User manual KASPERSKY LAB ANTI-VIRUS 5.0 ADMINISTRATION FOR LINUX

[. . . ] KASPERSKY LABS Kaspersky Anti-Virus 5. 0 for Linux Workstation ADMINISTRATOR'S GUIDE KASPERSKY ANTI-VIRUS 5. 0 FOR LINUX WORKSTATION Administrator's guide Kaspersky Labs, Ltd. http://www. kaspersky. com Revision date: November 2003 Contents CHAPTER 1. What's new in version 5. 0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Licensing policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [. . . ] Actions taken with the files Depending on the status of the file (see section 5. 1. 2 on page 38) different actions can be taken with it. By default, notification is made only of detected files that have a certain status. These notification messages are output to the console and to the report. However, for files that have the statuses Infected, Suspicious, Warning and Corrupted, a number of actions can be set up including: · Moving to a certain directory ­ The files that have a certain status are moved to a preset directory. Executing a certain command ­ the files are processed using standard Unix commands, script files etc. For the file types Protected and Cured, notification can only be output to the console and to the report. It should be noted that Kaspersky Anti-Virus distinguishes simple objects (a file) and compound objects (composed of more than one object ­ an archive). · · 40 Kaspersky Anti-VirusTM for Linux Workstation Actions taken with these two kinds of object are different too; they are separated in different sections in the configuration file. For simple objects ­ [scanner. object] section, for compound ones ­ [scanner. container]. If the archive itself is infected, it is treated as a simple object, but if the objects inside it are infected then it is considered a compound object. Accordingly, actions that are taken to the archive in these cases are defined by the parameters set in different sections of the configuration file!You can use the following methods to select an action for a file: · Set the actions in the configuration file kav4unix. conf, if they are supposed to be used as default actions (sections [scanner. object] and [scanner. container], for more details refer to section A. 2 on page 56). You can specify the actions remotely using the Kaspersky AntiVirus On-Demand Scanner tab of the Webmin program (see Figure 4). · Specify the actions in the alternative configuration file and use it when launching the component. If no configuration file is specified in the command line when launching the component, then the operation parameters will be taken from the file kav4unix. conf. You do not have to specify this file expressly when launching the component. · Set them for the current session using the command line keys when launching the kavscanner component (see section A. 3 on page 61). The syntax is the same for actions to be taken with either simple or compound objects (for more details refer to section A. 2 on page 56, sections [scanner. object] and [scanner. container]). 5. 2. Setting up file scanning parameters for the aveserver and aveclient components The Kaspersky Anti-Virus program consists of the aveserver process daemon and the aveclient client program. The aveserver component is launched during the operating system start-up, and upon the client's request it performs anti-virus processing of files using the antivirus databases. Advanced settings 41 The aveclient component receives a request for file scanning from the command line, transfers it to the daemon and then outputs a report on scanning results in the form most suitable for its further processing by various scripts. Such application architecture allows a considerable decrease of the time it takes to perform anti-virus scanning of several files. Let us review in detail the mechanism of operation and interaction between those components. 5. 2. 1. When a request for scanning of a certain file is received from the command line the aveclient client component receives the request, processes it, and transfers it to the aveserver process daemon using a local socket. The daemon performs anti-virus scanning of the object in accordance with its current settings. [. . . ] At the same time, you will not feel any negative influence from this mode while working on the Web. The program provides conventional transparency and accessibility of the data. Kaspersky® Anti-Hacker blocks the most common hacker network attacks, and monitors for attempts to scan computer ports. The software supports simplified management by giving a choice of five security levels. [. . . ]