ESET REMOTE ADMINISTRATOR V1 Installation guide

Remote Administrator
Overview

Remote Administrator Overview
ii
Copyright © 1997 – 2006 ESET LLC. All rights reserved.
No part of this document may be reproduced or transmitted in any form or by any
means electronic or mechanical, for any purpose without the express written permission
of ESET LLC. Information in this document is subject to change without prior notice.
Certain names of program products and company names used in this document might
be registered trademarks or trademarks owned by other entities.
ESET, NOD32 and AMON are trademarks of ESET.
Microsoft and Windows are registered trademarks of Microsoft Corporation.
ESET, LLC
610 West Ash Street
San Diego, California 92101
http://www.eset.com
For Sales and Technical Support (US and Canada):
Tel: [phone]
Fax: [phone]
Online purchase: http://www.eset.com/purchase/index.php
Sales email:
[email protected]
Technical Support Worldwide:
http://www.eset.com/support/index.php
This guide is frequently updated to reflect changes in the product. The latest version can
always be found at http://www.eset.com/download/manual.htm
This guide was prepared referring to NOD32 for Windows Version 2.7 (December 2006)

Remote Administrator Overview
iii
Table of Contents
ESET NOD32 Antivirus Overview __________________________________________ 1
Core ESET NOD32 Antivirus Technology 1
Traditional Signatures 2
Limitations for Signature-based Threat Scanning 2
Heuristics Explained 2
Generic Signatures 3
Passive Heuristics 3
Active Heuristics 4
ThreatSense® - Leveraging all detection 4
The Value of NOD32 5
ESET NOD32 Antivirus - Product Modules ________________________________ 6
NOD32 for Windows Workstations 6
What does ESET NOD32 Antivirus do? 6
Components – Standard Client 7
What is NOD32’s On-Demand Scanner? 8
What is AMON? 8
What is DMON? 9
What is EMON? 9
What is IMON? 10
ThreatSense.Net – Closing the Circle 11
NOD32 Control Center – NOD32 for Windows client 12
Updating ESET NOD32 Antivirus 13
Centrally Managing Clients with NOD32 Remote Administrator______________ 15
Remote Administrator Server (RAS) 17
Remote Administrator Console (RAC) 17
RA Console Capabilities 17
RA Console Panels 18
NOD32 Clients 19
Standard Client – NOD32 for Windows 19
NOD32 LAN Update Server 19
NOD32 Enterprise Edition 19
Remote Administrator Deployment Options for NOD32 ____________________ 20
Remote Installation 20
Remote Installation Process 20
Installation File Set 21
Installation Example 22
Communication among RA Components 23
Remote Administration and the Update Process 24
Updating with LAN Update Server 25
Updates and Server Bandwidth 26
Deployment Options in Larger Networks 26
Configuration and Remote Clients _______________________________________ 28
Configuration with Profiles 29
Scanning Profiles 29
Update Profiles 29
Implementing Configurations, Updates, or On-Demand Scans 30
Remote Administrator Reporting ________________________________________ 32
Index _________________________________________________________________ 35

Remote Administrator Overview
iv

Remote Administrator Overview
1
ESET NOD32 Antivirus Overview
ESET NOD32 Antivirus is an award-winning, multi-platform, unified anti-threat system
with a powerful graphical user interface. NOD32 stops more than just traditional viruses
-- it also detects, removes, and prevents these threats:
Adware
RATs (remote access tools)
Spyware
Trojan horses
Worms
Rootkits
Keyloggers
Potentially dangerous applications
These threats could affect the privacy, security, and confidentiality of the information on
a computer. Collectively, they are referred to as malicious software, or malware.
ESET NOD32 uses award-winning technology to detect tomorrow’s threats, in real-time,
by analyzing code execution for malicious intent – keeping you ahead of the malware
writers.
Core ESET NOD32 Antivirus Technology
ESET NOD32 Antivirus employs a unique technology called ThreatSense®, an optimized
scanning engine that looks for threats in four different ways in parallel:
Traditional signatures
Generic signatures
Passive heuristics
Active heuristics
First, let’s take a look at these methods as general concepts...

Remote Administrator Overview
2
Traditional Signatures
A specific threat has a specific set of bytes that uniquely identifies it.
Searching for that exact pattern of
bytes, an anti-threat tool can find and
identify that specific threat.
Though well suited to exploit
detection, signature scanning is
reactive and based on the
identification of a single object.
Because of this, it has limitations
against today’s advanced threats.
Limitations for Signature-based Threat Scanning
New threats are not detected until signatures are generated. PCs may be vulnerable
for hours, days, or weeks.
Malware writers use achiving and packing techniques to circumvent signature-
based detection. Compressing files hides the malware from signature-based tools.
Only some parts or forms of a complex virus may be detected initially. With a
polymorphic (dynamically changing) virus, some infected files might remain
undetected.
Pattern recognition techniques like signatures work effectively and efficiently for known
threats, but are ineffective for protecting against new threats. Heuristic scanning is the
solution to this problem...
Heuristics Explained
Heuristics is a method that uses rules to solve problems. For anti-threat software,
heuristics are a set of rules used to detect malicious behavior without needing to
uniquely identify the specific threat, as a classic signature-based “virus scanner” does.
Heuristics used by an anti-threat program might have rules to look for things like this:
Something that tries to copy itself into other programs
A program that decrypts itself when run
Code that binds to a TCP/IP port and listens for instructions over a network
connection
A process attempting to manipulate (copy, delete, modify, rename, etc.) files
required by the operating system or applications

Remote Administrator Overview
3
The advantage of heuristics is it can detect not just variants, or modified forms, of
existing malicious programs, but also new, previously unknown malicious programs.
Generic Signatures
One way to use heuristics to improve signature-based detection is to use generic
signatures. A generic signature is a scan pattern that matches more than one specific
piece of malware, possibly an entire family or set of variants.
Generic signatures help an anti-threat
system measure how similar something
is to known malware. Does it look like
anything we already know?
By looking for similarities, the anti-
threat tool can spot malware it hasn’t
seen before, without requiring a
definitive signature for that specific
threat.
However, Generic signatures may be
too restrictive, only finding threats that
have only minor differences.
Passive Heuristics
Passive Heuristics analyze a program as it is scanned, tracing through the instructions in
a program before passing the code to the processor for execution.
The idea is to analyze the suspicious
code to see what it appears to be
designed to do.
Passive heuristics rules look for
patterns, routines, or program calls that
indicate malicious behavior. This
approach is sometimes called
“code analysis.”
Passive heuristics, though a useful tool,
is very difficult to do well. There is no
single action that a malicious program
can perform that is not also allowed in
a “good” program.

Remote Administrator Overview
4
Active Heuristics
With active heuristics, the anti-threat system can execute the code to see what it actually
does. Execution occurs in a controlled, protected environment to avoid real damage.
The engine lets the code run in a
virtual environment and examines the
behavior performed in and changes
made to that virtual environment.
Active heuristics are useful in defeating
encryption, compression, and
polymorphic threats. It causes the
malware to “show” what it is designed
to do. This provides immediate
protection, not relying on signatures of
known threats for identification.
Since the code actually runs, it can’t
hide its malicious content.
ThreatSense® - Leveraging all detection
The best anti-threat solution is one that makes intelligent use of all viable detection
methods. That’s the idea behind NOD32’s ThreatSense® technology.
Viruses, worms, and spyware are constantly evolving as malware writers try to
circumvent security software. ThreatSense keeps NOD32 a few steps ahead.
The ThreatSense engine is a sophisticated, well-balanced system of advanced heuristics
and malware signatures, providing the best detection without compromising speed or
detection.
For most existing threats, ThreatSense includes a traditional form of malware signatures.
It also uses next-generation generic signatures to quickly detect known malware families
and their future variants.

Remote Administrator Overview
5
In addition to traditional and generic signatures, ThreatSense’s advanced heuristics
proactively decode and analyze executable code in a protected environment to identify
increasingly sophisticated malicious behavior, characteristic of today’s evolving threats.
What makes ThreatSense technology so accurate is its ability to perform all these types
of detections in parallel, not only improving its detection but also the speed with which
it operates. ThreatSense’s blended approach to detection leverages the benefits of each
technology and makes NOD32 the fastest, most accurate, and lowest impact solution in
the industry.
The Value of NOD32
If you’re managing thousands of workstations and servers across remote locations, you
need a robust, comprehensive solution you can rely on. NOD32 provides all-in-one
protection, small footprint, and fast performance, regardless of the size of the
organization. ESET NOD32 Antivirus products are advanced and easy on system
resources.
NOD32’s Remote Administrator makes it easy to deploy, monitor, and manage 10,000
machines from a single console. This powerful centralized management console installs
in minutes. An entire network of 500 machines can be installed in just a few hours.

Remote Administrator Overview
6
ESET NOD32 Antivirus
- Product Modules
NOD32’s broad product platform offers multiple solutions for organizations of all sizes:
Small, medium and large corporations
Government agencies
Educational institutions
Individual users
Proactive protection is available for Microsoft Windows, Linux, and MS DOS desktops and
servers, including file servers and mail gateways. Award-winning ThreatSense®
technology is at the core of each product ensuring the most-advanced protection
regardless of platform or network configuration.
Let’s begin by looking at the advanced protection available for individual workstations...
NOD32 for Windows Workstations
Desktop and mobile PC users can get the anti-threat protection they need with NOD32
without having to sacrifice detection or speed. And NOD32 is one of a very few products
that currently supports Windows® 64-bit systems
NOD32 was designed to perform anti-threat detection and prevention in two different
areas:
On-Access scanning – scanning files and data as they are accessed, safeguarding the
system at the most likely point of vulnerability. On-Access scanning also targets
operations with a specific type of data access (email, HTTP, etc.)
On-Demand scanning – scanning systems (storage, memory, boot sectors, etc.) as a
definitive task, either as desired or as a regularly scheduled operation.
What does ESET NOD32 Antivirus do?
ESET NOD32 Antivirus searches for threats within PCmemory, the system areas of disks,
files stored on those disks, and on HTTP and POP3 communication streams. A number of
different objects can hold viruses or other malware, such as files, archives, self-extracting
archives, run-time packers, and e-mail. NOD32 can open and inspect a variety of archive
file formats, including self-extracting files and files compressed with runtime packers.
NOD32 uses a variety of techniques to detect threats, which allow NOD32 to detect new,
unknown threats that may not have a name yet.