KAPERSKY ANTI-VIRUS 5.0 - FOR SAMBA SERVERS Service manual

KASPERSKY LABS
Kaspersky Anti-Virus 5.0
for Linux Workstation
ADMINISTRATOR’S GUIDE

KASPERSKY ANTI-VIRUS 5.0 FOR LINUX WORKSTATION
Administrator's
guide
Kaspersky Labs, Ltd.
http://www.kaspersky.com
Revision date: November 2003

Contents
CHAPTER 1. KASPERSKY ANTI-VIRUSTM FOR LINUX WORKSTATION ................ 6
1.1. What’s new in version 5.0 ..................................................................................... 6
1.2. Licensing policy ..................................................................................................... 8
1.3. Hardware and software requirements .................................................................. 8
1.4. Distribution kit ........................................................................................................ 8
1.5. Help desk for registered users .............................................................................. 9
1.6. Conventions........................................................................................................... 9
CHAPTER 2. INSTALLING KASPERSKY ANTI-VIRUS ............................................. 11
2.1. Universal installation............................................................................................ 11
2.1.1. Starting the installation procedure................................................................ 12
2.1.2. Previous version search ............................................................................... 12
2.1.2.1. Creating a backup copy of the previous distribution package.............. 13
2.1.2.2. Updating to version 5.0.......................................................................... 14
2.1.2.3. Installing alongside an earlier version ................................................... 14
2.1.3. Copying the distribution files......................................................................... 15
2.1.4. License key installation................................................................................. 15
2.1.5. Completing the installation ........................................................................... 16
2.1.6. Installation report........................................................................................... 16
2.2. Installing the program on a server running Linux ............................................... 17
CHAPTER 3. POST-INSTALLATION SETTINGS ....................................................... 19
3.1. Setting up the program by default....................................................................... 19
3.2. Installing / updating anti-virus database.............................................................. 20
3.3. Setting up joint operation with Webmin .............................................................. 20
CHAPTER 4. WORKING WITH KASPERSKY ANTI-VIRUS...................................... 22
4.1. Anti-virus database updating............................................................................... 22
4.1.1. Scheduling anti-virus database updating using cron................................... 23
4.1.2. One-time update of the anti-virus database................................................. 25
4.2. Antiviral protection of file systems....................................................................... 26
4.2.1. Launching directory scan from the command line....................................... 27
4.2.2. Scheduled daily directory scan .................................................................... 28
4.2.3. Moving objects to a separate directory (quarantine) ................................... 28

4 Kaspersky Anti-VirusTM for Linux Workstation
4.2.4. Advanced options: using script files............................................................. 30
4.2.4.1. Cleaning infected objects in archives.................................................... 30
4.2.4.2. Sending notifications to the administrator ............................................. 32
4.3. License key management................................................................................... 33
4.3.1. Viewing the license key information............................................................. 34
4.3.2. Renewing the license ................................................................................... 35
CHAPTER 5. ADVANCED SETTINGS ........................................................................ 37
5.1. Setting antiviral protection of the server’s file systems....................................... 37
5.1.1. Scan area...................................................................................................... 37
5.1.2. File check and disinfection mode................................................................. 38
5.1.3. Actions taken with the files ........................................................................... 39
5.2. Setting up file scanning parameters for the aveserver and aveclient
components........................................................................................................ 40
5.2.1. Operation mechanism of aveserver and aveclient ...................................... 41
5.2.2. Command line syntax for the aveclient client component........................... 41
5.2.3. Additional opportunities for integration with third party software................. 43
5.3. Localization of the format of time and date display ............................................ 43
5.4. Parameters of Kaspersky Anti-Virus report generation...................................... 44
5.4.1. Format of scanning messages output by kavscanner................................. 46
5.4.2. Format of other messages output by kavscanner ....................................... 47
5.4.3. Format of kavscanner console messages................................................... 48
CHAPTER 6. QUESTIONS AND ANSWERS.............................................................. 50
CHAPTER 7. UNINSTALLING KASPERSKY ANTI-VIRUS........................................ 54
APPENDIX A. SUPPLEMENTARY INFORMATION ABOUT THE PRODUCT......... 55
A.1. Location of the product files in the directories.................................................... 55
A.2. Kaspersky Anti-Virus configuration file............................................................... 56
A.3. Command line keys for the kavscanner component ......................................... 61
A.4. The kavscanner component return codes ......................................................... 64
A.5. Command line keys for the licenseviewer component ...................................... 65
A.6. Command line keys for the kavupdater component.......................................... 65
A.7. The kavupdater component return codes .......................................................... 66
A.8. Command line keys for the aveclient component.............................................. 67
A.9. The aveclient component return codes.............................................................. 67
A.10. A sample script file (vox.sh) for disinfecting tar- and zip-archives................... 68

Contents 5
APPENDIX B. MALICIOUS PROGRAMS IN THE UNIX ENVIRONMENT................ 71
B.1. Viruses................................................................................................................. 71
B.2. Trojan horses ...................................................................................................... 72
B.3. Internet worms..................................................................................................... 73
APPENDIX C. KASPERSKY LABS LTD...................................................................... 76
C.1. Other Kaspersky Labs Products ....................................................................... 77
C.2. Contact Information............................................................................................. 80
APPENDIX D. INDEX .................................................................................................... 81

CHAPTER 1. KASPERSKY ANTI-
VIRUSTM FOR LINUX
WORKSTATION
Kaspersky Anti-VirusTM for Linux Workstation (hereinafter also referred to as
Kaspersky Anti-Virus for Linux) is designed for anti-virus file scanning in file
systems of servers running under the Linux operating system.
This software product allows the user to:
• Check for viruses in all mounted file systems.
• Detect infected, suspicious, corrupted, and password-protected files, as
well as files that fail to be scanned because of an error.
• Carry out anti-virus processing (disinfect) infected objects in file systems.
• Move to the quarantine directory all infected, suspicious, and corrupted
objects of the server file system. For the latter, disinfected and password-
protected files can also be quarantined, as well as files that fail to be
scanned because of an error.
• Update the program’s anti-virus database. Anti-virus database updates
are downloaded from Kaspersky Labs’ update servers.
The anti-virus database is used when searching for and cleaning infected
objects. Based on its contents, during the scan, each file is analyzed for
the presence of viruses and the file’s code is compared to codes specific
to particular viruses. If the file is infected, the program disinfects it.
It should be kept in mind that new viruses appear daily, therefore
we recommend updating the anti-virus database every day in
order to maintain the product in up-to-date condition.
• Configure Kaspersky Anti-Virus via the web-interface provided by the
Webmin program and the product configuration file.
1.1. What’s new in version 5.0
Version 5.0 of Kaspersky Anti-Virus has the following changes compared to
version 4.0:

Kaspersky Anti-VirusTM for Linux Workstation 7
• All the product components have been transferred to the new antiviral
engine, which reduces the load on workstations and servers but provides
the same functionality.
• A number of drawbacks in Kaspersky Anti-Virus for Unix v. 4.0 related to
its architectural features have been corrected. Several security-related
bugs have been fixed, therefore an upgrade to version 5.0 is
recommended for users of version 4.0.
• The web-configuration component, WebTuner, has been replaced by a
plug-in from the commonly used program Webmin. This has extended the
functionality of the product.
• Configuration files of all components have been united into one file
kav4unix.conf, thus making it simpler to manage the product. In this
connection, the configuration of the entire product has been transferred
from a binary to a text framework.
• The possibility has been added to configure formats of time and date
representation in the program components’ operation reports and
notifications.
• It is now possible to use script files for processing of objects with different
statuses (infected, corrupted etc.)
• An option has been added of automatic restarting of the program’s
resident components after successful update of the anti-virus database.
• The product is distributed in the form of standard installation packages for
the supported operating systems (rpm, deb).
• The product licensing policy has been changed:
• After the license expires, Kaspersky Anti-Virus remains
functional except for the anti-virus database updating feature.
• Kaspersky Anti-Virus does not work without a license key.
• The component kavucc (Control Centre) has been excluded due to
simplification of the product architecture.
• The components kavinspector (Inspector), kavtuner (Tuner), kavdaemon
(Daemon) and kavmonitor (Monitor) have been excluded from the
product.
• The executable file of the kavdaemon component has been renamed to
aveserver and updated.
• The product has been supplemented with the aveserver component
including the aveclient client software, which allows the creation of
custom solutions (e.g. for integration with third party software, network

8 Kaspersky Anti-VirusTM for Linux Workstation
traffic protection, etc. Please read relevant details in para. 5.2.3 on p.
43).
1.2. Licensing policy
Kaspersky Anti-Virus licensing policy includes a system of product use limitations
based on product use duration (usually limited to one year from the date of
purchase).
1.3. Hardware and software
requirements
In order to function properly, Kaspersky Anti-Virus needs a system complying
with the following requirements:
• Hardware requirements:
• Intel Pentium-class processor
• 32 Mb of RAM or more
• 100 Mb or more of hard disk space
• Software requirements:
• One of the following operating systems:
Linux RedHat (version 7.3, 8.0 or 9.0), Linux SuSE (version 8.1
or 8.2) or Linux Debian (version 3.0)
• The Wget program (http://gnu.org/software/wget/wget.html) for
anti-virus database updating using kavupdater.
• The Webmin program (www.webmin.com) for Kaspersky Anti-
Virus remote administration.
• Perl version 5.0 or higher (www.perl.org) for Kaspersky Anti-
Virus installation using install.pl.
1.4. Distribution kit
You can purchase Kaspersky Anti-Virus either from our distributors (retail box) or
in our Internet-shop (www.kaspersky.com, Buy online section).
When purchasing a retail box you will receive the following distribution kit:

Kaspersky Anti-VirusTM for Linux Workstation 9
• A sealed envelope with an installation CD (or a set of floppy disks)
containing software product files.
• Administrator’s guide.
• License key.
• Registration card (with printed serial number of the product).
• License agreement.
Before you unseal the envelope containing the CD (or floppy disks), be sure to
thoroughly review the license agreement.
When purchasing Kaspersky Anti-Virus in the Web-shop you download the
product from Kaspersky Labs’ website. The distribution file contains the product
and the license key.
1.5. Help desk for registered users
Kaspersky Labs offers a large service package enabling legal users to efficiently
employ Kaspersky Anti-Virus.
If you register and purchase a subscription you will be provided with the following
services for the period of your subscription:
• daily virus-definition database updates via e-mail
• product upgrades
• phone and e-mail advice on matters related to your software installation,
configuration and performance
• information about new Kaspersky Labs products and new computer
viruses (for those who subscribe to our newsletter).
Kaspersky Labs does not give advice on the performance and use of
your operating system or other technologies.
1.6. Conventions
In this book we use various conventions to emphasize different meaningful parts
of the documentation.

10 Kaspersky Anti-VirusTM for Linux Workstation
Convention Meaning
Bold font Menu titles, commands, window titles,
dialog elements, etc.
Note.
Additional information, notes
Attention!
Very important information
To do this,
1. Step 1.
2. …
Actions that must be taken
Task
Example of a user defined task to be
accomplished using this program.
Solution
Solution of the task.
[switch] – function of the switch. Command line switches
Info message text Text of the configuration files and
information messages of the program.