KAPERSKY ANTI-VIRUS 5.5 - FOR MICROSOFT EXCHANGE SERVER... Service manual

KASPERSKY LAB
Kaspersky Anti-Virus® 5.5
for Microsoft Exchange Server 2000/2003
Administrator's Guide

KASPERSKY ANTI-VIRUS® 5.5 FOR MICROSOFT
EXCHANGE SERVER 2000/2003
Administrator's
Guide
©Kaspersky Lab Ltd.
http://www.kaspersky.com
Revision date: June, 2005

Table of Contents
CHAPTER 1. INTRODUCTION ...................................................................................... 6
1.1. Computer viruses and malicious software............................................................ 6
1.2. The purpose and major functionality of Kaspersky Anti-Virus ............................. 8
1.3. What's new in version 5.5? ................................................................................. 10
1.4. Software system requirements ........................................................................... 11
1.5. Hardware system requirements.......................................................................... 12
1.6. Distribution kit ...................................................................................................... 13
1.7. Services provided for registered users ............................................................... 13
CHAPTER 2. OPERATION OF KASPERSKY ANTI-VIRUS....................................... 15
2.1. Security Server architecture................................................................................ 16
2.2. Deployment of anti-virus server protection ......................................................... 16
2.3. Anti-virus protection system maintenance.......................................................... 17
2.4. Application’s operation on a cluster of servers ................................................... 18
CHAPTER 3. INSTALLING, UPDATING AND REMOVING THE APPLICATION..... 20
3.1. Installing the application ...................................................................................... 20
3.1.1. First-time installation ..................................................................................... 21
3.1.2. Reinstalling the application........................................................................... 26
3.2. Upgrading to a new version ................................................................................ 27
3.3. Removing the application.................................................................................... 28
CHAPTER 4. STARTING USING THE APPLICATION............................................... 30
4.1. Starting the application........................................................................................ 30
4.2. Application interface ............................................................................................ 30
4.2.1. Main application window .............................................................................. 30
4.2.2. Shortcut menu .............................................................................................. 32
4.3. Creating the list of managed servers .................................................................. 33
4.4. Connecting the Management Console to the server ......................................... 34
4.5. Minimum required configuration.......................................................................... 35
4.6. Mail server protection without additional configuration....................................... 36
4.7. Verifying the application performance ................................................................ 38

4 Kaspersky Anti-Virus for Microsoft Exchange Server
4.7.1. Test “virus” EICAR and its modifications ..................................................... 38
4.7.2. Testing the correct operation of the application........................................... 39
CHAPTER 5. ANTI-VIRUS PROTECTION .................................................................. 41
5.1. Anti-virus protection levels................................................................................... 43
5.2. Enabling and disabling the anti-virus server protection. Selecting anti-virus
protection level. .................................................................................................. 45
5.3. Scanning attachments......................................................................................... 47
5.4. Actions to be performed on infected objects ...................................................... 51
5.5. Anti-virus protection efficiency............................................................................. 56
5.6. Background scan................................................................................................. 58
CHAPTER 6. UPDATING THE ANTI-VIRUS DATABASE.......................................... 61
6.1. Downloading updates from the internet.............................................................. 62
6.2. Downloading updates from a shared network folder ......................................... 64
6.3. Automatic updates............................................................................................... 66
6.4. Manual updating .................................................................................................. 67
CHAPTER 7. BACKUP COPYING ............................................................................... 68
7.1. Viewing backup storage...................................................................................... 69
7.2. Backup storage filter............................................................................................ 70
7.3. Restoring objects from the backup storage........................................................ 72
7.4. Sending objects for analysis ............................................................................... 74
7.5. Deleting objects from the backup storage .......................................................... 75
7.6. Configuring the backup storage settings ............................................................ 75
CHAPTER 8. NOTIFICATIONS .................................................................................... 78
8.1. Viewing and editing notification parameters....................................................... 79
8.2. Creating a notification template........................................................................... 82
CHAPTER 9. PREVENTING VIRUS OUTBREAKS.................................................... 86
9.1. Viewing and modifying virus outbreak notification settings................................ 88
9.2. Creating a new virus outbreak counter............................................................... 90
CHAPTER 10. REPORTS............................................................................................. 95
10.1. Receiving reports............................................................................................... 97
10.1.1. Viewing and modifying the report templates.............................................. 98
10.1.2. Creating a report template........................................................................ 101
10.2. Viewing reports................................................................................................ 104

Table of Contents 5r
CHAPTER 11. APPLICATION’S EVENTS LOGS ..................................................... 108
11.1. Configuring the diagnostics level .................................................................... 109
11.2. Configuring logs settings................................................................................. 111
CHAPTER 12. LICENSE KEYS.................................................................................. 112
12.1. License information ......................................................................................... 114
12.2. License key details .......................................................................................... 116
12.3. License-related notifications............................................................................ 118
12.4. Installing the license key ................................................................................. 119
12.5. Removing a license key .................................................................................. 120
12.6. Unprotected storage areas ............................................................................. 120
CHAPTER 13. FREQUENTLY ASKED QUESTIONS............................................... 123
APPENDIX A. TABLE OF SUBSTITUTION MACROS .................................... 126
APPENDIX B. GLOSSARY................................................................................ 128
APPENDIX C. KASPERSKY LAB...................................................................... 132
C.1. Other Kaspersky Lab Products ....................................................................... 133
C.2. Contact Us........................................................................................................ 137
APPENDIX D. LICENSE AGREEMENT............................................................ 138

CHAPTER 1. INTRODUCTION
The main source of viruses today is the global Internet. Most cases of the virus
infection happen through the use of e-mail. The facts that almost every computer
has e-mail client applications installed and that malicious programs are able to
take a full advantage of software address book in order to find new victims are
favorable factors for the distribution of malware. Without even suspecting it, the
user of an infected computer is sending infected e-mail messages to his or her
contacts, who, in turn, send new waves of infected messages and so on. It is not
uncommon when infected files, due to someone's negligence, enter commercial
mailing lists of large companies. In this case, the virus will affect not just five, but
hundreds or even thousands recipients of such mailings who then will send
infected files to dozens thousands of their contacts.
Apart from the threat of virus or malware infection, there is a problem of
unsolicited e-mail messages and misuse of the internet resources. Not being a
direct threat by itself, unsolicited e-mail messages (SPAM) cause the loss of
working time and inflict serious financial losses.
Additionally, it is to be noted that the newest malicious programs use the so-
called spamming technologies for efficient mass distribution and the methods of
social psychology to make the user open the message, etc. Therefore, SPAM
filtering is important not only for convenience, but also in order to protect your
computer against some new types of viruses.
It is now acknowledged that for some companies information has become a more
important asset than its physical property or cash. At the same time, in order to
gain profit through the use of the information, it has to be available to the
company's employees, clients and partners. This raises the issue of data security
and, as its important element, the issue of protection of the corporate mail
servers against the external threats, preventing virus outbreaks within the
corporate networks and filtering out the unsolicited correspondence.
1.1. Computer viruses and malicious
software
As the number of computer users grows and the exchange of information via the
Internet and email increases in volume, there is an increased threat of computer
virus infection and data corruption or capture by malicious computer programs or
malware.

Introduction 7
In order to be aware of potential threats to your computer, it is helpful to know
what the types of malicious software (“malware”) are and how they work. In
general, malicious programs fall into one of the following three categories:
• Worms use network protection vulnerabilities for distribution. These pro-
grams were called "worms" because of their ability to tunnel from one
computer to another, using networks, email and other channels. Due to
this ability, worms can spread extremely fast.
Worms penetrate a computer, determine IP addresses of other
computers, and send copies of themselves to these computers. Worms
also utilize data contained in the address books of mail clients installed on
the infected machine for sending infected messages. They can create
work files on disks but may not utilize any resources of the infected
computer except memory.
Penetration of a worm is a preliminary stage that is often followed by
penetration of other malicious programs into the infected computer. For
example, a worm may identify some vulnerabilities that Trojans will use
later to penetrate the computer.
• Viruses infect computer programs by altering the way that infected pro-
grams work to gain control over the infected files when such files are run.
This simple definition helps determine that the main action a virus per-
forms is infecting computer programs. Viruses spread somewhat slower
than worms.
• Trojan horses perform unauthorized actions on infected computers: for
instance, they can erase information on hard drives, "freeze" the system,
steal confidential information. In the strict sense, Trojan Horses are not vi-
ruses as they do not infect programs or data, and are unable to sneak in-
dependently into computers but are distributed by malicious users as
"useful" software. Still the damage inflicted by Trojans may be far greater
than from a regular virus attack.
Recently, worms have become the most widespread type of malware, followed
by viruses and Trojans. Some malicious computer programs have characteristics
of two or even all three of the above categories.
The following potentially dangerous types of malware have also become
widespread:
Adware – code that, without the user's knowledge, is included into a program's
code in order to display advertising messages. As a rule, adware is
integrated into freeware programs. The advertising component is located in
the interface. Adware programs are often used to gather users' personal
information and send it to the developer, change browser's settings
(browser's home page, search page, security levels, etc.) and create traffic
that is not controlled by the user. All this may lead to the infringement of the
security policy and further to direct financial losses.

8 Kaspersky Anti-Virus for Microsoft Exchange Server
Riskware – programs that are not supposed to perform any malicious functions,
but contain security breaches and errors and therefore can be used by
intruders as an auxiliary component of a malicious program. This type of
software includes, for example remote administration programs, IRC client
programs, FTP programs and various utilities used for ending or hiding
running processes.
Spyware – software used to obtain unauthorized access to user's data, tracking
actions performed on this computer, gathering information about the
contents of the hard drive. Such programs help the intruder not only gather
information, but also gain control over the user's computer. Spyware
programs are often distributed along with freeware and installed on the
user's computer without the user's knowledge. This type of software includes
keyboard spies, password hacking programs and software used for
gathering confidential information (for example credit card numbers).
Automatic dialers (Pornware) – programs that establish modem connection with
various pay-per-visit internet (as a rule, pornographic) resources
Hacking tools –tools used by hackers to obtain access to the user's computer.
This type of software includes various illegal vulnerability scanners,
password hacking programs and other types of software used for hacking
network resources or for obtaining unauthorized access to the system under
attack.
Although malicious programs are distributed mainly via email and the Internet, a
floppy disk or a CD can also be a source of infection. Therefore, the task of
comprehensive protection from potential threats now extends far beyond simple
regular scans for viruses, and includes the more complex task of real-time anti-
virus protection.
Henceforth in the text of this User's Guide the term "virus" will be used
to refer to viruses, Trojan Horses, worms and potentially dangerous
programs and the term “dangerous objects” will be used to refer to
objects infected with them. A particular type of malware will be
mentioned only when it is required.
1.2. The purpose and major
functionality of Kaspersky Anti-
Virus
Kaspersky Anti-Virus 5.5 for Microsoft Exchange Server 2000/2003 (hereinafter
referred to as Kaspersky Anti-Virus) is designed to ensure the anti-virus
protection of mail boxes and public folders located at Microsoft Exchange Server
2000/2003 (hereinafter referred to as Microsoft Exchange Server).

Introduction 9
The major functionality of Kaspersky Anti-Virus includes:
• scanning and analyzing incoming and outgoing e-mail messages for the
presence of malicious objects. This analysis covers all attributes and at-
tachments of the e-mail message being scanned.
• processing attributes and attachments of the e-mail message.Depending
on the settings selected, the application will disinfect or delete a malicious
object or will add a warning message to such objects.
• saving backup copies of the message's objects before an attempt to disin-
fect or delete such object; copies are saved to a special storage for the
consequent restoring which prevents the loss of data. Configurable filters
allow to easily locate the original copies of objects.
• notifying the sender, the recipient and the system administrator about a
message that contains a malicious object.
• maintaining the events log and creating regular reports about the opera-
tion of the application and the status of the anti-virus protection. The appli-
cation allows to create reports using built-in templates with the required
level of detail and at the required interval.
• detecting virus outbreaks as they emerge and notifying about such events.
The application identifies attempts of mass-mailing infected messages
both from the internet and from the computers within the corporate net-
work.
• configuring application settings depending on the intensity and the nature
of the traffic as well as the characteristics of the hardware installed
(amount of RAM, speed, number of processors, etc.) both in the manual
and in the automatic mode.
• updating the anti-virus database via internet both in the manual and in the
automatic mode. The anti-virus database can be updated from the
Kaspersky Lab's ftp and http servers.
Anti-virus scan and disinfection of infected objects are per-
formed based on the records of the anti-virus database that
contains description of all currently known viruses, methods
used for the disinfection of objects infected with these viruses
and description of potentially dangerous software.
As new viruses appear daily, it is very important to keep your
anti-virus database up-to-date.
The anti-virus database at the Kaspersky Lab's servers is
updated on an hourly basis. We recommend that you up-
date the anti-virus database used by your application with the
same frequency (see Chapter 6, page 61).
• scanning old (previously scanned) messages for the presence of new vi-
ruses each time your anti-virus database is updated or according to the

10 Kaspersky Anti-Virus for Microsoft Exchange Server
schedule. This task is performed as a background scan and does not
have any considerable effect on the performance of the mail server.
• creating the list of protected storage areas, which offers additional flexibil-
ity in regards with license restrictions on the number of protected mail
boxes.
• managing license keys.
Kaspersky Anti-Virus 5.5 for Microsoft Exchange Server includes the following
components:
• Security server that provides the anti-virus functionality and updating of
the anti-virus database and includes administrative services for remote
management, configuring and ensuring the integrity of the application and
of the data stored.
• Management Console that provides the user interface for managing the
administrative services of the application and allows to install the applica-
tion, configure settings and manage the server component. The manage-
ment module is implemented as the extension of the Microsoft Manage-
ment Console (MMC).
1.3. What's new in version 5.5?
Kaspersky Anti-Virus 5.5 for Microsoft Exchange Server has the following distinc-
tions from the previous version:
• Completely revised intuitive graphical interface implemented according to
the MMC (Microsoft Management Console) standards. Using the new in-
terface, the administrator can start using the application without the need
to configure any preliminary settings; this interface also offers a wide
range of options for configuring the customized application management
environment that can be adapted to the conditions of any particular corpo-
rate network to the maximum possible extent.
• The use of extended anti-virus database allows protecting your mail
server not only against malicious software, but also against potentially
dangerous software, such as adware, automatic dialing programs that
connect the user's computer to commercial internet sites, hacking pro-
grams or joke programs.
• An option of selecting the anti-virus protection level has been imple-
mented to enable the administrator to adjust the e-mail flow security level
and the load on the server during the scan.
• Saving backup copies of objects before disinfection, deletion or renaming
allows to restore objects or to send them to Kaspersky Lab for analysis.
The possibility to create and use customized filters simplifies the search
for information you need.

Introduction 11
• The facility used for detecting virus outbreaks and for issuing notifications
about such events allows to react to emergency situations in a timely fash-
ion and to take timely measures aimed at the enhancement of the anti-
virus protection of your mail server.
• A new feature has been added that allow user to scale the application
based on the number of processors installed on the computer of the pro-
tected server. In order to enhance the efficiency of the application (in-
creasing the number of objects that can be analyzed at the same time)
several instances of the anti-virus kernel can be launched and run simul-
taneously.
• Memory object scanning capability has been expanded. Using scan set-
tings configurations it is now possible to analyze up to 8 objects up to 1
MB each at the same time in RAM without using the disk subsystem,
which results in a considerable increase in the application's efficiency.
• The logging capability has been drastically improved. Now this system al-
lows setting up the degree of completeness of the data stored in the logs
as well as the extent of detail of these data. Log viewing feature is imple-
mented using the standard Microsoft Windows Events viewing applica-
tion.
• This version includes a possibility to regularly create extended reports
about the status of the anti-virus protection. Reports can be created either
in the automatic mode or at the administrator's request. The reports main-
taining system ensures fast, convenient and consistent method of access-
ing information using standard tools, as, for example, Microsoft Internet
Explorer. The possibility to send reports by e-mail has been provided.
• A new feature has been added for notifying users about the detection of
infected and suspicious objects and about virus outbreaks threats, using
NET Send network tool.
1.4. Software system requirements
Requirements to protected Microsoft Exchange 2000 Server Enterprise
Edition:
• Microsoft Windows Server 2000 with Service Pack 4 installed or higher or
Microsoft Windows 2000 Advanced Server with Service Pack 4 installed
or higher;
• Microsoft Exchange 2000 Server Enterprise Edition with Service Pack 2
installed or higher.

12 Kaspersky Anti-Virus for Microsoft Exchange Server
Requirements to protected Microsoft Exchange 2000 Server Standard
Edition:
• Microsoft Windows Server 2000 with Service Pack 4 installed or higher or
Microsoft Windows 2000 Advanced Server Service Pack 4 installed or
higher;
• Microsoft Exchange 2000 Server Standard Edition.
Requirements to protected Microsoft Exchange 2003 Server Enterprise
Edition:
• Microsoft Windows Server 2000 with Service Pack 4 installed or higher /
Microsoft Windows 2000 Advanced Server with Service Pack 4 and higher
installed or higher / Windows Server 2003 Standard Edition and higher /
Windows Server 2003 Enterprise Edition and higher;
• Microsoft Exchange 2003 Enterprise Edition Server and higher.
Requirements to protected Microsoft Exchange Server 2003 Standard
Edition:
• Microsoft Windows Server 2000 with Service Pack 4 installed or higher /
Microsoft Windows 2000 Advanced Server with Service Pack 4 installed
or higher / Microsoft Windows Server 2003 Standard Edition and higher /
Microsoft Windows Server 2003 Enterprise Edition and higher;
• Microsoft Exchange 2003 Standard Edition Server and higher.
Requirements to the computer from which the application management will
be performed:
• OS Microsoft Windows 2000 with Service Pack 4 installed or higher / Mi-
crosoft Windows XP / Microsoft Windows 2003 with ММС version 1.2 or
higher.
• Active Directory Service Interfaces (ADSI) 2.5 or Active Directory Client
Extensions (Microsoft Windows 2000 or higher automatically complies
with this requirement).
1.5. Hardware system requirements
• Intel Pentium 300 MHz or higher;
• about 256 MB free RAM;
• about 20 MB free disk space for the application files (in addition to the size
of the backup storage and other service folders).

Introduction 13
1.6. Distribution kit
You can purchase Kaspersky Anti-Virus from our dealers (retail box) or online
(for example, you may visit www.kaspersky.com and follow the E-Store link).
The retail box package includes:
• a sealed envelope with the installation CD containing the application files;
• User's Guide
• a license key written on a special disk;
• License Agreement
Before you open the envelope with the CD make sure that you have
carefully read the license agreement..
If you buy Kaspersky Anti-Virus online, you will download the application from the
Kaspersky Lab's website. In this case, the distribution kit will include this Guide
along with the application. The license key will be e-mailed to you upon the
receipt of your payment.
License Agreement is a legal contract between you and Kaspersky Lab Ltd.
which contains the terms and conditions on which you may use the anti-virus
product which you have purchased.
Read the License Agreement carefully!
If you do not agree with the terms of this License Agreement, you can return the
box with Kaspersky Anti-Virus to the dealer you purchased it from for a full refund
provided that the envelope with the installation CD remained sealed.
By opening the envelope containing the installation CD or by installing the
product on your computer you accept all terms and conditions of the License
Agreement.
1.7. Services provided for registered
users
Kaspersky Lab Ltd. offers to all legally registered users an extensive service
package enabling them to use Kaspersky Anti-Virus more efficiently .
After purchasing a subscription, you become a registered user and, during the
period of your subscription, you will be provided with the following services:
• you will be receiving new versions of the purchased software product;

14 Kaspersky Anti-Virus for Microsoft Exchange Server
• support on issues related to the installation, configuration and use of the
purchased software product. Services will be provided by phone or via
email;
• information about new Kaspersky Lab products and about new viruses
appearing worldwide (this service is provided to users who subscribe to
the Kaspersky Lab's newsletter).
Support on issues related to the performance and the use of operating
systems or other technologies is not provided.

CHAPTER 2. OPERATION OF
KASPERSKY ANTI-VIRUS
Kaspersky Anti-Virus scans and, if it is possible, disinfects all incoming, outgoing
e-mail messages as well as messages stored at the server. The application
analyzes the body of the message and attached files of any format.
The scan for the viruses and the disinfection of infected objects are performed
based on the records in the anti-virus database that is updated by Kaspersky Lab
on a regular basis and contains description and the methods of disinfection of all
currently known malicious programs, joke programs, potentially dangerous
software and programs that are not potentially dangerous, but may be a part of
the software used for development of such software.
The application performs a real-time scan of all e-mail messages arriving to the
server. Before the message is scanned it cannot be viewed.
E-mail messages stored at the server and the content of all public folders are
scanned each time the anti-virus database is updated or according to the
schedule. The scan may identify new viruses that were not described in the anti-
virus database at the time when previous scans were performed. This task is
performed as a background scan and does not have any effect on the
performance of the mail server. If the user requests a message that has not been
scanned with the updated anti-virus database, such message will be scanned
prior to the delivery to the user. Thus, the user will always receive e-mail
messages that have been analyzed using the latest version of the anti-virus
database, no matter when a particular message arrived to the server.
The application processes each object according to its current settings: it
disinfects or deletes the infected object from the message, replacing it with the
corresponding notification. The administrator may select a mode in which the
application will deliver messages with infected objects to the user, although it will
modify the object's name by adding information about the virus to it and change
the object's extension.
Before processing an object, the application can save a copy of this object in a
special backup storage for the consequent restoring or sending to Kaspersky
Labs for analysis.
The program sends notifications about detected viruses to the administrator, to
the recipient and to the sender of the infected message and enters corresponding
records into the Windows application log and into the application's internal logs.
If the virus outbreaks detection tool is enabled, the application registers the virus
activity level and sends notifications about a new virus outbreak threat or enters

16 Kaspersky Anti-Virus for Microsoft Exchange Server
corresponding records into the Windows application log and into the application's
internal logs.
2.1. Security Server architecture
The server component of the application, Security Server, consists of the
following subsystems:
• E-mail Interceptor – this component intercepts objects arriving to Micro-
soft Exchange Server and forwards them to the anti-virus scan subsys-
tem. It is integrated into the Microsoft Exchange Server processes using
VSAPI 2.0 and 2.5 technologies.
• Anti-virus Scan Subsystem performs anti-virus scan of objects. This
component includes several processes with one anti-virus kernel per
process. The anti-virus scan subsystem also includes a storage of tempo-
rary objects for scanning objects in RAM. The storage is located in work-
ing folder Store that is created in the installation folder and must be ex-
cluded from the scan scope of Kaspersky Anti-Virus for Windows File
Servers or of other anti-virus applications.
• The Internal Application Management and Integrity Control Module is
launched in a separate process and is an Microsoft Windows service. This
service is launched automatically and does not depend on the state of Mi-
crosoft Exchange Server (started, stopped) which allows configuring the
application even if Microsoft Exchange Server is stopped. For the correct
operation of the application, the Internal Application Management Mod-
ule must always be running; stopping this service manually is not recom-
mended.
2.2. Deployment of anti-virus server
protection
In order to create the mail servers anti-virus protection system, using
Kaspersky Anti-Virus 5.5 for Microsoft Exchange Server, perform the
following:
1. Install the Security Server component on all protected Exchange
servers. The installation shall be performed from the distribution kit
individually for each server.
2. Install the Management Console on a computer within the
corporate network. The Management Console provides a centralized
access to all network resources from a single administrator's

Operation of Kaspersky Anti-Virus 17
workstation; therefore, it can be installed on one computer only.
However, if several administrators are working jointly, the
Management Console can be installed to each administrator's
computer.
If the Management Console is not installed, the application
will function within the default limitations and using the default
settings(see para 4.6, page 36).
The anti-virus protection of the server will be enabled auto-
matically when Microsoft Exchange Server is started and will
be disabled when Microsoft Exchange Server is stopped.
3. Create the list of managed servers (see para 4.2.2, page 32)
4. Connect the Management Control to the servers (see para 4.4,
page 34).
5. Configure the anti-virus protection system for each server:
• Configure the anti-virus database updating settings (see
Chapter 6, page 61).
• Verify the correctness of the settings and of the Anti-Virus
operation using a test "virus" EICAR (see para 4.7, page 38).
• Configure the notification system that issues notifications about
events registered during the application's operation (see
Chapter 8, 78)
• Configure the event logs and reports (see Chapter 10, page 95
and Chapter 11, page 108).
• Configure the settings for detecting virus outbreaks and
notification about such events. (Chapter 9, page 86).
2.3. Anti-virus protection system
maintenance
Maintaining the server anti-virus protection in the up-to-date state involves:
• periodic updating of the anti-virus database;
• receiving and processing messages about detection of viruses and about
threats of virus outbreaks;
• regular review of reports about the application operation and about the
stage of the mail server anti-virus protection;
• processing and cleaning of the backup storage.

18 Kaspersky Anti-Virus for Microsoft Exchange Server
2.4. Application’s operation on a
cluster of servers
Kaspersky Anti-Virus 5.5 for Microsoft Exchange Server 2000/2003 does not fully
support the cluster technology; however, it will function correctly on a cluster of
servers treating each node as a separate physical Exchange server.
A message arriving at a virtual Exchange server will be forwarded to one of the
cluster’s nodes. Streams of e-mail messages for each node may not intersect.
Kaspersky Anti-Virus will process a message at the node to which this message
had been forwarded by the virtual Exchange server.
The anti-virus scan results for each node of the cluster, namely,
• backup storage contents;
• information included into the reports;
• the group of events registered in the Windows logs and in the application’s
logs;
• values of virus outbreak counters
will be provided only for those messages that had been forwarded to this node of
the cluster by the virtual Exchange server.
In order to create Microsoft Exchange Server anti-virus protection of the
servers installed on the cluster:
1. Install the Security Server component to each node of the cluster.
The installation shall be performed from the distribution kit
individually for each server.
Specify a folder on a local disk of the server file system as
the installation folder.
Shared disks should not be used for this purpose as when
the Microsoft Exchange Server application is moved to a dif-
ferent node of the cluster, the shared disk will be moved
along with the application.
2. Install the Management Console on a computer within the
corporate network.
3. Create the list of managed servers by adding all cluster nodes as
servers (see para 4.2.2, page 32).

Operation of Kaspersky Anti-Virus 19
When adding managed servers and configuring connection
of Management Console to the Server, use the names of
physical servers on which the Security Server is installed.
The use of a virtual Exchange server name may cause an
addressing error when the Microsoft Exchange Server is
moved to a different node of the cluster.
4. Connect the Management Control to the servers (see para 4.4,
page 34).
5. Configure the anti-virus protection system for each server using
identical settings values taking into consideration the following:
• As the backup storage folder, select a folder located on the
physical server where the Security Server component is
installed (see para 7.6, page 75).
• As a folder to be used to store reports and logs, select folders
located on the physical server where the Security Server
component is installed (see para 10.1.1, page 98 and 11.2,
page 111).
• The list of unprotected storage areas on all servers must match
(see para 12.6, page 120).

CHAPTER 3. INSTALLING,
UPDATING AND REMOVING
THE APPLICATION
Before the installation of Kaspersky Anti-Virus, make sure that the software and
hardware of the computers used meet the installation requirements. The
minimum requirements to the computers' configuration are provided in para 1.4,
page 11.
3.1. Installing the application
The installation procedure is a standard one similar to that of most Windows
applications. The setup wizard will offer you to install the application components
of Kaspersky Anti-Virus 5.5 for Microsoft Exchange Server 2000/2003, Security
Server and Management Console, on the computer on which the setup wizard is
run. This configuration is recommended at the initial stage of creating the
Exchange servers anti-virus protection system. You can select either complete or
custom installation of the application or repair an incorrect installation of
Kaspersky Anti-Virus.
For installation of Kaspersky Anti-Virus 5.5 for Microsoft Exchange
Server 2000/2003 the local administrator's rights are required for the
computer on which the installation is performed..
After the Management Console is installed, a shortcut icon for this component will
appear in Run/Programs/Kaspersky Anti-Virus Microsoft Exchange Server
menu in your computer.
The Security Server will be installed on your computer as a service with a set of
attributes as follows:
• name – Kaspersky Anti-Virus 5.5 for Microsoft Exchange Server
2000/2003;
• startup type – automatic;
• account – Local system.
The properties of the Security Server can be viewed and its operation can be
monitored using standard Windows administration tools - Computer
Management/Services. Information about the operation of the Security Server
is registered and saved in the Windows applications log on the computer on
which the Security Server is installed.