KAPERSKY ANTI-VIRUS 5.0 - FOR SAMBA SERVERS Service manual

KASPERSKY LAB
Kaspersky Anti-Virus 5.0
for Windows Workstations
Administrator’s Guide

KASPERSKY ANTI-VIRUS®5.0
FOR WINDOWS WORKSTATIONS
Administrator’s Guide
©Kaspersky Lab
http://www.kaspersky.com
Revision date: July, 2006

Contents
CHAPTER 1. KASPERSKY ANTI-VIRUS FOR WINDOWS WORKSTATIONS ......... 7
1.1. What's new in version 5.0? ................................................................................... 9
1.2. Hardware and software system requirements ................................................... 11
1.3. Distribution kit ...................................................................................................... 11
1.3.1. License Agreement....................................................................................... 12
1.4. Services for registered users .............................................................................. 12
1.5. Conventions......................................................................................................... 13
CHAPTER 2. INSTALLATION AND REMOVAL OF THE APPLICATION ................. 14
2.1. Installing the application ...................................................................................... 14
2.2. Silent mode installation of the application........................................................... 19
2.3. Removing the application.................................................................................... 22
2.4. Updating from version 4.x to 5.0 ......................................................................... 22
CHAPTER 3. APPLICATION MANAGEMENT CONCEPTS ...................................... 23
3.1. Basic concepts of the administration concept .................................................... 24
3.2. Local interface ..................................................................................................... 25
3.2.1. System tray icon ........................................................................................... 25
3.2.2. Right-click menu ........................................................................................... 26
3.2.3. Main application window: general structure................................................. 27
3.2.3.1. The Protection tab.................................................................................. 28
3.2.3.2. The Settings tab..................................................................................... 29
3.2.3.3. The Support tab ..................................................................................... 31
3.2.4. Scanning process window............................................................................ 32
3.2.5. Help system .................................................................................................. 33
CHAPTER 4. COMPUTER PROTECTION USING THE DEFAULT SETTINGS ...... 34
4.1. Default settings .................................................................................................... 34
4.2. Anti-Virus protection levels.................................................................................. 36
CHAPTER 5. APPLICATION MANAGEMENT USING THE LOCAL INTERFACE... 39
5.1. Updating the anti-virus database and application modules ............................... 39
5.1.1. When to download updates.......................................................................... 40

4 Kaspersky Anti-Virus 5.0 for Windows Workstations
5.1.2. Performing manual update. Downloading updates ..................................... 40
5.1.3. Configuring updates ..................................................................................... 42
5.1.3.1. Updating the application modules ......................................................... 44
5.1.3.2. Copying updates to the local folder....................................................... 45
5.1.3.3. Selecting the updates source ................................................................ 46
5.1.3.4. Proxy server settings configuration ....................................................... 48
5.1.3.5. Selecting anti-virus database type ........................................................ 49
5.2. Real-time protection mode.................................................................................. 51
5.2.1. File system scan ........................................................................................... 53
5.2.1.1. Selecting the anti-virus protection level................................................. 55
5.2.1.2. Actions to be performed with a detected object.................................... 57
5.2.2. Scanning mail ............................................................................................... 59
5.2.2.1. Selecting the anti-virus protection level................................................. 60
5.2.2.2. Actions to be performed with a detected object.................................... 62
5.2.3. Scanning Microsoft Office Outlook mail....................................................... 63
5.2.4. Macros monitoring ........................................................................................ 64
5.2.5. Scripts monitoring ......................................................................................... 66
5.2.6. Protection against network attacks .............................................................. 67
5.3. The on-demand scan mode................................................................................ 70
5.3.1. Full computer scan ....................................................................................... 70
5.3.2. Scanning selected objects............................................................................ 72
5.3.3. Configuring on-demand scan....................................................................... 74
5.3.3.1. Selecting the scan level ......................................................................... 77
5.3.3.2. Actions to be performed with a detected object.................................... 80
5.3.4. Scanning archives ........................................................................................ 82
5.3.5. Scanning removable drives.......................................................................... 84
5.4. Processing malicious objects detected............................................................... 85
5.5. Software processing monitoring.......................................................................... 89
5.6. User’s tasks ......................................................................................................... 91
5.7. Creating list of exclusions.................................................................................... 92
5.8. Configuring schedule........................................................................................... 96
5.9. Launching a task under a selected user's account ............................................ 99
5.10. Additional features........................................................................................... 100
5.10.1. Quarantine and Backup storage .............................................................. 101
5.10.1.1. Storage setup..................................................................................... 101
5.10.1.2. Work with Quarantine storage........................................................... 103

Contents 5
5.10.1.3. Working with Backup storage............................................................ 105
5.10.2. Working with reports................................................................................. 106
5.10.3. Managing Kaspersky Anti-Virus configuration......................................... 111
5.10.4. Additional settings..................................................................................... 112
5.10.5. Configuring prompts for confirmation....................................................... 116
5.10.6. Restricting efficiency of Kaspersky Anti-Virus ......................................... 117
5.10.7. Working in the administrator’s and the user’s mode ............................... 118
CHAPTER 6. MANAGING THE APPLICATION USING KASPERSKY
ADMINISTRATION KIT............................................................................................ 120
6.1. Managing installation packages........................................................................ 120
6.1.1. Creating an installation package ................................................................ 120
6.1.2. Viewing and editing the installation package settings ............................... 123
6.2. Managing policies.............................................................................................. 124
6.2.1. Creating a policy ......................................................................................... 124
6.2.2. Viewing and editing policy settings ............................................................ 128
6.2.2.1. Viewing information about policy......................................................... 128
6.2.2.2. On-demand scanning .......................................................................... 130
6.2.2.3. Real-time protection of file system objects.......................................... 132
6.2.2.4. Threats and Exclusions ....................................................................... 135
6.2.2.5. Software processes monitoring........................................................... 135
6.2.2.6. Scanning e-mail messages ................................................................. 136
6.2.2.7. Scripts monitoring ................................................................................ 139
6.2.2.8. Macros monitoring ............................................................................... 140
6.2.2.9. Protection against network attacks...................................................... 143
6.2.2.10. Updating anti-virus databases and application modules.................. 144
6.2.2.11. Working with system tasks ................................................................ 146
6.2.2.12. Setting up Quarantine and Backup storage...................................... 146
6.2.2.13. Producing report on the operation of application.............................. 148
6.2.2.14. Additional parameters........................................................................ 151
6.2.2.15. Viewing results of policy application.................................................. 155
6.3. Managing tasks ................................................................................................. 156
6.3.1. Creating a task............................................................................................ 156
6.3.1.1. Creating a local task ............................................................................ 157
6.3.1.2. Creating a group task .......................................................................... 163
6.3.1.3. Creating a global task .......................................................................... 163
6.3.2. Viewing and editing task settings and monitoring task performance........ 164

6 Kaspersky Anti-Virus 5.0 for Windows Workstations
6.3.3. Launching and stopping tasks.................................................................... 165
6.4. Configuring application settings ........................................................................ 165
6.4.1. Viewing information about the application ................................................. 167
6.4.2. Additional application settings .................................................................... 168
6.4.3. Working with the quarantine and backup storage areas........................... 169
6.4.4. Viewing information on license keys .......................................................... 171
6.4.5. Setting up report generation parameters................................................... 171
CHAPTER 7. TESTING OPERATION OF KASPERSKY ANTI-VIRUS ................... 172
7.1. Test “virus” EICAR and its modifications .......................................................... 172
7.2. Testing correct operation of Kaspersky Anti-Virus ........................................... 174
CHAPTER 8. MANAGING LICENSE KEYS .............................................................. 176
8.1. Managing keys using local interface................................................................. 177
8.2. Working with license keys using the Kaspersky Administration Kit interface.. 180
CHAPTER 9. MANAGING APPLICATION FROM THE COMMAND LINE.............. 181
9.1. Scanning selected objects ................................................................................ 182
9.2. Full scan............................................................................................................. 184
9.3. Launching updates ............................................................................................ 185
9.4. Last update rollback .......................................................................................... 186
9.5. Real-time protection mode................................................................................ 187
9.6. Starting the application ...................................................................................... 187
9.7. Stopping the application .................................................................................... 188
9.8. Managing tasks ................................................................................................. 188
9.9. Import/export of settings.................................................................................... 190
9.10. Adding a license key ....................................................................................... 191
CHAPTER 10. FREQUENTLY ASKED QUESTIONS............................................... 192
APPENDIX A. CONTACTING TECHNICAL SUPPORT SERVICE.......................... 199
APPENDIX B. GLOSSARY......................................................................................... 202
APPENDIX C. KASPERSKY LAB............................................................................... 209
C.1. Other Kaspersky Lab Products ........................................................................ 210
C.2. Contact Us ........................................................................................................ 218
APPENDIX D. LICENSE AGREEMENT .................................................................... 219

CHAPTER 1. KASPERSKY ANTI-
VIRUS FOR WINDOWS
WORKSTATIONS
Kaspersky Anti-Virus®for Windows Workstations (hereinafter referred to as
the Kaspersky Anti-Virus) is designed to protect workstations against computer
viruses and malware.
The following features have been implemented in the application:
• Protection against computer viruses and malware – detection and
elimination of malware in your computer. Two main application operating
modes, that can be used either separately or jointly, can be distinguished:
• Real-time computer protection – scanning for viruses all
objects that are run, opened or saved on your computer.
• On-demand computer protection – scanning the entire
computer or its individual drives, files or folders. You can launch
such scan manually or configure a schedule to launch the scan
automatically at a certain time interval.
• Recovering after a virus attack. Full scan and disinfection that use
settings recommended by the Kaspersky Lab’s experts allows detecting
all viruses that infected your data during virus attacks.
• Scanning and disinfection of incoming/outdoing mail – anti-virus
analysis and disinfection of all incoming and outgoing mail in the real-time
mode1. Additionally, the application allows manual scanning and
disinfection of mail databases of mail clients2.
• Computer protection against network attacks – analysis of all data
received from the network (LAN and internet) by the user’s computer to
detect network attacks. Once a network attack is detected, required
1The application scans all mail sent and received by Microsoft Office Outlook irrespec-
tive of the mail protocols used as well as any mail sent or received by any mail program
using SMTP and POP3 protocols.
2Kaspersky Anti-Virus scans mail databases for any mail client program, but disinfects
databases of Microsoft Office Outlook and Microsoft Outlook Express only.

8 Kaspersky Anti-Virus 5.0 for Windows Workstations
defense will be provided and the attacking computer will be blocked.
Additionally, the application will use the invisible mode that allows
receiving data only from computers that are engaged in the data
exchange initiated by the user.
• Updating of the anti-virus database, network attacks database and
application modules – updating of the anti-virus database and network
attacks database with information about new viruses and attacks,
methods to be used for disinfection of objects infected with these viruses
and malware and updating of the application modules (if this feature is not
disabled). Updates are downloaded from the Kaspersky Lab’s updates
server specified by the user or from a network/local updates folder.
• Recommendations on the application setup and operation – various
tips and recommendation of Kaspersky Lab’s experts on configuring the
application to ensure the optimal anti-virus protection will be displayed
when you use Kaspersky Anti-Virus.
Once dangerous objects are detected, if the anti-virus database has not
been updated or the full computer scan has not been performed for a very
long time, recommendations to perform certain actions with explanation
will be displayed in the main window of Kaspersky Anti-Virus.
Based on the extensive practical experience in the anti-virus industry and
on the analysis of the feedback provided by our users to the Technical
Support Service, Kaspersky Lab’s specialists did their best to configure
the application to ensure the optimal performance. Anti-virus settings
recommended by our experts apply immediately after your have installed
and launched the application.
• The use of various application configuration profiles – creating and
using of special configuration files – profiles that store the application
settings. By specifying application settings and saving them in the profiles
you can easily alter Kaspersky Anti-Virus configuration. Thus, for
example, you can configure the application to use the real-time protection
mode or to perform the on-demand scan task only and to use such
configurations only when required. You can also return to the
recommended application settings at any time when using Kaspersky
Anti-Virus.
• Using two application operation modes – you can use the application
in the user’s or the administrator’s mode. In the user’s mode only basic
functionality of Kaspersky Anti-Virus is available, but you can not alter the
application settings or disable the anti-virus protection. In the
administrator’s mode you have access to all features to manage the
application.
• Placing objects into quarantine – moving objects that are possibly
infected with viruses and their modifications into a special safe storage

Kaspersky Anti-Virus for Windows Workstations 9
where you can disinfect, delete them, restore them to the original folder or
send them to the Kaspersky Lab’s experts for analysis. Quarantined files
are stored in a special format and do not impose any threat.
• Creating backup copies of objects – creating special backup copies of
objects in a special storage before attempting to disinfect or delete these
objects. Such copies are created for the cases when you need to restore
the original object if it contains valuable information or to restore the
situation when the infection took place. Copies are stored in a special
format and do not impose any threat.
• Creating reports – registering all results of Kaspersky Anti-Virus
operation in the reports. A detailed report about the results of the scan
includes the general statistical information about objects scanned, stores
information about the settings used to perform tasks and about the order
of scan and processing of each particular object. Reports are also created
for the results of the updates and of the operation in the real-time
protection mode.
• Centralized remote management of the application – controlling the
application using the Kaspersky Administration Kit 5.0 centralized
administration system.
Some functions of Kaspersky Anti-Virus are available from the
command line (details see Chapter 9 on page 181).
1.1. What's new in version 5.0?
Version 5.0 of Kaspersky Anti-Virus for Windows Workstations differs from
the previous 4.x version as follows:
• The use of the anti-virus scan acceleration technologies: iChecker™ and
iStreams™: Now Kaspersky Anti-Virus does not re-scan objects that have
been analyzed during a previous scan and have not been altered since
then not only in the real-time protection mode, but also during an on-
demand scan. This feature ensures a considerable acceleration of the
application’s operation.
• Scan and disinfection of mail sent or received by any mail client
application using SMTP and POP3 protocols. Previous versions ensured
anti-virus mail protection only for Microsoft Office Outlook.
• Disinfection of infected archives. Kaspersky Anti-Virus allows disinfecting
infected files contained in zip, arj, cab, rar, lha and ice archives. Previous
versions of the application provided only for detection of infected files in

10 Kaspersky Anti-Virus 5.0 for Windows Workstations
the archives and for disinfection of infected objects contained in zip
archives.
Kaspersky Anti-Virus scans multi-volume archives of the
above format and self-extracting archives, but does not
disinfect them.
• The anti-virus database updating process speed has been increased
through determining the Kaspersky Lab’s updates server closest to the
user’s geographical location. An ability to receive the remaining part of the
updates in case of a disconnection has been implemented.
• Protection against network attacks. This version of Kaspersky Anti-Virus
ensures protection of your computer against most common network and
hackers’ attacks.
• Intuitive interface. The application is now implemented as a single
program while previous versions consisted of a set of programs that
performed individual anti-virus protection functions. This new approach
made it possible to ensure intuitive and simple management of most
critical functions of Kaspersky Anti-Virus.
• Kaspersky Anti-Virus compatibility with other anti-virus products has been
improved. During the installation of the application you can disable the
function of file system, mail or network protection or the function of real-
time script monitoring if such protection is provided by other applications
installed on your computer.
• Recommended settings and expert tips. Settings recommended by the
Kaspersky Lab’s experts are used as the default settings in this version to
simplify the use of the program. In most cases there is no need to
configure the application before use. In situations when the anti-virus
protection is set to the low level, the application displays a corresponding
message and suggests various ways to increase the degree of protection.
• Managing application operation profiles. Ability to save the application
setting in special files for further use. If you are not satisfied with the
Kaspersky Anti-Virus settings, configure it as you wish and save this
configuration in the profile.
• Renewing the application license. Kaspersky Anti-Virus 5.0 allows to
install the license key to renew the application license.
• Sending objects to Kaspersky Lab for analysis. Now you can send to
Kaspersky Lab for analysis possibly infected objects detected by
Kaspersky Anti-Virus and files that you suspect to have been infected.
• Infected mail databases cannot be deleted. Now Kaspersky Anti-Virus
does not delete infected mail databases. However you still can delete
such object manually.