F-SECURE CLIENT SECURITY 7.00 Service manual

F-Secure Client
Security
Administrator’s Guide

"F-Secure" and the triangle symbol are registered trademarks of F-Secure Corporation and F-Secure
product names and symbols/logos are either trademarks or registered trademarks of F-Secure
Corporation. All product names referenced herein are trademarks or registered trademarks of their
respective companies. F-Secure Corporation disclaims proprietary interest in the marks and names of
others. Although F-Secure Corporation makes every effort to ensure that this information is accurate,
F-Secure Corporation will not be liable for any errors or omission of facts contained herein. F-Secure
Corporation reserves the right to modify specifications cited in this document without prior notice.
Companies, names and data used in examples herein are fictitious unless otherwise noted. No part of
this document may be reproduced or transmitted in any form or by any means, electronic or
mechanical, for any purpose, without the express written permission of F-Secure Corporation.
This product may be covered by one or more F-Secure patents, including the following:
Copyright © 2007 F-Secure Corporation. All rights reserved. 12000060-7A10
GB2353372 GB2366691 GB2366692 GB2366693 GB2367933 GB2368233
GB2374260

iii
Contents
About this Guide 10
Overview ............................................................................................................................ 11
Additional Documentation .................................................................................................. 13
Conventions Used in F-Secure Guides.............................................................................. 15
Symbols .................................................................................................................... 15
Chapter 1 Introduction 17
1.1 Overview ....................................................................................................................18
1.2 F-Secure Client Security Components and Features.................................................18
1.2.1 Virus and Spy Protection................................................................................18
1.2.2 Internet Shield ................................................................................................21
1.2.3 Application Management................................................................................22
1.3 Introduction to F-Secure Policy Manager...................................................................23
1.3.1 Main Components of F-Secure Policy Manager.............................................24
1.3.2 F-Secure Policy Manager Features................................................................25
1.4 Basic Terminology......................................................................................................26
Chapter 2 Installing F-Secure Policy Manager 28
2.1 Overview ....................................................................................................................29
2.2 System Requirements................................................................................................30
2.2.1 F-Secure Policy Manager Server ...................................................................30
2.2.2 F-Secure Policy Manager Console.................................................................32

iv
2.3 Installation Steps........................................................................................................33
2.4 Uninstalling F-Secure Policy Manager.......................................................................55
Chapter 3 Introduction to F-Secure Policy Manager Anti-Virus Mode
User Interface 56
3.1 Overview ....................................................................................................................57
3.2 Policy Domains Tab ...................................................................................................58
3.3 Management Tabs .....................................................................................................58
3.3.1 Summary Tab.................................................................................................59
3.3.2 Outbreak Tab..................................................................................................66
3.3.3 Settings Tab ...................................................................................................68
3.3.4 Status Tab....................................................................................................102
3.3.5 Alerts Tab.....................................................................................................110
3.3.6 Reports Tab..................................................................................................112
3.3.7 Installation Tab.............................................................................................113
3.3.8 Operations Tab.............................................................................................115
3.4 Toolbar.....................................................................................................................116
3.5 Menu Commands.....................................................................................................117
3.6 Settings Inheritance .................................................................................................120
3.6.1 How Settings Inheritance is Displayed on the User Interface.......................122
3.6.2 Locking and Unlocking all Settings on a Page at Once................................123
3.6.3 Settings Inheritance in Tables......................................................................124
Chapter 4 Setting up the Managed Network 125
4.1 Overview ..................................................................................................................126
4.2 Logging in for the First Time ....................................................................................126
4.2.1 Logging In.....................................................................................................127
4.3 Creating the Domain Structure.................................................................................130
4.3.1 Adding Policy Domains and Subdomains.....................................................132
4.4 Adding Hosts............................................................................................................132
4.4.1 Windows Domains........................................................................................133
4.4.2 Autoregistered Hosts....................................................................................133
4.4.3 F-Secure Push Installations..........................................................................138
4.4.4 Policy-Based Installation ..............................................................................147
4.4.5 Local Installation and Updates with Pre-Configured Packages....................151

v
4.5 Local Installation ......................................................................................................156
4.5.1 Local Installation System Requirements ......................................................157
4.5.2 Installation Instructions.................................................................................157
4.6 Installing on an Infected Host...................................................................................158
4.7 How to Check That the Management Connections Work ........................................159
Chapter 5 Configuring Virus and Spyware Protection 160
5.1 Overview: What can Virus and Spyware Protection be Used for?...........................161
5.2 Configuring Automatic Updates ...............................................................................162
5.2.1 How do Automatic Updates Work?...............................................................163
5.2.2 Automatic Updates Configuration Settings...................................................163
5.2.3 Configuring Automatic Updates from Policy Manager Server ......................164
5.2.4 Configuring Policy Manager Proxy...............................................................165
5.3 Configuring Real-Time Scanning.............................................................................166
5.3.1 Real-Time Scanning Configuration Settings.................................................166
5.3.2 Enabling Real-Time Scanning for the Whole Domain ..................................169
5.3.3 Forcing all Hosts to Use Real-Time Scanning..............................................169
5.3.4 Excluding Microsoft Outlooks's .pst File from Real-Time Scanning .............170
5.4 Configuring System Control.....................................................................................171
5.4.1 System Control Configuration Settings.........................................................171
5.5 Configuring Rootkit Scanning...................................................................................172
5.5.1 Rootkit Scanning Configuration Settings......................................................172
5.5.2 Launching a Rootkit Scan for the Whole Domain.........................................172
5.6 Configuring E-mail Scanning....................................................................................173
5.6.1 E-mail Scanning Configuration Settings.......................................................173
5.6.2 Enabling E-mail Scanning for Incoming and Outgoing E-mails....................176
5.7 Configuring Web Traffic (HTTP) Scanning...............................................................178
5.7.1 HTTP Scanning Configuration Settings........................................................178
5.7.2 Enabling Web Traffic Scanning for the Whole Domain ................................179
5.7.3 Excluding a Web Site from HTTP Scanning.................................................179
5.8 Configuring Spyware Scanning................................................................................181
5.8.1 Spyware Control Settings.............................................................................181
5.8.2 Setting up Spyware Control for the Whole Domain......................................185
5.8.3 Launching Spyware Scanning in the Whole Domain....................................187
5.8.4 Allowing the Use of a Spyware or Riskware Component.............................188

vi
5.9 Preventing Users from Changing Settings...............................................................189
5.9.1 Setting all Virus Protection Settings Final.....................................................189
5.10 Configuring F-Secure Client Security Alert Sending ................................................190
5.10.1 Setting F-Secure Client Security to Send Virus Alerts to an E-mail Address190
5.10.2 Disabling F-Secure Client Security Alert Pop-ups........................................192
5.11 Monitoring Viruses on the Network ..........................................................................192
5.12 Testing your Antivirus Protection .............................................................................192
Chapter 6 Configuring Internet Shield 194
6.1 Overview: What can Internet Shield be Used for? ...................................................195
6.1.1 Global Firewall Security Levels ....................................................................195
6.1.2 Security Level Design Principles..................................................................197
6.2 Configuring Internet Shield Security Levels and Rules............................................198
6.2.1 Selecting an Active Security Level for a Workstation...................................198
6.2.2 Configuring a Default Security Level for the Managed Hosts.......................199
6.2.3 Adding a New Security Level for a Certain Domain Only.............................200
6.3 Configuring Network Quarantine..............................................................................203
6.3.1 Network Quarantine Settings........................................................................203
6.3.2 Enabling Network Quarantine in the Whole Domain....................................203
6.3.3 Fine-Tuning Network Quarantine .................................................................204
6.4 Configuring Internet Shield Rule Alerts....................................................................205
6.4.1 Adding a New Internet Shield Rule with Alerting..........................................205
6.5 Configuring Application Control................................................................................209
6.5.1 Application Control Configuration Settings...................................................211
6.5.2 Setting up Application Control for the First Time..........................................212
6.5.3 Creating a Rule for an Unknown Application on Root Level.........................214
6.5.4 Editing an Existing Application Control Rule ................................................215
6.5.5 Disabling Application Control Pop-ups.........................................................216
6.6 How to use Alerts for Checking that Internet Shield Works? ...................................217
6.7 Configuring the Intrusion Prevention........................................................................218
6.7.1 Intrusion Prevention Configuration Settings.................................................219
6.7.2 Configuring IDS for Desktops and Laptops..................................................220

vii
Chapter 7 How to Check that the Environment is Protected 222
7.1 Overview ..................................................................................................................223
7.2 How to Check the Protection Status from Outbreak Tab .........................................223
7.3 How to Check that all the Hosts Have the Latest Policy ..........................................223
7.4 How to Check that the Server has the Latest Virus Definitions................................224
7.5 How to Check that the Hosts have the Latest Virus Definitions...............................224
7.6 How to Check that there are no Disconnected Hosts ..............................................225
7.7 Viewing Scanning Reports.......................................................................................225
7.8 Viewing Alerts ..........................................................................................................226
7.9 Creating a Weekly Infection Report .........................................................................227
7.10 Monitoring a Possible Network Attack......................................................................228
Chapter 8 Upgrading Software 229
8.1 Overview: Upgrading Software ................................................................................230
8.1.1 Using the Installation Editor..........................................................................230
Chapter 9 Local Host Operations 234
9.1 Overview ..................................................................................................................235
9.2 Scanning File Viruses Manually...............................................................................235
9.3 Viewing the Latest Scanning Report on a Local Host..............................................236
9.4 Adding a Scheduled Scan from a Local Host...........................................................236
9.5 Logging and Log File Locations on Local Hosts ......................................................237
9.5.1 LogFile.log....................................................................................................237
9.5.2 Packet Logging.............................................................................................238
9.5.3 Other Log Files.............................................................................................241
9.6 Connecting to F-Secure Policy Manager and Importing a Policy File Manually.......241
9.7 Suspending Downloads and Updates......................................................................242
9.8 Allowing Users to Unload F-Secure Products..........................................................242
Chapter 10 Virus Information 244
10.1 Virus Information on F-Secure Web Pages..............................................................245
10.2 Latest Threats..........................................................................................................245
10.2.1 F-Secure Radar............................................................................................245

viii
10.3 Viruses in the Wild ...................................................................................................246
10.4 How to Send a Virus Sample to F-Secure ...............................................................246
10.4.1 How to Package a Virus Sample..................................................................246
10.4.2 What Should Be Sent...................................................................................247
10.4.3 Where to Send the Virus Sample.................................................................249
10.4.4 In What Language........................................................................................250
10.4.5 Response Times...........................................................................................250
10.5 What to Do in Case of a Virus Outbreak?................................................................250
Chapter 11 Setting Up Cisco NAC Support 253
11.1 Introduction ..............................................................................................................254
11.2 Installing Cisco NAC Support...................................................................................254
11.2.1 Importing Posture Validation Attribute Definitions........................................255
11.3 Attributes to be Used for Application Posture Token ...............................................255
Chapter 12 Advanced Features: Virus and Spyware Protection 257
12.1 Overview..................................................................................................................258
12.2 Configuring Scheduled Scanning.............................................................................258
12.3 Configuring Policy Manager Proxy...........................................................................260
12.4 Configuring Automatic Updates on Hosts from Policy Manager Proxy....................261
12.5 Configuring a Host for SNMP Management.............................................................262
Chapter 13 Advanced Features: Internet Shield 263
13.1 Overview..................................................................................................................264
13.2 Managing Internet Shield Properties Remotely........................................................264
13.2.1 Packet Logging.............................................................................................264
13.2.2 Trusted Interface ..........................................................................................265
13.2.3 Packet Filtering.............................................................................................266
13.3 Configuring Security Level Autoselection.................................................................266
13.4 Troubleshooting Connection Problems....................................................................268
13.5 Adding New Services...............................................................................................269
13.5.1 Creating a New Internet Service based on the Default HTTP......................270

ix
AppendixA Modifying PRODSETT.INI 278
A.1 Overview ................................................................................................................. 279
A.2 Configurable Prodsett.ini Settings............................................................................279
AppendixB E-mail Scanning Alert and Error Messages 292
B.1 Overview ................................................................................................................. 293
Glossary 297
Technical Support 311
Overview .......................................................................................................................... 312
Web Club .........................................................................................................................312
Virus Descriptions on the Web ................................................................................312
Advanced Technical Support ...........................................................................................312
F-Secure Technical Product Training ...............................................................................313
Training Program ....................................................................................................313
Contact Information .................................................................................................314
About F-Secure Corporation

10
ABOUT THIS GUIDE
Overview..................................................................................... 11
Additional Documentation.......................................................... 13