KASPERSKY LABS Kaspersky Anti-Hacker 1.5 USER GUIDE KASPERSKY ANTI-HACKER 1.5 User Guide Kaspersky Labs Ltd. http://www.kaspersky.com Revision date: April 2004 Contents CHAPTER 1. KASPERSKY ANTI-HACKER.................................................................. 6 1.1. Introduction ............................................................................................................ 6 1.2. What's new in v. 1.5 .............................................................................................. 7 1.3. Distribution Kit........................................................................................................ 8 1.3.1. What Is in the Distribution Kit ......................................................................... 8 1.3.2. License Agreement......................................................................................... 8 1.4. Information in the Book ......................................................................................... 9 1.5. Conventions......................................................................................................... 10 1.6. Help Desk for Registered Users ......................................................................... 11 CHAPTER 2. INSTALLING AND REMOVING THE SOFTWARE.............................. 12 2.1. Hardware and Software Requirements .............................................................. 12 2.2. Installing ............................................................................................................... 13 2.3. Removing the Program ....................................................................................... 18 CHAPTER 3. STARTING WORK ................................................................................. 19 CHAPTER 4. KASPERSKY ANTI-HACKER ­ PREVENTING HACKER ATTACKS ................................................................................................................... 22 4.1. Kaspersky Anti-Hacker Operating Principles ..................................................... 22 4.2. Security Levels .................................................................................................... 23 4.3. Recommended Settings...................................................................................... 24 CHAPTER 5. RUNNING THE PROGRAM .................................................................. 27 5.1. Starting the Program ........................................................................................... 27 5.2. System Menu....................................................................................................... 28 5.3. Main Window ....................................................................................................... 29 5.4. Menus .................................................................................................................. 30 5.5. Toolbar................................................................................................................. 32 5.6. Workspace........................................................................................................... 33 4 Kaspersky Anti-Hacker 5.7. Status Bar ............................................................................................................ 34 5.8. Context Menu ...................................................................................................... 34 5.9. Rule Wizards ....................................................................................................... 34 5.10. Changing and Saving Interface Settings .......................................................... 35 5.11. Exiting the Program........................................................................................... 37 CHAPTER 6. ENABLING THE SECURITY SYSTEM AND DEFINING ITS SETTINGS.................................................................................................................. 38 6.1. Enabling the Security System and Selecting the Security Level ....................... 38 6.1.1. Enabling the Security System ...................................................................... 38 6.1.2. Selecting the Security Level ......................................................................... 40 6.1.3. Network Event Warning................................................................................ 41 6.1.4. Training Window (Medium Level) ................................................................ 42 6.1.5. The Executable Module Substitution Warning ............................................ 43 6.2. How the Program Responds to Attack ............................................................... 45 6.3. Customizing Application Rules ........................................................................... 46 6.3.1. Managing the Rule List................................................................................. 46 6.3.2. Adding a New Rule....................................................................................... 49 6.3.2.1. Step 1. Customizing the Rule................................................................ 49 6.3.2.2. Step 2. Rule Conditions......................................................................... 53 6.3.2.3. Step 3. Additional Actions...................................................................... 59 6.4. Customizing Packet Filtering Rules .................................................................... 60 6.4.1. Managing the Rule List................................................................................. 60 6.4.2. Adding a New Rule....................................................................................... 63 6.4.2.1. Step 1. Rule Conditions......................................................................... 63 6.4.2.2. Step 2. Rule Name and Additional Actions........................................... 67 6.5. Intrusion Detection System ................................................................................. 69 6.5.1. Intrusion Detector Settings ........................................................................... 69 6.5.2. The List of Detectable Attacks...................................................................... 70 CHAPTER 7. VIEWING PERFORMANCE RESULTS................................................ 73 7.1. Viewing the Current Status ................................................................................. 73 7.1.1. Active Applications........................................................................................ 73 Contents 5 7.1.2. Established Connections.............................................................................. 77 7.1.3. Open Ports.................................................................................................... 80 7.2. Using the Logs..................................................................................................... 83 7.2.1. Displaying the Logs Window........................................................................ 83 7.2.2. The Logs Window Layout............................................................................. 84 7.2.2.1. Menus..................................................................................................... 84 7.2.2.2. Report Table .......................................................................................... 84 7.2.2.3. Tabs........................................................................................................ 85 7.2.3. Selecting the Log .......................................................................................... 85 7.2.3.1. Security Log ........................................................................................... 85 7.2.3.2. Application Activity ................................................................................. 86 7.2.3.3. Packet Filtering ...................................................................................... 87 7.2.4. Defining Log Settings ................................................................................... 88 7.2.5. Saving the Log to a File................................................................................ 89 APPENDIX A. INDEX .................................................................................................... 90 APPENDIX B. FREQUENTLY ASKED QUESTIONS ................................................. 91 APPENDIX C. KASPERSKY LABS LTD...................................................................... 92 C.1. Other Kaspersky Lab's Products........................................................................ 93 C.2. Contact Information............................................................................................. 96 CHAPTER 1. KASPERSKY ANTIHACKER 1.1. Introduction What is Kaspersky Anti-Hacker? Kaspersky Anti-Hacker is a personal firewall that is designed to safeguard a computer running a Windows operating system. It protects the computer against unauthorized access to its data and external hacker attacks from the Internet or an adjacent local network. Kaspersky Anti-Hacker: · Monitors the TCP/IP network activity of all applications running on your machine. If it detects any suspicious actions, the program notifies you and if required, blocks the suspect application from accessing the network. This allows you to preserve confidential data on your machine. For example, if a Trojan tries to transmit any data from your computer, Kaspersky Anti-Hacker will block this malware from accessing the Internet. The SmartStealthTM technique makes it difficult to detect your computer from outside. As a result, hackers will lose the target and all their attempts to access your computer will be doomed to fail. Besides, this allows for prevention of the DoS (Denial of Service) attack of all types. At the same time you will not feel any negative influence of this mode while working on the Web: the program provides conventional transparency and accessibility of the data. Blocks the most common hacker network attacks by permanently filtering the incoming and outgoing traffic, and also notifies the user about any such attacks. Monitors for attempts to scan your ports (these attempts are usually followed by attacks), and prohibits any further communication with the attacking machine. Allows you to review the list of all established connections, open ports, and active network applications, and if required, lets you terminate unwanted connections. · · · · Kaspersky Anti-Hacker 7 · Allows you to secure your machine from hacker attacks without special configuration of program settings. The program allows simplified management by choosing one of five security levels: Block all, High, Medium, Low, Allow all. By default the program starts with the Medium level, which is a training mode that will automatically configure your security system depending on your responses to various events. Allows flexibility of security system configuration. In particular, you can set the program to filter network operations into wanted and unwanted, and you can configure the Intrusion Detection System. Allows you to log certain security-related network events to various special-purpose logs. If required, you can define the detail level of the log entries. · · The program may be used as a separate software product or as an integral component of various Kaspersky Labs solutions. Attention!!! Kaspersky Anti-Hacker does not protect your computer from viruses and malicious programs that can destroy and/or corrupt your data. It is advised that you use Kaspersky Anti-Virus Personal for this purpose. 1.2. What's new in v. 1.5 New features of version 1.5 The new version of this program: · · · · · supports operations with ADSL modems; completely supports Stealth mode (tests passed at www.pcflank.com); is able to detect new network attacks: SmbDie, Helkern, and Lovesan; allows definition of port ranges for packet filtering and application rules; is more easy to configure right after installation without any degradation of the computer security level ­ the most frequently used applications are allowed by default to establish network connections strictly according to their types; 8 Kaspersky Anti-Hacker · has an improved graphic interface: supports XP style under Windows XP; the rule handling lists can be resized; to add a new rule you can use the key. 1.3. Distribution Kit What is in the Distribution kit License agreement. 1.3.1. What Is in the Distribution Kit The distribution kit includes: · · · · A sealed envelope containing installation CD with software files for the product This user guide Key diskette or key file on the installation CD License agreement Before you unseal the CD envelope, be sure to review the license agreement thoroughly. 1.3.2. License Agreement The License Agreement (LA) is a legal agreement between you (either an individual or ...