background image

Kaspersky Anti-Virus 5.6 for MS ISA Server 2000 Enterprise Edition 

• 

Management of license keys. 

In addition, Kaspersky Anti-Virus

®

 for Microsoft ISA Server allows the 

administrator to: 

• 

Set parameters for anti-virus protection and for notifications about 

dangerous events. 

• 

Create groups of users in accordance with the adopted network policy. 

For example, you can use the existing administration division to define 
anti-virus policy settings for each of the groups created. This can 
significantly speed up the scanning process. 

• 

Create a list of trusted servers for one or several groups of users; the 

traffic from these servers will be excluded from scanning for viruses. 

• 

Create a list of types of object excluded from anti-virus protection. 

The application can be managed from a remote location using Kaspersky 
Administration Kit, a system for centralized management of the anti-virus 
protection system (see section 4.8 on page 63). 

Kaspersky Anti-Virus

®

 supports the following data transfer protocols:  

• 

HTTP 1.0 and 1.1 (RFC 2616); 

• 

FTP (RFC 959, 2389, Extensions to FTP); 

• 

FTP over HTTP. 

 

The application does not protect data transferred by other transfer pro-
tocols and VPN connections. 

1.1. What’s new in Kaspersky Anti-

Virus® 5.6 for Microsoft  ISA 
Server 2000 Enterprise Edition 

This application is designed to protect Microsoft ISA Servers installed as 
enterprise array members. The application allows centralized management of 
anti-virus protection settings for all servers protected by Kaspersky Anti-Virus and 
centralized updating of the anti-virus database. 

 

Though this version can be installed on a standalone Microsoft ISA 
Server, it is advised to use Kaspersky Anti-Virus 5.1 for Microsoft ISA 
Server on such servers. 

Summary of Contents for ANTI-VIRUS 5.6 - FOR MICROSOFT ISA SERVER 2000 ENTERPRISE...

Page 1: ...KASPERSKY LAB Kaspersky Anti Virus 5 6 for Microsoft ISA Server 2000 Enterprise Edition Administrator s Guide...

Page 2: ...S P E R S K Y A N T I V I R U S 5 6 F O R M I C R O S O F T I S A S E R V E R 2 0 0 0 E N T E R P R I S E E D I T I O N Administrator s Guide Kaspersky Lab http www kaspersky com Edition date August 2...

Page 3: ...14 3 2 2 Reinstalling 18 CHAPTER 4 USING KASPERSKY ANTI VIRUS FOR ISA SERVER 19 4 1 Default scan settings 19 4 2 Managing scans 22 4 2 1 Configuring general settings of anti virus scans 23 4 2 1 1 Ge...

Page 4: ...se keys 59 4 7 1 Installing a new license key 60 4 7 2 Renewing your license 61 4 7 3 Removing a license key 63 4 8 Managing the application via Kaspersky Administration Kit 63 4 8 1 Managing tasks 64...

Page 5: ...virus kernel The filters are integrated into Microsoft ISA Server as plug ins and the anti virus kernel is installed into the system as a service The anti virus protection is managed through a specia...

Page 6: ...an be managed from a remote location using Kaspersky Administration Kit a system for centralized management of the anti virus protection system see section 4 8 on page 63 Kaspersky Anti Virus supports...

Page 7: ...MB hard disk space for installation of the program At least 200 Mb hard disk space for temporary storage of data copied from the Internet before scanning for viruses The amount of free disk space requ...

Page 8: ...t agree to the terms of this LA you can return the unused product to your Kaspersky Anti Virus dealer for a full refund making sure the envelope containing the CD is sealed If you unseal the envelope...

Page 9: ...ventions to emphasize different meaningful parts of the documentation The Table below lists the conventions used in this User Guide Convention Meaning Bold font Menu titles commands window titles dial...

Page 10: ...rver mode Below we consider possible ISA Server modes and any special features of Kaspersky Anti Virus operation for each of these modes The documentation for ISA Server describes three possible modes...

Page 11: ...ISA Server is running in the Firewall mode Kaspersky Anti Virus Web Filter is installed in disabled state since it is presupposed that all the clients use the ISA Server as a firewall without accessin...

Page 12: ...11 Kaspersky Anti Virus 5 6 for MS ISA Server 2000 Enterprise Edition Figure 1 Processing of data streams by Kaspersky Anti Virus for Microsoft ISA Server...

Page 13: ...ct the performance of Kaspersky Anti Virus for Microsoft ISA Server To avoid disabling anti virus protection of servers make sure that FTP Access Filter is activated HTTP Redirector Filter is configur...

Page 14: ...itional filters can affect the performance of the anti virus application if their settings prevent the initial data from entering the Kaspersky Anti Virus filters Moreover in some cases Kaspersky Anti...

Page 15: ...fers two installation options complete installation or custom installation Fig 2 If you are installing the entire Kaspersky Anti Virus application anti virus kernel administration tools etc on an Micr...

Page 16: ...tration console Step 4 Anti virus protection settings In this installation step you must define the anti virus protection settings that will be used as default values Fig 4 The following settings can...

Page 17: ...ields Figure 4 Default settings for the program Immediately after this stage is completed the program will start copying files to your computer Step 5 Completing the setup The last step of Kaspersky A...

Page 18: ...tup In this stage you can run automatic installation of application license keys by selecting the corresponding box If this check box is selected after the installation completes a dialog box opens se...

Page 19: ...persky Anti Virus To correctly install the anti virus application select Repair in the dialog box that appears on your screen Fig 7 In this case the setup wizard will repeat the previous installation...

Page 20: ...puter is included into the centralized management system using Kaspersky Administration Kit you can remotely manage Kaspersky Anti Virus through the Kaspersky Administration Kit Administration Console...

Page 21: ...load enabled Error messages sent to the client html head title Kaspersky Anti Virus for Microsoft ISA Server title head body h1 Kaspersky Anti Virus for Microsoft ISA Server h1 p Internal Scanner Erro...

Page 22: ...uency of its updating By default updating is performed every three hours The update server is randomly selected from the list For each server the Anti Virus tab see section 4 2 2 on page 30 in the ser...

Page 23: ...ISA Server With these you can Edit the general parameters for the entire array of servers affecting Kaspersky Anti Virus performance including all anti virus scanning policies see section 4 2 1 on pa...

Page 24: ...ure 8 The Kaspersky Anti Virus for Microsoft ISA Server main window Figure 9 Shortcut menu 4 2 1 Configuring general settings of anti virus scans The administrator may need to change general settings...

Page 25: ...Figure 10 displays general information about Kaspersky Anti Virus Administration Console version and brief information about the license license owner license expiration date and the license key statu...

Page 26: ...fect an infected file upon detection check the Disinfect objects if possible box Only files transferred via the HTTP protocol can be disinfected An in fected file sent by the FTP protocol will not be...

Page 27: ...elay sending files to the client In the lower part of the tab you can select the anti virus database that will be used to detect viruses Standard databases viruses only the application will use the da...

Page 28: ...xtended and redundant databases are used to provide the highest level protection for data The use of these databases increases the load on your server resources 4 2 1 2 Settings for HTTP scanning On t...

Page 29: ...be immediately notified that the re quested file is infected Upon the second request for this file the client will be notified that the requested file is infected only if the time span between the fir...

Page 30: ...g 13 you can modify settings for scanning ISA Server data transmitted via the FTP and FTP over HTTP protocols In addition to the anti virus protection mode you can specify the amount of data transmitt...

Page 31: ...for each server Figure 14 The Kaspersky Anti Virus Server management dialog box To switch to the scan parameters for a single server Select the required server in the right part of the Kaspersky Anti...

Page 32: ...of the tab you can edit the default paths to the Kaspersky Anti Virus working folders These folders are used to store The anti virus database that is used during anti virus scanning Temporary files W...

Page 33: ...Anti Virus for Microsoft ISA Server can run simultaneously with other anti virus programs in order to protect the file system of your computer for example Kaspersky Anti Virus for Microsoft NT Server...

Page 34: ...imulta neously It is recommended that you run four anti virus ker nels on one physical processor The number of anti virus kernel instances reserved for scanning fast objects In this field you can spec...

Page 35: ...applied to different groups All ISA Server clients that do not belong to any group are assigned to the default group If a client is a member of several groups it is scanned for viruses using settings...

Page 36: ...ecting the Groups node in the tree The administrator can rename existing groups change their descriptions create new groups and delete old groups Figure 17 The Manage groups of Kaspersky Anti Virus di...

Page 37: ...Using Kaspersky Anti Virus for ISA Server 36 Figure 18 Creating a new group 3 In the next dialog box Fig 19 click Add clients Figure 19 Adding clients to a new group...

Page 38: ...y clicking New Figure 20 The Clients dialog box 5 If you select New you will see the Client Properties dialog box Fig 21 In this dialog box fill in the Client name field and select one of the followin...

Page 39: ...ents in a group Select the required group in the Manage groups of Kaspersky Anti Virus clients Fig 17 and click Edit group properties This will open the Group properties dialog box On the General tab...

Page 40: ...pecifying policies for anti virus scanning A specific policy can be assigned to each group of clients The anti virus policies define additional settings of filtering incoming traffic for different gro...

Page 41: ...ti Virus policies dialog box Fig 24 You can also switch to the Manage Kaspersky Anti Virus policies dialog box by clicking Policies in the tree Figure 24 The Manage Kaspersky Anti Virus policies dialo...

Page 42: ...us 5 6 for MS ISA Server 2000 Enterprise Edition Figure 25 Creating a new policy 3 In the next dialog box Fig 26 click Add and select a group of clients to be assigned to the new policy Figure 26 Addi...

Page 43: ...e description of the server and its properties see section 4 2 4 1 on page 45 about trusted servers After the list of trusted servers is complete click Next Figure 27 Adding trusted servers 5 The Add...

Page 44: ...settings In the Manage Kaspersky Anti Virus policies dialog box Fig 24 se lect the policy and click Edit policy settings On the General tab of the new dialog box Fig 29 you can rename the policy and c...

Page 45: ...The General tab Figure 30 The Groups tab On the Servers tab Fig 31 and the Object Types Fig 32 tab you can edit the list of trusted servers and objects excluded from scans for this anti virus policy F...

Page 46: ...cluded from anti virus protection This list only contains names of servers from which traffic cannot contain any malicious objects The larger the list of trusted servers the less Kaspersky Anti Virus...

Page 47: ...t of objects excluded from scans Reducing the types of object excluded from anti virus scans as well as the list of trusted servers in turn reduces the load on the resources of the ISA Server computer...

Page 48: ...default daily updating from Kaspersky Lab servers is disabled The database updates are downloaded once for all servers and then they are deployed through the shared network folder To set up centralize...

Page 49: ...s To configure updating settings for downloading updates from the Inter net 1 Click the Configure server button 2 In the Anti Virus Database Updating dialog box select the Update from Internet radio b...

Page 50: ...r the server address in the corresponding field 5 In the Use HTTP proxy part enter the HTTP proxy parameters if such a proxy is used in your system Select Use local proxy of the ISA server to use a lo...

Page 51: ...e full path to the desired folder see Figure 36 4 3 1 Scheduled updating of the anti virus database To enable automatic updating of your anti virus database check the Automatically update anti virus d...

Page 52: ...s enabled or disabled The Status field displays the current updating status 4 3 3 Configuring database updating on a single server If centralized updating is disabled in the Properties of Kaspersky An...

Page 53: ...for Microsoft ISA Server h1 p The requested URL URL is infected with VIRUSNAME virus p body html The following extensible variables are used in the message text URL the URL of the Internet resource r...

Page 54: ...st anti virus products identify this file as a virus Never use real viruses to test the operation of an anti virus product You can download the test virus from the official website of the EICAR organi...

Page 55: ...and select Use local computer counters if ISA Server is managed from an ISA Server computer or Select counters from computer if ISA Server is managed from a remote administrator s workstation 2 From...

Page 56: ...to the following files windir System32 PERFCxxx DAT windir system32 PERFHxxx DAT Read access to the following registry keys HKEY_LOCAL_MACHINE Software Microsoft WindowsNT CurrentVersion Perflib HKEY...

Page 57: ...r Microsoft Networks checkbox in My Network Places Properties LAN Properties 4 6 2 Notifying the administrator using ISA Server Alerts Using ISA Server Alerts system tools you can notify administrator...

Page 58: ...mation about application performance during the desig nated time period In the file name DATE is the date of creation of this file in the format YearMonthDate for example kavisa20040410 log If the pro...

Page 59: ...s database Licensing etc The right pane shows types of messages generated by Kaspersky Anti Virus for the selected task and their detail level For any type of messages you can select one of the follow...

Page 60: ...ve not yet decided to purchase a full version of Kaspersky Anti Virus we can provide you with a trial key valid for two weeks or a month After the trial period expires the key will be blocked and will...

Page 61: ...a license key On the Licensing tab see Figure 42 in the Current license key field click Add Replace and select the current license key file key in the dialog box that appears on your screen Figure 42...

Page 62: ...after the previous key expires Thus you will be able to keep your server constantly protected from viruses To install a reserve key click Add in the Reserve license key field see Figure 42 and select...

Page 63: ...key or Purchase a license key at Kaspersky Lab Write a letter of request di rectly to the Sales Department of our company sales kaspersky com or fill in the corresponding form on our website http www...

Page 64: ...his the computer is automatically connected to the centralized management system and you can manage the application from any computer on which the Administration Console of Kaspersky Administration Ki...

Page 65: ...ortcut menu and on the Action menu The tasks executed on every client computer have the settings that depend on the group policy task settings and the settings of this application on the client The ta...

Page 66: ...tab When you click Add a New Task Wizard opens The New Task Wizard has the interface similar to a standard Windows Wizard Use the Back and Next buttons to switch between steps each displayed in a sep...

Page 67: ...ify the path to the license key file using the Browse button Figure 45 In the fields below you will see general information about the license key to be installed Figure 45 Creating a local task Specif...

Page 68: ...that have enough tights to execute this task This allows the administrator to avoid errors when executing tasks in case the user who has run the task does not have appropriate access rights Figure 46...

Page 69: ...Refer to the Kaspersky Administration Kit 5 0 Administrator s Guide for a full description of this dialog box Step 6 Completing task creation In the last dialog box the wizard informs you that the tas...

Page 70: ...different folders or all com puters in the current folder for detail see the Kaspersky Administra tion Kit 5 0 Administrator s Guide Global tasks will be executed only on the specified clients The ap...

Page 71: ...ll computers on which this task will be applied All tabs except for Settings and Schedule are standard tabs for Kaspersky Administration Kit 5 0 See their full description in the Kaspersky Administrat...

Page 72: ...al or shared folder In this case specify the full path to the update folder in the corresponding field below Figure 48 Configuring settings of the database update task The Settings tab On the Schedule...

Page 73: ...g and stopping tasks Tasks are launched on a client only if the corresponding application is running When the application is disabled all running tasks are can celled Tasks are started and stopped aut...

Page 74: ...that includes the required client computer 2 In the details panel select the computer on which the target appli cation is installed Click the Properties command on the shortcut menu or on the Action m...

Page 75: ...Configure the application settings When you click the Proper ties button a dialog box containing the following tabs opens General Anti Virus server Groups Policies HTTP FTP Anti Virus Licenses Event...

Page 76: ...75 Kaspersky Anti Virus 5 6 for MS ISA Server 2000 Enterprise Edition Figure 51 Configuring application settings The General tab...

Page 77: ...you can change the Kaspersky Anti Virus settings affecting the performance of every server The options on this tab are the same as those on the Anti Virus tab see Figure 16 At the lower part of the ta...

Page 78: ...The Anti virus server tab On the Groups tab see Figure 54 you can modify a list of group of clients on the local network to which the same policies can be applied You can add a new group to the list r...

Page 79: ...ti Virus for ISA Server 78 Figure 54 Configuring application settings dialog box The Groups tab On the Policies tab see Figure 55 you can manage policies applicable to the groups of clients see sectio...

Page 80: ...tion 4 2 1 2 on page 27 for a description of this tab On the FTP tab you can regulate the ISA Server data received by the FTP and FTP over HTTP protocols See section 4 2 1 3 on page 29 for a descripti...

Page 81: ...r ISA Server 80 Figure 56 Configuring application settings dialog box The Licenses tab The Event processing tab Figure 57 displays events that occurred during application operation and were logged by...

Page 82: ...tes a list of events see Table 2 Each event can be of one of the following severity levels Critical Error Warning Info The events of the same type can be of different severity level depending on the s...

Page 83: ...s expired Warning Web filter is running Info Web filter is stopped Info FTP filter is running Info FTP filter is stopped Info HTTP filter is running Info HTTP filter is stopped Info For each event you...

Page 84: ...requent in the geographic location of the anti virus vendor and file formats that require complicated analysis e g PDF from their databases In contrast Kaspersky Lab believes that the purpose of its a...

Page 85: ...g the old anti virus database If this situation occurs inform your system administrator or contact the distributor who sold you the product or directly Kaspersky Lab Ltd Question Anti virus scanning i...

Page 86: ...ee Appendix A Question What are the daily updates for A few years ago viruses were transmitted on floppy disks and adequate computer protection could be achieved by installation of an anti virus progr...

Page 87: ...e LAN unites computers protected by Kaspersky Lab products Any computer on the LAN can be turned into an updates server that retrieves updates from the Internet and shares them with the other networke...

Page 88: ...ed through another proxy server or without us ing a proxy make sure that the ISA Server Firewall filter only in In tegrated and Firewall modes allows the updating application to ac cess the Internet I...

Page 89: ...atabase If the signature is wrong or the date of the database is later than that of the license expi ration Kaspersky Anti Virus will not use it Question Does Kaspersky Anti Virus 5 6 for Microsoft IS...

Page 90: ...y describe the problem For example Microsoft Windows 2003 Server Kaspersky Anti Virus for Microsoft ISA Server 2000 Enterprise Edition updating does not work 2 Compose your messages in plain text form...

Page 91: ...They can only help after fully understanding and reproducing it 5 Send the following data to the Technical support service pack them in one archive before sending All anti virus log files stored in t...

Page 92: ...their detection and disinfection At Kaspersky Lab the database is updated immediately after new viruses appear Therefore system administrators must regularly update the anti virus database C Client i...

Page 93: ...urrent and even future threats Resistance to future attacks is the basic policy implemented in all Kaspersky Lab s products At all times the company s products remain at least one step ahead of many o...

Page 94: ...ormance of the application Kaspersky Anti Virus Personal provides reliable protection against viruses that attempt to penetrate computers via e mail messages The application provides automatic scannin...

Page 95: ...ernal hacker attacks from either the Internet or the local network Kaspersky Anti Hacker monitors the TCP IP network activity of all applications running on your machine When it detects a suspicious a...

Page 96: ...rovides a configurable security solution for small and medium sized corporate networks Kaspersky Anti Virus Business Optimal includes full scale anti virus protection4 for Workstations running Windows...

Page 97: ...he Kaspersky Corporate Suite distribution kit includes Kaspersky Administration Kit a unique tool for automated deployment and administration You are free to choose from any of these anti virus applic...

Page 98: ...nt of the letter including the Subject and attached files as well as unique linguistic and heuristic algorithms The application s high performance is enhanced by daily updates to the content filtratio...

Page 99: ...E WITH THE LEGISLATION REGARDING KASPER SKY SOFTWARE INTENDED FOR INDIVIDUAL CONSUMERS KASPERSKY ANTI VIRUS PERSONAL KASPERSKY ANTI VIRUS PERSONAL PRO KASPERSKY ANTI HACKER KASPERSKY SECU RITY FOR PDA...

Page 100: ...pies contain all of the Software s proprietary notices You shall maintain records of the number and location of all copies of the Software and Documentation and will take all reasonable precautions to...

Page 101: ...make use or install as many additional copies of the Software on the number of Client Devices as the volume license terms specify You must have reasonable mechanisms in place to ensure that the numbe...

Page 102: ...ssession installation or use of the Software does not transfer any title to the intellectual property in the Software to you and you will not acquire any rights to the Software except as expressly set...

Page 103: ...ocumentation which might but for this paragraph vi have effect between the Kaspersky Lab and you or would otherwise be implied into or incorporated into this Agreement or any collateral contract wheth...

Page 104: ...been given or may be implied from anything written or said in negotiations between us or our representatives prior to this Agreement and all prior agreements between the parties relating to the matte...

Reviews: