KAPERSKY ANTI-VIRUS 5.6 - FOR MICROSOFT ISA SERVER 2000 ENTERPRISE... Service manual

KASPERSKY LAB
Kaspersky Anti-Virus®5.6
for Microsoft ISA Server 2000
Enterprise Edition
Administrator’s Guide

KASPERSKY ANTI-VIRUS®5.6
FOR MICROSOFT ISA SERVER 2000
ENTERPRISE EDITION
Administrator’s Guide
©Kaspersky Lab
http://www.kaspersky.com
Edition date: August 2005

Contents
CHAPTER 1. KASPERSKY ANTI-VIRUS® FOR MICROSOFT ISA SERVER
2000 ENTERPRISE EDITION..................................................................................... 4
1.1. What’s new in Kaspersky Anti-Virus® 5.6 for Microsoft ISA Server 2000
Enterprise Edition................................................................................................. 5
1.2. Hardware and software requirements .................................................................. 6
1.3. Distribution kit ........................................................................................................ 6
1.4. Help Desk for registered users.............................................................................. 7
1.5. Conventions........................................................................................................... 8
CHAPTER 2. TYPICAL DEPLOYMENT SCENARIOS ................................................. 9
CHAPTER 3. INSTALLING THE APPLICATION......................................................... 12
3.1. Configuring ISA Server settings before installing the application ...................... 12
3.2. Installing Kaspersky Anti-Virus®.......................................................................... 13
3.2.1. First installation ............................................................................................. 14
3.2.2. Reinstalling.................................................................................................... 18
CHAPTER 4. USING KASPERSKY ANTI-VIRUS®FOR ISA SERVER..................... 19
4.1. Default scan settings ........................................................................................... 19
4.2. Managing scans .................................................................................................. 22
4.2.1. Configuring general settings of anti-virus scans.......................................... 23
4.2.1.1. General settings..................................................................................... 24
4.2.1.2. Settings for HTTP scanning................................................................... 27
4.2.1.3. Settings for FTP scanning ..................................................................... 29
4.2.2. Editing application settings for a single server............................................. 30
4.2.3. Managing client groups ................................................................................ 34
4.2.4. Specifying policies for anti-virus scanning ................................................... 39
4.2.4.1. Managing a list of trusted servers.......................................................... 45
4.2.4.2. Creating a list of objects excluded from scans...................................... 46
4.3. Updating the anti-virus database ........................................................................ 47
4.3.1. Scheduled updating of the anti-virus database ........................................... 50
4.3.2. On-demand updating.................................................................................... 51
4.3.3. Configuring database updating on a single server...................................... 51

3 Kaspersky Anti-Virus 5.6 for MS ISA Server 2000 Enterprise Edition
4.4. Configuring notifications ...................................................................................... 52
4.5. Testing Kaspersky Anti-Virus®operation............................................................ 53
4.6. Application statistics and diagnostics.................................................................. 53
4.6.1. Recording and viewing statistics .................................................................. 54
4.6.2. Notifying the administrator using ISA Server Alerts..................................... 56
4.6.3. Configuring diagnostics options for the application ..................................... 57
4.7. Managing license keys........................................................................................ 59
4.7.1. Installing a new license key.......................................................................... 60
4.7.2. Renewing your license ................................................................................. 61
4.7.3. Removing a license key ............................................................................... 63
4.8. Managing the application via Kaspersky Administration Kit .............................. 63
4.8.1. Managing tasks............................................................................................. 64
4.8.1.1. Creating a task ....................................................................................... 64
4.8.1.2. Viewing and changing task settings...................................................... 69
4.8.1.3. Starting and stopping tasks ................................................................... 72
4.8.2. Managing application settings...................................................................... 73
CHAPTER 5. FREQUENTLY ASKED QUESTIONS................................................... 83
APPENDIX A. HOW TO CONTACT TECHNICAL SUPPORT ................................... 89
APPENDIX B. GLOSSARY........................................................................................... 91
APPENDIX C. KASPERSKY LAB................................................................................. 92
C.1. Other Kaspersky Lab Products .......................................................................... 93
C.2. Contact Us .......................................................................................................... 97
APPENDIX D. LICENSE AGREEMENT ...................................................................... 98

CHAPTER 1. KASPERSKY ANTI-
VIRUS® FOR MICROSOFT
ISA SERVER 2000
ENTERPRISE EDITION
Kaspersky Anti-Virus®for Microsoft ISA Server 2000 Enterprise Edition
(hereafter, also Kaspersky Anti-Virus®for ISA Servers) is a system of anti-
virus protection of files transferred using the HTTP and FTP protocols via the
Microsoft Internet Security and Acceleration Server. It ensures reliable protection
of corporate networks from penetration of malicious software.
Kaspersky Anti-Virus®for Microsoft ISA Server acts as a filter that intercepts
packets transferred via the HTTP and FTP protocols, isolates controlled objects
from this data, analyzes them for the presence of viruses, and prevents infected
files and Web documents from penetrating a corporate network.
The program includes data stream filters and the anti-virus kernel.
The filters are integrated into Microsoft ISA Server as plug-ins, and the anti-virus
kernel is installed into the system as a service.
The anti-virus protection is managed through a special interface built into the ISA
administration snap-in for Microsoft Management Console (MMC) as an
extension.
The interface for managing Kaspersky Anti-Virus for Microsoft ISA
Server is an extension of MMC that must be integrated with Microsoft
ISA Server. This extension cannot be installed on a separate adminis-
trator desktop as an MMC extension.
The application performs the following functions:
• Anti-virus protection and processing of data streams received from the
Internet.
• Generation of data streams from disinfected files and the delivery of
these streams to the client upon request.
• Scheduled and manual updating of the anti-virus database via the
Internet, a local folder, or a shared folder.
• Logging of statistics about program performance and displaying the
results using standard Windows tools.

5 Kaspersky Anti-Virus 5.6 for MS ISA Server 2000 Enterprise Edition
• Management of license keys.
In addition, Kaspersky Anti-Virus®for Microsoft ISA Server allows the
administrator to:
• Set parameters for anti-virus protection and for notifications about
dangerous events.
• Create groups of users in accordance with the adopted network policy.
For example, you can use the existing administration division to define
anti-virus policy settings for each of the groups created. This can
significantly speed up the scanning process.
• Create a list of trusted servers for one or several groups of users; the
traffic from these servers will be excluded from scanning for viruses.
• Create a list of types of object excluded from anti-virus protection.
The application can be managed from a remote location using Kaspersky
Administration Kit, a system for centralized management of the anti-virus
protection system (see section 4.8 on page 63).
Kaspersky Anti-Virus®supports the following data transfer protocols:
• HTTP 1.0 and 1.1 (RFC 2616);
• FTP (RFC 959, 2389, Extensions to FTP);
• FTP over HTTP.
The application does not protect data transferred by other transfer pro-
tocols and VPN connections.
1.1. What’s new in Kaspersky Anti-
Virus® 5.6 for Microsoft ISA
Server 2000 Enterprise Edition
This application is designed to protect Microsoft ISA Servers installed as
enterprise array members. The application allows centralized management of
anti-virus protection settings for all servers protected by Kaspersky Anti-Virus and
centralized updating of the anti-virus database.
Though this version can be installed on a standalone Microsoft ISA
Server, it is advised to use Kaspersky Anti-Virus 5.1 for Microsoft ISA
Server on such servers.

Kaspersky Anti-Virus® for Microsoft ISA Server 2000 Enterprise Edition 6
1.2. Hardware and software
requirements
Kaspersky Anti-Virus®for Microsoft ISA Server operates in integration with
Microsoft® Internet Security and Acceleration Server 2000 Enterprise Edition with
Service Pack 2 or higher installed under the following operating systems:
• Microsoft®Windows 2003 Server.
• Microsoft®Windows 2000 Server (Service Pack 4 or higher).
• Microsoft®Windows 2000 Advanced Server (Service Pack 4 or higher).
To use Kaspersky Anti-Virus®for Microsoft ISA Server, your computer must meet
the following minimum requirements:
• Pentium II processor of 300 MHz or higher.
• At least 256 MB free RAM.
• At least 50 MB hard disk space for installation of the program.
• At least 200 Mb hard disk space for temporary storage of data copied
from the Internet before scanning for viruses.
The amount of free disk space required to temporarily store
data downloaded from the Internet before an anti-virus scan
starts depends on the density of traffic processed by Micro-
soft ISA Server. As a rule, 500 MB is enough but if traffic is
heavy and files downloaded are too large, more space can be
required.
1.3. Distribution kit
You can purchase Kaspersky Anti-Virus®for Microsoft ISA Server either from our
distributors (retail box) or online at one of our Internet shops (for example,
www.kaspersky.com – select the E store link).
The retail box includes:
• a sealed envelope with an installation CD containing files for the software
product;
• administrator's guide;
• a license key written on the floppy disk;
• license agreement.

7 Kaspersky Anti-Virus 5.6 for MS ISA Server 2000 Enterprise Edition
Before you unseal the envelope containing the CD, be sure to thor-
oughly review the license agreement.
If you buy Kaspersky Anti-Virus®for Microsoft ISA Server online, you download
the installation file of the product from the Kaspersky Lab website. This
installation file includes this Administrator’s Guide and the license key. The
license key can also be sent to you by e-mail after receiving your payment.
The License Agreement is a legal agreement between you and the manufacturer
(Kaspersky Lab) describing the terms on which you may employ the anti-virus
product which you have purchased.
Make sure you read the License Agreement!
If you do not agree to the terms of this LA, you can return the unused product to
your Kaspersky Anti-Virus®dealer for a full refund, making sure the envelope
containing the CD is sealed.
If you unseal the envelope or install the program, you are considered to have
agreed to all the terms of the LA.
1.4. Help Desk for registered users
Kaspersky Lab offers a large service package enabling its registered customers
to enjoy all the available features of Kaspersky Anti-Virus®.
If you register and purchase a subscription you will be provided with the following
services for the period of your subscription:
• new versions of this anti-virus software product provided free of charge;
• phone or e-mail advice on matters related to the installation,
configuration, and operation of this anti-virus product;
• information about new Kaspersky Lab products and about new computer
viruses (for those who subscribe to the Kaspersky Lab newsletter).

Kaspersky Anti-Virus® for Microsoft ISA Server 2000 Enterprise Edition 8
Kaspersky Lab does not provide information related to the operation and
use of your operating system or various other technologies.
1.5. Conventions
In this book we use various conventions to emphasize different meaningful parts
of the documentation. The Table below lists the conventions used in this User
Guide.
Convention Meaning
Bold font Menu titles, commands, window titles,
dialog elements, etc.
Note.
Additional information, notes
Attention!
Critical information
To do this,
1. Step 1.
2. …
Actions that must be taken
Text of information mes-
sages and the command line Text of configuration files, information
messages, and the command line.

CHAPTER 2. TYPICAL
DEPLOYMENT SCENARIOS
A typical scenario for deploying ISA Server and most of its services is as follows:
the administrator installs the application on the ISA Server computer, and the ISA
administration tool on a remote computer (as a rule, an administrator’s
workstation).
In this deployment scenario, the Kaspersky Anti-Virus®application must be
installed on the ISA Server computer, and the Kaspersky Anti-Virus®
administration console, on the administrator’s workstation. The computer that
runs the Kaspersky Anti-Virus®for ISA Server administration console must only
have the ISA Server administration tools installed.
You can install separate components of Kaspersky Anti-Virus®by
manually installing the application (see Chapter 3 on page 12).
During the installation procedure, the program will automatically detect the ISA
Server mode. Below, we consider possible ISA Server modes and any special
features of Kaspersky Anti-Virus®operation for each of these modes.
The documentation for ISA Server describes three possible modes:
• Firewall.
• Proxy (Cache).
• Integrated.
In Firewall mode, ISA Server protects internal network communications from
various types of Internet-borne threats by using various tools, such as IP packet
filters, Web filters, and application filters. In this mode, caching of transmitted
information is disabled.
In Proxy mode, ISA Server acts as a cache server that routes requests and plans
data loading for efficient processing of subsequent clients’ requests. In this mode,
ISA Server does not protect the internal network.
In Integrated mode, all the features of the firewall and cache server are available.
In addition, in this mode, ISA Server operates as both Proxy and Firewall.
During Kaspersky Anti-Virus®installation, the mode in which ISA Server operates
is determined automatically. Depending on the mode, various sets of data stream
filters are installed.

Typical deployment scenarios 10
The following Kaspersky Anti-Virus®filters can optionally be added to the system:
• Kaspersky Anti-Virus FTP Application Filter.
• Kaspersky Anti-Virus Web Filter.
• Kaspersky Anti-Virus HTTP Application Filter.
Table 1 shows filter options for the three ISA Server modes.
Table 1
Filter Proxy Firewall Integrated
Kaspersky Anti-Virus FTP Application
Filter
No Yes Yes
Kaspersky Anti-Virus Web Filter Yes Yes1Yes
Kaspersky Anti-Virus HTTP Application
Filter
No Yes No
After Kaspersky Anti-Virus®is installed, you will be able to manage the above
filters through the ISA Server Administration interface.
When the ISA Server is running in the Firewall mode, Kaspersky Anti-Virus Web
Filter is installed in disabled state, since it is presupposed that all the clients use
the ISA Server as a firewall without accessing the proxy server directly. If the
clients do access the proxy server directly (e.g. their browsers are set to work via
the proxy), please enable Kaspersky Anti-Virus Web Filter after the application is
installed to make sure the traffic passing via the proxy server is scanned for
viruses.
If you reinstall ISA Server to change the installed mode, you must also
reinstall Kaspersky Anti-Virus®and select only those filters that are
compatible with the selected mode.
Fig. 1 shows a scheme of processing the initial data streams that are common for
all possible Kaspersky Anti-Virus®deployment scenarios.
1The filter is disabled by default

11 Kaspersky Anti-Virus 5.6 for MS ISA Server 2000 Enterprise Edition
Figure 1. Processing of data streams by Kaspersky Anti-Virus for Microsoft ISA Server

CHAPTER 3. INSTALLING THE
APPLICATION
To correctly install the Kaspersky Anti-Virus®application, you should first properly
configure several standard filters of ISA Server.
3.1. Configuring ISA Server settings
before installing the application
Microsoft ISA Server provides a number of standard filters for controlling data
packets received via the HTTP and FTP protocols: HTTP Redirector Filter иFTP
Access Filter (the latter is not used in Proxy mode). The settings and statuses of
these filters affect the performance of Kaspersky Anti-Virus for Microsoft ISA
Server.
To avoid disabling anti-virus protection of servers, make sure that:
• FTP Access Filter is activated;
• HTTP Redirector Filter is configured to forward HTTP traffic to
the anti-virus filter.
Data stream filters are controlled from the standard console tree of ISA
Management.
To configure HTTP Redirector Filter and FTP Access Filter:
In the console tree of the ISA Management main window, select the Ex-
tensions node and click the Application Filters folder.
If one of these filters is disabled, you will see the icon in the list of filters.
To enable a filter:
1. Select the required filter in the list and open the Properties dialog
box.

13 Kaspersky Anti-Virus 5.6 for MS ISA Server 2000 Enterprise Edition
2. For FTP Access Filter, click Enable this filter in the FTP Access
Filter Properties dialog box.
3. For HTTP Redirector Filter, click Enable this filter on the General
tab of the HTTP Redirector Filter Properties dialog box. Then, on
the Options tab, select Send to requested Web server, if Microsoft
ISA Server is operating in Firewall mode. This will allow the data
streams flowing through the HTTP protocol to enter the
corresponding Kaspersky Anti-Virus®filters.
If you have selected Send to local Web Proxy server when
the ISA Server is running in the Firewall mode and have en-
abled Kaspersky Anti-Virus Web Filter, it is recommended
that you disable Kaspersky Anti-Virus HTTP Application
Filter in order to avoid duplication checking of the traffic:
when passing through the HTTP Redirector Filter and the
local proxy server.
Sometimes, third-party filters are used in conjunction with the standard Microsoft
ISA Server filters. However, these additional filters can affect the performance of
the anti-virus application if their settings prevent the initial data from entering the
Kaspersky Anti-Virus®filters. Moreover, in some cases, Kaspersky Anti-Virus®for
ISA Server might be completely disabled because of these filters.
3.2. Installing Kaspersky Anti-Virus®
The installation procedure for Kaspersky Anti-Virus®for ISA Server is standard
for most Windows applications. The installation application can be run locally on
ISA Server or on a remote terminal. You can select complete installation or
custom installation and restore an Anti-Virus configuration in the case of an
incorrect installation.
To install Kaspersky Anti-Virus for Microsoft ISA Server 2000 Enterprise
Edition, the user must have domain administrator rights
During installation of Kaspersky Anti-Virus, several errors might occur. Each of
these errors causes termination of Kaspersky Anti-Virus installation. To avoid
errors, before installation make sure that your server meets all hardware and
software requirements (see section 1.2 on page 6).
If errors occur during installation, please contact the Technical Support
service (see Appendix A). Please, attach the log file c:\kav4isa.log to
the message.

Installing the application 14
3.2.1. First installation
Step 1. Welcome and License Agreement dialog boxes
The Kaspersky Anti-Virus®setup wizard starts with the Welcome and License
Agreement dialog boxes. The License Agreement dialog box contains the text
of the License Agreement. To proceed with the installation, read the agreement
thoroughly and accept its terms.
Step 2. User data and selecting installation options
At this stage, the program automatically detects user information by using data
from the operating system registry, and offers two installation options: complete
installation or custom installation (Fig. 2). If you are installing the entire
Kaspersky Anti-Virus®application (anti-virus kernel, administration tools, etc.) on
an Microsoft ISA Server computer, select complete installation.
If you want to install a separate component of Kaspersky Anti-Virus®, select
custom installation. For example, if you want to remotely manage Kaspersky
Anti-Virus®, install only the administration console on the administrator’s
workstation.
If you want to install Kaspersky Anti-Virus®for ISA Server administration
console on a computer, make sure that Microsoft Windows 2000 (with
Service Pack 4 and higher) and ISA administration tools are installed on
this computer!
Figure 2. Setup Type

15 Kaspersky Anti-Virus 5.6 for MS ISA Server 2000 Enterprise Edition
Step 3. Selecting the application components to be installed
In this stage, you select the Kaspersky Anti-Virus®components to be installed on
your computer (see Fig. 3).
As a rule, these are administration tools for managing Kaspersky Anti-Virus®that
come together with the Microsoft Management Console.
You can also change the location of the administration console.
Figure 3. Custom Setup. Installing the administration console
Step 4. Anti-virus protection settings
In this installation step, you must define the anti-virus protection settings that will
be used as default values (Fig. 4). The following settings can be adjusted:
• File system folder for storing the scan queue. This directory should meet
the requirements for free disk space for temporarily storing data copied
from the Internet before anti-virus scanning (see section 1.2 on page 6).
• Number of queued objects.
• Folder for storing the anti-virus database that is used to detect and
disinfect viruses.
• Folder for storing temporary files created by the program during its
operation.
• Number of anti-virus kernels running simultaneously.

Installing the application 16
To speed up anti-virus scanning and handling objects, we rec-
ommend that you install four anti-virus kernels on one physical
processor. Thus, for example, the recommended number of
anti-virus kernels running on two physical processors is eight.
Each of the above parameters has a default value. To change the default values,
click the corresponding buttons or enter data into the corresponding fields.
Figure 4. Default settings for the program
Immediately after this stage is completed, the program will start copying files to
your computer.
Step 5. Completing the setup
The last step of Kaspersky Anti-Virus®installation is restarting Microsoft ISA
Server. The server must be restarted in order to load the anti-virus filters included
in the package. You can restart the server from either the Microsoft ISA Server
console or the setup wizard window if you check the corresponding checkbox
(Fig. 6).
Note that anti-virus protection of your ISA server will be activated only
after you restart Microsoft ISA Server services.

17 Kaspersky Anti-Virus 5.6 for MS ISA Server 2000 Enterprise Edition
Figure 5. Complete the setup
In this stage, you can run automatic installation of application license keys by
selecting the corresponding box. If this check box is selected, after the
installation completes, a dialog box opens (see Figure 6) in which you can
add/install a license key file.
Figure 6. Selecting the license key

Installing the application 18
It is possible to install license keys after the application is installed (see
section 4.7 on page 59).
Without an installed license key, Kaspersky Anti-Virus will not scan traf-
fic and the anti-virus database will not be updated.
3.2.2. Reinstalling
Kaspersky Anti-Virus for ISA Server must be reinstalled if the first installation of
the application was incorrect or if you want to install a component of Kaspersky
Anti-Virus®.
To correctly install the anti-virus application, select Repair in the dialog
box that appears on your screen (Fig. 7).
In this case, the setup wizard will repeat the previous installation procedure.
Thus, if the previous installation was a custom type, after you select Repair, the
reinstallation procedure will also be performed in custom mode.
Figure 7. Selecting the reinstallation mode
To install an individual component of the anti-virus application on your
computer, select Modify.
After this, the custom installation dialog box will appear (Fig. 3). To con-
tinue with setup, follow the steps described for the first installation.

CHAPTER 4. USING KASPERSKY
ANTI-VIRUS®FOR ISA
SERVER
The installation package installs Kaspersky Anti-Virus®according to the current
mode of your ISA Server. After the application is installed and the Microsoft ISA
Server services are restarted, Kaspersky Anti-Virus is ready to start scanning
data streams because all the parameters necessary for the scan have been
already set by default. Kaspersky Anti-Virus can be managed:
• Locally, if the server part (anti-virus kernel, anti-virus database and filters
for Microsoft ISA Server) and administration tools (Administration
Console) for the application are installed on the same computer;
• Remotely, if the server part and administration tools are installed on
different computers.
In addition, if the computer is included into the centralized management system
using Kaspersky Administration Kit, you can remotely manage Kaspersky Anti-
Virus through the Kaspersky Administration Kit Administration Console2(see
section 4.8 on page 63).
The installed application automatically creates the user default, the
group default, and the policy default because Kaspersky Anti-Virus®can
work only when at least one group and one policy have been created.
Remember that you cannot delete the default user, group, or policy!
4.1. Default scan settings
You can configure scan settings on the tabs of the Properties of Kaspersky
Anti-Virus for Microsoft ISA Server 2000 Enterprise Edition dialog box. The
following are the default scan settings:
2Hereafter, the Administration Console of Kaspersky Anti-Virus for Microsoft ISA Server
is referred to as the Administration Console. The Administration Console of Kaspersky
Administration Kit is referred to by its full name.