KAPERSKY CORPORATE SUITE User manual

KASPERSKY LAB
Kaspersky™ Corporate Suite
ANTI-VIRUS
SOLUTION

KASPERSKY CORPORATE SUITE
Anti-Virus
Solution
KASPERSKY LAB LTD
Visit our WEB site: http://www.kaspersky.com/

Contents
1. KASPERSKY™ CORPORATE SUITE.................................................5
1.1. MAIN FUNCTION OF THE SOFTWARE PACKAGE ........................................5
1.2. MAIN FEATURES OF THE KASPERSKY™ CORPORATE SUITE PACKAGE.......6
1.3. COMPONENTS.......................................................................................8
2. PROTECTING WORKSTATIONS.......................................................9
2.1. KASPERSKY™ ANTI-VIRUS FOR WORKSTATIONS RUNNING WINDOWS 95/98/ME
AND WINDOWS 2000/NT/XP (WINTEL). MAIN FEATURES................................9
2.1.1. Real-time pro ectiont
t
................................................................9
2.1.2. Filtering viruses out of email ..................................................9
2.1.3. Comprehensive control over e-mail messages ..................10
2.1.4. Protecting against macro-viruses .........................................10
2.1.5. Monitoring data-integrity .......................................................10
2.1.6. Protecting data storage locations ........................................10
2.1.7. Intercepting script-viruses ....................................................11
2.1.8. Centralized deployment and management .........................11
2.1.9. Automated updating ..............................................................11
2.1.10. Universal boot system ...........................................................11
2.2. KASPERSKY™ ANTI-VIRUS FOR OS/2. MAIN FEATURES .....................12
2.2.1. Two-level anti-virus protection .............................................12
2.2.2. Compliant with the most popular OS/2 versions ...............12
2.2.3. User-friendly ............................................................................12
3. PROTECTING FILE SERVERS..........................................................13
3.1. KASPERSKY™ ANTI-VIRUS FOR WINDOWS 2000/NT SERVER. MAIN FEATURES
13
3.1.1. Real-time pro ection ..............................................................13
3.1.2. Centralized deployment and management .........................13
3.1.3. Protecting data storage locations ........................................14
3.1.4. Quarantine of dangerous and suspicious objects ..............14
3.1.5. Virus alerts broadcasting .......................................................14
3.1.6. Automated updating ..............................................................14
ii

3.2. KASPERSKY™ ANTI-VIRUS FOR NOVELL NETWARE. MAIN FEATURES...15
3.2.1. Full-scale anti-virus protection
.............................................15
3.2.2. Integration into Novell Directory Service ............................15
3.2.3. Centralized deployment and management .........................15
3.2.4. Real-time configuration update ............................................16
3.2.5. Quarantine of dangerous and suspicious objects ..............16
3.2.6. Virus alerts broadcasting .......................................................16
3.2.7. Automatic disconnection of infected workstations ............16
3.2.8. Adjusting of CPU utilization
..................................................16
3.2.9. Automated retrieve of updates via the Internet
................17
3.2.10. Multithreaded virus scanning ................................................17
4. PROTECTING MAIL SYSTEMS........................................................18
4.1. KASPERSKY™ ANTI-VIRUS FOR MICROSOFT EXCHANGE SERVER. MAIN FEATURES
18
4.1.1. E-mail anti-virus security .......................................................18
4.1.2. Protection of client worksta ionst ..........................................18
4.1.3. Comprehensive control over e-mail messages ..................19
4.1.4. Flexible configuration for personal and public e-mail accounts
19
4.1.5. Reliable quarantine of dangerous objects and alert broadcasting
19
4.1.6. Real-time configuration update ............................................19
4.1.7. Centralized management ......................................................20
4.1.8. Support for an unlimited number of e-mail accounts .......20
4.1.9. User-friendly ............................................................................20
4.2. KASPERSKY™ ANTI-VIRUS FOR LOTUS NOTES/DOMINO. MAIN FEATURES20
4.2.1. Constant protection of e-mail-traffic ...................................20
4.2.2. Comprehensive control over e-mail messages ..................21
4.2.3. Virus alerts broadcasting .......................................................21
4.2.4. Real-time virus neutralization ...............................................21
4.2.5. User-friendly ............................................................................21
4.2.6. Automated updating ..............................................................21
5. PROTECTING LINUX/UNIX OPERATING SYSTEMS...............22
5.1. KASPERSKY™ ANTI-VIRUS FOR LINUX/UNIX OPERATING SYSTEMS. MAIN
FEATURES.......................................................................................................22
5.1.1. Full-scale anti-virus protection .............................................22
5.1.2. Compliancy with the most popular Linux and UNIX versions 23
3

5.1.3. Unique combination of the most advanced anti-virus tools for
Linux and UNIX
......................................................................................23
5.1.4. Centralized protection of your e-mail systems ...................24
5.1.5. Easy integration into third party applications- ....................24
5.1.6. Automated retrieve of updates via the Internet ................24
5.1.7. Interactive management system .........................................24
6. KASPERSKY™ CORPORATE SUITE: PROTECTING WEB SERVERS
25
6.1. KASPERSKY™ WEB INSPECTOR..........................................................25
6.1.1. Monitoring changes ................................................................25
6.1.2. Improved file analysis ............................................................26
6.1.3. Back up ....................................................................................26
6.1.4. Recovery of original content .................................................26
6.1.5. Real-time configuration update ............................................26
6.1.6. Immediate broadcast of warnings .......................................26
6.1.7. User-friendly ............................................................................27
7. PROTECTING DATA TRAFFIC PASSING THROUGH FIREWALLS
28
7.1. KASPERSKY™ ANTI-VIRUS FOR FIREWALL...........................................28
7.1.1. Anti-virus solution for the Internet ......................................28
7.1.2. Compliancy with all the most popular firewalls .................29
7.1.3. Advanced anti-virus technology ...........................................29
7.1.4. Transparency of data traffic .................................................29
7.1.5. Reliable quarantine of dangerous objects and alert broadcasting
29
7.1.6. Centralized management ......................................................30
7.1.7. User-friendly ............................................................................30
8. MANAGEMENT OF ANTI-VIRUS PROTECTION.........................31
8.1. KASPERSKY™ ADMINISTRATION KIT ...................................................31
8.1.1. Remote management of the anti-virus tools ......................31
8.1.2. Alerts broadcasting ................................................................32
8.1.3. Cumulative reporting .............................................................33
8.1.4. Isolating infected and suspicious objects ...........................33
APPENDIX. KASPERSKY LAB LTD.......................................................34
4

Chapter
1
1. Kaspersky™ Corporate Suite
1.1.Main function of the software package
Kaspersky™ Corporate Suite is developed to provide the full-scale data-
protection for corporate networks. Main advantage of this package is that it
allows you to develop platform-independent and centrally-managed informa-
tion security structure successfully protecting corporate networks of any size
and complexity (with possible application to the remote sub-networks located
overseas) against malicious code and hacker attacks.
Anti-virus software products in Kaspersky™ Corporate Suite provide the reli-
able control over all virus propagation sources in your system: they are used
on workstations (DOS, Windows 95/98/ME, Windows 2000/NT/XP Work-
station, OS/2, Linux), file servers (Windows 2000/NT Server, Linux, Novell
NetWare, FreeBSD, OpenBSD, BSDi, Solaris) e-mail gateways (MS Exchange
Server, Lotus Notes, Sendmail, Qmail, Postfix), CVP compatible firewalls
(Check Point FireWall-1) and Web servers. Powerful and easy-to-use network
management tools allow for centralized deployment and administration of the
data-protection system on your computers and corporate networks.
At Kaspersky Lab, we strive for full and complete customer satisfaction. Kas-
persky™ Corporate Suite allows you to create a dependable defense that is
fully appropriate and compatible for your network configurations.
5

KASPERSKY CORPORATE SUITE
1.2. Main features of the Kaspersky™ Corpo-
rate Suite package
1. Reliable protection
When developing a modern enterprise-wide data-security solution the main
task is to implement a system with all its components operating trouble-free
and in full co-operation. The time-tested reliable and effective Kaspersky™
Corporate Suite components successfully provide reliable anti-virus protection
for hundreds of corporations around the world. The highest quality and effec-
tiveness of Kaspersky Lab products is confirmed by numerous certificates re-
ceived from the world's leading independent research centers and test labs
that include: the certificate and the license from the State Technical Committee
under the President of Russian Federation; the Checkmark certificate for three
levels (Level 1, Level 2, and Trojan) from the West Coast Labs test center; the
International Computer Security Association (ISCA) certificate; and the Micro-
soft Certificate for compatibility with the Windows operating system.
2. Supporting various platforms
The infrastructure of a modern enterprise is a complex multi-component com-
puting environment that consists of various operating systems and applications
operating simultaneously. Regarding this Kaspersky™ Corporate Suite was
provided with multi-platform components protecting workstations, file servers,
e-mail gateways, firewalls, and Web servers, and supports all the commonly
used operating systems.
3. Easy-to-integrate
Kaspersky Lab strives to completely satisfy demands and to pay attention
even to the most insignificant requests of its clients. Kaspersky™ Corporate
Suite is developed to operate especially within corporation networks of any
size and complexity. Due to application of the most up-to-date development
methods the software product can be seamlessly integrated into the existing
computing environment and customized to perform specific business tasks. As
a result, you receive a complete information security solution that meets your
system requirements and specific tasks of your business.
4. Comprehensive protection of a corporate network
Corporate network protection is successful only when it covers all nodes, data-
transmission channels and storage locations. Kaspersky™ Corporate Suite
provides comprehensive protection of a corporate network by effectively pro-
6

KASPERSKY CORPORATE SUITE
tecting workstations, file and mail servers, Web servers, and controlling data
traffic passing via e-mail gateways and firewalls. Kaspersky™ Corporate Suite
is powered by a unique management tool for advanced administration of the
anti-virus system. Kaspersky™ Administration Kit allows for a centralized
product deployment and management across the corporate network.
5. State-of-the-art set of anti-virus tools
Kaspersky™ Corporate Suite includes all the advanced tools for fighting
against viruses: an anti-virus scanner that checks data storage locations on-
demand; an anti-virus monitor that performs real-time virus-check of all files
being used; an integrity checker to monitor data integrity on your computers; a
unique script-virus background interceptor; a behavior blocker that provides
100% protection against micro-viruses. The combined use of these tools ex-
cludes the possibility of virus penetration, making your computing safe and
secure. Employment of the Kaspersky™ Corporate Suite-integrated system of
heuristic analysis allows you to prevent infection from even unknown viruses.
6. On-time detection of new viruses
Kaspersky Lab provides auto-installable updates for its anti-virus products on
the daily basis. The company anti-virus experts monitor the world virus situa-
tion twenty–four hours a day. In case a new virus appears, they immediately
develop the appropriate cure module and immediately deliver it to customers.
7. Extended services
Kaspersky™ Corporate Suite users may be provided with extended services
for the purpose of development of a customized comprehensive data-
protection system meeting all requirements of the corporate network. On your
request Kaspersky Lab can contribute to inspection and analysis of your cor-
porate network for the purpose of identification of the vulnerable points, to
network testing and modification of the anti-virus software to meet the cus-
tomer requirements, and to finishing of the customized anti-virus protection
project. The company experts provide services for installation and setting of
the software, and for training of the maintenance staff and users. Users of the
Kaspersky Lab products are also provided with round-the-clock technical sup-
port by either phone or e-mail in Russian or English.
7

KASPERSKY CORPORATE SUITE
1.3. Components
What components the Kaspersky™ Corporate Suite
package includes?
Kaspersky™ Corporate Suite includes the following components:
• Protection for workstations — Kaspersky™ Anti-Virus for Windows
95/98/Me, Windows 2000/NT/XP Workstation, OS/2 and Linux.
• Protection for file servers — Kaspersky™ Anti-Virus for Windows
2000/NT Server, Netware, UNIX (FreeBSD, OpenBSD, BSDi, Solaris)
and Linux.
• Protection for mail systems — Kaspersky™ Anti-Virus for Microsoft
Exchange, Lotus Notes, Sendmail, Postfix, Exim and Qmail.
• Protection for WEB servers — Kaspersky™ WEB Inspector.
• Protection of data passing through firewalls — Kaspersky™ Anti-Virus
for Firewall.
• Protection for pocket computers – Kaspersky™ Anti-Virus for Palm
OS.
• Centralized deployment and management of the package compo-
nents - Kaspersky™ Administration Kit.
8

Chapter
2
2. Protecting Workstations
2.1.Kaspersky™ Anti-Virus for workstations
running Windows 95/98/Me and Windows
2000/NT/XP (Wintel). Main features
2.1.1. Real-time protection
The background virus-interceptor - Monitor permanently resides in your Wintel
workstation’s memory, checking for viruses in files (including the archived)
while they are started, created or copied, and also in the memory of started
programs. The program comprehensively controls all the file operations pre-
venting virus attacks.
2.1.2. Filtering viruses out of email
Kaspersky™ Anti-Virus for Wintel workstations automatically and in real time
checks for viruses in all incoming and outgoing messages. Since the program
supports all the major e-mail database formats (MS Outlook, MS Outlook Ex-
9

KASPERSKY CORPORATE SUITE
press, MS Exchange, Eudora, MS Mail, Pegasus Mail, Netscape Mail, JSMail,
MIME, The BAT), it reliably protects against viruses in mail message storage
locations. The built-in Mail Checker efficiently deletes viruses from e-mail
messages, and completely recovers the original contents.
2.1.3. Comprehensive control over e-mail messages
Kaspersky™ Anti-Virus for Wintel workstations automatically checks for vi-
ruses in all elements of incoming and outgoing messages: the message body,
embedded OLE objects, attached files (including archived or compressed files)
and other messages of any nesting level.
2.1.4. Protecting against macro-viruses
Kaspersky™ Anti-Virus for Wintel contains special modules controlling macro-
instructions that are executed. The unique macro control technology using the
concept of behavior blocker allows the program to prohibit macro-viruses from
being executed.
2.1.5. Monitoring data-integrity
Inspector, the Kaspersky™ Anti-Virus for Wintel workstations built-in integrity
checker traces all changes on the local computer in background: appearance
of new, deletion and modification of existing files and more. The program im-
plements the control by calculating mathematical values known as checksums
or CRC values (for Cyclic Redundancy Code) for disk sectors and files, and
subsequently checking these against the existing copy of appropriate
file/sector. If a virus-incidental action (such as unauthorized changes in a file
or the system registry) is detected, the module allows removal of the malicious
code and recovery of the original disk contents.
2.1.6. Protecting data storage locations
The anti-virus Kaspersky™ AV Scanner allows for the comprehensive check of
local and network drive contents on-demand. You may run your scanner
10

PROTECTING WORKSTATIONS
manually or schedule its start using Kaspersky™ AV Control Centre included
in the package.
2.1.7. Intercepting script-viruses
To protect the user from script-viruses the package uses the built-in Script
Checker module that completely solves this problem by integrating itself as a
filter in-between the script-virus and its handler. This enables you to check for
viruses in any script before it is executed.
2.1.8. Centralized deployment and management
Kaspersky™ Anti-Virus for Wintel is completely integrated in the unique sys-
tem of anti-virus protection management. KasperskyAdministration Kit en-
ables you to centrally install and control Kaspersky™ Anti-Virus for NT Server
from any (including the remote) computer; to define a timetable and an order in
which the modules must be started; to automatically retrieve and enable anti-
virus database updates via the Internet; to broadcast notifications on virus at-
tacks; to review virus-check logs on workstations; and control access rights to
change the program configuration.
2.1.9. Automated updating
The Kaspersky™ AV Updater module allows for automated updating of anti-virus
databases containing virus and remedy definitions, and of the software package
components.
2.1.10. Universal boot system
The product contains the built-in Rescue Disk Set module – a boot system that
allows you to restore your PC at work in case it has been completely disabled
as the result of a virus attack. Rescue Disk Set creates a set of Linux-based
bootable diskettes with pre-installed Kaspersky™ Anti-Virus for Linux. This
allows you to perform a "clean boot" and to restore infected hard disks with all
11

KASPERSKY CORPORATE SUITE
the commonly used file systems at once: FAT (DOS), FAT32 (Windows
95/98), NTFS (Windows NT/2000), HPFS (OS/2), EXT (Linux).
2.2.Kaspersky™ Anti-Virus for OS/2.
Main features
2.2.1. Two-level anti-virus protection
Kaspersky™ Anti-Virus for OS/2 provides your computer with a two-level anti-
virus protection. The first level is an anti-virus scanner that may be started on
demand or from a third-party scheduler. On the second level, viruses are neu-
tralized with the world's first and only anti-virus monitor protecting all active
processes in OS/2 from viruses in real-time. Combined use of these tools al-
lows you full control over all virus propagation sources. The program success-
fully fights all types of malicious programs, including Internet-worms, Trojans,
and computer viruses including viruses that were specially developed for
OS/2.
2.2.2. Compliant with the most popular OS/2 versions
Kaspersky™ Anti-Virus for OS/2 may be used under the most popular versions
of this operating system, including Warp, Merlin and Aurora.
2.2.3. User-friendly
Kaspersky™ Anti-Virus for OS/2 contains the simple and user-friendly Presen-
tation Manager graphic interface. It utilizes the step-by-step method, offering a
user recommendations for the next step. Main functions of the program can be
activated by the touch of a single key.
12

Chapter
3
3. Protecting File Servers
3.1.Kaspersky™ Anti-Virus for Windows
2000/NT Server. Main features
3.1.1. Real-time protection
Kaspersky™ Anti-Virus for 2000/NT Server includes a background virus inter-
ceptor, Kaspersky™ AV Monitor that permanently resides in the computer
memory checking all used files (e.g. when these are opened or closed) in real-
time. The module also allows checking-in the memory of running programs
right after it is loaded, and also every time you update your anti-virus bases. If
the infected memory of a program cannot be disinfected, this program is
forced to abort the performance.
3.1.2. Centralized deployment and management
The product is completely integrated in the unique system of anti-virus protec-
tion control that was originally developed in Kaspersky Lab. Kaspersky™ AV
Control Centre (client subsystem) and Network Control Centre (network sub-
13

KASPERSKY CORPORATE SUITE
system) enable you to centrally install and control Kaspersky™ Anti-Virus for
NT Server from any (including the remote) computer; to define a timetable and
an order in which the modules must be started; to automatically retrieve and
enable anti-virus database updates via the Internet; to broadcast notifications
on virus attacks and review virus-check logs.
3.1.3. Protecting data storage locations
The anti-virus Kaspersky™ AV Scanner allows for the comprehensive check of
local and network drive contents on-demand or as scheduled. Combined use of
Kaspersky™ AV Scanner and Kaspersky™ AV Monitor allows you full control over
all virus propagation sources on your network.
3.1.4. Quarantine of dangerous and suspicious objects
Kaspersky™ Anti-Virus for 2000/NT Server has a special quarantine feature
allowing to isolate infected and suspicious objects in a safe place and subse-
quently move the objects to a quarantine directory defined by a network
administrator.
3.1.5. Virus alerts broadcasting
If Kaspersky™ Anti-Virus detects a virus trying to enter the server, it informs the
system administrator and/or a group of users by sending a user-defined alert mes-
sage to the pre-set addresses.
3.1.6. Automated updating
The Kaspersky™ AV Updater module allows for automated updating of anti-virus
databases containing virus and remedy definitions, and of the software package
components.
14

PROTECTING FILE SERVERS
3.2.Kaspersky™ Anti-Virus for Novell Net-
Ware. Main features
Kaspersky™ Anti-Virus for NetWare is a unique anti-virus solution with a net-
work management system, which is completely integrated in the Novell Direc-
tory Service (NDS). The program is a loadable module (NLM) for file and ap-
plication servers running Novell NetWare. It effectively controls all file opera-
tions on a server. If the program detects a virus attack, it is able to efficiently
repel it and quickly recover the system.
3.2.1. Full-scale anti-virus protection
Kaspersky™ Anti-Virus for NetWare includes a full set of anti-virus tools: an
anti-virus scanner that checks data storage locations and may be started on
demand or by schedule; and an anti-virus monitor checking all used files
(opened, copied, closed) in real-time. Combined use of these tools allows you
to perform full control over all the virus propagation sources on your network.
3.2.2. Integration into Novell Directory Service
Since all the main features of Kaspersky™ Anti-Virus for NetWare are com-
pletely integrated in NDS, it enables a network administrator to efficiently
manage the program directly from the administrator console (NWAdmin or
ConsoleOne).
3.2.3. Centralized deployment and management
The program may be installed on NetWare servers from any workstation run-
ning Microsoft Windows NT/2000 within the network. Due to deep integration
into the NWAdmin network management systems a network administrator is
able to remotely manage Kaspersky™ Anti-Virus for NetWare: to schedule
component starts, to change program settings, notification modes and the or-
der of infected files processing, to plan downloading of the anti-virus database
updates and etc.
15

KASPERSKY CORPORATE SUITE
3.2.4. Real-time configuration update
To apply the changes you have made to the program settings, you do not
need to restart the server. They will be activated right after you have confirmed
them.
3.2.5. Quarantine of dangerous and suspicious objects
Kaspersky™ Anti-Virus for NetWare has a special quarantine feature allowing
to isolate infected and suspicious objects in a safe place and subsequently
move the objects to a quarantine directory defined by the system administra-
tor.
3.2.6. Virus alerts broadcasting
If Kaspersky™ Anti-Virus detects a virus trying to enter the server, it informs
the system administrator and/or a group of users by sending a user-defined
alert message to the pre-set addresses.
3.2.7. Automatic disconnection of infected
workstations
If a certain workstation sends infected files to the server, Kaspersky™ Anti-
Virus for NetWare may temporarily disable further access of this workstation to
the server in order to prevent any further distribution of viruses on the network.
3.2.8. Adjusting of CPU utilization
Kaspersky™ Anti-Virus for NetWare provides a comprehensive set of settings
allowing the network administrator to adjust the CPU resources dedicated to
program use.
16

PROTECTING FILE SERVERS
3.2.9. Automated retrieve of updates via the Internet
Kaspersky™ Anti-Virus for NetWare supports the automatic downloading and
hookup of anti-virus database updates via the Internet. The procedure may be
performed on demand or scheduled by a network administrator.
3.2.10. Multithreaded virus scanning
Kaspersky™ Anti-Virus for NetWare now supports multithreaded virus scan-
ning that allows for an unlimited amount of files being scanned simultaneously
in real-time. This amount is limited only by the server's hardware configuration.
The multithreaded virus scanning essentially increases the overall efficiency of
the entire network by simultaneous processing of requests that arrived from
many workstations at the same time.
17

Chapter
4
4. Protecting Mail Systems
4.1.Kaspersky™ Anti-Virus for Microsoft Ex-
change Server. Main features
Kaspersky™ Anti-Virus for Exchange is a centralized anti-virus system for mail
servers running Microsoft Exchange Server 5.x and 2000. The program pro-
vides centralized anti-virus filtering for the entire local and external e-mail traf-
fic in real-time as well as on a user demand.
4.1.1. E-mail anti-virus security
Kaspersky™ Anti-Virus for Exchange integrates itself into the mail server as a
supplemental module and permanently checks for viruses in all e-mail mes-
sages in protected mailboxes and folders.
4.1.2. Protection of client workstations
Kaspersky™ Anti-Virus for Exchange prohibits infected e-mail from entering
the Internet-connected workstations within your corporate network. You may
18

PROTECTING MAIL SYSTEMS
set the program to delete, block or disinfect the infected messages. Further-
more, if a virus has infected one of your workstations, it is unable to distribute
itself, since the program suppresses any attempts of the kind and informs the
system administrator about this event.
4.1.3. Comprehensive control over e-mail messages
Kaspersky™ Anti-Virus for Exchange controls all elements of an e-mail mes-
sage: the message body, embedded OLE objects, attached files (including
archived and compressed files) and other messages of any nesting level.
4.1.4. Flexible configuration for personal and public e-
mail accounts
Kaspersky™ Anti-Virus for Exchange protects all types of mailboxes – per-
sonal and public. You may set specific preferences for each separate mailbox
or folder.
4.1.5. Reliable quarantine of dangerous objects and
alert broadcasting
You can define your quarantine address where the program will transfer all
infected and suspicious objects that have been detected in e-mail traffic. If
Kaspersky™ Anti-Virus detects a virus attempting to enter your network, it in-
forms the system administrator(s) by sending a user-defined alert message to
the pre-set address(es), reporting the details of the source and current location
of the infected object.
4.1.6. Real-time configuration update
To change the configuration (to update your anti-virus databases, to edit the
list of protected mailboxes) you do not need to restart your Kaspersky™ Anti-
Virus for Exchange. All changes will be activated right after the system admin-
istrator has confirmed them.
19