KAPERSKY ANTI-VIRUS 5.0 - FOR SAMBA SERVERS Service manual

KASPERSKY LABS
Kaspersky Anti-Virus 5.0
for Linux Workstation
ADMINISTRATOR’S GUIDE

KASPERSKY ANTI-VIRUS 5.0 FOR LINUX WORKSTATION
Administrator's
guide
Kaspersky Labs, Ltd.
http://www.kaspersky.com
Revision date: November 2003

Contents
CHAPTER 1. KASPERSKY ANTI-VIRUSTM FOR LINUX WORKSTATION ................ 6
1.1. What’s new in version 5.0 ..................................................................................... 6
1.2. Licensing policy ..................................................................................................... 8
1.3. Hardware and software requirements .................................................................. 8
1.4. Distribution kit ........................................................................................................ 8
1.5. Help desk for registered users .............................................................................. 9
1.6. Conventions........................................................................................................... 9
CHAPTER 2. INSTALLING KASPERSKY ANTI-VIRUS ............................................. 11
2.1. Universal installation............................................................................................ 11
2.1.1. Starting the installation procedure................................................................ 12
2.1.2. Previous version search ............................................................................... 12
2.1.2.1. Creating a backup copy of the previous distribution package.............. 13
2.1.2.2. Updating to version 5.0.......................................................................... 14
2.1.2.3. Installing alongside an earlier version ................................................... 14
2.1.3. Copying the distribution files......................................................................... 15
2.1.4. License key installation................................................................................. 15
2.1.5. Completing the installation ........................................................................... 16
2.1.6. Installation report........................................................................................... 16
2.2. Installing the program on a server running Linux ............................................... 17
CHAPTER 3. POST-INSTALLATION SETTINGS ....................................................... 19
3.1. Setting up the program by default....................................................................... 19
3.2. Installing / updating anti-virus database.............................................................. 20
3.3. Setting up joint operation with Webmin .............................................................. 20
CHAPTER 4. WORKING WITH KASPERSKY ANTI-VIRUS...................................... 22
4.1. Anti-virus database updating............................................................................... 22
4.1.1. Scheduling anti-virus database updating using cron................................... 23
4.1.2. One-time update of the anti-virus database................................................. 25
4.2. Antiviral protection of file systems....................................................................... 26
4.2.1. Launching directory scan from the command line....................................... 27
4.2.2. Scheduled daily directory scan .................................................................... 28
4.2.3. Moving objects to a separate directory (quarantine) ................................... 28

4 Kaspersky Anti-VirusTM for Linux Workstation
4.2.4. Advanced options: using script files............................................................. 30
4.2.4.1. Cleaning infected objects in archives.................................................... 30
4.2.4.2. Sending notifications to the administrator ............................................. 32
4.3. License key management................................................................................... 33
4.3.1. Viewing the license key information............................................................. 34
4.3.2. Renewing the license ................................................................................... 35
CHAPTER 5. ADVANCED SETTINGS ........................................................................ 37
5.1. Setting antiviral protection of the server’s file systems....................................... 37
5.1.1. Scan area...................................................................................................... 37
5.1.2. File check and disinfection mode................................................................. 38
5.1.3. Actions taken with the files ........................................................................... 39
5.2. Setting up file scanning parameters for the aveserver and aveclient
components........................................................................................................ 40
5.2.1. Operation mechanism of aveserver and aveclient ...................................... 41
5.2.2. Command line syntax for the aveclient client component........................... 41
5.2.3. Additional opportunities for integration with third party software................. 43
5.3. Localization of the format of time and date display ............................................ 43
5.4. Parameters of Kaspersky Anti-Virus report generation...................................... 44
5.4.1. Format of scanning messages output by kavscanner................................. 46
5.4.2. Format of other messages output by kavscanner ....................................... 47
5.4.3. Format of kavscanner console messages................................................... 48
CHAPTER 6. QUESTIONS AND ANSWERS.............................................................. 50
CHAPTER 7. UNINSTALLING KASPERSKY ANTI-VIRUS........................................ 54
APPENDIX A. SUPPLEMENTARY INFORMATION ABOUT THE PRODUCT......... 55
A.1. Location of the product files in the directories.................................................... 55
A.2. Kaspersky Anti-Virus configuration file............................................................... 56
A.3. Command line keys for the kavscanner component ......................................... 61
A.4. The kavscanner component return codes ......................................................... 64
A.5. Command line keys for the licenseviewer component ...................................... 65
A.6. Command line keys for the kavupdater component.......................................... 65
A.7. The kavupdater component return codes .......................................................... 66
A.8. Command line keys for the aveclient component.............................................. 67
A.9. The aveclient component return codes.............................................................. 67
A.10. A sample script file (vox.sh) for disinfecting tar- and zip-archives................... 68

Contents 5
APPENDIX B. MALICIOUS PROGRAMS IN THE UNIX ENVIRONMENT................ 71
B.1. Viruses................................................................................................................. 71
B.2. Trojan horses ...................................................................................................... 72
B.3. Internet worms..................................................................................................... 73
APPENDIX C. KASPERSKY LABS LTD...................................................................... 76
C.1. Other Kaspersky Labs Products ....................................................................... 77
C.2. Contact Information............................................................................................. 80
APPENDIX D. INDEX .................................................................................................... 81

CHAPTER 1. KASPERSKY ANTI-
VIRUSTM FOR LINUX
WORKSTATION
Kaspersky Anti-VirusTM for Linux Workstation (hereinafter also referred to as
Kaspersky Anti-Virus for Linux) is designed for anti-virus file scanning in file
systems of servers running under the Linux operating system.
This software product allows the user to:
• Check for viruses in all mounted file systems.
• Detect infected, suspicious, corrupted, and password-protected files, as
well as files that fail to be scanned because of an error.
• Carry out anti-virus processing (disinfect) infected objects in file systems.
• Move to the quarantine directory all infected, suspicious, and corrupted
objects of the server file system. For the latter, disinfected and password-
protected files can also be quarantined, as well as files that fail to be
scanned because of an error.
• Update the program’s anti-virus database. Anti-virus database updates
are downloaded from Kaspersky Labs’ update servers.
The anti-virus database is used when searching for and cleaning infected
objects. Based on its contents, during the scan, each file is analyzed for
the presence of viruses and the file’s code is compared to codes specific
to particular viruses. If the file is infected, the program disinfects it.
It should be kept in mind that new viruses appear daily, therefore
we recommend updating the anti-virus database every day in
order to maintain the product in up-to-date condition.
• Configure Kaspersky Anti-Virus via the web-interface provided by the
Webmin program and the product configuration file.
1.1. What’s new in version 5.0
Version 5.0 of Kaspersky Anti-Virus has the following changes compared to
version 4.0:

Kaspersky Anti-VirusTM for Linux Workstation 7
• All the product components have been transferred to the new antiviral
engine, which reduces the load on workstations and servers but provides
the same functionality.
• A number of drawbacks in Kaspersky Anti-Virus for Unix v. 4.0 related to
its architectural features have been corrected. Several security-related
bugs have been fixed, therefore an upgrade to version 5.0 is
recommended for users of version 4.0.
• The web-configuration component, WebTuner, has been replaced by a
plug-in from the commonly used program Webmin. This has extended the
functionality of the product.
• Configuration files of all components have been united into one file
kav4unix.conf, thus making it simpler to manage the product. In this
connection, the configuration of the entire product has been transferred
from a binary to a text framework.
• The possibility has been added to configure formats of time and date
representation in the program components’ operation reports and
notifications.
• It is now possible to use script files for processing of objects with different
statuses (infected, corrupted etc.)
• An option has been added of automatic restarting of the program’s
resident components after successful update of the anti-virus database.
• The product is distributed in the form of standard installation packages for
the supported operating systems (rpm, deb).
• The product licensing policy has been changed:
• After the license expires, Kaspersky Anti-Virus remains
functional except for the anti-virus database updating feature.
• Kaspersky Anti-Virus does not work without a license key.
• The component kavucc (Control Centre) has been excluded due to
simplification of the product architecture.
• The components kavinspector (Inspector), kavtuner (Tuner), kavdaemon
(Daemon) and kavmonitor (Monitor) have been excluded from the
product.
• The executable file of the kavdaemon component has been renamed to
aveserver and updated.
• The product has been supplemented with the aveserver component
including the aveclient client software, which allows the creation of
custom solutions (e.g. for integration with third party software, network

8 Kaspersky Anti-VirusTM for Linux Workstation
traffic protection, etc. Please read relevant details in para. 5.2.3 on p.
43).
1.2. Licensing policy
Kaspersky Anti-Virus licensing policy includes a system of product use limitations
based on product use duration (usually limited to one year from the date of
purchase).
1.3. Hardware and software
requirements
In order to function properly, Kaspersky Anti-Virus needs a system complying
with the following requirements:
• Hardware requirements:
• Intel Pentium-class processor
• 32 Mb of RAM or more
• 100 Mb or more of hard disk space
• Software requirements:
• One of the following operating systems:
Linux RedHat (version 7.3, 8.0 or 9.0), Linux SuSE (version 8.1
or 8.2) or Linux Debian (version 3.0)
• The Wget program (http://gnu.org/software/wget/wget.html) for
anti-virus database updating using kavupdater.
• The Webmin program (www.webmin.com) for Kaspersky Anti-
Virus remote administration.
• Perl version 5.0 or higher (www.perl.org) for Kaspersky Anti-
Virus installation using install.pl.
1.4. Distribution kit
You can purchase Kaspersky Anti-Virus either from our distributors (retail box) or
in our Internet-shop (www.kaspersky.com, Buy online section).
When purchasing a retail box you will receive the following distribution kit:

Kaspersky Anti-VirusTM for Linux Workstation 9
• A sealed envelope with an installation CD (or a set of floppy disks)
containing software product files.
• Administrator’s guide.
• License key.
• Registration card (with printed serial number of the product).
• License agreement.
Before you unseal the envelope containing the CD (or floppy disks), be sure to
thoroughly review the license agreement.
When purchasing Kaspersky Anti-Virus in the Web-shop you download the
product from Kaspersky Labs’ website. The distribution file contains the product
and the license key.
1.5. Help desk for registered users
Kaspersky Labs offers a large service package enabling legal users to efficiently
employ Kaspersky Anti-Virus.
If you register and purchase a subscription you will be provided with the following
services for the period of your subscription:
• daily virus-definition database updates via e-mail
• product upgrades
• phone and e-mail advice on matters related to your software installation,
configuration and performance
• information about new Kaspersky Labs products and new computer
viruses (for those who subscribe to our newsletter).
Kaspersky Labs does not give advice on the performance and use of
your operating system or other technologies.
1.6. Conventions
In this book we use various conventions to emphasize different meaningful parts
of the documentation.

10 Kaspersky Anti-VirusTM for Linux Workstation
Convention Meaning
Bold font Menu titles, commands, window titles,
dialog elements, etc.
Note.
Additional information, notes
Attention!
Very important information
To do this,
1. Step 1.
2. …
Actions that must be taken
Task
Example of a user defined task to be
accomplished using this program.
Solution
Solution of the task.
[switch] – function of the switch. Command line switches
Info message text Text of the configuration files and
information messages of the program.

CHAPTER 2. INSTALLING
KASPERSKY ANTI-VIRUS
Before you begin to install Kaspersky Anti-Virus for Unix, please prepare your
system as follows:
• Make sure your system meets the hardware and software requirements of
Kaspersky Anti-Virus (see section 1.3 on page 8). If some of the
applications, such as Wget, are not installed we recommend installing
them, otherwise some product functions will be unavailable.
• Set up an Internet connection.
• Enter the system as root user or any other with the UID (universal
identifier) equal to zero.
2.1. Universal installation
This installation variant is suitable for the Linux operating system.
A multi-system distribution package of Kaspersky Anti-Virus for Unix is supplied
as an archive. The archive contains the directory tree with the distribution
package files and the installation script install.pl (hereinafter also referred to as
the installer), which carries out the installation.
For the Linux operating system, the distribution package also contains rpm- and
deb-packages (see section 2.2 on page 17).
Product installation on the server consists of the following stages:
1. Server inspection for the purpose of finding an installed version 4.0 of
Kaspersky Anti-Virus, depending on which the following scenarios of
installer are possible:
• No earlier version is detected - installer proceeds to installation
of the product on the server.
• Earlier version of Kaspersky Anti-Virus detected:
o Backup copy of the detected distribution package is
created and the new version is installed.
o Update to version 5.0.

12 Kaspersky Anti-VirusTM for Linux Workstation
o Installation of version 5.0 of the product without removing
the earlier version.
The stages of creating backup, updating to version 5.0,
and concurrent installation are independent.
2. Copying of the distribution package files to the server.
3. Installation of the license key (only if not included in the distribution
package).
Below is a step-by-step description of the installation procedure.
2.1.1. Starting the installation procedure
In order to install Kaspersky Anti-Virus on the server, please do the
following:
1. Copy the distribution package archive to the server’s file system
directory.
2. Unpack the archive using the command: tar zxvf <archive
name>. After this, several files will be extracted from the archive,
including the installer and the file tree of the product’s distribution
package.
3. Run the installation script: install.pl.
In order to start the installation of Kaspersky Anti-Virus from the rpm-
package, type the following in the command line:
rpm –i <distribution_file_name>
In order to start the installation of Kaspersky Anti-Virus from the deb-
package, type the following in the command line:
dpkg –i <distribution_file_name>
2.1.2. Previous version search
Immediately after launching the installation, the system is inspected for the
presence of a previously installed copy of Kaspersky Anti-Virus for Unix
version 4.0.

Installing Kaspersky Anti-Virus 13
If no earlier version is installed on the server, then the process of copying
distribution files to the server starts (see section 2.1.3 on page 15).
If an earlier version of the product is found, the following message is output to
the console:
Previously installed components of Kaspersky AV
found. Do you want to back them up now?
and the administrator is offered the opportunity to back up the previous version of
the product (see section 2.1.2.1 on page 13).
You can skip the archiving and proceed to updating the previously installed
product (see section 2.1.2.2 on page 14). However, if you want to use both the
earlier and the current version of the product, you should reply ‘No’, and proceed
directly to copying of the distribution files to the server (see section 2.1.2.3 on
page 14).
2.1.2.1. Creating a backup copy of the previous
distribution package
In the event that an earlier version of the product is detected, the administrator
will be offered the opportunity to archive the previously installed Kaspersky Anti-
Virus (creating a backup copy) and then to delete its distribution files. The
archived earlier version of Kaspersky Anti-Virus may prove useful for subsequent
restoration if, for example, you later decide to return to using it.
The task of restoring the previous version of Kaspersky Anti-Virus is left
with the administrator.
To archive the distribution files you will have to select the path to the archive file:
Where do you want to save backup file?
Enter absolute path to file without .tgz extension
[/tmp/oldkav].
If the file suggested by default already exists, a message will be output to the
console with a query about whether to overwrite it or not.
If you do not want to use the default file name, you will have to enter the full path
to the archive file without the extension.
After the backup is successfully created, the administrator is offered the
opportunity to delete the previous version and proceed to updating to version
5.0.

14 Kaspersky Anti-VirusTM for Linux Workstation
2.1.2.2. Updating to version 5.0
The update procedure consists of converting the former profile of the anti-virus
(file defUnix.prf) to the configuration file for version 5.0:
Do you want to convert old settings to new config
file? [yes]
Answer ‘yes’ if you want to start the data conversion. This will launch the process
of creating a configuration file for version 5.0 with parameters that were true for
the earlier version.
You can select the created file as the default configuration file. To do so, reply
‘yes’ to the following question asked by the installer:
Do you want to make generated file as a default
config file?
The configuration file included in the distribution package will be renamed
(/etc/kav/5.0/kav4unix.conf.copy) and saved in the same directory. The newly
converted file will be assigned the name of Kaspersky Anti-Virus version 5.0
configuration file (/etc/kav/5.0/kav4unix.conf.)
If you do not want to replace the configuration file included in the distribution
package with the newly created one, answer ‘no’. In this case the new file will be
saved in the same directory as the main one (/etc/kav/5.0/kav4unix.conf.4.0) and
you will be able to use it with Kaspersky Anti-Virus.
2.1.2.3. Installing alongside an earlier version
It is also possible to run two versions of Kaspersky Anti-Virus for Unix on the
server simultaneously..
As for the components involved in file system scanning, these can function
independently.
In order to install Kaspersky Anti-Virus version 5.0 concurrently with an earlier
version you will have to do the following:
1. Do not create a backup when offered (see section 2.1.2.1 on page
13).
2. Do not update the installed program when offered (see
section 2.1.2.2 on page 14).
3. Proceed to copying the files of Kaspersky Anti-Virus version 5.0
distribution package to the server.

Installing Kaspersky Anti-Virus 15
2.1.3. Copying the distribution files
In this stage, an interactive installation process starts that will copy the
distribution files of Kaspersky Anti-Virus to your server.
The package files are divided into several groups according to their purpose, for
example: binary files, configuration files, initialization scripts etc. The installer
offers to copy each group into the respective directory. For example, for binary
files the directory is /opt/kav/bin:
Installing the content of the package.
In which directory do you want to install the binary
files? [/opt/kav/bin]:
Full paths to the directories vary with different distribution packages.
You can specify your own directories, but remember to make the
respective changes to the product configuration settings after the
installation is complete!
Depending on your answers, the necessary directories are created and the files
are copied.
Since the distribution package of Kaspersky Anti-Virus includes only the remote
administration module of the Webmin package, during file copying the installer
searches for Webmin installed on the server.
If the installer does not find Webmin using the typical path (for example,
/etc/Webmin), then it outputs an appropriate message to the console and
requests the path of the Webmin configuration file. In the event that the package
is not installed on your server, the remote administration module of Kaspersky
Anti-Virus will not be installed. However, all the files required for its installation
are stored in the archive of the Kaspersky Anti-Virus distribution package, so you
can add the Webmin module later using the tools provided by this package (for
details refer to the documentation supplied with the Webmin program).
2.1.4. License key installation
In this stage of the installation process, the installer searches the current
directory for the license key – the file (with the extension .
key ) - required by
Kaspersky Anti-Virus to run. This file detects the type of license and enables the
user to begin using the program. It is impossible to use Kaspersky Anti-Virus until
you install the license key.

16 Kaspersky Anti-VirusTM for Linux Workstation
If the license key is detected, the installer outputs an appropriate message to the
console and proceeds to the next stage – installation of the anti-virus database
(see section 3.2 on page 20).
If the license key is not detected, the installer suggests that you specify its full
path. If the administrator has no key (for example, the product was purchased
on-line and the license key has not yet been received) skip the step of specifying
the license key path (choose [cancel]) and proceed with the product installation.
As soon as you receive the license key, it must be copied to the key storage
directory specified in the LicensePath parameter in Kaspersky Anti-Virus
configuration file (see section A.2 on page 56).
If a license key is detected that is not suitable for this product (for example, a key
for Kaspersky Anti-Virus for Unix Mail Servers), then after installation the
program will only scan the server file system.
2.1.5. Completing the installation
If all the installation steps described above are finished successfully, the
appropriate message will be output to the console. The configuration file included
in the distribution package contains all the settings required to start the program.
A number of file parameters are determined during program installation, such as
the name of the host on which Kaspersky Anti-Virus will run.
Other parameters are set by default (see section 3.1 on page 19). However, the
administrator will have to adjust some settings to begin working with Kaspersky
Anti-Virus. For more information about all the settings required before you can
use the program, please refer to Chapter 3 on page 19.
If any installation step is skipped (e.g. because there is no access to the anti-
virus database), you can carry it out at a later time.
2.1.6. Installation report
Information about all the actions taken during installation is written to the text file
/etc/kav/5.0/locations .
This file is required for patching the product, adding components, or uninstalling
the program.
The format of the lines in the report may be different depending on the events
they describe:
• A directory created in the system or a file copied from the distribution
package is described by a line like this:

Installing Kaspersky Anti-Virus 17
<file | dir> <path> [size]
where:
• file or dir is the file or the directory ID
• path – full name of the file or the directory
• size – file size (this parameter is not used for directories).
• Actions dealing with user’s answers to the installer questions are
described by lines like this:
<answer> <var> <reply>
where:
• answer – the installer’s request ID
• var – variable name corresponding to this request
• reply – value of the variable entered as the answer to the
request.
2.2. Installing the program on a
server running Linux
For Linux RedHat and Linux SuSE operating system distribution packages,
Kaspersky Anti-Virus for Unix contains an rpm-package.
To start the installation of Kaspersky Anti-Virus from the rpm-package,
type the following in the command line:
rpm –i <distribution_file_name>
Kaspersky Anti-Virus will be installed automatically according to the default
settings of the operating system.
No search for a previous version of Kaspersky Anti-Virus will be made. If
Kaspersky Anti-Virus 4.0 is installed on your server, it will be ignored during the
installation of version 5.0.
During the installation process the administrator must run the script
/opt/kav/contrib/config.pl. During its execution, the license key will be installed (if
it is included in the distribution kit).
If the installer fails to find any required file in its default location (e.g. the license
key or Webmin configuration file), a request will be output to the console
regarding the location of this file.

18 Kaspersky Anti-VirusTM for Linux Workstation
A special deb-package is included for Linux Debian distribution package.
To start the installation of Kaspersky Anti-Virus from the deb-package,
type the following in the command line:
dpkg –i <distribution_file_name>
The procedure is similar to that of the rpm-package, except that the script
/opt/kav/contrib/config.pl will be launched automatically.

CHAPTER 3.
POST-INSTALLATION
SETTINGS
During installation, the system on to which you install Kaspersky Anti-Virus is
analyzed and some of its configuration parameters are set automatically. A
number of parameters of the configuration file are set by default as the most
suitable for the operation of the anti-virus program (see section 3.1 on page 19).
Before you begin using the product, we advise that you install or update
the anti-virus database if it was not done during the installation, and
scan the server’s file systems for viruses!
In addition, we recommend that you set up joint operation of Kaspersky Anti-
Virus with the Webmin package.
In this chapter, we shall describe the default setting of Kaspersky Anti-Virus and
take an in-depth look at the configuration required to use the product.
3.1. Setting up the program by
default
All the parameters of Kaspersky Anti-Virus for Unix are stored in the file
kav4unix.conf. This is the default configuration file.
You can create your own configuration files and use them for running
current tasks or as default configuration files.
Below is a detailed explanation of the parameters set in this file by default. Based
on the information provided in this chapter you will be able to find out if
Kaspersky Anti-Virus needs additional configuration (see Chapter 5 on page 37)
for maximum performance under the conditions existing in your business.
By default, Kaspersky Anti-Virus is configured in such a way that when the
kavscanner component is launched without any command line switches it will
carry out anti-virus checking of the server’s directories and file systems,
beginning with the current one.

20 Kaspersky Anti-VirusTM for Linux Workstation
If any infected, suspicious or corrupted files are found, appropriate messages will
be output to the console and the report file.
Please note that by default any infected files the anti-virus program
detects ARE NOT CLEANED!
3.2. Installing / updating anti-virus
database
We advise that you install/update the anti-virus database immediately after
installing the product on the server.
To do so, please run the kavupdater component. In the command line type:
/path/to/kavupdater
The anti-virus database will be downloaded from Kaspersky Labs’ update server
and stored in a special directory specified in the configuration file.
We advise that you update the anti-virus database DAILY, since new
viruses appear every day and it is important to maintain up-to-date
status of the product. For more information regarding database
updating refer to the sections 4.1.1 - 4.1.2 on pages 23 - 25.
3.3. Setting up joint operation with
Webmin
If you intend to configure Kaspersky Anti-Virus remotely, we advise that you set it
up for joint operation with the Webmin package.
For example, using Webmin you can limit access to the program by creating a
system of user passwords (for further details regarding setting up Webmin
please refer to the documentation supplied with it).
Hereinafter, when describing Webmin bookmarks that contain operating
parameters of Kaspersky Anti-Virus we shall provide the path to every
bookmark. The path will be given before the picture of the bookmark in
the following format:
Other (Webmin menu item)
! KAV for Unix ! window or bookmark
name
! etc.
By default, all the settings made using Webmin are stored in configuration file
kav4unix.conf.