User manual MCAFEE VIRUSSCAN 4.5 ADMINISTRATOR GUIDE

[. . . ] McAfee VirusScan Administrator's Guide Version 4. 5 COPYRIGHT Copyright © 1998-2000 Networks Associates Technology, Inc. No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form or by any means without the written permission of Networks Associates Technology, Inc. , or its suppliers or affiliate companies. TRADEMARK ATTRIBUTIONS * ActiveHelp, Bomb Shelter, Building a World of Trust, CipherLink, Clean-Up, Cloaking, CNX, Compass 7, CyberCop, CyberMedia, Data Security Letter, Discover, Distributed Sniffer System, Dr Solomon's, Enterprise Secure Cast, First Aid, ForceField, Gauntlet, GMT, GroupShield, HelpDesk, Hunter, ISDN Tel/Scope, LM 1, LANGuru, Leading Help Desk Technology, Magic Solutions, MagicSpy, MagicTree, Magic University, MagicWin, MagicWord, McAfee, McAfee Associates, MoneyMagic, More Power To You, Multimedia Cloaking, NetCrypto, NetOctopus, NetRoom, NetScan, Net Shield, NetShield, NetStalker, Net Tools, Network Associates, Network General, Network Uptime!, NetXRay, Nuts & Bolts, PC Medic, PCNotary, PGP, PGP (Pretty Good Privacy), PocketScope, Pop-Up, PowerTelnet, Pretty Good Privacy, PrimeSupport, RecoverKey, RecoverKey-International, ReportMagic, RingFence, Router PM, Safe & Sound, SalesMagic, SecureCast, Service Level Manager, ServiceMagic, Site Meter, Sniffer, SniffMaster, SniffNet, Stalker, Statistical Information Retrieval (SIR), SupportMagic, Switch PM, TeleSniffer, TIS, TMach, TMeg, Total Network Security, Total Network Visibility, Total Service Desk, Total Virus Defense, T-POD, Trusted Mach, Trusted Mail, Uninstaller, Virex, Virex-PC, Virus Forum, ViruScan, VirusScan, VShield, WebScan, WebShield, WebSniffer, WebStalker WebWall, and ZAC 2000 are registered trademarks of Network Associates and/or its affiliates in the US and/or other countries. All other registered and unregistered trademarks in this document are the sole property of their respective owners. [. . . ] If you manage a network of workstations that you want to secure, however, you often need a method that will tell you about an infection if you are at any other workstation on your network, or even if you are not connected to the network at all. You also need a method to collect and manage alert messages from all over the network in a central repository so that you can respond whenever any workstation detects an infected file. The software allows you to centralize alert message collection and processing, assign priority designations and custom messages to those messages, and designate any of up to 11 different methods to distribute them to you or to others. With the v4. 5 anti-virus product series, the Alert Manager server now comes as an independent package bundled with McAfee NetShield anti-virus software. You can install this new Alert Manager server together with NetShield software, or by itself on a computer that you want to use as an alert collection point. You can install multiple Alert Manager servers, one to a domain, perhaps, or one on each of the machines in a cluster server. If you do so, you can also forward alert messages among Alert Manager servers and, thereby, to other computers on your network or to centralized notification systems. This feature can allow MIS departments to keep close track of viruses and problem areas. To learn how to install and configure the Alert Manager utility, see the NetShield Administrator's Guide. Administrator's Guide 99 Sending Alert Messages VirusScan software as an Alert Manager Client VirusScan software works as a client program with respect to NetShield software and an Alert Manager server. It can send alert "events" whenever it detects a virus or malicious software to any Alert Manager server you specify. The Alert Manager server then relays those events--and any others it receives from other workstations--as alert messages, via the methods you or your system administrator defined for alert distribution. VirusScan software can instead send these same alert messages as text (. ALR) files to a Centralized Alerting directory visible to the Alert Manager server. The Alert Manager server checks the Centralized Alerting directory periodically, looking for any new . ALR files, and distributing the alert messages from any it finds. NOTE: McAfee recommends that you send alert events directly to an Alert Manager server rather than via Centralized Alerting, unless your network configuration does not permit you to use Alert Manager servers. The Alert Manager server can work in conjunction with Network Associates Event Orchestrator software to tie alert messages into the Network Associates Magic HelpDesk application for trouble-ticket generation and other features. Alert Manager messages also contain much richer data than do those sent via Centralized Alerting. Enabling SNMP traps for Alert Manager will collect a host of information about the computer that generates the alert message and its software configuration. The VirusScan client can supplement either method with Desktop Management Interface (DMI) alerts for network management software, such as Hewlett-Packard OpenView, to process. Configuring the Alert Manager Client utility VirusScan software includes a simple client configuration utility that allows you to choose the Alert Manager server that you want to receive alert events, designate a Centralized Alerting directory to receive alert messages, and specify the numeric value of DMI alert messages you want to send. Setting up a complete alert system is a two-part process: First, you must enable the Alert Manager Client Configuration utility and point it to the correct Alert Manager server or Centralized Alerting location. Next, you must verify that you have selected the Notify Alert Manager checkbox in the VirusScan Advanced Alert property page, in the Alert page for the E-Mail Scan extension and in the Alert pages for each VShield module you have enabled. 100 McAfee VirusScan Anti-Virus Software Sending Alert Messages This tells each VirusScan component to send an alert event to the Alert Manager client utility each time it detects a virus or malicious object. The client utility, in turn, passes the alert message to the Alert Manager server you designate. If you do not set your software to generate alert messages in the first place, the client utility will have nothing to pass to the Alert Manager server for distribution. To start and configure the Alert Manager utility, follow these steps: 1. Click Start in the Windows taskbar, point to Programs, then to Network Associates. The Alert Manager Client Configuration page appears. 2 Figure 5-1. [. . . ] Install all of the . UPD files and the DELTA. INI file you downloaded to a central server on your network, then configure the AutoUpdate copies on your network computers to download and install the iDAT set. Do not mark these files read-only, as this could cause the target computer to report an error when it tries to delete old files later. 198 McAfee VirusScan Anti-Virus Software Understanding iDAT Technology The AutoUpdate utility will download each file it needs, in sequence, to bring the . DAT files installed on its host computer up to date. From that point forward, your network computers will install iDAT files, which will reduce your update time and the demand on your network bandwidth. Scheduling internal . DAT updates The AutoUpdate utility has a built-in scheduling feature that lets you automate the entire update process. You can schedule updates for late nights, for times when network bandwidth demand is, low or at other convenient periods. [. . . ]