CHAPTER 3. KASPERSKY ANTI-
VIRUS INTERNAL
ARCHITECTURE
Let us examine the internal architecture of Kaspersky Anti-Virus for more
thorough understanding of the algorithm used in its operation. In addition, the
section will be useful for detailed analysis of activity reports generated by each of
the application components.
Kaspersky Anti-Virus includes the following modules:
•
Hook
– e-mail messages interception module
•
Kavmailmonitor
– e-mail messages scanning module
•
Kavdbscanner
– database scanning module
•
Kavreplmonitor
– replications scanning module
•
Kavupdater
– application anti-virus database updating module
•
The system detecting virus outbreaks
.
During its operation, the application uses several databases located on the
server hard drive:
•
Configuration database.
•
Quarantine database.
•
Statistical database and the application's run-time log.
The
Kavreplmonitor
,
Kavupdater
,
Kavmailmonitor
and
Kavdbscanner
modules start automatically at the Domino server startup.
After the
Hook
module is started, it intercepts all e-mail messages sent and
received by the Domino server and passes them to the
Kavmailmonitor
module
for anti-virus scanning and processing.
After scanning an object can be recognized as clean, infected, suspicious or as
one unchecked because of a failure or its corruption.
The
Kavmailmonitor
module
scans all received messages for viruses and
processes these messages based on the specified anti-virus protection settings.
For example, the module can attempt to disinfect all infected objects and place
