KAPERSKY ANTI-VIRUS - FOR FREEBSD-OPENBSD-BSDI FILE... User manual

KASPERSKY LAB
Kaspersky Anti-Virus
for FreeBSD, OpenBSD and BSDi
File Server
USER GUIDE

1
11
1
KASPERSKY ANTI-VIRUS FOR FREEBSD,
OPENBSD AND BSDI FILE SERVER
User Guide
User GuideUser Guide
User Guide
Kaspersky Lab Ltd.
http://www.kaspersky.com
Revision date: June 2002

2
22
2
Contents
1. KASPERSKYTM ANTI-VIRUS FOR FREEBSD, OPENBSD AND
BSDI FILE SERVER.............................................................................8
1.1. Introduction .................................................................................8
1.2. Distribution kit............................................................................10
1.2.1. What is in the distribution kit...............................................10
1.2.2. License agreement.............................................................11
1.2.3. Registration card.................................................................11
1.3. Help desk for registered users.................................................11
1.4. Information in the book.............................................................12
1.5. Conventions..............................................................................12
2. INSTALLING KASPERSKY ANTI-VIRUS FOR XBSD FILE
SERVER ..............................................................................................14
2.1. Software and hardware requirements.....................................14
2.2. Backing up your installation diskettes......................................15
2.3. Step-By-Step Installation..........................................................15
2.3.1. … of Kaspersky Anti-Virus for FreeBSD ...........................15
2.3.2. … of Kaspersky Anti-Virus for OpenBSD and BSDi.........17
2.4. Preparing to run........................................................................18
2.4.1. Editing the .ini file................................................................18
2.4.2. Editing the path to temporary files......................................19
2.4.3. Customizing software for several users.............................19
3. RUNNING KASPERSKY ANTI-VIRUS FOR XBSD FILE SERVER21
3.1. Changing scanning settings.....................................................21
3.2. Starting to check.......................................................................22
3.3. Starting to update virus-definition databases..........................23
4. ANTI-VIRUS SCANNER: SCANNING AND DISINFECTING.........25

CONTENTS
3
33
3
4.1. Starting Scanner.......................................................................25
4.2. Searching for viruses and deleting them.................................27
4.2.1. Loading anti-virus scanner.................................................27
4.2.2. Handling infected objects ...................................................28
4.2.3. Handling corrupted objects.................................................30
4.2.4. Handling suspicious objects...............................................31
4.3. Reviewing performance statistics............................................32
5. ANTI-VIRUS SCANNER AND DAEMON PROCESS: USING
SWITCHES AND PROFILES.............................................................34
5.1. Scanning settings.....................................................................34
5.2. How to change settings............................................................35
5.3. Settings for a separate location to be checked.......................36
5.3.1. Defining the location(s) to be checked...............................36
5.3.2. Defining objects to be checked..........................................38
5.3.2.1. Object types.................................................................... 38
5.3.2.2. Sectors............................................................................. 38
5.3.2.3. Files.................................................................................. 39
5.3.2.4. Packed executables...................................................... 41
5.3.2.5. Archives........................................................................... 42
5.3.2.6. Mail databases and plain mail files............................ 43
5.3.2.7. Embedded OLE objects............................................... 44
5.3.3. Defining anti-virus actions ..................................................44
5.3.4. Defining the advanced scanning tools to be used ............46
5.4. Settings for the cumulative location to be checked ................49
5.4.1. Cumulative settings ............................................................49
5.4.2. Defining scanning and performance settings: Scanner and
Daemon...............................................................................50
5.4.3. Defining actions on infected and suspicious objects ........54
5.4.4. Defining the reporting parameters .....................................56
6. DAEMON PROCESS: INTEGRATING ANTI-VIRUS PROTECTION
IN CLIENTS.........................................................................................59
6.1. Features of the Daemon program...........................................59

CONTENTS
4
44
4
6.2. Launching the daemon process..............................................60
6.3. Calling up the process from a client program .........................63
7. ANTI-VIRUS MONITOR: MONITORING THE SYSTEM FOR
VIRUSES .............................................................................................65
7.1. Features and functions.............................................................65
7.2. Assembling and Configuring....................................................66
7.2.1. Assembling Monitor............................................................66
7.2.2. Configuring Monitor ............................................................68
7.3. Launching Monitor....................................................................71
7.4. Reviewing the performance results.........................................72
7.5. Troubleshooting........................................................................72
8. SLOGAN: PROCESSING AND SUMMARIZING THE
PERFORMANCE REPORTS.............................................................75
8.1. Features and functions.............................................................75
8.2. Launching Slogan.....................................................................76
8.3. Slogan in the real-time monitoring mode ................................78
9. TUNER: CUSTOMIZING SCANNER AND DAEMON.....................80
9.1. Features and functions.............................................................80
9.2. Launching Tuner.......................................................................81
9.3. Interface....................................................................................82
9.4. Creating, editing and saving a profile......................................83
9.5. The Location page....................................................................85
9.5.1. Defining the location to be scanned for viruses ................85
9.5.2. Defining scanning settings for a separate directory..........87
9.5.2.1. The directory Property window: Selecting the
required directory........................................................... 87
9.5.2.2. The directory Property window: Objects to be
checked........................................................................... 88
9.5.2.3. The directory Property window: Defining anti-virus
actions.............................................................................. 90
9.5.2.4. The directory Property window: Defining the
advanced scanning tools used. The Options page 92

CONTENTS
5
55
5
9.6. The Options page.....................................................................93
9.7. The Report page.......................................................................95
9.8. The ActionWith page................................................................98
9.9. The Customize page..............................................................100
10. WEBTUNER: REMOTE ADMINISTRATION PROGRAM ............102
10.1. Functions and features...........................................................102
10.2. General concept of the program performance......................103
10.3. Installing WebTuner. Access rights.......................................105
10.3.1. The WebTuner components ............................................105
10.3.2. Setting up the web server and WebTuner.......................106
10.3.3. Rights on the web server..................................................109
10.3.3.1. Rights to run the web server..................................... 109
10.3.3.2. Rights to run the WebTuner copy............................ 110
10.4. Launching WebTuner.............................................................111
10.5. Interface..................................................................................112
10.6. Defining the Configuration of WebTuner...............................114
10.6.1. WebTuner settings............................................................114
10.6.2. The main page: WebTuner performance settings..........116
10.6.3. The modules page: remote administration settings........117
10.7. WebTuner: Administering Daemon.......................................121
10.7.1. Daemon settings...............................................................121
10.7.2. Remote configuration of the Daemon program...............123
10.7.2.1. The Profile tuning window......................................... 123
10.7.2.2. The objects page: location to be scanned............. 124
10.7.2.3. The options page: scanning settings ...................... 126
10.7.2.4. The actions page: object-handling settings........... 126
10.7.2.5. The report page: reporting settings ......................... 127
10.7.2.6. The customs page: advanced scanning settings. 128
10.7.3. Launching Daemon from a remote location....................128
10.7.4. Reviewing the log file........................................................132
10.8. WebTuner: administering Scanner........................................135

CONTENTS
6
66
6
10.8.1. Scanner settings...............................................................135
10.8.2. Remote configuration of the Scanner program...............137
10.8.3. Launching Scanner from a Remote Location..................137
10.8.4. Reviewing the log file........................................................139
10.9. WebTuner: administering Updater ........................................139
11. UPDATER: UPDATING VIRUS-DEFINITION DATABASES .......143
11.1. Function and features.............................................................143
11.2. Starting the Updater...............................................................143
11.3. How to update virus-definition databases.............................145
11.3.1. Updating via the Internet ..................................................145
11.3.2. Updating from a network directory...................................146
11.3.3. Updating from an archive.................................................146
11.4. Saving the report to a file .......................................................147
12. INSPECTOR: MONITORING FILESYSTEM INTEGRITY.............148
12.1. Function and Features...........................................................148
12.2. Running Inspector ..................................................................149
12.2.1. The Program Command Line ..........................................149
12.2.2. Defining the location to be checked.................................150
12.2.3. Handling modified and new files......................................152
12.2.4. Saving the performance report ........................................154
13. CONTROL CENTRE: SCHEDULING THE KASPERSKY ANTI-
VIRUS FOR XBSD FILE SERVER PERFORMANCE...................155
13.1. Function and Features...........................................................155
13.2. Running Control Centre .........................................................155
13.3. Scheduling performance of package component-based
tasks........................................................................................156
13.4. Saving the performance report..............................................160
14. APPENDIX A. PRINCIPAL FILES..................................................162
15. APPENDIX B. SUPPLEMENTARY DETAILS OF KASPERSKY
ANTI-VIRUS FOR XBSD FILE SERVER........................................163

CONTENTS
7
77
7
15.1. Files with the program settings..............................................163
15.2. Scanner and Daemon: The initialization file (AvpUnix.ini) ...163
15.3. Scanner and Daemon: the profile (defUnix.prf)....................165
15.4. Scanner and Daemon: command line switches...................176
15.5. Scanner and Daemon: report messages..............................181
15.6. Scanner and Daemon: exit codes.........................................183
15.7. Slogan: report templates........................................................184
15.8. Inspector: command line switches ........................................187
15.9. Control Centre: command line switches................................190
15.10. Monitor: configuration file (monitor.conf)...............................194
15.11. Updater: command line switches ..........................................196
15.12. Installer: command line switches...........................................199
15.13. WebTuner: the configuration file (loader.cfg)........................200
16. APPENDIX C. CLASSIFYING COMPUTER VIRUSES.................204
17. APPENDIX D. KASPERSKY LAB LTD.........................................207
17.1. About Kaspersky Lab.............................................................207
17.2. Other Kaspersky Lab AntiViral Products...............................208
17.3. Kaspersky Lab Contact Information......................................210
18. INDEX.................................................................................................212

8
88
8
Attention!!! New viruses arise every da
y
and if you want to keep your anti-virus
fresh and capable, we strongl
y
recommend you to update anti-virus
databases at least every day (for more
details see below). Moreover, make sure
to update them right after you install the
product on your computer!
1.
1.1.
1. Kaspersky
KasperskyKaspersky
KasperskyTM
TMTM
TM Anti
AntiAnti
Anti-
--
-Virus for
Virus forVirus for
Virus for
FreeBSD, OpenBSD and BSDi
FreeBSD, OpenBSD and BSDiFreeBSD, OpenBSD and BSDi
FreeBSD, OpenBSD and BSDi
File Server
File ServerFile Server
File Server
1.1.Introduction
What is Kaspersky Anti-Virus for FreeBSD,
OpenBSD and BSDi File Server?
KasperskyTM Anti-Virus for FreeBSD, OpenBSD and BSDi File
Server (Kaspersky Anti-Virus for xBSD File Server) is a software
product that is designed to search for and delete viruses1from xBSD and
remotely manage Kaspersky Anti-Virus for xBSD File Server File Server. It
1The computer virus is a computer program (that is, executable code and/or a collection
of instructions) that can replicate itself (though the copy may not necessarily exactly
match the original) and penetrate files and other resources of computer systems and
networks and make them perform tasks the virus dictates without the user’s permission.
Copies of the program are also capable of self-replicating.
Chapter
1

INTRODUCTION
9
99
9
allows detection and deletion of all currently known types of viruses and
mailware codes including:
• polymorphic or self-encoding viruses;
• stealth or invisible viruses;
• viruses for Windows 9x, Windows NT, UNIX, OS/2;
• new viruses for Java applets;
• macroviruses infecting Word documents, Excel spreadsheets,
PowerPoint presentations, Help files etc.;
• network worms;
• Trojans.
!"For classification of viruses that can be detected and deleted using
Kaspersky Anti-Virus for xBSD File Server refer to Appendix C.
The package contains a set of anti-virus applications and utilities.
The kavscanner (Scanner) enables you to check for viruses in your
operation system on demand2.
The kavdaemon anti-virus process (Daemon) allows integration of the
virus check process into your programs, and kavmonitor, the anti-virus file-
monitor (Monitor), continuously keeps checking for viruses in files of your
FreeBSD filesystem that are started or opened.
The slogan program (Slogan) was developed to process and summarize
data within the performance reports of the Scanner and the Daemon
programs.
Kavupdater (Updater) enables you to update virus-definition databases
that are used by other components when checking for viruses.
!"When checking for viruses Kaspersky Anti-Virus for xBSD File
Server uses virus-definition databases that contain information
allowing detection and deletion of many viruses. Kaspersky Lab
releases virus-definition database updates containing information
about new viruses on a daily basis.
2If there are other computer drives mounted under your filesystem, files on these drives
will be also virus-checked. Hereinafter when describing the virus-checking process on
your computer we mean your computer filesystem and all the files mounted under it.

INTRODUCTION
10
1010
10
The package also contains the special configuration program kavtuner
(Tuner), which allows you to define the virus-scanning settings of the
Scanner and Daemon programs.
By using the kavinspector program (Inspector) you can check the
filesystem. This will allow you to monitor changes in the file structure and to
check for viruses in files with respect to the methods used to penetrate
these files.
The package component WebTuner allows you to remotely manage
Kaspersky Anti-Virus for xBSD File Server.
Performance of all the Kaspersky Anti-Virus for xBSD File Server
components can be coordinated by means of the kavucc program (Control
Centre), allowing a user to schedule automatic starts of the components
and display information about the licensed traffic and the Kaspersky Anti-
Virus for xBSD File Server users.
1.2.Distribution kit
What is in the distribution kit. License agreement.
Registration card.
1.2.1. What is in the distribution kit
The distribution kit includes:
• a sealed envelope with installation CD (or diskettes) with files of
the software product;
• User Guide;
• key diskette;
• registration card (with serial number of the product);
• license agreement.
!"Before you unseal the envelope with CD (or diskettes), be sure to
thoroughly review the license agreement.

INTRODUCTION
11
1111
11
1.2.2. License agreement
The License Agreement (LA) is a legal agreement between you (either an
individual or a single entity) and the manufacturer (Kaspersky Lab Ltd.)
describing the terms on which you may employ the anti-virus product,
which you have purchased.
#"
Make sure to read the terms of the LA!
If you do not agree to the terms of this LA, Kaspersky Lab is not willing to
license the software product to you and you should return the unused
product to your Kaspersky Anti-Virus dealer for a full refund, making sure
the envelope with CD (or diskettes) is sealed.
If you unsealed the envelope, you have agreed to all the terms of the LA.
1.2.3. Registration card
To register please fill the detachable coupon of your registration card (your
full name, phone, e-mail address) and mail it to the dealer that sold this kit
to you.
If your mail/e-mail address or telephone number changes, please notify the
entity you mailed the register coupon to.
On registration you obtain the status of registered user of Kaspersky Anti-
Virus for xBSD File Server and will be provided with product support and
virus-definition database updates for the period of your subscription.
Furthermore, Kaspersky Lab provides Kaspersky Anti-Virus registered
users with information on the company’s new products.
1.3.Help desk for registered users
Services that we provide to registered users.
Kaspersky Lab offers a large service package enabling legal users to
efficiently employ Kaspersky Anti-Virus.

INTRODUCTION
12
1212
12
If you register and purchase a subscription you will be provided with the
following services for the period of your subscription:
• daily virus-definition database updates via e-mail;
• product upgrades;
• phone and e-mail advice on matters related to your software
installation, configuration and performance;
• information about new Kaspersky Lab products and new
computer viruses (for those who subscribe to our newsletter
http://www.kaspersky.com/subscribeNow.asp).
#"
Kaspersky Lab does not give advice on the performance and use of
your operating system or various other technologies.
1.4.Information in the book
What is in this documentation and what is not.
This book contains information on how to install, customize and manage
the software product. It explains the basic concepts and the way they can
be applied, and recommends ways to manage and change settings.
This book does not describe xBSD and software products that can be
integrated with Kaspersky Anti-Virus for xBSD File Server.
1.5.Conventions
Conventions that are used in this book.
In this book we use various conventions to emphasize different meaningful
parts of the documentation.

INTRODUCTION
13
1313
13
Convention Meaning
Bold font Menu titles, commands, window
titles, dialog elements, etc.
!"Note. Additional information, notes
#"
Attention! Very important information
$"
To do this: …
1. Step 1.
2. …
Actions that must be taken
• Function of the
control—function of
the control.
Description of the settings tree
[switch]—function of the switch. Command line switches
Strings in the command line Text to be entered in the
command line by the user
Info message text Text of the configuration files
and information messages of
the program.

14
1414
14
2.
2.2.
2. Installing Kaspersky Anti
Installing Kaspersky AntiInstalling Kaspersky Anti
Installing Kaspersky Anti-
--
-
Virus for xBSD File Se
Virus for xBSD File SeVirus for xBSD File Se
Virus for xBSD File Server
rverrver
rver
2.1.Software and hardware
requirements
What hardware and software do you need to run
Kaspersky Anti-Virus for xBSD File Server?
In order to run Kaspersky Anti-Virus for xBSD File Server you need a
system that meets the following requirements:
• a PC-compatible computer with 486 CPU or better and at least
64 Mb of RAM;
• running the xBSD (FreeBSD, OpenBSD or BSDi) operating
system;
• at least 30 MB of disk space;
• with a kernel (version 3.x or 4.x).
!"
Kernels of versions 2.0.x and earlier are not supported!
Chapter
2

INSTALLATION
15
1515
15
2.2.Backing up your installation
diskettes
If you purchased the Kaspersky Anti-Virus for xBSD File Server package
on installation diskettes (but not the CD) before installing the program on
your computer, it is recommended that you back up those diskettes. Then,
if during the installation you accidentally damage your installation diskettes,
you will be able to restore them from copies.
2.3.Step-By-Step Installation
Descriptions of each step to be taken when installing
Kaspersky Anti-Virus for xBSD File Server on a
computer.
2.3.1. … of Kaspersky Anti-Virus for
FreeBSD
$"
To install the Kaspersky Anti-Virus for FreeBSD software
package on a computer, follow these steps:
1. Copy the archive from the installation CD (installation diskette)
to a filesystem directory on your computer.
2. Extract the archive by using the string tar zxvf archive_name.
Several elements will be extracted from the software package
archive. These elements are also archives containing the
software product’s files.
3. Run installation of the Kaspersky Anti-Virus Workstation
package by using the string pkg_add archive_name in the
command line. For example, your command line may look like

INSTALLATION
16
1616
16
the following:
pkg_add kav-WorkstationSuit-4.0.0.0-FreeBSD-4.x.tgz
4. Copy the .key file from the installation CD (installation
diskette) to the directory defined in the KeysPath line of the
file AvpUnix.ini. The default .key file directory is /etc.
5. Run the Updater program to download virus-definition
databases that are used in searches for viruses and
disinfection (for details on how to launch Updater refer to
subchapter 11.2).
!"If required, before launching your Updater copy, edit the BasePath
value in the file AvpUnix.ini. The BasePath parameter defines the
path to the virus-definition database directory.
#"
For addresses of the servers from which you may download new
virus-definition databases refer to subchapter 17.3 of Appendix B.
6. Run installation of the Monitor program by using the string
pkg_add archive_name in the command line.
7. Run installation of the WebTuner program by using the string
pkg_add archive_name in the command line.A script file allowing
creation of the server SSL certificate will be started. You must
answer all the questions that appear on your screen.
8. Move to the directory /etc/AVP and edit the following files as
required: AvpUnix.ini, defUnix.prf and monitor.conf.
9. Move to the directory /usr/local/etc/rc.d and edit as required the
following auto-start parameters for the Kaspersky Anti-Virus
for FreeBSD components in the file kavd.sh:
RUN_DAEMON="Y" – launches the Daemon program.
RUN_MONITOR="Y" – launches the Monitor program.
RUN_KAVUCC="Y" – launches the Control Centre program.
RUN_HTTPD="Y" – launches the WebTuner program.
!"By default, auto-start for all the above-listed components is enabled,
i.e. the parameters’ value is "Y". To disable auto-start for a
component, substitute "N" for the appropriate parameter value.
The Kaspersky Anti-Virus for FreeBSD program will be started
automatically right after you restart your computer, or you may start it
manually by entering the string start: ./kavd.sh start in the command line.

INSTALLATION
17
1717
17
#"
If any component of the Kaspersky Anti-Virus for FreeBSD software
package failed to start, apply the launching procedure described in
the corresponding chapter of this book.
2.3.2. … of Kaspersky Anti-Virus for
OpenBSD and BSDi
$"
To install the Kaspersky Anti-Virus for OpenBSD and BSDi
software package on a computer, follow these steps:
1. Copy the archive from the installation CD (installation diskette)
to a filesystem directory on your computer.
2. Extract the archive by using the string tar zxvf archive_name.
Several elements will be extracted from the software package
archive. These elements are also archives containing files of
the software product.
3. Extract and install every component of the Kaspersky Anti-
Virus for OpenBSD and BSDi software package one by one.
4. Copy the .key file from the installation CD (installation
diskette) to the directory defined in the KeysPath line of the file
AvpUnix.ini. The default .key file directory is /etc.
5. Edit the BasePath value defining the path to the virus-definition
databases in the file AvpUnix.ini and, if required, the file
defUnix.prf.
!"
If you want to be able to start the installed executable files from any
directory, create appropriate links in the directory /usr/bin or
/usr/local/bin.
!"
For a list of files that are critical for the program’s performance refer
to Appendix A.

INSTALLATION
18
1818
18
2.4.Preparing to run
How to edit the .ini file and a path to the directory
for temporary files. Customizing the software for various
needs.
2.4.1. Editing the .ini file
The initialization file AvpUnix.ini contains information that is essential for
your program’s correct performance and may be found in one of the
following directories:
1. ~/.AVP (a user directory. For example, /root/.AVP or
/home/user1/.AVP)
2. /usr/local/share/AVP/etc
3. /etc/AVP
#"
When started, the program searches for the file AvpUnix.ini in the
directories listed above one after another. If the file is not detected
there, the program begins to look for it in the current directory!
If required, you may edit the file (for details of the INI file see Appendix B).
The initialization file must be edited in one of the following cases:
• If you copied your virus-definition databases to a separate
directory, you must specify a new path to these files in the
BasePath line of your AvpUnix.ini. Otherwise, when started your
Scanner will not find those databases and will not be able to
detect a virus, even if you have any!
• If you changed the name of your .set file (i.e. settings file of your
virus-definition databases), you must specify its new name in the
SetFile line of your AvpUnix.ini. Otherwise when started the
Scanner and the Daemon will not load its virus-definition
databases and will not be able to detect a virus, even if you have
any!

INSTALLATION
19
1919
19
#"
When editing the SetFile parameter, be sure to specify only the name
of your .set file. You do not need to define the full path to it!
• If you copied the key files to a separate directory, you must
specify a new path to these files in the KeysPath line of your
AvpUnix.ini. Otherwise, all the programs will operate as demo
versions, i.e. they will be disabled to delete the viruses detected
and to scan for viruses in archives and mail databases.
!"
It is advisable that you specify an absolute path to the virus-definition
databases and key files in your AvpUnix.ini file.
2.4.2. Editing the path to temporary
files
If you want your anti-virus scanner and the daemon process while checking
for viruses to place temporary in a directory that is different from /tmp (the
default directory for temporary files), define the desired directory by
following these steps:
1. Create a directory for temporary files, e.g. /TEMP.
2. Add the directory to your environmental variable TEMP or TMP.
#"
For other programs the directory for temporary files must be defined
by editing the corresponding settings in the settings files of these
programs.
2.4.3. Customizing software for
several users
If you want to enable two or more different users to start the Scanner and
the Daemon with individual settings, follow these steps:
1. Create the subdirectory .AVP (e.g. /root/.AVP) in the home
directories of those users.
2. Copy AvpUnix.ini and defUnix.prf to those subdirectories.