KAPERSKY ANTI-VIRUS 4.5 - FOR MICROSOFT EXCHANGE... User manual

KASPERSKY LABS
Kaspersky Anti-Virus®4.5
for Microsoft Exchange Server
USER’S GUIDE

KASPERSKY ANTI-VIRUS®4.5
FOR MICROSOFT EXCHANGE SERVER
User’s Guide
Kaspersky Labs Ltd.
http://www.kaspersky.com
Edition date: December 2003

Contents
CHAPTER 1. KASPERSKY ANTI-VIRUS®4.5 FOR MS EXCHANGE SERVER........ 7
1.1. What is new in version 4.5 .................................................................................... 9
1.2. Hardware and software requirements .................................................................. 9
1.2.1. Protected server is MS Exchange Server 5.5 ............................................... 9
1.2.2. Protected server is MS Exchange Server 2000/2003 ................................... 9
1.2.3. Requirements for the computer from which Anti-Virus Engine will be
controlled....................................................................................................... 10
1.3. Distribution Kit...................................................................................................... 10
1.4. Help desk for registered users ............................................................................ 11
1.5. Conventions......................................................................................................... 12
CHAPTER 2. INSTALLATION ...................................................................................... 13
2.1. Installing and uninstalling Kaspersky Anti-Virus®for MS Exchange Server...... 13
2.1.1. Step-by-step installation ............................................................................... 13
2.1.2. Enabling protection of mail bodies under MS Exchange Server 5.5 .......... 21
2.1.3. Updating version 4.2 to 4.5........................................................................... 24
2.1.4. Uninstalling.................................................................................................... 25
2.2. Selecting protected storages............................................................................... 25
2.3. Anti-virus features to support clustering facilities................................................ 28
CHAPTER 3. PROTECTION OF MS EXCHANGE SERVER MESSAGES .............. 29
3.1. Operating principles of the program. Message queue for anti-virus scan......... 29
3.2. Working Procedure.............................................................................................. 31
3.3. Anti-Virus Engine Control by means of Kaspersky AV MMC Snap-In .............. 32
3.3.1. Starting Kaspersky AV MMC Snap-In ......................................................... 32
3.3.2. Kaspersky AV MMC Snap-In Interface........................................................ 34
3.3.3. Adding/deleting server for control................................................................. 35
3.3.4. Setting/removing anti-virus protection. Disconnecting/connecting to
server. License. Importing/exporting settings .............................................. 37
3.3.5. Changing settings using Kaspersky AV MMC Snap-In............................... 40
3.3.6. Table of controlled servers. Customizing warning modes .......................... 41
3.4. Customizing Anti-Virus Engine settings.............................................................. 42

4 Kaspersky Anti-Virus 4.5 for MS Exchange Server
3.4.1. Categories: General and Settings............................................................... 42
3.4.2. Basic Settings for Anti-Virus Protection ....................................................... 43
3.4.2.1. Check Mode........................................................................................... 43
3.4.2.2. Advanced Scanning Modes .................................................................. 44
3.4.2.3. Objects to be scanned ........................................................................... 45
3.4.2.4. Scanning Methods ................................................................................. 46
3.4.3. Rules for scanned objects ............................................................................ 46
3.4.4. Virus Messages and Reports....................................................................... 50
3.4.4.1. Report Types.......................................................................................... 50
3.4.4.2. Sending report to administrator ............................................................. 51
3.4.4.3. Sending Report to Recipient and Sender ............................................. 53
3.4.4.4. Report File.............................................................................................. 54
3.4.4.5. Application Log....................................................................................... 55
3.4.5. Quarantine .................................................................................................... 58
3.4.6. Advanced: parameters of Anti-Virus Engine and MS Exchange Server
joint operation................................................................................................ 61
3.4.7. Advanced: Service Parameters ................................................................... 61
3.4.8. Advanced: Template Editing ........................................................................ 62
3.4.8.1. List of Templates.................................................................................... 62
3.4.8.2. Template Editor...................................................................................... 63
3.4.8.3. Macros and Conditional Clauses .......................................................... 66
3.5. Testing the program ............................................................................................ 72
3.6. System Performance Chart. System Monitor..................................................... 73
3.7. Operating in demo mode. Extending your license. Editing a list of
unprotected objects............................................................................................ 77
CHAPTER 4. KASPERSKY ANTI-VIRUS®CONTROL CENTRE .............................. 78
4.1. Launching Kaspersky AV Control Centre........................................................... 78
4.2. Kaspersky AV Control Centre Interface.............................................................. 80
4.2.1. Tasks tab....................................................................................................... 81
4.2.1.1. Properties window.................................................................................. 86
4.2.2. Components Tab .......................................................................................... 87
4.2.3. Settings Tab.................................................................................................. 88
4.2.3.1. Security Category .................................................................................. 90
4.2.3.2. Alerts Category ...................................................................................... 92
4.2.3.3. Customize Category .............................................................................. 95
4.3. New Task Wizard ................................................................................................ 97

Contents 5
4.3.1. Task Window ................................................................................................ 98
4.3.2. Schedule Window for Kaspersky AV Updater Task.................................... 99
4.3.2.1. Launching on Event ............................................................................. 100
4.3.2.2. Launching by Condition ....................................................................... 101
4.3.2.3. Launching Hourly................................................................................. 102
4.3.2.4. Launching Daily ................................................................................... 102
4.3.2.5. Launching Weekly ............................................................................... 103
4.3.2.6. Launching Monthly............................................................................... 104
4.3.3. Alerts Window............................................................................................. 105
4.3.4. User Account Window................................................................................ 105
4.3.5. Task Setting ................................................................................................ 106
CHAPTER 5. KASPERSKY ANTI-VIRUS®UPDATER ............................................. 107
5.1. How to Start Kaspersky AV Updater ................................................................ 107
5.2. Kaspersky AV Updater interface....................................................................... 108
5.2.1. Step 1. Kaspersky AV Updater Welcome Wizard Box.............................. 108
5.2.2. Step 2. Connection dialog box ................................................................... 109
5.2.2.1. Setting Kaspersky Anti-Virus®Update from the Internet .................... 110
5.2.2.2. Updating from local folder.................................................................... 115
5.2.2.3. Choosing objects to be updated.......................................................... 116
5.2.3. Step 3. Options box .................................................................................... 116
5.2.4. Step 4. Retrieving Updates window........................................................... 117
5.2.5. Step 5. Finishing Wizard box...................................................................... 118
CHAPTER 6. KASPERSKY ANTI-VIRUS®REPORT VIEWER................................ 119
CHAPTER 7. TREE CHART ....................................................................................... 122
7.1. Tree Chart.......................................................................................................... 122
7.2. Controls.............................................................................................................. 123
7.2.1. Check Box................................................................................................... 123
7.2.2. Option Button .............................................................................................. 124
7.2.3. Text Field .................................................................................................... 124
7.2.4. Path Field .................................................................................................... 125
7.2.5. Number Field .............................................................................................. 125
7.2.6. Drop-Down List ........................................................................................... 126
APPENDIX A. REGISTRY SETTINGS....................................................................... 127

6 Kaspersky Anti-Virus 4.5 for MS Exchange Server
APPENDIX B. KASPERSKY LABS LTD. ................................................................... 134
B.1. Other Kaspersky Labs Products....................................................................... 135
B.2. Contact Information........................................................................................... 138
APPENDIX C. INDEX .................................................................................................. 139
APPENDIX D. LICENSE AGREEMENT .................................................................... 140

CHAPTER 1. KASPERSKY ANTI-
VIRUS®4.5 FOR MS
EXCHANGE SERVER
Kaspersky Anti-Virus®4.5 for MS Exchange Server (hereinafter referred to as
Kaspersky Anti-Virus®) software package is designed to protect mailboxes and
public folders from viruses on MS Exchange Server 5.5/2000/2003 (hereinafter
referred to as MS Exchange Server).
Kaspersky Anti-Virus®performs the following functions on MS Exchange Server:
• Checking and disinfecting mail messages "on-the-fly". The program
scans all MS Exchange Server 5.5/2000 incoming and outgoing
messages as well as objects stored on it, and disinfects infected objects if
possible. Such objects can include message texts, attached messages
and files, and OLE objects.
During scanning the program uses anti-virus databases that
allow detection and deletion of all known virus types. Anti-
virus databases are continuously growing and updated.
• User protection from infected messages. The program prevents user
access to the infected objects. Depending on the settings, it blocks a
message with an infected object, deletes the infected object from the
message, or replaces this object by a file containing information on the
virus detected. The administrator can also customize the mode when the
program skips a message with an infected object. In this case, the
program changes the name of the infected object, adds information about
the detected virus to it, and changes the object extension. As a result, the
user will not be able to launch the infected file and infect his/her computer
by accident.
• Quarantine. The program renames suspicious and infected files, and
saves them to the quarantine directory on the hard disk.
• Background scanning on demand. This option allows you to detect and
delete viruses in old messages received before Kaspersky Anti-Virus®
installation, as well as in messages checked after anti-virus database
updating.
• Scanning in several threads. Checking mail messages in several
threads accelerates the program’s performance.

8 Kaspersky Anti-Virus 4.5 for MS Exchange Server
• Self-descriptive reporting. The program sends virus alerts to
administrator, recipient or sender of the infected messages and places
corresponding entries in the Application Log and program log file. Such
thorough supervision of the program’s performance helps to quickly
prevent infection of the server and other computers in your office.
• Template Editor. You can set notifications and reports by means of a
special program.
The following software products are included in the package:
• Kaspersky Anti-Virus®Engine for MS Exchange Server (Anti-Virus
Engine) – is a program component designed for anti-virus protection of
the mail messages passing through MS Exchange Server. It is installed
and operates on the server.
Anti-Virus Engine 5.5 includes Kaspersky AV AVAPI (1.0) Interceptor for
MS Exchange Server (AVAPI Interceptor) and Kaspersky Anti-Virus®
MAPI Interceptor for MS Exchange Server (MAPI-service).
Anti-Virus Engine 2000/2003 includes Kaspersky AV VSAPI (2.0)
Interceptor for MS Exchange Server (VSAPI Interceptor).
In addition, Anti-Virus Engine includes Kaspersky AV LDAP Notification
Service, which keeps track of a list of unprotected mailboxes defined in
Active Directory (MS Exchange Server 2000/2003) or Exchange Directory
(MS Exchange Server 5.5).
• Kaspersky Anti-Virus®MMC Snap-In – is a program component
designed for settings control and for launching Kaspersky Anti-Virus®
Engine from Microsoft Management Console (MMC), a standard Microsoft
Windows 2000 utility.
• Kaspersky Anti-Virus®Updater – is a virus-definition database-updating
utility. Anti-virus databases are used when searching for viruses in mail
messages. Kaspersky Labs regularly updates these databases by adding
new virus details to them; database updates are placed on Kaspersky
Labs web sites and later retrieved by the updating utility.
• Kaspersky Anti-Virus®Control Centre — is a control shell for other
components. In this software package, Kaspersky Anti-Virus®Control
Centre is used to control only Kaspersky Anti-Virus®Updater. Using
Kaspersky AV Control Centre, you can manage updating of anti-virus
databases, schedule automatic updating, and review the Anti-Virus
Updater performance statistics.

Kaspersky Anti-Virus®4.5 for MS Exchange Server 9
1.1. What is new in version 4.5
• MS Exchange Server 2003 assistance is provided with version 4.5.
• For version 4.5, purchase of a special license for protecting public folders
is not required. The license is issued only for MS Exchange Server
mailboxes. In this case, the protection is delivered to both MS Exchange
Server mailboxes and public folders.
• An option to disable protection of mailboxes has been introduced. Note
that if you want to protect more mailboxes than specified in your license,
you should either buy a new license or limit the number of protected
mailboxes. Otherwise, the program will operate in demo mode.
• A new feature has been added to the Kaspersky Anti-Virus®to support
the clustering facilities in MS Exchange Server 2000/2003.
• In version 4.5, the Kaspersky AV Сontrol Centre Plug-In component is not
installed. The Kaspersky Anti-Virus®will be managed only through the
MMC Snap-In component. The Kaspersky AV Сontrol Centre Plug-In is
uninstalled in case of the updating of program version from 4.x to 4.5.
1.2. Hardware and software
requirements
1.2.1. Protected server is MS Exchange
Server 5.5
Requirements for protected server on which Anti-Virus Engine is installed:
• Microsoft Windows NT 4.0 Service Pack 6;
• MS Exchange Server 5.5 with Service Pack 4;
• Active Directory Service Interfaces (ADSI) 2.5 or Active Directory Client
Extensions.
1.2.2. Protected server is MS Exchange
Server 2000/2003
Requirements for protected server on which Anti-Virus Engine is installed:

10 Kaspersky Anti-Virus 4.5 for MS Exchange Server
• Microsoft Windows Server 2000 with Service Pack 2;
• MS Exchange Server 2000 with Service Pack 2.
Requirements for the protected MS Exchange Server 2003 on which Anti-Virus
Engine is installed:
• MS Windows Server 2000 with Service Pack 3 or MS Windows Server
2003;
• MS Exchange Server 2003.
You can install Anti-Virus Engine onto different cluster nodes using the
Active/Active mode and then control Anti-Virus Engine on each of these nodes
separately.
1.2.3. Requirements for the computer from
which Anti-Virus Engine will be
controlled
The computer from which Anti-Virus Engine will be controlled must meet the
following requirements:
• If you intend to control your Anti-Virus Engine locally, install Kaspersky
Anti-Virus®Control Centre and/or Kaspersky Anti-Virus®MMC Snap-In on
your computer.
• If you intend to control your Anti-Virus Engine from a remote computer:
• Kaspersky Anti-Virus®MMC Snap-In.
• MS Windows 2000 operating system or higher or MS Windows
NT 4.0 with ММС version 1.2 or higher.
• Active Directory Service Interfaces (ADSI) 2.5 or Active
Directory Client Extensions (MS Windows 2000 and higher
automatically meets these requirements).
1.3. Distribution Kit
Kaspersky Anti-Virus®for MS Exchange Server is part of the series of Kaspersky
Anti-Virus®corporate products. You can purchase the corporate products either
from our distributors (retail box) or online at one of our Internet shops (for
example, www.kaspersky.com, the Buy online link).
The retail box includes:

Kaspersky Anti-Virus®4.5 for MS Exchange Server 11
• A sealed envelope with the installation CD containing files for the software
product.
• User’s Guide.
• A license key written on the installation CD.
• License agreement.
Before you unseal the envelope containing the CD, be sure to
thoroughly review the license agreement.
If you buy Kaspersky Anti-Virus®for MS Exchange Server online, you download
the installation file of the product from the Kaspersky Labs website. This
installation file includes this User Guide and the license key. The license key can
also be sent to you by e-mail after receiving your payment.
The License Agreement is a legal agreement between you and the manufacturer
(Kaspersky Labs Ltd.) describing the terms on which you may employ the anti-
virus product which you have purchased.
Make sure you read this License Agreement!
If you do not agree to the terms of this LA, you can return the unused product to
your Kaspersky Anti-Virus®dealer for a full refund, making sure the envelope
with the CD is sealed.
By unsealing the envelope, you agree to all the terms of the LA.
1.4. Help desk for registered users
Kaspersky Labs Ltd. offers a large service package enabling its legal
customers to efficiently employ Kaspersky Anti-Virus®.
If you register and purchase a subscription you will be provided with the following
services for the period of your subscription:
• new versions of this Kaspersky Anti-Virus®software.
• phone or e-mail advising on matters related to the installation, setup, and
operation of our anti-virus software.
• information about new Kaspersky Labs products and about new computer
viruses (for those who subscribe to the Kaspersky Labs newsletter).
Kaspersky Labs does not provide any information related to the
operation and use of your operating system or various technologies.

12 Kaspersky Anti-Virus 4.5 for MS Exchange Server
1.5. Conventions
In this book we use various conventions to emphasize different meaningful parts
of the documentation. The Table below lists the conventions used in this User
Guide.
Convention Meaning
Bold font Menu titles, commands, window titles, dialog
elements, etc.
Note.
Additional information, notes.
Attention!
Critical information.
To do this,
1. Step 1.
2. …
Actions that must be taken.
Task or example
Formulation of the problem or an example of
how to use the product.
Solution
•
A solution of the problem formulated.
[key]— Function of the key. Command line keys.
Text of information
messages and the
command line
Text of configuration files, information
messages, and the command line.

CHAPTER 2. INSTALLATION
2.1. Installing and uninstalling
Kaspersky Anti-Virus®for MS
Exchange Server
You can launch the installation program:
• on MS Exchange Server 5.5 SP4 / 2000 SP2/2003. In this case you may
install all package components on the server.
• on the computer from which the settings of server anti-virus protection will
be controlled. You will not be able to install the Kaspersky Anti-Virus®
Engine for MS Exchange Server component there as it is designed for
operation on the server only.
Launch the setup.exe program from the CD to start the package installation. The
setup wizard operates in dialog mode. Each dialog box contains a certain set of
buttons to manage the setup process. The main buttons are:
• OK— accept actions;
• Cancel – cancel actions;
• Next – move one step forward;
• Back – move one step backward.
Before you install Kaspersky Anti-Virus®4.5, make sure to quit all
programs running on your computer.
Before installing Kaspersky Anti-Virus®, remove all anti-virus software
for MS Exchange Server provided by other developers that use the
VirusScan API or Anti-Virus API technologies.
2.1.1. Step-by-step installation
Step 1. Read general information
The first dialog of the Setup Wizard (see Figure 1) contains general information
on Kaspersky Anti-Virus®4.5.

14 Kaspersky Anti-Virus 4.5 for MS Exchange Server
Step 2. Read the license agreement
The License Agreement dialog box (Figure 2) contains the Agreement text.
Read it and click Yes if you accept the license agreement terms. Otherwise, click
No to abort the setup.
Figure 1. First dialog box of Setup Wizard
Figure 2. The License Agreement
dialog box
Step 3. Installation requirements
Read the information on how to install and use the program in the Installation
requirements dialog box (see Figure 3).
Figure 3. The Installation Requirements dialog box

Installation 15
Step 4. Enter customer information
Enter customer information in the Customer Information dialog box (see Figure
4). Enter the appropriate data in the User Name field and the Company Name
field. By default the information for these fields is taken from the Windows
registry.
Step 5. Select the program installation folder
Select the directories for installation of Kaspersky Anti-Virus®4.5 components in
the Choose Destination Folder Location dialog box (see Figure 5). The
directory for components will be indicated in the Destination Folder group. The
general files folder path will be indicated in the Common Files Folder group.
Click on Browse to choose the directory.
The Common Files Folder field is hidden if a Kaspersky Labs server
product is installed on the server.
Figure 4. The Customer Information dialog
box
Figure 5. The Choose Destination Folder
Location dialog box

16 Kaspersky Anti-Virus 4.5 for MS Exchange Server
Step 6. Add the program group name to the
Start\Programs menu
Figure 6. The Select Program Folder dialog
box
Define the folder name in the
Select Program Folder dialog
box (see Figure 6) to display the
Kaspersky Anti-Virus®4.5 icon in
the standard Program menu.
Click Next.
Step 7. Installation Requirements
The program defines the installation configuration according to availabsility of MS
Exchange Server 2000 Service Pack 2, MS Exchange Server 2003, or MS
Exchange Server 5.5 Service Pack 4 on the computer. If none of these products
is installed, the Installation Requirements dialog box (see Figure 7) will appear
on the display. In the lower part of the box you will see the Installation Options
option buttons.
Do not install Kaspersky Anti-Virus®Engine for MS Exchange
Server ( default)
Install Kaspersky Anti-Virus®Engine for MS Exchange Server 5.5
Install Kaspersky Anti-Virus®Engine for MS Exchange
Server 2000/2003.
Choose the option button needed. By default, the installation program will
resume but Anti-Virus Engine for MS Exchange Server will not be installed. If you
choose to install Anti-Virus Engine for MS Exchange Server despite the fact that
the server does not fulfill the installation requirements, the program will install all
package components but the above-mentioned component will not operate at
full-range.

Installation 17
a. If MS Exchange Server has not been
detected
If you install Kaspersky Anti-Virus®
4.5 on a server under Microsoft
Windows NT 4.0 in which MMC
and/or ADSI are absent, you will see
the appropriate notifications with
actions you can choose (see Figure
7).
You can interrupt the process, install
applications needed, and repeat the
Kaspersky Anti-Virus®installation
when messages appear warning that
the installation program requirements
have not been satisfied.
b. If MMC has not been detected
c. If ADSI has not been detected
Figure 7. The Installation Requirements dialog box

18 Kaspersky Anti-Virus 4.5 for MS Exchange Server
Step 8. Choose Kaspersky Anti-Virus®components to be
installed
Figure 8. The Select Components
dialog box
In the Select Components dialog box
(see Figure 8) check the components to
install.
If you select Custom setup, you will
have to choose the required
components from the Select
Components dialog box (see Figure 8).
The component list is conditioned by
the installation pattern: if you install the
program on a server, the list will contain
all the components; otherwise, it will
contain two components less.
To choose the components to be
installed check the appropriate boxes at
the left of the component names.
Step 9. Copying files to the hard disk
Read the setup information in the Start Copying Files dialog box (see Figure 9).
Click Next to resume the installation. The program will start copying files to the
hard disk. Percentage of completion is indicated by the progress bar in the Setup
Status dialog box (see Figure 10).
Figure 9. The Start Copying Files dialog
box
Figure 10. The Setup Status dialog box

Installation 19
Step 10. Choose the report storage directory
In the Report Viewer Settings dialog box (see Figure 11), you should specify
the folder in which to save the reports generated by Anti-Virus Updater and
Kaspersky Anti-Virus®Control Centre. Reports generated by Anti-Virus Engine
are saved to the folder specified from MMC.
Step 11. Choosing service properties
While installing Anti-Virus Engine for MS Exchange Server 5.5, you should set
the service account for the Kaspersky Anti-Virus®MAPI Interceptor for MS
Exchange Server service in the Service properties dialog box (see Figure 12).
This service account must have MS Exchange Server administrator rights to
change any messages in the mailboxes stored on this server (Service Account
Admin rights). Enter the account name in the Account Name field. Enter the
appropriate password in the Password field and the Confirm password field.
Note that the setup wizard does not check the validity of your
information. If you enter incorrect information, the service will be
unavailabsle (or will operate incorrectly).
The data you enter in the Service properties dialog box will be used to
register Kaspersky AV LDAP Notification Service.
Under MS Exchange Server 2000/2003, Kaspersky AV LDAP
Notification Service runs under the system account.
Figure 11. The Report Viewer Settings
dialog box
Figure 12. The Service properties dialog
box

20 Kaspersky Anti-Virus 4.5 for MS Exchange Server
Step 12. Remote administration password
In the Administration Password dialog box (see Figure 13), enter the remote
administration password that will be used by Kaspersky®Network Control Centre
to connect to the protected server.
Step 13. Define paths to the license key files
In the License Key File dialog box (see Figure 14), define the license key file
name and the path.
Figure 13. The Administration Password
dialog box
Figure 14. The License Key File dialog
box
If the file is located in the setup folder, its name will be displayed in the List of
license key files to install.
If the license key file is located in a different folder, click Add and define the
license key file name and path in the Select License Key File standard dialog
box. If required, the program can use several license key files simultaneously.
Check the box in the Associate license key file types group if you want to
activate the AddKey utility. After the AddKey utility is activated, you can install
new license key files by double-clicking them.
The license key file is your personal "key" that contains all the housekeeping
data essential for Kaspersky Anti-Virus®to apply all its features:
• vendor information for this version (company name, addresses, telephone
numbers);
• support information (who provides the support and where);
• product release date;
• license name and number;