background image

 

Reference: Configuration options 

Avira Professional Security - User Manual (Status: 23 Sep. 2011) 

169 

Default text for deleted and moved emails 

The text in this box is inserted in the email as a message instead of the affected email. 
You can edit this message. A text may contain a maximum of 500 characters. 

You can use the following key combination for formatting: 

Ctrl + Enter

 = inserts a line break. 

Default 

The button inserts a pre-defined default text in the edit box. 

Default text for deleted and moved attachments 

The text in this box is inserted in the email as a message instead of the affected 
attachment. You can edit this message. A text may contain a maximum of 500 
characters. 

You can use the following key combination for formatting: 

Ctrl + Enter

 = inserts a line break. 

Default 

The button inserts a pre-defined default text in the edit box. 

Heuristic 

This configuration section contains the settings for the heuristic of the scan 
engine. (Options available in expert mode only.) 

Avira products contain very powerful heuristics that can proactively uncover unknown 
malware, i.e. before a special virus signature to combat the damaging element has been 
created and before a virus guard update has been sent. Virus detection involves an 
extensive analysis and investigation of the affected codes for functions typical of malware. 
If the code being scanned exhibits these characteristic features, it is reported as being 
suspicious. This does not necessarily mean that the code is in fact malware. False 
positives do sometimes occur. The decision on how to handle affected code is to be made 
by the user, e.g. based on his or her knowledge of whether the source of the code is 
trustworthy or not. 

Macrovirus heuristic 

Your Avira product contains a highly powerful macrovirus heuristic. If this option is 
enabled, all macros in the relevant document are deleted in the event of a repair, 
alternatively suspect documents are only reported, i.e. you receive an alert. This 
option is enabled as the default setting and is recommended. 

Advanced Heuristic Analysis and Detection (AHeAD)

 

Enable AHeAD 

Your Avira program contains a very powerful heuristic in the form of Avira AHeAD 
technology, which can also detect unknown (new) malware. If this option is enabled, 

Summary of Contents for PROFESSIONAL SECURITY

Page 1: ...Avira Professional Security User Manual...

Page 2: ...or registered trademarks of their respective owners Protected trademarks are not marked as such in this manual This does not mean however that they may be used freely Copyright information Code provi...

Page 3: ...om Installation 17 3 5 Configuration Wizard 19 3 6 Change installation 20 3 7 Installation modules 20 3 8 Uninstallation 22 3 9 Installation and uninstallation on the network 22 3 9 1 Command line par...

Page 4: ...React to detected viruses and malware 44 4 2 10 Handling quarantined files qua 49 4 2 11 Restore the files in quarantine 51 4 2 12 Move suspicious files to quarantine 53 4 2 13 Scan profile Amend or...

Page 5: ...n 83 11 1 2 Report 94 11 2 Realtime Protection 95 11 2 1 Scan 95 11 2 2 ProActiv 107 11 2 3 Report 110 11 3 Variables Realtime Protection and System Scanner exceptions 111 11 4 Update 112 11 4 1 Produ...

Page 6: ...155 11 7 1 Scan 155 11 7 2 Report 164 11 8 Mail Protection 165 11 8 1 Scan 165 11 8 2 General 170 11 8 3 Report 172 11 9 General 173 11 9 1 Threat categories 173 11 9 2 Password 174 11 9 3 Security 1...

Page 7: ...ts you access information on other Avira desktop programs download the latest Avira desktop programs download the latest product manuals in PDF format download free support and repair tools access our...

Page 8: ...ant information or a tip which makes your Avira product easier to use The following emphases are used Emphasis Explanation Italics File name or path data Displayed software interface elements e g wind...

Page 9: ...Make regular copies Backups of your data for security purposes Note A program can only provide reliable and effective protection from viruses malware unwanted programs and other dangers if it is up to...

Page 10: ...ncremental VDF updates via a web server on the Internet or an intranet User friendly licensing in License Manager Integrated Scheduler for planning one off or recurring jobs such as updates or scans E...

Page 11: ...ains exact details of which programs are licensed to you and for what period of time A digital license code can therefore also contain the license for more than one product If you purchased your Avira...

Page 12: ...or in the activation email with a double click and following the relevant instructions on the screen Note The Avira Professional Security License Manager automatically copies the corresponding licens...

Page 13: ...stallation on the network 3 1 1 Installation types During installation you can select a setup type in the installation wizard Express Standard components will be installed The program files are instal...

Page 14: ...search for possible incompatible software on your computer If potentially incompatible software is detected Avira generates a list of these programs It is recommended to remove these software programs...

Page 15: ...our computer system if you want to activate your Avira product Note Internet based installation For the Internet based installation of the program an installation program is provided that loads the cu...

Page 16: ...stom installation You may participate in the Avira ProActiv Community Configuration Realtime Scanner ProActiv Confirm that you accept the End User License Agreement For reading the detailed text of th...

Page 17: ...the preset options in order to maximize the security of your system If appropriate perform a complete system scan afterwards 3 4 Custom Installation Installing your Avira product Start the installatio...

Page 18: ...rs You have the option of confirming participation in the Avira ProActiv Community If this option is enabled Avira ProActiv sends data on suspicious programs detected by the ProActiv component to the...

Page 19: ...installation by clicking Next If you have selected the Avira FireWall installation module the Default rules for accessing the network and using network resources dialog box appears You can define whet...

Page 20: ...erforms a short system scan If after the scan you are asked to restart your computer click Yes to ensure that your system is fully protected After a successful installation we recommend that you check...

Page 21: ...iguration the program processes the affected emails automatically or asks the user for a certain action Avira Web Protection When surfing the Internet you are using your web browser to request data fr...

Page 22: ...here appropriate a dialog box appears recommending that your computer be restarted Click Yes to confirm The Avira product is now uninstalled and all directories files and registry entries for the prog...

Page 23: ...llation and uninstallation of Avira products on the network The Avira Management Console enables the remote installation and maintenance of Avira products on the network For further information please...

Page 24: ...ation starts automatically Note The setup program for the uninstallation should be started on the PC on which the Avira product is to be uninstalled do not start the setup program from a network drive...

Page 25: ...be placed in double quotes Example InstallPath PROGRAMFILES Avira AntiVir Server DestinationPath Destination path in which the program is installed It has to be included to the script Please note that...

Page 26: ...arts the computer after installation This entry has a higher priority than ShowRestartMessage 1 Restart computer 0 Do not restart computer Example RestartWindows 1 ShowRestartMessage Displays informat...

Page 27: ...tection 1 Install Avira Web Protection 0 Do not install Avira Web Protection Example WebGuard 1 RootKit Installs the Avira Rootkits Protection module Without Avira Rootkits Protection the System Scann...

Page 28: ...1 User interface and operation You operate your Avira product via three program interface elements Control Center monitoring and controlling the Avira product Configuration Configuring the Avira prod...

Page 29: ...ponents and are arranged in the navigation bar according to activity Example Activity Local Protection Section Realtime Protection Status This window shows the section selected in the navigation area...

Page 30: ...l window Highlight the data or object you wish to edit To highlight multiple elements elements in columns hold down the control key or the shift key while selecting the elements Click the appropriate...

Page 31: ...enables you to configure the basic settings for the Avira FireWall In addition the current data transfer rate and all active applications using a network connection are displayed Management In Manage...

Page 32: ...he left hand navigation bar 4 1 6 Accessing the Configuration You have several options for accessing the configuration via the Windows control panel via the Windows Security Center from Windows XP Ser...

Page 33: ...you can also use the following key combinations Alt underlined letter in the option name or button description Note All configuration sections are only displayed in expert mode Activate expert mode to...

Page 34: ...d If no switching rules have been defined you can switch to a configuration manually in the context menu of the tray icon You can add rename delete copy or restore configurations and define rules for...

Page 35: ...ws host file stop Windows FireWall notifications Popup settings alerts for network access by applications General Configuration of email using SMTP Extended risk categories for on demand and on access...

Page 36: ...les the FireWall Block all traffic Enabled Blocks all data transfers except transfers to the host computer system Local Host IP 127 0 0 1 Enable game mode Enables or disables the mode Enabled When act...

Page 37: ...lled your Avira product Double click the license file in File Manager or in the activation email and follow the on screen instructions when License Manager opens OR In your Avira product s Control Cen...

Page 38: ...Repeat job if time has expired Past jobs are performed that could not be performed at the required time for example because the computer was switched off Start job while connecting to the Internet co...

Page 39: ...roduct updates automatically in the configuration under PC protection Update Product update To start an update of your Avira product manually With the right hand mouse button click the Avira tray icon...

Page 40: ...Windows XP and 2000 This icon starts the scan via a scan profile In Windows Vista In Microsoft Windows Vista the Control Center only has limited rights at the moment e g for access to directories and...

Page 41: ...ory including sub directories black check mark Sub directories of one directory only grey check mark sub directories have black check marks No directory no check mark If you want to create a new scan...

Page 42: ...files with Avira in the context menu The Luke Filewalker window appears and a system scan is started When the scan is completed the results are displayed 4 2 7 Automatically scan for viruses and malw...

Page 43: ...ction of the display mode appears Select the display mode of the job window Invisible No job window Minimized progress bar only Maximized Entire job window Select the Shut down computer if job is done...

Page 44: ...cts to a detected virus or unwanted program in the Configuration under the section Action on detection No configurable action options are available for the ProActiv component of the Realtime Protectio...

Page 45: ...interactive action mode if a virus or unwanted program is detected a dialog box appears in which you can select what to do with the infected object This option is enabled as the default setting Automa...

Page 46: ...tten Ignore No further action is taken The infected file remains active on your computer Overwrite and delete The file is overwritten with a default template and then deleted It cannot be restored War...

Page 47: ...ion is blocked i e the application is terminated The actions of the application continue to be monitored by the ProActiv component Always block this program The application is blocked i e the applicat...

Page 48: ...nd The email together with all attachments is copied to Quarantine and is not sent The email remains in the outbox of your email client You receive an error message in your email program All other ema...

Page 49: ...xceptional cases Note We recommend that you move any suspicious file that cannot be repaired to quarantine Note You can also send files reported by the heuristic to us for analysis For example you can...

Page 50: ...s with a form for inputting your contact data Enter all the required data Select a type Suspicious file or Suspicion of false positive Select a response format HTML Text HTML Text Click OK The file is...

Page 51: ...rantined object to a text file Highlight the quarantined object and click on The text file quarantaene Notepad opens containing the data from the selected quarantined object Save the text file You can...

Page 52: ...n Quarantine section Note Emails and email attachments can only be restored using the option if the file extension is eml To restore a file to its original location Highlight the file and click the ic...

Page 53: ...types from the scan in a scan profile only possible for manual selection and customized scan profiles In the Control Center go to the PC protection System Scanner section With the right hand mouse bu...

Page 54: ...icon The desktop shortcut is created 4 2 15 Filter events Events that have been generated by program components of your Avira product are displayed in the Control Center under Administration Events an...

Page 55: ...scan Click the icon to exclude the email from the Mail Protection scan The selected email address will no longer be scanned for viruses and unwanted programs The email sender address is included in th...

Page 56: ...nd port scan are prevented User User defined rules If this security level is selected the program automatically recognizes that the adapter rules have been modified Note The default security level set...

Page 57: ...contains This procedure is recommended if you wish to scan individual files and directories that you have saved for example on your desktop System scan via profiles This procedure is recommended if y...

Page 58: ...on file and scan engine are up to date and if necessary implements an update Depending on the settings in the configuration the Updater also carries out a product update or informs you of the product...

Page 59: ...g download server on an intranet you need a server that is compatible with the update structure of your Avira product Note You can use Avira Update Manager file server or web server in Windows as a we...

Page 60: ...se whether the network activity of the application is allowed or denied If the Save Action for this application option is enabled the action is created as an application rule and is saved in the confi...

Page 61: ...tion immediately after activation AviraMail Protection does not work There is no network connection available in a virtual machine e g VMWare Virtual PC if Avira FireWall is installed on the host mach...

Page 62: ...rt the Avira product and the Configuration expert mode Select System Scanner Scan Files All files and confirm the window with OK Start a scan of all local drives Start the computer in Normal Mode Carr...

Page 63: ...ra Mail Protection Avira Mail Protection does not work Please check correct functioning of Avira Realtime Protection with the aid of the following checklists if problems occur with Avira Mail Protecti...

Page 64: ...computer on which a virtual machine for example VMWare virtual PC etc is also running the Avira FireWall will block all network connections for the virtual machine when the security level of the Avir...

Page 65: ...on has been blocked by Mail Protection Reason Transport Layer Security TLS encryption protocol for data transfers on the Internet is not supported by Mail Protection at this time The following options...

Page 66: ...vigation in the Control Center Go to next section Ctrl Shift Tab Ctrl Page up Navigation in the Control Center Go to previous section Navigation in the configuration sections First use the mouse to se...

Page 67: ...Tab Go to next section in the navigation window Ctrl Shift Tab Go to previous section in the navigation window Page up Change to the subject which is displayed above in the contents in the index or in...

Page 68: ...section Shortcut Description F2 Rename selected profile F3 Start scan with the selected profile F4 Create desktop link for the selected profile Ins Create new profile Del Delete selected profile FireW...

Page 69: ...store object to Return Properties Ins Add file Del Delete object Scheduler section Shortcut Description F2 Edit job Return Properties Ins Insert new job Del Delete job Reports section Shortcut Descrip...

Page 70: ...m is detected with one of these important points e g an outdated anti virus program the Security Center issues an alert and gives recommendations on how to protect your computer better 8 3 2 The Windo...

Page 71: ...y unauthorized users from gaining access to it through a network or the Internet Virus protection software Protection against malicious software You may receive the following information from the Wind...

Page 72: ...product has already been installed you will receive the following message Note In order for the Windows Security Center to recognize your Avira product as up to date an update must be performed after...

Page 73: ...that you want to monitor your anti virus software yourself Note This function is not supported by Windows Vista Note The Windows Security Center is supported by your Avira product You can enable this...

Page 74: ...es Adware Spyware If the option Adware Spyware is enabled with a check mark in the configuration under Threat categories you receive a corresponding alert if your Avira product detects adware or spywa...

Page 75: ...ted user will probably not notice until his next phone bill that an unwanted 0190 0900 dialer program on his computer has dialed a premium rate number with every connection resulting in dramatically i...

Page 76: ...e considering ways of banning computer games from workplace computers Your Avira product recognizes computer games If the Games option is enabled with a check mark in the configuration under Threat ca...

Page 77: ...receive a corresponding alert if your Avira product detects such software Unusual Runtime Packers Files that have been compressed with an unusual runtime packer and that can therefore be classified as...

Page 78: ...of service on a computer system One form of exploitation for example is an attack from the Internet with the help of manipulated data packages Programs can be infiltrated in order to obtain higher acc...

Page 79: ...manipulation of the host file a specific manipulation of a system is carried out with the aid of a Trojan or virus The result is that the system can now only access fake websites even if the correct...

Page 80: ...to infiltrate any kind of damaging programs on systems with restrictive security measures Spyware Spyware are so called spy programs that intercept or take partial control of a computer s operation wi...

Page 81: ...ble assistance in answering your questions or solving a technical problem All necessary information on our comprehensive support service can be obtained from our website http www avira com professiona...

Page 82: ...com sample upload 10 4 Reporting false positives If you believe that your Avira product is reporting a detection in a file that is most likely clean send the relevant file packed WinZIP PKZip Arj etc...

Page 83: ...ory all or selected files in the directory Files The System Scanner can use a filter to scan only those files with a certain extension type All files If this option is enabled all files are scanned fo...

Page 84: ...eleted Note Please note that the default list may vary from version to version Additional settings Scan boot sectors of selected drives If this option is enabled the System Scanner scans the boot sect...

Page 85: ...tandard level Note This option is only available on multi processor systems If your Avira program is managed with AMC the option is always displayed and can be enabled If the managed system does not h...

Page 86: ...tion is enabled as the default setting Scanner priority With the on demand scan the System Scanner distinguishes between priority levels This is only effective if several processes are running simulta...

Page 87: ...Permitted actions In this box actions can be specified which can be selected in individual or expert notification mode in case of a virus detection You must activate the corresponding options for thi...

Page 88: ...in case of a virus detection appears The System Scanner reacts according to the settings you predefine in this section as primary and secondary action Copy file to quarantine before action If this op...

Page 89: ...ssary sent to the Avira Malware Research Center Delete If this option is enabled the file is deleted This process is much faster than overwrite and delete Ignore If this option is enabled access to th...

Page 90: ...tored Note If you have selected Delete or Overwrite and delete as the primary or secondary action you should note the following In the case of heuristic hits the affected files are not deleted but are...

Page 91: ...xpert mode only Scan archives If this option is enabled the selected archives in the archive list are scanned This option is enabled as the default setting All archive types If this option is enabled...

Page 92: ...an For this you must select the relevant entries Exceptions File objects to be omitted for the System Scanner Options available in expert mode only The list in this window contains files and paths tha...

Page 93: ...rom the scan which does not apply to files in sub directories on the corresponding partition Example File object to be skipped D D file txt will be excluded from the scan of the System Scanner D folde...

Page 94: ...malware If this option is enabled you can define how aggressive this heuristic should be This option is enabled as the default setting Low detection level If this option is enabled slightly less unkno...

Page 95: ...s well as alerts and tips are included in the report file Note If you have to send us a report file at any time for troubleshooting please create this report file in this mode 11 2 Realtime Protection...

Page 96: ...are scanned All file types that may contain viruses and unwanted programs are preset The list can be edited manually via the File extensions button This option is enabled as the default setting and i...

Page 97: ...this option is disabled the network drives are not monitored They are no longer protected against viruses or unwanted programs Note When files are executed on network drives they are scanned by the Re...

Page 98: ...located in the main archive are scanned Max number of files When scanning archives you can restrict the scan to a maximum number of files in the archive The default value for the maximum number of fi...

Page 99: ...ites the file with a default pattern before deleting it It cannot be restored Warning If Realtime Protection is set to Scan when writing the affected file is not written Default This button allows you...

Page 100: ...air If this option is enabled the Realtime Protection repairs affected files automatically If the Realtime Protection cannot repair an affected file it carries out the action selected under Secondary...

Page 101: ...on Secondary action can only be selected if the Repair option was selected under Primary action With this option it can now be decided what is to be done with the affected file if it cannot be repaire...

Page 102: ...de only Exceptions With these options you can configure exception objects for the Realtime Protection on access scan The relevant objects are then not included in the on access scan The Realtime Prote...

Page 103: ...Protection without full path details For example application exe This however only applies to processes where the executable files are located on hard disk drives Full path details are required for p...

Page 104: ...Directory log Directory names must end with a backslash otherwise a file name is assumed If a directory is excluded all its sub directories are automatically also excluded For each drive you can spec...

Page 105: ...s are NOT excluded by the Realtime Protection scan Locate the relevant UNC path in the Realtime Protection report file Computer name Enable OR IP address Enable You can locate the path Realtime Protec...

Page 106: ...ia a connection 1 0 0 0 Shared1 This is generally a connected network drive which accesses another computer with a shared folder via the IP address 1 0 0 0 and the shared name Shared1 Heuristic This c...

Page 107: ...nd unknown threats for which there are not yet any virus definitions or heuristics available ProActiv technology is integrated into the Realtime Protection component and observes and analyzes the prog...

Page 108: ...With this link you can access an Internet page where you can obtain detailed information on the advanced online scan All data transmitted during an advanced online scan is included on the Internet pag...

Page 109: ...me Protection notification Applications to be skipped Application The list contains applications excluded from monitoring by the ProActiv component In the default installation settings the list contai...

Page 110: ...environment variable The button opens a window in which you can select the application to be excluded Add With the Add button you can transfer the application specified in the input box to the list of...

Page 111: ...e log file exceeds the indicated size by more than 50 kilobytes then old entries are deleted until the indicated size minus 50 kilobytes is reached Back up report file before shortening If this option...

Page 112: ...C Windows INSTALLDIR C Program Files Avira Antivir Desktop C Program Files Avira Antivir Desktop C Program Files x86 Avira Antivir Desktop AVAPPDATA C Documents and Settings All Users Avira AntiVir De...

Page 113: ...obs are performed that could not be performed at the time specified for example because the computer was switched off Option available in expert mode only Download via web server The update is perform...

Page 114: ...immediately after the download of the update file This has the advantage that the restart is not performed while users are working at their computers Updates to the virus definition file and scan engi...

Page 115: ...protection Update Product update Download and install product updates automatically The update and the restart are performed while users are working on their computers If you have enabled this option...

Page 116: ...t the Avira product is up to date on all workstations Note The Configuration heading is only enabled if under Configuration General Product update the via File Server Shared folders option has been se...

Page 117: ...in Windows for example User Enter the user name of the selected account Password Enter the password for this account For security reasons the actual characters you type in this space are replaced by a...

Page 118: ...your own web servers on the company intranet If a number of web servers are specified separate each one by a comma Default The button restores the predefined addresses Proxy settings Proxy server Do...

Page 119: ...Online protection Configuration is responsible for configuration of the Avira FireWall 11 5 1 Adapter rules In the Avira FireWall an adapter represents a software simulated hardware device e g minipo...

Page 120: ...as it responds to every packet Predefined rules for the ICMP protocol Setting Rules Low Incoming blocked types no type Outgoing blocked types no type Assume flooding if delay between packets is less...

Page 121: ...often followed by more dangerous attack types Predefined rules for the TCP Port Scan Setting Rules Low Assume a TCP Port Scan if 50 or more ports were scanned in 5 000 milliseconds When detected log a...

Page 122: ...were scanned in 5 000 milliseconds When detected log attacker s IP and don t add rule to block the attack Medium Assume a UDP Port Scan if 50 or more ports were scanned in 5 000 milliseconds When dete...

Page 123: ...ules are defined to control incoming data traffic by the Avira FireWall Warning When a packet is filtered the corresponding rules are applied successively therefore the rule order is very important Ch...

Page 124: ...ty at offset 0 TCP healthy traffic Monitor Allow TCP packets from address 0 0 0 0 with mask 0 0 0 0 if local port is in 0 65535 and remote port is in 0 65535 Apply for connection initiation and existi...

Page 125: ...ou have the choice to apply the rule for connection initiation and existing connection packets or only for packets of existing connections or for all packets Event database By clicking on the link wit...

Page 126: ...for all streams Don t log when packet matches rule Advanced Select packets that have following bytes empty with mask empty at offset 0 High Monitor established UDP traffic Allow UDP packets from addr...

Page 127: ...treams Event database By clicking on the link with the mouse you can choose between Log and Don t log to the event database if the packet complies with the rule Advanced The advanced feature enables c...

Page 128: ...ox opens in which you can enter the required IPv4 address IP mask By clicking on this link with the mouse a dialog box opens in which you can enter the required IPv4 mask Event database By clicking on...

Page 129: ...ject specially defined IP packages IPv4 IPv6 By clicking on the link with the mouse you can choose IPv4 or IPv6 IP address By clicking on this link with the mouse a dialog box opens in which you can e...

Page 130: ...the rule Outgoing Rules Outgoing rules are defined to control outgoing data traffic by the Avira FireWall You can define an outgoing rule for one of the following protocols IP ICMP UDP TCP See Add ne...

Page 131: ...ag the rule to the required position 11 5 2 Application rules Application rules for user This list contains all users in the system If you are logged in as an administrator you can select the user to...

Page 132: ...Wall Application rules section an additional column with the heading Filtering is displayed in the list of application rules with the entry Basic for each application Column Description Application Na...

Page 133: ...ay access to the Internet in front of the FireWall can be hidden In default mode code injection is enabled for all signed applications Allow Deny passive listening to the application of ports Allow De...

Page 134: ...expert mode only You can add remove producers to from the list using the Always trust this provider option in the Network Event popup window You can allow network access from applications that are si...

Page 135: ...or option in the Network Event popup window to add a vendor to the list of trusted vendors again Note The FireWall prioritizes application rules before making entries in the list of trusted vendors If...

Page 136: ...notification if a port scan has been detected by the FireWall Flooding If the option is activated you will receive a desktop notification if a flooding attack has been detected by the FireWall Applica...

Page 137: ...on for this application of the dialog box Network event is enabled as the default setting Always disabled When this option is enabled the option Remember action for this application of the dialog box...

Page 138: ...nformation is not displayed for the following network event 11 6 Firewall under SMC The FireWall is configured to meet the specific requirements of administration through the Avira Management Console...

Page 139: ...the time you have defined This option is enabled as the default setting Generic adapter rules Optionen nur bei aktiviertem Expertenmodus verf gbar Network connections that have been set up are designa...

Page 140: ...r preventing so called ICMP flood attacks which results in an increase of the CPU load of the attacked machine as it responds to every packet Predefined rules for the ICMP protocol Setting Rules Low I...

Page 141: ...an attacks that result in a detection of open TCP ports on your computer This kind of attack is used to search a computer for weak spots and is often followed by more dangerous attack types Predefined...

Page 142: ...erous attack types Predefined rules for the UDP port scan Setting Rules Low Assume a UDP port scan if 50 or more ports were scanned in 5 000 milliseconds When detected log attacker s IP and don t add...

Page 143: ...block the UDP port scan attack 11 6 2 Incoming Rules Incoming rules are defined to control incoming data traffic by the Avira FireWall Warning When a packet is filtered the corresponding rules are ap...

Page 144: ...nd remote ports in 0 65535 Apply for all packets Don t log when packet matches rule Advanced Discard packets that have following bytes empty with mask empty at offset 0 Monitor TCP healthy data traffi...

Page 145: ...alog box opens in which you can enter the required IPv4 or IPv6 mask Local ports With a mouse click on this link a dialog box appears in which you can define the local port number s or complete port r...

Page 146: ...puted from where TCP header ends Predefined rules for the UDP traffic data monitor Setting Rules Low Medium Monitor UDP accepted data traffic Allow UDP packets from address 0 0 0 0 with mask 0 0 0 0 i...

Page 147: ...y clicking on this link with the mouse a dialog box opens in which you can enter the required IPv4 or IPv6 mask Local ports With a mouse click on this link a dialog box appears in which you can define...

Page 148: ...s Low Medium Do not discard ICMP based on IP address Allow ICMP packets from address 0 0 0 0 with mask 0 0 0 0 Don t log when packet matches rule Advanced Discard packets that have following bytes emp...

Page 149: ...specific mask Filtered content Offset With a mouse click on the link a dialog box appears in which you can define the filtered content offset The offset is computed from where ICMP header ends Predefi...

Page 150: ...nk with the mouse a dialog box opens in which you can enter the required IPv4 or IPv6 mask Protocol By clicking on this link with the mouse a dialog box opens in which you can enter the required IP pr...

Page 151: ...dd new rules for individual adapters or for all adapters present on the computer To add an adapter rule for all adapters select My Computer from the adapter hierarchy that is displayed and click on th...

Page 152: ...s The application is added to the application list with the rule Allow If you use the option Add by md5 all added applications are uniquely identified using the MD5 checksum This allows the FireWall t...

Page 153: ...rovider from the list click Apply or OK in the configuration window Remove all All entries are removed from the list of trusted vendors Reload The changes made are reversed The last list saved is load...

Page 154: ...ill assume that any of the untrustworthy processes in the stack may actually be the one accessing the network through its child process Therefore a different popup window will be opened for each untru...

Page 155: ...the Network event window Show details on demand If this option is enabled the detailed information is only displayed in the Network event window on request i e the detailed information is displayed b...

Page 156: ...Frames Block suspicious I frames If this option is enabled I Frames on the web pages you request are scanned according to certain criteria If there are suspect I Frames on a requested web page the I...

Page 157: ...our web browser Default This button allows you to select an action that is activated in the dialog box by default when a virus is detected Select the action that is to be activated by default and clic...

Page 158: ...to your computer system Options available in expert mode only Web Protection blocks the following file types MIME Types All file types and MIME types content types for the transferred data in the list...

Page 159: ...pt MIME type files ActiveX script files axs are blocked by Web Protection exe All files with the extension exe executable files are blocked by Web Protection msi All files with the extension msi Windo...

Page 160: ...ion In this field you can select the MIME types content types for the transferred data to be ignored by Web Protection during scanning File types MIME types skipped by Web Protection user defined All...

Page 161: ...d file types from the input field into the display window Delete The button deletes a selected entry from the list This button is inactive if no entry is selected URLs skipped by Web Protection All UR...

Page 162: ...y is selected Examples Skipped URLs www avira com OR www avira com All URLs with the domain www avira com are excluded from Web Protection scans www avira com en pages index php www avira com en suppo...

Page 163: ...e code being scanned exhibits these characteristic features it is reported as being suspicious This does not necessarily mean that the code is in fact malware False positives do sometimes occur The de...

Page 164: ...concerning detections alerts and errors in the report file with less important information ignored for improved clarity This option is enabled as the default setting Advanced If this option is enable...

Page 165: ...alware by default If this option is disabled the Mail Protection service is still started but monitoring by Mail Protection is disabled Scan incoming emails If this option is enabled incoming emails a...

Page 166: ...IPv6 support If this option is enabled Internet Protocol version 6 is supported by the Mail Protection Option available in expert mode only Action on detection This configuration section contains set...

Page 167: ...ed to quarantine and then deleted replaced by a default text The body of the email is delivered The affected attachment can later be delivered via the quarantine manager Ignore If this option is enabl...

Page 168: ...nwanted program is found in an attachment Delete If this option is enabled the affected attachment is deleted if a virus or unwanted program is found and replaced by a default text Ignore If this opti...

Page 169: ...tics that can proactively uncover unknown malware i e before a special virus signature to combat the damaging element has been created and before a virus guard update has been sent Virus detection inv...

Page 170: ...etected but there are also likely to be false positives 11 8 2 General Exceptions Scanning exceptions This table shows you the list of email addresses excluded from scanning by Mail Protection white l...

Page 171: ...ored in the cache This field is used to set the maximum number of emails that are stored by Mail Protection in the cache Emails are deleted oldest first Maximum days for an email to be stored The maxi...

Page 172: ...t emails 11 8 3 Report Mail Protection includes an extensive logging function to provide the user or administrator with exact notes about the type and manner of a detection Options available in expert...

Page 173: ...tion see Configuration General Directories Report directory Write configuration in report file If this option is enabled the Mail Protection configuration is recorded in the report file Note If you ha...

Page 174: ...is password every time you want to open the protected area Password Enter password Enter your required password here For security reasons the actual characters you type in this space are replaced by a...

Page 175: ...Protection Activate deactivate FireWall If this option is enabled the pre defined password is required to enable disable the FireWall Activate deactivate Web Protection If this option is enabled the p...

Page 176: ...and modify jobs If this option is enabled the pre defined password is required to add and modify jobs in the Scheduler Start product updates If this option is enabled the pre defined password is requi...

Page 177: ...on CD and DVD drives Warning Only disable the autostart function for CD and DVD drives if you are sure you are only using trusted data media System protection Protect Windows hosts files from changes...

Page 178: ...cases read access to the registry entries or program files by users or external programs To enable this option you have to restart your computer Warning Please note that if this option is disabled the...

Page 179: ...erver is not established via a proxy server Use proxy system settings When the option is enabled the current Windows system settings are used for the connection to the web server via a proxy server Co...

Page 180: ...alerts from the System Scanner or from the Realtime Protection to any workstations in your network Note Please check whether the Message service has been started You will find the service i e in Windo...

Page 181: ...rts are sent This option is disabled as the default setting Note To be able to activate this option at least one recipient must be entered under Configuration General Alerts Network Message to be sent...

Page 182: ...the MAC address of the computer on which the Realtime Protection is running Default The button restores the predefined default text for an alert System Scanner network alerts Enable network alerts If...

Page 183: ...d in user using the System Scanner FILE contains the path and file name of the affected file COMPUTER contains the name of the computer on which the System Scanner is running ACTION contains the actio...

Page 184: ...In this case please inform our technical support and include the data given in the email The specified file should also be sent for examination Edit The Edit button opens the Email template window in...

Page 185: ...d and warnings Edit The Edit button opens the Email template window in which you can configure the notification for the End of scan event You have the option of inserting text for the subject line and...

Page 186: ...the option of inserting text for the subject line and body of the email You can use variables for this purpose see Email Template Update finished successfully A new product update is available If thi...

Page 187: ...y These alerts are sent irrespective of your email warning settings for the Update component Email template In the Email template window you can configure the email notifications for the individual co...

Page 188: ...ponent variables Variable Value Component emails ENGINEVER Version of scan engine used Realtime Protection System Scanner VDFVER Version of virus definition file used Realtime Protection System Scanne...

Page 189: ...ATE_ERROR Update error in words Updater DIRCOUNT Number of scanned directories System Scanner FILECOUNT Number of files scanned System Scanner MALWARECOUNT Number of viruses or unwanted programs detec...

Page 190: ...ile System Scanner Updater Acoustic alerts Options available in expert mode only When a virus or malware is detected by the System Scanner or Realtime Protection an acoustic alert is heard in interact...

Page 191: ...n is used to test the selected WAVE file Alerts Your Avira product generates so called slide ups desktop notifications for specific events which give information on successful or failed program sequen...

Page 192: ...d not be installed No update necessary If this option is enabled you will receive a desktop notification whenever an update is started but installation of the files is not necessary as your program is...

Page 193: ...tricted 11 9 9 Directories Options available in expert mode only Temporary path Use default system settings If this option is enabled the settings of the system are used for handling temporary files N...

Page 194: ...he button opens a window in which you can select the required directory Default The button restores the pre defined path to the report directory Quarantine directory Input box This box contains the pa...

Page 195: ...ed with great care However errors in design and contents cannot be excluded The reproduction of this publication or parts thereof in any form is prohibited without previous written consent from Avira...

Reviews: