KAPERSKY ANTI-VIRUS - FOR FREEBSD-OPENBSD-BSDI MAIL... User manual

KASPERSKY LAB
Kaspersky Anti-Virus
for FreeBSD, OpenBSD and BSDi
Mail Server
USER GUIDE

KASPERSKY ANTI-VIRUS FOR FREEBSD,
OPENBSD AND BSDI MAIL SERVER
User Guide
Kaspersky Lab Ltd.
http://www.kaspersky.com
Revision date: June 2002
1

Contents
1. KASPERSKYTM ANTI-VIRUS FOR FREEBSD, OPENBSD AND
BSDI MAIL SERVER..........................................................................11
1.1. Introduction...............................................................................11
1.2. Distribution kit............................................................................14
1.2.1. What is in the distribution kit...............................................14
1.2.2. License agreement.............................................................14
1.2.3. Registration card.................................................................15
1.3. Help desk for registered users.................................................15
1.4. Information in the book.............................................................16
1.5. Conventions..............................................................................16
2. INSTALLING ANTI-VIRUS.................................................................18
2.1. Software and hardware requirements.....................................18
2.2. Backing up your installation diskettes......................................19
2.3. Step-By-Step Installation..........................................................19
2.3.1. Installation of Anti-Virus for FreeBSD................................19
2.3.2. Installation of Anti-Virus for OpenBSD and BSDi Mail Server
.............................................................................................21
2.4. Preparing to run........................................................................22
2.4.1. Editing the .ini file................................................................22
2.4.2. Editing the path to temporary files......................................24
2.4.3. Customizing software for several users.............................24
3. RUNNING ANTI-VIRUS......................................................................25
3.1. Changing scanning settings.....................................................25
2

CONTENTS
3.2. Starting to check.......................................................................26
3.3. Starting to update virus-definition databases..........................28
4. ANTI-VIRUS SCANNER: SCANNING AND DISINFECTING.........29
4.1. Starting Scanner.......................................................................29
4.2. Searching for viruses and deleting them.................................31
4.2.1. Loading anti-virus scanner.................................................31
4.2.2. Handling infected objects ...................................................32
4.2.3. Handling corrupted objects.................................................35
4.2.4. Handling suspicious objects...............................................36
4.3. Reviewing performance statistics............................................36
5. ANTI-VIRUS SCANNER AND DAEMON PROCESS: USING
SWITCHES AND PROFILES.............................................................38
5.1. Scanning settings.....................................................................38
5.2. How to change settings............................................................39
5.3. Settings for a separate location to be checked.......................40
5.3.1. Defining the location(s) to be checked...............................40
5.3.2. Defining objects to be checked..........................................42
5.3.2.1. Object types.................................................................... 42
5.3.2.2. Sectors............................................................................. 43
5.3.2.3. Files.................................................................................. 43
5.3.2.4. Packed executables...................................................... 45
5.3.2.5. Archives........................................................................... 46
5.3.2.6. Mail databases and plain mail files............................ 47
5.3.2.7. Embedded OLE objects............................................... 49
5.3.3. Defining anti-virus actions ..................................................49
5.3.4. Defining the advanced scanning tools to be used ............51
5.4. Settings for the cumulative location to be checked ................54
3

CONTENTS
5.4.1. Cumulative settings.............................................................54
5.4.2. Defining scanning and performance settings: Scanner and
Daemon...............................................................................55
5.4.3. Defining actions on infected and suspicious objects.........59
5.4.4. Defining the reporting parameters .....................................61
6. DAEMON PROCESS: INTEGRATING ANTI-VIRUS PROTECTION
IN CLIENTS.........................................................................................65
6.1. Features of the Daemon program...........................................65
6.2. Launching the daemon process..............................................66
6.3. Calling up the process from a client program .........................69
7. KEEPER: SCANNING SMTP TRAFFIC IN MAIL SYSTEMS:
SENDMAIL, QMAIL, POSTFIX AND EXIM......................................72
7.1. Features of the Keeper program.............................................72
7.2. Integrating Anti-Virus with sendmail........................................74
7.3. Integrating Anti-Virus with Qmail .............................................76
7.4. Integrating Anti-Virus with Postfix............................................78
7.5. Integrating Anti-Virus with Exim...............................................80
7.6. Customizing Keeper.................................................................82
7.6.1. General concept..................................................................82
7.6.2. Processing infected messages for an address group.......84
7.6.2.1. General concept............................................................ 84
7.6.2.2. The address group and the To/From addresses.... 86
7.6.2.3. To check or not to check… ......................................... 87
7.6.2.4. Defining after-check processing of a message....... 88
7.6.2.5. Filtering mail by the files attached.............................. 93
7.6.2.6. Delivering infected messages to the administrator 94
7.6.2.7. Notifying the sender...................................................... 95
4

CONTENTS
7.6.3. Defining attributes of the notification..................................96
7.6.4. Log.......................................................................................97
7.6.5. Communication between Keeper and the daemon process
.............................................................................................97
7.7. Launching Keeper....................................................................97
8. ANTI-VIRUS MONITOR: MONITORING THE SYSTEM FOR
VIRUSES .............................................................................................99
8.1. Features and functions.............................................................99
8.2. Assembling and Configuring..................................................100
8.2.1. The File-Monitoring Technology ......................................100
8.2.2. Configuring Monitor...........................................................101
8.3. Launching Monitor..................................................................105
8.4. Reviewing the performance results.......................................106
8.5. Troubleshooting......................................................................106
9. SLOGAN: PROCESSING AND SUMMARIZING THE
PERFORMANCE REPORTS...........................................................109
9.1. Features and functions...........................................................109
9.2. Launching Slogan...................................................................110
9.3. Slogan in the real-time monitoring mode..............................112
10. TUNER: CUSTOMIZING SCANNER AND DAEMON...................115
10.1. Features and functions...........................................................115
10.2. Launching Tuner.....................................................................116
10.3. Interface..................................................................................117
10.4. Creating, editing and saving a profile....................................119
10.5. The Location page..................................................................121
10.5.1. Defining the location to be scanned for viruses...............121
10.5.2. Defining scanning settings for a separate directory........123
5

CONTENTS
10.5.2.1. The directory Property window: Selecting the
required directory......................................................... 123
10.5.2.2. The directory Property window: Objects to be
checked......................................................................... 124
10.5.2.3. The directory Property window: Defining anti-virus
actions............................................................................ 127
10.5.2.4. The directory Property window: Defining the
advanced scanning tools used. The Options page128
10.6. The Options page...................................................................130
10.7. The Report page.....................................................................132
10.8. The ActionWith page..............................................................135
10.9. The Customize page..............................................................137
11. WEBTUNER: REMOTE ADMINISTRATION PROGRAM ............139
11.1. Functions and features...........................................................139
11.2. General concept of the program performance......................140
11.3. Installing WebTuner. Access rights.......................................142
11.3.1. The WebTuner components............................................142
11.3.2. Setting up the web server and WebTuner.......................143
11.3.3. Rights on the web server..................................................147
11.3.3.1. Rights to run the web server..................................... 147
11.3.3.2. Rights to run the WebTuner copy............................ 148
11.4. Launching WebTuner.............................................................148
11.5. Interface..................................................................................150
11.6. Defining the Configuration of WebTuner...............................152
11.6.1. WebTuner settings............................................................152
11.6.2. The main page: WebTuner performance settings..........154
11.6.3. The modules page: remote administration settings........155
11.7. WebTuner: Administering Daemon.......................................159
6

CONTENTS
11.7.1. Daemon settings...............................................................159
11.7.2. Remote configuration of the Daemon program...............161
11.7.2.1. The Profile tuning window......................................... 161
11.7.2.2. The objects page: location to be scanned............. 162
11.7.2.3. The options page: scanning settings ...................... 165
11.7.2.4. The actions page: object-handling settings........... 165
11.7.2.5. The report page: reporting settings......................... 166
11.7.2.6. The customs page: advanced scanning settings. 167
11.7.3. Launching Daemon from a remote location....................167
11.7.4. Reviewing the log file........................................................172
11.8. WebTuner: administering Scanner........................................174
11.8.1. Scanner settings...............................................................174
11.8.2. Remote configuration of the Scanner program...............176
11.8.3. Launching Scanner from a Remote Location..................177
11.8.4. Reviewing the log file........................................................179
11.9. WebTuner: administering Updater ........................................179
11.10. WebTuner: administering Keeper..........................................183
11.10.1. Keeper settings.................................................................183
11.10.2. The main page: identification settings and communication
with Daemon.....................................................................185
11.10.3. Defining processing rules for a separate group ..............188
11.10.3.1. The groups page: defining the group...................... 188
11.10.3.2. The Group: window masks page: defining group
recipients and senders............................................... 191
11.10.3.3. The Group: window filters page: defining the filter193
11.10.3.4. The Group: window administrator page: notifications
for the administrator. Isolating infected objects..... 195
7

CONTENTS
11.10.3.5. The Group: window sender page: notifications for the
sender............................................................................ 198
11.10.3.6. The Group: window recipient page: messages to
group recipients........................................................... 200
11.10.4. The users page: the list of legal users............................203
11.10.5. The log page: data to be logged......................................205
11.10.6. The report page: defining the notification contents........206
11.10.6.1. The list of to be notified.............................................. 206
11.10.6.2. Notifications for administrators................................. 208
11.10.6.3. Notifications for senders............................................. 210
11.10.6.4. Notifications for recipients.......................................... 210
11.10.7. The restricts page: restrictions for the Keeper.................210
12. UPDATER: UPDATING VIRUS-DEFINITION DATABASES .......213
12.1. Function and features.............................................................213
12.2. Starting the Updater...............................................................214
12.3. How to update virus-definition databases.............................215
12.3.1. Updating via the Internet ..................................................215
12.3.2. Updating from a network directory...................................216
12.3.3. Updating from an archive.................................................217
12.4. Saving the report to a file .......................................................217
13. INSPECTOR: MONITORING FILESYSTEM INTEGRITY.............219
13.1. Function and Features...........................................................219
13.2. Running Inspector..................................................................220
13.2.1. The Program Command Line ..........................................220
13.2.2. Defining the location to be checked.................................222
13.2.3. Handling modified and new files......................................224
13.2.4. Saving the performance report.........................................226
8

CONTENTS
14. CONTROL CENTRE: SCHEDULING THE ANTI-VIRUS
PERFORMANCE..............................................................................227
14.1. Function and Features...........................................................227
14.2. Running Control Centre.........................................................227
14.3. Scheduling performance of package component-based tasks
.................................................................................................228
14.4. Saving the performance report..............................................233
15. APPENDIX A. PRINCIPAL FILES..................................................234
16. APPENDIX B. SUPPLEMENTARY DETAILS OF ANTI-VIRUS..236
16.1. Files with the program settings..............................................236
16.2. Scanner and Daemon: The initialization file (AvpUnix.ini)....236
16.3. Scanner and Daemon: the profile (defUnix.prf)....................238
16.4. Scanner and Daemon: command line switches...................249
16.5. Scanner and Daemon: report messages..............................256
16.6. Scanner and Daemon: exit codes.........................................257
16.7. Slogan: report templates........................................................259
16.8. Inspector: command line switches ........................................262
16.9. Control Centre: command line switches................................266
16.10. Monitor: configuration file (monitor.conf)...............................270
16.11. Updater: command line switches...........................................273
16.12. Installer: command line switches...........................................276
16.13. Keeper for sendmail: configuration file (kaspersky-av.mc) .277
16.14. Keeper for Postfix: configuration file (master.cf)...................278
16.15. WebTuner: the configuration file (loader.cfg)........................280
17. APPENDIX C. CLASSIFYING COMPUTER VIRUSES.................284
18. APPENDIX D. KASPERSKY LAB LTD.........................................288
18.1. About Kaspersky Lab.............................................................288
9

CONTENTS
18.2. Other Kaspersky Lab AntiViral Products...............................289
18.3. Kaspersky Lab Contact Information......................................292
19. INDEX ................................................................................................293
10

11
Chapter
1
Attention!!! New viruses arise every da
y
and if you want to keep your anti-virus
fresh and capable, we strongly recom-
mend you to update anti-virus databases
at least every day (for more details see
below). Moreover, make sure to update
them right after you install the product on
your computer!
1. KasperskyTM Anti-Virus for
FreeBSD, OpenBSD and BSDi
Mail Server
1.1.Introduction
What is Kaspersky Anti-Virus for xBSD Mail
Server?
KasperskyTM Anti-Virus for FreeBSD, OpenBSD and BSDi Mail
Server (Kaspersky Anti-Virus for xBSD Mail Server) is a software
product that is designed to search for and delete viruses1from xBSD. It
1The computer virus is a computer program (that is, executable code and/or a collection
of instructions) that can replicate itself (though the copy may not necessarily exactly
match the original) and penetrate files and other resources of computer systems and net-
works and make them perform tasks the virus dictates without the user’s permission.
Copies of the program are also capable of self-replicating.

INTRODUCTION
allows detection and deletion of all currently known types of viruses and
mailware codes including:
• polymorphic or self-encoding viruses;
• stealth or invisible viruses;
• viruses for Windows 9x, Windows NT, UNIX, OS/2;
• new viruses for Java applets;
• macroviruses infecting Word documents, Excel spreadsheets,
PowerPoint presentations, Help files etc.;
• network worms;
• Trojans.
 For classification of viruses that can be detected and deleted using
Kaspersky Anti-Virus for xBSD Mail Server refer to Appendix C.
The package contains a set of anti-virus applications and utilities.
The kavscanner (Scanner) enables you to check for viruses in your opera-
tion system on demand2.
The kavdaemon anti-virus process (Daemon) allows integration of the vi-
rus check process into your programs, and kavmonitor, the anti-virus file-
monitor (Monitor), continuously keeps checking for viruses in files of your
FreeBSD filesystem that are started or opened.
The slogan program (Slogan) was developed to process and summarize
data within the performance reports of the Scanner and the Daemon pro-
grams.
Kavupdater (Updater) enables you to update virus-definition databases
that are used by other components when checking for viruses.
2If there are other computer drives mounted under your filesystem, files on these drives
will be also virus-checked. Hereinafter when describing the virus-checking process on
your computer we mean your computer filesystem and all the files mounted under it.
12

INTRODUCTION
 When checking for viruses Kaspersky Anti-Virus for xBSD Mail
Server uses virus-definition databases that contain information al-
lowing detection and deletion of many viruses. Kaspersky Lab re-
leases virus-definition database updates containing information
about new viruses on a daily basis.
The package also contains the special configuration program kavtuner
(Tuner), which allows you to define the virus-scanning settings of the
Scanner and Daemon programs.
By using the kavinspector program (Inspector) you can check the filesys-
tem. This will allow you to monitor changes in the file structure and to check
for viruses in files with respect to the methods used to penetrate these files.
The package component WebTuner allows you to remotely manage
Kaspersky Anti-Virus for xBSD Mail Server.
The server version of the software product also contains mail-checking
programs: kavkeeper for sendmail, kavkeeper for Qmail, kavkeeper for
Postfix and kavkeeper for Exim ; these allow you to check for viruses in e-
mail and can be integrated in the following mailing systems: sendmail,
Qmail, Postfix and Exim.
Performance of all the Kaspersky Anti-Virus for xBSD Mail Server compo-
nents can be coordinated by means of the kavucc program (Control Cen-
tre), allowing a user to schedule automatic starts of the components and
display information about the licensed traffic and the Kaspersky Anti-Virus
for xBSD Mail Server users.
13

INTRODUCTION
1.2.Distribution kit
What is in the distribution kit. License agreement. Reg-
istration card.
1.2.1. What is in the distribution kit
The distribution kit includes:
• a sealed envelope with installation CD (or diskettes) with files of
the software product;
• User Guide;
• key diskette;
• registration card (with serial number of the product);
• license agreement.
 Before you unseal the envelope with CD (or diskettes), be sure to
thoroughly review the license agreement.
1.2.2. License agreement
The License Agreement (LA) is a legal agreement between you (either an
individual or a single entity) and the manufacturer (Kaspersky Lab Ltd.) de-
scribing the terms on which you may employ the anti-virus product, which
you have purchased.

Make sure to read the terms of the LA!
If you do not agree to the terms of this LA, Kaspersky Lab is not willing to
license the software product to you and you should return the unused
14

INTRODUCTION
product to your Kaspersky Anti-Virus dealer for a full refund, making sure
the envelope with CD (or diskettes) is sealed.
If you unsealed the envelope, you have agreed to all the terms of the LA.
1.2.3. Registration card
To register please fill the detachable coupon of your registration card (your
full name, phone, e-mail address) and mail it to the dealer that sold this kit
to you.
If your mail/e-mail address or telephone number changes, please notify the
entity you mailed the register coupon to.
On registration you obtain the status of registered user of Kaspersky Anti-
Virus for xBSD Mail Server and will be provided with product support and
virus-definition database updates for the period of your subscription. F
thermore, Kaspersky Lab provides Kaspersky Anti-Virus registered user
with information on the company’s new products.
ur-
s
1.3.Help desk for registered users
Services that we provide to registered users.
Kaspersky Lab offers a large service package enabling legal users to effi-
ciently employ Kaspersky Anti-Virus.
If you register and purchase a subscription you will be provided with the
following services for the period of your subscription:
• daily virus-definition database updates via e-mail;
• product upgrades;
15

INTRODUCTION
• phone and e-mail advice on matters related to your software in-
stallation, configuration and performance;
• information about new Kaspersky Lab products and new com-
puter viruses (for those who subscribe to our newsletter
http://www.kaspersky.com/subscribeNow.asp).
 Kaspersky Lab does not give advice on the performance and use of
your operating system or various other technologies.
1.4.Information in the book
What is in this documentation and what is not.
This book contains information on how to install, customize and manage
the software product. It explains the basic concepts and the way they can
be applied, and recommends ways to manage and change settings.
This book does not describe xBSD and software products that can be inte-
grated with Kaspersky Anti-Virus for xBSD Mail Server.
1.5.Conventions
Conventions that are used in this book.
In this book we use various conventions to emphasize different meaningful
parts of the documentation.
Convention Meaning
Bold font Menu titles, commands, window
titles, dialog elements, etc.
16

INTRODUCTION
Convention Meaning
 Note. Additional information, notes

Attention! Very important information

To do this: …
1. Step 1.
2. …
Actions that must be taken
• Function of the con-
trol—function of the
control.
Description of the settings tree
[switch]—function of the switch. Command line switches
Strings in the command line Text to be entered in the com-
mand line by the user
Info message text Text of the configuration files
and information messages of
the program.
17

Chapter
2
2. Installing Anti-Virus
2.1.Software and hardware
requirements
What hardware and software do you need to run
Kaspersky Anti-Virus for xBSD Mail Server?
In order to run Kaspersky Anti-Virus for xBSD Mail Server you need a
system that meets the following requirements:
• a PC-compatible computer with 486 CPU or better and at least
64 Mb of RAM;
• running the xBSD (FreeBSD, OpenBSD or BSDi) operating sys-
tem;
• with a kernel (version 3.x or 4.x).

Kernels of versions 2.0.x and earlier are not supported!
18

INSTALLATION
2.2.Backing up your installation
diskettes
If you purchased the Kaspersky Anti-Virus for xBSD Mail Server package
on installation diskettes (but not the CD) before installing the program on
your computer, it is recommended that you back up those diskettes. Then,
if during the installation you accidentally damage your installation diskettes,
you will be able to restore them from copies.
2.3.Step-By-Step Installation
Descriptions of each step to be taken when installing
Kaspersky Anti-Virus for xBSD Mail Server on a
computer.
2.3.1. Installation of Anti-Virus for
FreeBSD

To install the Kaspersky Anti-Virus for FreeBSD software pack-
age on a computer, follow these steps:
1. Copy the archive from the installation CD (installation diskette)
to a filesystem directory on your computer.
2. Extract the archive by using the string tar zxvf archive_name.
Several elements will be extracted from the software package
archive. These elements are also archives containing the
software product’s files.
19