User manual KASPERSKY LAB ANTI-VIRUS CORPORATE SUITE

[. . . ] KASPERSKY LAB KasperskyTM Corporate Suite ANTI-VIRUS SOLUTION KASPERSKY CORPORATE SUITE Anti-Virus Solution KASPERSKY LAB LTD Visit our WEB site: http://www. kaspersky. com/ C ne t o t ns 1. KASPERSKYTM CORPORATE SUITE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2. 1. AND MAIN FUNCTION OF THE SOFTWARE PACKAGE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 COMPONENTS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [. . . ] The built-in Mail Checker efficiently deletes viruses from e-mail messages, and completely recovers the original contents. 2. 1. 3. Comprehensive control over e-mail messages KasperskyTM Anti-Virus for Wintel workstations automatically checks for viruses in all elements of incoming and outgoing messages: the message body, embedded OLE objects, attached files (including archived or compressed files) and other messages of any nesting level. 2. 1. 4. Protecting against macro-viruses KasperskyTM Anti-Virus for Wintel contains special modules controlling macroinstructions that are executed. The unique macro control technology using the concept of behavior blocker allows the program to prohibit macro-viruses from being executed. 2. 1. 5. Monitoring data-integrity Inspector, the KasperskyTM Anti-Virus for Wintel workstations built-in integrity checker traces all changes on the local computer in background: appearance of new, deletion and modification of existing files and more. The program implements the control by calculating mathematical values known as checksums or CRC values (for Cyclic Redundancy Code) for disk sectors and files, and subsequently checking these against the existing copy of appropriate file/sector. If a virus-incidental action (such as unauthorized changes in a file or the system registry) is detected, the module allows removal of the malicious code and recovery of the original disk contents. 2. 1. 6. Protecting data storage locations The anti-virus KasperskyTM AV Scanner allows for the comprehensive check of local and network drive contents on-demand. You may run your scanner 10 PROTECTING WORKSTATIONS manually or schedule its start using KasperskyTM AV Control Centre included in the package. 2. 1. 7. Intercepting script-viruses To protect the user from script-viruses the package uses the built-in Script Checker module that completely solves this problem by integrating itself as a filter in-between the script-virus and its handler. This enables you to check for viruses in any script before it is executed. 2. 1. 8. Centralized deployment and management KasperskyTM Anti-Virus for Wintel is completely integrated in the unique system of anti-virus protection management. Kaspersky Administration Kit enables you to centrally install and control KasperskyTM Anti-Virus for NT Server from any (including the remote) computer; to define a timetable and an order in which the modules must be started; to automatically retrieve and enable antivirus database updates via the Internet; to broadcast notifications on virus attacks; to review virus-check logs on workstations; and control access rights to change the program configuration. 2. 1. 9. Automated updating The KasperskyTM AV Updater module allows for automated updating of anti-virus databases containing virus and remedy definitions, and of the software package components. 2. 1. 10. Universal boot system The product contains the built-in Rescue Disk Set module ­ a boot system that allows you to restore your PC at work in case it has been completely disabled as the result of a virus attack. Rescue Disk Set creates a set of Linux-based bootable diskettes with pre-installed KasperskyTM Anti-Virus for Linux. This allows you to perform a "clean boot" and to restore infected hard disks with all 11 KASPERSKY CORPORATE SUITE the commonly used file systems at once: FAT (DOS), FAT32 (Windows 95/98), NTFS (Windows NT/2000), HPFS (OS/2), EXT (Linux). 2. 2. Two-level anti-virus protection KasperskyTM Anti-Virus for OS/2 provides your computer with a two-level antivirus protection. The first level is an anti-virus scanner that may be started on demand or from a third-party scheduler. On the second level, viruses are neutralized with the world's first and only anti-virus monitor protecting all active processes in OS/2 from viruses in real-time. Combined use of these tools allows you full control over all virus propagation sources. The program successfully fights all types of malicious programs, including Internet-worms, Trojans, and computer viruses including viruses that were specially developed for OS/2. 2. 2. 2. Compliant with the most popular OS/2 versions KasperskyTM Anti-Virus for OS/2 may be used under the most popular versions of this operating system, including Warp, Merlin and Aurora. 2. 2. 3. User-friendly KasperskyTM Anti-Virus for OS/2 contains the simple and user-friendly Presentation Manager graphic interface. It utilizes the step-by-step method, offering a user recommendations for the next step. Main functions of the program can be activated by the touch of a single key. 12 3 3. Real-time protection Chapter KasperskyTM Anti-Virus for 2000/NT Server includes a background virus interceptor, KasperskyTM AV Monitor that permanently resides in the computer memory checking all used files (e. g. The module also allows checking-in the memory of running programs right after it is loaded, and also every time you update your anti-virus bases. If the infected memory of a program cannot be disinfected, this program is forced to abort the performance. 3. 1. 2. Centralized deployment and management The product is completely integrated in the unique system of anti-virus protection control that was originally developed in Kaspersky Lab. KasperskyTM AV Control Centre (client subsystem) and Network Control Centre (network sub13 KASPERSKY CORPORATE SUITE system) enable you to centrally install and control KasperskyTM Anti-Virus for NT Server from any (including the remote) computer; to define a timetable and an order in which the modules must be started; to automatically retrieve and enable anti-virus database updates via the Internet; to broadcast notifications on virus attacks and review virus-check logs. 3. 1. 3. Protecting data storage locations The anti-virus KasperskyTM AV Scanner allows for the comprehensive check of local and network drive contents on-demand or as scheduled. Combined use of KasperskyTM AV Scanner and KasperskyTM AV Monitor allows you full control over all virus propagation sources on your network. 3. 1. 4. Quarantine of dangerous and suspicious objects KasperskyTM Anti-Virus for 2000/NT Server has a special quarantine feature allowing to isolate infected and suspicious objects in a safe place and subsequently move the objects to a quarantine directory defined by a network administrator. 3. 1. 5. Virus alerts broadcasting If KasperskyTM Anti-Virus detects a virus trying to enter the server, it informs the system administrator and/or a group of users by sending a user-defined alert message to the pre-set addresses. 3. 1. 6. Automated updating The KasperskyTM AV Updater module allows for automated updating of anti-virus databases containing virus and remedy definitions, and of the software package components. 14 PROTECTING FILE SERVERS 3. 2. Main features KasperskyTM Anti-Virus for NetWare is a unique anti-virus solution with a network management system, which is completely integrated in the Novell Directory Service (NDS). [. . . ] In this program we implemented the so-called Pending application of the new settings. Now, while defining new settings for a workstation the administrator doesn't have to worry whether the workstation is available on the network. The settings are defined using their copy stored on the primary server, and are actually applied immediately after the network connection to the workstation is restored. detect a virus-outbreak (simultaneous infection of several computers on the network) immediately after it happened. [. . . ]