KAPERSKY ANTI-VIRUS 5.5 - FOR MICROSOFT EXCHANGE SERVER... Service manual

KASPERSKY LAB
Kaspersky Anti-Virus® 5.5
for Microsoft Exchange Server 2000/2003
Administrator's Guide

KASPERSKY ANTI-VIRUS® 5.5 FOR MICROSOFT
EXCHANGE SERVER 2000/2003
Administrator's
Guide
©Kaspersky Lab Ltd.
http://www.kaspersky.com
Revision date: June, 2005

Table of Contents
CHAPTER 1. INTRODUCTION ...................................................................................... 6
1.1. Computer viruses and malicious software............................................................ 6
1.2. The purpose and major functionality of Kaspersky Anti-Virus ............................. 8
1.3. What's new in version 5.5? ................................................................................. 10
1.4. Software system requirements ........................................................................... 11
1.5. Hardware system requirements.......................................................................... 12
1.6. Distribution kit ...................................................................................................... 13
1.7. Services provided for registered users ............................................................... 13
CHAPTER 2. OPERATION OF KASPERSKY ANTI-VIRUS....................................... 15
2.1. Security Server architecture................................................................................ 16
2.2. Deployment of anti-virus server protection ......................................................... 16
2.3. Anti-virus protection system maintenance.......................................................... 17
2.4. Application’s operation on a cluster of servers ................................................... 18
CHAPTER 3. INSTALLING, UPDATING AND REMOVING THE APPLICATION..... 20
3.1. Installing the application ...................................................................................... 20
3.1.1. First-time installation ..................................................................................... 21
3.1.2. Reinstalling the application........................................................................... 26
3.2. Upgrading to a new version ................................................................................ 27
3.3. Removing the application.................................................................................... 28
CHAPTER 4. STARTING USING THE APPLICATION............................................... 30
4.1. Starting the application........................................................................................ 30
4.2. Application interface ............................................................................................ 30
4.2.1. Main application window .............................................................................. 30
4.2.2. Shortcut menu .............................................................................................. 32
4.3. Creating the list of managed servers .................................................................. 33
4.4. Connecting the Management Console to the server ......................................... 34
4.5. Minimum required configuration.......................................................................... 35
4.6. Mail server protection without additional configuration....................................... 36
4.7. Verifying the application performance ................................................................ 38

4 Kaspersky Anti-Virus for Microsoft Exchange Server
4.7.1. Test “virus” EICAR and its modifications ..................................................... 38
4.7.2. Testing the correct operation of the application........................................... 39
CHAPTER 5. ANTI-VIRUS PROTECTION .................................................................. 41
5.1. Anti-virus protection levels................................................................................... 43
5.2. Enabling and disabling the anti-virus server protection. Selecting anti-virus
protection level. .................................................................................................. 45
5.3. Scanning attachments......................................................................................... 47
5.4. Actions to be performed on infected objects ...................................................... 51
5.5. Anti-virus protection efficiency............................................................................. 56
5.6. Background scan................................................................................................. 58
CHAPTER 6. UPDATING THE ANTI-VIRUS DATABASE.......................................... 61
6.1. Downloading updates from the internet.............................................................. 62
6.2. Downloading updates from a shared network folder ......................................... 64
6.3. Automatic updates............................................................................................... 66
6.4. Manual updating .................................................................................................. 67
CHAPTER 7. BACKUP COPYING ............................................................................... 68
7.1. Viewing backup storage...................................................................................... 69
7.2. Backup storage filter............................................................................................ 70
7.3. Restoring objects from the backup storage........................................................ 72
7.4. Sending objects for analysis ............................................................................... 74
7.5. Deleting objects from the backup storage .......................................................... 75
7.6. Configuring the backup storage settings ............................................................ 75
CHAPTER 8. NOTIFICATIONS .................................................................................... 78
8.1. Viewing and editing notification parameters....................................................... 79
8.2. Creating a notification template........................................................................... 82
CHAPTER 9. PREVENTING VIRUS OUTBREAKS.................................................... 86
9.1. Viewing and modifying virus outbreak notification settings................................ 88
9.2. Creating a new virus outbreak counter............................................................... 90
CHAPTER 10. REPORTS............................................................................................. 95
10.1. Receiving reports............................................................................................... 97
10.1.1. Viewing and modifying the report templates.............................................. 98
10.1.2. Creating a report template........................................................................ 101
10.2. Viewing reports................................................................................................ 104

Table of Contents 5r
CHAPTER 11. APPLICATION’S EVENTS LOGS ..................................................... 108
11.1. Configuring the diagnostics level .................................................................... 109
11.2. Configuring logs settings................................................................................. 111
CHAPTER 12. LICENSE KEYS.................................................................................. 112
12.1. License information ......................................................................................... 114
12.2. License key details .......................................................................................... 116
12.3. License-related notifications............................................................................ 118
12.4. Installing the license key ................................................................................. 119
12.5. Removing a license key .................................................................................. 120
12.6. Unprotected storage areas ............................................................................. 120
CHAPTER 13. FREQUENTLY ASKED QUESTIONS............................................... 123
APPENDIX A. TABLE OF SUBSTITUTION MACROS .................................... 126
APPENDIX B. GLOSSARY................................................................................ 128
APPENDIX C. KASPERSKY LAB...................................................................... 132
C.1. Other Kaspersky Lab Products ....................................................................... 133
C.2. Contact Us........................................................................................................ 137
APPENDIX D. LICENSE AGREEMENT............................................................ 138

CHAPTER 1. INTRODUCTION
The main source of viruses today is the global Internet. Most cases of the virus
infection happen through the use of e-mail. The facts that almost every computer
has e-mail client applications installed and that malicious programs are able to
take a full advantage of software address book in order to find new victims are
favorable factors for the distribution of malware. Without even suspecting it, the
user of an infected computer is sending infected e-mail messages to his or her
contacts, who, in turn, send new waves of infected messages and so on. It is not
uncommon when infected files, due to someone's negligence, enter commercial
mailing lists of large companies. In this case, the virus will affect not just five, but
hundreds or even thousands recipients of such mailings who then will send
infected files to dozens thousands of their contacts.
Apart from the threat of virus or malware infection, there is a problem of
unsolicited e-mail messages and misuse of the internet resources. Not being a
direct threat by itself, unsolicited e-mail messages (SPAM) cause the loss of
working time and inflict serious financial losses.
Additionally, it is to be noted that the newest malicious programs use the so-
called spamming technologies for efficient mass distribution and the methods of
social psychology to make the user open the message, etc. Therefore, SPAM
filtering is important not only for convenience, but also in order to protect your
computer against some new types of viruses.
It is now acknowledged that for some companies information has become a more
important asset than its physical property or cash. At the same time, in order to
gain profit through the use of the information, it has to be available to the
company's employees, clients and partners. This raises the issue of data security
and, as its important element, the issue of protection of the corporate mail
servers against the external threats, preventing virus outbreaks within the
corporate networks and filtering out the unsolicited correspondence.
1.1. Computer viruses and malicious
software
As the number of computer users grows and the exchange of information via the
Internet and email increases in volume, there is an increased threat of computer
virus infection and data corruption or capture by malicious computer programs or
malware.

Introduction 7
In order to be aware of potential threats to your computer, it is helpful to know
what the types of malicious software (“malware”) are and how they work. In
general, malicious programs fall into one of the following three categories:
• Worms use network protection vulnerabilities for distribution. These pro-
grams were called "worms" because of their ability to tunnel from one
computer to another, using networks, email and other channels. Due to
this ability, worms can spread extremely fast.
Worms penetrate a computer, determine IP addresses of other
computers, and send copies of themselves to these computers. Worms
also utilize data contained in the address books of mail clients installed on
the infected machine for sending infected messages. They can create
work files on disks but may not utilize any resources of the infected
computer except memory.
Penetration of a worm is a preliminary stage that is often followed by
penetration of other malicious programs into the infected computer. For
example, a worm may identify some vulnerabilities that Trojans will use
later to penetrate the computer.
• Viruses infect computer programs by altering the way that infected pro-
grams work to gain control over the infected files when such files are run.
This simple definition helps determine that the main action a virus per-
forms is infecting computer programs. Viruses spread somewhat slower
than worms.
• Trojan horses perform unauthorized actions on infected computers: for
instance, they can erase information on hard drives, "freeze" the system,
steal confidential information. In the strict sense, Trojan Horses are not vi-
ruses as they do not infect programs or data, and are unable to sneak in-
dependently into computers but are distributed by malicious users as
"useful" software. Still the damage inflicted by Trojans may be far greater
than from a regular virus attack.
Recently, worms have become the most widespread type of malware, followed
by viruses and Trojans. Some malicious computer programs have characteristics
of two or even all three of the above categories.
The following potentially dangerous types of malware have also become
widespread:
Adware – code that, without the user's knowledge, is included into a program's
code in order to display advertising messages. As a rule, adware is
integrated into freeware programs. The advertising component is located in
the interface. Adware programs are often used to gather users' personal
information and send it to the developer, change browser's settings
(browser's home page, search page, security levels, etc.) and create traffic
that is not controlled by the user. All this may lead to the infringement of the
security policy and further to direct financial losses.

8 Kaspersky Anti-Virus for Microsoft Exchange Server
Riskware – programs that are not supposed to perform any malicious functions,
but contain security breaches and errors and therefore can be used by
intruders as an auxiliary component of a malicious program. This type of
software includes, for example remote administration programs, IRC client
programs, FTP programs and various utilities used for ending or hiding
running processes.
Spyware – software used to obtain unauthorized access to user's data, tracking
actions performed on this computer, gathering information about the
contents of the hard drive. Such programs help the intruder not only gather
information, but also gain control over the user's computer. Spyware
programs are often distributed along with freeware and installed on the
user's computer without the user's knowledge. This type of software includes
keyboard spies, password hacking programs and software used for
gathering confidential information (for example credit card numbers).
Automatic dialers (Pornware) – programs that establish modem connection with
various pay-per-visit internet (as a rule, pornographic) resources
Hacking tools –tools used by hackers to obtain access to the user's computer.
This type of software includes various illegal vulnerability scanners,
password hacking programs and other types of software used for hacking
network resources or for obtaining unauthorized access to the system under
attack.
Although malicious programs are distributed mainly via email and the Internet, a
floppy disk or a CD can also be a source of infection. Therefore, the task of
comprehensive protection from potential threats now extends far beyond simple
regular scans for viruses, and includes the more complex task of real-time anti-
virus protection.
Henceforth in the text of this User's Guide the term "virus" will be used
to refer to viruses, Trojan Horses, worms and potentially dangerous
programs and the term “dangerous objects” will be used to refer to
objects infected with them. A particular type of malware will be
mentioned only when it is required.
1.2. The purpose and major
functionality of Kaspersky Anti-
Virus
Kaspersky Anti-Virus 5.5 for Microsoft Exchange Server 2000/2003 (hereinafter
referred to as Kaspersky Anti-Virus) is designed to ensure the anti-virus
protection of mail boxes and public folders located at Microsoft Exchange Server
2000/2003 (hereinafter referred to as Microsoft Exchange Server).

Introduction 9
The major functionality of Kaspersky Anti-Virus includes:
• scanning and analyzing incoming and outgoing e-mail messages for the
presence of malicious objects. This analysis covers all attributes and at-
tachments of the e-mail message being scanned.
• processing attributes and attachments of the e-mail message.Depending
on the settings selected, the application will disinfect or delete a malicious
object or will add a warning message to such objects.
• saving backup copies of the message's objects before an attempt to disin-
fect or delete such object; copies are saved to a special storage for the
consequent restoring which prevents the loss of data. Configurable filters
allow to easily locate the original copies of objects.
• notifying the sender, the recipient and the system administrator about a
message that contains a malicious object.
• maintaining the events log and creating regular reports about the opera-
tion of the application and the status of the anti-virus protection. The appli-
cation allows to create reports using built-in templates with the required
level of detail and at the required interval.
• detecting virus outbreaks as they emerge and notifying about such events.
The application identifies attempts of mass-mailing infected messages
both from the internet and from the computers within the corporate net-
work.
• configuring application settings depending on the intensity and the nature
of the traffic as well as the characteristics of the hardware installed
(amount of RAM, speed, number of processors, etc.) both in the manual
and in the automatic mode.
• updating the anti-virus database via internet both in the manual and in the
automatic mode. The anti-virus database can be updated from the
Kaspersky Lab's ftp and http servers.
Anti-virus scan and disinfection of infected objects are per-
formed based on the records of the anti-virus database that
contains description of all currently known viruses, methods
used for the disinfection of objects infected with these viruses
and description of potentially dangerous software.
As new viruses appear daily, it is very important to keep your
anti-virus database up-to-date.
The anti-virus database at the Kaspersky Lab's servers is
updated on an hourly basis. We recommend that you up-
date the anti-virus database used by your application with the
same frequency (see Chapter 6, page 61).
• scanning old (previously scanned) messages for the presence of new vi-
ruses each time your anti-virus database is updated or according to the

10 Kaspersky Anti-Virus for Microsoft Exchange Server
schedule. This task is performed as a background scan and does not
have any considerable effect on the performance of the mail server.
• creating the list of protected storage areas, which offers additional flexibil-
ity in regards with license restrictions on the number of protected mail
boxes.
• managing license keys.
Kaspersky Anti-Virus 5.5 for Microsoft Exchange Server includes the following
components:
• Security server that provides the anti-virus functionality and updating of
the anti-virus database and includes administrative services for remote
management, configuring and ensuring the integrity of the application and
of the data stored.
• Management Console that provides the user interface for managing the
administrative services of the application and allows to install the applica-
tion, configure settings and manage the server component. The manage-
ment module is implemented as the extension of the Microsoft Manage-
ment Console (MMC).
1.3. What's new in version 5.5?
Kaspersky Anti-Virus 5.5 for Microsoft Exchange Server has the following distinc-
tions from the previous version:
• Completely revised intuitive graphical interface implemented according to
the MMC (Microsoft Management Console) standards. Using the new in-
terface, the administrator can start using the application without the need
to configure any preliminary settings; this interface also offers a wide
range of options for configuring the customized application management
environment that can be adapted to the conditions of any particular corpo-
rate network to the maximum possible extent.
• The use of extended anti-virus database allows protecting your mail
server not only against malicious software, but also against potentially
dangerous software, such as adware, automatic dialing programs that
connect the user's computer to commercial internet sites, hacking pro-
grams or joke programs.
• An option of selecting the anti-virus protection level has been imple-
mented to enable the administrator to adjust the e-mail flow security level
and the load on the server during the scan.
• Saving backup copies of objects before disinfection, deletion or renaming
allows to restore objects or to send them to Kaspersky Lab for analysis.
The possibility to create and use customized filters simplifies the search
for information you need.