KAPERSKY ANTI-VIRUS 5.6 - FOR MICROSOFT ISA SERVER 2004-2006 STANDARD EDITION, Administrator'S Manual

Page 1: ...KASPERSKY LAB Kaspersky Anti Virus 5 6 for Microsoft ISAServer 2004 2006 Standard Edition ADMINISTRATOR S GUIDE...

Page 2: ...K AS P ERS KY ANTI VI RUS 5 6 F O R M I CRO S O F T I S A S ERVE R 2 0 0 4 2 0 0 6 S TA NDAR D EDI TI O N Administrator s Guide Kaspersky Lab http www kaspersky com Revision date December 2008...

Page 3: ...20 4 1 Default scan settings 20 4 2 Managing scans 22 4 2 1 Configuring general settings of anti virus scans 24 4 2 2 Managing client groups 34 4 2 3 Specifying policies for anti virus scanning 38 4 3...

Page 4: ...2004 2006 Standard Edition 4 8 1 Installing a new license key 57 4 8 2 Renewing your license 59 4 8 3 Removing a license key 60 CHAPTER 5 FREQUENTLY ASKED QUESTIONS 61 APPENDIX A GLOSSARY 65 APPENDIX...

Page 5: ...filters are integrated into Microsoft ISA Server as plug ins and the anti virus kernel is installed into the system as a service The anti virus protection settings are managed through a special interf...

Page 6: ...y Anti Virus supports the following data transfer protocols HTTP 1 0 and 1 1 RFC 2616 FTP RFC 775 959 2389 Extensions to FTP FTP over HTTP Note Kaspersky Anti Virus does not protect data transferred o...

Page 7: ...ct the E store link The retail box includes a sealed envelope with an installation CD containing files for the software product administrator s guide a license key written on the floppy disk license a...

Page 8: ...them to use Kaspersky Anti Virus more efficiently After purchasing a subscription you become a registered user and during the period of your subscription you will be provided with the following servi...

Page 9: ...e computer that runs the Kas persky Anti Virus for ISA Server administration console must only have the ISA Server administration tools installed Note You can install separate components of Kaspersky...

Page 10: ...Typical deployment scenarios 10 Figure 1 Processing of data streams by Kaspersky Anti Virus for Microsoft ISA Server...

Page 11: ...tivated Data stream filters are controlled from the standard console tree of ISA Server Management To configure FTP Access Filter In the console tree of the ISA Management main window select the Micro...

Page 12: ...rus for Microsoft ISA Server Remote Management Warning For Microsoft ISA Server 2004 Standard Edition the rule s name will only be dis played in English By default this rule is inactive after installa...

Page 13: ...t variable 3 2 1 First installation Step 1 Welcome and License Agreement dialog boxes The Kaspersky Anti Virus setup wizard starts with the Welcome and License Agreement dialog boxes The License Agree...

Page 14: ...er and ISA Server administration tools are installed on this computer Figure 2 Setup Type Step 3 Selecting the application components to be installed In this stage you select the Kaspersky Anti Virus...

Page 15: ...for temporarily storing data co pied from the Internet before anti virus scanning see section 1 1 on page 6 Number of queued objects Folder for storing the anti virus database that is used to detect a...

Page 16: ...nding buttons or enter data into the corresponding fields Figure 4 Default settings for the application Immediately after this stage is completed the program will start copying files to your computer...

Page 17: ...en success fully installed Figure 5 Complete the setup You can also run a wizard for automatic installation of application license keys by selecting the corresponding box see Figure 5 If this check bo...

Page 18: ...not scan traffic and the anti virus database will not be updated 3 2 2 Reinstalling Kaspersky Anti Virus for ISA Server must be reinstalled if the first installation of the application was incorrect...

Page 19: ...dard Edition to 2006 Standard Edition Kaspersky Anti Virus stops its work This behaviour follows from the fact that the procedure updating an ISA server does not preserve the registration of third par...

Page 20: ...ISA server policy Allows Kaspersky An ti Virus for Microsoft ISA Server Remote Management from specified computers using MMC Access using these protocols can be enabled by adding a remote computer to...

Page 21: ...tle head body h1 Kaspersky Anti Virus for Microsoft ISA Server h1 p The requested URL URL is infected with VIRUSNAME virus p body html The FTP tab see section 4 2 1 3 on page 33 for more detail contai...

Page 22: ...i Virus for ISA Server bases Folder for scan queue Program Files Kaspersky Lab Kaspersky Anti Virus for ISA Server TaskQueue Folder for temporary files Program Files Kaspersky Lab Kaspersky Anti Virus...

Page 23: ...for the server on which Kaspersky Anti Virus is installed see section 4 2 1 on page 24 Set up new rules for anti virus protection that differ from the default rules The new rules are added by creating...

Page 24: ...the Kaspersky Anti Virus main window Figure 7 select Edit Kas persky Anti Virus settings to open the Properties of Kaspersky An ti Virus for Microsoft ISA Server dialog box 4 2 1 1 General settings Th...

Page 25: ...Using Kaspersky Anti Virus 25 Figure 9 The General tab The Anti Virus tab see Figure 10 displays general settings of Kaspersky Anti Virus...

Page 26: ...e tab you can see the following scan settings Fig 10 If you want to enable extracting and scanning of archives check the Scan archives box Note If the extracting archives control is disabled the archi...

Page 27: ...to scan compressed executable files check the Scan com pressed executable files box Note As for archives if this option is disabled executable files will be scanned as un compressed The program will d...

Page 28: ...use the standard anti virus database The extended and redundant databases are used to provide the high est level protection for data The use of these databases increases the load on your server resou...

Page 29: ...File Servers In this case the correct operation of Kaspersky Anti Virus for Microsoft ISA Server requires that the folders for the scan queue and temporary files be excluded from scans by these additi...

Page 30: ...large objects The following types of objects can be classified as HTTP traffic fast ob jects Text files of size less than 2 MB Graphic files of size less than 2 MB Other objects excluding executable...

Page 31: ...it messages sent to the clients In the upper three fields specify the settings for HTTP scanning Select the Cure HTTP traffic check box if you want Kaspersky Anti Virus to cure an infected file upon i...

Page 32: ...second request for this file the file will be scanned only if the time span between the first and the second requests is more than 100 seconds If the time span between requests is less than 100 secon...

Page 33: ...editing the current settings you can return to default settings by clicking the Set default values button 4 2 1 3 Settings for FTP scanning On the FTP tab Fig 13 you can modify settings for scanning...

Page 34: ...ne or several groups The same policy can be applied to different groups Note During installation the application automatically creates the default user and default user group because at least one user...

Page 35: ...ress can be computers with pre set network services and static IP addresses for example mail servers For network clients that do not have static IP addresses you can create one client and specify the...

Page 36: ...w 5 If you select New you will see the Client Properties dialog box In this dialog box fill in the Client name field and select one of the following options One IP address to add a client with a stati...

Page 37: ...groups of Kaspersky Anti Virus clients Fig 14 and click Edit group properties This will open the Group properties dialog box On the General tab of this di alog box Fig 17 change the name and descripti...

Page 38: ...ch group of clients The anti virus policies define additional settings of filtering incoming traffic for different groups of clients thus increasing the speed of anti virus scanning Note During instal...

Page 39: ...e new policy 4 In the Add Trusted Servers to a Policy dialog box Fig 22 click Add to specify trusted servers The incoming traffic from these servers will be excluded from anti virus scanning In the Tr...

Page 40: ...40 Kaspersky Anti Virus 5 6 for Microsoft ISA Server 2004 2006 Standard Edition Figure 20 Creating a new policy Figure 21 Adding a group of clients...

Page 41: ...Using Kaspersky Anti Virus 41 Figure 22 Adding trusted servers Figure 23 Adding an object type...

Page 42: ...e new dialog box Fig 24 you can rename the policy and change its description On the Groups tab Fig 25 you can change the list of groups assigned to this policy add a new group to the list of groups or...

Page 43: ...traf fic from these servers is excluded from anti virus protection This list only con tains names of servers from which traffic cannot contain any malicious objects The larger the list of trusted ser...

Page 44: ...tton on the Servers tab see Figure 26 4 2 3 2 Creating a list of objects excluded from scans Reducing the types of object excluded from anti virus scans as well as the list of trusted servers in turn...

Page 45: ...Updating the anti virus database Updates to your anti virus database can be downloaded on demand or automati cally scheduled The updated anti virus database can be downloaded from the following sourc...

Page 46: ...persky Anti Virus for Microsoft ISA Server dialog box select the Updating tab 2 On the Updating tab select the Update from the Internet radio button 3 Click Settings for updating via the Internet to s...

Page 47: ...server and in the Proxy name and port fields enter the proxy name and port that differ from the lo cal proxy of the ISA server Figure 31 Configuring the database updating server 6 In the FTP settings...

Page 48: ...anti virus database according to the current settings Note You can update the anti virus database on demand regardless of whether sche duled updating of the anti virus database is enabled or disabled...

Page 49: ...tle Kaspersky Anti Virus for Microsoft ISA Serv er title head body h1 Kaspersky Anti Virus for Microsoft ISA Server h1 p Internal Scanner Error ERR_TEXT ERR p body html The following extensible variab...

Page 50: ...e 20 the Internet connection will be terminated and you will see a warning about downloading an object infected with the eicar virus 4 6 Application statistics and diagnostics You can view Kaspersky A...

Page 51: ...tion only on specified parameters of the application perfor mance Then select a necessary counter from the list and click Add Figure 32 Customizing statistics settings Warning The following settings...

Page 52: ...he computer where Kaspersky Anti Virus for Microsoft ISA Server is installed 4 To view statistics on a server with Kaspersky Anti Virus for Microsoft ISA Server from a remote computer the following se...

Page 53: ...i Virus allows you to monitor the application performance on each Microsoft ISA Server and record results in the following log files kavisaDATE log Kaspersky Anti Virus log that stores the customizabl...

Page 54: ...ed event logs is displayed in Univer sal Coordinated Time UTC format Figure 34 Diagnostics options for Kaspersky Anti Virus All critical events related to Kaspersky Anti Virus performance are also sav...

Page 55: ...irus There are some settings of Kaspersky Anti Virus that make work more comforta ble However they tend to increase the risk of penetration of harmful objects into a protected network too The settings...

Page 56: ...d on the Licensing tab of the Properties of Kas persky Anti Virus for Microsoft ISA Server dialog box Fig 36 A valid license key allows you to take advantage of all available features of Kas persky An...

Page 57: ...g will be disabled If you fail to find the license key in the distribution kit contact the distributor who sold you this copy of the product 4 8 1 Installing a new license key For normal operation of...

Page 58: ...license ex piry Note You can see the license expiry date on the General tab of the Kaspersky Anti Virus for Microsoft ISA Server main window You can also install a reserve key which will take effect...

Page 59: ...To renew your license you need to Contact the seller of your copy of the product and purchase a new Kas persky Anti Virus license key or Purchase a license key at Kaspersky Lab Write a letter of reque...

Page 60: ...a license key During installation of a new license key you can manually remove the expired key by clicking the corresponding button on the Licensing tab Fig 36 If you have installed two keys current...

Page 61: ...and file formats that require complicated analysis e g PDF from their databases In contrast Kaspersky Lab believes that the purpose of its anti virus applica tions is to establish real and complete a...

Page 62: ...from the network Why If this issue occurs verify that 1 Kaspersky Anti Virus uses a valid license key You can view the current application operation mode in the server proper ties dialog box on the Ge...

Page 63: ...e Currently it is updated every hour Updating of the Anti Virus application modules is an additional feature that allows both correction of discovered vulnerabilities and addition of new functions Que...

Page 64: ...ow the updating application to access the Internet kavisasrv exe process If the application is configured to retrieve updates from either a local or shared folder Figure 31 the following issues might...

Page 65: ...infection At Kaspersky Lab the database is updated immediately after new viruses appear Therefore system administrators must regularly update the anti virus database C Client is a user of a corporate...

Page 66: ...n against new types of attacks Resistance to future attacks is the basic policy implemented in all Kaspersky Lab s products At all times the company s products remain one step ahead of other vendors i...

Page 67: ...7 495 645 79 29 7 495 956 87 08 from 10 am until 7 pm http support kaspersky com helpdesk html Support for corporate users Contact information will be provided after you pur chase a corporate softwar...

Page 68: ...68 Kaspersky Anti Virus 5 6 for Microsoft ISA Server 2004 2006 Standard Edition WWW http www kaspersky com http www viruslist com...

Page 69: ...NTITY ARE CONSENTING TO BE BOUND BY THIS AGREEMENT IF YOU DO NOT AGREE TO ALL OF THE TERMS OF THIS AGREEMENT DO NOT BREAK THE CD s SLEEVE DOWNLOAD INSTALL OR USE THIS SOFTWARE IN ACCORDANCE WITH THE L...

Page 70: ...nly as many back up copies of the Soft ware as are necessary for its lawful use and solely for back up purposes pro vided that all such copies contain all of the Software s proprietary notices You sha...

Page 71: ...xplicitly confirmed in corresponding Statement has the right to gather information about potential threats and vulne rabilities from your computer The information thus gathered is used in a generic fo...

Page 72: ...base b Free software updates including version upgrades c Technical support via Internet and hot phone line provided by Vendor and or Reseller d Virus detection and disinfection updates in 24 hours pe...

Page 73: ...t a virus in a title not infected by that virus iv Your sole remedy and the entire liability of Kaspersky Lab for breach of the warranty at in paragraph i will be at Kaspersky Lab option to re pair re...

Page 74: ...ing losses or damage whether such losses or damage were foreseen foreseeable known or otherwise a Loss of revenue b Loss of actual or anticipated profits including for loss of profits on contracts c...

Page 75: ...andings undertakings and promises between you and Kaspersky Lab whether oral or in writing which have been given or may be implied from anything written or said in negotiations between us or our repre...