User manual SOPHOS ANTI-VIRUS 4.0 FOR NETWARE

[. . . ] User manual Sophos Anti-Virus for NetWare Document date: July 2007 Sophos Anti-Virus NetWare user manual About this manual This user manual explains how to use Sophos Anti-Virus for NetWare and how to configure virus scanning virus alerts disinfection logging reporting. For information on automatically installing and updating Sophos Anti-Virus, see one of the following documents: If the network uses Microsoft networking, see the Sophos Endpoint Security and Control network startup guide on the Sophos website or the Sophos Network Install CD. If the network uses NDS networking, see the Sophos Endpoint Security and Control network startup guide: NetWare edition on the Sophos website or the Sophos Network Install CD. For information on manually installing and updating Sophos Anti-Virus, see the Sophos Anti-Virus NetWare startup guide on the Sophos Anti-Virus Supplementary CD. 2 Sophos Anti-Virus NetWare user manual Contents Using Sophos Anti-Virus 1 Loading and unloading Sophos Anti-Virus 2 Using the Sophos Anti-Virus screen 3 Scanning the server 4 Scheduled scanning 5 Viewing the log file 6 Disinfection Configuration 7 Configuring immediate or scheduled scanning 8 Configuring InterCheck (central reporting) 9 Configuring real-time scanning 10 Purging checksums (for real-time scanning) 11 Setting administration options 12 Restoring or saving configuration settings 13 Command line options Troubleshooting 14 Troubleshooting Glossary and index Glossary Index Technical support 60 62 64 56 22 35 37 45 46 52 53 6 7 9 11 15 16 3 Sophos Anti-Virus NetWare user manual 4 Using Sophos Anti-Virus Loading and unloading Sophos Anti-Virus Using the Sophos Anti-Virus screen Scanning the server Scheduled scanning Viewing the log file Disinfection Sophos Anti-Virus NetWare user manual 1 Loading and unloading Sophos Anti-Virus 1. 1 Loading Sophos Anti-Virus At a workstation running RCONSOLE, or at the server console, enter LOAD SWEEP The main Sophos Anti-Virus screen is displayed. [. . . ] which processes on the server activate real-time scanning (Server processes) !which users to notify of viruses (Notify group). 37 Sophos Anti-Virus NetWare user manual For details of all the options, see the following sections. 9. 1 Status This option enables or disables real-time scanning. By default, real-time scanning is Inactive. See the Volumes option below. 9. 2 Volumes This option specifies how real-time scanning is applied to each volume. Read only If this is selected, every time a file on the volume is read from, that file is scanned. This is the default setting. 38 Sophos Anti-Virus NetWare user manual Write only If this is selected, every time a file on the volume is written to, that file is scanned. Read and write If this is selected, every time a file on the volume is read from or written to, that file is scanned. None If this is selected, real-time scanning is not used for that volume. Other volumes This refers to volumes that don't usually appear in the list (e. g. You can delete from the list volumes that are not currently mounted and that are not represented by a Volume object in the eDirectory tree. To do this, select the volume and press `Delete'. 9. 3 Workstations This option enables you to specify which client workstations will activate real-time scanning when they access files on the server. All Select this if you want all workstations to activate real-time scanning. This is the default setting. 39 Sophos Anti-Virus NetWare user manual Specify Select this to restrict real-time scanning to any workstations, e. g. DOS clients, which are not protected by InterCheck on-access scanning. 9. 4 Server processes This option specifies whether processes running on the server activate real-time scanning or not. Monitor file access This activates real-time scanning for all file accesses, whether originating from other processes on the server itself (e. g. Do not monitor file access This activates real-time scanning only for file accesses originating from outside the server. This might be useful if, for example, a backup NLM is run on the server. 9. 5 Scanning options This set of options specifies the level and priority of scanning. 40 Sophos Anti-Virus NetWare user manual The options are as follows. 9. 5. 1 Scanning level Quick scanning checks only the parts of a file that are likely to contain a virus. Quick scanning is sufficient for normal operation and is the default setting. The Full level is more secure, but is slower than Quick scanning. 9. 5. 2 InterCheck checksums When Sophos Anti-Virus scans a file on the server and finds it to be virus-free, it can add its checksum to a central list. This list is used by real-time scanning, which checks the checksum of a file against this list, and only scans that file if its checksum is found to differ from the checksum on the list. This is the default setting. 9. 5. 3 Compressed files Sophos Anti-Virus is capable of looking for viruses inside files compressed with PKLite, LZEXE and Diet. Sophos Anti-Virus can also be configured to scan inside archive files. For more details, see the -ARCHIVEOA option in section 13. 41 Sophos Anti-Virus NetWare user manual 9. 6 Document viruses This option specifies disinfection of files containing document viruses. By default, Sophos Anti-Virus does not disinfect files containing document viruses. Select Disinfect if you want Sophos Anti-Virus to attempt to disinfect documents automatically. If disinfection fails, the chosen removal mode (see section 9. 8) is applied. 9. 7 Program viruses This option specifies disinfection of files containing program viruses. By default, Sophos Anti-Virus does not disinfect files containing program viruses. Select Disinfect if you want Sophos Anti-Virus to attempt to disinfect programs automatically. [. . . ] Database containing a virus When running a full scan, Sophos Anti-Virus may report that there is a virus fragment in a database file. 58 Glossary and index Sophos Anti-Virus NetWare user manual Glossary Checksum A value calculated from item(s) of data. If the checksum of a file is found to have changed, it is sent for scanning as it may have been infected with a virus. Central installation directory; a central copy of Sophos Anti-Virus files from which Sophos Anti-Virus is installed and updated automatically on the server and workstations. You must create a different CID for each platform on the network, and remember to keep every CID up to date. [. . . ]