:
–Scan documents during upload
If this option is enabled, documents are scanned for viruses and malware during
upload, i.e. before storing in the SharePoint database.
–Scan documents during download
If this option is enabled, documents are scanned for viruses and malware before
download.
–Allow users to download infected documents
If this option is enabled, a download of documents is permitted, even if the
document is infected by viruses or malware. Users should scan all downloaded
documents on their own computer system for viruses and malware with an anti-
virus program.
–Attempt to clean infected files
If this option is enabled, AntiVir SharePoint attempts to remove viruses or
malware from the affected document. If viruses can be successfully removed, the
transfer from and to the SharePoint Team pages is permitted.
–Virus scan timeout after n seconds
Enter a timeout in seconds for the virus scan process. The default value is 300
seconds and is recommended.
–Permissible thread number for virus scanner
Enter a number of threads to be permitted for the virus scan process.
The configuration of the anti-virus protection settings is implemented on
the SharePoint page. Only a link from AntiVir to this configuration page is
available. Information on individual configuration options is available in
the Help section of Microsoft SharePoint. You can also access the
SharePoint anti-virus setting via the SharePoint central administration:
fNavigate from the Windows SharePoint central administration:
Security configuration :: Configure anti-virus settings
Avira GmbH Avira AntiVir SharePoint 19

Settings
8.3 Updater configuration
On the page Updater configuration you can define the network settings and if
necessary proxy settings for the automatic update of AntiVir SharePoint. You can also
configure an email message by SMTP.
Network settings
You can obtain updates via a web server or via fileserver / share from the Internet or
Intranet (see ch. Updates).
–Update URL
Enter the URL or the IP address of the server from which you want to download
the updates. You can enter more than one web server, separated by commas.
AntiVir SharePoint uses the first available web server for the update:
http://dl1.pro.antivir.de/upd,
http://dl2.pro.antivir.de/upd
If you want to obtain the updates from a fileserver via a share directory, enter the
UNC path for the share directory:
\\<server>|<IP address>\<share>\<path>
–Update interval in minutes
Enter an update interval in minutes. AntiVir SharePoint checks at the pre-
defined intervals whether updates are available for AntiVir SharePoint on the
specified update server, and where appropriate starts the update process. The
default setting is 120 minutes and is recommended.
–Network user name
Enter a user name for authentication if you use a share directory on the fileserver
for the update.
–Network password
Enter a password for authentication if you use a share directory on a fileserver
for the update.
–Confirm network password
Enter the network password to confirm.
20 Avira AntiVir SharePoint Avira GmbH