ESET REMOTE ADMINISTRATOR V1 Installation guide

Remote Administrator
Overview

Remote Administrator Overview
ii
Copyright © 1997 – 2006 ESET LLC. All rights reserved.
No part of this document may be reproduced or transmitted in any form or by any
means electronic or mechanical, for any purpose without the express written permission
of ESET LLC. Information in this document is subject to change without prior notice.
Certain names of program products and company names used in this document might
be registered trademarks or trademarks owned by other entities.
ESET, NOD32 and AMON are trademarks of ESET.
Microsoft and Windows are registered trademarks of Microsoft Corporation.
ESET, LLC
610 West Ash Street
San Diego, California 92101
http://www.eset.com
For Sales and Technical Support (US and Canada):
Tel: [phone]
Fax: [phone]
Online purchase: http://www.eset.com/purchase/index.php
Sales email:
[email protected]
Technical Support Worldwide:
http://www.eset.com/support/index.php
This guide is frequently updated to reflect changes in the product. The latest version can
always be found at http://www.eset.com/download/manual.htm
This guide was prepared referring to NOD32 for Windows Version 2.7 (December 2006)

Remote Administrator Overview
iii
Table of Contents
ESET NOD32 Antivirus Overview __________________________________________ 1
Core ESET NOD32 Antivirus Technology 1
Traditional Signatures 2
Limitations for Signature-based Threat Scanning 2
Heuristics Explained 2
Generic Signatures 3
Passive Heuristics 3
Active Heuristics 4
ThreatSense® - Leveraging all detection 4
The Value of NOD32 5
ESET NOD32 Antivirus - Product Modules ________________________________ 6
NOD32 for Windows Workstations 6
What does ESET NOD32 Antivirus do? 6
Components – Standard Client 7
What is NOD32’s On-Demand Scanner? 8
What is AMON? 8
What is DMON? 9
What is EMON? 9
What is IMON? 10
ThreatSense.Net – Closing the Circle 11
NOD32 Control Center – NOD32 for Windows client 12
Updating ESET NOD32 Antivirus 13
Centrally Managing Clients with NOD32 Remote Administrator______________ 15
Remote Administrator Server (RAS) 17
Remote Administrator Console (RAC) 17
RA Console Capabilities 17
RA Console Panels 18
NOD32 Clients 19
Standard Client – NOD32 for Windows 19
NOD32 LAN Update Server 19
NOD32 Enterprise Edition 19
Remote Administrator Deployment Options for NOD32 ____________________ 20
Remote Installation 20
Remote Installation Process 20
Installation File Set 21
Installation Example 22
Communication among RA Components 23
Remote Administration and the Update Process 24
Updating with LAN Update Server 25
Updates and Server Bandwidth 26
Deployment Options in Larger Networks 26
Configuration and Remote Clients _______________________________________ 28
Configuration with Profiles 29
Scanning Profiles 29
Update Profiles 29
Implementing Configurations, Updates, or On-Demand Scans 30
Remote Administrator Reporting ________________________________________ 32
Index _________________________________________________________________ 35

Remote Administrator Overview
iv

Remote Administrator Overview
1
ESET NOD32 Antivirus Overview
ESET NOD32 Antivirus is an award-winning, multi-platform, unified anti-threat system
with a powerful graphical user interface. NOD32 stops more than just traditional viruses
-- it also detects, removes, and prevents these threats:
Adware
RATs (remote access tools)
Spyware
Trojan horses
Worms
Rootkits
Keyloggers
Potentially dangerous applications
These threats could affect the privacy, security, and confidentiality of the information on
a computer. Collectively, they are referred to as malicious software, or malware.
ESET NOD32 uses award-winning technology to detect tomorrow’s threats, in real-time,
by analyzing code execution for malicious intent – keeping you ahead of the malware
writers.
Core ESET NOD32 Antivirus Technology
ESET NOD32 Antivirus employs a unique technology called ThreatSense®, an optimized
scanning engine that looks for threats in four different ways in parallel:
Traditional signatures
Generic signatures
Passive heuristics
Active heuristics
First, let’s take a look at these methods as general concepts...

Remote Administrator Overview
2
Traditional Signatures
A specific threat has a specific set of bytes that uniquely identifies it.
Searching for that exact pattern of
bytes, an anti-threat tool can find and
identify that specific threat.
Though well suited to exploit
detection, signature scanning is
reactive and based on the
identification of a single object.
Because of this, it has limitations
against today’s advanced threats.
Limitations for Signature-based Threat Scanning
New threats are not detected until signatures are generated. PCs may be vulnerable
for hours, days, or weeks.
Malware writers use achiving and packing techniques to circumvent signature-
based detection. Compressing files hides the malware from signature-based tools.
Only some parts or forms of a complex virus may be detected initially. With a
polymorphic (dynamically changing) virus, some infected files might remain
undetected.
Pattern recognition techniques like signatures work effectively and efficiently for known
threats, but are ineffective for protecting against new threats. Heuristic scanning is the
solution to this problem...
Heuristics Explained
Heuristics is a method that uses rules to solve problems. For anti-threat software,
heuristics are a set of rules used to detect malicious behavior without needing to
uniquely identify the specific threat, as a classic signature-based “virus scanner” does.
Heuristics used by an anti-threat program might have rules to look for things like this:
Something that tries to copy itself into other programs
A program that decrypts itself when run
Code that binds to a TCP/IP port and listens for instructions over a network
connection
A process attempting to manipulate (copy, delete, modify, rename, etc.) files
required by the operating system or applications

Remote Administrator Overview
3
The advantage of heuristics is it can detect not just variants, or modified forms, of
existing malicious programs, but also new, previously unknown malicious programs.
Generic Signatures
One way to use heuristics to improve signature-based detection is to use generic
signatures. A generic signature is a scan pattern that matches more than one specific
piece of malware, possibly an entire family or set of variants.
Generic signatures help an anti-threat
system measure how similar something
is to known malware. Does it look like
anything we already know?
By looking for similarities, the anti-
threat tool can spot malware it hasn’t
seen before, without requiring a
definitive signature for that specific
threat.
However, Generic signatures may be
too restrictive, only finding threats that
have only minor differences.
Passive Heuristics
Passive Heuristics analyze a program as it is scanned, tracing through the instructions in
a program before passing the code to the processor for execution.
The idea is to analyze the suspicious
code to see what it appears to be
designed to do.
Passive heuristics rules look for
patterns, routines, or program calls that
indicate malicious behavior. This
approach is sometimes called
“code analysis.”
Passive heuristics, though a useful tool,
is very difficult to do well. There is no
single action that a malicious program
can perform that is not also allowed in
a “good” program.

Remote Administrator Overview
4
Active Heuristics
With active heuristics, the anti-threat system can execute the code to see what it actually
does. Execution occurs in a controlled, protected environment to avoid real damage.
The engine lets the code run in a
virtual environment and examines the
behavior performed in and changes
made to that virtual environment.
Active heuristics are useful in defeating
encryption, compression, and
polymorphic threats. It causes the
malware to “show” what it is designed
to do. This provides immediate
protection, not relying on signatures of
known threats for identification.
Since the code actually runs, it can’t
hide its malicious content.
ThreatSense® - Leveraging all detection
The best anti-threat solution is one that makes intelligent use of all viable detection
methods. That’s the idea behind NOD32’s ThreatSense® technology.
Viruses, worms, and spyware are constantly evolving as malware writers try to
circumvent security software. ThreatSense keeps NOD32 a few steps ahead.
The ThreatSense engine is a sophisticated, well-balanced system of advanced heuristics
and malware signatures, providing the best detection without compromising speed or
detection.
For most existing threats, ThreatSense includes a traditional form of malware signatures.
It also uses next-generation generic signatures to quickly detect known malware families
and their future variants.

Remote Administrator Overview
5
In addition to traditional and generic signatures, ThreatSense’s advanced heuristics
proactively decode and analyze executable code in a protected environment to identify
increasingly sophisticated malicious behavior, characteristic of today’s evolving threats.
What makes ThreatSense technology so accurate is its ability to perform all these types
of detections in parallel, not only improving its detection but also the speed with which
it operates. ThreatSense’s blended approach to detection leverages the benefits of each
technology and makes NOD32 the fastest, most accurate, and lowest impact solution in
the industry.
The Value of NOD32
If you’re managing thousands of workstations and servers across remote locations, you
need a robust, comprehensive solution you can rely on. NOD32 provides all-in-one
protection, small footprint, and fast performance, regardless of the size of the
organization. ESET NOD32 Antivirus products are advanced and easy on system
resources.
NOD32’s Remote Administrator makes it easy to deploy, monitor, and manage 10,000
machines from a single console. This powerful centralized management console installs
in minutes. An entire network of 500 machines can be installed in just a few hours.

Remote Administrator Overview
6
ESET NOD32 Antivirus
- Product Modules
NOD32’s broad product platform offers multiple solutions for organizations of all sizes:
Small, medium and large corporations
Government agencies
Educational institutions
Individual users
Proactive protection is available for Microsoft Windows, Linux, and MS DOS desktops and
servers, including file servers and mail gateways. Award-winning ThreatSense®
technology is at the core of each product ensuring the most-advanced protection
regardless of platform or network configuration.
Let’s begin by looking at the advanced protection available for individual workstations...
NOD32 for Windows Workstations
Desktop and mobile PC users can get the anti-threat protection they need with NOD32
without having to sacrifice detection or speed. And NOD32 is one of a very few products
that currently supports Windows® 64-bit systems
NOD32 was designed to perform anti-threat detection and prevention in two different
areas:
On-Access scanning – scanning files and data as they are accessed, safeguarding the
system at the most likely point of vulnerability. On-Access scanning also targets
operations with a specific type of data access (email, HTTP, etc.)
On-Demand scanning – scanning systems (storage, memory, boot sectors, etc.) as a
definitive task, either as desired or as a regularly scheduled operation.
What does ESET NOD32 Antivirus do?
ESET NOD32 Antivirus searches for threats within PCmemory, the system areas of disks,
files stored on those disks, and on HTTP and POP3 communication streams. A number of
different objects can hold viruses or other malware, such as files, archives, self-extracting
archives, run-time packers, and e-mail. NOD32 can open and inspect a variety of archive
file formats, including self-extracting files and files compressed with runtime packers.
NOD32 uses a variety of techniques to detect threats, which allow NOD32 to detect new,
unknown threats that may not have a name yet.

Remote Administrator Overview
7
Components – Standard Client
Protection against threats from multiple input sources is provided by these modules, all
included in NOD32:
AMON – On-access (memory-resident) scanner, automatically scans files before
they’re accessed
NOD32 – On-demand scanner, run manually on specific files or disks -- It can also be
scheduled to run during off-peak times
DMON – Microsoft Office document scanner, using the Microsoft Antivirus API
EMON – Additional module for scanning incoming/outgoing emails via the MAPI
interface, such as Microsoft Outlook and Microsoft Exchange, and also SSL-
encrypted email.
IMON – A memory-resident scanner for Internet browsing traffic (HTTP) and
incoming email via the POP3 protocol
All modules are managed from NOD32’s Control Center.
NOD32 is available for Microsoft Windows 95, 98, ME, NT 4.0, 2000, XP, Vista and 2003
Server, and for both 32-bit and 64-bit (x64) versions of XP, Vista and 2003 Server.

Remote Administrator Overview
8
What is NOD32’s On-Demand Scanner?
NOD32 for Windows Workstations includes an on-demand scanner, which can be run
manually or scheduled to run automatically on entire disks, disk volumes/directories, or
specific files.
NOD32’s On-Demand Scanner lets you immediately
check disks for threats as needed. You can perform an
immediate scan, as well as schedule periodic scans of
your system.
You should perform a full system scan of all disks
regularly. On-demand scanning begins with a self-check
of integrity, and a scan of computer memory. If a threat
is found in memory, NOD32 notifies the user with
recommended cleaning steps. Then, by default, it will
scan and clean individual files on disk detected as
infected.
What is AMON?
AMON (Access Monitor) is a memory-resident anti-threat monitor that automatically
checks files the moment they are opened, executed, created, or accessed. AMON is the
most important line of anti-threat defense.
AMON uses both heuristics and advanced methods of
the threat signature databases. These settings are
configurable through the NOD32 Control Center.
AMON detects all threats, on resident disks, removable
media (CDs, DVDs, USB cards, etc.), and shared network
disks, before a file is opened. It checks the boot sectors
of floppy diskettes the first time the diskette is accessed.
It is very important to enable automatic startup of AMON
and to stay up-to-date with the most current threat
signature database. If you disable AMON, your computer
will be more prone to becoming infected.
AMON is installed with Administrator privileges, requiring important system rights and
working as a system driver. By default, AMON starts automatically after each restart of
the computer.
When AMON is stopped, no active on-access anti-threat protection is available on the
computer.

Remote Administrator Overview
9
What is DMON?
DMON (Document Monitor) is a complementary add-on to AMON, providing an
additional layer of protection for Microsoft Office documents.
DMON scans Microsoft Office documents and files
downloaded automatically by Internet Explorer, such as
Microsoft ActiveX elements. DMON works with
applications that support the Microsoft Antivirus API
(AVAPI) interface, including Microsoft Office 2000, 9.0
and newer, and Microsoft Internet Explorer, 5.0 and
newer.
If AMON and IMON are enabled, it is not crucial to use
DMON – its protection is supplemental to that of
NOD32’s other components. However, using DMON
provides an additional layer of defense against viruses
and other threats that may spread via Microsoft Office
documents and ActiveX controls.
What is EMON?
EMON (Email Monitor) is an auxiliary module for scanning incoming/outgoing email,
providing an additional layer of protection in Microsoft Outlook.
EMON checks messages received by Microsoft
Outlook 95 (or newer) configured to use the MAPI
protocol connecting with a Microsoft Exchange server.
EMON also works with Outlook 2000 (or newer) when
using the MAPI, POP3, or IMAP protocols to connect to
Microsoft Exchange and other mail servers. EMON does
not need to be enabled if a mail client other than
Microsoft Outlook is used. Other mail clients, including
Microsoft Outlook Express, are checked for threats by
IMON.

Remote Administrator Overview
10
What is IMON?
IMON (Internet Monitor) is a memory-resident module that automatically scans a
computer’s network connections to prevent infected files from reaching the computer’s
disks.
IMON scans Internet web browsing traffic (HTTP) and
incoming email messages via the POP3 protocol
before they are saved to disk and detects threats
before they can get to the e-mail client. IMON can
also block certain blacklisted URLs known to host
malware.
IMON can prompt for an action or perform
automatically without prompting the user. IMON can
block exploits used by popular worms (e.g. Code Red,
Lovsan, Nachi and others) without requiring a patch
from the operating system vendor to be installed.
IMON-scanned Protocols
IMON examines POP3 traffic on TCP port 110 and HTTP traffic on TCP ports 80, 81, 3128,
8080, 8081, and other ports for threats to your system.
Note that since all SSL communications are encrypted, it is not possible for IMON to scan
them. After encrypted traffic has been decrypted, it will be checked for threats by the
other components of NOD32.
IMON and other NOD32 components
While the role of AMON is to provide real-time, resident, anti-virus monitoring of a
system and user actions, the IMON module serves as an anti-virus monitor of traffic
between the system and the outside world (Internet).
IMON’s primary role is to monitor incoming email. EMON provides scanning of incoming
and outgoing email in Microsoft Outlook as well as in Microsoft Exchange Extension-
compliant mail clients. Unlike EMON, IMON is email client independent. It doesn’t
require an email client to be reconfigured.

Remote Administrator Overview
11
ThreatSense.Net – Closing the Circle
ThreatSense.Net extends the power of ThreatSense’s unique analytics and acts as an
early warning system on a global scale.
By anonymously submitting samples of new suspected malware to threat lab researchers
for analysis, ThreatSense.Net complements ThreatSense technology to constantly
improve threat protection for all ESET customers.
Analyzing new infiltrations helps ESET increase the detection capability of its products.
All threat identification and detection information is then included in updates to all
ESET NOD32 Antivirus users worldwide.

Remote Administrator Overview
12
ThreatSense.Net gathers information from ThreatSense® scans, sending details about
new infiltrations to ESET labs for thorough analysis:
File sample with the infiltration
Directory name
File name
Detection date/time
How the infiltration entered the computer
Operating system information
NOTE: Submission is optional and anonymous. ThreatSense.Net in no way attempts to
gather personal data, and sends no data at all without the user’s permission.
Exception lists can exclude certain file types, if desired, to increase anonymity.
NOD32 Control Center – NOD32 for Windows client
The NOD32 Control Center is the central management console for the standard
MS Windows client, providing full access to NOD32’s features, tools, and settings and
fully integrating all installed system components.
Note that all settings available to end-users through the NOD32 Control Center are also
accessible as remote installation and configuration parameters within the Remote
Administrator.

Remote Administrator Overview
13
NOD32 Control Center’s tools and settings are
categorized into four different sections, each of which
can be expanded into an easy-to-use directory tree:
Threat protection modules (AMON, DMON, EMON,
IMON, NOD32)
Update – automatic Internet/network update of
key system elements including the executables and
threat signature databases
Logs – a management tool for maintaining the
system event, threat alert, and on-demand scanner
logs
NOD32 System Tools – a variety of tools including
Quarantine, Scheduler/Planner, Information, and
System Setup
For increased security, an administrator can password
protect these key settings to prevent unauthorized
changes.
Updating ESET NOD32 Antivirus
Because infiltration tracking using threat signatures is an important part of threat
detection, ESET NOD32 Antivirus performs regular threat signature database updates.
The incremental threat database update takes place regularly according to the level of
threat, often several times a day.
NOD32 is updated from an update server, either an Internet server maintained by ESET, a
local network server, a network directory, a CD drive, etc. Whatever the method, it is
crucial to ensure that each computer has access to a current source of updates. ESET
monitors the virus situation worldwide and provides updates as needed.
Updates can be either automatic or manual.
Manual updates are performed on demand directly from the NOD32 Control Center.
During update, the Control Center window displays status information about the
downloaded files.
Automatic update tasks are scheduled by default. If you use a permanent Internet
connection, you can set up a regular automatic update search as often as every
hour. For dial-up connections, you can make NOD32 search for newer updates
whenever you connect to the Internet.

Remote Administrator Overview
14
NOD32 supports three types of automatic Internet updates:
Cumulative update of the virus signature database
Incremental update of the virus signature database
Update of the executable components of the system (program components)
While the first two types of updates are performed 'on-the-fly', the program component
update requires restart of the updated computer. Each scanning module of the NOD32
system provides information about the virus signature database version used during
scanning in its main window.
It is important to monitor the Log of the NOD32 system on a regular basis to ensure that
the automatic system update is functioning properly.

Remote Administrator Overview
15
Centrally Managing Clients with
NOD32 Remote Administrator
Now that you’ve seen how NOD32 works to protect individual workstations, let’s look at
expanding NOD32 workstation protections for larger groups...
The NOD32 Remote Administrator provides centralized
management of NOD32’s network installations. NOD32
Remote Administrator enables an administrator to easily
deploy, manage, and maintain thousands of NOD32
systems in large, distributed corporate networks, as well
as small and medium-sized organizations.
NOD32 Remote Administrator is a powerful tool that
enables an administrator to manage large installations
of the NOD32 antivirus system.
This system gives you these capabilities:
Quick overview of your network security situation
Comprehensive statistics in an intuitive graphical form
Enables virus scan on remote disks
Remote NOD32 client configuration file editing on chosen workstations
Remote install/uninstall of NOD32 antivirus system
Locating unprotected computers in network
NOD32 Remote Administrator provides a global overview of NOD32 antivirus activity on
network workstations, and can receive information about threats or other problems.
Information retrieved from the clients is stored centrally on a server, accessible from an
administrator’s own workstation or laptop. The administrator can immediately react to
new situations and assign tasks to NOD32 client workstations.

Remote Administrator Overview
16
Remote Administrator is comprised of these parts:
Remote Administrator Server, which stores configurations, installations, and
reporting information
Remote Administrator Console, where you can easily administer the whole system
One or more NOD32 for Windows Workstations clients
−Standard NOD32 for Windows Workstations client
−LAN Update Server (also called “Mirror” or Administrative Client), which performs
all client operations and also can receive and store updates and upgrades from
ESET