KAPERSKY ANTI-VIRUS 7.0 User manual

KASPERSKY LAB
KasperskyAnti-Virus7.0
USER GUIDE

KASPERSKY ANTI-VIRUS 7.0
User Guide
Kaspersky Lab
http://www.kaspersky.com
Revision date: December, 2007

Contents
CHAPTER 1. THREATS TO COMPUTER SECURITY.................................................9
1.1. Sources of Threats................................................................................................9
1.2. How threats spread.............................................................................................10
1.3. Types of Threats..................................................................................................12
1.4. Signs of Infection.................................................................................................14
1.5. What to do if you suspect infection.....................................................................15
1.6. Preventing Infection.............................................................................................16
CHAPTER 2. KASPERSKY ANTI-VIRUS 7.0..............................................................18
2.1. What‟s new in Kaspersky Anti-Virus 7.0.............................................................18
2.2. The elements of Kaspersky Anti-Virus Defense...............................................20
2.2.1. Real-Time Protection Components..............................................................21
2.2.2. Virus scan tasks............................................................................................22
2.2.3. Update...........................................................................................................23
2.2.4. Program tools................................................................................................23
2.3. Hardware and software system requirements ...................................................24
2.4. Software packages..............................................................................................25
2.5. Support for registered users................................................................................26
CHAPTER 3. INSTALLING KASPERSKY ANTI-VIRUS 7.0.......................................27
3.1. Installation procedure usingthe Installation Wizard...........................................27
3.2. Setup Wizard.......................................................................................................31
3.2.1. Using objects saved with Version 5.0..........................................................32
3.2.2. Activating the program..................................................................................32
3.2.2.1. Selecting a program activation method.................................................32
3.2.2.2. Entering the activation code..................................................................33
3.2.2.3. User Registration...................................................................................34
3.2.2.4. Obtaining a Key File...............................................................................34
3.2.2.5. Selecting a Key File...............................................................................34
3.2.2.6. Completing program activation..............................................................35
3.2.3. Selecting a security mode............................................................................35
3.2.4. Configuring update settings..........................................................................36

4 Kaspersky Anti-Virus 7.0
3.2.5. Configuring a virus scan schedule...............................................................36
3.2.6. Restricting program access..........................................................................37
3.2.7. Application Integrity Control..........................................................................37
3.2.8. Finishing the SetupWizard ..........................................................................38
3.3. Installing the program from the command prompt.............................................38
CHAPTER 4. PROGRAMINTERFACE.......................................................................39
4.1. Icon in the taskbar notification area....................................................................39
4.2. Thecontext menu................................................................................................40
4.3. Main program window.........................................................................................41
4.4. Program settings window....................................................................................45
CHAPTER 5. GETTING STARTED..............................................................................47
5.1. What is the computer‟s protection status?..........................................................47
5.2. Verifying the Status of Each Individual Protection Component.........................49
5.3. How to scan your computer for viruses..............................................................50
5.4. How to scan critical areas of the computer.........................................................51
5.5. How to scan afile, folderor disk for viruses.......................................................51
5.6. How to update theprogram ................................................................................52
5.7.What to do if protectionis not running................................................................53
CHAPTER 6. PROTECTION MANAGEMENT SYSTEM............................................54
6.1. Stopping and resuming real-time protection on your computer.........................54
6.1.1. Pausing protection........................................................................................55
6.1.2. Stopping protection.......................................................................................56
6.1.3. Pausing / Stopping Individual Protection Components...............................57
6.1.4. Restoring protection on your computer........................................................57
6.2. Advanced Disinfection Technology....................................................................58
6.3. Running Application on a Portable Computer....................................................58
6.4. Runtime Computer Performance........................................................................59
6.5. Troubleshooting KasperskyAnti-Virus Compatibility with Other Applications ..59
6.6. Running Virus Scans and Updates as Another User.........................................60
6.7. Configuring Scheduled Tasks and Notifications.................................................61
6.8. Types ofMalware to Monitor...............................................................................63
6.9. Creating a trusted zone.......................................................................................64
6.9.1. Exclusion rules..............................................................................................65
6.9.2. Trusted applications......................................................................................70

Contents 5
CHAPTER 7. FILE ANTI-VIRUS...................................................................................73
7.1. Selecting a file security level...............................................................................74
7.2. Configuring File Anti-Virus...................................................................................75
7.2.1. Defining the filetypes to be scanned...........................................................76
7.2.2. Defining protection scope.............................................................................78
7.2.3. Configuring advanced settings.....................................................................80
7.2.4. Using Heuristic Analysis...............................................................................82
7.2.5. Restoring default File Anti-Virus settings.....................................................84
7.2.6. Selecting actions for objects.........................................................................84
7.3. Postponed disinfection........................................................................................86
CHAPTER 8. MAIL ANTI-VIRUS..................................................................................87
8.1. Selecting an email security level.........................................................................88
8.2. Configuring Mail Anti-Virus..................................................................................89
8.2.1. Selecting a protected email group................................................................90
8.2.2. Configuring email processing in Microsoft Office Outlook...........................92
8.2.3. Configuring email scans in The Bat!............................................................93
8.2.4. Using Heuristic Analysis...............................................................................95
8.2.5. Restoring default Mail Anti-Virus settings....................................................96
8.2.6. Selecting actions for dangerous email objects............................................97
CHAPTER 9.WEB ANTI-VIRUS..................................................................................99
9.1. Selecting Web Security Level...........................................................................100
9.2. Configuring Web Anti-Virus...............................................................................102
9.2.1. General scan settings.................................................................................102
9.2.2. Creating a trusted address list....................................................................104
9.2.3. Using Heuristic Analysis.............................................................................104
9.2.4. Restoring defaultWeb Anti-Virus settings.................................................105
9.2.5. Selecting responses to dangerous objects................................................106
CHAPTER 10. PROACTIVE DEFENSE ....................................................................108
10.1. Activity Monitoring Rules.................................................................................112
10.2. Application Integrity Control............................................................................115
10.2.1. Configuring Application Integrity Control rules.........................................116
10.2.2. Creating a list of common components...................................................118
10.3. Registry Guard ................................................................................................119
10.3.1. Selecting registry keys for creating a rule................................................121

6 Kaspersky Anti-Virus 7.0
10.3.2. Creating a Registry Guard rule................................................................122
CHAPTER 11. SCANNING COMPUTERS FOR VIRUSES .....................................125
11.1. Managing virus scan tasks..............................................................................126
11.2. Creatinga list of objects toscan.....................................................................126
11.3. Creating virus scan tasks................................................................................128
11.4. Configuring virusscan tasks...........................................................................129
11.4.1. Selecting a security level..........................................................................130
11.4.2. Specifying the types of objects to scan....................................................131
11.4.3. Additional virus scan settings...................................................................133
11.4.4. Scanning for rootkits.................................................................................135
11.4.5. Using heuristic methods...........................................................................136
11.4.6. Restoring default scan settings................................................................137
11.4.7. Selecting actions for objects.....................................................................137
11.4.8. Setting up global scan settings forall tasks.............................................139
CHAPTER 12. TESTING KASPERSKY ANTI-VIRUS FEATURES .........................140
12.1. The EICAR test virus and its variations..........................................................140
12.2. Testing File Anti-Virus.....................................................................................142
12.3. Testing Virus scan tasks.................................................................................143
CHAPTER 13. PROGRAM UPDATES.......................................................................145
13.1. Starting the Updater........................................................................................146
13.2. Rolling back to the previous update................................................................147
13.3. Configuring update settings............................................................................147
13.3.1. Selecting an update source......................................................................148
13.3.2. Selecting an update method and what to update....................................150
13.3.3. Update distribution....................................................................................152
13.3.4. Actions after updating the program..........................................................153
CHAPTER 14. MANAGING KEYS .............................................................................155
CHAPTER 15. ADVANCED OPTIONS......................................................................157
15.1. Quarantine for potentially infected objects......................................................158
15.1.1. Actions with quarantined objects .............................................................159
15.1.2. Setting up Quarantine ..............................................................................160
15.2. Backup copies of dangerous objects..............................................................161
15.2.1. Actions with backup copies......................................................................162

Contents 7
15.2.2. Configuring Backup settings ....................................................................163
15.3. Reports............................................................................................................163
15.3.1. Configuring report settings.......................................................................166
15.3.2. The Detected tab......................................................................................166
15.3.3. The Events tab..........................................................................................167
15.3.4. The Statistics tab......................................................................................168
15.3.5. The Settings tab........................................................................................169
15.3.6. The Registry tab.......................................................................................170
15.4. Rescue Disk ....................................................................................................171
15.4.1. Creating a rescue disk..............................................................................172
15.4.2. Using the rescue disk...............................................................................173
15.5. Creating a monitored port list..........................................................................174
15.6. Scanning Secure Connections.......................................................................176
15.7. Configuring Proxy-Server................................................................................178
15.8. Configuring the Kaspersky Anti-Virus interface..............................................180
15.9. Using advanced options..................................................................................182
15.9.1. Kaspersky Anti-Virus event notifications..................................................183
15.9.1.1. Types of events and notification delivery methods...........................184
15.9.1.2. Configuring email notification ............................................................185
15.9.1.3. Configuring event log settings...........................................................186
15.9.2. Self-Defense and access restriction........................................................187
15.9.3. Importing and exporting Kaspersky Anti-Virus settings...........................189
15.9.4. Restoring default settings.........................................................................189
15.10. Technical Support.........................................................................................190
15.11. Closing Application........................................................................................192
CHAPTER 16. WORKING WITH THE PROGRAMFROM THE COMMAND LINE194
16.1. Activating the application.................................................................................195
16.2. Managing program components and tasks....................................................196
16.3. Anti-virus scans...............................................................................................199
16.4. Program updates.............................................................................................203
16.5. Rollback settings.............................................................................................204
16.6. Exporting protection settings...........................................................................204
16.7. Importing settings............................................................................................205
16.8. Starting the program........................................................................................205
16.9. Stopping the program......................................................................................206
16.10. Creatinga trace file.......................................................................................206

8 Kaspersky Anti-Virus 7.0
16.11. Viewing Help..................................................................................................207
16.12. Return codes from the command line interface...........................................207
CHAPTER 17. MODIFYING, REPAIRING, ANDREMOVING THE PROGRAM....208
17.1. Modifying, repairing, and removing the program using InstallWizard...........208
17.2. Uninstalling the program from the command line ..........................................210
CHAPTER 18. FREQUENTLY ASKED QUESTIONS...............................................211
APPENDIX A. REFERENCE INFORMATION...........................................................213
A.1. List of files scanned by extension.....................................................................213
A.2. Valid file exclusion masks.................................................................................215
A.3. Valid exclusion masks by Virus Encyclopedia classification...........................216
APPENDIX B. KASPERSKY LAB...............................................................................218
B.1. Other Kaspersky Lab Products........................................................................219
B.2. Contact Us.........................................................................................................228
APPENDIX C. LICENSE AGREEMENT ....................................................................230

CHAPTER 1. THREATS TO
COMPUTER SECURITY
As information technology has rapidly developed and penetrated many aspects
of human existence, so the number and range of crimes aimed at breaching in-
formation security has grown.
Cyber criminals have shown great interest in the activities of both state structures
and commercial enterprises. They attempt to steal or disclose confidential infor-
mation, which damages business reputations, disrupts business continuity, and
may impair an organization's information resources. These acts can do extensive
damage to assets, both tangible and intangible.
It is not only big companies who are at risk, individual users can also be at-
tacked. Criminals can gain access to personal data (for instance, bank account
and credit card numbers and passwords), or cause a computer to malfunction.
Some types of attacks can give hackers complete access to a computer, which
can then be used as part of a “zombie network” of infected computers to attack
servers, send out spam, harvest confidential information, and spread new viruses
and Trojans.
In today‟s world, it is widely acknowledged that information is a valuable asset
which should be protected. At the same time, information must be accessible to
those who legitimately require it (for instance, employees, clients and partners of
a business). Hence the need to create a comprehensive information security
system, which must take account of all possible sources of threats, whether hu-
man, man-made, or natural disasters, and use a complete array of defensive
measures, at the physical, administrative and software levels.
1.1. Sources of Threats
A person, a group of people, or phenomena unrelated to human activity can
threaten information security. Following from this, all threat sources can be put
into one of three groups:
The human factor. This group of threats concerns the actions of
people with authorized or unauthorized access to information. Threats
in this group can be divided into:
External, including cyber criminals, hackers, internet scams, un-
principled partners, and criminal organizations.

10 Kaspersky Anti-Virus 7.0
Internal, including the actions of company staff and users of home
PCs. Actions taken by this group could be deliberate or accidental.
The technological factor. This threat group is connected with technical
problems –use of obsolete or poor-quality software and hardware to
process information. This can lead to equipment failure and often to da-
ta loss.
The natural-disaster factor. This threat group includes the whole
range of events caused by nature and independent of human activity.
All three threat sources must be accounted for when developing a data security
protection system. This User Guide focuses on the area that is directly tied to
Kaspersky Lab‟s expertise – external threats involving human activity.
1.2. How threats spread
As modern computer technology and communications tools develop, hackers
have more opportunities for spreading threats. Let‟s take a closer look at them:
The Internet
The Internet is unique, since it is no one‟s property and has no
geographical borders. In many ways, this has promoted the development
of web resources and the exchange of information. Today, anyone can
access data on the Internet or create their own webpage.
However, these very features of the worldwide web give hackers the
ability to commit crimes on the Internet, and makes the hackers difficult to
detect and punish.
Hackers place viruses and other malicious programs on Internet sites and
disguise them as useful freeware. In addition, scripts which are run
automatically when certain web pages are loaded, may perform hostile
actions on your computer by modifying the system registry, retrieving your
personal data without your consent, and installing malicious software.
By using network technologies, hackers can attack remote PCs and
company servers. Such attacks may result in a resource being disabled or
used as part of a zombie network, and in full access being gained to a
resource and any information residing on it.
Lastly, since it became possible to use credit cards and e-money through
the Internet in online stores, auctions, and bank homepages, online
scams have become increasingly common.

Threats to Computer Security 11
Intranet
Your intranet is your internal network, specially designed for handling
information within a company or a home network. An intranet is a unified
space for storing, exchanging, and accessing information for all the
computers on the network. Therefore, if any one network host is infected,
other hosts run a significant risk of infection. To avoid such situations,
both the network perimeter and each individual computer must be
protected.
Email
Since the overwhelming majority of computers have email client programs
installed, and since malicious programs exploit the contents of electronic
address books, conditions are usually right for spreading malicious
programs. The user of an infected host unwittingly sends infected
messages out to other recipients who in turn send out new infected
messages, etc. For example, it is common for infected file documents to
go undetected when distributed with business information via a
company‟s internal email system. When this occurs, more than a handful
of people are infected. It might be hundreds or thousands of company
workers, together with potentially tens of thousands of subscribers.
Beyond the threat of malicious programs lies the problem of electronic
junk email, or spam. Although not a direct threat to a computer, spam
increases the load on email servers, eats up bandwidth, clogs up the
user‟s mailbox, and wastes working hours, thereby incurring financial
harm.
Also, hackers have begun using mass mailing programs and social
engineering methods to convince users to open emails, or click on a link
to certain websites. It follows that spam filtration capabilities are valuable
for several purposes: to stop junk email; to counteract new types of online
scans, such as phishing; to stop the spread of malicious programs.
Removable storage media
Removable media (floppies, CD/DVD-ROMs, and USB flash drives) are
widely used for storing and transmitting information.
Opening a file that contains malicious code and is stored on a removable
storage device can damage data stored on the local computer and spread
the virus to the computer‟s other drives or other computers on the
network.

12 Kaspersky Anti-Virus 7.0
1.3. Types of Threats
There are a vast number of threats to computer security today. This section will
review the threats that are blocked by Kaspersky Anti-Virus.
Worms
This category of malicious programs spreads itself largely by exploiting vul-
nerabilities in computer operating systems. The class was named for the
way that worms crawl from computer to computer, using networks and
email. This feature allows worms to spread themselves very rapidly.
Worms penetrate a computer, search for the network addresses of other
computers, and send a burst of self-made copies to these addresses. In ad-
dition, worms often utilize data from email client address books. Some of
these malicious programs occasionally create working files on system disks,
but they can run without any system resources except RAM.
Viruses
Viruses are programs which infect other files, adding their own code to them
to gain control of the infected files when they are opened. This simple defini-
tion explains the fundamental action performed by a virus –infection.
Trojans
Trojans are programs which carry out unauthorized actions on computers,
such as deleting information on drives, making the system hang, stealing
confidential information, and so on. This class of malicious program is not a
virus in the traditional sense of the word, because it does not infect other
computers or data. Trojans cannot break into computers on their own and
are spread by hackers, who disguise them as regular software. The damage
that they inflict can greatly exceed that done by traditional virus attacks.
Recently, worms have been the commonest type of malicious program damaging
computer data, followed by viruses and Trojans. Some malicious programs com-
bine features of two or even three of these classes.
Adware
Adware comprises programs which are included in software, unknown to the
user, which is designed to display advertisements. Adware is usually built in-
to software that is distributed free. The advertisement is situated in the pro-
gram interface. These programs also frequently collect personal data on the
user and send it back to their developer, change browser settings (start
page and search pages, security levels, etc.) and create traffic that the user
cannot control. This can lead to a security breach and to direct financial
losses.

Threats to Computer Security 13
Spyware
This software collects information about a particular user or organization
without their knowledge. Spyware often escapes detection entirely. In gen-
eral, the goal of spyware is to:
trace user actions on a computer;
gather information on the contents of your hard drive; in such cas-
es, this usually involves scanning several directories and the sys-
tem registry to compile a list of software installed on the computer;
gather information on the quality of the connection, bandwidth,
modem speed, etc.
Riskware
Potentially dangerous applications include software that has no malicious
features but could form part of the development environment for malicious
programs or could be used by hackers as auxiliary components for malicious
programs. This program category includes programs with backdoors and
vulnerabilities, as well as some remote administration utilities, keyboard
layout togglers, IRC clients, FTP servers, and all-purpose utilities for stop-
ping processes or hiding their operation.
Another type of malicious program that is similar to adware, spyware, and risk-
ware are programs that plug into your web browser and redirect traffic. The web
browser will open different web sites than those intended.
Jokes
Software that does not cause a host any direct harm but displays messages
that such harm has already been caused or will result under certain condi-
tions. These programs often warn the user of non-existent dangers, such as
messages that warn of formatting the hard drive (although no formatting ac-
tually takes place) or detecting viruses in uninfected files.
Rootkits
These are utilities which are used to conceal malicious activity. They mask
malicious programs to keep anti-virus programs from detecting them.
Rootkits modify basic functions of the computer‟s operating system to hide
both their own existence and actions that the hacker undertakes on the in-
fected computer.
Other dangerous programs
These are programs created to, for instance, set up denial of service (DoS)
attacks on remote servers, hack into other computers, and programs that
are part of the development environment for malicious programs. These
programs include hack tools, virus builders, vulnerability scanners, pass-

14 Kaspersky Anti-Virus 7.0
word-cracking programs, and other types of programs for cracking network
resources or penetrating a system.
Kaspersky Anti-Virus uses two methods for detecting and blocking these threat
types:
Reactive: it is a method designed to search for malicious objects using
continuously updating application databases. This method requires at
least one instance of infection to add the threat signature to the data-
bases and to distribute a database update.
Proactive –in contrast to reactive protection, this method is based not
on analyzing the object‟s code but on analyzing its behavior in the sys-
tem. This method is aimed at detecting new threats that are still not de-
fined in the signatures.
By employing both methods, Kaspersky Anti-Virus provides comprehensive pro-
tection for your computer from both known and new threats.
Warning!
From this point forward, we will use the term "virus" to refer to malicious and
dangerous programs. The type of malicious programs will only be emphasized
where necessary.
1.4. Signs of Infection
There are a number of signs that a computer is infected. The following events
are good indicators that a computer is infected with a virus:
Unexpected messages or images appear on your screen or you hear
unusual sounds;
The CD/DVD-ROM tray opens and closes unexpectedly;
The computer arbitrarily launches a program without your assistance;
Warnings pop up on the screen about a program attempting to access
the Internet, even though you initiated no such action;
There are also several typical traits of a virus infection through email:
Friends or acquaintances tell you about messages from you that you
never sent;
Your inbox houses a large number of messages without return ad-
dresses or headers.

Threats to Computer Security 15
It must be noted that these signs can arise from causes other than viruses. For
example, in the case of email, infected messages can be sent with your return
address but not from your computer.
There are also indirect indications that your computer is infected:
Your computer freezes or crashes frequently;
Your computer loads programs slowly;
You cannot boot up the operating system;
Files and folders disappear or their contents are distorted;
The hard drive is frequently accessed (the light blinks);
The web browser (e.g., Microsoft Internet Explorer) freezes or behaves
unexpectedly (for example, you cannot close the program window).
In 90% of cases, these indirect systems are caused by malfunctions in hardware
or software. Despite the low likelihood that these symptoms are indicative of in-
fection, a full scan of your computer is recommended (see 5.3 on pg. 50) if they
should manifest themselves.
1.5. What to do if you suspect
infection
If you notice that your computer is behaving suspiciously…
1. Don‟t panic! This is the golden rule: it could save you from losing impor-
tant data.
2. Disconnect your computer from the Internet or local network, if it is on
one.
3. If the computer will not boot from the hard drive (the computer displays
an error message when you turn it on), try booting in safe mode or with
the emergency Microsoft Windows boot disk that you created when you
installed the operating system.
4. Before doing anything else, back up your work on removable storage
media (floppy, CD/DVD, flash drive, etc.).
5. Install Kaspersky Anti-Virus, if you have not done so already.
6. Update databases and application modules (see 5.6 on pg. 52). If poss-
ible, download the updates off the Internet from a different uninfected
computer, for instance at a friend‟s, an Internet café, or work. It is better
to use a different computer since, when you connect an infected com-

16 Kaspersky Anti-Virus 7.0
puter to the Internet, there is a chance that the virus will send important
information to hackers or spread the virus to the addresses in your ad-
dress book. That is why if you suspect that your computer has a virus,
you should immediately disconnect from the Internet. You can also get
threat signature updates on floppy disk from Kaspersky Lab or its dis-
tributors and update your signatures using the disk.
7. Select the security level recommended by the experts at Kaspersky
Lab.
8. Start a full computer scan (see 5.3 on pg. 50).
1.6. Preventing Infection
Not even the most reliable and deliberate measures can provide 100% protection
against computer viruses and Trojans, but following such a set of rules signifi-
cantly lowers the likelihood of virus attacks and the level of potential damage.
One of the basic methods of battling viruses is, as in medicine, well-timed pre-
vention. Computer prophylactics involve a rather small number of rules that, if
complied with, can significantly lower the likelihood of being infected with a virus
and losing data.
Below is a listing of basic safety rules which, if followed, will help mitigate the risk
of virus attacks.
Rule No. 1: Use anti-virus software and Internet security programs. To do so:
Install Kaspersky Anti-Virus as soon as possible.
Regularly (see 5.6 on pg. 52) update the program‟s threat signatures. In
the event of virus outbreaks updates may occur several times a day
with application databases on Kaspersky Lab update servers updating
immediately.
Select the security settings recommended by Kaspersky Lab for your
computer. You will be protected constantly from the moment the com-
puter is turned on, and it will be harder for viruses to infect your com-
puter.
Select the settings for a complete scan recommended by Kaspersky
Lab, and schedule scans for at least once per week. If you have not in-
stalled Firewall, we recommend that you do so to protect your computer
when using the Internet.

Threats to Computer Security 17
Rule No. 2: Use caution when copying new data to your computer:
Scan all removable storage drives, for example floppies, CD/DVDs, and
flash drives, for viruses before using them (see 5.5 on pg. 51).
Treat emails with caution. Do not open any files attached to emails un-
less you are certain that you were intended to receive them, even if they
were sent by people you know.
Be careful with information obtained through the Internet. If any web site
suggests that you install a new program, be certain that it has a security
certificate.
If you are copying an executable file from the Internet or local network,
be sure to scan it with Kaspersky Anti-Virus.
Use discretion when visiting web sites. Many sites are infected with
dangerous script viruses or Internet worms.
Rule No. 3: Pay close attention to information from Kaspersky Lab.
In most cases, Kaspersky Lab announces a new outbreak long before it
reaches its peak. The corresponding likelihood of infection is still low, and
you will be able to protect yourself from new infection by downloading
updated application databases.
Rule No. 4: Do not trust virus hoaxes, such as prank programs and emails about
infection threats.
Rule No. 5: Use the Microsoft Windows Update tool and regularly install Micro-
soft Windows operating system updates.
Rule No. 6: Buy legitimate copies of software from official distributors.
Rule No. 7: Limit the number of people who are allowed to use your computer.
Rule No. 8: Lower the risk of unpleasant consequences of a potential infection:
Back up data regularly. If you lose your data, the system can fairly
quickly be restored if you have backup copies. Store distribution flop-
pies, CD/DVDs, flash drives, and other storage media with software and
valuable information in a safe place.
Create a Rescue Disk (see 15.4 on pg. 171) that you can use to boot
up the computer, using a clean operating system.
Rule No. 9: Review list of software installed on your computer on a regular ba-
sis. This can be accomplished using the Install/Remove Programs service
under Control Panel or simply by viewing the contents of the Program
Files folder. You can discover software here that was installed on your com-
puter without your knowledge, for example, while you were using the Inter-
net or installing a different program. Programs like these are almost always
riskware.

CHAPTER 2. KASPERSKY ANTI-
VIRUS 7.0
Kaspersky Anti-Virus 7.0 heralds a new generation of data security products.
What really sets Kaspersky Anti-Virus 7.0 apart from other software, even from
other Kaspersky Lab products, is its multi-faceted approach to data security.
2.1. What’s new in Kaspersky Anti-
Virus 7.0
Kaspersky Anti-Virus 7.0 (henceforth referred to as “Kaspersky Anti-Virus”, or
“the program”) has a new approach to data security. The program‟s main feature
is that it combines and noticeably improves the existing features of all the com-
pany‟s products in one security solution. The program provides protection
against viruses. New modules offer protection from unknown threats.
You will no longer need to install several products on your computer for overall
security. It is enough simply to install Kaspersky Anti-Virus 7.0.
Comprehensive protection guards all incoming and outgoing data channels. A
flexible configuration of all application components allows for maximum customi-
zation of Kaspersky Anti-Virus to the needs of each user. Configuration of the
entire program can be done from one location.
Let‟s take a look at the new features in Kaspersky Anti-Virus.
New Protection Features
Kaspersky Anti-Virus protects you both from known malicious programs,
and from programs that have not yet been discovered. Proactive De-
fense (see Chapter 10 on pg. 108) is the program‟s key advantage. It
analyzes the behavior of applications installed on your computer, moni-
toring changes to the system registry, and fighting hidden threats. The
component uses a heuristic analyzer to detect and record various types
of malicious activity, with which actions taken by malicious programs
can be rolled back and the system can be restored to its state prior to
the malicious activity.
File Anti-Virus technology has been improved to lower the load on the
central processor and disk subsystems and increase the speed of file

Kaspersky Anti-Virus 7.0 19
scans using iChecker and iSwift. By operating this way, the program
rules out scanning files twice.
The scan process now runs as a background task, enabling the user to
continue using the computer. If there is a competition for system re-
sources, the virus scan will pause until the user‟s operation is com-
pleted and then resumes at the point where it left off.
Individual tasks are provided for scanning Critical Areas of the computer
and startup objects that could cause serious problems if infected and for
detecting rootkits used to hide malware on your system. You can confi-
gure these tasks to run automatically every time the system is started.
E-mail protection from malicious programs has been significantly im-
proved. The program scans these protocols for emails containing virus-
es:
IMAP, SMTP, POP3, regardless of which email client you use
NNTP, regardless of the email client
Regardless of the protocol (including MAPI and HTTP), using plug-
ins for Microsoft Office Outlook and The Bat!
Special plug-ins are available for the most common mail clients, such as
Microsoft Office Outlook, Microsoft Outlook Express (Windows Mail),
and The Bat! that can configure mail protection from viruses directly in
the mail client.
The user notification function (see 15.9.1 on pg. 183) has been ex-
panded for certain events that arise during program operation. You can
select the method of notification yourselves for each of these event
types: e-mails, sound notifications, pop-up messages.
The program now has the ability to scan traffic sent over SSL protocol.
New features included application self-defense technology, protection
from unauthorized remote access of Kaspersky Anti-Virus services, and
password protection for program settings. These features help keep
malicious programs, hackers, and unauthorized users from disabling
protection.
The option of creating a rescue disk has been added. Using this disk,
you can restart your operating system after a virus attack and scan it for
malicious objects.
A News Agent has been added. It is a module designed for real-time
delivery of news content from Kaspersky Lab.

20 Kaspersky Anti-Virus 7.0
New Program Interface Features
The new Kaspersky Anti-Virus interface makes the program‟s functions
clear and easy to use. You can also change the program‟s appearance
by using your own graphics and color schemes.
The program regularly provides you with tips as you use it: Kaspersky
Anti-Virus displays informative messages on the level of protection and
includes a thorough Help section. A security wizard built into the appli-
cation provides a complete snapshot of a host's protection status and
allows to proceed directly to issue resolution.
New Program Update Features
This version of the application debuts our improved update procedure:
Kaspersky Anti-Virus automatically checks the update source for update
packages. When the program detects fresh updates, it downloads them
and installs them on the computer.
The program downloads updates incrementally, ignoring files that have
already been downloaded. This lowers the download traffic for updates
by up to 10 times.
Updates are downloaded from the most efficient source.
You can choose not to use a proxy server, by downloading program up-
dates from a local source. This noticeably reduces the traffic on the
proxy server.
A rollback capability has been implemented to recover to a previous ap-
plication database version in the event of file corruption or copy errors.
A feature has been added for distributing updates to a local folder to
give other network computers access to them to save bandwidth.
2.2. The elements of Kaspersky
Anti-Virus Defense
Kaspersky Anti-Virus protection is designed with the sources of threats in mind.
In other words, a separate program component deals with each threat, monitor-
ing it and taking the necessary action to prevent malicious effects of that threat
on the user's data. This setup makes the system flexible, with easy configuration
options for all of the components that fit the needs of a specific user or business
as a whole.