KAPERSKY ANTI-VIRUS 5.5 - FOR LOTUS NOTES-DOMINO User manual

KASPERSKY LAB
Kaspersky Anti-Virus 5.5
for Lotus Notes/Domino
User’s Guide

KASPERSKY ANTI-VIRUS 5.5
FOR LOTUS NOTES/DOMINO
User's Guide
©Kaspersky Lab
http://www.kaspersky.com
Revision date: May 2007

Contents
CHAPTER 1. INTRODUCTION ...................................................................................... 5
1.1. Computer viruses and malware ............................................................................ 5
1.2. Kaspersky Anti-Virus 5.5 for Lotus Notes/Domino............................................... 6
1.3. Hardware and software system requirements ..................................................... 7
1.4. Distribution kit ........................................................................................................ 8
1.5. Services provided for registered users ................................................................. 9
1.6. Conventions......................................................................................................... 10
CHAPTER 2. INSTALLING AND REMOVING THE APPLICATION .......................... 11
2.1. Installing the application ...................................................................................... 11
2.2. Post-installation setup ......................................................................................... 13
2.3. Removing the application.................................................................................... 13
CHAPTER 3. KASPERSKY ANTI-VIRUS INTERNAL ARCHITECTURE.................. 15
CHAPTER 4. CONFIGURING THE ANTI-VIRUS PROTECTION SYSTEM ............. 17
4.1. General application settings................................................................................ 17
4.2. Updating the anti-virus databases ...................................................................... 18
4.3. Replications scan settings................................................................................... 20
4.4. E-mail protection settings .................................................................................... 23
4.5. Protection against virus outbreaks...................................................................... 25
4.6. Database protection ............................................................................................ 26
4.7. Anti-virus protection settings ............................................................................... 29
4.7.1. General scanning settings............................................................................ 29
4.7.2. Status-dependent actions over objects........................................................ 31
4.7.3. Notifications................................................................................................... 33
CHAPTER 5. ADDITIONAL SETTINGS....................................................................... 34
5.1. Quarantine database........................................................................................... 34
5.1.1. Working with documents in the Quarantine database ................................ 35

4 Kaspersky Anti-Virus 5.5 for Lotus Notes/Domino
5.1.2. Working with e-mail message objects in the Quarantine database............ 37
5.2. Worklog................................................................................................................ 39
5.3. Reports on application activity ............................................................................ 40
5.4. Working with license keys ................................................................................... 42
5.4.1. Renewing your license ................................................................................. 42
5.5. Managing the application using command line .................................................. 44
CHAPTER 6. VERIFYING THE APPLICATON'S OPERATION ................................. 46
APPENDIX A. FREQUENTLY ASKED QUESTIONS ................................................. 47
APPENDIX B. RETURN CODES OF THE KAVUPDATER MODULE....................... 50
APPENDIX C. KASPERSKY LAB................................................................................. 52
C.1. Other Kaspersky Lab Products .......................................................................... 53
C.2. Contact Us .......................................................................................................... 63
APPENDIX D. LICENSE AGREEMENT ...................................................................... 65

CHAPTER 1. INTRODUCTION
Constant growth in both the number of computer users, and the volume of e-mail
and Internet traffic, increases the threat of virus infections and data corruption or
theft by malicious computer programs (malware).
The most dangerous sources of malware are:
Internet
The global information network is the main conduit for all types of malware. As a
rule, viruses and other malicious programs are located on popular Internet web
sites, disguised as useful software or freeware. Malware can also be found within
scripts that automatically run when a web site is loaded in the user’s browser.
E-mail messages
E-mail messages delivered to the user’s mailbox and stored in e-mail databases
may contain viruses. Malware can be located in message body or in its
attachment. Typically, infected e-mail messages contain viruses or mail worms.
When you open an e-mail message or save an attached file to your hard drive,
you may infect data stored on your computer.
Software vulnerabilities
In most cases hacker attacks are attempted using the so-called "software
security breaches". Such vulnerabilities allow hackers to access remotely your
computer and, therefore, your data, your LAN resources and other sources of
information.
1.1. Computer viruses and malware
In order to be aware of potential threats to your computer, it is helpful to know
the types of malicious software ("malware") and how they work. In general,
malicious programs fall into the following three categories:
Worms - malicious programs which spread using network resources. These
programs are called "worms" due to their ability to tunnel from one computer to
another using networks, e-mail and other communication channels. This ability
also allows worms to proliferate extremely quickly.
Worms propagate by penetrating a system, determining network addresses of
other computers, and sending their copies to those computers. Apart from
network addresses, worms often use data contained in the address books of e-
mail client applications installed on the infected host. Sometimes worms create

6 Kaspersky Anti-Virus 5.5 for Lotus Notes/Domino
temporary files on disks, but they can also function without utilizing any
resources of infected computers other than RAM.
Viruses - programs that infect other software by embedding their code in order
to gain control when the infected files are run. This simple definition helps
determine that the major action of a virus is infection of computer programs.
Viruses spread somewhat slower than worms.
Trojan horses or Trojans are programs that perform unauthorized actions on
infected computers. For instance, depending on the particular conditions, they
can erase information on hard drives, make the system freeze, steal confidential
information, etc. Trojan horses are not viruses proper since they do not infect
programs or data; they are unable to sneak independently into computers;
malefactors often distribute them disguised as some "useful" software. However,
Trojans may inflict far greater damages than a regular virus attack.
Henceforth in this Guide the term "virus" will be used to refer to viruses,
Trojan horses and worms. A particular type of malware will be
mentioned only when it is required.
1.2. Kaspersky Anti-Virus 5.5 for
Lotus Notes/Domino
Kaspersky Anti-VirusTM for Lotus Notes/Domino (hereinafter referred to as
Kaspersky Anti-Virus or the application) is designed to provide anti-virus
protection of Lotus Notes/Domino-based mail systems and databases. The
application is installed on the server running Windows 2000/2003 operating
system and protects all mail traffic passing through the server and the Domino
database files against malware.
Kaspersky Anti-Virus for Lotus Notes/Domino allows you to perform the following
operations:
• Scan for viruses all e-mail messages passing through the Lotus
Notes/Domino mail system. The anti-virus scan involves both the text of
the message and attached files.
• Cure infected messages if that is provided for in the settings.
• Filter database files by their type. Files of a specific format will be treated
using individual rules defined by the administrator.
• Isolate files in Quarantine (special storage for suspicious objects) to
prevent the possibility of data loss.
• Notify the sender, recipient and the system administrator about messages
that contain malicious objects.

Introduction 7
• Register virus outbreaks and notify the administrator about such events.
• Update the anti-virus database either in automatic or manual mode.
Supported sources of updates include Kaspersky Lab’s FTP and HTTP
servers or a local/network folder that contains a current set of updates.
• Maintain the Anti-Virus operation log.
• Manage the license keys for the Anti-Virus.
Attention! New viruses emerge every day and in order to keep your anti-
virus application up-to-date, it is extremely important that you update
your anti-virus database on an hourly basis!
Please note limitations in the operation of Kaspersky Anti-Virus for
Lotus Notes/Domino:
• It does not scan messages encrypted using standard
Lotus Notes/Domino tools.
• It can disrupt the integrity of electronic signatures in
messages signed by the sender when adding a scan
report to message text or when replacing attached files
with disinfected ones or during removal of incurable
objects.
• It does not scan files created in OS/2 or Macintosh
environment.
• It converts messages from MIME format into Rich Text if
a scan report is added to the body of the message. Some
formatting of the message may be lost then.
• It cannot be configured using via a web-based interface.
1.3. Hardware and software system
requirements
The following software must be installed on the host server for the operation of
Kaspersky Anti-Virus 5.5 for Lotus Notes/Domino:
One of the following operating systems:
• Microsoft Windows 2000 (Service Pack 4 and higher)
• Microsoft Windows 2000 Advanced Server (Service Pack 4 and higher)
• Microsoft Windows Server 2003 Standard Edition

8 Kaspersky Anti-Virus 5.5 for Lotus Notes/Domino
• Microsoft Windows Server 2003 Enterprise Edition
• One of the following versions of Lotus Notes/Domino:
• version 6.5 or higher
• version 7.0 or higher.
Lotus Notes/Domino 7.0 version is supported without use of the DB2
Universal Database technology.
Minimum hardware requirements for Kaspersky Anti-Virus:
• Pentium 300 MHz or higher processor.
• 64 MB free RAM (128 MB is recommended).
• 11 MB of available disk space in order to install the application (the
amount does not include the space required for service folders).
• Free disk space required is calculated based on the average size of one
message.
The system requirements for Lotus Domino may differ from the system
requirements for Kaspersky Anti-Virus.
1.4. Distribution kit
You can purchase Kaspersky Anti-Virus either from our dealers (retail box) or
online (for example, visit http://www.kaspersky.com and follow the E-Store link).
The retail box package includes:
• a sealed envelope with the installation CD containing the application files;
• User's Guide
• a license key written on the installation CD or on a special diskette;
• License Agreement
Before you open the envelope with the CD make sure that you have
carefully read the license agreement.
If you buy Kaspersky Anti-Virus online, you will have to download the application
from the Kaspersky Lab's website. In this case, the distribution kit will include this

Introduction 9
Guide along with the application. The license key will be e-mailed to you upon
the receipt of your payment.
License Agreement is a legal contract between you and Kaspersky Lab Ltd.,
which contains the terms and conditions, on which you may use the anti-virus
product you have purchased.
Read the License Agreement carefully!
If you do not agree with the terms of the license agreement, you can return
Kaspersky Anti-Virus to your dealer for a full refund. In this case, the envelope
with the installation CD must remain sealed.
By opening the sealed envelope containing the installation CD or by installing the
product on your computer you accept all terms and conditions of the License
Agreement.
1.5. Services provided for registered
users
Kaspersky Lab Ltd. offers to all legally registered users an extensive service
package enabling them to use Kaspersky Anti-Virus more efficiently.
After purchasing a subscription, you become a registered user and, during the
period of your subscription, you will be provided with the following services:
• you will be receiving new versions of the purchased software product;
• support on issues related to the installation, configuration and use of the
purchased software product. Services will be provided by phone or via
email;
• information about new Kaspersky Lab products and about new viruses
appearing worldwide (this service is provided to users who subscribe to
the Kaspersky Lab's newsletter).
Support on issues related to the performance and the use of operating
systems or other technologies is not provided.

10 Kaspersky Anti-Virus 5.5 for Lotus Notes/Domino
1.6. Conventions
Various formatting features and icons are used throughout this document
depending on the purpose and the meaning of the text. The table below lists
adopted conventions used in the text.
Format feature Meaning/Usage
Bold font Titles of menus, menu items, windows,
dialog boxes and their elements, etc.
Note.
Additional information, notes.
Attention!
Information requiring special attention.
1. Step 1.
2. …
In order to perform Description of the successive user's
steps and possible actions.
Task, example
Statement of a problem, example of the
demonstration of the application's
capabilities.
Solution
Implementation of the task.
[option] – option purpose. Command line modifiers.
Information messages and
command line text Text of configuration files, information
messages and command line

CHAPTER 2. INSTALLING AND
REMOVING THE
APPLICATION
Before the installation of Kaspersky Anti-Virus make sure that the software and
hardware of the destination computer used meet the installation requirements.
The minimum allowable system configuration is described in section 1.3 on page
7.
For installation and removal of Kaspersky Anti-Virus 5.5 for Lotus
Notes/Domino the local administrator's rights are required for the
computer on which the installation is performed and the Lotus
Notes/Domino administrator’s rights.
2.1. Installing the application
The installation procedure is standard, similar to that of most Microsoft Windows
applications.
In order to install Kaspersky Anti-Virus on your computer, run the executable file
on the installation CD included into the distribution package. The installation
process will be facilitated by the setup wizard. Following below is a detailed
discussion of each step of the application installation.
The process of installation from a distribution package received via the
Internet is completely identical to the installation from the installation
CD.
Step 1. Verifying the version of the installed operating
system
Before the application installation is started, a check will be performed to
determine whether your operating system and the Service Packs installed meet
the software requirements for the installation of Kaspersky Anti-Virus. If any of
the required service packs for the operating system is not installed, perform the
necessary updates and then restart Kaspersky Anti-Virus setup.

12 Kaspersky Anti-Virus 5.5 for Lotus Notes/Domino
Additionally, if any other anti-virus software for Lotus Notes/Domino is installed
on the computer, it may conflict with Kaspersky Anti-Virus. We recommend that
you manually uninstall such software before proceeding with the installation.
Step 2. Welcome screen and License Agreement
During first steps of the installation process the setup wizard displays its greeting
window and a window containing the License Agreement. Read the text of the
License Agreement carefully and accept the terms and conditions contained
therein to proceed with the installation.
Step 3. Entering user's information
Enter the user name in the User's information dialog box. By default the dialog
box will contain information substituted from the Microsoft Windows registry.
Step 4. Initiating the installation process
After the user settings are configured, start the actual installation process. In
order to do that, press the Install button in the wizard window.
Kaspersky Anti-Virus will be installed by default to the
<Drive>\Program Files\Kaspersky Lab\Kaspersky Anti-Virus for
Lotus Notes folder.
Step 5. Installing license key
During this step your license key for Kaspersky Anti-Virus for Lotus
Notes/Domino will be installed. The license key is your personal "key" that
contains all service information required for the full-featured functionality of the
application.
Press the Add button in the Installed license keys window that will open.
Specify the license key file (*.key) to be installed in the standard Windows file
selection dialog box. As a result, the selected license key will be installed as the
active license key for Kaspersky Anti-Virus. If, at the time of the installation, you
still do not have the license key (for example, you ordered it from Kaspersky Lab
via the Internet but have not received it yet), you can install it later when you run
the application for the first time. Note that without the license key you cannot
start using Kaspersky Anti-Virus.

Installing and removing the application 13
Step 6. Completing the setup
During this step the setup wizard displays its final dialog informing that the
installation procedure is complete.
Before you start using the application, you have to perform the post-installation
setup to ensure proper interaction between the product and Domino server (see
section 2.2 on page 13).
2.2. Post-installation setup
In order to ensure that your application works correctly after its setup
has been completed, you must sign certain Domino server databases
as follows:
• Make sure that you have the administrator rights for Lotus
Notes/Domino.
• Launch Domino Administrator.
• Connect to the server where Kaspersky Anti-Virus is installed.
• Switch to the Files tab.
• Select the databases of Kaspersky Anti-Virus (kldsettings.nsf
and kldquarantine.nsf) in the list of databases within the tab.
• Perform the Sign command for both databases.
The command should be performed using Active Server's ID
privileges.
2.3. Removing the application
You can remove Kaspersky Anti-Virus for Lotus Notes/Domino from your
computer using standard Microsoft Windows Add or Remove Programs tool. This
will remove all installed Kaspersky Anti-Virus components from your computer.
The application logs information about the installation process in the
%TEMP%\kav_lotus.log file.

14 Kaspersky Anti-Virus 5.5 for Lotus Notes/Domino
In order to uninstall Kaspersky Anti-Virus:
• Stop the Lotus Server.
• Use Microsoft Windows Control Panel to select Add or
Remove Programs→Kaspersky Anti-Virus for Lotus
Notes/Domino and click the Remove button.

CHAPTER 3. KASPERSKY ANTI-
VIRUS INTERNAL
ARCHITECTURE
Let us examine the internal architecture of Kaspersky Anti-Virus for more
thorough understanding of the algorithm used in its operation. In addition, the
section will be useful for detailed analysis of activity reports generated by each of
the application components.
Kaspersky Anti-Virus includes the following modules:
• Hook – e-mail messages interception module
• Kavmailmonitor – e-mail messages scanning module
• Kavdbscanner – database scanning module
• Kavreplmonitor – replications scanning module
• Kavupdater – application anti-virus database updating module
• The system detecting virus outbreaks.
During its operation, the application uses several databases located on the
server hard drive:
• Configuration database.
• Quarantine database.
• Statistical database and the application's run-time log.
The Kavreplmonitor, Kavupdater, Kavmailmonitor and Kavdbscanner
modules start automatically at the Domino server startup.
After the Hook module is started, it intercepts all e-mail messages sent and
received by the Domino server and passes them to the Kavmailmonitor module
for anti-virus scanning and processing.
After scanning an object can be recognized as clean, infected, suspicious or as
one unchecked because of a failure or its corruption.
The Kavmailmonitor module scans all received messages for viruses and
processes these messages based on the specified anti-virus protection settings.
For example, the module can attempt to disinfect all infected objects and place

16 Kaspersky Anti-Virus 5.5 for Lotus Notes/Domino
objects it failed to cure into the Quarantine database. Additionally, the
Kavmailmonitor module records its actions into the run-time log.
The Kavdbscanner module scans all Domino server databases using the
current settings and processes them depending on the anti-virus protection
settings. All functions and actions of this module are similar to the
Kavmailmonitor functions.
The Kavreplmonitor module prevents the server infection by replication of
documents from other Domino servers not protected by Kaspersky Anti-Virus.
Local replications performed within a Domino server will not be scanned.
The detection system provides protection against virus outbreaks. Outbreak
detection rules and criteria, as well as the possible actions to be performed once
an outbreak is detected, can be defined through the configuration database by
the administrator.
The Kavupdater module updates the anti-virus database used to detect and
disinfect viruses.
If settings have been modified, the Kavmailmonitor, Kavdbscanner,
KavReplMonitor and the KavUpdater modules will start using the new settings
virtually right after the settings are saved.
In cases when settings are modified in the notes.ini file, the
corresponding module starts using the updated values after its restart.

CHAPTER 4. CONFIGURING THE
ANTI-VIRUS PROTECTION
SYSTEM
Kaspersky Anti-Virus is ready for work immediately after its installation and
signing of the required databases. Its general settings are already specified.
Kaspersky Anti-Virus settings are configured locally using the administration
console of the application. Command line management is supported for some
basic tasks only (see section 5.5 on page 44 for details). This section is devoted
to product configuration within its administration console.
All settings are combined into groups for user convenience. Each group controls
specific features of the Anti-Virus. Groups consist of tasks pertaining to more
narrow aspects.
You can open individual task windows from the Tasks settings and Anti-virus
kernel groups in the viewing window of Kaspersky Anti-Virus console by clicking
the corresponding links.
4.1. General application settings
The General window of the Tasks settings group (see Figure 1) displays the
general operation settings of Kaspersky Anti-Virus:
• Temporary folder – full path to the temporary files folder used by
Kaspersky Anti-Virus during the scan. If your computer also runs an anti-
virus product monitoring the file system (e.g., Kaspersky Anti-Virus for
File Servers), you are advised to exclude that folder from its scanning
scope.
• Administrators – the list of e-mail addresses where notifications will be
sent.

18 Kaspersky Anti-Virus 5.5 for Lotus Notes/Domino
Figure 1. The General tab
4.2. Updating the anti-virus
databases
The anti-virus databases can be updated automatically with specified frequency
or manually by the administrator. Anti-virus databases can be retrieved from two
sources:
• Update servers of Kaspersky Lab.
• FTP or HTTP server or a local/network folder.
New anti-virus databases on updates servers of Kaspersky Lab are
made available every hour.
Updating of the anti-virus database can be configured in the Updates
configuration window of the Tasks settings group (see Figure 2). You can:
• Specify the database storage folders (main and backup folders).
• The backup folder is used to save the previous version of the anti-virus
database that allows you to restore the database in case of a copying
process failure.

Configuring the anti-virus protection system 19
• Specify the storage folder for temporary files used by the Kavupdater
module.
• Specify the sources of updates and database downloading settings.
• Define the source of updates from which the updates will be installed in
the Updates source section. The following resources can be used as the
updates source:
• HTTP, FTP server or a network folder – a local server or folder where
the administrator copies the updates downloaded from the Internet.
Specify the path to the folder in the Local folder entry field using the
Modify button.
• Kaspersky Lab's updates servers – Kaspersky Lab's HTTP and FTP
Internet servers, to which new updates are uploaded every hour.
• The Passive FTP mode option is used when you download updates from
an FTP server that requires connection in passive mode (e.g., through a
firewall). You can uncheck the box if active FTP mode is used.
• Enable the Use proxy server checkbox if you access the Internet via a
proxy server.
• Schedule the frequency of updates. In order to do this, specify the
frequency of copying the anti-virus database in the Schedule section:
• The Enable schedule checkbox enables application updates in
accordance with the specified schedule.
• Use the Frequency group of settings to choose one of the following
options:
• By days – the application will be updated once per specified
number of days. Select how often updating should be started by
defining the Ntime interval in the Every N day parameter.
• By hours – the interval between updates is specified in hours.
If you select that option, enable the Every N hour option and
define the N interval. E.g. for hourly updates set the parameter
to Every 1 hour.
• Start now – immediate manual update launch.
• During operation Kavupdater logs its status indicated using return codes
(the logs can be reviewed in the log.nsf database within the Data folder
of the Domino server).

20 Kaspersky Anti-Virus 5.5 for Lotus Notes/Domino
Figure 2. The Updates configuration tab
4.3. Replications scan settings
The Kavreplmonitor component of Kaspersky Anti-Virus provides for anti-virus
security of the replications that your server performs. Scanning settings can be
configured in the Replication settings window of the Tasks settings group (see
Figure 3).
You can enable the Objects to be scanned: checkbox to select the types of
objects to scan:
• Attached objects – scan all files attached to e-mail messages.
• Message body – scan the body of the message.
• OLE objects – scan for viruses all objects (e.g., text, graphical and sound
objects, etc.) embedded into a message.
You can exclude certain types of objects from the scan scope using the Filtering
by name and Filtering by type settings.
• Filtering by name means that filtered objects will be processed using
special rules defined on the Unit by name tab of the Actions window.