KAPERSKY ANTI-VIRUS 5.0 - FOR SAMBA SERVERS User manual

KASPERSKY LAB
Kaspersky Anti-Virus® 5.0
for Windows Workstations
USER GUIDE

KASPERSKY ANTI-VIRUS®5.0
FOR WINDOWS WORKSTATIONS
User Guide
©Kaspersky Lab Ltd.
http://www.kaspersky.com
Revision date: March, 2005

Contents
CHAPTER 1. COMPUTER VIRUSES AND MALWARE............................................... 5
CHAPTER 2. IF YOUR COMPUTER IS INFECTED… ................................................. 7
2.1. Symptoms of infection........................................................................................... 7
2.2. What to do if you have any of these symptoms ................................................... 8
2.3. If viruses are found during a scan......................................................................... 9
2.4. If nothing helps…................................................................................................. 10
2.5. After you eradicate the infection.......................................................................... 10
CHAPTER 3. KASPERSKY ANTI-VIRUS®FOR WINDOWS WORKSTATIONS ..... 11
3.1. Product package.................................................................................................. 12
3.2. Services for registered users .............................................................................. 13
3.3. Adopted conventions........................................................................................... 13
CHAPTER 4. PROGRAM INTERFACE ....................................................................... 15
4.1. System tray icon .................................................................................................. 15
4.2. Right-click menu .................................................................................................. 15
4.3. Main program window: general structure ........................................................... 16
4.3.1. Protection tab................................................................................................ 18
4.3.2. Support tab.................................................................................................... 19
4.4. Scanning process window .................................................................................. 20
4.5. Help system ......................................................................................................... 21
CHAPTER 5. WORKING WITH THE PROGRAM....................................................... 22
5.1. Updates for the anti-virus database and application modules........................... 22
5.1.1. Choice of time for updating........................................................................... 22
5.1.2. Update procedure......................................................................................... 23
5.2. How to prevent a virus infection.......................................................................... 24
5.2.1. When do I need to scan my computer and particular objects?................... 25
5.2.2. Full scan........................................................................................................ 26
5.2.3. On-demand scans of selected files or folders ............................................. 26
5.2.4. Scan of archives ........................................................................................... 29
5.2.5. Treating suspended objects ......................................................................... 30

4 Kaspersky Anti-Virus®5.0 for Windows Workstations
5.2.6. How to scan a CD or a floppy disk............................................................... 32
5.3. Real-time protection ............................................................................................ 33
5.4. Additional features............................................................................................... 34
5.4.1. Quarantine and Backup storage .................................................................. 34
5.4.1.1. Work with Quarantine storage............................................................... 34
5.4.1.2. Work with Backup storage..................................................................... 36
5.4.2. Work with reports.......................................................................................... 37
APPENDIX A. FREQUENTLY ASKED QUESTIONS ................................................. 41
APPENDIX B. CONTACTING TECHNICAL SUPPORT SERVICE............................ 46
APPENDIX C. GLOSSARY........................................................................................... 48
APPENDIX D. KASPERSKY LAB................................................................................. 52
D.1. Other Kaspersky Lab Products .......................................................................... 53
D.2. Contact Us .......................................................................................................... 57
APPENDIX E. INDEX .................................................................................................... 58
APPENDIX F. LICENSE AGREEMENT....................................................................... 59

CHAPTER 1. COMPUTER
VIRUSES AND MALWARE
The risks of computer virus infection and data damage or theft through other
malicious software has grown as the number of computer users increases,
together with the number of opportunities for data exchange between them via e-
mail and the Internet.
It would be useful to learn about the types of malware and how they function in
order to understand the threats that they pose to your data.
The following classes of malware can be defined according to their specific
manifestations:
• Worms – malware belonging to this category copies itself to network re-
sources. The name of this class comes from the ability of worms to “crawl”
from one computer to another through networks, e-mail and other infor-
mational channels. This feature enables worms to spread extremely
quickly.
They penetrate computer memory, calculate network addresses of other
computers and send copies of themselves to those addresses. Apart from
network addresses, they frequently use the data from e-mail client ad-
dress books. Programs of this class may sometimes have work files on
system disks, but they might not use any resources on a computer at all
(except for RAM).
• Viruses – programs that infect other programs by embedding their own
code into the latter in order to gain control when infected files are
launched. This simplified definition lets us identify the main action that a
virus performs – infection. Viruses spread somewhat slower than worms.
• Trojans – programs that perform actions which the user has not author-
ized; for example, depending upon certain conditions, they may destroy
the information recorded on disks, cause the system to “hang”, steal con-
fidential data, etc. Programs belonging to this class are not viruses in the
traditional understanding of the term; Trojans cannot penetrate target
computers independently and therefore they are passed off by intruders
as “useful” software.
• Damage caused by Trojan software may exceed the losses from tradi-
tional virus attacks by tenfold, since the consequences of viruses may be
minimized using an adequate backup system.
In recent times, worms have become the most wide-spread type of malware
corrupting computer data. Then viruses and Trojans follow, judging by the

6 Kaspersky Anti-Virus®5.0 for Windows Workstations
frequency of their occurrence. Some malicious programs combine the properties
of two or even three of the classes mentioned above.
The following types of potentially dangerous software also became widely
spread:
• AdWare – software code for advertisement demonstration added into a
program without informing the users about that. As a rule, adware is built
into free software. The advertisement appears within the program inter-
face. Such programs frequently collect and transmit to their developers
some personal information about users, change various browser parame-
ters (home and search pages, security levels, etc.), generating additional
traffic, which users do not control. All of the above may cause violations of
the security policy or even direct financial losses.
• Riskware – software that does not have any harmful functions but may
be employed by intruders as an auxiliary component for malware pro-
grams because of the security breaches and errors it contains. The cate-
gory includes, for example, remote administration software, IRC clients,
FTP servers, various utilities used to terminate processes or hide their ac-
tivity.
• SpyWare – software designed for unauthorized access to user data,
tracking of actions performed on a computer, collection of information
about hard drive contents. Such tools allow an intruder to gather data or
even control a computer from outside. Spyware is usually distributed with
free software and deploy on a computer imperceptibly for its user. Spy-
ware category includes software tracking keyboard input, password crack-
ing tools, programs for collection of confidential data (e. g., credit card
numbers).
• PornWare – programs that establish charged modem connections to
various Internet sites, mostly with adult content.
• Hack Tools – software employed by intruders for their own purposes to
gain access to your computer. The category includes various illegal scan-
ners of vulnerabilities, password cracking tools, other types of software for
breaking into network resources or intrusion into an attacked system.
E-mail and the Internet act as the main sources for spreading virus infections and
malware, although infection may be caused by a floppy disk or a CD. This
situation reflects a shift of emphasis in anti-virus protection from simple regular
scanning of computers for virus presence to a more complex process of real-time
computer protection from a probable infection.

CHAPTER 2. IF YOUR
COMPUTER IS INFECTED…
Sometimes it is not always apparent, even to a knowledgeable user, that a
computer is infected with a virus or a Trojan, because these programs mask their
presence among useful files. This chapter describes in detail how to recognize
the infection, restore data after a virus attack, and prevent malicious programs
from getting onto your computer.
2.1. Symptoms of infection
There are a number of common symptoms which indicate that your computer
has been infected. If you have noticed one of the following symptoms, a virus
has probably infected your computer:
• Unexpected messages or images are suddenly displayed.
• Unusual sounds or music is played at random times.
• Your CD-ROM drawer mysteriously opens and closes.
• Programs are suddenly launched on your computer.
• If Kaspersky Anti-Hacker is installed on your computer, you receive notifi-
cations about attempts of some programs to connect to the Internet with-
out your permission.
In addition, there are other typical symptoms indicating that your computer has
been infected via e-mail:
• You receive notifications that the message you sent contained a virus but
the anti-virus program of the recipient declined your message, whereas in
reality, you did not send this message or are sure that the message was
free of viruses.
• Your contacts receive messages from your address that you did not send.
• Your mailbox contains many messages without the sender’s address and
the header.
Note that these problems are not necessarily symptoms of virus-like activities.
They can have other causes. For example, infected messages from your address
can be sent from another computer.

8 Kaspersky Anti-Virus®5.0 for Windows Workstations
You might have noticed the following indirect symptoms point to a virus infection
on your computer:
• Your computer freezes frequently or displays error messages.
• Your computer slows down when programs are launched.
• Your attempts to boot up the operating system fail.
• Files and directories suddenly go missing or their content changes.
• Your hard disk is accessed too often (the light below the power button
blinks).
• Microsoft Internet Explorer "hangs" or behaves erroneously (for example,
you cannot close a program window).
• Your computer cannot boot from the hard drive (an error message is dis-
played).
Note that 90% of such cases indicate problems with your hardware or software.
However, the remaining 10% indicate a possible infection of your computer. If
you experience any of the above symptoms, we recommend that you contact
your system administrator and conduct a comprehensive virus scan of your
computer.
2.2. What to do if you have any of
these symptoms
If you have noticed that your computer is behaving “suspiciously”:
1. Don’t panic! This golden rule prevents you from unnecessary stress
and helps you save important data stored on your computer.
2. If you cannot boot from the hard drive (your computer gives you an
error message when you are starting the system), try to start the
system in safe mode or from the Windows boot disk that you
created during installation of the operating system on your
computer.
3. Before taking any actions, back up all critical data on an external
storage device (floppy disk, CD, flash card, etc.).
4. Install Kaspersky Anti-Virus, if you have not yet installed it.

If your computer is infected… 9
5. Retrieve the latest updates for your anti-virus database. If possible,
retrieve the updates using an uninfected computer. This is quite
important, because if you are connected to the Internet, a virus can
send important information to the perpetrators or try to send itself to
everyone in your address book. Therefore, if you suspect that your
computer is infected, immediately disconnect it from the Internet.
However, if there is no other way of retrieving the updates, you can
take the risk and download updates before disconnecting.
6. Disconnect your computer from the Internet.
7. If your computer is connected to a local network, disconnect it.
8. Launch a full scan (see section 5.2.2 on p. 26).
9. Inform your system administrator about suspicious symptoms in
computer operation.
2.3. If viruses are found during a
scan
If viruses are found during a scan, Kaspersky Anti-Virus will automatically
disinfect them and recover the data on your computer according to the settings.
Note that in 99% of cases, computers suffer from e-mail worms, Trojan
programs, or viruses (see Chapter 1 on p. 5 about malicious programs). In
virtually all cases, lost data can be successfully restored.
To remove viruses and recover damaged data:
1. Do not interrupt the operation of Kaspersky Anti-Virus. During a full
scan, the program will disinfect infected files, move suspicious files
to a quarantine folder, and delete mail worms and Trojans. Before
curing upon scan completion Kaspersky Anti-Virus will display all
the suspicious files, viruses, e-mail worms, and Trojans that it has
detected. Also you can find the names of any virus resident on your
computer in the report (see section 5.4.2 on p. 37).
2. In some cases, you might need a special recovery utility to restore
corrupted data. Connect to the Internet and read the information at
the Kaspersky Lab website (www.kaspersky.com) about a virus, a
Trojan horse, or a worm that has infected your computer. Download
the special utility for data recovery if such a program exists for a
specific virus. For example, to recover data infected with the Klez
virus, download and run the clrav.com program.

10 Kaspersky Anti-Virus®5.0 for Windows Workstations
3. Read the information about your situation on the website carefully.
You will probably have to take additional measures.
4. If viruses (for example, Nimda, Klez, or Badtrans) have penetrated
your computer by exploiting Microsoft Outlook Express
vulnerabilities, they can reactivate even after Kaspersky Anti-Virus
cleans the system, for example, when you are reading previously
infected messages. Therefore, check if the protection mode that
scans e-mail database is enabled (for more information, please
contact your system administrator) and install the latest security
patches for Microsoft Outlook to ensure its safe future operation.
Unfortunately, some viruses cannot be totally removed from infected objects.
Some of them destroy information on your computer during infection.
2.4. If nothing helps…
If the symptoms described above persist even after you have scanned your
computer, hardware, and software, and have checked your hard drive using
Windows utilities, please feel free to send a letter with a full description of your
problem to the Technical Support Service of Kaspersky Lab.
If you are sure that some files are Trojan programs or are infected, send these
files to Kaspersky Lab for expert analysis.
For details of how to send messages and files to Kaspersky Lab,
see Appendix B on p. 46.
2.5. After you eradicate the infection
After you get rid of the infection, scan all disks and floppy disks that may be
infected with a virus.
Make sure that you have the latest version of Kaspersky Anti-Virus installed on
your computer and you use the latest anti-virus database and the default settings
recommended by the Kaspersky Lab experts (for more information about
Kaspersky Anti-Virus settings, please contact your system administrator).
Read carefully How to prevent a virus infection section (see section 5.2 on
p. 24) and pay attention to the main security rules that will help you to prevent
future virus infections.