KAPERSKY ANTI-VIRUS 5.5 - FOR CHECK POINT FIREWALL-1 Service manual

KASPERSKY LAB
KasperskyAnti-Virus® 5.5
for Check PointTM Firewall-1®
Administrator's Guide

KASPERSKY ANTI-VIRUS ® 5.5 FOR CHECK POINTTM
FIREWALL-1®
Administrator's Guide
©Kaspersky Lab Ltd
http://www.kaspersky.com
Revision date: November, 2006

Table of Contents
CHAPTER 1. INTRODUCTION......................................................................................6
1.1. Computer viruses and malicious software............................................................ 6
1.2. Purpose, main functions and structure of Kaspersky Anti-Virus..........................8
1.3. What's new in version 5.5?.................................................................................10
1.4. Software and hardware requirements................................................................11
1.5. Distribution kit ......................................................................................................12
1.5.1. License Agreement.......................................................................................13
1.6. Services provided for registered users...............................................................13
1.7. Formatting conventions.......................................................................................13
CHAPTER 2. OPERATION OF KASPERSKY ANTI-VIRUS.......................................15
2.1. Deploying the application....................................................................................15
2.2. Deployment of anti-virus protection ....................................................................15
2.3. Anti-virus protection system maintenance..........................................................17
CHAPTER 3. INSTALLING AND REMOVING THE APPLICATION..........................18
3.1. Installing the application......................................................................................18
3.1.1. First-time installation.....................................................................................19
3.1.2. Reinstalling the application...........................................................................22
3.2. Removing the application....................................................................................22
CHAPTER 4. INTEGRATION OF KASPERSKY ANTI-VIRUS WITH CHECK
POINTTM FIREWALL-1®............................................................................................23
4.1. Registering Security Server with Check PointTM Firewall-1®.............................23
4.2. Obtaining a Security Server certificate................................................................32
CHAPTER 5. STARTING USING THE APPLICATION...............................................34
5.1. Starting the application........................................................................................34
5.2. Application interface............................................................................................34
5.2.1. Main application window ..............................................................................34
5.2.2. Shortcut menu ..............................................................................................36
5.3. Creating the list of monitored servers.................................................................37
5.4. Connecting the Management Console to the server.........................................38
5.5. Connecting the Security Server to Check PointTM Firewall-1®...........................39
5.6. Minimum required settings..................................................................................46

4 Kaspersky Anti-Virus 5.5 for Check PointTM Firewall-1
®
5.7. Protection without additional configuration.........................................................47
5.8. Verifying the application performance ................................................................48
5.8.1. Test “virus” EICAR and its modifications.....................................................48
5.8.2. Testing the HTTP traffic protection ..............................................................49
5.8.3. Testing the SMTP traffic protection..............................................................49
5.8.4. Testing the FTP traffic protection.................................................................50
CHAPTER 6. UPDATING THE ANTI-VIRUS DATABASE..........................................51
6.1. Downloading updates from the internet..............................................................54
6.2. Installing updates from a network folder.............................................................55
6.3. Automatic updates...............................................................................................56
6.4. Updating the anti-virus database in the manual mode.......................................57
CHAPTER 7. ANTI-VIRUS PROTECTION..................................................................58
7.1. Anti-virus objects processing ..............................................................................60
7.1.1. Actions performed with objects transferred via HTTP protocol...................61
7.1.2. Actions performed with objects transferred via FTP protocol .....................62
7.1.3. Actions performed with objects transferred via SMTP protocol..................62
7.2. Anti-Virus protection level....................................................................................63
7.3. Enabling and disabling the anti-virus protection. Selecting the anti-virus
protection level...................................................................................................63
7.4. Scanning HTTP traffic.........................................................................................65
7.5. Scanning FTP traffic............................................................................................70
7.6. Scanning SMTP traffic.........................................................................................73
7.7. Anti-virus scan efficiency.....................................................................................75
CHAPTER 8. BACKUP STORAGE..............................................................................79
8.1. Viewing the backup storage................................................................................80
8.2. Backup storage filter............................................................................................81
8.3. Restoring objects from the backup storage........................................................84
8.4. Deleting objects from the backup storage..........................................................86
8.5. Configuring the backup storage settings............................................................87
CHAPTER 9. REPORTS...............................................................................................89
9.1. Creating reports...................................................................................................91
9.2. Creating the report template ...............................................................................92
9.3. Viewing reports....................................................................................................95
CHAPTER 10. APPLICATION EVENT LOG................................................................98

Table of Contents 5
10.1. Configuring the diagnostics level......................................................................99
10.2. Configuring log files settings ...........................................................................101
CHAPTER 11. LICENSE KEYS..................................................................................102
11.1. License information.........................................................................................104
11.2. License key details..........................................................................................105
11.3. License-related notifications............................................................................107
11.4. Installing the license key .................................................................................107
11.5. Removing a license key..................................................................................108
CHAPTER 12. NOTIFICATIONS................................................................................110
CHAPTER 13. FREQUENTLY ASKED QUESTIONS...............................................114
A.1.1.1. NOTIFICATION SETTINGS..........................................................................118
A.1.1.2. GLOSSARY....................................................................................................122
A.1.1.3. KASPERSKY LAB..........................................................................................126
A.2. Other Kaspersky Lab Products ........................................................................127
A.3. Contact Us.........................................................................................................134
A.3.1.1. LICENSE AGREEMENT................................................................................136

CHAPTER 1. INTRODUCTION
The main source of viruses today is the global Internet. Most virus infections
happen via e-mail. The facts that almost every computer has e-mail client
applications installed and that malicious programs are able to take a full
advantage of software address books in order to find new victims are favorable
factors for the distribution of malware. Without even suspecting it, the user of an
infected computer is sending infected e-mail messages to his or her contacts,
who, in turn, send new waves of infected messages and so on. It is not
uncommon when infected files, due to someone's negligence, enter commercial
mailing lists of large companies. In this case, the virus will affect not just five, but
hundreds or even thousands recipients of such mailings who then will send
infected files to dozens thousands of their contacts.
It is now acknowledged that for some companies information has become a more
important asset than their physical property or cash. At the same time, in order to
gain profit through the use of the information, it has to be available to the
company's employees, clients and partners. This raises the issue of data security
and, as its important element, the issue of protection of the corporate mail
servers against the external threats, preventing virus outbreaks within the
corporate networks.
1.1. Computer viruses and malicious
software
The constant growth in the number of computer users and new possibilities of
data exchange between them via e-mail or internet result in the increased threat
of virus infections and data corruption or theft by malicious computer programs.
In order to be aware of the potential threats to your computer, it is helpful to know
what the types of malicious software (“malware”) are and how they work. In
general, malicious programs fall into one of the following three categories:
•Worms – malicious programs that belong to this category use network
resources for distribution. These programs were called "worms" due to
their ability to tunnel from one computer to another, using networks, email
and other channels. Due to this ability, worms can proliferate extremely
fast.
Worms penetrate a computer, determine IP addresses of other com-
puters, and send copies of themselves to these computers. Apart from the
network addresses, worms often use data contained in the address books
of e-mail client applications installed on the infected machine. Sometimes
worms create work files on disks, but they also can function without utiliz-
ing any resources of the infected computer except RAM.

Introduction 7
•Viruses –programs that infect other programs by adding their code to the
infected program's code in order to gain control when infected files are
run. This simple definition helps determine that the major action a virus
performs is infecting computer programs. Viruses spread somewhat
slower than worms.
•Trojan horses – perform unauthorized actions on infected computers,
for instance, depending on the particular conditions, they can erase in-
formation on hard drives, "freeze" the system, steal confidential informa-
tion, etc. In the strict sense, Trojan Horses are not viruses as they do not
infect programs or data, and are unable to sneak independently into com-
puters and are distributed by malicious users as some "useful" software.
However, Trojans may inflict far greater damages compared to a regular
virus attack.
Recently, worms have become the most widespread type of malware, followed
by viruses and Trojans. Some malicious computer programs have characteristics
of two or even all three of the above categories.
The following potentially dangerous types of malware have also become
widespread:
•Adware - code that, without the user's knowledge, is included into a
program's code in order to display advertising messages. As a rule,
adware is integrated into freeware programs. The advertising component
is located in the interface. Adware programs are often used to gather
users' personal information and send it to the developer, change
browser's settings (browser's home page, search page, security levels,
etc.) and create traffic that is not controlled by the user. All this may lead
to the infringement of the security policies and further to direct financial
losses.
•Riskware - programs that are not supposed to perform any malicious
functions, but contain security breaches and errors and therefore can be
used by intruders as auxiliary components of malicious programs. This
type of software includes, for example remote administration programs,
IRC client programs, FTP programs and various utilities used for ending
or hiding running processes.
•Spyware - software used to obtain unauthorized access to user's data,
for tracking actions performed on this computer or gathering information
about the contents of the hard drive. Such programs help the intruder not
only gather information, but also gain control over the user's computer.
Spyware programs are often distributed along with freeware and installed
on the user's computer without the user's knowledge. This type of
software includes keyboard spies, password hacking programs and
software used for gathering confidential information (for example credit
card numbers).

8 Kaspersky Anti-Virus 5.5 for Check PointTM Firewall-1
®
•Automatic dialers (Pornware) - programs that establish modem
connection with various pay-per-visit internet (as a rule, pornographic)
websites.
•Hacking tools - tools used by hackers to obtain access to the user's
computer. This type of software includes various illegal vulnerability
scanners, password hacking programs and other types of software used
to hack network resources or to obtain unauthorized access to the system
under attack.
Although malicious programs are distributed mainly via email and the Internet, a
floppy disk or a CD can also be a source of infection. Therefore, the task of
comprehensive protection against potential threats now extends far beyond
simple regular scans for viruses, and includes the more complex task of real-time
anti-virus protection.
Henceforth in the text of this Guide the term "virus" will be used to refer
to viruses, Trojan Horses and worms. A particular type of malware will
be mentioned only when it is required.
1.2. Purpose, main functions and
structure of Kaspersky Anti-
Virus
Kaspersky Anti-Virus® for Check PointTM Firewall-1®(hereinafter referred to
as Kaspersky Anti-Virus) is a system that provides anti-virus monitoring of files
transmitted over HTTP, FTP and SMTP protocols via Check PointTM Firewall-1®
firewall that ensures high quality protection of corporate networks against
malware.
Kaspersky Anti-Virus is controlled using special user interface incorporated into
Microsoft Management Console (hereinafter - MMC).
The application performs the following functions:
•performs anti-virus scan and processing of data streams transmitted via
HTTP and FTP protocols. Depending on the settings, the application will
skip or attempt to disinfect a malicious object, block access to it and notify
about detection of such objects.
•passes over disinfected files to the client that requested this HTTP or FTP
stream.
•scans incoming and outgoing e-mail messages transmitted via SMTP pro-
tocol and all attached files for the presence of malicious code in the real-
time format. Depending on the settings selected, the application will pass
infected messages, delete them or attach to them a warning message.

Introduction 9
•creates list of objects that will not be scanned for viruses.
•saves backup copies of objects to a special storage before disinfecting,
deleting or blocking the object for the consequent restoring which pre-
vents the loss of data. Configurable filters allow to easily locate the origi-
nal copies of objects.
•notifies user requesting an object that contains malicious code.
•notifies about the results of the anti-virus object scan, anti-virus database
updates, report creation, forthcoming expiration of the license and change
of the application status by launching external programs including scripts
written by the administrator. This feature allows the administrator to setup
notifications about the above events in a most convenient way.
•updates the anti-virus database from internet or from the local folder ei-
ther in the manual or automatic mode. Internet updates can be performed
from the Kaspersky Lab's FTP and HTTP internet servers.
Anti-virus scan and disinfection of infected objects are per-
formed based on the records of the anti-virus database that
contains description of all currently known viruses, methods
used for the disinfection of objects infected with these viruses
and description of potentially dangerous programs (riskware).
As new viruses are created daily, it is extremely important
that you maintain your anti-virus database up-to-date.
The anti-virus database at the Kaspersky Lab's servers is
updated on an hourly basis. We recommend that you update
your anti-virus database with the same frequency (see
Chapter 6, page 51).
•Maintains events log and creates reports about the results of the anti-
virus scan on a regular basis.The application allows creating reports us-
ing built-in templates at the required time interval.
•Allows configuring application settings depending on the intensity and the
nature of the traffic as well as the characteristics of the hardware installed
(amount of RAM, speed, number of processors, etc.).
•Manages license keys
Kaspersky Anti-Virus 5.5 for Check PointTM Firewall-1®includes the following
components:
•Security server that provides the anti-virus functionality and updating of
the anti-virus database and includes administrative services for remote
management, configuring and ensuring the integrity of the application and
of the data stored.
•Management Console that provides the user interface for managing the
administrative services of the application and allows installing the applica-
tion, configuring settings and managing the server component. The man-

10 Kaspersky Anti-Virus 5.5 for Check PointTM Firewall-1
®
agement module is implemented as the extension of the Microsoft Man-
agement Console (MMC).
1.3. What's new in version 5.5?
Kaspersky Anti-Virus 5.5 for Check PointTM Firewall-1®has the following
distinctions from the previous version:
•Completely revised intuitive graphical interface implemented according to
the Microsoft Management Console standards. Using the new interface,
the administrator can start using the application without the need to con-
figure any preliminary settings. Additionally, this interface offers a wide
range of options for configuring the customized application management
environment that can be adapted to the conditions of any particular corpo-
rate network to the maximum possible extent.
•The use of extended set of the anti-virus database for scanning objects
helps protect traffic not only against malware, but also against potentially
dangerous programs (riskware), such as spyware, adware, automatic di-
aling programs, hacking software and joke programs.
•The possibility to select anti-virus protection levels has been implemented
which enables the administrator to adjust the security level of the stream
passing through the firewall and the Anti-Virus load during the scan.
•Configurable filters allow to easily locate the original copies of objects for
example for their subsequent restoration.
•A new feature has been added that allows user to scale the application
based on the number of processors installed on the computer on which
the application is residing. In order to enhance the efficiency of the appli-
cation (increasing the number of objects that can be analyzed at the same
time) several instances of the anti-virus kernel can be launched and run
simultaneously.
•The possibility to control the size of the queue of the objects to be
scanned allows a more precise control of the Anti-Virus load depending
on the amount of data being scanned.
•A possibility to scan objects in RAM without using the disk subsystem has
been added, which considerably increases the efficiency of the applica-
tion.
•Due to the support of AMON and ELA protocols a deeper level of Kasper-
sky Anti-Virus integration with Check PointTM Firewall-1®has been
achieved, which allows transferring information about Kaspersky Anti-
Virus operation and viewing it using standard Check PointTM Firewall-1®
tools.
•The logging capability has been drastically improved. The application now
allows logging registered events into the Microsoft Windows application