User manual KASPERSKY LAB KASPERSKY CORPORATE SUITE - ANTI-VIRUS SOLUTION

KASPERSKY LAB KasperskyTM Corporate Suite ANTI-VIRUS SOLUTION KASPERSKY CORPORATE SUITE Anti-Virus Solution KASPERSKY LAB LTD Visit our WEB site: http://www.kaspersky.com/ C ne t o t ns 1. KASPERSKYTM CORPORATE SUITE ................................................. 5 1.1. 1.2. 1.3. 2. 2.1. AND MAIN FUNCTION OF THE SOFTWARE PACKAGE ........................................ 5 MAIN FEATURES OF THE KASPERSKYTM CORPORATE SUITE PACKAGE ....... 6 COMPONENTS ....................................................................................... 8 PROTECTING WORKSTATIONS....................................................... 9 KASPERSKYTM ANTI-VIRUS FOR WORKSTATIONS RUNNING WINDOWS 95/98/ME WINDOWS 2000/NT/XP (WINTEL). MAIN FEATURES................................ 9 2.1.1. Real-time protection ................................................................ 9 2.1.2. Filtering viruses out of email .................................................. 9 2.1.3. Comprehensive control over e-mail messages .................. 10 2.1.4. Protecting against macro-viruses......................................... 10 2.1.5. Monitoring data-integrity....................................................... 10 2.1.6. Protecting data storage locations ........................................ 10 2.1.7. Intercepting script-viruses .................................................... 11 2.1.8. Centralized deployment and management......................... 11 2.1.9. Automated updating .............................................................. 11 2.1.10. Universal boot system ........................................................... 11 2.2. KASPERSKYTM ANTI-VIRUS FOR OS/2. MAIN FEATURES ..................... 12 2.2.1. Two-level anti-virus protection............................................. 12 2.2.2. Compliant with the most popular OS/2 versions ............... 12 2.2.3. User-friendly............................................................................ 12 PROTECTING FILE SERVERS.......................................................... 13 3.1. KASPERSKYTM ANTI-VIRUS FOR WINDOWS 2000/NT SERVER. MAIN FEATURES 13 3.1.1. Real-time protection .............................................................. 13 3.1.2. Centralized deployment and management......................... 13 3.1.3. Protecting data storage locations ........................................ 14 3.1.4. Quarantine of dangerous and suspicious objects.............. 14 3.1.5. Virus alerts broadcasting....................................................... 14 3.1.6. Automated updating .............................................................. 14 3. ii 3.2. KASPERSKYTM ANTI-VIRUS FOR NOVELL NETWARE. MAIN FEATURES ... 15 3.2.1. Full-scale anti-virus protection ............................................. 15 3.2.2. Integration into Novell Directory Service............................ 15 3.2.3. Centralized deployment and management......................... 15 3.2.4. Real-time configuration update............................................ 16 3.2.5. Quarantine of dangerous and suspicious objects.............. 16 3.2.6. Virus alerts broadcasting....................................................... 16 3.2.7. Automatic disconnection of infected workstations ............ 16 3.2.8. Adjusting of CPU utilization .................................................. 16 3.2.9. Automated retrieve of updates via the Internet................ 17 3.2.10. Multithreaded virus scanning................................................ 17 PROTECTING MAIL SYSTEMS........................................................ 18 KASPERSKYTM ANTI-VIRUS FOR MICROSOFT EXCHANGE SERVER. MAIN FEATURES 18 4.1.1. E-mail anti-virus security....................................................... 18 4.1.2. Protection of client workstations .......................................... 18 4.1.3. Comprehensive control over e-mail messages .................. 19 4. 4.1. Flexible configuration for personal and public e-mail accounts 19 4.1.5. Reliable quarantine of dangerous objects and alert broadcasting 19 4.1.6. Real-time configuration update............................................ 19 4.1.7. Centralized management ...................................................... 20 4.1.8. Support for an unlimited number of e-mail accounts ....... 20 4.1.9. User-friendly............................................................................ 20 4.2. KASPERSKYTM ANTI-VIRUS FOR LOTUS NOTES/DOMINO. MAIN FEATURES20 4.2.1. Constant protection of e-mail-traffic ................................... 20 4.2.2. Comprehensive control over e-mail messages .................. 21 4.2.3. Virus alerts broadcasting....................................................... 21 4.2.4. Real-time virus neutralization............................................... 21 4.2.5. User-friendly............................................................................ 21 4.2.6. Automated updating .............................................................. 21 5. PROTECTING LINUX/UNIX OPERATING SYSTEMS ............... 22 5.1. KASPERSKYTM ANTI-VIRUS FOR LINUX/UNIX OPERATING SYSTEMS. MAIN FEATURES ....................................................................................................... 22 4.1.4. 5.1.1. 5.1.2. Full-scale anti-virus protection ............................................. 22 Compliancy with the most popular Linux and UNIX versions 23 3 5.1.3. Unique combination of the most advanced anti-virus tools for Linux and UNIX ...................................................................................... 23 5.1.4. Centralized protection of your e-mail systems................... 24 5.1.5. Easy integration into third-party applications .................... 24 5.1.6. Automated retrieve of updates via the Internet................ 24 5.1.7. Interactive management system ......................................... 24 6. KASPERSKYTM CORPORATE SUITE: PROTECTING WEB SERVERS 25 6.1. KASPERSKYTM WEB INSPECTOR.......................................................... 25 6.1.1. Monitoring changes................................................................ 25 6.1.2. Improved file analysis............................................................ 26 6.1.3. Back up .................................................................................... 26 6.1.4. Recovery of original content................................................. 26 6.1.5. Real-time configuration update............................................ 26 6.1.6. Immediate broadcast of warnings ....................................... 26 6.1.7. User-friendly............................................................................ 27 PROTECTING DATA TRAFFIC PASSING THROUGH FIREWALLS 28 7.1. KASPERSKYTM ANTI-VIRUS FOR FIREWALL........................................... 28 7.1.1. Anti-virus solution for the Internet ...................................... 28 7.1.2. Compliancy with all the most popular firewalls ................. 29 7.1.3. Advanced anti-virus technology ........................................... 29 7.1.4. Transparency of data traffic ................................................. 29 7.1.5. Reliable quarantine of dangerous objects and alert broadcasting 29 7.1.6. Centralized management ...................................................... 30 7.1.7. User-friendly............................................................................ 30 MANAGEMENT OF ANTI-VIRUS PROTECTION......................... 31 8.1. KASPERSKYTM ADMINISTRATION KIT ................................................... 31 8.1.1. Remote management of the anti-virus tools...................... 31 8.1.2. Alerts broadcasting ................................................................ 32 8.1.3. Cumulative reporting ............................................................. 33 8.1.4. Isolating infected and suspicious objects ........................... 33 7. 8. APPENDIX. KASPERSKY LAB LTD. ...................................................... 34 4 1 1. KasperskyTM Corporate Suite 1.1. Main function of the software package Chapter KasperskyTM Corporate Suite is developed to provide the full-scale dataprotection for corporate networks. Main advantage of this package is that it allows you to develop platform-independent and centrally-managed information security structure successfully protecting corporate networks of any size and complexity (with possible application to the remote sub-networks located overseas) against malicious code and hacker attacks. Anti-virus software products in KasperskyTM Corporate Suite provide the reliable control over all virus propagation sources in your system: they are used on workstations (DOS, Windows 95/98/ME, Windows 2000/NT/XP Workstation, OS/2, Linux), file servers (Windows 2000/NT Server, Linux, Novell NetWare, FreeBSD, OpenBSD, BSDi, Solaris) e-mail gateways (MS Exchange Server, Lotus Notes, Sendmail, Qmail, Postfix), CVP compatible firewalls (Check Point FireWall-1) and Web servers. Powerful and easy-to-use network management tools allow for centralized deployment and administration of the data-protection system on your computers and corporate networks. At Kaspersky Lab, we strive for full and complete customer satisfaction. KasperskyTM Corporate Suite allows you to create a dependable defense that is fully appropriate and compatible for your network configurations. 5 KASPERSKY CORPORATE SUITE 1.2. Main features of the KasperskyTM Corporate Suite package 1. Reliable protection When developing a modern enterprise-wide data-security solution the main task is to implement a system with all its components operating trouble-free and in full co-operation. The time-tested reliable and effective KasperskyTM Corporate Suite components successfully provide reliable anti-virus protection for hundreds of corporations around the world. The highest quality and effectiveness of Kaspersky Lab products is confirmed by numerous certificates received from the world's leading independent research centers and test labs that include: the certificate and the license from the State Technical Committee under the President of Russian Federation; the Checkmark certificate for three levels (Level 1, Level 2, and Trojan) from the West Coast Labs test center; the International Computer Security Association (ISCA) certificate; and the Microsoft Certificate for compatibility with the Windows operating system. 2. Supporting various platforms The infrastructure of a modern enterprise is a complex multi-component computing environment that consists of various operating systems and applications operating simultaneously. Regarding this KasperskyTM Corporate Suite was provided with multi-platform components protecting workstations, file servers, e-mail gateways, firewalls, and Web servers, and supports all the commonly used operating systems. 3. Easy-to-integrate Kaspersky Lab strives to completely satisfy demands and to pay attention even to the most insignificant requests of its clients. KasperskyTM Corporate Suite is developed to operate especially within corporation networks of any size and complexity. Due to application of the most up-to-date development methods the software product can be seamlessly integrated into the existing computing environment and customized to perform specific business tasks. As a result, you receive a complete information security solution that meets your system requirements and specific tasks of your business. 4. Comprehensive protection of a corporate network Corporate network protection is successful only when it covers all nodes, datatransmission channels and storage locations. KasperskyTM Corporate Suite provides comprehensive protection of a corporate network by effectively pro6 KASPERSKY CORPORATE SUITE tecting workstations, file and mail servers, Web servers, and controlling data traffic passing via e-mail gateways and firewalls. KasperskyTM Corporate Suite is powered by a unique management tool for advanced administration of the anti-virus system. KasperskyTM Administration Kit allows for a centralized product deployment and management across the corporate network. 5. State-of-the-art set of anti-virus tools KasperskyTM Corporate Suite includes all the advanced tools for fighting against viruses: an anti-virus scanner that checks data storage locations ondemand; an anti-virus monitor that performs real-time virus-check of all files being used; an integrity checker to monitor data integrity on your computers; a unique script-virus background interceptor; a behavior blocker that provides 100% protection against micro-viruses. The combined use of these tools excludes the possibility of virus penetration, making your computing safe and secure. Employment of the KasperskyTM Corporate Suite-integrated system of heuristic analysis allows you to prevent infection from even unknown viruses. 6. On-time detection of new viruses Kaspersky Lab provides auto-installable updates for its anti-virus products on the daily basis. The company anti-virus experts monitor the world virus situation twenty­four hours a day. In case a new virus appears, they immediately develop the appropriate cure module and immediately deliver it to customers. 7. Extended services KasperskyTM Corporate Suite users may be provided with extended services for the purpose of development of a customized comprehensive dataprotection system meeting all requirements of the corporate network. On your request Kaspersky Lab can contribute to inspection and analysis of your corporate network for the purpose of identification of the vulnerable points, to network testing and modification of the anti-virus software to meet the customer requirements, and to finishing of the customized anti-virus protection project. The company experts provide services for installation and setting of the software, and for training of the maintenance staff and users. Users of the Kaspersky Lab products are also provided with round-the-clock technical support by either phone or e-mail in Russian or English. 7 KASPERSKY CORPORATE SUITE 1.3. Components What components the KasperskyTM Corporate Suite package includes? KasperskyTM Corporate Suite includes the following components: · · Protection for workstations -- KasperskyTM Anti-Virus for Windows 95/98/Me, Windows 2000/NT/XP Workstation, OS/2 and Linux. Protection for file servers -- KasperskyTM Anti-Virus for Windows 2000/NT Server, Netware, UNIX (FreeBSD, OpenBSD, BSDi, Solaris) and Linux. Protection for mail systems -- KasperskyTM Anti-Virus for Microsoft Exchange, Lotus Notes, Sendmail, Postfix, Exim and Qmail. Protection for WEB servers -- KasperskyTM WEB Inspector. Protection of data passing through firewalls -- KasperskyTM Anti-Virus for Firewall. Protection for pocket computers ­ KasperskyTM Anti-Virus for Palm OS. Centralized deployment and management of the package components - KasperskyTM Administration Kit. · · · · · 8 2 2. Protecting Workstations 2.1.1. Real-time protection Chapter 2.1. KasperskyTM Anti-Virus for workstations running Windows 95/98/Me and Windows 2000/NT/XP (Wintel). Main features The background virus-interceptor - Monitor permanently resides in your Wintel workstation's memory, checking for viruses in files (including the archived) while they are started, created or copied, and also in the memory of started programs. The program comprehensively controls all the file operations preventing virus attacks. 2.1.2. Filtering viruses out of email KasperskyTM Anti-Virus for Wintel workstations automatically and in real time checks for viruses in all incoming and outgoing messages. Since the program supports all the major e-mail database formats (MS Outlook, MS Outlook Ex9 KASPERSKY CORPORATE SUITE press, MS Exchange, Eudora, MS Mail, Pegasus Mail, Netscape Mail, JSMail, MIME, The BAT), it reliably protects against viruses in mail message storage locations. The built-in Mail Checker efficiently deletes viruses from e-mail messages, and completely recovers the original contents. 2.1.3. Comprehensive control over e-mail messages KasperskyTM Anti-Virus for Wintel workstations automatically checks for viruses in all elements of incoming and outgoing messages: the message body, embedded OLE objects, attached files (including archived or compressed files) and other messages of any nesting level. 2.1.4. Protecting against macro-viruses KasperskyTM Anti-Virus for Wintel contains special modules controlling macroinstructions that are executed. The unique macro control technology using the concept of behavior blocker allows the program to prohibit macro-viruses from being executed. 2.1.5. Monitoring data-integrity Inspector, the KasperskyTM Anti-Virus for Wintel workstations built-in integrity checker traces all changes on the local computer in background: appearance of new, deletion and modification of existing files and more. The program implements the control by calculating mathematical values known as checksums or CRC values (for Cyclic Redundancy Code) for disk sectors and files, and subsequently checking these against the existing copy of appropriate file/sector. If a virus-incidental action (such as unauthorized changes in a file or the system registry) is detected, the module allows removal of the malicious code and recovery of the original disk contents. 2.1.6. Protecting data storage locations The anti-virus KasperskyTM AV Scanner allows for the comprehensive check of local and network drive contents on-demand. You may run your scanner 10 PROTECTING WORKSTATIONS manually or schedule its start using KasperskyTM AV Control Centre included in the package. 2.1.7. Intercepting script-viruses To protect the user from script-viruses the package uses the built-in Script Checker module that completely solves this problem by integrating itself as a filter in-between the script-virus and its handler. This enables you to check for viruses in any script before it is executed. 2.1.8. Centralized deployment and management KasperskyTM Anti-Virus for Wintel is completely integrated in the unique system of anti-virus protection management. Kaspersky Administration Kit enables you to centrally install and control KasperskyTM Anti-Virus for NT Server from any (including the remote) computer; to define a timetable and an order in which the modules must be started; to automatically retrieve and enable antivirus database updates via the Internet; to broadcast notifications on virus attacks; to review virus-check logs on workstations; and control access rights to change the program configuration. 2.1.9. Automated updating The KasperskyTM AV Updater module allows for automated updating of anti-virus databases containing virus and remedy definitions, and of the software package components. 2.1.10. Universal boot system The product contains the built-in Rescue Disk Set module ­ a boot system that allows you to restore your PC at work in case it has been completely disabled as the result of a virus attack. Rescue Disk Set creates a set of Linux-based bootable diskettes with pre-installed KasperskyTM Anti-Virus for Linux. This allows you to perform a "clean boot" and to restore infected hard disks with all 11 KASPERSKY CORPORATE SUITE the commonly used file systems at once: FAT (DOS), FAT32 (Windows 95/98), NTFS (Windows NT/2000), HPFS (OS/2), EXT (Linux). 2.2. KasperskyTM Anti-Virus for OS/2. Main features 2.2.1. Two-level anti-virus protection KasperskyTM Anti-Virus for OS/2 provides your computer with a two-level antivirus protection. The first level is an anti-virus scanner that may be started on demand or from a third-party scheduler. On the second level, viruses are neutralized with the world's first and only anti-virus monitor protecting all active processes in OS/2 from viruses in real-time. Combined use of these tools allows you full control over all virus propagation sources. The program successfully fights all types of malicious programs, including Internet-worms, Trojans, and computer viruses including viruses that were specially developed for OS/2. 2.2.2. Compliant with the most popular OS/2 versions KasperskyTM Anti-Virus for OS/2 may be used under the most popular versions of this operating system, including Warp, Merlin and Aurora. 2.2.3. User-friendly KasperskyTM Anti-Virus for OS/2 contains the simple and user-friendly Presentation Manager graphic interface. It utilizes the step-by-step method, offering a user recommendations for the next step. Main functions of the program can be activated by the touch of a single key. 12 3 3. Protecting File Servers 3.1. KasperskyTM Anti-Virus for Windows 2000/NT Server. Main features 3.1.1. Real-time protection Chapter KasperskyTM Anti-Virus for 2000/NT Server includes a background virus interceptor, KasperskyTM AV Monitor that permanently resides in the computer memory checking all used files (e.g. when these are opened or closed) in realtime. The module also allows checking-in the memory of running programs right after it is loaded, and also every time you update your anti-virus bases. If the infected memory of a program cannot be disinfected, this program is forced to abort the performance. 3.1.2. Centralized deployment and management The product is completely integrated in the unique system of anti-virus protection control that was originally developed in Kaspersky Lab. KasperskyTM AV Control Centre (client subsystem) and Network Control Centre (network sub13 KASPERSKY CORPORATE SUITE system) enable you to centrally install and control KasperskyTM Anti-Virus for NT Server from any (including the remote) computer; to define a timetable and an order in which the modules must be started; to automatically retrieve and enable anti-virus database updates via the Internet; to broadcast notifications on virus attacks and review virus-check logs. 3.1.3. Protecting data storage locations The anti-virus KasperskyTM AV Scanner allows for the comprehensive check of local and network drive contents on-demand or as scheduled. Combined use of KasperskyTM AV Scanner and KasperskyTM AV Monitor allows you full control over all virus propagation sources on your network. 3.1.4. Quarantine of dangerous and suspicious objects KasperskyTM Anti-Virus for 2000/NT Server has a special quarantine feature allowing to isolate infected and suspicious objects in a safe place and subsequently move the objects to a quarantine directory defined by a network administrator. 3.1.5. Virus alerts broadcasting If KasperskyTM Anti-Virus detects a virus trying to enter the server, it informs the system administrator and/or a group of users by sending a user-defined alert message to the pre-set addresses. 3.1.6. Automated updating The KasperskyTM AV Updater module allows for automated updating of anti-virus databases containing virus and remedy definitions, and of the software package components. 14 PROTECTING FILE SERVERS 3.2. KasperskyTM Anti-Virus for Novell NetWare. Main features KasperskyTM Anti-Virus for NetWare is a unique anti-virus solution with a network management system, which is completely integrated in the Novell Directory Service (NDS). The program is a loadable module (NLM) for file and application servers running Novell NetWare. It effectively controls all file operations on a server. If the program detects a virus attack, it is able to efficiently repel it and quickly recover the system. 3.2.1. Full-scale anti-virus protection KasperskyTM Anti-Virus for NetWare includes a full set of anti-virus tools: an anti-virus scanner that checks data storage locations and may be started on demand or by schedule; and an anti-virus monitor checking all used files (opened, copied, closed) in real-time. Combined use of these tools allows you to perform full control over all the virus propagation sources on your network. 3.2.2. Integration into Novell Directory Service Since all the main features of KasperskyTM Anti-Virus for NetWare are completely integrated in NDS, it enables a network administrator to efficiently manage the program directly from the administrator console (NWAdmin or ConsoleOne). 3.2.3. Centralized deployment and management The program may be installed on NetWare servers from any workstation running Microsoft Windows NT/2000 within the network. Due to deep integration into the NWAdmin network management systems a network administrator is able to remotely manage KasperskyTM Anti-Virus for NetWare: to schedule component starts, to change program settings, notification modes and the order of infected files processing, to plan downloading of the anti-virus database updates and etc. 15 KASPERSKY CORPORATE SUITE 3.2.4. Real-time configuration update To apply the changes you have made to the program settings, you do not need to restart the server. They will be activated right after you have confirmed them. 3.2.5. Quarantine of dangerous and suspicious objects KasperskyTM Anti-Virus for NetWare has a special quarantine feature allowing to isolate infected and suspicious objects in a safe place and subsequently move the objects to a quarantine directory defined by the system administrator. 3.2.6. Virus alerts broadcasting If KasperskyTM Anti-Virus detects a virus trying to enter the server, it informs the system administrator and/or a group of users by sending a user-defined alert message to the pre-set addresses. 3.2.7. Automatic disconnection of infected workstations If a certain workstation sends infected files to the server, KasperskyTM AntiVirus for NetWare may temporarily disable further access of this workstation to the server in order to prevent any further distribution of viruses on the network. 3.2.8. Adjusting of CPU utilization KasperskyTM Anti-Virus for NetWare provides a comprehensive set of settings allowing the network administrator to adjust the CPU resources dedicated to program use. 16 PROTECTING FILE SERVERS 3.2.9. Automated retrieve of updates via the Internet KasperskyTM Anti-Virus for NetWare supports the automatic downloading and hookup of anti-virus database updates via the Internet. The procedure may be performed on demand or scheduled by a network administrator. 3.2.10. Multithreaded virus scanning KasperskyTM Anti-Virus for NetWare now supports multithreaded virus scanning that allows for an unlimited amount of files being scanned simultaneously in real-time. This amount is limited only by the server's hardware configuration. The multithreaded virus scanning essentially increases the overall efficiency of the entire network by simultaneous processing of requests that arrived from many workstations at the same time. 17 4 4. Protecting Mail Systems 4.1.1. E-mail anti-virus security Chapter 4.1. KasperskyTM Anti-Virus for Microsoft Exchange Server. Main features KasperskyTM Anti-Virus for Exchange is a centralized anti-virus system for mail servers running Microsoft Exchange Server 5.x and 2000. The program provides centralized anti-virus filtering for the entire local and external e-mail traffic in real-time as well as on a user demand. KasperskyTM Anti-Virus for Exchange integrates itself into the mail server as a supplemental module and permanently checks for viruses in all e-mail messages in protected mailboxes and folders. 4.1.2. Protection of client workstations KasperskyTM Anti-Virus for Exchange prohibits infected e-mail from entering the Internet-connected workstations within your corporate network. You may 18 PROTECTING MAIL SYSTEMS set the program to delete, block or disinfect the infected messages. Furthermore, if a virus has infected one of your workstations, it is unable to distribute itself, since the program suppresses any attempts of the kind and informs the system administrator about this event. 4.1.3. Comprehensive control over e-mail messages KasperskyTM Anti-Virus for Exchange controls all elements of an e-mail message: the message body, embedded OLE objects, attached files (including archived and compressed files) and other messages of any nesting level. 4.1.4. Flexible configuration for personal and public email accounts KasperskyTM Anti-Virus for Exchange protects all types of mailboxes ­ personal and public. You may set specific preferences for each separate mailbox or folder. 4.1.5. Reliable quarantine of dangerous objects and alert broadcasting You can define your quarantine address where the program will transfer all infected and suspicious objects that have been detected in e-mail traffic. If KasperskyTM Anti-Virus detects a virus attempting to enter your network, it informs the system administrator(s) by sending a user-defined alert message to the pre-set address(es), reporting the details of the source and current location of the infected object. 4.1.6. Real-time configuration update To change the configuration (to update your anti-virus databases, to edit the list of protected mailboxes) you do not need to restart your KasperskyTM AntiVirus for Exchange. All changes will be activated right after the system administrator has confirmed them. 19