KAPERSKY ANTI-VIRUS 5.0 - FOR SAMBA SERVERS Use and care manual

KASPERSKY LAB
Kaspersky Anti-Virus®5.0
for Windows File Servers
ADMINISTRATOR’S
MANUAL

KASPERSKY ANTI-VIRUS®5.0
FOR WINDOWS FILE SERVERS
Administrator’s manual
©Kaspersky Lab
http://www.kaspersky.com
Revision date: May 2006

Contents
CHAPTER 1. KASPERSKY ANTI-VIRUS FOR WINDOWS FILE SERVERS............. 6
1.1. What's new in version 5.0 ..................................................................................... 7
1.2. Hardware and software system requirements ..................................................... 8
1.3. Product package.................................................................................................... 9
1.4. Services for registered users ................................................................................ 9
1.5. Adopted conventions........................................................................................... 10
CHAPTER 2. SOFTWARE INSTALLATION AND REMOVAL ................................... 12
2.1. Software installation ............................................................................................ 13
2.2. Software removal................................................................................................. 15
2.3. Version upgrade from 4.хto 5.0.......................................................................... 15
CHAPTER 3. APPLICATION MANAGEMENT CONCEPTS ...................................... 16
3.1. Introduction to software administration ............................................................... 17
3.2. User interface concepts....................................................................................... 17
3.2.1. Main application window .............................................................................. 18
3.2.2. Console tree.................................................................................................. 18
3.2.3. Context-sensitive (Right-click) menu............................................................ 19
CHAPTER 4. DEFAULT SERVER PROTECTION...................................................... 20
4.1. Levels of anti-virus protection.............................................................................. 20
4.2. Default parameters.............................................................................................. 21
CHAPTER 5. RECOMMENDED SETUP DEPENDING UPON SERVER
CONFIGURATION..................................................................................................... 24
CHAPTER 6. LOCAL MANAGEMENT......................................................................... 25
6.1. Using the command line...................................................................................... 25
6.1.1. Scanning selected objects............................................................................ 26
6.1.2. Full scan........................................................................................................ 27
6.1.3. Launching update ......................................................................................... 28
6.1.4. Rolling back the last update ......................................................................... 29
6.1.5. Real-time protection...................................................................................... 29

4 Kaspersky Anti-Virus 5.0 for Windows File Servers
6.1.6. Application launch......................................................................................... 30
6.1.7. Application stop............................................................................................. 30
6.1.8. Task management........................................................................................ 30
6.1.9. Convert report to convenient format for reading.......................................... 32
6.1.10. Import / export of parameters..................................................................... 32
6.2. Application management using the Administration console .............................. 33
6.2.1. Task management........................................................................................ 33
6.2.1.1. Launching and stopping tasks............................................................... 34
6.2.1.2. Viewing and editing task parameters .................................................... 35
6.2.1.3. Task launch using a specified user account ......................................... 52
6.2.1.4. Task creation.......................................................................................... 53
6.2.2. Configuring application parameters ............................................................. 57
6.2.2.1. General information about the application ............................................ 58
6.2.2.2. Configuring additional application settings............................................ 59
6.2.2.3. Setting up riskware detection parameters............................................. 61
6.2.2.4. Monitoring the activity of software processes ....................................... 63
6.2.2.5. Configuring Quarantine and Backup settings ....................................... 65
6.2.2.6. Working with Quarantine and Backup .................................................. 66
6.2.2.7. Viewing license key information ............................................................ 68
6.2.2.8. Configuring report generation settings .................................................. 69
CHAPTER 7. REMOTE MANAGEMENT..................................................................... 73
7.1. Policy management............................................................................................. 73
7.1.1. Creating a policy ........................................................................................... 73
7.1.2. Viewing and editing policy settings .............................................................. 76
7.2. Task management .............................................................................................. 77
7.2.1. Creating a task.............................................................................................. 77
7.2.1.1. Creating a local task .............................................................................. 78
7.2.1.2. Creating a group task ............................................................................ 79
7.2.1.3. Creating a global task ............................................................................ 80
7.2.2. Viewing and editing task settings ................................................................. 80
7.3. Configuring application parameters .................................................................... 81
CHAPTER 8. TESTING THE KASPERSKY ANTI-VIRUS OPERATION................... 83
8.1. EICAR test "virus" and its modifications ............................................................. 83
8.2. Testing correct operation of Kaspersky Anti-Virus ............................................. 85

General information about the product 5
CHAPTER 9. ANTI-VIRUS PROTECTION AND SERVER MAINTENANCE ............ 86
CHAPTER 10. FREQUENTLY ASKED QUESTIONS................................................. 87
APPENDIX A. GLOSSARY........................................................................................... 95
APPENDIX B. COMMAND LINE RETURN CODES ................................................. 101
A.1. General return codes ........................................................................................ 101
A.2. Return codes for on-demand scan................................................................... 101
A.3. Update service return codes............................................................................. 102
A.4. Licensing service return codes......................................................................... 103
APPENDIX C. KASPERSKY LAB............................................................................... 104
C.1. Other Kaspersky Lab Products ........................................................................ 105
C.2. Contact Us ........................................................................................................ 113
APPENDIX D. LICENSE AGREEMENT .................................................................... 114

CHAPTER 1. KASPERSKY ANTI-
VIRUS FOR WINDOWS FILE
SERVERS
Kaspersky Anti-Virus®for Windows File Servers (hereinafter also referred to
as Kaspersky Anti-Virus or the application) is designed to protect file servers
from viruses and malware.
The following features are implemented in the application:
• Real-time protection of file system from malicious code in monitoring
mode: interception and analysis of calls to the computer's file system,
disinfection, removal of infected objects or isolation of suspicious objects
for further analysis.
• Scanning and neutralization of malicious code at the administrator’s
request: search for infected or suspicious objects in defined scanning
areas and their analysis; disinfection, removal or isolation of objects for
further analysis.
• Constant scanning of dangerous VBScript and JavaScript scripts:
scanning of script code prior to its execution by the OS script processing
engine; blocking execution of dangerous scripts.
• Scanning of riskware: analysis of programs launched on a computer or
downloaded from the Internet and executables on hard drives or
removable media. Upon detection of a potentially dangerous program the
application (depending upon the selected parameters) allows or blocks
the execution thereof or deletes the program,
• Quarantine of suspicious objects: storage of suspicious objects in a
quarantine directory; an opportunity to send them to Kaspersky Lab for
further research; restoration of objects from the quarantine at
administrator's request.
• Creation of backup copies for infected objects prior to disinfection or
removal in order to allow on-demand restoration of objects containing
valuable data or if necessary for further investigation.
• Updating of the anti-virus database and application modules included in
the Anti-Virus package from the updates’ servers of Kaspersky Lab;
creation of backup copies for all files being updated so that the last
update can be rolled back; copying of received updates to a local source
for further sharing with other network computers saving Internet traffic.

General information about the product 7
Please keep in mind that new viruses emerge every day,
therefore you are advised to set up automatic product updates
to keep the product up-to-date.
• Local administration of the application through the command line or via
Administration console, and centralized control through Kaspersky
Administration Kit.
1.1. What's new in version 5.0
The following changes have been implemented in Kaspersky Anti-Virus 5.0 for
Windows File Servers compared to 4.хversions:
• The new anti-virus core uses considerably less memory compared to
version 4.0.
• Use of iChecker™and iStreams™technologies allows an increase of the
anti-virus protection performance over version 4.0.
• The speed of anti-virus database updating has been increased through
automatic detection of the least busy updates’ server of Kaspersky Lab;
an algorithm for downloading just the remaining update part in case of
disconnection has been added; received updates can now be copied to a
local source for further sharing.
• The anti-virus parameters can be adjusted through selection of one of
three preset protection levels with specific settings defined by Kaspersky
Lab: maximum protection, recommended and high speed.
• An opportunity for scanning and processing of riskware in the real-time
protection and on-demand scanning modes has been added,
• The ability to disinfect files in ZIP, ARJ, CAB, and RAR archives has been
added.
• The Control Centre component has been replaced with a more
convenient and simple administrator interface, enabling flexible
management of the application parameters.
• It is possible now to perform simultaneous remote application deployment
to several file servers through Kaspersky Administration Kit 5.0.
• Quarantine operations have been enhanced: now it is possible to restrict
the storage duration for suspicious objects in quarantine.
• Backup storage for original objects has been created in order to preserve
backup copies of suspicious or infected objects created prior to their
disinfection or removal.

8 Kaspersky Anti-Virus 5.0 for Windows File Servers
• The event report functionality has been extended, enabling logged events
to trigger corresponding actions, for example: saving to Windows Event
Log, E-mail notification, notification using NET SEND or run an operating
system command.
• It is possible now to build a list of trusted software processes, which
Kaspersky Anti-Virus does not have to control in real time.
• An opportunity to download all or selected updates has been added: for
all products of Kaspersky Lab or only for Kaspersky Anti-Virus 5.0 for
Windows Workstations and Kaspersky Anti-Virus 5.0 for Windows File
Servers.
1.2. Hardware and software system
requirements
Optimal operation of the application requires the following minimum server
specification:
• Microsoft Windows NT 4.0 Server with installed Service Pack 6a or later:
• Intel Pentium or higher CPU;
• 32 MB of free RAM;
• 30 MB of available disk space.
• Microsoft Windows 2000 Server/Advanced Server with installed Service
Pack 2 or later:
• Intel Pentium or higher CPU;
• 64 MB of free RAM;
• 30 MB of available disk space.
• Microsoft Windows 2003 Server:
• Intel Pentium or higher CPU;
• 128 MB of free RAM;
• 30 MB of available disk space.
The 64-bit version of Microsoft Windows 2003
Server for IA-64 platform is not supported.

General information about the product 9
1.3. Product package
You can purchase the software from our distributors (retail box), or from one of
our web shops (for example, www.kaspersky.com, E-Store section).
If you purchase a box product, the software bundle includes:
• sealed envelope with an installation CD containing software files;
• user's manual;
• license key file included in the program distribution package or stored on
the floppy disk;
• license agreement.
Please read the license agreement carefully before opening the CD
envelope.
If you purchase our product from a web shop, you will copy it from the Kaspersky
Lab's website; the copy also contains this manual. Your license key is either
included in the installation file or sent to you by e-mail after payment.
The license agreement constitutes a legal agreement between you and
Kaspersky Lab containing the terms and conditions under which you may use the
purchased software.
Please read the license agreement carefully!
If you do not agree with the terms of the license agreement you must return the
box containing Kaspersky Anti-Virus to the distributor where you purchased it;
you will be refunded the amount you've paid for subscription, provided the CD
envelope remains sealed.
Opening the sealed envelope of the installation CD or installing the product to a
computer confirms your acceptance of all the terms and conditions of the license
agreement.
1.4. Services for registered users
Kaspersky Lab offers its legal users a broad range of services maximizing the
efficiency of Kaspersky Anti-Virus use.
By purchasing a subscription you become a registered software user entitled to
the following services throughout the license period:

10 Kaspersky Anti-Virus 5.0 for Windows File Servers
• software upgrades;
• consultations regarding issues pertaining to installation, configuration and
use of this software, available over the telephone or via e-mail;
• notifications about new software products from the Kaspersky Lab, and
new viruses outbreaks. This service is provided to users who have
subscribed to the Kaspersky Lab e-mail newsletter service.
No consulting is offered for issues pertaining to operating systems'
functioning or use, or to the use of non-Kaspersky technologies.
1.5. Adopted conventions
The text in this document uses various styles depending upon its purpose. The
table below lists adopted conventions used in the text.
Style Purpose
Bold type
Used to indicate menu titles, menu
items, window titles, parts of dialog
boxes, and other graphical interface
items.
Note.
Additional information, notes.
Attention!
Information requiring special attention.
In order to perform the
action,
1. Step 1.
2. …
Procedure description for user's steps
and possible actions.
Task, example
Statement of a problem, example for
using the software features.
Solution
Solution to a defined problem.

General information about the product 11
Style Purpose
[key] – key purpose. Command line keys.
Text of information
messages and the command
line
Text of configuration files, information
messages and the command line.

CHAPTER 2. SOFTWARE
INSTALLATION AND
REMOVAL
There are two main choices for the installation of Kaspersky Anti-Virus: local
installation, and remote installation, through a centralized administration
computer using Kaspersky Administration Kit 5.0. This manual describes the
local installation of Kaspersky Anti-Virus. For details regarding remote
product installation please consult the administrator’s guide for Kaspersky
Administration Kit 5.0.
Further installation choices must be made depending upon the intended use of
the application:
• Command line management: install Kaspersky Anti-Virus to a server
computer. In this case the product does not offer a graphical user
interface, and the application is managed from the command line using
the kavshell.exe utility.
• Management through Administration console:install Kaspersky Anti-
Virus on the server, together with Administration Agent and Administration
console which are included in the Kaspersky Administration Kit package.
In this case the application is managed locally through Administration
console.
If you are planning to control the Anti-Virus later remotely via
Kaspersky Administration Kit 5.0, then ensure during
installation of Administration Agent that the Administration
Server address (name and port) has been specified correctly.
• Centralized management using Kaspersky Administration Kit:
• Deploy Administration Server on your LAN, and install
Administration Console to the administrator’s workplace (please
see details in the Administrator's guide for Kaspersky
Administration Kit 5.0).
• Install Kaspersky Anti-Virus and Administration Agent on the
server computer.

Software installation and removal 13
2.1. Software installation
In order to install the application run the setup executable file included in the
distribution package. The installation runs in interactive mode. Each window
contains certain buttons controlling the installation process. There are four main
buttons:
• OK – accept the suggested actions;
• Cancel – cancel the suggested actions;
• Next – moves one step further;
• Back – returns one step back.
Step 1. Reading the license agreement
The License Agreement dialog box contains the text of the license agreement.
Please read it. Click Yes if you agree with the terms. In order to reject installation
of the software, click No.
Step 2. Entering user information
Enter the required information in the Customer Information dialog box. Enter
the user name in the User Name field, and the organization in the Company
Name field. By default this information is taken from the Microsoft Windows
registry.
Step 3. Selection of the target directory
The target directory for installation of Kaspersky Anti-Virus is defined in the
Choose Destination Location dialog box. By default it will be Program
Files\Kaspersky Lab\Kaspersky Anti-Virus for File Servers 5.
You can change the target directory using the Browse… button.
Step 4. Read important information about the program
You will have to read important information in this window before you actually
start using the program. The window described the main features of Kaspersky
Anti-Virus, peculiarities of its operation, etc.
When you have read the information, click Next.

14 Kaspersky Anti-Virus 5.0 for Windows File Servers
Step 5. License key installation
In the License key dialog box you should specify the license key, which
Kaspersky Anti-Virus will use for checking the presence of a license agreement
and its validity.
The license key is your personal "key" containing service information
required to unlock complete software functionality and some additional
information, namely:
• support information (support provider and its contact
information);
• license title, number and its expiry date.
The License key window may have a different look depending on key
availability; the key may be bundled with the installation package or you may
have to load it from the Internet.
The installer will add the license key file automatically, if it can be found on the
installation disk or in the target directory specified for installation. Information
about the key being installed will appear on the screen during the procedure.
If the installer cannot locate the license key file, you will be offered this choice of
license file locations:
Local license key – to install a key located on the computer.
Internet license key – to obtain the key via Internet from the Kaspersky
Lab's website.
Selection of the first option opens a window where you should locate your license
key file with the .key extension using the Browse… button.
Selection of the Internet license key option opens a dialog box where you
should fill in the information fields and enter your key activation code (provided at
the time of product purchase). When you have entered the information, click
Next.
Step 6. Completion of the installation procedure
The Setup Wizard Complete window displays information about the completion
of Kaspersky Anti-Virus setup on your computer.
As a rule, setup completion does not require restarting the computer. If you do
not wish to enable anti-virus computer protection immediately after product
installation then you should disable the checkbox Launch Kaspersky Anti-Virus
5.0 for Windows File Servers. Click the Finish button.

Software installation and removal 15
If you disable that checkbox, anti-virus protection will be automatically
activated only after the restart of your computer.
2.2. Software removal
If for some reason you need to remove Kaspersky Anti-Virus, run
Start!Programs!Kaspersky Anti-Virus 5.0 for Windows File
Servers!Remove Kaspersky Anti-Virus or use the standard Microsoft
Windows Add or Remove Programs Control Panel applet.
You will be prompted to confirm application removal. Click OK in order to begin
the uninstall procedure. When removal of the application is completed, you will
be prompted to restart your computer. Postpone the restart if necessary and click
the Finish button to close the wizard.
2.3. Version upgrade from 4.хto 5.0
You are advised to process objects preserved in quarantine or backup
storage prior to launching the Kaspersky Anti-Virus upgrade procedure.
In order to upgrade version 4.x of Kaspersky Anti-Virus for Windows File Servers
to version 5.0 run the application setup executable file. During the setup
procedure the installer will remove the previous version.
After the upgrade completes, you will have to restart the operating system.
In case of remote software deployment performed using Kaspersky
Administration Kit (see details in the Administrator's guide for Kaspersky
Administration Kit 5.0) the application upgrade from version 4.x to 5.0 will be
automatic. The earlier version of the Anti-Virus will be removed at that and the
remote computer will be restarted.
Please note that the Anti-Virus parameters will not be preserved during
an upgrade from version 4.x. You can use the default parameters or
customize the application settings again.

CHAPTER 3. APPLICATION
MANAGEMENT CONCEPTS
Kaspersky Anti-Virus is installed on servers and can either be controlled locally,
or remotely through Kaspersky Administration Kit if the computer is included in a
centralized control system.
The application recognizes two categories of users:
• Anti-virus security administrator (hereinafter referred to as
administrator) performs local control of the application.
• Logical network administrator controls Anti-Virus operation via Kaspersky
Administration Kit's centralized remote control system.
Local computer administrators by default also become anti-virus security
administrators.
If the application is locally managed, the application is installed on a server and
controlled either using the command line or through the Administration console.
In this case the administrator can perform the following tasks:
• configure the application parameters;
• set up and launch anti-virus tasks;
• update anti-virus database and application modules;
• install license keys;
• view contents of quarantine and backup storage;
• view reports about application activity.
In the case of centralized control via Kaspersky Administration Kit, the
application is controlled remotely from a computer with Administration console
installed, provided that the network includes an Administration server. The logical
network administrator can perform the following functions, in addition to the
above-listed tasks:
• remote installation of the application on client computers;
• remote configuration of Kaspersky Anti-Virus;
• installation of license keys to client computers and their removal;
• viewing information about application operations on client computers.

Application management concept 17
Please see details of centralized management concepts in the Administrator's
guide for Kaspersky Administration Kit 5.0.
3.1. Introduction to software
administration
If Kaspersky Anti-Virus is locally controlled, computer protection is based on the
application and task parameters defined by the administrator.
Atask is a named action performed by the application. The tasks are subdivided
in accordance with their purpose, for instance: full system scanning task, the task
for updating anti-virus database and application modules. Each task has a set of
parameters specified to control its execution, which are referred to as the task
parameters.
Application parameters represent a set of supplementary parameters defined
for the operation of Kaspersky Anti-Virus including quarantine, backup, reporting
service options.
Centralized control allows the administrator to create logical groups of
computers, and manage them creating and defining group policies.
Apolicy is a set of application parameters used within a logical network group,
as well as a set of restrictions on how far those parameters may be redefined
during application or task setup on individual client computers.
A policy contains complete configuration of all the application features. Thus, it
includes both application parameters and parameters for all task types, except
for certain parameters specific for an individual task type.
3.2. User interface concepts
A graphical user interface for program administration is provided by the
Administration console component included in Kaspersky Administration Kit 5.0.
It is a specialized independent snap-in for Microsoft Management Console
(MMC).
In this section we shall discuss the interface's most important elements: the main
window, console tree and right-click context menu.
To disable modification of policy parameters, "lock" them: .
Parameters which may be modified are marked with .

18 Kaspersky Anti-Virus 5.0 for Windows File Servers
3.2.1. Main application window
The main window of the application (see Figure 1) contains:
• The menu – it contains the main features used to manage files and dialog
boxes and provides access to Help topics.
• The toolbar – its buttons provide quick access to frequently used menu
options.
• The view pane, which displays the list of anti-virus system objects as a
console tree.
• The results pane, which shows a list of elements for the object selected
in the console tree.
Figure 1. Administration Console
3.2.2. Console tree
The console tree represents the logical networks existing in the corporate LAN,
as well as the properties of the local computer where the Administration console
is installed.
The Kaspersky Administration Kit namespace may include several nodes
representing Administration servers deployed within your LAN and the Local
computer object.
The Local computer object is designed for the local management of Kaspersky
Anti-Virus 5.0 for Windows File Servers. The context-sensitive (right-click) menu

Application management concept 19
allows to you to open the application parameters dialog box, which also allows
you to manage the tasks on the selected computer.
If an Administration server is present on the LAN you can control Kaspersky Anti-
Virus on remote servers. When a connection to an Administration server is
established the <Server name> node will display a list of folders (please see
details in the Administrator's guide for Kaspersky Administration Kit 5.0).
Selecting a folder in the console tree displays its contents in the results pane.
Objects within the folders can be managed using the context-sensitive menu.
The Policies and Tasks folders in the Groups folder are intended for the
management of group policies (see Chapter 6 on p. 25) and tasks (see section
7.2 on p. 77). You can modify the application (see section 7.3 on p. 81) and local
task parameters (see section 7.2 on p. 77) for all remote computers on which
Kaspersky Anti-Virus is installed, provided that they are included in the Groups
folder.
3.2.3. Context-sensitive (Right-click) menu
Every type of object in the Kaspersky Administration Kit namespace of the
console tree has a context-sensitive (right-click) menu, which enable both the
standard MMC right-click commands, and specific options for treating objects.
In the results pane, each element of an item selected in the console tree also has
a context-sensitive menu, containing actions that can be performed on the
element.

CHAPTER 4. DEFAULT SERVER
PROTECTION
Anti-virus protection will be enabled immediately after application setup on a
computer using the default parameters recommended by experts at Kaspersky
lab for optimal protection of your computer.
Besides, the application provides an opportunity for quick modification of its
parameters by selecting any of three predefined protection levels specified by
Kaspersky Lab experts: maximum protection, recommended or high speed.
4.1. Levels of anti-virus protection
The anti-virus protection can be conveniently adjusted through selection of one
of three preset protection levels using predefined parameters (see Table 1):
• Maximum protection – provides maximum possible protection, at the
expense of a certain performance decrease.
• Recommended – the default level of anti-virus protection with
parameters recommended by Kaspersky Lab, which ensures the optimal
balance between performance and protection.
• High speed – provides top system performance at the expense of a
somewhat lower protection.
If you modify any of the predefined level settings the level of anti-virus protection
will change to Customized. It is the fourth anti-virus protection level using
custom user settings.
The table below contains the parameters of real-time protection tasks
(protection) and on-demand scanning tasks (scanning) for the predefined
security levels.
Legend:
+enabled setting;
– disabled setting;
xthe setting is not applicable for the task.