ESET NOD32 ANTIVIRUS - FOR KERIO User manual

ESET NOD32 Antivirus
for Novell Netware Server
Installation
w e p r o t e c t d i g i t a l w o r l d s

2ESET NOD32 Antivirus for Novell Netware Server
Copyright © Eset, spol. s r. o.
All rights reserved.
No part of this document may be reproduced or transmitted
in any form or by any means electronic or mechanical, for
any purpose without the express written permission of
Eset, spol. s r. o. Information in this document is subject to
change without prior notice.
Certain names of program products and company names
used in this
document might be registered trademarks or trademarks
owned by other entities.
Eset, NOD32 and AMON are trademarks of Eset, spol. s r. o.
Microsoft and Windows are registered trademarks of
Microsoft Corporation.
Eset, spol. s r. o.
Svoradova 1, 811 03 Bratislava, Slovak Republic
http://www.eset.sk/en
Technical Support Worldwide:
http://www.eset.com/support
Technical Support for Europe:
http://www.eset.eu/support
REV.20071116-002

3
1. Introduction
This User Guide describes the usage of ESET NOD32
Antivirus for Novell Netware Server (or just ESET NOD32
Antivirus for Novell), namely:
– installation of the product,
– conguration of individual modules,
– updating of the product.
ESET NOD32 Antivirus for Novell consists of the fol-
lowing NLM modules:
– AMON.NLM – on-access scanner, which automatically
scans les accessed from the network or locally, or -
les saved to the server.
– NOD32.NLM – on-demand scanner, which can be di-
rected to scan certain groups of les on the disk (usu-
ally folders, volumes, or the whole hard disk). In this
case, it is only a single action – after it is completed,
the NOD32.NLM module is removed from memory.
– NOD32UP2.NLM – module providing a virus signatu-
re database update for the modules AMON.NLM and
NOD32.NLM.
2. Installation
Create a directory named, for example NOD32, on vo-
lume SYS: and copy les from the installation packages
for the ESET NOD32 Antivirus for Novell into it. It is recom-
mended to enable automatic startup of AMON.NLM and
NOD32.NLM after each start of the server.We recommend
enabling the startup using the system le AUTOEXEC.NCF
with these commands:
LOAD SYS:/NOD32/AMON
LOAD SYS:/NOD32/NOD32UPD [parameters]
Individual parameters are described in the following
chapters. In the case of the module AMON, it is recom-
mended to provide accessibility of the le AMON.CFG,
which will transfer conguration to AMON at startup.
Quick guide through the complete
installation
Extract the installation package. eg: into volume SYS:/
NOD32. Also, it is recommended to create le AMON.CFG
and insert the following into it:
recipient=network_administrator_login
notify
clean
delete
log
Then load AMON - memory-resident monitor using
the following command on the Novell system console:
LOAD SYS:/NOD32/AMON.NLM
With the above mentioned setting, AMON will send
information about inltrations to the user network_ad-
ministrator_login, but also to a user, who manipulated
with the infected le (parameter notify). At the same
time, AMON will attempt to clean the infected le, and if
it is not possible, the le will be deleted.
Next, it is required to provide updates for ESET NOD32
Antivirus for Novell.This product does not download virus
updates from Internet update servers, but it uses a mirror
directory created for example by NOD32 forWindows Pro-
fessional Edition.The mirror directory must be located on
the same hard disk as the installation of ESET NOD32 Anti-
virus for Novell (let us assume it is located in SYS:/PUBLIC/
MIRROR). To congure the mirror correctly, run this com-
mand on the console to set up and launch the NOD32UP2.
NLM module:
LOAD SYS:/NOD32/NOD32UP2.NLM SYS:/PUBLIC/MIRROR/
-update -period=60
Now ESET NOD32 Antivirus for Novell will be updated
from the mirror directory SYS:/PUBLIC/MIRROR every hour
(parameter -period=60).
It is recommended to enable automatic startup of
AMON.NLM and NOD32UP2.NLM at each server startup
using system le AUTOEXEC.NCF.
3. Modules
AMON.NLM
To load AMON, use the following command on the sys-
tem console:
LOAD SYS:/NOD32/AMON
To unload AMON from memory, use the following com-
mand:
UNLOAD AMON
ESET NOD32 Antivirus for Novell Netware Server

4
AMON.CFG
If there is present the le AMON.CFG in the directory
with the module AMON.NLM, conguration from AMON.
CFG will be transferred to AMON at its startup.
Syntax of the le AMON.CFG is as follows (each line
may contain one of the following switches one switch
per line):
onread+ (default setting)
Files will be tested in a moment when a command to
open/read is detected.
The opposite switch is: onread-
onwrite+ (default setting)
Files are tested at the moment when a command to
create/modify is detected.
The opposite switch is: onwrite-
onrename+ (default setting)
Files are tested at the moment when a command to
rename is detected.
The opposite switch is: onrename-
all (default setting)
All les are tested. Otherwise, if the parameter all-
is used, only extensions dened by the Eset Compa-
ny are tested.
notify
When an inltration is detected, AMON sends a mes-
sage to the user who attempted to access the infected
le (using the NetWare Message PopUp Service).
recipient=user1, user2 ...
When an inltration is detected, AMON sends a mes-
sage to all users in the list. It is possible to list more
users – in this case, use commas to delimit them –
see the example above.
Other parameters:
pattern
log
logappend
logrewrite
clean
rename
delete
heur
heursafe
heurstd
heurdeep
These switches are identical to those used in module
NOD32.NLM. They are described below (when ente-
ring parameters, always omit the hyphen).
NOD32.NLM
To run the NOD32 diagnostic scan or clean, enter the com-
mand as follows:
LOAD SYS:/NOD32/NOD32 [parameters] [path list]
If [path list] is not entered, NOD32 will automatically scan
whole disk.
Parameters:
-? -h -help
Displays list of parameters with descriptions.
-subdir+ (default setting)
Enables testing of subdirectories.
The opposite switch is: -subdir-
-pack+
Enables testing of internally compressed les.
The opposite switch is: -pack- (default setting)
-arch+
Enables testing of archives (ZIP, RAR, ARJ...).
The opposite switch is: -arch- (default setting)
-pattern+ (default setting – recommended)
Enables testing using virus signatures.
The opposite switch is: -pattern-
-heur+ (default setting – recommended)
Enables detection using a heuristics method.
The opposite switch is: -heur-
There are three levels of heuristics analysis sensitivi-
ty:
-heursafe
-heurstd (default setting – recommended)
-heurdeep
Actions to take after an inltration is found can be
modied with the following parameters. The parame-
ters can be suitably combined with each other. For exam-
ple, parameters -clean -delete provide that an infected
le, which cannot be cleaned, will be deleted. In case of
the module AMON.NLM, not using any of the three fol-
ESET NOD32 Antivirus for Novell Netware Server

5
lowing parameters will result only in blocking access to
infected les.
-clean
Automatically cleans infected les.
-rename
Renames infected les.
-delete
Deletes infected les.
-prompt (not available for AMON.NLM)
Displays a dialog window individually on every in-
fected le.
-log+ (default setting)
Enables logging to le (le NOD32.LOG, or AMON.
LOG).
The opposite switch is: -log-
Log maintenance:
-logappend (default setting)
New information is attached to the end of existing
log le.
-logrewrite
Logle will be deleted with each module’s startup.
-log=<lename>
Use this parameter to create your own log le.
Other parameters:
-list+
Enables listing of all scanned objects.
The opposite switch is: -list- (default setting)
Conguration – a practical example:
LOAD SYS:/NOD32/NOD32 -pack+ -arch+ -clean -delete
(Control of the whole disk including internally com-
pressed les and archives. In case an inltration is fo-
und, a le will be cleaned or deleted.)
NOD32UP2.NLM
This product does not download virus updates directly
from Internet update servers, but it uses a mirror directory
created, for example, by ESET NOD32 Antivirus 2.7 Mirror
Server (LAN Update Server). The mirror directory must be
located on the same hard disk as the installation of ESET
NOD32 Antivirus for Novell.
The syntax is as follows:
LOAD SYS:/NOD32/NOD32UP2 mirror_directory [folder_
with_NLM_modules] [parameters]
Only mirror_directory, or a path to the mirror folder is
required. This folder will provide update les for the
modules NOD32.NLM and AMON.NLM.
[directory_with_NLM_modules] is optional in case
the le NOD32UP2.NLM is located in the directory to-
gether with les NOD32.NLM and AMON.NLM.
Possible parameters:
-update
Provides NOD32 updates (otherwise, available upda-
tes will be displayed only).
-period=n
This parameter triggers update attempts every n mi-
nutes. We recommend updating every hour (-peri-
od=60).
-show_retvals
Use of this parameter returns all possible return valu-
es with brief comments.
-help
Will list all parameters with brief comments.
Special parameters:
-no_signature
This parameter can be used to avoid error No. 107.The
error means that update les have an invalid digital
signature.
Update - a practical example:
LOAD SYS:/NOD32/NOD32UP2.NLM SYS:/PUBLIC/MIRROR/
-update -period=60
(The modules AMON.NLM and NOD32.NLM will be
updated every hour from the mirror directory: SYS:/
PUBLIC/MIRROR/).
ESET NOD32 Antivirus for Novell Netware Server