KAPERSKY ANTI-VIRUS 7.0 User manual

KASPERSKY LAB
KasperskyAnti-Virus7.0
USER GUIDE

KASPERSKY ANTI-VIRUS 7.0
User Guide
Kaspersky Lab
http://www.kaspersky.com
Revision date: December, 2007

Contents
CHAPTER 1. THREATS TO COMPUTER SECURITY.................................................9
1.1. Sources of Threats................................................................................................9
1.2. How threats spread.............................................................................................10
1.3. Types of Threats..................................................................................................12
1.4. Signs of Infection.................................................................................................14
1.5. What to do if you suspect infection.....................................................................15
1.6. Preventing Infection.............................................................................................16
CHAPTER 2. KASPERSKY ANTI-VIRUS 7.0..............................................................18
2.1. What‟s new in Kaspersky Anti-Virus 7.0.............................................................18
2.2. The elements of Kaspersky Anti-Virus Defense...............................................20
2.2.1. Real-Time Protection Components..............................................................21
2.2.2. Virus scan tasks............................................................................................22
2.2.3. Update...........................................................................................................23
2.2.4. Program tools................................................................................................23
2.3. Hardware and software system requirements ...................................................24
2.4. Software packages..............................................................................................25
2.5. Support for registered users................................................................................26
CHAPTER 3. INSTALLING KASPERSKY ANTI-VIRUS 7.0.......................................27
3.1. Installation procedure usingthe Installation Wizard...........................................27
3.2. Setup Wizard.......................................................................................................31
3.2.1. Using objects saved with Version 5.0..........................................................32
3.2.2. Activating the program..................................................................................32
3.2.2.1. Selecting a program activation method.................................................32
3.2.2.2. Entering the activation code..................................................................33
3.2.2.3. User Registration...................................................................................34
3.2.2.4. Obtaining a Key File...............................................................................34
3.2.2.5. Selecting a Key File...............................................................................34
3.2.2.6. Completing program activation..............................................................35
3.2.3. Selecting a security mode............................................................................35
3.2.4. Configuring update settings..........................................................................36

4 Kaspersky Anti-Virus 7.0
3.2.5. Configuring a virus scan schedule...............................................................36
3.2.6. Restricting program access..........................................................................37
3.2.7. Application Integrity Control..........................................................................37
3.2.8. Finishing the SetupWizard ..........................................................................38
3.3. Installing the program from the command prompt.............................................38
CHAPTER 4. PROGRAMINTERFACE.......................................................................39
4.1. Icon in the taskbar notification area....................................................................39
4.2. Thecontext menu................................................................................................40
4.3. Main program window.........................................................................................41
4.4. Program settings window....................................................................................45
CHAPTER 5. GETTING STARTED..............................................................................47
5.1. What is the computer‟s protection status?..........................................................47
5.2. Verifying the Status of Each Individual Protection Component.........................49
5.3. How to scan your computer for viruses..............................................................50
5.4. How to scan critical areas of the computer.........................................................51
5.5. How to scan afile, folderor disk for viruses.......................................................51
5.6. How to update theprogram ................................................................................52
5.7.What to do if protectionis not running................................................................53
CHAPTER 6. PROTECTION MANAGEMENT SYSTEM............................................54
6.1. Stopping and resuming real-time protection on your computer.........................54
6.1.1. Pausing protection........................................................................................55
6.1.2. Stopping protection.......................................................................................56
6.1.3. Pausing / Stopping Individual Protection Components...............................57
6.1.4. Restoring protection on your computer........................................................57
6.2. Advanced Disinfection Technology....................................................................58
6.3. Running Application on a Portable Computer....................................................58
6.4. Runtime Computer Performance........................................................................59
6.5. Troubleshooting KasperskyAnti-Virus Compatibility with Other Applications ..59
6.6. Running Virus Scans and Updates as Another User.........................................60
6.7. Configuring Scheduled Tasks and Notifications.................................................61
6.8. Types ofMalware to Monitor...............................................................................63
6.9. Creating a trusted zone.......................................................................................64
6.9.1. Exclusion rules..............................................................................................65
6.9.2. Trusted applications......................................................................................70

Contents 5
CHAPTER 7. FILE ANTI-VIRUS...................................................................................73
7.1. Selecting a file security level...............................................................................74
7.2. Configuring File Anti-Virus...................................................................................75
7.2.1. Defining the filetypes to be scanned...........................................................76
7.2.2. Defining protection scope.............................................................................78
7.2.3. Configuring advanced settings.....................................................................80
7.2.4. Using Heuristic Analysis...............................................................................82
7.2.5. Restoring default File Anti-Virus settings.....................................................84
7.2.6. Selecting actions for objects.........................................................................84
7.3. Postponed disinfection........................................................................................86
CHAPTER 8. MAIL ANTI-VIRUS..................................................................................87
8.1. Selecting an email security level.........................................................................88
8.2. Configuring Mail Anti-Virus..................................................................................89
8.2.1. Selecting a protected email group................................................................90
8.2.2. Configuring email processing in Microsoft Office Outlook...........................92
8.2.3. Configuring email scans in The Bat!............................................................93
8.2.4. Using Heuristic Analysis...............................................................................95
8.2.5. Restoring default Mail Anti-Virus settings....................................................96
8.2.6. Selecting actions for dangerous email objects............................................97
CHAPTER 9.WEB ANTI-VIRUS..................................................................................99
9.1. Selecting Web Security Level...........................................................................100
9.2. Configuring Web Anti-Virus...............................................................................102
9.2.1. General scan settings.................................................................................102
9.2.2. Creating a trusted address list....................................................................104
9.2.3. Using Heuristic Analysis.............................................................................104
9.2.4. Restoring defaultWeb Anti-Virus settings.................................................105
9.2.5. Selecting responses to dangerous objects................................................106
CHAPTER 10. PROACTIVE DEFENSE ....................................................................108
10.1. Activity Monitoring Rules.................................................................................112
10.2. Application Integrity Control............................................................................115
10.2.1. Configuring Application Integrity Control rules.........................................116
10.2.2. Creating a list of common components...................................................118
10.3. Registry Guard ................................................................................................119
10.3.1. Selecting registry keys for creating a rule................................................121

6 Kaspersky Anti-Virus 7.0
10.3.2. Creating a Registry Guard rule................................................................122
CHAPTER 11. SCANNING COMPUTERS FOR VIRUSES .....................................125
11.1. Managing virus scan tasks..............................................................................126
11.2. Creatinga list of objects toscan.....................................................................126
11.3. Creating virus scan tasks................................................................................128
11.4. Configuring virusscan tasks...........................................................................129
11.4.1. Selecting a security level..........................................................................130
11.4.2. Specifying the types of objects to scan....................................................131
11.4.3. Additional virus scan settings...................................................................133
11.4.4. Scanning for rootkits.................................................................................135
11.4.5. Using heuristic methods...........................................................................136
11.4.6. Restoring default scan settings................................................................137
11.4.7. Selecting actions for objects.....................................................................137
11.4.8. Setting up global scan settings forall tasks.............................................139
CHAPTER 12. TESTING KASPERSKY ANTI-VIRUS FEATURES .........................140
12.1. The EICAR test virus and its variations..........................................................140
12.2. Testing File Anti-Virus.....................................................................................142
12.3. Testing Virus scan tasks.................................................................................143
CHAPTER 13. PROGRAM UPDATES.......................................................................145
13.1. Starting the Updater........................................................................................146
13.2. Rolling back to the previous update................................................................147
13.3. Configuring update settings............................................................................147
13.3.1. Selecting an update source......................................................................148
13.3.2. Selecting an update method and what to update....................................150
13.3.3. Update distribution....................................................................................152
13.3.4. Actions after updating the program..........................................................153
CHAPTER 14. MANAGING KEYS .............................................................................155
CHAPTER 15. ADVANCED OPTIONS......................................................................157
15.1. Quarantine for potentially infected objects......................................................158
15.1.1. Actions with quarantined objects .............................................................159
15.1.2. Setting up Quarantine ..............................................................................160
15.2. Backup copies of dangerous objects..............................................................161
15.2.1. Actions with backup copies......................................................................162

Contents 7
15.2.2. Configuring Backup settings ....................................................................163
15.3. Reports............................................................................................................163
15.3.1. Configuring report settings.......................................................................166
15.3.2. The Detected tab......................................................................................166
15.3.3. The Events tab..........................................................................................167
15.3.4. The Statistics tab......................................................................................168
15.3.5. The Settings tab........................................................................................169
15.3.6. The Registry tab.......................................................................................170
15.4. Rescue Disk ....................................................................................................171
15.4.1. Creating a rescue disk..............................................................................172
15.4.2. Using the rescue disk...............................................................................173
15.5. Creating a monitored port list..........................................................................174
15.6. Scanning Secure Connections.......................................................................176
15.7. Configuring Proxy-Server................................................................................178
15.8. Configuring the Kaspersky Anti-Virus interface..............................................180
15.9. Using advanced options..................................................................................182
15.9.1. Kaspersky Anti-Virus event notifications..................................................183
15.9.1.1. Types of events and notification delivery methods...........................184
15.9.1.2. Configuring email notification ............................................................185
15.9.1.3. Configuring event log settings...........................................................186
15.9.2. Self-Defense and access restriction........................................................187
15.9.3. Importing and exporting Kaspersky Anti-Virus settings...........................189
15.9.4. Restoring default settings.........................................................................189
15.10. Technical Support.........................................................................................190
15.11. Closing Application........................................................................................192
CHAPTER 16. WORKING WITH THE PROGRAMFROM THE COMMAND LINE194
16.1. Activating the application.................................................................................195
16.2. Managing program components and tasks....................................................196
16.3. Anti-virus scans...............................................................................................199
16.4. Program updates.............................................................................................203
16.5. Rollback settings.............................................................................................204
16.6. Exporting protection settings...........................................................................204
16.7. Importing settings............................................................................................205
16.8. Starting the program........................................................................................205
16.9. Stopping the program......................................................................................206
16.10. Creatinga trace file.......................................................................................206

8 Kaspersky Anti-Virus 7.0
16.11. Viewing Help..................................................................................................207
16.12. Return codes from the command line interface...........................................207
CHAPTER 17. MODIFYING, REPAIRING, ANDREMOVING THE PROGRAM....208
17.1. Modifying, repairing, and removing the program using InstallWizard...........208
17.2. Uninstalling the program from the command line ..........................................210
CHAPTER 18. FREQUENTLY ASKED QUESTIONS...............................................211
APPENDIX A. REFERENCE INFORMATION...........................................................213
A.1. List of files scanned by extension.....................................................................213
A.2. Valid file exclusion masks.................................................................................215
A.3. Valid exclusion masks by Virus Encyclopedia classification...........................216
APPENDIX B. KASPERSKY LAB...............................................................................218
B.1. Other Kaspersky Lab Products........................................................................219
B.2. Contact Us.........................................................................................................228
APPENDIX C. LICENSE AGREEMENT ....................................................................230

CHAPTER 1. THREATS TO
COMPUTER SECURITY
As information technology has rapidly developed and penetrated many aspects
of human existence, so the number and range of crimes aimed at breaching in-
formation security has grown.
Cyber criminals have shown great interest in the activities of both state structures
and commercial enterprises. They attempt to steal or disclose confidential infor-
mation, which damages business reputations, disrupts business continuity, and
may impair an organization's information resources. These acts can do extensive
damage to assets, both tangible and intangible.
It is not only big companies who are at risk, individual users can also be at-
tacked. Criminals can gain access to personal data (for instance, bank account
and credit card numbers and passwords), or cause a computer to malfunction.
Some types of attacks can give hackers complete access to a computer, which
can then be used as part of a “zombie network” of infected computers to attack
servers, send out spam, harvest confidential information, and spread new viruses
and Trojans.
In today‟s world, it is widely acknowledged that information is a valuable asset
which should be protected. At the same time, information must be accessible to
those who legitimately require it (for instance, employees, clients and partners of
a business). Hence the need to create a comprehensive information security
system, which must take account of all possible sources of threats, whether hu-
man, man-made, or natural disasters, and use a complete array of defensive
measures, at the physical, administrative and software levels.
1.1. Sources of Threats
A person, a group of people, or phenomena unrelated to human activity can
threaten information security. Following from this, all threat sources can be put
into one of three groups:
The human factor. This group of threats concerns the actions of
people with authorized or unauthorized access to information. Threats
in this group can be divided into:
External, including cyber criminals, hackers, internet scams, un-
principled partners, and criminal organizations.

10 Kaspersky Anti-Virus 7.0
Internal, including the actions of company staff and users of home
PCs. Actions taken by this group could be deliberate or accidental.
The technological factor. This threat group is connected with technical
problems –use of obsolete or poor-quality software and hardware to
process information. This can lead to equipment failure and often to da-
ta loss.
The natural-disaster factor. This threat group includes the whole
range of events caused by nature and independent of human activity.
All three threat sources must be accounted for when developing a data security
protection system. This User Guide focuses on the area that is directly tied to
Kaspersky Lab‟s expertise – external threats involving human activity.
1.2. How threats spread
As modern computer technology and communications tools develop, hackers
have more opportunities for spreading threats. Let‟s take a closer look at them:
The Internet
The Internet is unique, since it is no one‟s property and has no
geographical borders. In many ways, this has promoted the development
of web resources and the exchange of information. Today, anyone can
access data on the Internet or create their own webpage.
However, these very features of the worldwide web give hackers the
ability to commit crimes on the Internet, and makes the hackers difficult to
detect and punish.
Hackers place viruses and other malicious programs on Internet sites and
disguise them as useful freeware. In addition, scripts which are run
automatically when certain web pages are loaded, may perform hostile
actions on your computer by modifying the system registry, retrieving your
personal data without your consent, and installing malicious software.
By using network technologies, hackers can attack remote PCs and
company servers. Such attacks may result in a resource being disabled or
used as part of a zombie network, and in full access being gained to a
resource and any information residing on it.
Lastly, since it became possible to use credit cards and e-money through
the Internet in online stores, auctions, and bank homepages, online
scams have become increasingly common.