KAPERSKY ANTI-VIRUS 5.5 - FOR NOVELL NETWARE Service manual

KASPERSKY LAB
Kaspersky Anti-Virus 5.5
for Novell NetWare
ADMINISTRATOR’S GUIDE

KASPERSKY ANTI-VIRUS 5.5 FOR NOVELL NETWARE
Administrator’s Guide
©Kaspersky Lab
http://www.kaspersky.com/
Revision date: December, 2004

Contents:
CHAPTER 1. INTRODUCTION ...................................................................................... 6
1.1. What’s new in Version 5.5?................................................................................... 7
1.2. Hardware and software requirements .................................................................. 7
1.3. Distribution kit ........................................................................................................ 8
1.3.1. License agreement ......................................................................................... 8
1.4. Help Desk for Registered Users ........................................................................... 9
1.5. Conventions........................................................................................................... 9
CHAPTER 2. KASPERSKY ANTI-VIRUS 5.5 FOR NOVELL NETWARE BASICS .. 11
2.1. Deploying protection on servers ......................................................................... 11
2.2. Basic concepts and operation scheme of the application.................................. 12
2.3. Maintaining the antiviral protection system......................................................... 13
CHAPTER 3. INSTALLING, UPDATING, AND UNINSTALLING THE
APPLICATION............................................................................................................ 14
3.1. Installation from the distribution package ........................................................... 14
3.2. Deploying the application across the network.................................................... 18
3.3. Uninstalling the application.................................................................................. 20
3.4. Updating the application version......................................................................... 21
CHAPTER 4. SETTING UP THE APPLICATION ........................................................ 22
4.1. Starting the application........................................................................................ 22
4.2. Application interface ............................................................................................ 22
4.3. Default protection of the server ........................................................................... 25
4.4. Starting/stopping the application on the server .................................................. 26
4.5. Setting up the application .................................................................................... 30
CHAPTER 5. UPDATING THE ANTI-VIRUS DATABASE.......................................... 32
5.1. Creating an update task ...................................................................................... 33
5.2. Setting up the task............................................................................................... 34
5.3. Batch task setup .................................................................................................. 40
5.4. Starting/stopping a task....................................................................................... 42
5.5. Deleting a task ..................................................................................................... 43

4 Kaspersky Anti-Virus for Novell NetWare
CHAPTER 6. SCANNING THE SERVER FOR VIRUSES.......................................... 45
6.1. Creating tasks for Real-Time Protection and On-Demand Scan ...................... 46
6.2. Setting up a task.................................................................................................. 48
6.3. Batch task setup .................................................................................................. 53
6.4. Starting/stopping a task....................................................................................... 54
6.5. Deleting a task ..................................................................................................... 55
CHAPTER 7. GENERATING AND VIEWING LOGS, RECEIVING
NOTIFICATIONS........................................................................................................ 58
7.1. Viewing the anti-virus database updating results............................................... 59
7.2. Viewing the server scanning results ................................................................... 62
7.3. Summarized results of the task execution.......................................................... 67
7.4. Notification regarding detected viruses............................................................... 70
CHAPTER 8. LICENSE MANAGEMENT..................................................................... 71
8.1. Licensing policy ................................................................................................... 71
8.2. Installing the license key...................................................................................... 74
APPENDIX A. APPLICATION SETTINGS ................................................................... 76
A.1. The General Tab................................................................................................. 76
A.2. The Folders Tab.................................................................................................. 77
A.3. The Advanced Tab ............................................................................................. 78
A.4. The Schedule Tab............................................................................................... 80
A.5. The Tasks Tab .................................................................................................... 83
A.6. The E-mail Notification tab.................................................................................. 85
APPENDIX B. TASK SETTINGS .................................................................................. 86
B.1. The Update Task ................................................................................................ 86
B.1.1. The Recipients Tab ...................................................................................... 86
B.1.2. The Settings Tab.......................................................................................... 88
B.1.3. The Event log Tab........................................................................................ 93
B.1.4. The Proxy Tab.............................................................................................. 95
B.1.5. The Schedule Tab........................................................................................ 96
B.1.6. The Statistics Tab....................................................................................... 100
B.2. The Scan on Demand and Real-Time Protection Tasks................................. 102
B.2.1. The Scanning options Tab......................................................................... 102
B.2.1.1. Code analyzer ..................................................................................... 104
B.2.1.2. Extracting Engine ................................................................................ 105

Table of contents 5
5
B.2.1.3. Executable Module Extracting Engine................................................ 105
B.2.2. The Actions Tab ......................................................................................... 106
B.2.3. The Event log Tab...................................................................................... 109
B.2.3.1. Messages regarding infected files ...................................................... 111
B.2.3.2. Messages Regarding Suspicious Files .............................................. 112
B.2.3.3. Warnings.............................................................................................. 113
B.2.3.4. Messages Regarding Packed Executable Files ................................ 113
B.2.3.5. Messages Regarding Archive Files .................................................... 113
B.2.3.6. Messages Regarding Uninfected Files............................................... 113
B.2.4. The NW-Notification Tab............................................................................ 113
B.2.5. The E-mail Notification Tab........................................................................ 116
B.2.6. The Schedule Tab...................................................................................... 117
B.2.7. The Statistics Tab....................................................................................... 121
APPENDIX C. KASPERSKY LAB............................................................................... 123
C.1. Other Kaspersky Lab Products ........................................................................ 124
C.2. Contact Us ........................................................................................................ 128
APPENDIX D. LICENSE AGREEMENT .................................................................... 129

CHAPTER 1. INTRODUCTION
Kaspersky Anti-Virus 5.5 for Novell NetWare is an anti-virus application
designed to protect LAN file servers running the Novell NetWare operating
system.
Kaspersky Anti-Virus 5.5 has the following functions:
• Real-time server protection – scans all the files started or modified on
the server, then disinfects and/or deletes infected objects.
• On-demand server scans – successively scans the files on the server
on user’s demand or according to a schedule with user-specified
frequency. The anti-virus application can disinfect and/or delete infected
objects.
• Anti-virus database updating – updates the anti-virus database used to
search for viruses, and distributes the downloaded updates to other
servers on the Novell NetWare network. The database can be scheduled
for automatic updating. The application will download the latest updates
via the Internet or the LAN and distribute these among the specified
servers. Prior to updating the anti-virus database on a server the program
will back up all the files being modified, thus making it possible to revert to
the latest update if necessary.
• Quarantine – moves infected or suspicious files to a special storage
location called ‘quarantine’. Quarantined files can be analyzed by the
administrator or sent to the Kaspersky Lab for examination.
• Event log keeping – creates detailed logs and writes the results of the
on-demand server scanning, real-time protection and anti-virus database
updating. The logs can be viewed and printed.
• Backup – saves backup copies of any suspicious or infected files prior to
disinfecting or deleting them. This makes it possible to restore the data in
the event of disinfection, deletion failure or error.
Kaspersky Anti-Virus 5.5 for Novell NetWare is based on client-server
architecture. Its server part consists of two modules: Kaspersky Anti-Virus,
dealing with anti-virus functionality, and Anti-Virus database updater,
responsible for updating the anti-virus database and application modules. The
client part consists of Snapin for ConsoleOne and a web module that provide
the user interface for the application administrative services and enable the user
to install the application, set it up, and manage the server part.

Introduction 7
1.1. What’s new in Version 5.5?
The main difference of the current version from version 5.0 is that Kaspersky
Anti-Virus 5.5 for Novell NetWare can be managed through a web interface. The
new module added to the package is similar to the Snapin for ConsoleOne, a
management tool included into the previous version. There are only minor
differences in the location of control buttons, which is specific of web interfaces1.
To view task log files through the web interface, you should have a client for
Novell NetWare installed on this computer.
The procedure of automatic database updating has changed: now Kaspersky
Anti-Virus must be running on the servers being updated. The update task can
be started either automatically (at a scheduled time) or manually. If Maintenance
Pack 1 for Kaspersky Anti-Virus 5.5 for Novell NetWare is installed on the main
update server, this patch should be installed on other servers that will receive the
updates, i.e., those included into the list of recipient servers. Otherwise, the anti-
virus database on these servers will not be updated.
1.2. Hardware and software
requirements
Software requirements:
• A server with installed Novell NetWare ver. 5.x or 6.0, 6.5.
• Installed Apache Web server and a Tomcat servlet container (for installing
and using the web management interface).
• Installed Support Packs:
• For Novell NetWare 5.x – Support Pack 6 or higher
• For Novell NetWare 6.0.x – Support Pack 3 or higher
• All servers and workstations used to control the application must support
the TCP/IP protocols.
• Microsoft Internet Explorer 6.0 or higher.
Hardware requirements:
1This Administrator’s Guide describes mainly the interface of Snapin for ConsoleOne.
The differences between the console and web interfaces are discussed separately.

8 Kaspersky Anti-Virus for Novell NetWare
• An Intel Pentium processor or higher.
• About 12 MB of available (free) RAM.
• About 8 MB of free hard-disk space on the server’s volumes.
1.3. Distribution kit
You can purchase Kaspersky Anti-Virus 5.5 for Novell NetWare either from our
distributors (retail box) or online at one of our Internet shops (for example,
www.kaspersky.com – select the E-Store link).
The retail box includes:
• A sealed envelope with an installation CD containing files for the software
product
• User Guide
• A license key written on the installation CD
• License agreement
Before you unseal the envelope containing the CD, be sure to
thoroughly review the license agreement.
If you buy Kaspersky Anti-Virus 5.5 for Novell NetWare online, you download the
installation file of the product from the Kaspersky Lab website. This installation
file includes this User Guide and the license key. The license key can also be
sent to you by e-mail after receiving your payment.
1.3.1. License agreement
The License Agreement (LA) is a legal agreement between you and the
manufacturer (Kaspersky Lab Ltd.) describing the terms on which you may use
the anti-virus product which you have purchased.
Make sure you read the License Agreement!
If you do not agree to the terms of this LA you can return the unused product to
your Kaspersky Anti-Virus dealer for a full refund, making sure the envelope
containing the CD is sealed.
By unsealing the envelope or installing the program, you agree to all the terms of
the LA.

Introduction 9
1.4. Help Desk for Registered Users
Kaspersky Lab offers a large service package enabling its registered customers
to enjoy all available features of Kaspersky Anti-Virus.
If you register and purchase a subscription you will be provided with the following
services for the period of your subscription:
• New versions of this anti-virus software product provided free of charge.
• Phone or e-mail advice on matters related to the installation,
configuration, and operation of this anti-virus product.
• Information about new Kaspersky Lab products and about new computer
viruses (for those who subscribe to the Kaspersky Lab newsletter).
Kaspersky Lab does not provide information related to operation and
use of your operating system or various other technologies.
1.5. Conventions
In this book we use various conventions to emphasize different meaningful parts
of the documentation. The table below lists the conventions used in this Guide.
Convention Meaning
Bold font Menu titles, commands, window titles,
dialog elements, etc.
Note.
Additional information, notes
Attention!
Critical information
To do this,
1. Step 1.
2. …
Actions that must be taken
Task or example
Formulation of the problem or an example
of how to use the product.

10 Kaspersky Anti-Virus for Novell NetWare
Convention Meaning
Solution
A solution of the problem formulated
[key] – Function of the key. Command line keys
Text of information
messages and the com-
mand line
Text of configuration files, information
messages, and the command line.

CHAPTER 2. KASPERSKY ANTI-
VIRUS 5.5 FOR NOVELL
NETWARE BASICS
2.1. Deploying protection on servers
Building of the file server antiviral protection system using Kaspersky Anti-Virus
5.5 for Novell NetWare must begin with installation of Snapin for Novell
ConsoleOne and/or the web management module.
Snapin for ConsoleOne is installed from the distribution package on one of the
workstations running Windows or on a NetWare server, where the Novell
ConsoleOne network administration utility is installed.
The Web management module is also installed from the distribution package on
a Windows workstation or on a NetWare server with the installed Apache Web
server and Tomcat servlet container.
Snapin for ConsoleOne and the Web module can be installed on only one of the
computers as they provide centralized access to all network resources from a
single administrator workbench. However, if in the event that several
administrators are working jointly, the management modules can be installed on
each of their computers.
If none of the modules is installed, the anti-virus functionality of the
application will be limited to real-time server protection mode with
default settings. Scanning will be launched automatically when starting
the server and will be stopped when the server is shut down. Stopping
or starting the scanning forcibly will only be possible from the command
line by closing or starting the application.
The next step is installation of the server side application on all the NetWare file
servers across the network. Kaspersky Anti-Virus and Anti-virus database
updater modules can be installed on the server either using the distribution
package or without it, by using the Snapin for ConsoleOne or web interface.

12 Kaspersky Anti-Virus for Novell NetWare
2.2. Basic concepts and operation
scheme of the application
The antiviral protection system is based on creation of tasks, which maximize the
basic functionality of the application.
A task is a specific action performed by the application. Tasks are divided into
several types according to their function. Kaspersky Anti-Virus 5.5 for Novell
NetWare uses three types of task:
• Real-time protection
• Scan on-demand
• Anti-virus database updating
The tasks can be started according to a schedule, manually, or upon an
application event. Each task has a corresponding set of parameters that specify
how the application will work when running this task.
The set of application parameters common for all its task types makes up the
application settings. The application parameters specific to each type of task
make up task settings.
Because of the distributed architecture of Kaspersky Anti-Virus 5.5 for Novell
NetWare, obtaining access to its anti-virus functionality requires starting its
server part – Kaspersky Anti-Virus or Anti-virus database updater module –
to carry out the update. This can be started using the Snapin for Novell
ConsoleOne or the web module (see section 4.4 on page 26).
In order to initiate execution of the required function, the user must set the
application parameters (see section 4.5 on page 30), create the respective task
(see section 5.1 on page 33 and section 6.1 on page 46), set its generic
parameters (see section 5.2 on page 34 and section 6.2 on page 48) and run this
task (see section 5.4 on page 42 and section 6.4 on page 54). If the scheduled
start mode or start on event mode is selected, the task is launched automatically.
Access to the application administrative functions, and creation and running of
the tasks is granted to the users2who possess administrator rights. The user
rights are checked based on their authentication in the Novell Netware network.
2In this document, users with administrator rights are referred to as users.

Kaspersky Anti-Virus 5.5 for Novell NetWare basics 13
2.3. Maintaining the antiviral
protection system
Maintenance of the server antiviral protection system involves the following
processes:
• Reception and processing of virus detection messages
• Regular checking of anti-virus database update reception and distribution
reports
An important factor that determines the quality of infected object detection by
anti-virus programs is completeness of their anti-virus database. The procedure
of searching and removing viruses is based on the records of the anti-virus
database, which stores descriptions of every virus known at the time along with
methods of cleaning objects infected by them.
Kaspersky Lab adds descriptions of new viruses to the anti-virus database daily
and places the updates on the Internet for downloading. It is recommended to
download these updates daily.
The anti-virus database versions must be the same on all the protected servers.
In order to save traffic, the update process can be set up in such a way that the
anti-virus database updates will be downloaded from the Internet by the “main"
server. All the other servers will receive the updates from the shared folder
located on the “main” server.
A server can receive updates only from the server located in the same
NDS tree. Therefore, it is necessary to create at least one server
responsible for updating the anti-virus database in every NDS tree
whose servers are to be protected from viruses.

CHAPTER 3. INSTALLING,
UPDATING, AND
UNINSTALLING THE
APPLICATION
Prior to installing Kaspersky Anti-Virus 5.5 for Novell NetWare please make sure
that hardware and software of the server/workstation meets the program’s
requirements. The minimal possible requirements are specified in section 1.2 on
page 7.
3.1. Installation from the distribution
package
Kaspersky Anti-Virus 5.5 for Novell NetWare is installed from a computer running
Windows 9x/NT/2000/Me/XP.
To install Kaspersky Anti-Virus 5.5 for Novell NetWare, run the installer
(setup.exe) from the CD with the application distribution package.
This will start the installation wizard. Follow its directions. Most of the
settings required for installation will be made by default or will be based
on the choice you make. Please read carefully the text in each window of
the wizard. Make any desired changes if necessary.
A detailed description of the installation steps is provided below.
1. First of all, the license agreement will be displayed. You must
accept it in order to proceed with the installation.
2. After that you should select the application components to install
(see Figure 1). You can install both the server-side application and
the client application simultaneously (full installation) or install the
Snapin for ConsoleOne first and then deploy the application via
Novell ConsoleOne. To install the server-side application select
Kaspersky Anti-Virus (version 5.5); for the client application select
Snapin for ConsoleOne and/or the Web management module.

Installing, updating, and uninstalling the 15
Figure 1. Selecting the components to install
3. If you choose to install the server-side application – Kaspersky
Anti-Virus, you will be asked to specify servers for the installation
(Figure 2). Select the required servers from the list of those currently
connected.
Figure 2. Selecting servers for the Kaspersky Anti-Virus installation

16 Kaspersky Anti-Virus for Novell NetWare
4. The next step is specifying the directories in which to install the
components of Kaspersky Anti-Virus 5.5 for Novell NetWare. The
group of elements of the component is only displayed if it was
selected for installation (see Figure 3).
Figure 3. Installation folders selection
The server-side application is installed in the SYS/KAV folder. If you
are installing the product on only one server, you can specify
another destination folder in the volume structure of the server.
As for the installation directory for the Snapin for ConsoleOne, you
must specify the installation directory of Novell ConsoleOne on the
computer from which the application control utility will be started. By
default this field contains the server’s directory
SYS\Public\mgmt\ConsoleOne\1.2 of the workstation’s directory
\Novel\ConsoleOne\1.2. You need to change it.
By default, the Web management module (iKAV) is installed in the
<server_name >\\SYS\Tomcat\4 directory. This path is correct if you
are running a server version 6.0 or higher.
For a server version 5.x, check the version of Tomcat launched at
Apache startup and specify the path <server_name
>\SYS\Tomcat\< Tomcat_version>. The default Tomcat version is
33. The path for this version should be changed to <server_name
>\SYS\Tomcat\33.

Installing, updating, and uninstalling the 17
If you want to install only the web management module, the default
installation directory is C:\Tomcat\4. You can change the path by
specifying the Tomcat directory on your local drive or simply copy
the module files to the Tomcat directory after the installation.
5. In the license key installation window please specify the license key
file (*.keys), using which Kaspersky Anti-Virus 5.5 for Novell
NetWare will check the validity of the license agreement and its
deadline (see Figure 4).
The license key is your personal “key”, which stores the
information required for full-featured operation of the application.
This information includes:
• Support information (who provides it and where it
can by obtained).
• Name, number and the expiration date of the li-
cense.
Your license key can be enclosed with the distribution package or
sent to you by e-mail after the product is purchased. The program
will not run without the key file.
Figure 4. The License Key installation window
6. Next,the files will be copied to the server and the settings will be
stored in the NDS.

18 Kaspersky Anti-Virus for Novell NetWare
7. After the wizard successfully completes its work, in the final window
(see Figure 5) you will be offered the opportunity to modify the
AUTOEXEC.NCF file so as to start the server-side application
whenever the server is started. In addition, you will be offered the
possibility of loading the server-side application immediately after
the application is installed on the server. Select the required
variants.
The AUTOEXEC.NCF is modified automatically and does not require
additional settings to be made.
Figure 5. The final window of the setup wizard
3.2. Deploying the application
across the network
If the Snapin for Novell ConsoleOne and/or the Web management module
are already installed on a computer (server or workstation), then the server-side
application can be installed on other servers without using the distribution
package. This is done via Novell ConsoleOne or the web module using the
Install Kaspersky Anti-Virus shortcut menu command of the NDS console tree.
You can install the server-side application of Kaspersky Anti-Virus 5.5 for Novell
Netware on both a server selected in the console tree and several servers at the
same time.

Installing, updating, and uninstalling the 19
To install Kaspersky Anti-Virus 5.5 for Novell NetWare on a group of
servers:
Select a node in the console tree that contains the required servers and
right click your mouse button to open the shortcut menu. In the shortcut
menu, select the Install Kaspersky Anti-Virus option. If this option is
unavailable in the shortcut menu, Kaspersky Anti-Virus is already installed
on all the servers of this node.
During installation, the program will ask you to select the servers on which
you want to install Kaspersky Anti-Virus and specify the path to the
license key file (see Figure 6). The list of servers available for installation
includes only those servers on which Kaspersky Anti-Virus has not been
installed. The license key file is selected in the same manner as
installation from the distribution package (see section 3.1 on page. 14).
After the installation is complete you will be offered the opportunity to
update the AUTOEXEC.NCF file automatically so as to start the server-
side application whenever the servers are started (see Figure 7).
Figure 6. Installing the application on a group of servers via Novell ConsoleOne

20 Kaspersky Anti-Virus for Novell NetWare
To install Kaspersky Anti-Virus 5.5 for Novell NetWare on one server:
Select a node in the console tree that contains the required servers, open
the shortcut menu, and select the Install Kaspersky Anti-Virus option.
During installation the program will ask you to specify the directory in
which to install the server-side application, and specify the path to the
license key file (similarly to Figure 6). These operations are the same as
those described above (see section 3.1 on page. 14). After the installation
is complete you will be offered the opportunity to update the
AUTOEXEC.NCF file automatically so as to start the server-side
application whenever the server is started (see Figure 7).
Figure 7. Installing the application on the server via Novell ConsoleOne.
Modifying the AUTOEXEC.NCF file
3.3. Uninstalling the application
Uninstalling Kaspersky Anti-Virus 5.5 for Novell NetWare means removing the
application’s server part from the file servers and removing its client part from the
computers on which it was installed (see section 3.1 on page. 14).
The application’s server part can be uninstalled from the file server selected in
the NDS structure via Novell ConsoleOne using the Remove Kaspersky Anti-
Virus command in the shortcut menu of the console tree. You will be asked to
confirm that you really want to uninstall the application (see Figure 8). After the
last installed server part is removed, the NDS structure will be cleared – the
Kaspersky Anti-Virus 5.5 class and all its attributes will be deleted.
Figure 8. Request concerning removal of the application’s server part
To uninstall the client part, Snapin for ConsoleOne and/or Web management
module, it must be removed from the computer on which it is installed (see