KASPERSKY LAB Kaspersky Security® 5.
KASPERSKY SECURITY 5.5 FOR MICROSOFT EXCHANGE SERVER 2003 Administrator's Guide © Kaspersky Lab http://www.kaspersky.
Table of Contents CHAPTER 1. INTRODUCTION ...................................................................................... 7 1.1. Threats to the computer security .......................................................................... 7 1.2. The purpose and major functionality of the application...................................... 10 1.3. Hardware system requirements.......................................................................... 12 1.4. Software system requirements ....................
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 4.7.1. Testing the anti-virus protection system ...................................................... 35 4.7.2. Testing the anti-spam protection system ..................................................... 36 CHAPTER 5. UPDATING THE ANTI-VIRUS AND THE CONTENT FILTRATION DATABASES.............................................................................................................. 38 5.1. Manual updating...................................
Table of Contents 5r CHAPTER 10. NOTIFICATIONS .................................................................................. 86 10.1. Creating a notification template......................................................................... 87 10.2. Viewing and editing notification parameters..................................................... 91 10.3. Customizing general notification settings ......................................................... 91 CHAPTER 11. PREVENTING VIRUS OUTBREAKS.........
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 15.1.2.9. Notifications on detected objects....................................................... 139 15.1.2.10. Virus outbreak notification ............................................................... 140 15.1.2.11. General notification settings ............................................................ 140 15.1.2.12. Additional settings............................................................................ 141 15.1.2.13.
CHAPTER 1. INTRODUCTION The main source of viruses today is the global Internet. Most virus infections happen via e-mail. The facts that almost every computer has e-mail client applications installed and that malicious programs are able to take a full advantage of software address book in order to find new victims are favorable factors for the distribution of malware.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 crawl from computer to computer, using networks, e-mail, and other data channels. This feature gives many worms a rather high speed in spreading themselves. Worms penetrate a computer, calculate the network addresses of other computers, and send a burst of self-made copies to these addresses. In addition to network addresses, worms often utilize data from e-mail client address books.
Introduction Riskware Potentially dangerous software that does not have a malicious function but can be used by hackers as an auxiliary component for a malicious code, since it contains holes and errors. Under certain conditions, having such programs on your computer can put your data at risk. These programs include, for instance, some remote administration utilities, keyboard layout togglers, IRC clients, FTP servers, and all-purpose utilities for stopping processes or hiding their operation.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 builders, vulnerability scanners, password cracking programs, and other types of programs for cracking network resources or penetrating a system. Although malicious programs are distributed mainly via email and the Internet, a floppy disk or a CD can also be a source of infection.
Introduction 11 • scanning e-mail messages received by the Exchange server via SMTP protocol for SPAM including the analysis of all attributes and attachments of the message. Depending on the settings, the application will deliver the message to the Inbox folder, move the message to the Junk E-mail folder, block the message or delete it.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 • Security Server performs the scan of the mail traffic for viruses and spam, updates the anti-virus database and content filtration database, provides administrative services for remote management, configuring and ensuring the integrity of the application and of the data stored.
Introduction • License Agreement Before you open the envelope with the CD make sure that you have carefully read the license agreement. If you buy Kaspersky Security online, you will download the application from the Kaspersky Lab's website. In this case, the distribution kit will include this Guide along with the application. The license key will be e-mailed to you upon the receipt of your payment. License Agreement is a legal contract between you and Kaspersky Lab Ltd.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 Support on issues related to the performance and the use of operating systems or other technologies is not provided. 1.7. Conventions Various formatting features and icons are used throughout this document depending on the purpose and the meaning of the text. The table below lists adopted conventions used in the text. Format feature Bold font Meaning/Usage Titles of menus, menu items, windows, dialog boxes and their elements, etc. Note.
CHAPTER 2. OPERATION OF THE APPLICATION Kaspersky Security 5.5 for Microsoft Exchange Server 2003 scans and, if it is possible, disinfects all incoming and outgoing e-mail messages as well as messages stored at the server. The application analyzes the body of the message and attached files of any format. Additionally, Kaspersky Security performs an anti-spam scan of all messages received by Exchange server via SMTP protocol.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 The application sends notifications about events occurred to the administrator, the recipient and the sender of the infected message and also places a record about this event into the Kaspersky Security application log file and into the Microsoft Windows event log.
Operation of the application 2.2. Server protection deployment In order to create the system of mail servers protection against malicious programs and SPAM using Kaspersky Security 5.5 for Microsoft Exchange Server 2003: 1. Install the Security Server component on all protected Exchange servers. The installation shall be performed from the distribution kit individually for each server. 2. Install the Management Console on a computer within the corporate network.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 • Configure the settings for detecting virus outbreaks and notification about such events. (Chapter 11, page 93). 2.3.
Operation of the application 19 In order to create protection of Microsoft Exchange Server, installed on the cluster, against malware and SPAM: 1. Install the Security Server component on each node of the cluster. The installation shall be performed from the distribution kit individually for each server. Specify a folder on a local disk of the server file system as the installation folder.
CHAPTER 3. INSTALLING, UPDATING AND REMOVING THE APPLICATION Before starting installation of the application, make sure that the software and hardware of your computer meet the installation requirements (details see section 1.4, page 12). In order to install, update the version or remove Kaspersky Security 5.5 for Microsoft Exchange Server 2003 from your computer, you will need administrator privileges on the domain. 3.1.
Installing, updating and removing the application 21 is registered and saved in the Microsoft Windows event log on the computer on which the Security Server is installed. 3.1.1. First-time installation In order to install Kaspersky Security into your computer run the executable file on the installation CD included into the distribution package. The installation process will be facilitated by the setup wizard. Setup wizard will offer you to configure the installation parameters and start the installation.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 Kaspersky Security. Remove the existing program and then run the installer of Kaspersky Security again. • If the setup detects that Kaspersky Security 5.5 for Microsoft Exchange Server 2003 (release version, MP1) is installed on the computer, it will suggest upgrading the application to Kaspersky Security 5.5 for Microsoft Exchange Server 2003 MP2 (see section 3.3, page 25).
Installing, updating and removing the application 23 If this computer is the administrator's workstation and you plan to manage the protection of the Exchange servers from this computer, select the Management Console. Note that the setup wizard will display reference information about the selected component and the disk space required for its installation. By default, the application components will be installed to the Program files\Kaspersky Lab\Kaspersky Security for Microsoft Exchange Server folder.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 the number of storage areas created on the server, you must remove anti-virus protection from some of these areas before the protection is started (see section 14.5, page 122). If you wish to adjust the application settings first, disable automatic activation of anti-virus and anti-spam protection in the respective checkboxes. Step 7. Copying files In order to proceed with the setup, press the Install button in the wizard window.
Installing, updating and removing the application 25 In order to reinstall the application, run the executable file from its distribution package and select the Repair option in the wizard window. This will reinstall Kaspersky Security using the settings of the previous installation. For example, if the previous installation was a custom installation, then the reinstallation initiated by the Repair button will also be a custom type installation. 3.2.
CHAPTER 4. STARTING USING THE APPLICATION 4.1. Starting the application The server component of the application is started automatically at the operating system startup. If the anti-virus protection of the server and the anti-spam protection features are enabled, they will start functioning immediately after the Microsoft Exchange Server is launched. The operation of the application is controlled from the administrator's workstation – a computer where the Management Console is installed.
Starting using the application The Kaspersky Security 5.5 for Microsoft Exchange Server 2003 namespace may contain several nodes with the names of the servers managed via the console. The namespace does not contain any elements immediately after the installation of the Management Console. Figure 2. Main application window After a new server is added (see section 4.3, page 30), it is displayed in the console tree as a node .
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 • Notification templates – for configuring notifications about infected or suspicious objects and messages containing spam detected during the scan. • Backup storage – for working with the backup storage where backup copies of objects are stored; includes the list of objects stored in the backup storage.
Starting using the application Notification templates Backup storage Report templates New notification Create and configure a new notification template about infected and suspicious objects revealed by a scan and about messages containing spam. New filter Create and configure a new filter used to search for objects located in the backup storage. Properties Configure general Backup parameters. New report Create a new report template.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 4.3. Creating the list of managed servers In order to be able to control the application via the console, the Exchange server, where the Security Server component is installed, must be added to the list of managed servers. You can add either a local computer or any Exchange server within the network to this list. Adding a server may be accompanied by establishing a connection between the Management Console and the Kaspersky Security application.
Starting using the application 31 or select the computer from the list using the Browse button. Later on, the Management Console will use this name to establish connection with the Security Server. The connection is established using DCOM protocol. In order to establish connection between the Management Console and Kaspersky Security when adding the server, check the Connect now box (details see section 4.4, page 31). The server you select must have the Security Server component installed.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 In order to be able to connect to the Security Server, the user must have the local administrator rights for the computer to which the connection is attempted. The rights verification is performed based on the standard Microsoft Windows network user authentication process.
Starting using the application 33 4.6. Mail server protection without additional configuration Exchange server protection against malware and SPAM starts operating immediately after the Security Server component is installed.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 • when a protected or corrupted object is detected, the application will save its copy (file or the body of the message) in the backup storage. Objects detected in message body are replaced with a notification of the following format: The attached file %OBJECT_NAME% was deleted by Kaspersky Security 5.5 for Microsoft Exchange Server 2003. File was password-protected or corrupted.
Starting using the application 35 4.7. Verifying the application performance After Kaspersky Security is installed and configured, we recommend verifying the correctness of its settings and operation: • using a test "virus" and its modifications (see section 4.7.1, page 35); • using a test SPAM message (see section 4.7.2, page 36). 4.7.1.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 Prefix Object type No prefix, standard test "virus" Infected. An error occurs during an attempt to disinfect the object; apply action set for objects that cannot be disinfected. CORR- Corrupted. SUSP- Suspicious (unknown virus code). WARN- Warning (modified code of a known virus). ERRO- An error corresponding to detection of a corrupted object. CURE- Infected (can be cured).
Starting using the application 37 When such message arrives at Exchange Server, Kaspersky Security will assign it SPAM status and will process it applying the action specified for this type of objects by the administrator (see section 7.2, page 67).
CHAPTER 5. UPDATING THE ANTI-VIRUS AND THE CONTENT FILTRATION DATABASES Users of Kaspersky Lab's products can update: • anti-virus database used to detect malicious programs and disinfect infected objects.
Starting using the application 39 In order to review the status of the databases and modify the updating settings, In the main application window select the Kaspersky Security 5.5 for Microsoft Exchange Servers 2003 node in the console tree, open it, select the node corresponding to the server you need and follow the Updates link in the results pane.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 Figure 4. Configuring update settings. The General tab In order to update the anti-virus database and content filtration database immediately, press the Update now button in the corresponding section. The application will launch the updating process using the selected settings. 5.2. Automatic updates In order to update the database in the automatic mode, 1. In the main application window select the Kaspersky Security 5.
Starting using the application Figure 5. Configuring update settings. Schedule tab In order to enable the automatic updates of the anti-virus and the content filtration databases, check the Update automatically box and set up the schedule for receiving updates. If the box is not checked, the databases must be updated manually (see section 5.1, page 39). You can select different modes for updating the anti-virus and the content filtration databases.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 Additionally, you can configure the updates to be downloaded from a HTTP, FTP server or a network folder. If you have Kaspersky Administration Kit (the centralized Kaspersky Lab's applications management system) installed in your corporate network, then the databases updates received by the Administration Servers will be copied to a public folder (details see Kaspersky Administration Kit Guide).
Starting using the application Figure 6. Configuring update settings. The Source of updates tab 5.4. Configuring the connection settings In order to view/modify the network connection settings: 1. In the main application window select the Kaspersky Security 5.5 for Microsoft Exchange Server 2003 node in the console tree, open it, select the node corresponding to the server you need and follow the Updates link in the results pane. 2.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 • If you use a password in order to access the proxy server, specify the proxy user's authentication settings. In order to do this check the Proxy server authentication box and fill in the Name and the Password fields. • Specify time limit for establishing connection with the update server in the Connection timeout (sec.) field.
Starting using the application 45 5.5. Running updates under a different user account Kaspersky Security program updates can be run under a different user account. This feature is disabled by default, and tasks are run under the system profile.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 Figure 8. Configuring update settings.
CHAPTER 6. ANTI-VIRUS PROTECTION The main task of Kaspersky Security for Microsoft Exchange Server 2003 is to perform an anti-virus scan of mail traffic and to disinfect mail messages using the information contained in the current (latest) version of the anti-virus database. Depending on the anti-virus protection level selected by the administrator (see section 6.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 E-mail messages stored on the server and the content of public folders are also rescanned on a regular basis using the latest version of the anti-virus database (if the background storage scan is enabled). The scan is performed in the background mode and can be launched either automatically each time the antivirus database is updated, or according to the schedule, or manually (details see section 6.6, page 62).
Anti-virus protection containers above the specified nesting level, file specified by mask or files specified by type (details see section 6.3, page 53). Kaspersky Security supports scanning several objects at the same time. The number of objects that can be processed at the same time depends on the number of started instances of the anti-virus kernel running simultaneously. The mode of scanning objects in RAM allows scanning objects without saving them to a temporary folder on the hard drive.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 • • programs that cause unexpected video or sound effects; • programs that cause problems in the system operation; • virus simulators. Programs that do not contain malicious code and do not inflict any damage to the user, but can be a part of the environment used for development of malicious software.
Anti-virus protection 6.2. Enabling and disabling the antivirus server protection. Selecting anti-virus protection level If the anti-virus server protection is enabled, then the anti-virus scan of the e-mail traffic will be started or stopped when the Microsoft Exchange Server is started or stopped.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 The use of extended or redundant anti-virus protection level may affect the speed of the program's operation. Besides, some programs may be referred to potentially dangerous programs when transferred by mail, and so they may be deleted or blocked, depending upon the application settings (see section 6.5, page 57). You can restore the default settings by pressing the Restore the default settings button.
Anti-virus protection 53 1. Disable the anti-virus mail protection using the Management Console (see above). 2. Disable the anti-spam server protection using the Management Console (see section 7.1, page 66). 3. Restart the Microsoft Exchange Information Store and IIS Admin services. 4. Specify the Disabled startup type for the service of Kaspersky Security 5.5 for Microsoft Exchange Server 2003. In order to start the application after the automatic startup of the Kaspersky Security 5.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 Figure 10. Configuring restrictions for the attachment scan 3. In the Exclude from the scan scope group, specify objects that you wish to exclude from the anti-virus scan scope: • Archives – exclude archives from the scan scope. • Objects-containers with nesting level above... – exclude from the scan scope containers with the nesting level exceeding the value specified in the field to the right.
Anti-virus protection cluding them from the scan scope. In order to do this, specify exclusions by the file type or using a mask: • Files defined by mask. Using the Append and Delete buttons, create the list of exclusion masks. When adding an exclusion in the Adding a mask window (see Figure 11), enter the exclusion mask into the corresponding field. Examples of allowable masks: o *.txt – all files with mask *.txt o *.tx? – all files with mask *.tx? o test – all files with name test Figure 11.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 You can restore the default settings by pressing the Restore the default settings button. 6.4. Scanning of routed e-mail traffic In order to reduce the load on the server in the traffic protection mode, we recommend that mail traffic routed by the server, shall not be scanned. In order to exclude mail routed to other servers from the scan scope, 1. In the main application window select the Kaspersky Security 5.
Anti-virus protection Figure 13. Excluding transit traffic from the scan scope 6.5. Selecting actions to be performed with objects As a result of an anti-virus scan each object can be assigned a status as listed below: • Not infected – object does not contain viruses. • Infected – object contains at least one of the known viruses. • Suspicious – object's code is similar to the code of a known or unknown virus. • Protected – object is password-protected. • Corrupted – object is corrupted.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 The most important major function of the application is the disinfection of infected objects. Disinfection is performed based on the information contained in the anti-virus database. According to the results of the attempted disinfection, an object can be assigned a status as listed below: • Disinfected – object was successfully disinfected. • Non-disinfectable – object disinfection failed.
Anti-virus protection 59 message will include the name of the virus detected and the name of the infected object. If an object attached to the message was processed (disinfected, deleted, replaced) by Kaspersky Security, then before the message is closed, your e-mail client application (for example, Microsoft Outlook) will offer you to save changes although the user has made no changes. You must save the message. In order to define the rules for processing objects detected during an anti-virus scan, 1.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 3. Determine the rule for object processing for each status individually. In order to do this, press the Modify rule… button in the corresponding section. As a result the Master is started. Follow its instructions. 4. In the window that will open (see Figure 15) select actions from the list. Figure 15.
Anti-virus protection Figure 16. Selecting an action to be performed with an object that could not be disinfected 6. If you selected one of the actions that involve replacement of the object with text, you will be offered to create a replacement template (see Figure 17). The informational message created based on this template will be copied to the message body and into the replacement txt file. Create a replacement template. In order to do this, enter the message text into the wizard window.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 In order to close the wizard, press the Finish button. 7. In order to ensure that a copy of the object is saved to the backup storage before the object is processed, check the Save a copy of the original object in the backup storage box (see Figure 14). You can restore the default settings by pressing the Restore the default settings button. 6.6. Background scan Kaspersky Security 5.
Anti-virus protection 63 Figure 18. Configuring background scan settings and anti-virus protection performance 3. Check the Enable background scan box (unchecked by default) and specify the desired scan launch option: • Every time the anti-virus database is updated – launch the scan every time the anti-virus database is updated. • According to schedule – launch the scan according to the specified schedule.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 Figure 19. Creating the background scan schedule If you need to start the scan immediately, press the Start now button (Figure 18). 4. You can restrict the scan time. In order to do this, check the Stop scan in [NN] hours box and specify the desired time period in hours. After this period of time (24 hours by default) expires, the scan will be stopped. In order to apply the changes, press the Apply or the OK button.
CHAPTER 7. ANTI-SPAM PROTECTION One of the main tasks of Kaspersky Security 5.5 for Microsoft Exchange Server 2003 is protection of mailboxes and public folders of the Exchange server against unsolicited e-mail messages (SPAM). The anti-spam scan module filters the incoming e-mail messages while they are being received via SMTP protocols that is, before the messages get into the users' mailboxes.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 SPAM, suspicious message, formal message, obscene message (details see section 1.1, page 7). Messages in which traces of SPAM have been detected, will be processed by applying actions described in section 7.2, page 67. 7.1. Enabling/disabling anti-spam protection In order to enable/disable anti-spam protection: 1. In the main application window select the Kaspersky Security 5.
Anti-Spam protection Figure 20. Configuring anti-spam protection settings. The General tab When you click the Restore the default settings button, Anti-Spam will be enabled. We do not recommend disabling Anti-Spam by disabling the Kaspersky Security 5.5 for Microsoft Exchange Server 2003 start function manually through Manage computer / Services (see section 6.2, page 51). 7.2.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 Specify the rules for processing messages for each type of SPAM in the Actions tab (see Figure 22) of the window that will open: • Skip – deliver the message into the user's Inbox. By default this action is applied to messages that do not contain spam attributes and to formal emails. • Move to the Junk E-mail folder – deliver message to a special folder of the e-mail client on the recipient's computer.
Anti-Spam protection Figure 21. Adding markers to the subject line of the message By default, if a message is declined or deleted, a copy of such message is saved to the backup storage (see Chapter 6, page 47). If necessary, you can restore the message from the backup storage or forward it to recipients unchanged. If you do not want copies to be saved, uncheck the Save a copy of the original object in the backup storage box.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 7.3. Configuring TCP/IP settings Anti-spam mail scan is performed by the service using the TCP/IP settings. These settings will be applied in automatically during the program's installation. In case of a conflict with other applications installed on your computer using the same port for TCP/IP, we recommend changing it.
Anti-Spam protection 71 Connection filtration allows the Exchange Server to access block lists and determine if the computer sending an e-mail is on those lists. Exchange Server can also be used to specify exclusions from block lists. In addition, Exchange Server can be used to create recipient filters that restrict delivery of e-mail to defined recipients in the organization or beyond. To configure connection filtration: 1. Open Exchange System Manager. 2.
CHAPTER 8. APPLICATION'S OPERATION EFFICIENCY Kaspersky Security for Microsoft Exchange Server 2003 provides the possibility to fine-tune the application's operation efficiency depending on the amount and the characteristics of the mail traffic through the Exchange servers and on the system features of the computer: amount of RAM, operation speed, number of processors, etc. Additionally, you can fine-tune various efficiency levels of anti-virus and antispam protection. 8.1.
Application's operation efficiency 73 kilobytes. By default, the box is checked and the size of the object is 1024 KB. 8.2. Anti-spam protection efficiency In order to configure the anti-spam protection efficiency settings: 1. In the main application window select the Kaspersky Security 5.5 for Microsoft Exchange Server 2003 node in the console tree, open it, select the node corresponding to the server you need and follow the Anti-Spam protection link in the results pane. 2.
CHAPTER 9. BACKUP COPYING Kaspersky Security for Microsoft Exchange Server 2003 allows saving a backup copy of an initial object before processing. For example, before an attempt to disinfect or delete such object or before declining or deleting a message containing SPAM attributes, an initial copy can be saved to the backup storage. Later on objects located in the backup storage may be: • restored - in order to obtain information contained in the object.
Backup copying • if the object storage period is limited, the application will delete objects with the expired storage period. The object can stay in the backup storage longer than the established storage period if no new objects are added to the storage. Viewing the backup storage (details see section 9.1, page 75), configuring backup storage parameters (details see section 9.7, page 83) and managing backup copies (details see section 9.3, page 80, section 9.4, page 81 and section 9.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 Figure 24. Viewing the backup storage In addition to the standard e-mail message attributes (Sender, Recipients, Cc, Subject, Sent time), this table will contain the following information for each object: • Object name. Attachments will retain their original names, while the message body will be saved as (result of anti-virus scan) or (result of spam scan). • Object status.
Backup copying You can perform ascending and descending sorting of the data contained in the table by any column. 9.2. Backup storage filter The use of filters allows performing search and data structuring tasks on the data contained in the backup storage as after applying the filter only information complying with the filtering parameters becomes available. This feature becomes very important as the number of objects stored in the backup storage increases.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 Figure 25. Creating a new filter. The Filter tab 4. On the Additional tab (see Figure 26) specify the values for the filter settings that will be used to search for objects in the backup storage. To configure settings, use the following file attributes: o file type.
Backup copying Figure 26. Creating a new filter. The Additional tab 5. After you are done with the filter settings, press the Apply or the OK buttons to create the filter. If you wish to cancel creation of the filter, press the Cancel button. As a result of this action, a subfolder with the filter's name will be created in the console tree inside the Backup Storage folder.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 2. Modify the filter parameter values as required. 3. In order to apply the changes, press the Apply or the OK buttons. To exit without saving the changes, press the Cancel button. As a result, the information displayed in the results pane will be updated according to the new values of the filter settings.
Backup copying 81 As a result of these actions the object will be moved from the backup storage into the specified folder, decoded and saved with the specified name. The restored file will have the same format as it had when it was first processed by the application. After the object is successfully restored, a corresponding notification is displayed on the screen. We recommend restoring only those messages that contain spam attributes or that have suspicious, protected or corrupted status.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 In order to send a suspicious object to Kaspersky Lab's experts for analysis, 1. Select the Backup Storage folder in the console tree. 2. Select the object with the suspicious status you wish to send for analysis in the table displaying the content of the backup storage (see Figure 24). You can use filter when searching for the object (see section 9.2, page 77). 3.
Backup copying 2. Select the object you wish to delete in the table displaying the content of the backup storage (see Figure 24). You can use filter when searching for the object (see section 9.2, page 77). 3. Open the shortcut menu and use the Delete command or the analogous command under the Action menu. As a result of these actions, the object will be deleted from the backup storage directory. 9.7.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 Figure 27. Configuring the backup storage settings By default, the backup copy of the object is stored in qb folder. This is a service application folder, which is created in the application installation folder at the time when the Security Server is installed. When you change the backup folder, backup copies that had been created earlier will remain in the folder where they had been placed initially.
Backup copying • 85 Maximum objects storing time – if you wish to restrict the period objects are stored in the backup storage (unlimited by default), specify the number of days in the entry field (the default value is 30 days). If the size of the backup storage does not need to be restricted, deselect the Auto delete objects from storage box. In order to apply the changes, press the Apply or the OK buttons. To exit without saving the changes, press the Cancel button.
CHAPTER 10. NOTIFICATIONS Kaspersky Security allows notifying about revealed infected objects and about messages that contain SPAM. Notifications can be delivered using the following methods: • by sending e-mail messages; • by sending messages using Net Send tools; • by registering the event in the Microsoft Windows event log on the computer where the Security Server component is installed.
Notifications You can learn more about templates parameters in the settings window that opens by the Properties command available through the shortcut menu (details see section 10.2, page 91). Figure 28. The Notifications templates folder The administrator can create new templates, view and edit parameters of the existing templates and rename or delete templates using the shortcut menu commands. In order to enable notification about objects detected during scan. 1.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 1. Select the Notification templates folder in the console tree. 2. Open the shortcut menu and use the New template command or an analogous command under the Action menu. 3. As a result of these actions a window used for configuring new notification template will open (Figure 29). Specify the required values for the parameters in the tabs of the window.
Notifications • Enter a brief description of the notification in the Notification subject field. This line will be used as a header of the message. • Create the message text in the Full notification text field. The message may include information about a registered event. To include this information add corresponding substitution macros to the template selecting them from the dropdown list accessible via the Macros button (the list of macros will depend upon notification type).
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 The validity of the addresses can be verified using the Test button. A message will be sent to the specified address. Entering several e-mail addresses is allowed, the addresses entered must be separated by semicolons. Figure 31. Notification template.
Notifications results pane and, if the Notify about events box in the General tab is checked, notifications will be issued using this template. 10.2. Viewing and editing notification parameters In order to view or modify notification parameters, 1. Select the Notification templates folder in the console tree. 2. Select the required notification template in the table containing the list of created templates (see Figure 28). 3.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 2. It will open the General settings window, where you should select the Advanced (see Figure 32) tab. Enter the information that will be displayed as the sender of messages generated by Kaspersky Security in the From field. Figure 32.
CHAPTER 11. PREVENTING VIRUS OUTBREAKS Kaspersky Security 5.5 for Microsoft Exchange Server 2003 allows to detect increases in the virus activities on the protected Exchange server and to notify the administrator and other users about such events. This feature may be very useful in the periods of virus outbreaks as it helps the administrator to timely react to the emerging threats of virus attacks.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 The values of all virus outbreak counters will be reset if the Security Server component or the server operating system, where the component is installed, are restarted. Several counters with different settings values can be created for any event. During Security Server setup a virus outbreak counter is created. The counter can be used to set up a respective notification.
Preventing virus outbreaks 95 In order to set up issuing notifications about increased virus activity level: 1. Create a new virus outbreak counter (see section 11.1, page 95) or select an existing counter and configure its settings (see section 11.2, page 99). 2. Check the Notify me about virus outbreaks box in the General tab of the virus outbreak counter settings (see Figure 34). 11.1. Creating a new virus outbreak counter In order to create a new virus outbreak counter, 1.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 Figure 34. Virus outbreak counter. The General tab Perform the following in the General tab (see Figure 34): • Enter the counter name in the Name field. • Specify the type of the event that will be traced by the counter. In order to do this, select the required value from the Type drop-down list. • Specify the value of the virus activity level threshold.
Preventing virus outbreaks 97 specified type is exceeded. Uncheck this box if you do not want notifications to be issued. Create the template of a message that will be sent as a notification in the Text tab (see Figure 35): Figure 35. Virus outbreak counter. The Text tab • Enter a brief description of the notification in the Notification subject field. This line will be used as a header of the message. • Create the message text in the Full notification text field.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 Figure 36. Virus outbreak counter. The Notifications tab • In order to send messages via the e-mail server, check the E-mail notifications box and enter the e-mail addresses in the To and Copy fields. The validity of the addresses can be verified using the Test button. A message will be sent to the specified address. Entering several e-mail addresses is allowed, the addresses entered must be separated by semicolons.
Preventing virus outbreaks 99 After you are done with the settings press the Apply or the OK button.
CHAPTER 12. REPORTS Kaspersky Security 5.5 for Microsoft Exchange Server 2003 allows receiving reports about the results of the anti-virus Exchange Server protection and about the anti-spam protection results. Reports are generated automatically according to the schedule or manually by request and can be saved in a specified folder and sent by e-mail. Information contained in the reports saved on disk and those sent by e-mail is identical; however the format, structure and viewing method differ.
Reports Figure 37. The Report templates folder Apart from the reports' names, this table contains information on the status for each report created based on the template.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 12.1. Receiving reports In order to receive a report about an anti-virus server scan or an antispam scan: 1. Create a report template of an appropriate type (see section 12.1.1, page 104) or select an existing template and configure its settings (see section 12.1.2, page 107). 2. Check the Create a report box in the General tab of the report template settings window (see Figure 39).
Reports In order to restrict the report storage period: 1. In the main application window select the Kaspersky Security 5.5 for Microsoft Exchange Server 2003 node in the console tree, open it, select the node corresponding to the server you need and select the Report templates folder in the console tree. 2. Open the shortcut menu and use the Properties command or the analogous command under the Action menu. 3. In the Report templates Properties window that will open (see Figure 38): Figure 38.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 • To delete contents of the statistical database on program operation used for creating reports, click Clear report statistics button. After you have made the changes, press the Apply or the OK button to apply the new settings. The settings will change within one hour after the changes have been made. To exit without saving the changes, press the Cancel button. 12.1.1. Creating a report template In order to create a new report template, 1.
Reports Figure 39. Report template. The General tab Specify the reporting period and the report creation schedule settings in the Settings tab (see Figure 40). • • The following options are available when specifying the reporting period: • specify the time period. In this case, the report will contain information for the specified period starting with the report creation date and time.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 • Specify the time when reports will be created in the Generate report at field. Figure 40. Report template. The Settings tab Specify which format shall be used for reports creation and specify the reports storage folder and mailing list in the Actions tab (see Figure 41). • In order to create a report and save it in the server file system folder, check the Save report box. Then, specify the folder where reports will be saved.
Reports Figure 41. Report template. The Actions tab After you are done with the settings press the Apply or the OK button. As a result: • The report template will be added to the Report templates folder and will be displayed in the table in the results pane; • If the Create a report box in the General tab is checked, the application will create reports according to the time specified in the schedule and with the specified frequency. Reports can also be created by the administrator’s request. 12.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 2. Select the report template you need in the table displaying the list of created templates (see Figure 37). 3. Open the shortcut menu and use the Properties command or the analogous command under the Action menu. 4. As a result of these actions, a report template settings window : Properties will open.
Reports Figure 42. Viewing a report saved as a folder Reports have frame-based structure. The left frame contains the list of the report’s sections (table of contents); the heading and the content of the selected section are displayed in the right frame. In order to view a particular section, select its name in the table of contents and the content of the section will be loaded in the right frame. In order to view the report, delivered by e-mail, open index.htm file attached to the message.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 Figure 43. Viewing a report delivered by e-mail The upper part of the report contains the list of sections (table of contents). This part is followed by the sections including the information they contain. The sections are arranged in the same order as they are listed in the table of contents. The structure and the content of the sections are identical to those of the report saved to disk.
CHAPTER 13. APPLICATION’S EVENT LOGS Kaspersky Security 5.5 for Microsoft Exchange Server 2003 allows the user to perform full diagnostics of its operation and register events in the Microsoft Windows event log and in the Kaspersky Security application's log file. The degree of the completeness of the information entered into the logs depends on the diagnostics levels selected in the application’s settings (details see section 13.1, page 112).
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 format. If this maximum allowable number is exceeded at the time a new log is created, the oldest log of the same format will be deleted. The frequency for creating new logs and the maximum number of logs can be modified (details see section 13.2, page 114). New records entered into the application logs are added to the end of the newest file. The log size is not restricted.
Application’s event logs 2. Go to the Diagnostics tab in the General settings window that will open (see Figure 44). Figure 44. The Diagnostics tab The Diagnostics level for the system modules section located in the tab contains a table. The left part of the table contains the list of all modules included into the structure of the program. The right part of the table contains the list of components included into the selected module and the diagnostics level for each component.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 13.2. Configuring log settings In order to configure log settings: 1. In the main application window select the Kaspersky Security 5.5 for Microsoft Exchange Server 2003 node in the console tree, open it, select the node corresponding to the server you need and follow the General settings link in the results pane. 2. Go to the Diagnostics tab in the General settings window that will open (see Figure 44).
CHAPTER 14. LICENSE KEYS When you purchase Kaspersky Security 5.5 for Microsoft Exchange Server 2003, you enter into a license agreement with Kaspersky Lab. Based on this agreement, you are granted the right to use the software you purchased during a certain period for the protection of the specified number of mailboxes. Anti-virus protection covers both mailboxes and public folders.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 The number of objects not scanned during the period when the application functionality was restricted due to the violation of the license terms, can be viewed in the corresponding section of the General scan results report (see section 12.2, page 108). We recommend that you start a background scan after the functionality of the application is restored (after the new license key is installed) to scan these objects (see section 6.6, page 62).
License keys Figure 46). If you have trial license key installed, click Buy license. This will send you to the Kaspersky Lab website, where you will find complete information on buying or extending a license. 2. Install the license key (see section 14.2, page 119). You can install two keys: one current key and one backup key. The current key is the active key that you are using. The application cannot use more than one current key.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 Figure 45. Viewing license information The tab contains the following information: • the name of Exchange server where the Security Server component is installed; • the version (number) of the application installed; • license owner information; • license expiration date; • the status of the current license key; • application functionality available based on the current license key: o Full.
License keys outdated versions of its databases. Your license may be expired. • o Management services only. Only management services used to configure the application parameters (license key installation) are available. This may be caused by the expiration of the trial license key. o Update only. Only database updating feature is available. The databases may have been corrupted; therefore, the email scanning cannot be performed.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 • if you are installing or replacing the current license key, press the Add/replace… button in the Current license key section. • if you are installing or replacing the backup license key, press the Add key… in the Backup license key section. Figure 46. View license key info. Configuring license notifications 3. Specify the license key file (*.key) to be installed in the file select dialog box that will open.
License keys 14.3. Removing a license key When you remove your license key using the Kaspersky Security interface, only the registration of the key with the application will be removed. Physically, the key will remain on the media from which it had been added to the application. In order to remove a license key, 1. Select the node corresponding to the required server in the console tree and follow the General settings link in the results pane. 2.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 • the number of mailboxes on the mail server has exceeded the quote specified in the license; a record will be entered into the application’s logs and, if the notification parameters are configured, a message will be sent by e-mail to the specified email address. By default, a notification will be issued 14 days before your license period expires. You can set up an earlier or a later notification date.
License keys In order to remove protection from a storage area, 1. Select the node corresponding to the required server in the console tree and follow the Anti-virus protection link in the results pane. 2. Go to the Protected mail (see Figure 13) tab in the Anti-virus protection window that will open. • Uncheck boxes next to the names of storage areas in the Protected mailbox storages section for those storage areas whose mailboxes will not be scanned for viruses.
CHAPTER 15. APPLICATION MANAGEMENT USING KASPERSKY ADMINISTRATION KIT Kaspersky Administration Kit is a centralized system performing the main administration tasks pertaining to the management of corporate network security system built on the basis of applications included into the bundles of Kaspersky Anti-Virus Business Optimal or Kaspersky Corporate Suite. Kaspersky Security 5.
Application management using Kaspersky Administration Kit • 125 Deploy the Administration Server in the network; install Administration Console to the administrator's workplace (please refer to the administrator's guide for "Kaspersky Administration Kit" for details). You can manage the application using Kaspersky Administration Kit via its Administration Console (see Figure 47).
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 Application settings – a set of parameters defined for the operation of the application that includes parameters of the backup storage, reports generation service, etc. A distinctive feature of the centralized administration is the arrangement of computers into groups and modification of their settings by creating and defining group policies.
Application management using Kaspersky Administration Kit 127 Step 1. General information about the policy The first wizard dialog boxes are introductory steps, where you should enter the policy name into the Name field and select the Kaspersky Security 5.5 for Microsoft Exchange Server 2003 product from the Application drop-down list. Enable the Activate policy checkbox to enforce it immediately after creation. An application can only have one active group policy.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 Figure 49. Scanning of attachments Step 4. Enabling scanning of routed mail You can use the Protected e-mail dialog (see Figure 50) to disable scanning of mail routed by the server in order to decrease the load on the Exchange server (see section 6.4, page 56).
Application management using Kaspersky Administration Kit 129 Figure 50. Scanning of routed mail Step 5. Selecting the source of updates At this stage (see Figure 51), you are asked to configure the settings for antivirus database and content filtration database updates: • specify the update source (see section 5.3, page 41); • configure local network settings in the window that opens when you click the Connection parameters button (see section 5.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 Figure 51. Selecting the update source Step 6. Finalizing policy creation The final window of the wizard informs you that a new policy has been successfully created. After the wizard is closed, the policy for this application will be added to the Policies folder of the corresponding group and shown on the results panel.
Application management using Kaspersky Administration Kit 131 3. In the list of policies, point to a policy for Kaspersky Security 5.5 for Microsoft Exchange Server 2003 (the application name is displayed in the Application field). 4. Open the shortcut menu for the selected policy and click Properties. You will see a window with the policy properties for Kaspersky Security 5.5 for Microsoft Exchange Server 2003, consisting of several tabs.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 Figure 52. The General tab • Policy name; • The application this policy is assigned to (Kaspersky Security 5.5 for Microsoft Exchange Server 2003); • Application version (number); • Date and time of policy creation; • Date and time of the last policy modification. On this tab, you can edit the policy name, enable or disable it or define its activation whenever specified events occur. 15.1.2.2.
Application management using Kaspersky Administration Kit 133 Upon enabling of the anti-virus protection you will have to select one of three available levels of anti-virus protection: Standard, Extended or Redundant (see section 6.1, page 49). To enable anti-virus scanning of e-mail and contents of public folders stored on the server, check Enable background scan and configure the scan settings (for more on background scanning, see section 6.6, page 62). Figure 53. The Server protection tab 15.1.2.3.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 Figure 54. The Attachment scan tab 15.1.2.4. Scanning of routed mail You can use the Protected Mail tab (see Figure 55) to enable / disable scanning of mail traffic routed via an Exchange server. Configuration of these parameters is similar to the case of application management via its local interface (see details in section 6.4, page 56).
Application management using Kaspersky Administration Kit 135 Figure 55. The Protected Mail tab 15.1.2.5. The choice of actions over objects You can use the Actions on viruses tab (see Figure 56) to define the actions, which the Kaspersky Security application will perform whenever it reveals objects containing malicious code. In addition, you can enable the option to create a copy of the original object in the Backup storage prior to its disinfection.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 Figure 56. The Actions on viruses tab 15.1.2.6. The choice of actions over spam messages You can use the Actions on spam tab (see Figure 57) to define the actions, which the Kaspersky Security application will perform whenever it detects messages bearing signs of spam, and also to configure special markers for flagging the subject line of the message.
Application management using Kaspersky Administration Kit Figure 57. The Actions on spam tab 15.1.2.7. Configuring the server protection productivity Anti-Virus and Anti-Spam productivity Performance tab (see Figure 58). settings are configured on the These settings are configured in the same way as when configuring them through the application's own interface. For more, see Chapter 8, page 72.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 Figure 58. The Performance tab 15.1.2.8. Updating the anti-virus and content filtration databases You can use the Update tab (see Figure 59) to define the policy parameters for updating of the anti-virus and content filtration databases.
Application management using Kaspersky Administration Kit 139 Figure 59. The Update tab 15.1.2.9. Notifications on detected objects On the Templates and counters tab (see Figure 60), you can create notification templates for notifying the administrator or users when certain events occur in program operation. In order to create a new template, click the Append… button in the Notification templates section and use the resulting window to configure the notification template.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 Figure 60. The Templates and counters tab 15.1.2.10. Virus outbreak notification On the Templates and counters tab (see Figure 60) you can configure notification settings for virus activity. In order to create a new counter, click the Append… button in the Virus outbreak counters section and use the resulting window to configure the counter.
Application management using Kaspersky Administration Kit 141 settings are configured in the same way as when configuring them through the application's own interface. For more, see section 14.4, page 121. In addition, you can define whose account will be used when sending notifications by e-mail. By default notifications are sent under KSE (see section 10.3, page 91). Figure 61. The Notifications tab 15.1.2.12.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 Figure 62. The Additional tab 15.1.2.13. Registration of events on program operation on Administration Server On the Event processing tab (see Figure 63) you can configure settings for recording events that occur in program operation, on Kaspersky Administration Kit Administration Server, and the event notification mode for the administrator or users.
Application management using Kaspersky Administration Kit 143 Figure 63. The Event processing tab While running, the application generates a specific set of events. Every event is characterized by the level of its importance. There are four such levels: • Critical event • Functional failure • Warning • Informational message Events of the same type may have various importance levels depending upon the situation in which they occur.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 Please refer to the administrator's guide for Kaspersky Administration Kit for a detailed description of the Event processing tab. 15.1.2.14.
Application management using Kaspersky Administration Kit 145 Click Details to open a dialog box containing detailed information about the selected policy applied to each client computer (for details, see the administrator’s guide for Kaspersky Administration Kit). In addition, you can configure the procedure for modifying local application settings on client computers (for more, see the Kaspersky Administration Kit Administrator's Handbook). 15.2.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 for Kaspersky Administration Kit for details on work with reports). • Review the current statistics on application activity. • Configure the application. Most tabs in the window are identical to similar ones in the policy configuration window (see details in section 15.1.2, page 130). The section further will only describe the functionality different from the features provided for in policies. Figure 65. Client computer properties dialog.
Application management using Kaspersky Administration Kit 147 15.2.1. Reviewing the information about application The General tab (see Figure 66) displays general information about Kaspersky Security 5.5 for Microsoft Exchange Server 2003. The upper window part contains the title of the installed application, its version number, installation date, status (running or stopped on the local computer) and the information about the anti-virus database status. Figure 66. The application properties window.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 15.2.2. Reviewing the license key information The Licenses tab (see Figure 67) is purely informational. It displays the information about the current and the backup license keys installed on the selected computer. Figure 67. The Licenses tab 15.2.3. Start background scan Background scans of e-mail saved on the server and in public folders are run on the Server protection tab (see Figure 68).
Application management using Kaspersky Administration Kit 149 Figure 68. The Server protection tab 15.2.4. Selection of protected storage You can use the Protected Mail tab (see Figure 69) to enable/disable scanning of mail traffic routed via an Exchange server and also enable/disable protection of mailbox storages or public folders. By default, the application protects all mailbox storages and public folders existing on the protected mail server.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 Figure 69. The Protected Mail tab 15.2.5. Viewing reports On the Templates and counters tab (see Figure 70) you can create report templates, edit their settings, and view generated reports stored on a remote computer. The procedure for creating a report template is the same as the one described in section 12.1.1, page 104.
Application management using Kaspersky Administration Kit Figure 70.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 Figure 71. Report viewing window 15.3. Task management During application setup a list of system tasks is generated for each server. The list (see Figure 72) includes the tasks for updating of the anti-virus and content filtration databases. There is always just a single instance of system tasks on every server. You can run these tasks, configure their settings and schedule; they cannot be deleted.
Application management using Kaspersky Administration Kit 153 Properties dialog (see Figure 65) in the main program window. To configure the application tasks on the local computer, select the Local computer object (see Figure 47) in the console tree and use the Properties command from the right-click menu. 3. Open the Tasks tab (see Figure 72). It contains a complete list of tasks existing on that server. Figure 72. Properties reviewing window for a client computer.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 • Review general information about the task, launch or stop it (the General tab). • Customize specific parameters used to run the task (the Settings tab). • Create its schedule (the Schedule tab). • Configure task launch using an authorized account (the Account tab), please refer to the administrator's guide for Kaspersky Administration Kit for details.
Application management using Kaspersky Administration Kit 155 Tasks are launched in accordance with their established schedule. You can temporarily remove certain tasks from the list of scheduled ones. Doing so will not delete the tasks; instead, they will just be skipped. In addition, you can control tasks manually in the task list window (see Figure 72) and in the dialog for reviewing task settings (see Figure 73).
CHAPTER 16. FREQUENTLY ASKED QUESTIONS This chapter is devoted to questions most frequently asked by users regarding the installation, setup, and operation of Kaspersky Security for Microsoft Exchange Server 2003. We will try to answer them here in detail. Question: Can the application be used with other vendors' anti-virus software? Kaspersky Security 5.5 for Microsoft Exchange Server 2003 is an antivirus e-mail application designed to be used in corporate networks.
Frequently asked questions 157 scanning of various file types. However, do not forget that this leads to lowering the security level of your computer. Question: Why do I need a license key? Will my Kaspersky Security application work without it? Kaspersky Security 5.5 for Microsoft Exchange Server 2003 will not work without a license key.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 An additional feature available is the updating of the application modules to repair detected vulnerabilities or offer new functionality. Question: Can an intruder replace my anti-virus database? All anti-virus and content filtration databases are supplied with a unique signature verified by the application when it tries to use them.
Frequently asked questions 159 Kaspersky Security, files in that format can be damaged during their delivery via an Exchange server. Question: After installation of Kaspersky Security on one of servers in our organization, the nearest relay server began generating a queue of messages, which cannot arrive at our server. What should be done in such case? The situation results from the application of the Reject action to one of the messages containing signs of spam and addressed to your server.
Appendix A. Table of substitution macros This section lists all the macros used in configuring alternate templates for antivirus processing of files (see section 6.5, page 57) and settings for virus outbreak counters (see section 11.1, page 95) and notifications (see section 10.1, page 87). The macros available may differ in each specific case. To add a macro, use the Macros button when configuring the corresponding settings.
Appendix A Macros Macros meaning %CONTENT_TYPE% MIME object information %DATABASE_NAME% the name of the Microsoft Exchange Server database where the object was detected %FROM% displayed sender’s name %MAILBOX_NAME% name of the mailbox in which the object was detected %MESSAGE_URL_NAME% full name of the message where the object was detected %OBJECT_NAME% attachment name, not defined for OLE objects and for messages %OBJECT_TYPE% object type: message, file, OLE object %RECV_TIME% time t
Kaspersky Security 5.
Appendix B. Contacting the technical support service If you encounter problems while using Kaspersky Security, first check if the solution to your problem can be found in this documentation, specifically in the Frequently Asked Questions section (see Chapter 16, page 156), or in the Services/Knowledge base (FAQ) section of the Kaspersky Lab website (www.kaspersky.com).
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 In the next window of the web form, specify your contact information. Enter the security code from automatic registration and click the Send request button. The Technical Support team will analyze your problem and will assist you as soon as possible.
Appendix C. Glossary The product's documentation contains terms and concepts specific to the field of anti-virus protection. This glossary contains definitions of such concepts. For your convenience, the terms are arranged in the alphabetic order. А Administrator’s workstation – a computer on which the Management Console (a component of Kaspersky Security) is installed. This computer is used to configure and manage the server part of the application called the Security Server.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 C Container object – an object subject to anti-virus scan that consists of several objects, such as an archive, a message containing an attached message, etc. See also simple object. Content filtration database – database, created by Kaspersky Lab's specialists, containing samples of SPAM messages and words and phrases characteristic of SPAM and used for the linguistic analysis of the message content and attachments.
Appendix C 167 K Kaspersky Administration Kit – an application included into Kaspersky Anti-Virus Business Optimal and Kaspersky Corporate Suite and designed to provide a centralized solution for most important administration tasks associated with managing the corporate network anti-virus security system based on Kaspersky Lab’s applications.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 O Obscene messages – messages that contain obscene language. R Replacement template – a template used to create a text notification about infected objects detected or about a threat of a virus outbreak. Report template – a template used to create reports on the results of the anti-virus and the anti-spam server scan. A report template contains a set of parameters that define the reporting period, the reporting schedule and the report format.
Appendix C 169 V Virus activity level threshold – a maximum allowable number of events of a certain type within a specified time interval; when this number is exceeded, the situation is classified as increased virus activity and a threat of virus attack. This value is of great significance in the periods of virus outbreaks as it helps the administrator timely react on the emerging threats of virus attacks.
Appendix D. Kaspersky Lab Founded in 1997, Kaspersky Lab has become a recognized leader in information security technologies. It produces a wide range of data security software and delivers high-performance, comprehensive solutions to protect computers and networks against all types of malicious programs, unsolicited and unwanted email messages, and hacker attacks. Kaspersky Lab is an international company.
Appendix D 171 D.1. Other Kaspersky Lab Products Kaspersky Anti-Virus® Personal ® Kaspersky Anti-Virus Personal has been designed to provide anti-virus protection to personal computers running Microsoft Windows 98/ME or Microsoft Windows 2000/NT/XP against all known viruses, including potentially dangerous software. Kaspersky Anti-Virus Personal provides real-time monitoring of all sources of virus intrusion - e-mail, Internet, floppy disks, CD, etc.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 retrieval of daily updates for the anti-virus database and the program modules. A unique second-generation heuristic analyzer efficiently detects unknown viruses. A simple and convenient interface allows users to configure the program quickly making work with it easier than ever. ® Kaspersky Anti-Virus Personal Pro has the following features: • On-demand scan of local disks.
Appendix D 173 Kaspersky® Personal Security Suite Kaspersky® Personal Security Suite is a software suite designed for organizing comprehensive protection of personal computers running Microsoft Windows. The suite prevents malicious and potentially dangerous programs from penetrating through any possible data sources and protects you from unauthorized attempts to access your computer’s data, as well as blocking spam.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 • Exclude archives and e-mail databases from scanning. • Select standard/extended anti-virus databases for scanning. • Save a report on the scanning results in txt or html formats. ® Kaspersky OnLine Scanner Pro The program is a subscription service offered to the visitors of Kaspersky Lab's corporate website. The service allows an efficient online anti-virus scan of your computer and disinfection of dangerous files.
Appendix D 175 • Monitoring of changes in OS registry due to internal system registry control. • Blocking of dangerous VBA macros in Microsoft Office documents. • System restoration after malicious spyware influence accomplished due to recording of all changes in the registry and computer file system and an opportunity to perform their roll-back at user's discretion. Kaspersky® Internet Security 6.0 ® Kaspersky Internet Security 6.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 computer detection from outside. When you switch into that mode, the system will block all network activity except for a few transactions allowed in userdefined rules. The program employs complex approach to anti-spam filtering of incoming e-mail messages: • Verification against black and white lists of recipients (including addresses of phishing sites). • Inspection of phrases in message body.
Appendix D Kaspersky Anti-Virus® Business Optimal This package provides a unique configurable security solution for small- and medium-sized corporate networks. Kaspersky Anti-Virus® protection2 for: Business Optimal guarantees full-scale anti-virus • Workstations running Microsoft Windows 98/ME, Microsoft Windows NT/2000/XP Workstation and Linux. • File servers running Microsoft Windows NT 4.
Kaspersky Security 5.
Appendix D Kaspersky® Mail Gateway Kaspersky Mail Gateway is a comprehensive solution that provides complete protection for users of mail systems. This application installed between the corporate network and the Internet scans all components of e-mail messages for the presence of viruses and other malware (Spyware, Adware, etc.) and performs centralized anti-spam filtration of e-mail stream.
Appendix E. License agreement End User License Agreement NOTICE TO ALL USERS: CAREFULLY READ THE FOLLOWING LEGAL AGREEMENT ("AGREEMENT") FOR THE LICENSE OF SPECIFIED SOFTWARE ("SOFTWARE") PRODUCED BY KASPERSKY LAB ("KASPERSKY LAB"). IF YOU HAVE PURCHASED THIS SOFTWARE VIA THE INTERNET BY CLICKING THE ACCEPT BUTTON, YOU (EITHER AN INDIVIDUAL OR A SINGLE LEGAL ENTITY) CONSENT TO BE BOUND BY AND BECOME PARTY TO THIS AGREEM ENT.
Appendix E 181 All references to "Software" herein shall be deemed to include the software activation key ("Key Identification File") with which you will be provided by Kaspersky Lab as part of the Software. 1. License Grant.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 1.1.5 You shall not rent, lease or lend the Software to any other person, nor transfer or sub-license your license rights to any other person. 1.1.6 You shall not use this Software in automatic, semi-automatic or manual tools designed to create virus signatures, virus detection routines, any other data or code for detecting malicious code or data. 1.2 Server-Mode Use.
Appendix E 183 (i) Kaspersky Lab will provide you with the support services ("Support Services") as defined below for a period of one year following: (a) Payment of its then current support charge, and: (b) Successful completion of the Support Services Subscription Form as provided to you with this Agreement or as available on the Kaspersky Lab website, which will require you to produce the Key Identification File which will have been provided to you by Kaspersky Lab with this Agreement.
Kaspersky Security 5.5 for Microsoft Exchange Server 2003 (i) Kaspersky Lab warrants that for six (6) months from first download or installation the Software purchased on a physical medium will perform substantially in accordance with the functionality described in the Documentation when operated properly and in the manner specified in the Documentation. (ii) You accept all responsibility for the selection of this Software to meet your requirements.
Appendix E 185 (c) Loss of the use of money; (d) Loss of anticipated savings; (e) Loss of business; (f) Loss of opportunity; (g) Loss of goodwill; (h) Loss of reputation; (i) Loss of, damage to or corruption of data, or: (j) Any indirect or consequential loss or damage howsoever caused (including, for the avoidance of doubt, where such loss or damage is of the type specified in paragraphs (ii), (a) to (ii), (i).
