KAPERSKY ANTI-VIRUS 5.0 - FOR SAMBA SERVERS User manual

KASPERSKY LAB
Kaspersky Anti-Virus® 5.0
for Windows Workstations
USER GUIDE

KASPERSKY ANTI-VIRUS®5.0
FOR WINDOWS WORKSTATIONS
User Guide
©Kaspersky Lab Ltd.
http://www.kaspersky.com
Revision date: March, 2005

Contents
CHAPTER 1. COMPUTER VIRUSES AND MALWARE............................................... 5
CHAPTER 2. IF YOUR COMPUTER IS INFECTED… ................................................. 7
2.1. Symptoms of infection........................................................................................... 7
2.2. What to do if you have any of these symptoms ................................................... 8
2.3. If viruses are found during a scan......................................................................... 9
2.4. If nothing helps…................................................................................................. 10
2.5. After you eradicate the infection.......................................................................... 10
CHAPTER 3. KASPERSKY ANTI-VIRUS®FOR WINDOWS WORKSTATIONS ..... 11
3.1. Product package.................................................................................................. 12
3.2. Services for registered users .............................................................................. 13
3.3. Adopted conventions........................................................................................... 13
CHAPTER 4. PROGRAM INTERFACE ....................................................................... 15
4.1. System tray icon .................................................................................................. 15
4.2. Right-click menu .................................................................................................. 15
4.3. Main program window: general structure ........................................................... 16
4.3.1. Protection tab................................................................................................ 18
4.3.2. Support tab.................................................................................................... 19
4.4. Scanning process window .................................................................................. 20
4.5. Help system ......................................................................................................... 21
CHAPTER 5. WORKING WITH THE PROGRAM....................................................... 22
5.1. Updates for the anti-virus database and application modules........................... 22
5.1.1. Choice of time for updating........................................................................... 22
5.1.2. Update procedure......................................................................................... 23
5.2. How to prevent a virus infection.......................................................................... 24
5.2.1. When do I need to scan my computer and particular objects?................... 25
5.2.2. Full scan........................................................................................................ 26
5.2.3. On-demand scans of selected files or folders ............................................. 26
5.2.4. Scan of archives ........................................................................................... 29
5.2.5. Treating suspended objects ......................................................................... 30

4 Kaspersky Anti-Virus®5.0 for Windows Workstations
5.2.6. How to scan a CD or a floppy disk............................................................... 32
5.3. Real-time protection ............................................................................................ 33
5.4. Additional features............................................................................................... 34
5.4.1. Quarantine and Backup storage .................................................................. 34
5.4.1.1. Work with Quarantine storage............................................................... 34
5.4.1.2. Work with Backup storage..................................................................... 36
5.4.2. Work with reports.......................................................................................... 37
APPENDIX A. FREQUENTLY ASKED QUESTIONS ................................................. 41
APPENDIX B. CONTACTING TECHNICAL SUPPORT SERVICE............................ 46
APPENDIX C. GLOSSARY........................................................................................... 48
APPENDIX D. KASPERSKY LAB................................................................................. 52
D.1. Other Kaspersky Lab Products .......................................................................... 53
D.2. Contact Us .......................................................................................................... 57
APPENDIX E. INDEX .................................................................................................... 58
APPENDIX F. LICENSE AGREEMENT....................................................................... 59

CHAPTER 1. COMPUTER
VIRUSES AND MALWARE
The risks of computer virus infection and data damage or theft through other
malicious software has grown as the number of computer users increases,
together with the number of opportunities for data exchange between them via e-
mail and the Internet.
It would be useful to learn about the types of malware and how they function in
order to understand the threats that they pose to your data.
The following classes of malware can be defined according to their specific
manifestations:
• Worms – malware belonging to this category copies itself to network re-
sources. The name of this class comes from the ability of worms to “crawl”
from one computer to another through networks, e-mail and other infor-
mational channels. This feature enables worms to spread extremely
quickly.
They penetrate computer memory, calculate network addresses of other
computers and send copies of themselves to those addresses. Apart from
network addresses, they frequently use the data from e-mail client ad-
dress books. Programs of this class may sometimes have work files on
system disks, but they might not use any resources on a computer at all
(except for RAM).
• Viruses – programs that infect other programs by embedding their own
code into the latter in order to gain control when infected files are
launched. This simplified definition lets us identify the main action that a
virus performs – infection. Viruses spread somewhat slower than worms.
• Trojans – programs that perform actions which the user has not author-
ized; for example, depending upon certain conditions, they may destroy
the information recorded on disks, cause the system to “hang”, steal con-
fidential data, etc. Programs belonging to this class are not viruses in the
traditional understanding of the term; Trojans cannot penetrate target
computers independently and therefore they are passed off by intruders
as “useful” software.
• Damage caused by Trojan software may exceed the losses from tradi-
tional virus attacks by tenfold, since the consequences of viruses may be
minimized using an adequate backup system.
In recent times, worms have become the most wide-spread type of malware
corrupting computer data. Then viruses and Trojans follow, judging by the

6 Kaspersky Anti-Virus®5.0 for Windows Workstations
frequency of their occurrence. Some malicious programs combine the properties
of two or even three of the classes mentioned above.
The following types of potentially dangerous software also became widely
spread:
• AdWare – software code for advertisement demonstration added into a
program without informing the users about that. As a rule, adware is built
into free software. The advertisement appears within the program inter-
face. Such programs frequently collect and transmit to their developers
some personal information about users, change various browser parame-
ters (home and search pages, security levels, etc.), generating additional
traffic, which users do not control. All of the above may cause violations of
the security policy or even direct financial losses.
• Riskware – software that does not have any harmful functions but may
be employed by intruders as an auxiliary component for malware pro-
grams because of the security breaches and errors it contains. The cate-
gory includes, for example, remote administration software, IRC clients,
FTP servers, various utilities used to terminate processes or hide their ac-
tivity.
• SpyWare – software designed for unauthorized access to user data,
tracking of actions performed on a computer, collection of information
about hard drive contents. Such tools allow an intruder to gather data or
even control a computer from outside. Spyware is usually distributed with
free software and deploy on a computer imperceptibly for its user. Spy-
ware category includes software tracking keyboard input, password crack-
ing tools, programs for collection of confidential data (e. g., credit card
numbers).
• PornWare – programs that establish charged modem connections to
various Internet sites, mostly with adult content.
• Hack Tools – software employed by intruders for their own purposes to
gain access to your computer. The category includes various illegal scan-
ners of vulnerabilities, password cracking tools, other types of software for
breaking into network resources or intrusion into an attacked system.
E-mail and the Internet act as the main sources for spreading virus infections and
malware, although infection may be caused by a floppy disk or a CD. This
situation reflects a shift of emphasis in anti-virus protection from simple regular
scanning of computers for virus presence to a more complex process of real-time
computer protection from a probable infection.

CHAPTER 2. IF YOUR
COMPUTER IS INFECTED…
Sometimes it is not always apparent, even to a knowledgeable user, that a
computer is infected with a virus or a Trojan, because these programs mask their
presence among useful files. This chapter describes in detail how to recognize
the infection, restore data after a virus attack, and prevent malicious programs
from getting onto your computer.
2.1. Symptoms of infection
There are a number of common symptoms which indicate that your computer
has been infected. If you have noticed one of the following symptoms, a virus
has probably infected your computer:
• Unexpected messages or images are suddenly displayed.
• Unusual sounds or music is played at random times.
• Your CD-ROM drawer mysteriously opens and closes.
• Programs are suddenly launched on your computer.
• If Kaspersky Anti-Hacker is installed on your computer, you receive notifi-
cations about attempts of some programs to connect to the Internet with-
out your permission.
In addition, there are other typical symptoms indicating that your computer has
been infected via e-mail:
• You receive notifications that the message you sent contained a virus but
the anti-virus program of the recipient declined your message, whereas in
reality, you did not send this message or are sure that the message was
free of viruses.
• Your contacts receive messages from your address that you did not send.
• Your mailbox contains many messages without the sender’s address and
the header.
Note that these problems are not necessarily symptoms of virus-like activities.
They can have other causes. For example, infected messages from your address
can be sent from another computer.

8 Kaspersky Anti-Virus®5.0 for Windows Workstations
You might have noticed the following indirect symptoms point to a virus infection
on your computer:
• Your computer freezes frequently or displays error messages.
• Your computer slows down when programs are launched.
• Your attempts to boot up the operating system fail.
• Files and directories suddenly go missing or their content changes.
• Your hard disk is accessed too often (the light below the power button
blinks).
• Microsoft Internet Explorer "hangs" or behaves erroneously (for example,
you cannot close a program window).
• Your computer cannot boot from the hard drive (an error message is dis-
played).
Note that 90% of such cases indicate problems with your hardware or software.
However, the remaining 10% indicate a possible infection of your computer. If
you experience any of the above symptoms, we recommend that you contact
your system administrator and conduct a comprehensive virus scan of your
computer.
2.2. What to do if you have any of
these symptoms
If you have noticed that your computer is behaving “suspiciously”:
1. Don’t panic! This golden rule prevents you from unnecessary stress
and helps you save important data stored on your computer.
2. If you cannot boot from the hard drive (your computer gives you an
error message when you are starting the system), try to start the
system in safe mode or from the Windows boot disk that you
created during installation of the operating system on your
computer.
3. Before taking any actions, back up all critical data on an external
storage device (floppy disk, CD, flash card, etc.).
4. Install Kaspersky Anti-Virus, if you have not yet installed it.

If your computer is infected… 9
5. Retrieve the latest updates for your anti-virus database. If possible,
retrieve the updates using an uninfected computer. This is quite
important, because if you are connected to the Internet, a virus can
send important information to the perpetrators or try to send itself to
everyone in your address book. Therefore, if you suspect that your
computer is infected, immediately disconnect it from the Internet.
However, if there is no other way of retrieving the updates, you can
take the risk and download updates before disconnecting.
6. Disconnect your computer from the Internet.
7. If your computer is connected to a local network, disconnect it.
8. Launch a full scan (see section 5.2.2 on p. 26).
9. Inform your system administrator about suspicious symptoms in
computer operation.
2.3. If viruses are found during a
scan
If viruses are found during a scan, Kaspersky Anti-Virus will automatically
disinfect them and recover the data on your computer according to the settings.
Note that in 99% of cases, computers suffer from e-mail worms, Trojan
programs, or viruses (see Chapter 1 on p. 5 about malicious programs). In
virtually all cases, lost data can be successfully restored.
To remove viruses and recover damaged data:
1. Do not interrupt the operation of Kaspersky Anti-Virus. During a full
scan, the program will disinfect infected files, move suspicious files
to a quarantine folder, and delete mail worms and Trojans. Before
curing upon scan completion Kaspersky Anti-Virus will display all
the suspicious files, viruses, e-mail worms, and Trojans that it has
detected. Also you can find the names of any virus resident on your
computer in the report (see section 5.4.2 on p. 37).
2. In some cases, you might need a special recovery utility to restore
corrupted data. Connect to the Internet and read the information at
the Kaspersky Lab website (www.kaspersky.com) about a virus, a
Trojan horse, or a worm that has infected your computer. Download
the special utility for data recovery if such a program exists for a
specific virus. For example, to recover data infected with the Klez
virus, download and run the clrav.com program.

10 Kaspersky Anti-Virus®5.0 for Windows Workstations
3. Read the information about your situation on the website carefully.
You will probably have to take additional measures.
4. If viruses (for example, Nimda, Klez, or Badtrans) have penetrated
your computer by exploiting Microsoft Outlook Express
vulnerabilities, they can reactivate even after Kaspersky Anti-Virus
cleans the system, for example, when you are reading previously
infected messages. Therefore, check if the protection mode that
scans e-mail database is enabled (for more information, please
contact your system administrator) and install the latest security
patches for Microsoft Outlook to ensure its safe future operation.
Unfortunately, some viruses cannot be totally removed from infected objects.
Some of them destroy information on your computer during infection.
2.4. If nothing helps…
If the symptoms described above persist even after you have scanned your
computer, hardware, and software, and have checked your hard drive using
Windows utilities, please feel free to send a letter with a full description of your
problem to the Technical Support Service of Kaspersky Lab.
If you are sure that some files are Trojan programs or are infected, send these
files to Kaspersky Lab for expert analysis.
For details of how to send messages and files to Kaspersky Lab,
see Appendix B on p. 46.
2.5. After you eradicate the infection
After you get rid of the infection, scan all disks and floppy disks that may be
infected with a virus.
Make sure that you have the latest version of Kaspersky Anti-Virus installed on
your computer and you use the latest anti-virus database and the default settings
recommended by the Kaspersky Lab experts (for more information about
Kaspersky Anti-Virus settings, please contact your system administrator).
Read carefully How to prevent a virus infection section (see section 5.2 on
p. 24) and pay attention to the main security rules that will help you to prevent
future virus infections.

CHAPTER 3. KASPERSKY ANTI-
VIRUS®FOR WINDOWS
WORKSTATIONS
Kaspersky Anti-Virus®for Windows Workstations (also referred in this user
guide to as Kaspersky Anti-Virus) is designed to protect workstations from the
viruses and malware.
The following features have been implemented in the application:
• Real-time protection of file system against malicious code in the monitor-
ing mode: interception and analysis of attempts to access the computer
file system and network directories; disinfection or deletion of infected ob-
jects or isolation of suspicious objects for further analysis.
• Scan for and neutralization of malicious code on user’s or administrator’s
request: detection and analysis of infected or suspicious objects in the de-
fined scanning areas; removal of infected and isolation of suspicious ob-
jects for further analysis.
• Checking potentially dangerous software: analysis of programs started in
the user’s computer, downloaded from the internet or located on the hard
drive or removable media. When potentially dangerous software is de-
tected, the application (depending on the settings) will either allow or
block its execution or remove this software from the user’s computer.
• E-mail scanning in the monitoring mode: analysis of requests for e-mail
sending or receiving. The anti-virus prevents e-mail messages containing
malicious code from penetrating the user’s mailbox or from sending sus-
picious or infected objects to other addresses. The anti-virus scans all in-
coming and outgoing Microsoft Outlook e-mail messages; it also scans
incoming and outgoing e-mail messages of any mail clients that use
SMTP and POP3 protocols.
• Constant protection of office applications using VBA macros: analysis of
macro commands prior to their execution and prevention of potentially
dangerous macro commands being executed.
• Constant protection against execution of dangerous VBScript and
JavaScript scripts: scanning of script code prior to its execution by the OS
script processing engine; blocking execution of dangerous scripts.
• Quarantine of suspicious objects: storage of discovered suspicious ob-
jects in a quarantine directory; on-demand dispatch of them to Kaspersky

12 Kaspersky Anti-Virus®5.0 for Windows Workstations
Lab for further research; restoration of objects from the quarantine at ad-
ministrator's or user's request.
• Creation of copies in backup storage for infected objects prior to their dis-
infection or removal in order to allow on-demand restoration of an object if
the latter contains valuable data.
• Updates for the anti-virus database and software modules included in the
Anti-Virus package from the Kaspersky Lab update servers; creation of
backup copies for all files being updated if the last update needs to be
rolled back; addition of received updates to a special directory for further
distribution in order to reduce internet traffic.
Please keep in mind that new viruses emerge every day in the
world. Therefore, it is recommended that you enable the auto-
matic updates feature.
3.1. Product package
You can purchase the software from our distributors (retail box), or from one of
our web shops (for example, www.kaspersky.com, E-Store section).
If you purchase a box product, the software bundle includes:
• sealed envelope with an installation CD containing software files;
• user's manual;
• license key included in the distribution package or recorded on a special
floppy disk;
• license agreement.
Please read the license agreement carefully before opening the CD
envelope.
If you purchase our product from an e-shop, or you copy it from the Kaspersky
Lab site, the copy also contains this manual. Your license key is either included
in the installation file or sent to you by e-mail after payment.
The license agreement constitutes a legal agreement between you and
Kaspersky Lab containing the terms and conditions subject to which you may
use the purchased software.
Please read the license agreement carefully!
If you do not agree to the terms of the license agreement, you may return the box
with Kaspersky Anti-Virus to the distributor, where you have purchased it; you

Common information about the program 13
will be refunded the amount you have paid for subscription, provided the CD
envelope remains sealed.
Opening the sealed envelope of the installation CD or installing the product to a
computer entails your acceptance of all the terms and conditions of the license
agreement.
3.2. Services for registered users
Kaspersky Lab offers its legal users a broad range of services maximizing the
efficiency of Kaspersky Anti-Virus use.
By purchasing a subscription, you become a registered software user entitled to
the following services throughout the period of subscription validity:
• upgrades for the software;
• consultations regarding issues pertaining to installation, setup, and use of
this software available over the telephone or e-mail;
• notifications about availability of new software products from the Kasper-
sky Lab and new viruses emerging in the world (that service is provided to
users who have subscribed for e-mail newsletter from the Kaspersky
Lab).
No consulting is offered for issues pertaining to operating systems func-
tionality or use or operation of various technologies.
3.3. Adopted conventions
The text in this document uses various styles depending upon its purpose. The
table below lists adopted conventions used in the text.
Style Purpose
Bold face Menu titles, menu items, window titles,
parts of dialog boxes, etc.
Note. Additional information or notes
Attention!
Information that should be given special
attention

14 Kaspersky Anti-Virus®5.0 for Windows Workstations
Style Purpose
In order to perform the
action,
1. Step 1.
2. …
Procedure description for user's steps
and possible actions
Task, example Statement of a problem, example for
using the software features

CHAPTER 4. PROGRAM
INTERFACE
Kaspersky Anti-Virus has a simple and easy-to-use interface. This chapter is
devoted to detailed description of its main components – the system tray icon,
right-click menu, main window, and some service windows.
4.1. System tray icon
After the application has been launched, its icon appears in the system tray. The
icon appearance depends on the status of anti-virus protection, demonstrating
whether real-time protection is enabled or on-demand scanning has been
started.
If the real-time protection is on, the icon will be active (red) , if it is off – the
icon will be inactivated (gray) .
The icon will blink in the system tray when full system scanning or scanning
of an individual file, disk or analysis of some object in real-time mode is taking
place. Scanning of incoming e-mail is indicated by the icon, and the icon
appears when errors occur when launching of any real-time protection tasks. The
program changes its tray icon to while downloading updates to the anti-virus
databases and application modules.
If an event of some importance in terms of anti-virus protection occurs, an
informational message box appears for a while over the icon and displays
recommendation from the experts of Kaspersky Lab (this feature is not available
in Windows98/NT).
4.2. Right-click menu
If you click the application icon in the system tray using the right mouse button,
you will see a menu (see Figure 1) consisting of the following items:
• Open Kaspersky Anti-Virus – opens the Protection tab of the main
program window. You can achieve the same result by double-clicking the
program icon in the system tray.

16 Kaspersky Anti-Virus®5.0 for Windows Workstations
• Scan My Computer for viruses – launches complete computer scan for
viruses in accordance with the defined level of protection.
• Update the anti-virus database – launches download of updates for the
anti-virus database.
• Running tasks – this item appears in the right-click menu as soon as the
Anti-Virus starts any scheduled tasks. Selection of that item brings up a
submenu containing a list of all scheduled tasks running at the moment.
Select a task from the list (please see Figure 4) in order to see the details
of its activity.
• About the application – displays a help window with information about
Kaspersky Anti-Virus for Windows Workstations.
• Switch to user mode/ Switch to administrator mode (only under MS
Windows 98/ME) – switches respectively between a user interface and
the extended administrator interface. Selection of the Switch to adminis-
trator mode option brings up a dialog box with a prompt to enter the
password of the anti-virus security administrator.
Figure 1. Right-click menu
4.3. Main program window: general
structure
The main window of Kaspersky Anti-Virus is designed for implementing all
application’s features, which gives your computer complete anti-virus protection.
Here you can:
• start the anti-virus protection tasks;
• download updates for the anti-virus database;
• work with objects that have been quarantined or copied to the backup
storage;
• work with report logs, etc.
All parameters of anti-virus protection, necessary information, and tasks are
grouped in the following tabs of the main window:

Program interface 17
• Protection – anti-virus protection status and tasks. The tab represents
the main functionality while working with the application.
• Support – information required in case of problems or a need to address
Kaspersky Lab for assistance.
Each tab is subdivided into two parts:
• Task list is the left frame of the tab containing the tasks which actually
implement the anti-virus protection. The task list depends on tab purpose.
The Protection tab, for example, contains tasks for complete scans of
your computer for viruses.
• Anti-virus protection status is represented in the right frame of the tab
including the information about current status of anti-virus protection for
your computer (real-time protection, full system scans, and the anti-virus
database). The Protection tab, for example, indicates the status of anti-
virus protection.
There are three states for anti-virus protection status. They are indicated by the
following icons:
Critical anti-virus protection status. This means that real-time protection
is disabled, some of the tasks (scanning and/or updating) have not been
performed for a long time, or the settings do not provide an adequate
level of anti-virus protection for your computer; it also notifies the user of
errors that occur while running an Anti-Virus task.
Anti-virus protection level is different from the recommended one. This
status is reached when user-defined anti-virus protection settings do not
correspond to the settings recommended by experts at Kaspersky Lab.
It also indicates that a certain anti-virus protection task has to be
performed.
Recommended level of anti-virus protection.The status means complete
conformity of protection and anti-virus security settings to the
recommendations of Kaspersky Lab experts.
Each of the above statuses is supplemented by comments and
recommendations. Thus, for example, when the anti-virus protection level is
different from the recommended one, to the program will propose that you return
to recommended settings, since they provide for the optimal level of anti-virus
protection.

18 Kaspersky Anti-Virus®5.0 for Windows Workstations
4.3.1. Protection tab
The Protection tab (see Figure 2) is designed for running tasks which provide
full system scanning as well as scanning individual disks, folders, or files. Here
you can also launch update downloads for the anti-virus database. The tasks
may be started by corresponding hyperlinks in the left part of the tab.
The left part of the tab also contains links to quarantine and backup storage and
program reports:
• Quarantine – open suspicious objects’ storage window.
• Backup – open infected objects’ backup storage window.
• Reports – open reports log.
In the right part of the tab you can review the current status of real-time
protection, full system scanning, and anti-virus database. Kaspersky Anti-Virus
recommendations represent an essential attribute of critical or medium status
levels of anti-virus protection.
Figure 2. Protection tab

Program interface 19
The right panel of the tab under status indicators of anti-virus protection displays
some general information about the total number of objects scanned and viruses
detected since installation of Kaspersky Anti-Virus.
General information about the number of scanned objects and viruses detected
after Kaspersky Anti-Virus was started is presented in the right part of the tab
under the area containing the anti-virus status information.
The information is replaced with a Viruses detected… hyperlink if a scheduled
scanning task discovers infected or suspicious objects. Clicking the hyperlink will
take you to the list of tasks which have assigned some objects for subsequent
treatment.
4.3.2. Support tab
Using the Support tab (see Figure 3), you can access information about the
Technical Support Service, which you should call in case of problems pertaining
to Anti-Virus operation or situations which you cannot handle by yourself. It
contains information about the program, your license key, and the operating
system installed on your computer. All that information is displayed in the right
part of the tab.
The left frame contains the following hyperlinks:
• Send question to technical support – send a question concerned with
Anti-Virus operation to Technical Support.
• Send file for analysis – send an e-mail with a suspicious object to Kasper-
sky Lab for analysis.
• Help us to make this product better! – send a suggestion to the Technical
Support Service through the automated system of feedback processing.
Clicking the hyperlink opens a feedback collection form on the web site of
Kaspersky Lab.
The left part of any tab in the main window of Kaspersky Anti-Virus contains links
to help information:
• Help – general help for the software.
• How to… – help system for task performance and resolving emerging is-
sues.
• Virus Encyclopedia – a link to www.viruslist.com, which contains a de-
tailed description of all currently existing malware.
• Kaspersky Lab’s Website – a link to the Kaspersky Lab web site.

20 Kaspersky Anti-Virus®5.0 for Windows Workstations
Figure 3. Support tab
4.4. Scanning process window
When a computer scan or scan of its individual objects (disks, folders, files) is
launched, the scanning process window appears on the screen (see Figure 4).
The window consists of two parts:
• The upper part demonstrates the scanning progress indicator, the time of
process was begun, estimated completion time, and the name of the file
being scanned at the moment.
• The lower part consists of three tabs: a Statistics tab with statistical re-
sults of the scan, a Report tab containing the report on events which
have occurred during the scanning procedure, and a Settings tab with a
list of settings used for the recent or current scan.
The View quarantine hyperlink takes the user to the quarantine storage window
(see section 5.4.1.1 on p. 34).
Use the Export report to file hyperlink to save the report as a text document.
Clicking the link opens a standard browsing window, where you should enter the