KAPERSKY ANTI-VIRUS 5.6 - FOR MICROSOFT ISA SERVER 2004-2006 STANDARD... Service manual

KASPERSKY LAB
KasperskyAnti-Virus 5.6for
Microsoft ISAServer2004/2006
Standard Edition
ADMINISTRATOR'S
GUIDE

KASPERSKY ANTI -VIRUS 5.6 FOR MICROSOFT ISA
SERVER 2004/2006 STANDARD EDITION
Administrator's Guide
Kaspersky Lab
http://www.kaspersky.com
Revision date: December, 2008

Contents
CHAPTER 1. KASPERSKY ANTI-VIRUS® FOR MICROSOFT ISA SERVER.......... 5
1.1. Hardware and softwarerequirements............................................................... 6
1.2. Distribution kit................................................................................................... 7
1.2.1. License Agreement.................................................................................... 7
1.3. Services provided for registered users.............................................................. 8
CHAPTER 2. TYPICAL DEPLOYMENT SCENARIOS............................................... 9
CHAPTER 3. INSTALLING THE APPLICATION...................................................... 11
3.1. Configuring ISAServer settings beforeinstalling theapplication..................... 11
3.2. Installing Kaspersky Anti-Virus®...................................................................... 12
3.2.1. Firstinstallation........................................................................................ 13
3.2.2. Reinstalling............................................................................................... 18
3.3. Upgrading....................................................................................................... 19
CHAPTER 4. USING KASPERSKY ANTI-VIRUS®................................................... 20
4.1. Default scan settings....................................................................................... 20
4.2. Managingscans............................................................................................. 22
4.2.1. Configuring general settings of anti-virus scans........................................ 24
4.2.2. Managing client groups............................................................................ 34
4.2.3. Specifying policies for anti-virus scanning................................................. 38
4.3. Updatingtheanti-virus database..................................................................... 45
4.3.1. Scheduled updating of the anti-virusdatabase......................................... 48
4.3.2.On-demandupdating............................................................................... 48
4.4. Configuring notifications.................................................................................. 48
4.5. Testing Kaspersky Anti-Virus®operation......................................................... 49
4.6. Applicationstatistics anddiagnostics.............................................................. 50
4.6.1. Recording and viewing statistics............................................................... 50
4.6.2. Notifying the administrator usingISAServer Alerts................................... 52
4.6.3. Configuring diagnostics optionsfor theapplication................................... 53
4.7. Restrictions that applyto using Kaspersky Anti-Virus...................................... 55
4.8. Managinglicensekeys................................................................................... 56

4 Kaspersky Anti-Virus 5.6 for Microsoft ISA Server 2004/2006 Standard Edition
4.8.1.Installing anew licensekey...................................................................... 57
4.8.2. Renewing your license............................................................................. 59
4.8.3. Removing alicensekey........................................................................... 60
CHAPTER 5. FREQUENTLY ASKEDQUESTIONS................................................ 61
APPENDIX A. GLOSSARY...................................................................................... 65
APPENDIX B. KASPERSKYLAB............................................................................. 66
APPENDIX C. LICENSE AGREEMENT................................................................... 69

CHAPTER 1. KASPERSKY ANTI-
VIRUS® FOR MICROSOFT
ISA SERVER
Kaspersky Anti-Virus®for Microsoft ISA Server (hereafter, also Kaspersky
Anti-Virus®for ISA Server) is a system of anti-virus protection of files trans-
ferred using the HTTP and FTP protocols via the Microsoft Internet Security and
Acceleration Server. It ensures reliable protection of corporate networks from
penetration of malicious software.
Kaspersky Anti-Virus®for Microsoft ISA Server acts as a filter that intercepts
packets transferred via the HTTP and FTP protocols, isolates controlled objects
from this data, analyzes them for the presence of viruses, and prevents infected
files and Web documents from penetrating a corporate network.
The program includes data stream filters and the anti-virus kernel.
The filters are integrated into Microsoft ISA Server as plug-ins, and the anti-virus
kernel is installed into the system as a service.
The anti-virus protection settings are managed through a special interface, which
is a snap-in for Microsoft Management Console (hereafter referred to as MMC).
Note:
The interface for managing Kaspersky Anti-Virus for Microsoft ISA Server can be
installed on a separate administrator desktop.
The application performs the following functions:
Anti-virus protection and processing of data streams received from the In-
ternet.
Generation of data streams from disinfected files and the delivery of these
streams to the client upon request.
Blocking the download of data stream if disinfection fails.
Scheduled and manual updating of the anti-virus database via the Inter-
net, a local folder, or a shared folder.
Logging of statistics about program performance and displaying the re-
sults using standard Microsoft Windows tools.
Management of license keys.

6 Kaspersky Anti-Virus 5.6 for Microsoft ISA Server 2004/2006 Standard Edition
In addition, Kaspersky Anti-Virus®for Microsoft ISA Server allows the administra-
tor to:
Set parameters for anti-virus protection and for notifications about dan-
gerous events.
Create groups of clients in accordance with the adopted network policy.
For example, you can use the existing administration division to define
anti-virus policy settings for each of the groups created. This can signifi-
cantly speed up the scanning process.
Create a list of trusted servers for one or several groups of users; the traf-
fic from these servers will be excluded from scanning for viruses.
Create a list of types of object excluded from anti-virus protection.
Kaspersky Anti-Virus®supports the following data transfer protocols:
HTTP 1.0 and 1.1 (RFC 2616);
FTP (RFC 775, 959, 2389, Extensions to FTP);
FTP over HTTP.
Note:
Kaspersky Anti-Virus does not protect data transferred over the other transfer
protocols and VPN connections.
1.1. Hardware and software
requirements
Kaspersky Anti-Virus®for Microsoft ISA Server operates in integration with Mi-
crosoft® Internet Security and Acceleration Server 2004/2006 Standard Edition
installed on the Microsoft Windows 2000 with installed Service Pack 4 and Mi-
crosoft Windows Server 2003.
If Microsoft Internet Security and Acceleration Server 2006 Standard Edition
have been installed on your server than to use Kaspersky Anti-Virus®you need
Microsoft Windows Server 2003 platform with installed Service Pack 1.
Minimum requirements:
Pentium III processor of 550 MHz or higher.
At least 512 MB free RAM.
At least 50 MB hard disk space for installation of the program.

Kaspersky Anti-Virus® for Microsoft ISA Server 7
At least 200 Mb hard disk space for temporary storage of data copied
from the Internet before scanning for viruses.
Note:
The amount of free disk space required to temporarily store data downloaded
from the Internet before an anti-virus scan starts depends on the density of traffic
processed by Microsoft ISA Server. As a rule, 500 MB is enough but if traffic is
heavy and files downloaded are too large, more space can be required.
1.2. Distribution kit
You can purchase Kaspersky Anti-Virus®for Microsoft ISA Server either from our
distributors (retail box) or online at one of our Internet shops (for example,
www.kaspersky.com –select the E store link).
The retail box includes:
a sealed envelope with an installation CD containing files for the software
product;
administrator's guide;
a license key written on the floppy disk;
license agreement.
Note:
Before you unseal the envelope containing the CD, be sure to thoroughly review
the license agreement.
If you buy Kaspersky Anti-Virus®for Microsoft ISA Server online, you download
the installation file of the product from the Kaspersky Lab website. This installa-
tion file includes this Administrator’s Guide and the license key. The license key
can also be sent to you by e-mail after receiving your payment.
1.2.1. License Agreement
The License Agreement is a legal agreement between you and the manufacturer
(Kaspersky Lab) describing the terms on which you may employ the anti-virus
product which you have purchased.
Warning!
Make sure you read the License Agreement!

8 Kaspersky Anti-Virus 5.6 for Microsoft ISA Server 2004/2006 Standard Edition
If you do not agree to the terms of this LA, you can return the unused product to
your Kaspersky Anti-Virus®dealer for a full refund, making sure the envelope
containing the CD is sealed.
If you unseal the envelope or install the program, you are considered to have
agreed to all the terms of the LA.
1.3. Services provided for registered
users
Kaspersky Lab Ltd. offers to all legally registered users an extensive service
package enabling them to use Kaspersky Anti-Virus more efficiently.
After purchasing a subscription, you become a registered user and, during the
period of your subscription, you will be provided with the following services:
you will be receiving new versions of the purchased software product;
support on issues related to the installation, configuration and use of the
purchased software product. Services will be provided by phone or via
email;
information about new Kaspersky Lab products and about new viruses
appearing worldwide (this service is provided to users who subscribe to
the Kaspersky Lab's newsletter).
Note:
Support on issues related to the performance and the use of operating systems
or other technologies is not provided.

CHAPTER 2. TYPICAL
DEPLOYMENT SCENARIOS
A typical scenario for deploying ISA Server and most of its server applications
and filters is as follows: the administrator installs the application on the ISA Serv-
er computer, and the ISA administration tool on a remote computer (as a rule, an
administrator’s workstation).
In this deployment scenario, the Kaspersky Anti-Virus®application must be in-
stalled on the ISA Server computer, and the Kaspersky Anti-Virus®administra-
tion console, on the administrator’s workstation. The computer that runs the Kas-
persky Anti-Virus®for ISA Server administration console must only have the ISA
Server administration tools installed.
Note:
You can install separate components of Kaspersky Anti-Virus®by manually in-
stalling the application (see Chapter 3 on page 11).
The following Kaspersky Anti-Virus®filters can be integrated into the ISA Server
system:
Kaspersky Anti-Virus FTP Application Filter.
Kaspersky Anti-Virus Web Filter.
After Kaspersky Anti-Virus®is installed, you will be able to manage the above
filters through the ISA Server Administration interface.
Figure 1 shows a scheme of processing the initial data streams that are common
for all possible Kaspersky Anti-Virus®deployment scenarios.

Typical deployment scenarios 10
Figure 1. Processing of data streams by Kaspersky Anti-Virus for Microsoft ISA Server

CHAPTER 3. INSTALLING THE
APPLICATION
To correctly install the Kaspersky Anti-Virus®application, you should first proper-
ly configure FTP Access Filer, a standard filter for ISA Server.
If you also use Microsoft Internet Security and Acceleration Server 2004 Service
Pack 2, you need to configure support for decompression of HTTP objects.
3.1. Configuring ISA Server settings
before installing the application
Microsoft ISA Server provides a standard filter for controlling data packets re-
ceived via the FTP protocol: FTP Access Filter. The status of this filter affects the
performance of Kaspersky Anti-Virus for Microsoft ISA Server.
Warning!
To avoid disabling anti-virus protection of servers, make sure that the FTP
Access Filter is activated.
Data stream filters are controlled from the standard console tree of ISA Server
Management.
To configure FTP Access Filter:
In the console tree of the ISA Management main window, select the
Microsoft Security and Acceleration Server 2004/2006\<Array
name>\Configuration\Add-Ins node and click the Application Filters
tab.
If the filter is disabled, you will see the icon in the list.
Sometimes, third-party filters are used in conjunction with standard Microsoft ISA
Server filters. However, these additional filters can affect the performance of the
anti-virus application if their settings prevent the initial data from entering the
Kaspersky Anti-Virus®filters. Moreover, in some cases, Kaspersky Anti-Virus®
for ISA Server might be completely disabled because of these filters.
In addition for Kaspersky Anti-Virus on Microsoft ISA Server 2004 to function
correctly, you should enable a Microsoft ISA Server option that allows unpacking

12 Kaspersky Anti-Virus 5.6 for Microsoft ISA Server 2004/2006 Standard Edition
traffic before it is transferred to Web filters for processing (compressed content
support).
To enable content compression support:
In the console tree of the ISA Management main window, select the
Microsoft Security and Acceleration Server 2004\<Array
name>\Configuration\General node and then, in the right part of the
window, click the Define HTTP Compression Preferences link. In the
HTTP Compression dialog box, open the Content Inspection tab and
select the Decompress incoming packets to allow ISA Server Web
filters to inspect the content checkbox.
If you plan to manage the application from a remote location, you must allow a
remote administration utility to connect to the ISA Server machine via TCP. Ap-
plication installer automatically creates a rule that allows such connections for
this purpose (Allows Kaspersky Anti-Virus for Microsoft ISA Server Remote
Management).
Warning!
For Microsoft ISA Server 2004 Standard Edition the rule's name will only be dis-
played in English!
By default, this rule is inactive after installation. Before applying this rule, the
administrator can analyze and try it using the Microsoft ISA Server console.
Warning!
To remotely manage Kaspersky Anti-Virus, the remote machine should have the
right to administer Microsoft ISA Server. This is regulated by a built-in system
policy of the firewall in Microsoft ISA Server Remote Management\Microsoft
Management Console (MMC).
3.2. Installing Kaspersky Anti-Virus®
The installation procedure for Kaspersky Anti-Virus®for ISA Server is standard
for most Microsoft Windows applications.
Note:
Before installing Kaspersky Anti-Virus, we recommend that you uninstall anti-
virus applications of other vendors because mutual operation of miscellaneous
anti-virus applications might cause compatibility issues.
The installation application can be run locally on a Microsoft ISA Server comput-
er or remotely, by establishing a terminal session. You can select complete in-

Installing the application 13
stallation or custom installation and restore an Anti-Virus configuration in the
case of an incorrect installation.
Warning!
To install Kaspersky Anti-Virus for Microsoft ISA Server 2004/2006 Standard
Edition, the user must have server administrator rights.
During installation of Kaspersky Anti-Virus, several errors might occur. Each of
these errors causes termination of Kaspersky Anti-Virus installation. To avoid
errors, before installation make sure that your server meets all hardware and
software requirements (see section 1.1 on page6).
Note:
If errors occur during installation, please contact the Technical Support service
(see Appendix A). Please, attach the log file kav4isa.log stored in a temporary
files directory (this directory is specified as a value to the %TEMP% environment
variable.
3.2.1. First installation
Step 1. Welcome and License Agreement dialog boxes
The Kaspersky Anti-Virus®setup wizard starts with the Welcome and License
Agreement dialog boxes. The License Agreement dialog box contains the text
of the License Agreement. To proceed with the installation, read the agreement
thoroughly and accept its terms.
Step 2. User data and selecting installation options
At this stage, the program automatically detects user information by using data
from the operating system registry, and offers two installation options: complete
installation or custom installation (Fig. 2). If you are installing the entire Kas-
persky Anti-Virus®application (anti-virus kernel, administration tools, etc.) on an
Microsoft ISA Server computer, select complete installation.
If you want to install a separate component of Kaspersky Anti-Virus®, select cus-
tom installation. For example, if you want to remotely manage Kaspersky Anti-
Virus®, install only the administration console on the administrator’s workstation.

14 Kaspersky Anti-Virus 5.6 for Microsoft ISA Server 2004/2006 Standard Edition
Warning!
If you want to install Kaspersky Anti-Virus®for ISA Server administration console
on a computer, make sure that Microsoft Windows 2000 (with Service Pack 4
and higher) and ISA Server administration tools are installed on this computer!
Figure 2. Setup Type
Step 3. Selecting the application components to be installed
In this stage, you select the Kaspersky Anti-Virus®components to be installed on
your computer (see Fig. 3). The recommended option is to perform full installa-
tion of all bundled components.
You can also change the destination folder of the anti-virus kernel and adminis-
tration console by clicking Browse.

Installing the application 15
Figure 3. Selecting the administration console to install
Step 4. Anti-virus protection settings
In this installation step, you must define the anti-virus protection settings that will
be used as default values (Fig. 4). The following settings can be adjusted:
File system folder for storing the scan queue. This folder should meet the
minimum requirements for free disk space for temporarily storing data co-
pied from the Internet before anti-virus scanning (see section 1.1 on
page 6).
Number of queued objects.
Folder for storing the anti-virus database that is used to detect and disin-
fect viruses.
Folder for storing temporary files created by the program during its opera-
tion.
Number of anti-virus kernels running simultaneously.
Note:
To speed up anti-virus scanning and handling objects, we recommend that you
install four anti-virus kernels on one physical processor. Thus, for example, the
recommended number of anti-virus kernels running on two physical processors
is eight.

16 Kaspersky Anti-Virus 5.6 for Microsoft ISA Server 2004/2006 Standard Edition
Each of the above parameters has a default value. To change the default values,
click the corresponding buttons or enter data into the corresponding fields.
Figure 4. Default settings for the application
Immediately after this stage is completed, the program will start copying files to
your computer. Microsoft ISA Server services will be automatically restarted1.
1Microsoft ISA Server services will not start if they have been stopped before Kaspersky
Anti-Virus installation.

Installing the application 17
Step 5. Completing the setup
In this step, the wizard informs you that Kaspersky Anti-Virus has been success-
fully installed.
Figure 5. Complete the setup
You can also run a wizard for automatic installation of application license keys by
selecting the corresponding box (see Figure 5). If this check box is selected, after
the installation completes, a dialog box opens (see Figure 6) in which you can
add/install a license key file.

18 Kaspersky Anti-Virus 5.6 for Microsoft ISA Server 2004/2006 Standard Edition
Figure 6. Selecting the license key
It is possible to install license keys after the application is installed (see sec-
tion 4.8 on page 56).
Warning!
Without an installed license key, Kaspersky Anti-Virus will not scan traffic and the
anti-virus database will not be updated.
3.2.2. Reinstalling
Kaspersky Anti-Virus for ISA Server must be reinstalled if the first installation of
the application was incorrect or if you want to install a component of Kaspersky
Anti-Virus®.
In this case, the setup wizard will repeat the previous installation procedure.
Thus, if the previous installation was a custom type, after you select Repair, the
reinstallation procedure will also be performed in custom mode.

Installing the application 19
3.3. Upgrading
If your server has Kaspersky Anti-Virus 5.5 for Microsoft ISA Server 2004 in-
stalled, you can upgrade it to Kaspersky Anti-Virus 5.6 for Microsoft ISA Server
2004/2006. To upgrade the application, launch the installer (see section 3.2.1 on
page 13 for details). The installer will detect the earlier version of the application
and upgrade it preserving the settings and the setup type (complete or selective
installation).
When Microsoft ISA Server is upgraded from 2004 Standard Edition to 2006
Standard Edition, Kaspersky Anti-Virus stops its work. This behaviour follows
from the fact that the procedure updating an ISA server does not preserve the
registration of third-party filters. To restore application functionality, reinstall (up-
grade) your Kaspersky Anti-Virus.
Note:
If version 5.6 of the application is installed on your server, then to reinstall it,
open Microsoft Windows Control Panel, select Add or Remove Pro-
grams→Kaspersky Anti-Virus 5.6 for Microsoft ISA Server 2004/2006 and
click the Repair button in the product properties.
If version 5.5 of the application is installed on your computer, the procedure of its
upgrading to version 5.6 will be performed as described above.

CHAPTER 4. USING KASPERSKY
ANTI-VIRUS®
After the application is installed and the Microsoft ISA Server services are res-
tarted, Kaspersky Anti-Virus is ready to start scanning data streams because all
the parameters necessary for the scan have been already set by default. Kas-
persky Anti-Virus can be managed:
Locally, if the server part (anti-virus kernel, anti-virus database and filters
for Microsoft ISA Server) and administration tools (Administration Con-
sole) for the application are installed on the same computer;
Remotely, if the server part and administration tools are installed on dif-
ferent computers.
Please note, that in order to use remote management, the following protocols
must be employed for accessing the server:
Protocols listed in the standard ISA server policy Allows Kaspersky An-
ti-Virus for Microsoft ISA Server Remote Management from specified
computers using MMC. Access using these protocols can be enabled by
adding a remote computer to that system policy
The Kaspersky Anti-Virus for Microsoft ISA Server Remote Manage-
ment Protocol. Access using that protocol is allowed by a special firewall
rule created by the installer of Kaspersky Anti-Virus.
4.1. Default scan settings
You can configure scan settings on the tabs of the Properties of Kaspersky
Anti-Virus for Microsoft ISA Server dialog box. The following are the default
scan settings:
The HTTP tab displays settings that regulate the application performance
(see section 4.2.1.2 on page 27 for more detail) and messages sent to the
client (see section 4.4 on page 48):
Cure HTTP traffic –enabled
Maximum scanning duration before sending data to client, sec
–30 seconds.
Maximum time span between chunks of data sent to the client,
sec –10 seconds.