manualshive.com logo in svg

KAPERSKY ANTI-VIRUS 5.5 - FOR CHECK POINT FIREWALL-1, Administrator'S Manual, Page: 14 / 141

Share
Download
KAPERSKY ANTI-VIRUS 5.5 - FOR CHECK POINT FIREWALL-1 Administrator'S Manual Download Page 14

14 

Kaspersky Anti-Virus 5.5 for Check Point

TM

 Firewall-1

®

 

Format feature 

Meaning/Usage 

Bold font 

Titles of menus, menu items, windows, 
dialog boxes and their elements, etc. 

 

Note 

 

Additional information, notes 

 

Attention! 

 

Information requiring special attention 

 

In order to perform, 

Step 1. 

… 

Description of the successive user's 
steps and possible actions 

 

Task, example 

 

Statement of a problem, example of the 
demonstration of the application's 
capabilities 

 

Solution 

 

Implementation of the task 

[key]

 – modifier name. 

Command line modifier 

Information messages 
and command line text 

Text of configuration files, information 
messages and command line 

 

Summary of Contents for ANTI-VIRUS 5.5 - FOR CHECK POINT FIREWALL-1

Page 1: ...KASPERSKY LAB Kaspersky Anti Virus 5 5 for Check PointTM Firewall 1 Administrator sGuide...

Page 2: ...K A S P E R S K Y A N T I V I R U S 5 5 F O R C H E C K P O I N T T M F I R E W A L L 1 Administrator s Guide Kaspersky Lab Ltd http www kaspersky com Revision date November 2006...

Page 3: ...3 INSTALLING AND REMOVING THE APPLICATION 18 3 1 Installing the application 18 3 1 1 First time installation 19 3 1 2 Reinstalling the application 22 3 2 Removing the application 22 CHAPTER 4 INTEGRA...

Page 4: ...1 Actions performed with objects transferred via HTTP protocol 61 7 1 2 Actions performed with objects transferred via FTP protocol 62 7 1 3 Actions performed with objects transferred via SMTP protoco...

Page 5: ...cense key details 105 11 3 License related notifications 107 11 4 Installing the license key 107 11 5 Removing a license key 108 CHAPTER 12 NOTIFICATIONS 110 CHAPTER 13 FREQUENTLY ASKED QUESTIONS 114...

Page 6: ...its important element the issue of protection of the corporate mail servers against the external threats preventing virus outbreaks within the corporate networks 1 1 Computer viruses and malicious so...

Page 7: ...ertising messages As a rule adware is integrated into freeware programs The advertising component is located in the interface Adware programs are often used to gather users personal information and se...

Page 8: ...s required 1 2 Purpose main functions and structure of Kaspersky Anti Virus Kaspersky Anti Virus for Check Point TM Firewall 1 hereinafter referred to as Kaspersky Anti Virus is a system that provides...

Page 9: ...f objects infected with these viruses and description of potentially dangerous programs riskware As new viruses are created daily it is extremely important that you maintain your anti virus database u...

Page 10: ...e security level of the stream passing through the firewall and the Anti Virus load during the scan Configurable filters allow to easily locate the original copies of objects for example for their sub...

Page 11: ...ll 1 versions NG NG AI and NGX For the installation and operation of the application components the software and hardware of your computer must comply with the following minimum requirements Managemen...

Page 12: ...higher Microsoft Windows Server 2003 Enterprise Edition or higher 1 5 Distribution kit You can purchase Kaspersky Anti Virus either from our dealers retail box or online for example visit http www kas...

Page 13: ...vice package enabling them to use Kaspersky Anti Virus more efficiently After purchasing a subscription you become a registered user and during the period of your subscription you will be provided wit...

Page 14: ...formation requiring special attention In order to perform Step 1 Description of the successive user s steps and possible actions Task example Statement of a problem example of the demonstration of the...

Page 15: ...ication in accordance with OPSEC TM standards and by default supports protected data transfer protocol The Security Server can be installed either on one computer with Check PointTM Firewall 1 or on a...

Page 16: ...ed to this Security Server by Check Point TM Firewall 1 The number of instances of Kaspersky Anti Virus installed in the network will be determined by the number of installed Se curity Servers 2 Perfo...

Page 17: ...0 page 98 and Chapter 9 page 89 Configure notifications about the results of anti virus object scan anti virus database updates report creation forthcoming expiration of the license change of the appl...

Page 18: ...and Management Console on the computer on which the setup wizard is run You can select either complete or custom installation of the application or repair an invalid installation of Kaspersky Anti Vir...

Page 19: ...version install all required Service Packs and start the installation of Kaspersky Anti Virus one more time Step 2 Greeting and License Agreement First steps of the installation process are standard a...

Page 20: ...zard will display reference information about the selected component and the disk space required for its installation Step 5 Selecting the data folder During the installation of the Security Server th...

Page 21: ...that without the license key the anti virus functionality of the application will not be available and you will only be able to launch the Management Console During this step Kaspersky Anti Virus 5 5...

Page 22: ...operation In order to reinstall the application select the Repair option in the win dow that will open This will start reinstallation of Kaspersky Anti Virus which will use the same settings as the pr...

Page 23: ...servers each server must be integrated with Security Check Point TM Firewall 1 4 1 Registering Security Server with Check PointTM Firewall 1 Registering OPSEC TM applications is described in detail in...

Page 24: ...tion New in the General tab of the OPSECTM Application Properties settings configuration window see Figure 2 perform the following Using the Name entry field enter the name of the OPSECTM application...

Page 25: ...ted by the application Configuring the protocols settings is not required Kaspersky Anti Virus uses the default Check Point TM Firewall 1 settings If the configuration of Check PointTM Firewall 1 in t...

Page 26: ...subject to the anti virus scan Kaspersky Anti Virus scans the data passing through the firewall via HTTP FTP and SMTP protocols Create the following a URI resource for transferring the HTTP protocol d...

Page 27: ...tion of Kaspersky Anti Virus with Check PointTM 27 Figure 3 Creating a URI resource The CVP tab to create an FTP resource check the GET and the PUT boxes in the Methods section on the Match tab see Fi...

Page 28: ...rus 5 5 for Check PointTM Firewall 1 Figure 4 Creating an FTP resource The Match tab to create a URI resource select the Enforce URI capabilities option in the Use this resource to section on the Gene...

Page 29: ...SMTP and FTP resources This parameter controls the possibility of disinfection and re placement of objects detected during the anti virus scan see section 7 1 page 60 If the box is not checked disinfe...

Page 30: ...lease take into account the following restrictions when creat ing a SMPT resource the size of messages redirected by Check Point TM Fire wall 1 for the anti virus scan displayed in the Do not send mai...

Page 31: ...Integration of Kaspersky Anti Virus with Check PointTM 31 Figure 6 Configuring the SMTP resource settings The Action2 tab...

Page 32: ...ning the certificate is a standard procedure for applications integrated with Check Point TM Firewall 1 This procedure is performed using special utility opsec_pull_cert exe designed for obtaining cer...

Page 33: ...for secure connection to Check PointTM Firewall 1 were configured path to the certificate file full path to the file where the Security Server certificate received from Check PointTM Firewall 1 will...

Page 34: ...Virus 5 5 for Check PointTM Firewall from the standard Start Pro grams Windows menu This programs group is created only on the ad ministrator s workstations when the Management Console is installed 5...

Page 35: ...s used for viewing general settings of Kaspersky Anti Virus operation license details and information about installed license keys renewing the license and the configuring the application operation di...

Page 36: ...cular object The list of objects and the corresponding set of commands accessible via the context menu are provided in the table below Object Command Purpose Kaspersky Anti Virus 5 5 for Check PointTM...

Page 37: ...onsole and the Security Server In order to add a new server to the list of monitored servers 1 Select the Kaspersky Anti Virus 5 5 for Check PointTM Firewall 1 node in the console tree open the shortc...

Page 38: ...red and the node structure will include nested folders Backup Storage and Report Templates If the connection have not been established or could not be established the server will be flagged with the i...

Page 39: ...ty Server the user must have the local administrator s right on the computer to which the connection is at tempted The rights verification is performed based on the standard Windows network user authe...

Page 40: ...onfigure the settings will be the same In order to configure the settings for interaction between the Security Server and Check Point TM Firewall 1 1 Select the node corresponding to the required serv...

Page 41: ...the data will not be encrypted If the list does not contain the required value enter it manually If protocols that require keys for encryption are used for au thentication the key files must be locate...

Page 42: ...t is displayed in the settings configuration window of Check PointTM Firewall 1 Network Objects Check Point TM GeneralProperties in the DN field section Secure Internal Communication Specify the full...

Page 43: ...on This will open the Configuring additional OPSEC TM settings window see Figure 11 Enter the description of the required settings and press the OK button An example of such settings for CVP and AMON...

Page 44: ...ion has been received within this period of time the Security Server will disconnect from Check Point TM Firewall 1 The connection will be established later when Check PointTM Firewall 1 transfers dat...

Page 45: ...the events that happened while the con nection was out will be transferred to Check Point TM Fire wall 1 immediately after the connection is restored Information about the following events will be sen...

Page 46: ...Anti Virus will start working with the minimum set of settings most of which are default optimum settings recommended by the Kaspersky Lab s experts If necessary depending on the network properties a...

Page 47: ...disinfected the application will block ac cess to it and display an information message of the following format Kaspersky Anti Virus 5 5 for Check Point TM Firewall 1 Requested address path to the res...

Page 48: ...Computer Antivirus Research specifically for testing anti virus products The test virus IS NOT A VIRUS because it does not contain code that can harm your computer However most anti virus products man...

Page 49: ...disinfected and will perform an action specified in the HTTP traffic settings for this type of objects By default see section 5 7 page 47 if you attempt to download the test virus connection with the...

Page 50: ...e saved in the backup storage 5 8 4 Testing the FTP traffic protection In order to detect viruses in the data stream transferred via FTP proto col 1 Copy the test virus to a location that you can acce...

Page 51: ...ternet sites automatic dialing programs that connect the user s computer to porn websites automatic porn files downloading programs keyboard spies password hacking programs backdoor programs c Joke pr...

Page 52: ...rsky Anti Virus 5 0 for File Servers see section 6 2 page 55 Updates are downloaded either according to the schedule or manually In order to download the anti virus database from the internet your com...

Page 53: ...see section 6 3 page 56 If updates are required immediately press the Update now button details see section 6 4 page 57 to download the updates manually Before performing manual updating make sure th...

Page 54: ...n see Figure 13 and select Kaspersky Lab s updating servers default option as the source of updates 3 After this press the Configure settings button and specify the network connection settings in the...

Page 55: ...the Kaspersky Administration Kit 5 0 centralized management system to control Kaspersky Lab s applications installed on your network computers then the anti virus updates received by the Administratio...

Page 56: ...from the local folder 6 3 Automatic updates In order to update the anti virus database in the automatic mode 1 Select the node corresponding to the required server in the console tree and follow the...

Page 57: ...update the anti virus database in the manual mode 1 Select the node corresponding to the required server in the console tree and follow the Anti virus scan link in the results pane 2 Press the Update...

Page 58: ...ver protection is enabled details see section 7 3 page 63 then starting and stopping of the traffic scan will be performed simultaneously with the startup and shutdown of the computer on which the Sec...

Page 59: ...ti Virus provides an option of blocking access to objects that are transferred in parts see section 7 4 page 65 This option is not provided for FTP protocol and in order to minimize the possibility of...

Page 60: ...objects in RAM allows scanning objects without saving them to a work folder on the hard drive Depending on the scan settings the application can simultaneously scan up to 1000 objects up to 1024 KB ea...

Page 61: ...If the object cannot be disinfected apply the action specified for objects that cannot be disinfected Disinfect save a copy disinfect pass the object to the use once disin fected save a copy of the or...

Page 62: ...object as a result a data transfer error mes sage will be displayed in the FTP client window Block save a copy block access to the object save a copy of the origi nal object in the backup storage As a...

Page 63: ...lied by default Extended anti virus protection level protection against all currently known malicious and potentially dangerous programs included under b in the Updating the anti virus database list o...

Page 64: ...Standard anti virus protection Extended anti virus protec tion or Redundant anti virus protection in order to enable anti virus protection and apply the required protection level The use of the exten...

Page 65: ...P traffic settings link in the results pane Configure the anti virus operation settings for scanning HTTP traffic on the tabs of the HTTP traffic scan settings window that will open see Figure 17 2 On...

Page 66: ...s to access the object again within the specified interval the access to the object will be granted or the user will receive a notification about the result of the last scan of this object By default...

Page 67: ...ld The greater the value of this setting the less will be the possibility of infection when passing unscanned data to the user The suggested default value is 10 In order to allow delivery of files dow...

Page 68: ...at involves replacement of the object you must create a replacement template In order to do this press the Notification template button and enter the notification text in the window that will open see...

Page 69: ...copies of disinfected objects and the objects that cannot be disinfected will also be saved if the Skip make no changes action is selected for such ob jects Figure 19 Creating the replacement templat...

Page 70: ...ngs button In order to disable scanning data transferred via HTTP protocol uncheck the Scan HTTP traffic box on the Settings tab of the HTTP scan settings window see Figure 17 and press the Apply or t...

Page 71: ...see section 7 4 page 65 Figure 21 FTP traffic scan settings The Settings tab 2 In order to ensure that the scan will be performed check the Scan FTP traffic box see Figure 21 After this specify values...

Page 72: ...re 22 FTP traffic scan settings The Actions tab 4 On the Exclusions tab see Figure 23 provide the list of objects that will not be scanned for the presence of malicious code In order to do this check...

Page 73: ...ransferred via FTP protocol uncheck the Scan FTP traffic box on the Settings tab of the FTP scan settings window see Figure 21 and press the Apply or the OK button 7 6 Scanning SMTP traffic In order t...

Page 74: ...ox see Figure 24 on the Settings tab Figure 24 SMTP traffic scan settings The Settings tab 3 Specify which actions will be performed upon detection of infected suspicious protected and corrupted objec...

Page 75: ...rder to disable scanning data transferred via SMTP protocol uncheck the Scan SMTP traffic box on the Settings tab of the SMTP scan settings window see Figure 24 and press the Apply or the OK button 7...

Page 76: ...usly You can set this value in the range between 1 to 32 Microsoft recommends that you set up a value that is not greater then 4 multiplied by the number of the processors on the computer on which the...

Page 77: ...led The total volume of the objects being scanned shall not ex ceed the amount of free RAM The size of the queue of objects to be scanned the maximum number of objects being scanned and waiting to be...

Page 78: ...rom the scan scope does not affect settings used to scan other types of containers 3 In order to apply the changes press the Apply or the OK button The settings for scanning objects in RAM will be app...

Page 79: ...lder It is created in the application s data folder during the installation of the Security Server The amount of information that can be stored in the backup storage may be restricted by the following...

Page 80: ...view the backup storage select the Backup Storage folder in the console tree After this a table containing the full list of all objects contained in the backup storage will appear in the results pane...

Page 81: ...detected Exact date and time when the object was detected by Kaspersky Anti Virus You can perform ascending and descending sorting of the data contained in the table by any column 8 2 Backup storage...

Page 82: ...filter name The following information about the object can be used to configure the parameters object status multiple values can be selected the type of protocol that was scanned when the object was...

Page 83: ...e tree inside the Backup Storage folder When the filter is selected in the console tree only data that complies with the filter criteria will be displayed in the results pane Later you can alter value...

Page 84: ...are removed from the backup stor age Objects that meet the filter parameters will still be available in the Backup Storage folder 8 3 Restoring objects from the backup storage In order to restore an...

Page 85: ...tion of the object a cor responding notification will be displayed We recommend that you restore only objects with the suspi cious or protected corrupted status During the next scan for example with K...

Page 86: ...been reached and there is not enough space for storing a new object The application will then delete the number of older objects required to free the space needed A possibility to manually remove obj...

Page 87: ...ent The settings of the backup storage are determined by default and can be altered by the administrator In order to modify the settings of the backup storage 1 Select the Backup Storage folder in the...

Page 88: ...32 Configuring the backup storage settings 4 In order to apply the changes press the Apply or the OK button For exit without saving the changes made press the Cancel button You can restore the defaul...

Page 89: ...a possibility to configure notifications about the results of report creation see Chapter 12 on page 110 The default storage location for the reports is the Reports folder This folder is located in th...

Page 90: ...rent stage of the report creation the report status may have one of the following values being created since time and date for scheduled report genera tion created date and time of the report creation...

Page 91: ...template you need in the table displaying the list of created templates see Figure 33 3 Open the shortcut menu and use the Create a report command or the analogous command under the Action menu A rep...

Page 92: ...ettings Check the Store statistics box Specify the information storage period and select the time unit 4 After you have made the changes press the Apply or the OK button to apply the new settings The...

Page 93: ...template name in the Name field Specify whether reports will be automatically created based on this template In order to do this check or uncheck the Create reports box If required enter a more detail...

Page 94: ...e pe riod option in the Reporting period group and specify the desired date in the From and To fields In order to create a schedule perform the following in the Frequency section o Select the report c...

Page 95: ...folder 2 Select and open an html file with the name corresponding to the date and time of report creation in the following format DD MM YYYY_HH MM SS As a result the system default browser will be loa...

Page 96: ...he selected section are displayed in the right frame In order to view a particular section select this section s name in the table of contents and the content of the section will be loaded in the righ...

Page 97: ...e selected template will be displayed Reports are viewed using the default system browser 5 If no reports were created based on the selected template an information message will be displayed see Figur...

Page 98: ...the log files have the following naming convention Kav4Cpf1_DATE log Kaspersky Anti Virus log that contains information about the application s operation provided with the extent of detail that was sp...

Page 99: ...e diagnostics level For each component of the program there is a set of diagnostic messages that will be entered into the logs The information volume and the extent of detail will be determined by the...

Page 100: ...the groups Only diagnostic messages of group Scan Results for the Fil ters component will be entered into the results log Messages of this group are not registered in the application s operation log S...

Page 101: ...cs tab in the General parameters window that will open see Figure 39 3 Enter the path to the new folder in the Log files folder field 4 Select the frequency for creating logs in the Start a new file o...

Page 102: ...ictions imposed on the use of Kaspersky Anti Virus that can be verified by the special application s utilities If any violation of the terms and conditions of the license agreement have been detected...

Page 103: ...or Check PointTM Firewall 1 or Purchase a new license key directly from Kaspersky Labs In order to do this send a request directly to the Sales Department of our company sales kaspersky com or fill in...

Page 104: ...neral settings link in the results pane 2 Go to the General tab in the General parameters window that will open see Figure 40 Figure 40 Viewing license information The tab contains the following infor...

Page 105: ...triction on the number of protected workstations or by the expiration of the trial license key o Update only Only anti virus database updating feature is available The anti virus database may have bee...

Page 106: ...tion License expiration date Serial number The maximum number of protected workstations The following license key details are displayed in the Backup li cense key section License expiration date Seria...

Page 107: ...cations about the forthcoming license expiration in the Anti Virus settings see Chapter 12 on page 110 By default a notification is issued 14 days prior to the license expiration date You can configur...

Page 108: ...erver in the console tree and follow the General settings link in the results pane 2 Go to the License keys tab in the General settings window that will open see Figure 41 3 On the License keys tab if...

Page 109: ...tab if you are removing the backup license key press the Remove button in the Backup license key section if you are removing the current license key press the Remove button in the Current license key...

Page 110: ...after the license is renewed Additionally Kaspersky Anti Virus allows the possibility to automatically launch applications specified by the administrator on the Security Server when certain types of...

Page 111: ...neral settings window that will open see Figure 42 3 On this tab in the field corresponding to the required event specify the full path to the module that will be launched on the Security Server when...

Page 112: ...as successfully created Address of the sender and the recipient address and number of the SMTP server port and the message subject are specified in the script variables These settings must be configur...

Page 113: ...Notifications 113 events has its own set of variables the complete list of variables is provided in Appendix A on page 118...

Page 114: ...erall scanning time Unlike other anti virus software vendors that try to reduce the overall scan time by excluding from their databases viruses that are less easily detectable or less frequent in the...

Page 115: ...d that you contact the dealer you purchased your copy of Kaspersky Anti Virus from or send an e mail message to our Technical support service support kaspersky com or at the address specified in your...

Page 116: ...to ensure adequate computer protection Yet the recent virus outbreaks spread over the world in a matter of sev eral hours and anti virus software using old anti virus databases may not be able to prot...

Page 117: ...w the update service may use the Mi crosoft Internet Explorer settings incorrectly internet settings are not configured on your computer Microsoft Internet Explorer settings are not available if no us...

Page 118: ...iption Settings passed Anti virus object scan Anti virus object scan completed kav4cpf1_event object kav4cpf1_scan cured in fected suspicious other cured disinfected infected infected suspicious suspi...

Page 119: ...e kav4cpf1_bases date_and_time_of_creation_of_ant i vi rus_database_used_by_application kav4cpf1_error empty kav4cpf1_time event_occurrence_time Anti virus database update resulted in an error Anti vi...

Page 120: ...kav4cpf1_error er ror_description kav4cpf1_time event_occurrence_time Forthcoming expiration of the license License expiration notification period specified in the Kaspersky Anti Virus settings has b...

Page 121: ...ration or anti virus database corruption kav4cpf1_event status kav4cpf1_error disabled kav4cpf1_time event_occurrence_time Security Server component not started or not initialized kav4cpf1_event statu...

Page 122: ...ication data folder the folder in which service folder and databases required for the application to operate are stored If you change the data folder all information stored in this folder must be save...

Page 123: ...o the object i e if it is the first action to be performed on an object after it is detected a backup copy of such object will be created before this ac tion is performed Part of the data may be lost...

Page 124: ...plate a template used to create a text notification about infected objects detected or about a threat of a virus outbreak Report template a template used to create reports on the results of the anti v...

Page 125: ...of parameters that determine the virus activity level threshold the distri bution method and the text of notifications to be sent Virus activity level threshold a maximum allowable number of events of...

Page 126: ...e protection from current and future threats Resistance to future attacks is the basic policy implemented in all Kaspersky Lab s products At all times the company s products remain at least one step a...

Page 127: ...erably increases the speed of the program s operation The application creates a reliable barrier against viruses when they attempt to intrude your computer via e mail Kaspersky Anti Virus Personal per...

Page 128: ...any Microsoft Windows operating system It protects your computer against unauthorized access and external hacker attacks from either the Internet or the local network Kaspersky Anti Hacker monitors t...

Page 129: ...s server of Kaspersky Lab with specified frequency The product performs the following functions It visualizes in the system tray the current status of virus activity The product allows the users to su...

Page 130: ...traffic on the level of data transmission protocol POP3 IMAP and NNTP for incoming mail and SMTP for out going messages irrespectively of the mail client being used as well as disinfection of e mail...

Page 131: ...and start up objects of Microsoft Windows Proactive protection the program performs constant monitoring of ap plication activity and processes running in random access memory pre venting dangerous cha...

Page 132: ...ts your handheld PDA from unauthorized intrusion by encrypting both access to the device and data stored on memory cards Kaspersky Anti Virus Business Optimal This package provides a unique configurab...

Page 133: ...indows 2000 2003 Server Advanced Server Novell Netware FreeBSD OpenBSD Linux and Samba Servers E mail systems including Microsoft Exchange Server 2000 2003 Lotus Notes Domino Sendmail Postfix Exim and...

Page 134: ...ng and outgoing mail messages as well as messages stored at the server including letters in public folders and filters out unsolicited correspondence using smart spam recognition techniques in combina...

Page 135: ...o Check Point products 2005 Check Point Software Technologies Ltd All rights reserved Check Point Application Intelligence the Check Point logo FireWall 1 OPSEC and SmartDashborard are trademarks or r...

Page 136: ...OF THIS AGREEMENT DO NOT BREAK THE CD s SLEEVE DOWNLOAD INSTALL OR USE THIS SOFTWARE IN ACCORDANCE WITH THE LEGISLATION REGARDING KASPER SKY SOFTWARE INTENDED FOR INDIVIDUAL CONSUMERS KASPERSKY ANTI V...

Page 137: ...lient Device or by more than one user at a time except as set forth in this Section 1 1 1 The Software is in use on a Client Device when it is loaded into the temporary memory i e random access memory...

Page 138: ...plexing or pooling software or hardware front end If the number of Client Devices or seats that can connect to the Software exceeds the number of licenses you have obtained then you must have a reason...

Page 139: ...the Kaspersky Lab Privacy Policy which is deposited on ww kaspersky com privacy and you explicitly consent to the transfer of data to other countries outside your own as set out in the Privacy Policy...

Page 140: ...nformation as may be reasonably necessary to assist the Supplier in resolving the defective item v The warranty in i shall not apply if you a make or cause to be made any modifications to this Softwar...

Page 141: ...er hereof and supersedes all and any prior understandings undertakings and promises between you and Kaspersky Lab whether oral or in writing which have been given or may be implied from anything writt...

Reviews:

No comments