manualshive.com logo in svg
background image

 

KASPERSKY LAB 

Kaspersky Anti-Virus

® 

 5.5  

for Check Point

TM

 Firewall-1

®

 

Administrator's Guide 

Содержание ANTI-VIRUS 5.5 - FOR CHECK POINT FIREWALL-1

Страница 1: ...KASPERSKY LAB Kaspersky Anti Virus 5 5 for Check PointTM Firewall 1 Administrator sGuide...

Страница 2: ...K A S P E R S K Y A N T I V I R U S 5 5 F O R C H E C K P O I N T T M F I R E W A L L 1 Administrator s Guide Kaspersky Lab Ltd http www kaspersky com Revision date November 2006...

Страница 3: ...3 INSTALLING AND REMOVING THE APPLICATION 18 3 1 Installing the application 18 3 1 1 First time installation 19 3 1 2 Reinstalling the application 22 3 2 Removing the application 22 CHAPTER 4 INTEGRA...

Страница 4: ...1 Actions performed with objects transferred via HTTP protocol 61 7 1 2 Actions performed with objects transferred via FTP protocol 62 7 1 3 Actions performed with objects transferred via SMTP protoco...

Страница 5: ...cense key details 105 11 3 License related notifications 107 11 4 Installing the license key 107 11 5 Removing a license key 108 CHAPTER 12 NOTIFICATIONS 110 CHAPTER 13 FREQUENTLY ASKED QUESTIONS 114...

Страница 6: ...its important element the issue of protection of the corporate mail servers against the external threats preventing virus outbreaks within the corporate networks 1 1 Computer viruses and malicious so...

Страница 7: ...ertising messages As a rule adware is integrated into freeware programs The advertising component is located in the interface Adware programs are often used to gather users personal information and se...

Страница 8: ...s required 1 2 Purpose main functions and structure of Kaspersky Anti Virus Kaspersky Anti Virus for Check Point TM Firewall 1 hereinafter referred to as Kaspersky Anti Virus is a system that provides...

Страница 9: ...f objects infected with these viruses and description of potentially dangerous programs riskware As new viruses are created daily it is extremely important that you maintain your anti virus database u...

Страница 10: ...e security level of the stream passing through the firewall and the Anti Virus load during the scan Configurable filters allow to easily locate the original copies of objects for example for their sub...

Страница 11: ...ll 1 versions NG NG AI and NGX For the installation and operation of the application components the software and hardware of your computer must comply with the following minimum requirements Managemen...

Страница 12: ...higher Microsoft Windows Server 2003 Enterprise Edition or higher 1 5 Distribution kit You can purchase Kaspersky Anti Virus either from our dealers retail box or online for example visit http www kas...

Страница 13: ...vice package enabling them to use Kaspersky Anti Virus more efficiently After purchasing a subscription you become a registered user and during the period of your subscription you will be provided wit...

Страница 14: ...formation requiring special attention In order to perform Step 1 Description of the successive user s steps and possible actions Task example Statement of a problem example of the demonstration of the...

Страница 15: ...ication in accordance with OPSEC TM standards and by default supports protected data transfer protocol The Security Server can be installed either on one computer with Check PointTM Firewall 1 or on a...

Страница 16: ...ed to this Security Server by Check Point TM Firewall 1 The number of instances of Kaspersky Anti Virus installed in the network will be determined by the number of installed Se curity Servers 2 Perfo...

Страница 17: ...0 page 98 and Chapter 9 page 89 Configure notifications about the results of anti virus object scan anti virus database updates report creation forthcoming expiration of the license change of the appl...

Страница 18: ...and Management Console on the computer on which the setup wizard is run You can select either complete or custom installation of the application or repair an invalid installation of Kaspersky Anti Vir...

Страница 19: ...version install all required Service Packs and start the installation of Kaspersky Anti Virus one more time Step 2 Greeting and License Agreement First steps of the installation process are standard a...

Страница 20: ...zard will display reference information about the selected component and the disk space required for its installation Step 5 Selecting the data folder During the installation of the Security Server th...

Страница 21: ...that without the license key the anti virus functionality of the application will not be available and you will only be able to launch the Management Console During this step Kaspersky Anti Virus 5 5...

Страница 22: ...operation In order to reinstall the application select the Repair option in the win dow that will open This will start reinstallation of Kaspersky Anti Virus which will use the same settings as the pr...

Страница 23: ...servers each server must be integrated with Security Check Point TM Firewall 1 4 1 Registering Security Server with Check PointTM Firewall 1 Registering OPSEC TM applications is described in detail in...

Страница 24: ...tion New in the General tab of the OPSECTM Application Properties settings configuration window see Figure 2 perform the following Using the Name entry field enter the name of the OPSECTM application...

Страница 25: ...ted by the application Configuring the protocols settings is not required Kaspersky Anti Virus uses the default Check Point TM Firewall 1 settings If the configuration of Check PointTM Firewall 1 in t...

Страница 26: ...subject to the anti virus scan Kaspersky Anti Virus scans the data passing through the firewall via HTTP FTP and SMTP protocols Create the following a URI resource for transferring the HTTP protocol d...

Страница 27: ...tion of Kaspersky Anti Virus with Check PointTM 27 Figure 3 Creating a URI resource The CVP tab to create an FTP resource check the GET and the PUT boxes in the Methods section on the Match tab see Fi...

Страница 28: ...rus 5 5 for Check PointTM Firewall 1 Figure 4 Creating an FTP resource The Match tab to create a URI resource select the Enforce URI capabilities option in the Use this resource to section on the Gene...

Страница 29: ...SMTP and FTP resources This parameter controls the possibility of disinfection and re placement of objects detected during the anti virus scan see section 7 1 page 60 If the box is not checked disinfe...

Страница 30: ...lease take into account the following restrictions when creat ing a SMPT resource the size of messages redirected by Check Point TM Fire wall 1 for the anti virus scan displayed in the Do not send mai...

Страница 31: ...Integration of Kaspersky Anti Virus with Check PointTM 31 Figure 6 Configuring the SMTP resource settings The Action2 tab...

Страница 32: ...ning the certificate is a standard procedure for applications integrated with Check Point TM Firewall 1 This procedure is performed using special utility opsec_pull_cert exe designed for obtaining cer...

Страница 33: ...for secure connection to Check PointTM Firewall 1 were configured path to the certificate file full path to the file where the Security Server certificate received from Check PointTM Firewall 1 will...

Страница 34: ...Virus 5 5 for Check PointTM Firewall from the standard Start Pro grams Windows menu This programs group is created only on the ad ministrator s workstations when the Management Console is installed 5...

Страница 35: ...s used for viewing general settings of Kaspersky Anti Virus operation license details and information about installed license keys renewing the license and the configuring the application operation di...

Страница 36: ...cular object The list of objects and the corresponding set of commands accessible via the context menu are provided in the table below Object Command Purpose Kaspersky Anti Virus 5 5 for Check PointTM...

Страница 37: ...onsole and the Security Server In order to add a new server to the list of monitored servers 1 Select the Kaspersky Anti Virus 5 5 for Check PointTM Firewall 1 node in the console tree open the shortc...

Страница 38: ...red and the node structure will include nested folders Backup Storage and Report Templates If the connection have not been established or could not be established the server will be flagged with the i...

Страница 39: ...ty Server the user must have the local administrator s right on the computer to which the connection is at tempted The rights verification is performed based on the standard Windows network user authe...

Страница 40: ...onfigure the settings will be the same In order to configure the settings for interaction between the Security Server and Check Point TM Firewall 1 1 Select the node corresponding to the required serv...

Страница 41: ...the data will not be encrypted If the list does not contain the required value enter it manually If protocols that require keys for encryption are used for au thentication the key files must be locate...

Страница 42: ...t is displayed in the settings configuration window of Check PointTM Firewall 1 Network Objects Check Point TM GeneralProperties in the DN field section Secure Internal Communication Specify the full...

Страница 43: ...on This will open the Configuring additional OPSEC TM settings window see Figure 11 Enter the description of the required settings and press the OK button An example of such settings for CVP and AMON...

Страница 44: ...ion has been received within this period of time the Security Server will disconnect from Check Point TM Firewall 1 The connection will be established later when Check PointTM Firewall 1 transfers dat...

Страница 45: ...the events that happened while the con nection was out will be transferred to Check Point TM Fire wall 1 immediately after the connection is restored Information about the following events will be sen...

Страница 46: ...Anti Virus will start working with the minimum set of settings most of which are default optimum settings recommended by the Kaspersky Lab s experts If necessary depending on the network properties a...

Страница 47: ...disinfected the application will block ac cess to it and display an information message of the following format Kaspersky Anti Virus 5 5 for Check Point TM Firewall 1 Requested address path to the res...

Страница 48: ...Computer Antivirus Research specifically for testing anti virus products The test virus IS NOT A VIRUS because it does not contain code that can harm your computer However most anti virus products man...

Страница 49: ...disinfected and will perform an action specified in the HTTP traffic settings for this type of objects By default see section 5 7 page 47 if you attempt to download the test virus connection with the...

Страница 50: ...e saved in the backup storage 5 8 4 Testing the FTP traffic protection In order to detect viruses in the data stream transferred via FTP proto col 1 Copy the test virus to a location that you can acce...

Страница 51: ...ternet sites automatic dialing programs that connect the user s computer to porn websites automatic porn files downloading programs keyboard spies password hacking programs backdoor programs c Joke pr...

Страница 52: ...rsky Anti Virus 5 0 for File Servers see section 6 2 page 55 Updates are downloaded either according to the schedule or manually In order to download the anti virus database from the internet your com...

Страница 53: ...see section 6 3 page 56 If updates are required immediately press the Update now button details see section 6 4 page 57 to download the updates manually Before performing manual updating make sure th...

Страница 54: ...n see Figure 13 and select Kaspersky Lab s updating servers default option as the source of updates 3 After this press the Configure settings button and specify the network connection settings in the...

Страница 55: ...the Kaspersky Administration Kit 5 0 centralized management system to control Kaspersky Lab s applications installed on your network computers then the anti virus updates received by the Administratio...

Страница 56: ...from the local folder 6 3 Automatic updates In order to update the anti virus database in the automatic mode 1 Select the node corresponding to the required server in the console tree and follow the...

Страница 57: ...update the anti virus database in the manual mode 1 Select the node corresponding to the required server in the console tree and follow the Anti virus scan link in the results pane 2 Press the Update...

Страница 58: ...ver protection is enabled details see section 7 3 page 63 then starting and stopping of the traffic scan will be performed simultaneously with the startup and shutdown of the computer on which the Sec...

Страница 59: ...ti Virus provides an option of blocking access to objects that are transferred in parts see section 7 4 page 65 This option is not provided for FTP protocol and in order to minimize the possibility of...

Страница 60: ...objects in RAM allows scanning objects without saving them to a work folder on the hard drive Depending on the scan settings the application can simultaneously scan up to 1000 objects up to 1024 KB ea...

Страница 61: ...If the object cannot be disinfected apply the action specified for objects that cannot be disinfected Disinfect save a copy disinfect pass the object to the use once disin fected save a copy of the or...

Страница 62: ...object as a result a data transfer error mes sage will be displayed in the FTP client window Block save a copy block access to the object save a copy of the origi nal object in the backup storage As a...

Страница 63: ...lied by default Extended anti virus protection level protection against all currently known malicious and potentially dangerous programs included under b in the Updating the anti virus database list o...

Страница 64: ...Standard anti virus protection Extended anti virus protec tion or Redundant anti virus protection in order to enable anti virus protection and apply the required protection level The use of the exten...

Страница 65: ...P traffic settings link in the results pane Configure the anti virus operation settings for scanning HTTP traffic on the tabs of the HTTP traffic scan settings window that will open see Figure 17 2 On...

Страница 66: ...s to access the object again within the specified interval the access to the object will be granted or the user will receive a notification about the result of the last scan of this object By default...

Страница 67: ...ld The greater the value of this setting the less will be the possibility of infection when passing unscanned data to the user The suggested default value is 10 In order to allow delivery of files dow...

Страница 68: ...at involves replacement of the object you must create a replacement template In order to do this press the Notification template button and enter the notification text in the window that will open see...

Страница 69: ...copies of disinfected objects and the objects that cannot be disinfected will also be saved if the Skip make no changes action is selected for such ob jects Figure 19 Creating the replacement templat...

Страница 70: ...ngs button In order to disable scanning data transferred via HTTP protocol uncheck the Scan HTTP traffic box on the Settings tab of the HTTP scan settings window see Figure 17 and press the Apply or t...

Страница 71: ...see section 7 4 page 65 Figure 21 FTP traffic scan settings The Settings tab 2 In order to ensure that the scan will be performed check the Scan FTP traffic box see Figure 21 After this specify values...

Страница 72: ...re 22 FTP traffic scan settings The Actions tab 4 On the Exclusions tab see Figure 23 provide the list of objects that will not be scanned for the presence of malicious code In order to do this check...

Страница 73: ...ransferred via FTP protocol uncheck the Scan FTP traffic box on the Settings tab of the FTP scan settings window see Figure 21 and press the Apply or the OK button 7 6 Scanning SMTP traffic In order t...

Страница 74: ...ox see Figure 24 on the Settings tab Figure 24 SMTP traffic scan settings The Settings tab 3 Specify which actions will be performed upon detection of infected suspicious protected and corrupted objec...

Страница 75: ...rder to disable scanning data transferred via SMTP protocol uncheck the Scan SMTP traffic box on the Settings tab of the SMTP scan settings window see Figure 24 and press the Apply or the OK button 7...

Страница 76: ...usly You can set this value in the range between 1 to 32 Microsoft recommends that you set up a value that is not greater then 4 multiplied by the number of the processors on the computer on which the...

Страница 77: ...led The total volume of the objects being scanned shall not ex ceed the amount of free RAM The size of the queue of objects to be scanned the maximum number of objects being scanned and waiting to be...

Страница 78: ...rom the scan scope does not affect settings used to scan other types of containers 3 In order to apply the changes press the Apply or the OK button The settings for scanning objects in RAM will be app...

Страница 79: ...lder It is created in the application s data folder during the installation of the Security Server The amount of information that can be stored in the backup storage may be restricted by the following...

Страница 80: ...view the backup storage select the Backup Storage folder in the console tree After this a table containing the full list of all objects contained in the backup storage will appear in the results pane...

Страница 81: ...detected Exact date and time when the object was detected by Kaspersky Anti Virus You can perform ascending and descending sorting of the data contained in the table by any column 8 2 Backup storage...

Страница 82: ...filter name The following information about the object can be used to configure the parameters object status multiple values can be selected the type of protocol that was scanned when the object was...

Страница 83: ...e tree inside the Backup Storage folder When the filter is selected in the console tree only data that complies with the filter criteria will be displayed in the results pane Later you can alter value...

Страница 84: ...are removed from the backup stor age Objects that meet the filter parameters will still be available in the Backup Storage folder 8 3 Restoring objects from the backup storage In order to restore an...

Страница 85: ...tion of the object a cor responding notification will be displayed We recommend that you restore only objects with the suspi cious or protected corrupted status During the next scan for example with K...

Страница 86: ...been reached and there is not enough space for storing a new object The application will then delete the number of older objects required to free the space needed A possibility to manually remove obj...

Страница 87: ...ent The settings of the backup storage are determined by default and can be altered by the administrator In order to modify the settings of the backup storage 1 Select the Backup Storage folder in the...

Страница 88: ...32 Configuring the backup storage settings 4 In order to apply the changes press the Apply or the OK button For exit without saving the changes made press the Cancel button You can restore the defaul...

Страница 89: ...a possibility to configure notifications about the results of report creation see Chapter 12 on page 110 The default storage location for the reports is the Reports folder This folder is located in th...

Страница 90: ...rent stage of the report creation the report status may have one of the following values being created since time and date for scheduled report genera tion created date and time of the report creation...

Страница 91: ...template you need in the table displaying the list of created templates see Figure 33 3 Open the shortcut menu and use the Create a report command or the analogous command under the Action menu A rep...

Страница 92: ...ettings Check the Store statistics box Specify the information storage period and select the time unit 4 After you have made the changes press the Apply or the OK button to apply the new settings The...

Страница 93: ...template name in the Name field Specify whether reports will be automatically created based on this template In order to do this check or uncheck the Create reports box If required enter a more detail...

Страница 94: ...e pe riod option in the Reporting period group and specify the desired date in the From and To fields In order to create a schedule perform the following in the Frequency section o Select the report c...

Страница 95: ...folder 2 Select and open an html file with the name corresponding to the date and time of report creation in the following format DD MM YYYY_HH MM SS As a result the system default browser will be loa...

Страница 96: ...he selected section are displayed in the right frame In order to view a particular section select this section s name in the table of contents and the content of the section will be loaded in the righ...

Страница 97: ...e selected template will be displayed Reports are viewed using the default system browser 5 If no reports were created based on the selected template an information message will be displayed see Figur...

Страница 98: ...the log files have the following naming convention Kav4Cpf1_DATE log Kaspersky Anti Virus log that contains information about the application s operation provided with the extent of detail that was sp...

Страница 99: ...e diagnostics level For each component of the program there is a set of diagnostic messages that will be entered into the logs The information volume and the extent of detail will be determined by the...

Страница 100: ...the groups Only diagnostic messages of group Scan Results for the Fil ters component will be entered into the results log Messages of this group are not registered in the application s operation log S...

Страница 101: ...cs tab in the General parameters window that will open see Figure 39 3 Enter the path to the new folder in the Log files folder field 4 Select the frequency for creating logs in the Start a new file o...

Страница 102: ...ictions imposed on the use of Kaspersky Anti Virus that can be verified by the special application s utilities If any violation of the terms and conditions of the license agreement have been detected...

Страница 103: ...or Check PointTM Firewall 1 or Purchase a new license key directly from Kaspersky Labs In order to do this send a request directly to the Sales Department of our company sales kaspersky com or fill in...

Страница 104: ...neral settings link in the results pane 2 Go to the General tab in the General parameters window that will open see Figure 40 Figure 40 Viewing license information The tab contains the following infor...

Страница 105: ...triction on the number of protected workstations or by the expiration of the trial license key o Update only Only anti virus database updating feature is available The anti virus database may have bee...

Страница 106: ...tion License expiration date Serial number The maximum number of protected workstations The following license key details are displayed in the Backup li cense key section License expiration date Seria...

Страница 107: ...cations about the forthcoming license expiration in the Anti Virus settings see Chapter 12 on page 110 By default a notification is issued 14 days prior to the license expiration date You can configur...

Страница 108: ...erver in the console tree and follow the General settings link in the results pane 2 Go to the License keys tab in the General settings window that will open see Figure 41 3 On the License keys tab if...

Страница 109: ...tab if you are removing the backup license key press the Remove button in the Backup license key section if you are removing the current license key press the Remove button in the Current license key...

Страница 110: ...after the license is renewed Additionally Kaspersky Anti Virus allows the possibility to automatically launch applications specified by the administrator on the Security Server when certain types of...

Страница 111: ...neral settings window that will open see Figure 42 3 On this tab in the field corresponding to the required event specify the full path to the module that will be launched on the Security Server when...

Страница 112: ...as successfully created Address of the sender and the recipient address and number of the SMTP server port and the message subject are specified in the script variables These settings must be configur...

Страница 113: ...Notifications 113 events has its own set of variables the complete list of variables is provided in Appendix A on page 118...

Страница 114: ...erall scanning time Unlike other anti virus software vendors that try to reduce the overall scan time by excluding from their databases viruses that are less easily detectable or less frequent in the...

Страница 115: ...d that you contact the dealer you purchased your copy of Kaspersky Anti Virus from or send an e mail message to our Technical support service support kaspersky com or at the address specified in your...

Страница 116: ...to ensure adequate computer protection Yet the recent virus outbreaks spread over the world in a matter of sev eral hours and anti virus software using old anti virus databases may not be able to prot...

Страница 117: ...w the update service may use the Mi crosoft Internet Explorer settings incorrectly internet settings are not configured on your computer Microsoft Internet Explorer settings are not available if no us...

Страница 118: ...iption Settings passed Anti virus object scan Anti virus object scan completed kav4cpf1_event object kav4cpf1_scan cured in fected suspicious other cured disinfected infected infected suspicious suspi...

Страница 119: ...e kav4cpf1_bases date_and_time_of_creation_of_ant i vi rus_database_used_by_application kav4cpf1_error empty kav4cpf1_time event_occurrence_time Anti virus database update resulted in an error Anti vi...

Страница 120: ...kav4cpf1_error er ror_description kav4cpf1_time event_occurrence_time Forthcoming expiration of the license License expiration notification period specified in the Kaspersky Anti Virus settings has b...

Страница 121: ...ration or anti virus database corruption kav4cpf1_event status kav4cpf1_error disabled kav4cpf1_time event_occurrence_time Security Server component not started or not initialized kav4cpf1_event statu...

Страница 122: ...ication data folder the folder in which service folder and databases required for the application to operate are stored If you change the data folder all information stored in this folder must be save...

Страница 123: ...o the object i e if it is the first action to be performed on an object after it is detected a backup copy of such object will be created before this ac tion is performed Part of the data may be lost...

Страница 124: ...plate a template used to create a text notification about infected objects detected or about a threat of a virus outbreak Report template a template used to create reports on the results of the anti v...

Страница 125: ...of parameters that determine the virus activity level threshold the distri bution method and the text of notifications to be sent Virus activity level threshold a maximum allowable number of events of...

Страница 126: ...e protection from current and future threats Resistance to future attacks is the basic policy implemented in all Kaspersky Lab s products At all times the company s products remain at least one step a...

Страница 127: ...erably increases the speed of the program s operation The application creates a reliable barrier against viruses when they attempt to intrude your computer via e mail Kaspersky Anti Virus Personal per...

Страница 128: ...any Microsoft Windows operating system It protects your computer against unauthorized access and external hacker attacks from either the Internet or the local network Kaspersky Anti Hacker monitors t...

Страница 129: ...s server of Kaspersky Lab with specified frequency The product performs the following functions It visualizes in the system tray the current status of virus activity The product allows the users to su...

Страница 130: ...traffic on the level of data transmission protocol POP3 IMAP and NNTP for incoming mail and SMTP for out going messages irrespectively of the mail client being used as well as disinfection of e mail...

Страница 131: ...and start up objects of Microsoft Windows Proactive protection the program performs constant monitoring of ap plication activity and processes running in random access memory pre venting dangerous cha...

Страница 132: ...ts your handheld PDA from unauthorized intrusion by encrypting both access to the device and data stored on memory cards Kaspersky Anti Virus Business Optimal This package provides a unique configurab...

Страница 133: ...indows 2000 2003 Server Advanced Server Novell Netware FreeBSD OpenBSD Linux and Samba Servers E mail systems including Microsoft Exchange Server 2000 2003 Lotus Notes Domino Sendmail Postfix Exim and...

Страница 134: ...ng and outgoing mail messages as well as messages stored at the server including letters in public folders and filters out unsolicited correspondence using smart spam recognition techniques in combina...

Страница 135: ...o Check Point products 2005 Check Point Software Technologies Ltd All rights reserved Check Point Application Intelligence the Check Point logo FireWall 1 OPSEC and SmartDashborard are trademarks or r...

Страница 136: ...OF THIS AGREEMENT DO NOT BREAK THE CD s SLEEVE DOWNLOAD INSTALL OR USE THIS SOFTWARE IN ACCORDANCE WITH THE LEGISLATION REGARDING KASPER SKY SOFTWARE INTENDED FOR INDIVIDUAL CONSUMERS KASPERSKY ANTI V...

Страница 137: ...lient Device or by more than one user at a time except as set forth in this Section 1 1 1 The Software is in use on a Client Device when it is loaded into the temporary memory i e random access memory...

Страница 138: ...plexing or pooling software or hardware front end If the number of Client Devices or seats that can connect to the Software exceeds the number of licenses you have obtained then you must have a reason...

Страница 139: ...the Kaspersky Lab Privacy Policy which is deposited on ww kaspersky com privacy and you explicitly consent to the transfer of data to other countries outside your own as set out in the Privacy Policy...

Страница 140: ...nformation as may be reasonably necessary to assist the Supplier in resolving the defective item v The warranty in i shall not apply if you a make or cause to be made any modifications to this Softwar...

Страница 141: ...er hereof and supersedes all and any prior understandings undertakings and promises between you and Kaspersky Lab whether oral or in writing which have been given or may be implied from anything writt...

Отзывы: