Kaspersky Anti-Virus for Mac. Reviewer s Guide

Transcription

1 Kaspersky Anti-Virus for Mac Reviewer s Guide

2 Table of contents 1 Introduction Key advantages An integrated approach to computer protection Intelligent allocation of resources Protection of virtual machines 4 3 Installation and setup Minimum system requirements Installation 5 4 User interface An intuitive and stylish interface 6 5 Features Virus scanning: quick or full Protection from all types of malicious programs Antivirus protection of the file system Exporting and importing protection settings Behavior upon detecting infected objects 11 6 Updates Reports Technical support

3 1 Introduction Despite the proliferation of Microsoft Windows, the market share of other operating systems continues to grow. Mac OS X, the second most popular commercial operating system, has nearly achieved a 5% share of global operating system sales. At the same time, Mac sales grew faster than PC sales in the past three years. In some regions, Apple s operating system already has a substantial, and growing, market share. Today, a vast majority of malicious programs are written for Windows operating systems. However, the situation has started to change in the past several years: the number of viruses, Trojans and other malicious programs for Mac OS X is growing. As Apple computers become more popular, the number of threats for Mac OS X will only grow. Kaspersky Lab currently detects a new Trojan designed specifically for Mac OS X every week. Clearly, each of these malicious programs can pose a threat to users. The new Kaspersky Lab product for Apple Mac computers protects Mac OS X users from all types of malicious programs. Its intuitive interface makes it easy to use even for inexperienced users. The product also combats malicious programs that do not manifest themselves in any way in Mac OS X but can damage the files of Windows users when data is exchanged between computers of these operating systems. Additional information: The evolution of malware for Mac OS vulnerabilities: Additional information: Malware beyond Vista and XP: 3

4 2 Key advantages 2.1 An integrated approach to computer protection The Kaspersky Lab solution for Mac OS X combines the advantages of Kaspersky Lab s new antivirus engine with those of multiplatform protection from IT threats for home and corporate networks. Kaspersky Anti-Virus for Mac not only provides protection from viruses, worms and Trojans expressly written for Mac OS X but also combats similar threats which affect Windows and Unix operating systems. To ensure reliable protection of mixed networks, the new product has access to Kaspersky Lab s global antivirus database, which contains information about over 25 million malicious programs for various computer platforms. Kaspersky Anti-Virus for Mac, like Kaspersky Lab antivirus products for other operating systems, receives antivirus database updates on an hourly basis, protecting users computers from the numerous new malicious programs that appear on the Internet every day. 2.2 Intelligent allocation of resources When scanning files and attachments downloaded from the Internet, Kaspersky Anti-Virus for Mac optimizes the use of resources on the computer. If user activity increases, the antivirus scanner s task becomes a lower priority, thereby giving the user maximum access to system resources on the computer and improving the performance of user applications. 2.3 Protection of virtual machines Kaspersky Anti-Virus for Mac provides protection when working with shared folders used by virtual machines, which are becoming increasingly popular not only among corporate users but among home users as well. This prevents viruses from being transferred to the Mac OS X operating environment from a Windows or Unix virtual system, a feature that will be appreciated by Mac users who work with more than one operating system. Additional information: Mac OS X: 4

5 3 Installation and setup 3.1 Minimum system requirements For Kaspersky Anti-Virus for Mac to function properly, the computer should meet the following system requirements: o Intel CPU (PowerPC processors are not supported); o 512 MB free RAM; o 80 MB free space on the hard drive; o Mac OS X or later operating system. 3.2 Installation The Kaspersky Anti-Virus installation package includes programs that install and uninstall the application. To install Kaspersky Anti-Virus on the computer, the user should run the distribution file (*.dmg) and select the Kaspersky Anti- Virus installation program. With the Kaspersky Anti-Virus installation assistant, the application is installed in a series of steps. The user can navigate between these steps using the Continue (go to the next step) and Go Back (go to the previous step) buttons. After selecting the drive on which the application will be installed, the user needs to choose the installation type. If the standard installation options are suitable, the user should select the Install button and enter the system administrator s password to confirm installation. To use a different installation folder, the user should select the Change installation folder button and select a different drive. For custom installation of the application, the user should click the Preferences button. After installation, the user is prompted to activate the product by entering the activation code in the Activation code field. 5

6 4 User interface 4.1 An intuitive and stylish interface Keeping in mind that a user-friendly and attractive user interface is essential for Mac applications, Kaspersky Lab designed a brand new animated interface for its new product. It is very user-friendly both from a beginner s and a professional s point of view. Information on protection status and the actions that need to be taken is presented to users in a clear and accessible way. The new products include a fully automatic operating mode in which the application does not annoy the user with prompts and alerts, making all decisions independently. The current protection status is indicated by a traffic light in the application s main window. There are three possible protection statuses, each indicated with a color, like lights in a traffic light. Green means that your computer s protection is up to par, yellow and red mean that there are security problems, which may have to do with the settings or operation of Kaspersky Anti-Virus. The user can modify the application s appearance with customized graphics and color schemes. 6

7 5 Features 5.1 Virus scanning: quick or full Kaspersky Anti-Virus for Mac has the following capabilities to combat computer threats: o scanning for and neutralizing malicious code on demand or automatically; o searching for and analyzing malicious or potentially unwanted objects in areas specified for scanning; o isolating objects for further analysis, disinfecting or deleting malicious objects. The application includes pre-configured tasks which users need most often: full scan of all objects on the computer and quick scan of critical areas. The user can customize either task if necessary. The user can also select specific folders for scanning in the Virus scan section. When running a full or quick scan of the computer for viruses and other malicious programs, the user can set the security level and define the actions to be performed by the application if malicious software is detected. 7

8 5.2 Protection from all types of malicious programs Kaspersky Anti-Virus for Mac allows the user to configure the scope of protection. By default, Kaspersky Anti-Virus for Mac detects and blocks viruses, Trojans and hacking tools. In addition, the user can configure the product to protect from spyware, adware and potentially unwanted programs, as well as from dialer programs. The scope of Kaspersky Anti-Virus protection is configured in the Threats tab of the application preferences window. It includes the list of threats the application will protect against, as well as the list of objects included in the trusted zone, which will be excluded from scanning. It makes sense to include those programs which the user firmly believes to be perfectly safe into the trusted zone in order to ensure that Kaspersky Anti-Virus does not block access to these objects. 8

9 5.3 Antivirus protection of the file system The file system may contain viruses and other malicious programs which, once they enter the computer from a removable drive or the Internet, can remain in the file system for years without revealing their presence in any way. However, if an infected file is opened, the virus will immediately begin performing malicious actions. File Anti-Virus is a component that monitors the computer s file system in real time. By default, it starts at system startup, remains resident in RAM and scans all files that are opened, executed or saved on your computer and any drives attached to it The File Anti-Virus module provides file protection at one of the following levels: o Maximum protection. Maximum control of the files that are opened, saved and executed. o Recommended. This level s parameters are recommended by Kaspersky Lab experts. o Maximum speed. The range of files scanned at this level is limited, allowing the user to use applications that require large amounts of RAM without any inconvenience. By default, the application is configured for the Recommended level of protection. When specifying the file types for scanning the user can define the format, size and on which disks scanning will be performed for files that are opened, executed or saved. The file types to be scanned are defined in the File types section. The user needs to choose one of the following three options: o Scan all files. In this case, all files that are opened, executed or saved will be scanned. o Scan programs and documents (by content). If this option is selected, File Anti-Virus will scan only those files that can potentially be infected, i.e., into which malicious code can be injected. Before a file is scanned for malware, its format (.txt,.doc,.exe etc.) is analyzed. If the analysis reveals that this file format cannot be infected, the file is not scanned for malware and becomes available to the user immediately. If a file s format makes it possible for the file to be infected, then the file is scanned for malware. o Scan programs and documents (by extension). In this case, File Anti-Virus will scan only those files that can be infected, but the file s format will be determined based on its extension only. 9

10 Self-defense Kaspersky Anti-Virus for Mac protects itself from being removed or damaged. The solution includes special mechanisms that prevent deletion or modification of its files on the hard drive or in RAM, as well as remote control of the program. The application provides the user with full information support: Kaspersky Anti-Virus displays protection status messages and offers detailed help information. The Security Assistant included in the application provides the user with a detailed account of the computer s current protection status and can begin to resolve problems immediately should they arise. 5.4 Exporting and importing protection settings Kaspersky Anti-Virus for Mac allows the user to export or import its settings. This is helpful, e.g., if the application is installed both on the user s home computer and in the office. The user can configure a convenient set of settings on one computer, save these parameters on a removable medium and quickly and easily import them to the other computer. The parameters are stored in a dedicated configuration file. 10

11 5.5 Behavior upon detecting infected objects Under default settings, if an infected object is detected, the antivirus product blocks access to the infected file and prompts the user to select one of the following actions: disinfect the file, delete or skip it. The type of alert to be used by the product sound or popup message can be configured in the product s settings. Kaspersky Anti-Virus can also be configured to perform certain actions on infected files automatically rather than prompt the user for action. If a file cannot be disinfected, the product will suggest deleting it. When the solution deletes an infected object, it saves its backup copy, making it possible to restore the deleted file if necessary. If a file is suspicious, it is quarantined (and the user is alerted). The user can restore a file from quarantine at any time. 11

12 6 Updates Keeping protection up-to-date is a prerequisite for any computer s security. Tens of thousands of new viruses, Trojans and other malicious programs appear globally every day, so the user needs to be sure that important information is well protected. Updating the application involves downloading and installing antivirus databases on the computer. Information on the computer is protected using the application s antivirus databases. The File Anti-Virus and the virus scanning tasks use the databases to search for and neutralize dangerous objects on the computer. Updating databases on a regular basis is recommended, since records of new threats and ways to combat them are added to the databases on an hourly basis. If a new version of the application is released, the user is notified and is sent a link for downloading the new version of the application. Kaspersky Anti-Virus uses dedicated Kaspersky Lab update servers as the principal source of updates. The update module included in Kaspersky Anti-Virus for Mac provides the following functions: o updating databases and modules included in the application from Kaspersky Lab update servers; o backing up all the files that are updated in case the latest update needs to be rolled back; o storing copies of the updates received on the local network to provide other computers on the network with access to them (in order to save Internet traffic); o rescanning quarantined files using the new databases, recovering objects from quarantine upon demand. 12

13 7 Reports Kaspersky Anti-Virus for Mac allows the user to view detailed statistics on the results of its operation, as well as all the events that took place while the application was running. A detailed report is also generated for each of the application s components: File Anti-Virus, updates and scanning for malware. The report window includes the following tabs: o Detected: the list of all malicious and suspicious objects detected by the File Anti-Virus or virus scan tasks. To disinfect malicious objects immediately, the Disinfect all button should be selected. To include the objects disinfected in the list, the Show disinfected objects flag should be set. o o o o o Events: the list of all the events recorded during operation of Kaspersky Anti-Virus. Quarantine: the list of objects in quarantine. Backup: backup copies of deleted files that cannot be disinfected. Running tasks: all the tasks that are currently running. Completed tasks: all the tasks completed earlier (in chronological order). The user has the option to control the operation of File Anti-Virus, as well as virus scan and update tasks (start, stop, suspend and resume operation) from the reports window. 13

14 8 Technical support Technical support for users of Kaspersky Anti-Virus for Mac, as well as users of other Kaspersky Lab products, is available by telephone, via the support.kaspersky.com website or by via 14