KAPERSKY ANTI-VIRUS 6.0 User manual

KASPERSKY LAB
Kaspersky®Anti-Virus 6.0
USER GUIDE

KASPERSKY ANTI-VIRUS 6.0
User Guide
©Kaspersky Lab
http://www.kaspersky.com
Revision date: January 2006

Table of Contents
CHAPTER 1. THREATS TO COMPUTER SECURITY................................................. 9
1.1. Sources of Threats ................................................................................................ 9
1.2. How threats spread ............................................................................................. 10
1.3. Types of Threats.................................................................................................. 12
1.4. Signs of Infection ................................................................................................. 15
1.5. What to do if you suspect infection ..................................................................... 16
1.6. Preventing Infection............................................................................................. 17
CHAPTER 2. KASPERSKY ANTI-VIRUS 6.0.............................................................. 19
2.1. What’s new in Kaspersky Anti-Virus 6.0............................................................. 19
2.2. The elements of Kaspersky Anti-Virus Defense................................................. 21
2.2.1. Protection components................................................................................. 22
2.2.2. Virus scan tasks............................................................................................ 23
2.2.3. Program tools................................................................................................ 23
2.3. Hardware and software system requirements ................................................... 25
2.4. Software packages.............................................................................................. 25
2.5. Support for registered users................................................................................ 26
CHAPTER 3. INSTALLING KASPERSKY ANTI-VIRUS 6.0....................................... 27
3.1. Installation procedure using the Installation Wizard........................................... 27
3.2. Setup Wizard ....................................................................................................... 31
3.2.1. Using objects saved with Version 5.0 .......................................................... 31
3.2.2. Activating the program.................................................................................. 31
3.2.2.1. Selecting a program activation method................................................. 32
3.2.2.2. Entering the activation code .................................................................. 32
3.2.2.3. Obtaining a license key.......................................................................... 33
3.2.2.4. Selecting a license key file..................................................................... 33
3.2.2.5. Completing program activation.............................................................. 33
3.2.3. Selecting a security mode ............................................................................ 33
3.2.4. Configuring update settings.......................................................................... 34
3.2.5. Configuring a virus scan schedule ............................................................... 35
3.2.6. Restricting program access.......................................................................... 35

4 Kaspersky Anti-Virus 6.0
3.2.7. Application Integrity Control.......................................................................... 36
3.2.8. Finishing the Setup Wizard .......................................................................... 36
3.3. Installing the program from the command prompt ............................................. 36
3.4. Upgrading from 5.0 to 6.0 ................................................................................... 37
CHAPTER 4. PROGRAM INTERFACE ....................................................................... 38
4.1. System tray icon .................................................................................................. 38
4.2. The context menu................................................................................................ 39
4.3. Main program window......................................................................................... 40
4.4. Program settings window.................................................................................... 43
CHAPTER 5. GETTING STARTED.............................................................................. 45
5.1. What is the protection status of my computer? .................................................. 45
5.1.1. Protection indicators ..................................................................................... 46
5.1.2. Kaspersky Anti-Virus component status...................................................... 49
5.1.3. Program performance statistics ................................................................... 50
5.2. How to scan your computer for viruses .............................................................. 50
5.3. How to scan critical areas of the computer......................................................... 51
5.4. How to scan a file, folder or disk for viruses ....................................................... 51
5.5. How to update the program ................................................................................ 52
5.6. What to do if protection is not running ................................................................ 53
CHAPTER 6. PROTECTION MANAGEMENT SYSTEM............................................ 54
6.1. Stopping and resuming protection on your computer ........................................ 54
6.1.1. Pausing protection ........................................................................................ 54
6.1.2. Stopping protection....................................................................................... 56
6.1.3. Pausing / stopping protection components, virus scans, and update
tasks .............................................................................................................. 56
6.1.4. Restoring protection on your computer........................................................ 57
6.1.5. Shutting down the program .......................................................................... 58
6.2. Types of programs to be monitored.................................................................... 58
6.3. Creating a trusted zone ....................................................................................... 59
6.3.1. Exclusion rules.............................................................................................. 60
6.3.2. Trusted applications...................................................................................... 65
6.4. Starting virus scan and update tasks under another user account ................... 68
6.5. Configuring virus scan and update schedules ................................................... 69
6.6. Power options...................................................................................................... 71
6.7. Advanced Disinfection Technology .................................................................... 72

Table of Contents 5
CHAPTER 7. FILE ANTI-VIRUS ................................................................................... 73
7.1. Selecting a file security level ............................................................................... 73
7.2. Configuring File Anti-Virus................................................................................... 75
7.2.1. Defining the file types to be scanned ........................................................... 75
7.2.2. Defining protection scope............................................................................. 78
7.2.3. Configuring advanced settings..................................................................... 79
7.2.4. Restoring default File Anti-Virus settings ..................................................... 82
7.2.5. Selecting actions for objects......................................................................... 82
7.3. Postponed disinfection ........................................................................................ 84
CHAPTER 8. MAIL ANTI-VIRUS .................................................................................. 85
8.1. Selecting an email protection level ..................................................................... 86
8.2. Configuring Mail Anti-Virus.................................................................................. 87
8.2.1. Selecting a protected email group................................................................ 88
8.2.2. Configuring email processing in Microsoft Office Outlook........................... 89
8.2.3. Configuring email scans in The Bat! ............................................................ 91
8.2.4. Restoring default Mail Anti-Virus settings .................................................... 92
8.2.5. Selecting actions for dangerous email objects ............................................ 93
CHAPTER 9. WEB ANTI-VIRUS .................................................................................. 95
9.1. Selecting the web security level.......................................................................... 96
9.2. Configuring Web Anti-Virus................................................................................. 98
9.2.1. Setting a scan method.................................................................................. 98
9.2.2. Creating a trusted address list...................................................................... 99
9.2.3. Restoring default Web Anti-Virus settings ................................................. 100
9.2.4. Selecting responses to dangerous objects................................................ 101
CHAPTER 10. PROACTIVE DEFENSE .................................................................... 102
10.1. Proactive Defense settings ............................................................................. 105
10.1.1. Activity control rules .................................................................................. 106
10.1.2. Application Integrity Control...................................................................... 110
10.1.2.1. Configuring Application Integrity Control rules.................................. 111
10.1.2.2. Creating a list of shared components................................................ 113
10.1.3. Office Guard.............................................................................................. 114
10.1.4. Registry Guard.......................................................................................... 116
10.1.4.1. Selecting registry keys for creating a rule ......................................... 118
10.1.4.2. Creating a Registry Guard rule.......................................................... 119

6 Kaspersky Anti-Virus 6.0
CHAPTER 11. SCANNING FOR VIRUSES ON YOUR COMPUTER ..................... 121
11.1. Managing virus scan tasks.............................................................................. 122
11.2. Creating a list of objects to scan ..................................................................... 122
11.3. Creating virus scan tasks ................................................................................ 124
11.4. Configuring virus scan tasks ........................................................................... 125
11.4.1. Selecting a security level .......................................................................... 125
11.4.2. Specifying the types of objects to scan.................................................... 126
11.4.3. Restoring default scan settings ................................................................ 129
11.4.4. Selecting actions for objects..................................................................... 129
11.4.5. Advanced virus scan options ................................................................... 131
11.4.6. Setting up global scan settings for all tasks............................................. 133
CHAPTER 12. TESTING KASPERSKY ANTI-VIRUS FEATURES ......................... 134
12.1. The EICAR test virus and its variations .......................................................... 134
12.2. Testing File Anti-Virus ..................................................................................... 136
12.3. Testing Virus scan tasks ................................................................................. 137
CHAPTER 13. PROGRAM UPDATES....................................................................... 139
13.1. Starting the Updater ........................................................................................ 140
13.2. Rolling back to the previous update................................................................ 141
13.3. Creating update tasks ..................................................................................... 141
13.4. Configuring update settings ............................................................................ 143
13.4.1. Selecting an update source...................................................................... 143
13.4.2. Selecting an update method and what to update.................................... 145
13.4.3. Configuring connection settings............................................................... 147
13.4.4. Update distribution.................................................................................... 149
13.4.5. Actions after updating the program.......................................................... 150
CHAPTER 14. ADVANCED OPTIONS ...................................................................... 152
14.1. Quarantine for potentially infected objects...................................................... 153
14.1.1. Actions with quarantined objects.............................................................. 154
14.1.2. Setting up Quarantine............................................................................... 155
14.2. Backup copies of dangerous objects.............................................................. 156
14.2.1. Actions with backup copies ...................................................................... 156
14.2.2. Configuring Backup settings .................................................................... 158
14.3. Reports ............................................................................................................ 158
14.3.1. Configuring report settings ....................................................................... 161

Table of Contents 7
14.3.2. The Detected tab ...................................................................................... 161
14.3.3. The Events tab.......................................................................................... 162
14.3.4. The Statistics tab ...................................................................................... 163
14.3.5. The Settings tab........................................................................................ 164
14.3.6. The Macros tab......................................................................................... 165
14.3.7. The Registry tab ....................................................................................... 166
14.4. General information about the program ......................................................... 167
14.5. Managing licenses........................................................................................... 168
14.6. Technical Support ........................................................................................... 170
14.7. Creating a monitored port list .......................................................................... 171
14.8. Checking your SSL connection....................................................................... 173
14.9. Configuring the Kaspersky Anti-Virus interface.............................................. 175
14.10. Rescue Disk .................................................................................................. 176
14.10.1. Creating a rescue disk............................................................................ 177
14.10.1.1. Getting ready to write the disk......................................................... 177
14.10.1.2. Creating an .iso file .......................................................................... 178
14.10.1.3. Burning the disk ............................................................................... 178
14.10.1.4. Finishing creating a rescue disk...................................................... 178
14.10.2. Using the rescue disk ............................................................................. 178
14.11. Using advanced options................................................................................ 180
14.11.1. Kaspersky Anti-Virus event notifications................................................ 180
14.11.1.1. Types of events and notification delivery methods......................... 181
14.11.1.2. Configuring email notification .......................................................... 183
14.11.1.3. Configuring event log settings ......................................................... 184
14.11.2. Self-Defense and access restriction ...................................................... 185
14.11.3. Resolving conflicts with other applications ............................................ 187
14.12. Importing and exporting Kaspersky Anti-Virus settings ............................... 187
14.13. Resetting to default settings.......................................................................... 188
CHAPTER 15. WORKING WITH THE PROGRAM FROM THE COMMAND
PROMPT .................................................................................................................. 189
15.1. Activating the application................................................................................. 190
15.2. Managing program components and tasks.................................................... 191
15.3. Anti-virus scans ............................................................................................... 192
15.4. Program updates............................................................................................. 196
15.5. Rollback settings ............................................................................................. 197
15.6. Exporting settings ............................................................................................ 197

8 Kaspersky Anti-Virus 6.0
15.7. Importing settings ............................................................................................ 198
15.8. Starting the program........................................................................................ 199
15.9. Stopping the program...................................................................................... 199
15.10. Viewing Help.................................................................................................. 199
15.11. Return codes from the command line interface ........................................... 200
CHAPTER 16. MODIFYING, REPAIRING, AND REMOVING THE PROGRAM .... 201
16.1. Modifying, repairing and removing the program using Setup Wizard ........... 201
16.2. Uninstalling the program from the command prompt..................................... 203
CHAPTER 17. FREQUENTLY ASKED QUESTIONS............................................... 204
APPENDIX A. REFERENCE INFORMATION ........................................................... 206
A.1. List of files scanned by extension..................................................................... 206
A.2. Possible file exclusion masks ........................................................................... 208
A.3. Possible threat exclusion classifications from the Virus Encyclopedia ........... 209
APPENDIX B. KASPERSKY LAB............................................................................... 211
B.1. Other Kaspersky Lab Products ........................................................................ 212
B.2. Contact Us......................................................................................................... 217
APPENDIX C. LICENSE AGREEMENT .................................................................... 218

CHAPTER 1. THREATS TO
COMPUTER SECURITY
As information technology has rapidly developed and penetrated many aspects
of human existence, so the number and range of crimes aimed at breaching
information security has grown.
Cyber criminals have shown great interest in the activities of both state structures
and commercial enterprises. They attempt to steal or disclose confidential
information, which damages business reputations, disrupts business continuity,
and may impair an organization's information resources. These acts can do
extensive damage to assets, both tangible and intangible.
It is not only big companies who are at risk:, individual users can also be
attacked. Criminals can gain access to personal data (for instance, bank account
and credit card numbers and passwords), or cause a computer to malfunction.
Some types of attacks can give hackers complete access to a computer, which
can then be used as part of a “zombie network” of infected computers to attack
servers, send out spam, harvest confidential information, and spread new viruses
and Trojans.
In today’s world, it is widely acknowledged that information is a valuable asset
which should be protected. At the same time, information must be accessible to
those who legitimately require it (for instance, employees, clients and partners of
a business). Hence the need to create a comprehensive information security
system, which must take account of all possible sources of threats, whether
human, man-made, or natural disasters, and use a complete array of defensive
measures, at the physical, administrative and software levels.
1.1. Sources of Threats
A person, a group of people, or phenomena unrelated to human activity can
threaten information security. Following from this, all threat sources can be put
into one of three groups:
•The human factor. This group of threats concerns the actions of people
with authorized or unauthorized access to information. Threats in this
group can be divided into:
•External, including cyber criminals, hackers, internet scams,
unprincipled partners, and criminal organisations.

10 Kaspersky Anti-Virus 6.0
•Internal, including the actions of company staff and users of
home PCs. Actions taken by this group could be deliberate or
accidental.
•The technological factor. This threat group is connected with technical
problems – use of obsolete or poor-quality software and hardware to
process information. This can lead to equipment failure and often to data
loss.
•The natural-disaster factor. This threat group includes the whole range
of events caused by nature and independent of human activity.
All three threat sources must be accounted for when developing a data
security protection system. This User Guide focuses on the area that is
directly tied to Kaspersky Lab’s expertise – external threats involving
human activity.
1.2. How threats spread
As modern computer technology and communications tools develop, hackers
have more opportunities for spreading threats. Let’s take a closer look at them:
The Internet
The Internet is unique, since it is no one’s property and has no
geographical borders. In many ways, this has promoted the development
of web resources and the exchange of information. Today, anyone can
access data on the Internet or create their own webpage.
However, these very features of the worldwide web give hackers the
ability to commit crimes on the Internet, and makes the hackers difficult to
detect and punish.
Hackers place viruses and other malicious programs on Internet sites and
disguise them as useful freeware. Furthermore, scripts that run
automatically when you open a webpage can execute dangerous actions
on your computer, including modifying the system registry, stealing
personal data, and installing malicious software.
By using network technologies, hackers can attack remote PCs and
company servers. These attacks can cause parts of your system to
malfunction, or could provide hackers with complete access to your
system and thereby to the information stored on it. They can also use it
as part of a zombie network.
Lastly, since it became possible to use credit cards and e-money through
the Internet in online stores, auctions, and bank homepages, online
scams have become increasingly common.

Threats to Computer Security 11
Intranet
Your intranet is your internal network, specially designed for handling
information within a company or a home network. An intranet is a unified
space for storing, exchanging, and accessing information for all the
computers on the network. This means that if one computer on the
network is infected, the others are at great risk of infection. To avoid such
situations, both the network perimeter and each individual computer must
be protected.
Email
Since the overwhelming majority of computers have email client programs
installed, and since malicious programs exploit the contents of electronic
address books, conditions are usually right for spreading malicious
programs. The user of an infected computer might, without realizing, send
infected emails to friends or coworkers who in turn send more infected
emails. For example, it is common for infected file documents to go
undetected when distributed with business information via a company’s
internal email system. When this occurs, more than a handful of people
are infected. It might be hundreds or thousands of company workers,
together with potentially tens of thousands of subscribers.
Beyond the threat of malicious programs lies the problem of electronic
junk email, or spam. Although not a direct threat to a computer, spam
increases the load on email servers, eats up bandwidth, clogs up the
user’s mailbox, and wastes working hours, thereby incurring financial
harm.
Also, hackers have begun using mass mailing programs and social
engineering methods to convince users to open emails, or click on a link
to certain websites. It follows that spam filtration capabilities are valuable
for several purposes: to stop junk email; to counteract new types of online
scans, such as phishing; to stop the spread of malicious programs.
Removable storage media
Removable media (floppies, CD/DVD-ROMs, and USB flash drives) are
widely used for storing and transmitting information.
Opening a file that contains malicious code and is stored on a removable
storage device can damage data stored on the local computer and spread
the virus to the computer’s other drives or other computers on the
network.

12 Kaspersky Anti-Virus 6.0
1.3. Types of Threats
There are a vast number of threats to computer security today. This section will
review the threats that are blocked by Kaspersky Anti-Virus.
Worms
This category of malicious programs spreads itself largely by exploiting
vulnerabilities in computer operating systems. The class was named for
the way that worms crawl from computer to computer, using networks,
and email. This feature allows worms to spread themselves very rapidly.
Worms penetrate a computer, search for the network addresses of other
computers, and send a burst of self-made copies to these addresses. In
addition, worms often utilize data from email client address books. Some
of these malicious programs occasionally create working files on system
disks, but they can run without any system resources except RAM.
Viruses
Viruses are programs which infect other files, adding their own code to
them to gain control of the infected files when they are opened. This
simple definition explains the fundamental action performed by a virus –
infection.
Trojans
Trojans are programs which carry out unauthorized actions on computers,
such as deleting information on drives, making the system hang, stealing
confidential information, and so on. This class of malicious program is not
a virus in the traditional sense of the word, because it does not infect
other computers or data. Trojans cannot break into computers on their
own and are spread by hackers, who disguise them as regular software.
The damage that they inflict can greatly exceed that done by traditional
virus attacks.
Recently, worms have been the commonest type of malicious program damaging
computer data, followed by viruses and Trojans. Some malicious programs
combine features of two or even three of these classes.
Adware
Adware comprises programs which are included in software, unknown to
the user, which is designed to display advertisements. Adware is usually
built into software that is distributed free. The advertisement is situated in
the program interface. These programs also frequently collect personal
data on the user and send it back to their developer, change browser
settings (start page and search pages, security levels, etc.) and create

Threats to Computer Security 13
traffic that the user cannot control. This can lead to a security breach and
to direct financial losses.
Spyware
This software collects information about a particular user or organization
without their knowledge. Spyware often escapes detection entirely. In
general, the goal of spyware is to:
•trace user actions on a computer;
•gather information on the contents of your hard drive; in such
cases, this usually involves scanning several directories and the
system registry to compile a list of software installed on the
computer;
•gather information on the quality of the connection, bandwidth,
modem speed, etc.
Riskware
Riskware includes software that does not have malicious features but
could form part of the development environment for malicious programs
or could be used by hackers as auxiliary components for malicious
programs. This program category includes programs with backdoors and
vulnerabilities, as well as some remote administration utilities, keyboard
layout togglers, IRC clients, FTP servers, and all-purpose utilities for
stopping processes or hiding their operation.
Another type of malicious program that is similar to adware, spyware, and
riskware are programs that plug into your web browser and redirect traffic. The
web browser will open different web sites than those intended.
Jokes
Joke software does not do any direct damage, but displays messages
stating that damage has already been done or will be under certain
conditions. These programs often warn the user of non-existent dangers,
such as messages that warn of formatting the hard drive (although no
formatting actually takes place) or detecting viruses in uninfected files.
Rootkits
These are utilities which are used to conceal malicious activity. They
mask malicious programs to keep anti-virus programs from detecting
them. Rootkits modify basic functions of the computer’s operating system
to hide both their own existence and actions that the hacker undertakes
on the infected computer.

14 Kaspersky Anti-Virus 6.0
Other dangerous programs
These are programs created to, for instance, set up denial of service
(DoS) attacks on remote servers, hack into other computers, and
programs that are part of the development environment for malicious
programs. These programs include hack tools, virus builders, vulnerability
scanners, password-cracking programs, and other types of programs for
cracking network resources or penetrating a system.
Hacker attacks
Hacker attacks can be initiated either by hackers or by malicious
programs. They are aimed at stealing information from a remote
computer, causing the system to malfunction, or gaining full control of the
system's resources.
Some types of online scams
Phishing is an online scam that uses mass emailings to steal confidential
information from the user, generally of a financial nature. Phishing emails
are designed to maximally resemble informative emails from banks and
well-known companies. These emails contain links to fake websites
created by hackers to mimic the site of the legitimate organization. On this
site, the user is asked to enter, for example, his credit card number and
other confidential information.
Dialers to pay-per-use websites – type of online scam using
unauthorized use of pay-per-use Internet services, which are commonly
pornographic web sites. The dialers installed by hackers initiate modem
connections from your computer to the number for the pay service. These
phone numbers often have very high rates and the user is forced to pay
enormous telephone bills.
Intrusive advertising
This includes popup windows and banner ads that open when using your
web browser. The information in these windows is generally not of benefit
to the user. Popup windows and banner ads distract the user from the
task and take up bandwidth.
Spam
Spam is anonymous junk email, and includes several different types of
content: adverts; political messages; requests for assistance; emails that
ask one to invest large amounts of money or to get involved in pyramid
schemes; emails aimed at stealing passwords and credit card numbers,
and emails that ask to be sent to friends (chain letters).

Threats to Computer Security 15
Kaspersky Anti-Virus uses two methods for detecting and blocking these threat
types:
•Reactive – this method searches for malicious files using a threat
signature database that is regularly updated.
•Proactive – in contrast to reactive protection, this method is not based on
analyzing code but on the system’s behavior. This method is aimed at
detecting new threats that are still not defined in the signatures.
By employing both methods, Kaspersky Anti-Virus provides comprehensive
protection for your computer from both known and new threats.
1.4. Signs of Infection
There are a number of signs that a computer is infected. The following events
are good indicators that a computer is infected with a virus:
•Unexpected messages or images appear on the screen or you hear
unusual sounds;
•The CD/DVD-ROM tray opens and closes unexpectedly;
•The computer arbitrarily launches a program without your assistance;
•Warnings pop up on the screen about a program attempting to access the
Internet, even though you initiated no such action;
There are also several typical traits of a virus infection through email:
•Friends or acquaintances tell you about messages from you that you
never sent;
•Your inbox houses a large number of messages without return addresses
or headers.
It must be noted that these signs can arise from causes other than viruses. For
example, in the case of email, infected messages can be sent with your return
address but not from your computer.
There are also indirect indications that your computer is infected:
•Your computer freezes or crashes frequently;
•Your computer loads programs slowly;
•You cannot boot up the operating system;
•Files and folders disappear or their contents are distorted;
•The hard drive is frequently accessed (the light blinks);

16 Kaspersky Anti-Virus 6.0
•The web browser program (for example, Microsoft Internet Explorer)
freezes or behaves unexpectedly (for example, you cannot close the
program window).
In 90% of cases, these indirect systems are caused by malfunctions in hardware
or software. Despite the fact that such symptoms rarely indicate infection, we
recommend that, upon detecting them, you run a complete scan of your
computer (see 5.2 on pg. 50) with the settings at the recommended level.
1.5. What to do if you suspect
infection
If you notice that your computer is behaving suspiciously…
1. Don’t panic! This is the golden rule: it could save you from losing
important data, and from a lot of needless worry.
2. Disconnect your computer from the Internet or local network, if it is on
one.
3. If the computer will not boot from the hard drive (the computer displays
an error message when you turn it on), try booting in safe mode or with
the emergency operating system boot disk that you created when you
installed the operating system.
4. Before doing anything else, back up your work on removable storage
media (floppy, CD/DVD, flash drive, etc.).
5. Install Kaspersky Anti-Virus, if you have not done so already. See
section Chapter 3 on page 27.
6. Update the program’s threat signatures and application modules (see
5.5 on pg. 52). If possible, download the updates off the Internet from a
different, uninfected ,computer, for instance at a friend’s, an Internet
café, or work. It is better to use a different computer since, when you
connect an infected computer to the Internet, there is a chance that the
virus will send important information to hackers or spread the virus to
the addresses in your address book. That is why if you suspect that
your computer has a virus, you should immediately disconnect from the
Internet. You can also get threat signature updates on floppy disk from
Kaspersky Lab or its distributors and update your signatures using the
disk.
7. Select the security level recommended by the experts at Kaspersky
Lab.
8. Start a full computer scan (see 5.2 on pg. 50).

Threats to Computer Security 17
1.6. Preventing Infection
Not even the most reliable and deliberate measures can provide 100% protection
against computer viruses and Trojans, but following such a set of rules
significantly lowers the likelihood of virus attacks and the level of potential
damage.
The basic safety rules are discussed in the rest of this chapter..
Rule No. 1: Use anti-virus software and Internet security programs. To do so:
•Install Kaspersky Anti-Virus as soon as possible.
•Regularly (see 5.5 on pg. 52) update the program’s threat signatures. You
should update the signatures several times per day during virus
outbreaks. In such situations, the threat signatures on Kaspersky Lab’s
update servers are updated immediately.
•Select the security settings recommended by Kaspersky Lab for your
computer. You will be protected constantly from the moment the
computer is turned on, and it will be harder for viruses to infect your
computer.
•Select the settings for a complete scan recommended by Kaspersky Lab,
and schedule scans for at least once per week.
Rule No. 2: Use caution when copying new data to your computer:
•Scan all removable storage drives, for example floppies, CD/DVDs, and
flash drives, for viruses before using them (see 5.4 on pg. 51).
•Treat emails with caution. Do not open any files attached to emails unless
you are certain that you were intended to receive them, even if they were
sent by people you know.
•Be careful with information obtained through the Internet. If any web site
suggests that you install a new program, be certain that it has a security
certificate.
•If you are copying an executable file from the Internet or local network, be
sure to scan it with Kaspersky Anti-Virus.
•Use discretion when visiting web sites. Many sites are infected with
dangerous script viruses or Internet worms.
Rule No. 3: Pay close attention to information from Kaspersky Lab.
In most cases, Kaspersky Lab announces a new outbreak long before it
reaches its peak. The likelihood of the infection in such a case is low, and

18 Kaspersky Anti-Virus 6.0
once you download the threat signature updates, you will have plenty of
time to protect yourself against the new virus.
Rule No. 4: Do not trust virus hoaxes, such as prank programs and emails about
infection threats.
Rule No. 5: Use the Windows Update tool and regularly install Windows
operating system updates.
Rule No. 6: Buy legitimate copies of software from official distributors.
Rule No. 7: Limit the number of people who are allowed to use your computer.
Rule No. 8: Lower the risk of unpleasant consequences of a potential infection:
•Back up data regularly. If you lose your data, the system can fairly quickly
be restored if you have backup copies. Store distribution floppies, CDs,
flash drives, and other storage media with software and valuable
information in a safe place.
•Create a Rescue Disk (see 14.10 on pg. 176) that you can use to boot up
the computer, using a clean operating system.
Rule No. 9: Regularly inspect the list of installed programs on your computer. To
do so, open Install/Remove Programs in the Control Panel, or look
through the Program Files directory and the startup directory. You may
discover software here that was installed on your computer without your
knowledge, for example, while you were using the Internet or installing a
different program. Programs like these are almost always potentially
dangerous.

CHAPTER 2. KASPERSKY ANTI-
VIRUS 6.0
Kaspersky Anti-Virus 6.0 heralds a new generation of data security products.
What really sets Kaspersky Anti-Virus 6.0 apart from other software, even from
other Kaspersky Lab products, is its multi-faceted approach to data security.
2.1. What’s new in Kaspersky Anti-
Virus 6.0
Kaspersky Anti-Virus 6.0 (henceforth referred to as “Kaspersky Anti-Virus”, or
“the program”) has a new approach to data security. The program’s main feature
is that it combines and noticeably improves the existing features of all the
company’s products in one security solution. The program provides protection
against viruses and unknown threats.
You will no longer need to install several products on your computer for overall
security. It is enough simply to install Kaspersky Anti-Virus 6.0.
Comprehensive protection guards all incoming and outgoing data channels. All
of the program’s components have flexible settings which enable Kaspersky Anti-
Virus to adapt to the needs of each user. Configuration of the entire program can
be done from one location.
Let’s take a look at the new features in Kaspersky Anti-Virus.
New Protection Features
•Kaspersky Anti-Virus protects you both from known malicious programs,
and from programs that have not yet been discovered. Proactive Defense
(see Chapter 10 on pg. 102) is the program’s key advantage. It analyzes
the behavior of applications installed on your computer, monitoring
changes to the system registry, tracking macros, and fighting hidden
threats. The component uses a heuristic analyzer to detect and record
various types of malicious activity, with which actions taken by malicious
programs can be rolled back and the system can be restored to its state
prior to the malicious activity.
•File Anti-Virus technology has been improved: now you can lower the
load on the central processor and disk subsystems and increase the

20 Kaspersky Anti-Virus 6.0
speed of file scans. iCheckerТМ and iSwiftТМ help achieve this. This
method rules out the application repeating scans of the same files.
•The scan process now runs as a background task, enabling the user to
continue using the computer. If there is a competition for system
resources, the virus scan will pause until the user’s operation is
completed and then resumes at the point where it left off.
•Critical areas of the computer, which if infected would seriously affect
data quality or security, are given their own separate task. This task can
be configured to run automatically every time the system is started.
•Major advances have been made in protecting the user's e-mail from
malicious programs. The program scans these protocols for emails
containing viruses:
•IMAP, SMTP, POP3, regardless of which email client you use
•NNTP, regardless of the email client
•Regardless of the protocol (MAPI, HTTP) when using plug-ins
for Microsoft Office Outlook and The Bat!
•Special plug-ins are available for the most common mail clients, such as
Outlook, Microsoft Outlook Express, and The Bat!. These place email
protection against both viruses directly in the mail client.
•The user notification function (see 14.11.1 on pg. 180) has been
expanded for certain protection events. You can select the method of
notification by choosing from emails, sound notifications, popup
messages, and logging the event.
•The program now has the ability to scan traffic sent over SSL protocol.
•The program has added self-defense features, including protection
against unauthorized remote access of Anti-Virus services, and password
protection for program settings. These features help keep malicious
programs, hackers, and unauthorized users from disabling protection.
•The option of creating a rescue disk has been added. Using this disk, you
can restart your operating system after a virus attack and scan it for
malicious objects.
New Program Interface Features
•The new Kaspersky Anti-Virus interface makes the program’s functions
clear and easy to use. You can also change the program’s appearance by
using your own graphics and color schemes.
•The program regularly provides you with tips as you use it: Kaspersky
Anti-Virus displays informative messages on the level of protection,