KAPERSKY ANTI-VIRUS 5.6 - FOR NOVELL NETWARE Service manual

KASPERSKY LAB
Kaspersky Anti-Virus 5.6
for Novell NetWare
ADMINISTRATOR’S GUIDE

KASPERSKY ANTI-VIRUS 5.6 FOR NOVELL NETWARE
Administrator’s Guide
©Kaspersky Lab
http://www.kaspersky.com/
Revision date: June, 2005

Contents
CHAPTER 1. INTRODUCTION ...................................................................................... 6
1.1. What’s new in Version 5.6?................................................................................... 7
1.2. Hardware and software requirements .................................................................. 7
1.3. Distribution kit ........................................................................................................ 8
1.4. Help Desk for Registered Users ........................................................................... 8
1.5. Conventions........................................................................................................... 9
CHAPTER 2. KASPERSKY ANTI-VIRUS 5.6 FOR NOVELL NETWARE BASICS .. 10
2.1. Deploying protection on servers ......................................................................... 10
2.2. Basic concepts and operation scheme of the application.................................. 11
2.3. Maintaining the antiviral protection system......................................................... 12
CHAPTER 3. INSTALLING, UPDATING, AND UNINSTALLING THE
APPLICATION............................................................................................................ 13
3.1. Installation from the distribution package ........................................................... 13
3.2. Deploying the application across the network.................................................... 17
3.3. Uninstalling the application.................................................................................. 19
3.4. Updating the application version......................................................................... 20
CHAPTER 4. SETTING UP THE APPLICATION ........................................................ 21
4.1. Starting the application........................................................................................ 21
4.2. Application interface ............................................................................................ 21
4.3. Default protection of the server ........................................................................... 24
4.4. Starting/stopping the application on the server .................................................. 25
4.5. Setting up the application .................................................................................... 29
CHAPTER 5. UPDATING THE ANTI-VIRUS DATABASE.......................................... 31
5.1. Creating an update task ...................................................................................... 32
5.2. Setting up the task............................................................................................... 33
5.3. Batch task setup .................................................................................................. 38
5.4. Starting/stopping a task....................................................................................... 40
5.5. Deleting a task ..................................................................................................... 41

4 Kaspersky Anti-Virus for Novell NetWare
CHAPTER 6. SCANNING THE SERVER FOR VIRUSES.......................................... 43
6.1. Creating tasks for Real-Time Protection and On-Demand Scan ...................... 44
6.2. Setting up a task.................................................................................................. 46
6.3. Batch task setup .................................................................................................. 50
6.4. Starting/stopping a task....................................................................................... 51
6.5. Deleting a task ..................................................................................................... 53
CHAPTER 7. GENERATING AND VIEWING LOGS, RECEIVING
NOTIFICATIONS........................................................................................................ 55
7.1. Viewing the anti-virus database updating results............................................... 56
7.2. Viewing the server scanning results ................................................................... 60
7.3. Summarized results of the task execution.......................................................... 65
7.4. Notification regarding detected viruses............................................................... 68
CHAPTER 8. LICENSE MANAGEMENT..................................................................... 69
8.1. Licensing policy ................................................................................................... 69
8.2. Installing the license key...................................................................................... 72
APPENDIX A. APPLICATION SETTINGS ................................................................... 74
A.1. The General Tab................................................................................................. 74
A.2. The Folders Tab.................................................................................................. 75
A.3. The Advanced Tab ............................................................................................. 77
A.4. The Schedule Tab............................................................................................... 78
A.5. The Task Tab ...................................................................................................... 81
A.6. The E-mail Notification tab.................................................................................. 82
APPENDIX B. TASK SETTINGS .................................................................................. 84
B.1. The Update Task ................................................................................................ 84
B.1.1. The Recipients Tab ...................................................................................... 84
B.1.2. The Updating source Tab ............................................................................ 86
B.1.3. The Event log Tab........................................................................................ 90
B.1.4. The Proxy Tab.............................................................................................. 93
B.1.5. The Schedule Tab........................................................................................ 94
B.1.6. The E-mail notification tab............................................................................ 97
B.2. The On-Demand Scan and Real-Time Protection Tasks ................................. 99
B.2.1. The Scan options Tab.................................................................................. 99
B.2.1.1. Code analyzer ..................................................................................... 101
B.2.1.2. Extracting Engine ................................................................................ 102

Contents 5
B.2.1.3. Executable Module Extracting Engine................................................ 102
B.2.2. The Actions Tab ......................................................................................... 103
B.2.3. The Event log Tab...................................................................................... 106
B.2.3.1. Messages regarding infected files ...................................................... 108
B.2.3.2. Messages Regarding Suspicious Files .............................................. 109
B.2.3.3. Warnings.............................................................................................. 110
B.2.3.4. Messages Regarding Packed Executable Files ................................ 110
B.2.3.5. Messages Regarding Archive Files .................................................... 110
B.2.3.6. Messages Regarding Uninfected Files............................................... 110
B.2.4. The NW-Notification Tab............................................................................ 110
B.2.5. The E-mail Notification Tab........................................................................ 113
B.2.6. The Schedule Tab...................................................................................... 114
APPENDIX C. KASPERSKY LAB............................................................................... 119
C.1. Other Kaspersky Lab Products ........................................................................ 120
C.2. Contact Us ........................................................................................................ 124
APPENDIX D. LICENSE AGREEMENT .................................................................... 125

CHAPTER 1. INTRODUCTION
Kaspersky Anti-Virus 5.6 for Novell NetWare is an anti-virus application
designed to protect LAN file servers running the Novell NetWare operating
system.
Kaspersky Anti-Virus 5.6 has the following functions:
• Real-time server protection – scans all started or modified files, then
disinfects and/or deletes infected objects.
• On-demand server scans – successively scans the files on the server
on administrator’s demand or according to a schedule with user-specified
frequency. The anti-virus application can disinfect and/or delete infected
objects.
• Anti-virus database updating – updates the anti-virus database used to
search for viruses, and distributes the downloaded updates to other
servers on the Novell NetWare network. The database can be scheduled
for automatic updating. The application will download the latest updates
via the Internet or the LAN and distribute these among the specified
servers. Prior to updating the anti-virus database on a server the program
will back up all the files being modified, thus making it possible to revert to
the latest update if necessary.
• Quarantine – moves infected or suspicious files to a special storage
location called ‘quarantine’. Quarantined files can be analyzed by the
administrator or sent to the Kaspersky Lab for examination.
• Event log keeping – creates detailed logs and writes the results of the
on-demand server scanning, real-time protection and anti-virus database
updating. The logs can be viewed and printed.
• Backup – saves backup copies of any suspicious or infected files prior to
disinfecting or deleting them. This makes it possible to restore the data in
the event of disinfection, deletion failure or error.
Kaspersky Anti-Virus 5.6 for Novell NetWare is based on the client-server
architecture. Its server part consists of two modules: Kaspersky Anti-Virus,
dealing with anti-virus functionality, and Anti-virus database updating,
responsible for updating the anti-virus database and application modules. The
client part consists of Snapin for ConsoleOne and a web module that provide
the user interface for the application administrative services and enable the user
to install the application, set it up, and manage the server part.

Introduction 7
1.1. What’s new in Version 5.6?
Version 5.6 of Kaspersky Anti-Virus for Novell NetWare described herein has the
following enhancements compared with version 5.5:
• It is possible now to use e-mail for notification of the administrator and
network users about completion of updating and scanning tasks.
• An opportunity for daily data rotation in the event log has been added.
• Automatic creation of backup copies for all updated files of the anti-virus
databases has been implemented to allow roll-back of the last update.
1.2. Hardware and software
requirements
Software requirements:
• A server with installed Novell NetWare ver. 5.x or 6.0, 6.5.
• Installed Apache Web server and a Tomcat servlet container (for installing
and using the web management interface).
Viewing the task performance log within a web interface
requires the presence of an installed Novell NetWare client on
the computer.
• Installed Support Packs:
• For Novell NetWare 5.x – Support Pack 6 or higher
• For Novell NetWare 6.0.x – Support Pack 3 or higher
• All servers and workstations used to control the application must support
the TCP/IP protocols.
• Microsoft Internet Explorer 6.0 or higher.
Hardware requirements:
• An Intel Pentium processor or higher.
• About 12 MB of available (free) RAM.
• About 8 MB of free hard-disk space on the server’s volumes.

8 Kaspersky Anti-Virus for Novell NetWare
1.3. Distribution kit
You can purchase Kaspersky Anti-Virus 5.6 for Novell NetWare either from our
distributors (retail box) or online at one of our Internet shops (for example,
www.kaspersky.com – select the E-Store link).
The retail box includes:
• A sealed envelope with an installation CD containing files for the software
product
• User Guide
• A license key written on the installation CD
• License agreement
Before you unseal the envelope containing the CD, be sure to
thoroughly review the license agreement.
If you buy Kaspersky Anti-Virus 5.6 for Novell NetWare online, you download the
installation file of the product from the Kaspersky Lab website. This installation
file includes this User Guide and the license key. The license key can also be
sent to you by e-mail after receiving your payment.
The License Agreement (LA) is a legal agreement between you and the
manufacturer (Kaspersky Lab Ltd.) describing the terms on which you may use
the anti-virus product which you have purchased.
Make sure you read the License Agreement!
If you do not agree to the terms of this LA you can return the unused product to
your Kaspersky Anti-Virus dealer for a full refund, making sure the envelope
containing the CD is sealed.
By unsealing the envelope or installing the program, you agree to all the terms of
the LA.
1.4. Help Desk for Registered Users
Kaspersky Lab offers a large service package enabling its registered customers
to enjoy all available features of Kaspersky Anti-Virus.
If you register and purchase a subscription you will be provided with the following
services for the period of your subscription:
• New versions of this anti-virus software product provided free of charge.

Introduction 9
• Phone or e-mail advice on matters related to the installation,
configuration, and operation of this anti-virus product.
• Information about new Kaspersky Lab products and about new computer
viruses (for those who subscribe to the Kaspersky Lab newsletter).
Kaspersky Lab does not provide information related to operation and
use of your operating system or various other technologies.
1.5. Conventions
In this book we use various conventions to emphasize different meaningful parts
of the documentation. The table below lists the conventions used in this Guide.
Convention Meaning
Bold font Menu titles, commands, window titles,
dialog elements, etc.
Note.
Additional information, notes
Attention!
Critical information
To do this,
1. Step 1.
2. …
Actions that must be taken
Task or example
Formulation of the problem or an example
of how to use the product.
Solution
A solution of the problem formulated
[key] – Function of the key. Command line keys
Text of information
messages and the com-
mand line
Text of configuration files, information
messages, and the command line.

CHAPTER 2. KASPERSKY ANTI-
VIRUS 5.6 FOR NOVELL
NETWARE BASICS
2.1. Deploying protection on servers
Building of the file server antiviral protection system using Kaspersky Anti-Virus
5.6 for Novell NetWare must begin with installation of Snapin for Novell
ConsoleOne and/or the web management module1.
Snapin for ConsoleOne is installed from the distribution package on one of the
workstations running Windows or on a NetWare server, where the Novell
ConsoleOne network administration utility is installed.
The Web management module is also installed from the distribution package on
a Windows workstation or on a NetWare server with the installed Apache Web
server and Tomcat servlet container.
Snapin for ConsoleOne and the Web module can be installed on only one of the
computers as they provide centralized access to all network resources from a
single administrator workbench. However, if in the event that several
administrators are working jointly, the management modules can be installed on
each of their computers.
If none of the modules is installed, the anti-virus functionality of the
application will be limited to real-time server protection mode with
default settings. Scanning will be launched automatically when starting
the server and will be stopped when the server is shut down. Stopping
or starting the scanning forcibly will only be possible from the command
line by closing or starting the application.
The next step is installation of the server side application on all the NetWare file
servers across the network. Kaspersky Anti-Virus and Anti-virus database
updating modules can be installed on the server either using the distribution
package or without it, by using the Snapin for ConsoleOne or web interface.
1Hereinafter in this Administrator’s Guide we shall demonstrate the interface of the
Snapin for Novell ConsoleOne. All peculiarities of the web-based interface will be men-
tioned individually.

Kaspersky Anti-Virus 5.6 for Novell NetWare basics 11
2.2. Basic concepts and operation
scheme of the application
The antiviral protection system is based on creation of tasks, which maximize the
basic functionality of the application.
A task is a specific action performed by the application. Tasks are divided into
several types according to their function. Kaspersky Anti-Virus 5.6 for Novell
NetWare uses three types of task:
• Real-time protection
• Scan on-demand
• Anti-virus database updating
The tasks can be started according to a schedule, manually, or upon an
application event. Each task has a corresponding set of parameters that specify
how the application will work when running this task.
The set of application parameters common for all its task types makes up the
application settings. The application parameters specific to each type of task
make up task settings.
Because of the distributed architecture of Kaspersky Anti-Virus 5.6 for Novell
NetWare, obtaining access to its anti-virus functionality requires starting its
server part – Kaspersky Anti-Virus or Anti-virus database updating module –
to carry out the update. This can be started using the Snapin for Novell
ConsoleOne or the web module (see section 4.4 on page 25).
In order to initiate execution of the required function, the user must set the
application parameters (see section 4.5 on page 29), create the respective task
(see section 5.1 on page 32 and section 6.1 on page 44), set its generic
parameters (see section 5.2 on page 33 and section 6.2 on page 46) and run this
task (see section 5.4 on page 40 and section 6.4 on page 51). If the scheduled
start mode or start on event mode is selected, the task is launched automatically.
Access to the application administrative functions, and creation and running of
the tasks is granted to the users2who possess administrator rights. The user
rights are checked based on their authentication in the Novell Netware network.
2In this document, users with administrator rights are referred to as users.

12 Kaspersky Anti-Virus for Novell NetWare
2.3. Maintaining the antiviral
protection system
Maintenance of the server antiviral protection system involves the following
processes:
• Reception and processing of virus detection messages
• Regular checking of anti-virus database update reception and distribution
reports
An important factor that determines the quality of infected object detection by
anti-virus programs is completeness of their anti-virus database. The procedure
of searching and removing viruses is based on the records of the anti-virus
database, which stores descriptions of every virus known at the time along with
methods of cleaning objects infected by them.
Kaspersky Lab adds descriptions of new viruses to the anti-virus database daily
and places the updates on the Internet for downloading. It is recommended to
download these updates daily.
The anti-virus database versions must be the same on all the protected servers.
In order to save traffic, the update process can be set up in such a way that the
anti-virus database updates will be downloaded from the Internet by the “main"
server. All the other servers will receive the updates from the shared folder
located on the “main” server.
A server can receive updates only from the server located in the same
NDS tree. Therefore, it is necessary to create at least one server
responsible for updating the anti-virus database in every NDS tree
whose servers are to be protected from viruses.

CHAPTER 3. INSTALLING,
UPDATING, AND
UNINSTALLING THE
APPLICATION
Prior to installing Kaspersky Anti-Virus 5.6 for Novell NetWare please make sure
that hardware and software of the server/workstation meets the program’s
requirements. The minimal possible requirements are specified in section 0 on
page 7.
3.1. Installation from the distribution
package
Kaspersky Anti-Virus 5.6 for Novell NetWare is installed from a computer running
Windows 9x/NT/2000/Me/XP.
To install Kaspersky Anti-Virus 5.6 for Novell NetWare, run the installer
(setup.exe) from the CD with the application distribution package.
This will start the installation wizard. Follow its directions. Most of the
settings required for installation will be made by default or will be based
on the choice you make. Please read carefully the text in each window of
the wizard. Make any desired changes if necessary.
A detailed description of the installation steps is provided below.
1. First of all, the license agreement will be displayed. You must
accept it in order to proceed with the installation.
2. After that you should select the application components to install
(see Figure 1). You can install both the server-side application and
the client application simultaneously (full installation) or install the
Snapin for ConsoleOne first and then deploy the application via
Novell ConsoleOne. To install the server-side application select
Kaspersky Anti-Virus; for the client application select Snapin for
ConsoleOne and/or the Web management module.

14 Kaspersky Anti-Virus for Novell NetWare
Figure 1. Selecting the components to install
3. If you choose to install the server-side application – Kaspersky
Anti-Virus, you will be asked to specify servers for the installation
(Figure 2). Select the required servers from the list of those currently
connected.
Figure 2. Selecting servers for the Kaspersky Anti-Virus installation

Installing, updating, and uninstalling the application 15
4. The next step is specifying the directories in which to install the
components of Kaspersky Anti-Virus 5.6 for Novell NetWare. The
group of elements of the component is only displayed if it was
selected for installation (see Figure 3).
Figure 3. Installation folders selection
The server-side application is installed in the SYS/KAV folder. If you
are installing the product on only one server, you can specify
another destination folder in the volume structure of the server.
As for the installation directory for the Snapin for ConsoleOne, you
must specify the installation directory of Novell ConsoleOne on the
computer from which the application control utility will be started. By
default this field contains the server’s directory
SYS\Public\mgmt\ConsoleOne\1.2 of the workstation’s directory
\Novell\ConsoleOne\1.2. You need to change it.
By default, the Web management module (iKAV) is installed in the
<server_name >\\SYS\Tomcat\4 directory. This path is correct if you
are running a server version 6.0 or higher.
For a server version 5.x, check the version of Tomcat launched at
Apache startup and specify the path <server_name
>\SYS\Tomcat\< Tomcat_version>. The default Tomcat version is
33. The path for this version should be changed to <server_name
>\SYS\Tomcat\33.

16 Kaspersky Anti-Virus for Novell NetWare
If you want to install only the web management module, the default
installation directory is C:\Tomcat\4. You can change the path by
specifying the Tomcat directory on your local drive or simply copy
the module files to the Tomcat directory after the installation.
5. In the license key installation window please specify the license key
file (*.keys), using which Kaspersky Anti-Virus 5.6 for Novell
NetWare will check the validity of the license agreement and its
deadline (see Figure 4).
The license key is your personal “key”, which stores the
information required for full-featured operation of the application
and some reference information. This information includes:
• Support information (who provides it and where it can
by obtained).
• Name, number and the expiration date of the license.
Your license key can be enclosed with the distribution package or
sent to you by e-mail after the product is purchased. The program
will not run without the key file.
Figure 4. The License Key installation window
6. Next, the files will be copied to the server and the settings will be
stored in the NDS.

Installing, updating, and uninstalling the application 17
7. After the wizard successfully completes its work, in the final window
(see Figure 5) you will be offered the opportunity to modify the
AUTOEXEC.NCF file so as to start the server-side application
whenever the server is started. In addition, you will be offered the
possibility of loading the server-side application immediately after
the application is installed on the server. Enable the necessary
checkboxes.
The AUTOEXEC.NCF is modified automatically and does not
require additional settings to be made.
Figure 5. The final window of the setup wizard
3.2. Deploying the application
across the network
If the Snapin for Novell ConsoleOne and/or the Web management module
are already installed on a computer (server or workstation), then the server-side
application can be installed on other servers without using the distribution
package. This is done via Novell ConsoleOne or the web module using the
Install Kaspersky Anti-Virus shortcut menu command of the NDS console tree.

18 Kaspersky Anti-Virus for Novell NetWare
You can install the server-side application of Kaspersky Anti-Virus 5.6 for Novell
Netware on both a server selected in the console tree and several servers at the
same time.
To install Kaspersky Anti-Virus 5.6 for Novell NetWare on a group of
servers:
Select a node in the console tree that contains the required servers and
right click your mouse button to open the shortcut menu. In the shortcut
menu, select the Install Kaspersky Anti-Virus option. If this option is
unavailable in the shortcut menu, Kaspersky Anti-Virus is already installed
on all the servers of this node.
During installation, the program will ask you to select the servers on which
you want to install Kaspersky Anti-Virus and specify the path to the
license key file (see Figure 6). The list of servers available for installation
includes only those servers on which Kaspersky Anti-Virus has not been
installed. The license key file is selected in the same manner as
installation from the distribution package (see section 3.1 on page. 13).
Figure 6. Installing the application on a group of servers via Novell ConsoleOne

Installing, updating, and uninstalling the application 19
In order to make the server-side part of the application launch
automatically at the server start, update the AUTOEXEC.NCF file by
checking the Modify the autoexec.ncf file automatically box (see
Figure 6).
To install Kaspersky Anti-Virus 5.6 for Novell NetWare on one server:
Select a node in the console tree that contains the required servers, open
the shortcut menu, and select the Install Kaspersky Anti-Virus option.
During installation the program will ask you to specify the directory in
which to install the server-side application and the path to the license key
file. You will also be prompted to update the AUTOEXEC.NCF
configuration file to make the server-side part of the application launch at
the server’s start (similarly to Figure 6). These operations are the same as
those described above (see section 3.1 on page. 13).
3.3. Uninstalling the application
Uninstalling Kaspersky Anti-Virus 5.6 for Novell NetWare means removing the
application’s server part from the file servers and removing its client part from the
computers on which it was installed (see section 3.1 on page. 13).
The application’s server part can be uninstalled from the file server selected in
the NDS structure via Novell ConsoleOne using the Remove Kaspersky Anti-
Virus command in the shortcut menu of the console tree. You will be asked to
confirm that you really want to uninstall the application. After the last installed
server part is removed, the NDS structure will be cleared – the Kaspersky Anti-
Virus 5 class and all its attributes will be deleted.
To uninstall the client part, Snapin for ConsoleOne and/or Web management
module, it must be removed from the computer on which it is installed (see
section 3.1 on page 13) using the available file manager. The following files and
directories must be removed from the Novell ConsoleOne installation directory:
For the Snapin for ConsoleOne:
• kav500.jar file from the snapins\mach directory;
• kavResource500.jar file from the resources\mach directory;
• InstallAVP subdirectory from the jre directory;
• KasperskyAV subdirectory from the help directory
For the Web management module:

20 Kaspersky Anti-Virus for Novell NetWare
• For version tomcat 33: the tomcat\33\webapps\ikav directory
and the ikav.war file, the tomcat\33\work\default directory;
• For version tomcat 4:
the tomcat\4\work\standalone\localhost\iKAV directory.
3.4. Updating the application version
In order to upgrade Kaspersky Anti-Virus for Novell NetWare from version 4.0 to
5.6, you must first uninstall version 4.0 and install the new version, according to
the instructions contained in this document (see section 3.1 on page 13).
To update the application from version 5.хto version 5.6, do the following:
1. Install one of the management modules, either for ConsoleOne or the
web module;
2. In the Kaspersky Anti-Virus 5 namespace, select a server on which
you want to upgrade the application version;
3. Open the shortcut menu and select the Update Kaspersky Anti-Virus
option.
After this, all previous settings will be saved and the current license key will be
applied to the new version of Kaspersky Anti-Virus.
Kaspersky Anti-Virus 5.6 for Novell NetWare supports the anti-virus
database formats used in the previous versions of the program.
After software update from version 5.хto 5.6 on the server, you will
have to update the program on all servers included into the list for
distribution of updates. Otherwise updating of the anti-virus databases
on those computers will become impossible.