KAPERSKY ANTI-VIRUS - FOR SUN SOLARIS MAIL SERVER User manual

KASPERSKY LAB
Kaspersky Anti-Virus
for Sun Solaris Mail Server
USER GUIDE

KASPERSKY ANTI-VIRUS FOR SUN SOLARIS MAIL
SERVER
User Guide
Kaspersky Lab Ltd.
http://www.kaspersky.com
Revision date: February 2002
1

Contents
1. KASPERSKYTM ANTI-VIRUS FOR SUN SOLARIS MAIL SERVER9
1.1. Introduction.................................................................................9
1.2. Distribution kit............................................................................11
1.2.1. What is in the distribution kit...............................................11
1.2.2. License agreement.............................................................12
1.2.3. Registration card.................................................................12
1.3. Help desk for registered users.................................................12
1.4. Information in the book.............................................................13
1.5. Conventions..............................................................................13
2. INSTALLING ANTI-VIRUS.................................................................15
2.1. Software and hardware requirements.....................................15
2.2. Backing up your installation diskettes......................................16
2.3. Step-By-Step Installation..........................................................16
2.4. Preparing to run........................................................................18
2.4.1. Editing the .ini file................................................................18
2.4.2. Editing the path to temporary files......................................19
2.4.3. Customizing software for several users.............................20
3. RUNNING ANTI-VIRUS......................................................................21
3.1. Changing scanning settings.....................................................21
3.2. Starting to check.......................................................................22
3.3. Starting to update virus-definition databases..........................23
4. ANTI-VIRUS SCANNER: SCANNING AND DISINFECTING.........25
4.1. Starting Scanner.......................................................................25
4.2. Searching for viruses and deleting them.................................27
4.2.1. Loading anti-virus scanner.................................................27
4.2.2. Handling infected objects ...................................................28
2

CONTENTS
4.2.3. Handling corrupted objects.................................................30
4.2.4. Handling suspicious objects...............................................31
4.3. Reviewing performance statistics............................................32
5. ANTI-VIRUS SCANNER AND DAEMON PROCESS: USING
SWITCHES AND PROFILES.............................................................34
5.1. Scanning settings.....................................................................34
5.2. How to change settings............................................................35
5.3. Settings for a separate location to be checked.......................36
5.3.1. Defining the location(s) to be checked...............................36
5.3.2. Defining objects to be checked..........................................38
5.3.2.1. Object types.................................................................... 38
5.3.2.2. Sectors............................................................................. 38
5.3.2.3. Files.................................................................................. 39
5.3.2.4. Packed executables...................................................... 41
5.3.2.5. Archives........................................................................... 42
5.3.2.6. Mail databases and plain mail files............................ 43
5.3.2.7. Embedded OLE objects............................................... 44
5.3.3. Defining anti-virus actions ..................................................44
5.3.4. Defining the advanced scanning tools to be used ............46
5.4. Settings for the cumulative location to be checked ................49
5.4.1. Cumulative settings.............................................................49
5.4.2. Defining scanning and performance settings: Scanner and
Daemon...............................................................................50
5.4.3. Defining actions on infected and suspicious objects.........54
5.4.4. Defining the reporting parameters .....................................56
6. DAEMON PROCESS: INTEGRATING ANTI-VIRUS PROTECTION
IN CLIENTS.........................................................................................59
6.1. Features of the Daemon program...........................................59
6.2. Launching the daemon process..............................................60
6.3. Calling up the process from a client program .........................63
3

CONTENTS
7. KEEPER: SCANNING SMTP TRAFFIC IN MAIL SYSTEMS:
SENDMAIL, QMAIL, POSTFIX AND EXIM......................................65
7.1. Features of the Keeper program.............................................65
7.2. Integrating Anti-Virus with sendmail........................................67
7.3. Integrating Anti-Virus with Qmail .............................................69
7.4. Integrating Anti-Virus with Postfix............................................70
7.5. Integrating Anti-Virus with Exim...............................................72
7.6. Customizing Keeper.................................................................74
7.6.1. General concept..................................................................74
7.6.2. Processing infected messages for an address group.......76
7.6.2.1. General concept............................................................ 76
7.6.2.2. The address group and the To/From addresses.... 78
7.6.2.3. To check or not to check…......................................... 79
7.6.2.4. Defining after-check processing of a message....... 79
7.6.2.5. Filtering mail by the files attached.............................. 84
7.6.2.6. Delivering infected messages to the administrator 85
7.6.2.7. Notifying the sender...................................................... 86
7.6.3. Defining attributes of the notification..................................87
7.6.4. Log.......................................................................................87
7.6.5. Communication between Keeper and the daemon process
.............................................................................................87
7.7. Launching Keeper....................................................................88
8. SLOGAN: PROCESSING AND SUMMARIZING THE
PERFORMANCE REPORTS.............................................................89
8.1. Features and functions.............................................................89
8.2. Launching Slogan.....................................................................90
8.3. Slogan in the real-time monitoring mode................................92
9. TUNER: CUSTOMIZING SCANNER AND DAEMON.....................94
9.1. Features and functions.............................................................94
9.2. Launching Tuner.......................................................................95
9.3. Interface....................................................................................96
9.4. Creating, editing and saving a profile......................................97
4

CONTENTS
9.5. The Location page....................................................................99
9.5.1. Defining the location to be scanned for viruses.................99
9.5.2. Defining scanning settings for a separate directory........101
9.5.2.1. The directory Property window: Selecting the
required directory......................................................... 101
9.5.2.2. The directory Property window: Objects to be
checked......................................................................... 102
9.5.2.3. The directory Property window: Defining anti-virus
actions............................................................................ 104
9.5.2.4. The directory Property window: Defining the
advanced scanning tools used.The Options page106
9.6. The Options page...................................................................107
9.7. The Report page.....................................................................109
9.8. The ActionWith page..............................................................112
9.9. The Customize page..............................................................114
10. WEBTUNER: REMOTE ADMINISTRATION PROGRAM ............116
10.1. Functions and features...........................................................116
10.2. General concept of the program performance......................117
10.3. Installing WebTuner. Access rights.......................................119
10.3.1. The WebTuner components............................................119
10.3.2. Setting up the web server and WebTuner.......................120
10.3.3. Rights on the web server..................................................123
10.3.3.1. Rights to run the web server..................................... 123
10.3.3.2. Rights to run the WebTuner copy............................ 124
10.4. Launching WebTuner.............................................................125
10.5. Interface..................................................................................126
10.6. Defining the Configuration of WebTuner...............................128
10.6.1. WebTuner settings............................................................128
10.6.2. The main page: WebTuner performance settings..........130
10.6.3. The modules page: remote administration settings........131
10.7. WebTuner: Administering Daemon.......................................135
10.7.1. Daemon settings...............................................................135
5

CONTENTS
10.7.2. Remote configuration of the Daemon program...............137
10.7.2.1. The Profile tuning window......................................... 137
10.7.2.2. The objects page: location to be scanned............. 138
10.7.2.3. The options page: scanning settings ...................... 140
10.7.2.4. The actions page: object-handling settings........... 140
10.7.2.5. The report page: reporting settings......................... 141
10.7.2.6. The customs page: advanced scanning settings. 142
10.7.3. Launching Daemon from a remote location....................142
10.7.4. Reviewing the log file........................................................146
10.8. WebTuner: administering Scanner........................................149
10.8.1. Scanner settings...............................................................149
10.8.2. Remote configuration of the Scanner program...............150
10.8.3. Launching Scanner from a Remote Location..................151
10.8.4. Reviewing the log file........................................................152
10.9. WebTuner: administering Updater ........................................153
10.10. WebTuner: administering Keeper..........................................156
10.10.1. Keeper settings.................................................................156
10.10.2. The main page: identification settings and communication
with Daemon.....................................................................159
10.10.3. Defining processing rules for a separate group ..............161
10.10.3.1. The groups page: defining the group...................... 161
10.10.3.2. The Group: window masks page: defining group
recipients and senders............................................... 164
10.10.3.3. The Group: window filters page: defining the filter166
10.10.3.4. The Group: window administrator page: notifications
for the administrator. Isolating infected objects..... 168
10.10.3.5. The Group: window sender page: notifications for the
sender............................................................................ 170
10.10.3.6. The Group: window recipient page: messages to
group recipients........................................................... 172
10.10.4. The users page: the list of legal users............................175
10.10.5. The log page: data to be logged......................................176
10.10.6. The report page: defining the notification contents........178
6

CONTENTS
10.10.6.1. The list of to be notified.............................................. 178
10.10.6.2. Notifications for administrators................................. 179
10.10.6.3. Notifications for senders............................................. 180
10.10.6.4. Notifications for recipients.......................................... 181
10.10.7. The restricts page: restrictions for the Keeper.................181
11. UPDATER: UPDATING VIRUS-DEFINITION DATABASES .......184
11.1. Function and features.............................................................184
11.2. Starting the Updater...............................................................184
11.3. How to update virus-definition databases.............................186
11.3.1. Updating via the Internet ..................................................186
11.3.2. Updating from a network directory...................................187
11.3.3. Updating from an archive.................................................187
11.4. Saving the report to a file .......................................................188
12. INSPECTOR: MONITORING FILESYSTEM INTEGRITY.............189
12.1. Function and Features...........................................................189
12.2. Running Inspector..................................................................190
12.2.1. The Program Command Line ..........................................190
12.2.2. Defining the location to be checked.................................191
12.2.3. Handling modified and new files......................................193
12.2.4. Saving the performance report.........................................195
13. CONTROL CENTRE: SCHEDULING THE ANTI-VIRUS
PERFORMANCE..............................................................................196
13.1. Function and Features...........................................................196
13.2. Running Control Centre.........................................................196
13.3. Scheduling performance of package component-based tasks
.................................................................................................197
13.4. Saving the performance report..............................................201
14. APPENDIX A. PRINCIPAL FILES..................................................203
15. APPENDIX B. SUPPLEMENTARY DETAILS OF ANTI-VIRUS..204
15.1. Files with the program settings..............................................204
7

CONTENTS
15.2. Scanner and Daemon: The initialization file (AvpUnix.ini)....204
15.3. Scanner and Daemon: the profile (defUnix.prf)....................206
15.4. Scanner and Daemon: command line switches...................217
15.5. Scanner and Daemon: report messages..............................222
15.6. Scanner and Daemon: exit codes.........................................224
15.7. Slogan: report templates........................................................225
15.8. Inspector: command line switches ........................................228
15.9. Control Centre: command line switches................................231
15.10. Updater: command line switches...........................................235
15.11. Keeper for sendmail: configuration file (kaspersky-av.mc) .238
15.12. Keeper for Postfix: configuration file (master.cf)...................239
15.13. WebTuner: the configuration file (loader.cfg)........................240
16. APPENDIX C. CLASSIFYING COMPUTER VIRUSES.................244
17. APPENDIX D. KASPERSKY LAB LTD.........................................247
17.1. About Kaspersky Lab.............................................................247
17.2. Other Kaspersky Lab AntiViral Products...............................248
17.3. Kaspersky Lab Contact Information......................................250
18. INDEX ................................................................................................252
8

99
Attention!!! New viruses arise every da
y
Attention!!! New viruses arise every da
y
and if you want to keep your anti-virus
fresh and capable, we strongl
y
recommend you to update anti-virus
databases at least every day (for more
details see below). Moreover, make sure
to update them right after you install the
product on your computer!
Chapter
1
1. KasperskyTM Anti-Virus for Sun
Solaris Mail Server
1.1.Introduction
What is Kaspersky Anti-Virus for Linux?
KasperskyTM Anti-Virus for Sun Solaris Mail Server is a software
product that is designed to search for and delete viruses1from Sun Solaris.
It allows detection and deletion of all currently known types of viruses and
malware codes including:
• polymorphic or self-encoding viruses;
• stealth or invisible viruses;
• viruses for Windows 9x, Windows NT, UNIX, OS/2;
1The computer virus is a computer program (that is, executable code and/or a collection
of instructions) that can replicate itself (though the copy may not necessarily exactly
match the original) and penetrate files and other resources of computer systems and
networks and make them perform tasks the virus dictates without the user’s permission.
Copies of the program are also capable of self-replicating.

INTRODUCTION
• new viruses for Java applets;
• macroviruses infecting Word documents, Excel spreadsheets,
PowerPoint presentations, Help files etc.;
• network worms;
• Trojans.
 For classification of viruses that can be detected and deleted using
Kaspersky Anti-Virus for Sun Solaris Mail Server refer to
Appendix C.
The package contains a set of anti-virus applications and utilities.
The kavscanner (Scanner) enables you to check for viruses in your
operation system on demand2.
The kavdaemon anti-virus process (Daemon) allows integration of the
virus check process into your programs.
The slogan program (Slogan) was developed to process and summarize
data within the performance reports of the Scanner and the Daemon
programs.
Kavupdater (Updater) enables you to update virus-definition databases
that are used by other components when checking for viruses.
 When checking for viruses Kaspersky Anti-Virus for Sun Solaris
Mail Server uses virus-definition databases that contain information
allowing detection and deletion of many viruses. Kaspersky Lab
releases virus-definition database updates containing information
about new viruses on a daily basis.
The package also contains the special configuration program kavtuner
(Tuner), which allows you to define the virus-scanning settings of the
Scanner and Daemon programs.
By using the kavinspector program (Inspector) you can check the
filesystem. This will allow you to monitor changes in the file structure and to
check for viruses in files with respect to the methods used to penetrate
these files.
2If there are other computer drives mounted under your filesystem, files on these drives
will be also virus-checked. Hereinafter when describing the virus-checking process on
your computer we mean your computer filesystem and all the files mounted under it.
10

INTRODUCTION
The package component WebTuner allows you to remotely manage
Kaspersky Anti-Virus for Sun Solaris Mail Server.
The server version of the software product also contains mail-checking
programs: kavkeeper for sendmail, kavkeeper for Qmail, kavkeeper for
Postfix and kavkeeper for Exim ; these allow you to check for viruses in e-
mail and can be integrated in the following mailing systems: sendmail,
Qmail, Postfix and Exim.
Performance of all the Kaspersky Anti-Virus for Sun Solaris Mail Server
components can be coordinated by means of the kavucc program (Control
Centre), allowing a user to schedule automatic starts of the components
and display information about the licensed traffic and the Kaspersky Anti-
Virus for Sun Solaris Mail Server users.
1.2.Distribution kit
What is in the distribution kit. License agreement.
Registration card.
1.2.1. What is in the distribution kit
The distribution kit includes:
• a sealed envelope with installation CD (or diskettes) with files of
the software product;
• User Guide;
• key diskette;
• registration card (with serial number of the product);
• license agreement.
 Before you unseal the envelope with CD (or diskettes), be sure to
thoroughly review the license agreement.
11

INTRODUCTION
1.2.2. License agreement
The License Agreement (LA) is a legal agreement between you (either an
individual or a single entity) and the manufacturer (Kaspersky Lab Ltd.)
describing the terms on which you may employ the anti-virus product,
which you have purchased.

Make sure to read the terms of the LA!
If you do not agree to the terms of this LA, Kaspersky Lab is not willing to
license the software product to you and you should return the unused
product to your Kaspersky Anti-Virus dealer for a full refund, making sure
the envelope with CD (or diskettes) is sealed.
If you unsealed the envelope, you have agreed to all the terms of the LA.
1.2.3. Registration card
To register please fill the detachable coupon of your registration card (your
full name, phone, e-mail address) and mail it to the dealer that sold this kit
to you.
If your mail/e-mail address or telephone number changes, please notify the
entity you mailed the register coupon to.
On registration you obtain the status of registered user of Kaspersky Anti-
Virus for Sun Solaris Mail Server and will be provided with product support
and virus-definition database updates for the period of your subscription.
Furthermore, Kaspersky Lab provides Kaspersky Anti-Virus registered
users with information on the company’s new products.
1.3.Help desk for registered users
Services that we provide to registered users.
Kaspersky Lab offers a large service package enabling legal users to
efficiently employ Kaspersky Anti-Virus.
12

INTRODUCTION
If you register and purchase a subscription you will be provided with the
following services for the period of your subscription:
• daily virus-definition database updates via e-mail;
• product upgrades;
• phone and e-mail advice on matters related to your software
installation, configuration and performance;
• information about new Kaspersky Lab products and new
computer viruses (for those who subscribe to our newsletter
http://www.kaspersky.com/subscribeNow.asp).

Kaspersky Lab does not give advice on the performance and use of
your operating system or various other technologies.
1.4.Information in the book
What is in this documentation and what is not.
This book contains information on how to install, customize and manage
the software product. It explains the basic concepts and the way they can
be applied, and recommends ways to manage and change settings.
This book does not describe Sun Solaris and software products that can be
integrated with Kaspersky Anti-Virus for Sun Solaris Mail Server.
1.5.Conventions
Conventions that are used in this book.
In this book we use various conventions to emphasize different meaningful
parts of the documentation.
13

INTRODUCTION
Convention Meaning
Bold font Menu titles, commands, window
titles, dialog elements, etc.
 Note. Additional information, notes

Attention! Very important information

To do this: …
1. Step 1.
2. …
Actions that must be taken
• Function of the
control—function of
the control.
Description of the settings tree
[switch]—function of the switch. Command line switches
Strings in the command line Text to be entered in the
command line by the user
Info message text Text of the configuration files
and information messages of
the program.
14

Chapter
2
2. Installing Anti-Virus
2.1.Software and hardware
requirements
Hardware and software requirements.
In order to run Kaspersky Anti-Virus for Sun Solaris Mail Server you
need a system that meets the following requirements:
• 64 Mb of Ram;
• preinstalled Sun Solaris version 7 or 8.

There are special version of Kaspersky Anti-Virus for Sun Solaris
Mail Server for processors Sparc and Intel.
15

INSTALLATION
2.2.Backing up your installation
diskettes
If you purchased the Kaspersky Anti-Virus for Sun Solaris Mail Server
package on installation diskettes (but not the CD) before installing the
program on your computer, it is recommended that you back up those
diskettes. Then, if during the installation you accidentally damage your
installation diskettes, you will be able to restore them from copies.
2.3.Step-By-Step Installation
Descriptions of each step to be taken when installing
Kaspersky Anti-Virus for Sun Solaris Mail Server on
a computer.

Only a root user is authorized to install Kaspersky Anti-Virus for
Sun Solaris Mail Server.

To install Kaspersky Anti-Virus for Sun Solaris Mail Server on a
computer, follow these steps:
1. Copy the archive from the installation CD (installation diskette)
to a filesystem directory on your computer.
2. Extract the archive by using the string gunzip archive_name in
the command line. Several elements will be extracted from the
software package archive. These elements are also archives
containing the software product’s files. For example, at this
stage your command line may look like the following:
gunzip kav-ServerSuit-4.0.0.0-sparc.tgz
3. Extract every component of the package by using the string
tar xfv archive_name in the command line. For example, your
command line may look like the following:
tar xfv kav-WorkstationSuit-4.0.0.0-sparc.tar
16

INSTALLATION
4. Run installation of every Kaspersky Anti-Virus for Sun
Solaris Mail Server component one at a time by using the
string root# pkgadd –d archive_name in the command line. For
example, to install the Workstation package, enter the
following string in the command line:
root# pkgadd –d kav-WorkstationSuit-4.0.0.0-sparc

The Workstation for Sun Solaris softwarepackage includes the
following programs: Scanner, Daemon, Inspector, Control Centre,
Tuner, Updater and Slogan.
5. Copy the .key file from the installation CD (installation
diskette) to the directory defined in the KeysPath line of the file
AvpUnix.ini. The default .key file directory is /etc.
6. Run the Updater program to download virus-definition
databases that are used in searches for viruses and
disinfection (for details on how to launch Updater refer to
subchapter 11.2).
 If required, before launching your copy of Updater, edit the
BasePath value in the file AvpUnix.ini. The BasePath parameter
defines the path to the virus-definition database directory.

For addresses of the servers from which you may download new
virus-definition databases, refer to subchapter 17.3 of Appendix B.
7. Run installation of the WebTuner program by using the string
root# pkgadd –d archive_name in the command line. A script file
allowing creation of the server SSL certificate will be started.
You must answer all the questions that appear on your
screen.
8. Choose and run installation of one of the Keeper
configurations for various mail systems (sendmail, Qmail,
Postfix or Exim). A script file allowing installation of the
selected program configuration will be started. You must
answer all the questions that appear on your screen.
9. Move to the directory /etc/AVP and edit the following files as
required: AvpUnix.ini and defUnix.prf.
17

INSTALLATION
 If you want to be able to start the installed executable files from any
directory, create appropriate links in the directory /usr/bin or
/usr/local/bin.
 For a list of files that are critical for the program’s performance refer
to Appendix A.
2.4.Preparing to run
How to edit the .ini file and a path to the directory
for temporary files. Customizing the software for various
needs.
2.4.1. Editing the .ini file
The initialization file AvpUnix.ini contains information that is essential for
your program’s correct performance and may be found in one of the
following directories:
1. ~/.AVP (a user directory. For example, /root/.AVP or
/home/user1/.AVP)
2. /opt/AVP/etc
3. /etc/AVP

When started, the program searches for the file AvpUnix.ini in the
directories listed above one after another. If the file is not detected
there, the program begins to look for it in the current directory!
If required, you may edit the file (for details of the INI file see Appendix B).
The initialization file must be edited in one of the following cases:
• If you copied your virus-definition databases to a separate
directory, you must specify a new path to these files in the
BasePath line of your AvpUnix.ini. Otherwise, when started your
Scanner will not find those databases and will not be able to
detect a virus, even if you have any!
18

INSTALLATION
• If you changed the name of your .set file (i.e. settings file of your
virus-definition databases), you must specify its new name in the
SetFile line of your AvpUnix.ini. Otherwise when started the
Scanner and the Daemon will not load its virus-definition
databases and will not be able to detect a virus, even if you have
any!

When editing the SetFile parameter, be sure to specify only the name
of your .set file. You do not need to define the full path to it!
• If you copied the key files to a separate directory, you must
specify a new path to these files in the KeysPath line of your
AvpUnix.ini. Otherwise, all the programs will operate as demo
versions, i.e. they will be disabled to delete the viruses detected
and to scan for viruses in archives and mail databases.
 It is advisable that you specify an absolute path to the virus-definition
databases and key files in your AvpUnix.ini file.
2.4.2. Editing the path to temporary
files
If you want your anti-virus scanner and the daemon process while checking
for viruses to place temporary in a directory that is different from /tmp (the
default directory for temporary files), define the desired directory by
following these steps:
1. Create a directory for temporary files, e.g. /TEMP.
2. Add the directory to your environmental variable TEMP or TMP.

For other programs the directory for temporary files must be defined
by editing the corresponding settings in the settings files of these
programs.
19