KAPERSKY ANTI-VIRUS 5.1 - FOR MICROSOFT ISA SERVER Service manual

KASPERSKY LABS
Kaspersky Anti-Virus®5.1
for Microsoft ISA Server
Administrator’s guide

KASPERSKY ANTI-VIRUS®5.1 FOR MS ISA SERVER
Administrator’s Guide
Kaspersky Labs Ltd.
http://www.kaspersky.com
Edition date: July 2004

Contents
CHAPTER 1. KASPERSKY ANTI-VIRUS®FOR MS ISA SERVER ............................. 4
1.1. Hardware and software requirements .................................................................. 5
1.2. Distribution kit ........................................................................................................ 6
1.3. Help Desk for registered users.............................................................................. 6
1.4. Conventions........................................................................................................... 7
CHAPTER 2. TYPICAL DEPLOYMENT SCENARIOS ................................................. 8
CHAPTER 3. HOW TO INSTALL THE APPLICATION ............................................... 11
3.1. Configuring ISA Server before installing the application .................................... 11
3.2. Installing Kaspersky Anti-Virus®.......................................................................... 12
3.2.1. First installation ............................................................................................. 12
3.2.2. Reinstalling.................................................................................................... 16
3.2.3. Troubleshooting installation problems ......................................................... 17
CHAPTER 4. USING KASPERSKY ANTI-VIRUS®FOR ISA SERVER..................... 19
4.1. Default values of scan settings ........................................................................... 19
4.2. Managing scans .................................................................................................. 21
4.2.1. Configuring general settings of anti-virus scanning..................................... 22
4.2.1.1. General settings..................................................................................... 23
4.2.1.2. Settings for HTTP scanning................................................................... 25
4.2.1.3. Settings for FTP scanning ..................................................................... 26
4.2.2. Managing groups.......................................................................................... 27
4.2.3. Specifying policies for anti-virus scanning ................................................... 32
4.2.3.1. Managing a list of trusted servers.......................................................... 36
4.2.3.2. Creating a list of objects excluded from scans...................................... 37
4.3. Updating the anti-virus database ........................................................................ 38
4.3.1. Scheduled updating of the anti-virus database ........................................... 40
4.3.2. On-demand updating.................................................................................... 40
4.4. Managing notifications......................................................................................... 40
4.5. Testing Kaspersky Anti-Virus®operation............................................................ 42
4.6. Application statistics and diagnostics.................................................................. 42

3 Kaspersky Anti-Virus for MS ISA Server
4.6.1. Recording and viewing statistics .................................................................. 42
4.6.2. Notifying the administrator using ISA Server Alerts..................................... 45
4.6.3. Configuring diagnostics options for the application ..................................... 46
4.7. Managing license keys........................................................................................ 48
4.7.1. Renewing your license ................................................................................. 49
4.7.2. Removing a license key ............................................................................... 50
CHAPTER 5. TROUBLESHOOTING ........................................................................... 51
APPENDIX A. GLOSSARY........................................................................................... 54
APPENDIX B. KASPERSKY LABS LTD. ....... ERROR! BOOKMARK NOT DEFINED.
B.1. Other Kaspersky Labs products..........................Error! Bookmark not defined.
B.2. Contact Information..............................................Error! Bookmark not defined.
APPENDIX C. LICENSE AGREEMENT ...................................................................... 61

Chapter 1. Kaspersky Anti-
Virus®for MS ISA Server
Kaspersky Anti-Virus®for Microsoft ISA Server (hereafter, also Kaspersky
Anti-Virus®for ISA Servers) is a system of anti-virus control for files transferred
using the HTTP and FTP protocols via the Microsoft Internet Security and
Acceleration Server. It ensures reliable protection of corporate networks from
penetration by malicious software.
Kaspersky Anti-Virus®for MS ISA Server acts as a filter that intercepts packets
transferred via the HTTP and FTP protocols, isolates controlled objects from this
data, analyzes them for the presence of viruses, and prevents infected files and
Web documents from penetrating into a corporate network.
The program includes data stream filters and the anti-virus kernel.
The filters are integrated into MS ISA Server as plug-ins, and the anti-virus kernel
is installed into the system as a service.
The anti-virus protection is managed through a special interface built into the ISA
administration snap-in for Microsoft Management Console (MMC) as an
extension.
The application performs the following functions:
• Anti-virus protection and processing of data streams received from the
Internet.
• Generation of data streams from disinfected files and the delivery of these
streams to the client upon request.
• Scheduled and manual updating of the anti-virus database via the Inter-
net, a local folder, or a shared folder.
• Logging of statistics about program performance and displaying the
results using standard Windows tools.
• Management of license keys.
In addition, Kaspersky Anti-Virus®for MS ISA Server allows the user to:
• Set parameters for anti-virus protection and for notifications about dan-
gerous events.
• Create groups of users in accordance with the adopted network policy.
For example, you can use the existing administration division to define

5 Kaspersky Anti-Virus for MS ISA Server
anti-virus policy settings for each of the groups created. This can signifi-
cantly speed up the scanning process.
• Create a list of trusted servers for one or several groups of users; the traf-
fic from these servers will be excluded from scanning for viruses.
• Create a list of types of object excluded from anti-virus protection.
Kaspersky Anti-Virus®supports the following data transfer protocols:
• HTTP 1.0 and 1.1 (RFC 2616);
• FTP (RFC 959, 2389, Extensions to FTP);
• FTP over HTTP.
1.1. Hardware and software
requirements
Kaspersky Anti-Virus®for MS ISA Server operates in integration with Microsoft®
Internet Security and Acceleration Server 2000 with Service Pack 1 or higher
installed under the following platforms:
• Microsoft®Windows 2003 Server.
• Microsoft®Windows 2000 Server (Service Pack 3 or higher).
• Microsoft®Windows 2000 Advanced Server (Service Pack 3 or higher).
This version of the program cannot be installed on MS ISA Server com-
puters operating as array members.
To use Kaspersky Anti-Virus®for MS ISA Server, your computer must meet the
following minimum requirements:
• Pentium II processor of 300 MHz or higher.
• At least 256 Mb of free RAM.
• At least 20 Mb of free hard disk space for installation of the program.
• At least 200 Mb of free hard disk space for temporary storage of data cop-
ied from the Internet before scanning for viruses.

Kaspersky Anti-Virus®for MS ISA Server 6
1.2. Distribution kit
You can purchase Kaspersky Anti-Virus®for MS ISA Server either from our
distributors (retail box) or online at one of our Internet shops (for example,
www.kaspersky.com – select the E store link).
The retail box includes:
• a sealed envelope with an installation CD containing files for the software
product;
• administrator's guide;
• a license key written on the floppy disk;
• license agreement.
Before you unseal the envelope containing the CD, be sure to thor-
oughly review the license agreement.
If you buy Kaspersky Anti-Virus®for MS ISA Server online, you download the
installation file of the product from the Kaspersky Labs website. This installation
file includes this Administrator’s Guide and the license key. The license key can
also be sent to you by e-mail after receiving your payment.
The License Agreement is a legal agreement between you and the manufacturer
(Kaspersky Labs Ltd.) describing the terms on which you may employ the anti-
virus product which you have purchased.
Make sure you read the License Agreement!
If you do not agree to the terms of this LA, you can return the unused product to
your Kaspersky Anti-Virus®dealer for a full refund, making sure the envelope
containing the CD is sealed.
If you unseal the envelope or install the program, you are considered to have
agreed to all the terms of the LA.
1.3. Help Desk for registered users
Kaspersky Labs offers a large service package enabling its registered customers
to enjoy all the available features of Kaspersky Anti-Virus®.
If you register and purchase a subscription you will be provided with the following
services for the period of your subscription:

7 Kaspersky Anti-Virus for MS ISA Server
• new versions of this anti-virus software product provided free of charge;
• phone or e-mail advice on matters related to the installation, configuration,
and operation of this anti-virus product;
• information about new Kaspersky Labs products and about new computer
viruses (for those who subscribe to the Kaspersky Labs newsletter).
Kaspersky Labs does not provide information related to the operation
and use of your operating system or various other technologies.
1.4. Conventions
In this book we use various conventions to emphasize different meaningful parts
of the documentation. The Table below lists the conventions used in this User
Guide.
Convention Meaning
Bold font Menu titles, commands, window titles,
dialog elements, etc.
Note.
Additional information, notes
Attention!
Critical information
To do this,
1. Step 1.
2. …
Actions that must be taken
Text of information mes-
sages and the command line Text of configuration files, information
messages, and the command line.

Chapter 2. Typical Deployment
scenarios
A typical scenario for deploying ISA Server and most of its services is as follows:
the administrator installs the application on the ISA Server computer, and the ISA
administration tool on a remote computer (as a rule, an administrator’s
workstation).
In this deployment scenario, the Kaspersky Anti-Virus®application must be
installed on the ISA Server computer, and the Kaspersky Anti-Virus®
administration console, on the administrator’s workstation. The computer that
runs the Kaspersky Anti-Virus®for ISA Server administration console must only
have the ISA Server administration tools installed.
You can install separate components of Kaspersky Anti-Virus®by
manually installing the application (see Chapter 3 on page 11).
During the installation procedure, the program will automatically detect the ISA
Server mode. Below, we consider possible ISA Server modes and any special
features of Kaspersky Anti-Virus®operation for each of these modes.
The documentation for ISA Server describes three possible modes:
• Firewall.
• Proxy (Cache).
• Integrated.
In Firewall mode, ISA Server protects internal network communications from
various types of Internet-borne threats by using various tools, such as IP packet
filters, Web filters, and application filters. In this mode, caching of transmitted
information is disabled.
In Proxy (Cache) mode, ISA Server acts as a cache server that routes requests
and plans data loading for efficient processing of subsequent clients’ requests. In
this mode, ISA Server does not function as a firewall.
In Integrated mode, all the features of the firewall and cache server are
available. In addition, in this mode, you can set ISA Server to operate separately
in the Proxy or Firewall modes.
During the installation of Kaspersky Anti-Virus®, the mode in which ISA Server
operates is determined automatically. Depending on the mode, various sets of
data stream filters are installed.

9 Kaspersky Anti-Virus for MS ISA Server
The following Kaspersky Anti-Virus®filters can optionally be added to the system:
• Kaspersky Anti-Virus FTP Application Filter.
• Kaspersky Anti-Virus Web Filter.
• Kaspersky Anti-Virus HTTP Application Filter.
Table 1 shows filter options for the three ISA Server modes.
Table 1
Filters Proxy Firewall Integrated
Kaspersky Anti-Virus FTP
Application Filter
No Yes Yes
Kaspersky Anti-Virus Web Filter Yes Yes1Yes
Kaspersky Anti-Virus HTTP
Application Filter
No Yes No
After Kaspersky Anti-Virus®is installed, you will be able to manage the above
filters using the ISA Server Administration interface.
When the ISA Server is running in the Firewall mode Kaspersky Anti-Virus Web
Filter is installed in disabled state, since it is presupposed that all the clients use
the ISA Server as a firewall without accessing the proxy server directly. If the
clients do access the proxy server directly (e.g. their browsers are set to work via
the proxy), please enable Kaspersky Anti-Virus Web Filter after the application
is installed to make sure the traffic passing via the proxy server is scanned for
viruses.
If you reinstall ISA Server to change the installed mode, you must also
reinstall Kaspersky Anti-Virus®and select only those filters that are
compatible with the selected mode.
Fig. 1 shows a scheme of processing the initial data streams that are common for
all possible Kaspersky Anti-Virus®deployment scenarios.
1The filter is disabled by default