Avira AntiVir Server Windows User Manual

Transcription

1 Avira AntiVir Server Windows User Manual

2 Trademarks and Copyright Trademarks AntiVir is a registered trademark of Avira GmbH. Windows is a registered trademark of the Microsoft Corporation in the United States and other countries. All other brand and product names are trademarks or registered trademarks of their respective owners. Protected trademarks are not marked as such in this manual. This does not mean, however that they may be used freely. Copyright information Code provided by third party providers was used for Avira AntiVir Server. We thank the copyright owners for making the code available to us. For detailed information on copyright, please refer to Third Party Licenses in the Program Help of Avira AntiVir Server.

3 Table of Contents 1 Introduction Icons and emphases Product information Functionality Delivery scope System requirements Licensing License models Installation and uninstallation Installation Uninstallation Installation and uninstallation on the network Installation on the network Uninstallation on the network Command line parameter for the setup program Parameter of the file setup.inf User interface and operation User interface: AntiVir Server Console User interface: Tray icon Quickstart Scanner Scanner Updates Viruses and more Viruses and other malware Extended threat categories Info and Service Technical support Suspicious file Reporting false positives Your feedback for more security Reference: Configuration options Scanner Action on detection Further actions Archives Archives Exceptions Heuristics Report Guard Action on detection Further actions ii

4 Table of Contents Exceptions Products Heuristics Report General Threat categories Password Security WMI Events Reports Directories Update Update File server Proxy Warnings Guard Scanner Acoustic alerts Guard Scanner Updater template iii

5

6 1 Introduction Your AntiVir program protects your computer against viruses, worms, Trojans, adware and spyware and other risks. In this manual these are referred to as viruses or malware (harmful software) and unwanted programs. The manual describes the program installation and operation. For further options and information, please visit our website: The Avira website lets you... access information on other AntiVir desktop programs download the latest AntiVir desktop programs download the latest product manuals in PDF format download free support and repair tools access our comprehensive knowledge database and FAQs for troubleshooting access country-specific support addresses. Your Avira Team 1

7 2 Icons and emphases The following icons are used: Icon / designation Explanation Placed before a condition which must be fulfilled prior to execution of an action. Placed before an action step that you perform. Placed before an event that follows the previous action. Warning Placed before a warning of the danger of critical data loss. Placed before a link to particularly important information or a tip which makes your AntiVir program easier to use. The following emphases are used: Emphasis Cursive Bold Explanation File name or path data. Displayed software interface elements (e.g. window heading, window field or options box). Clicked software interface elements (e.g. menu item, section or button). 2

8 3 Product information 3.1 Functionality The Avira AntiVir Server protection package includes the Avira AntiVir Server service and the AntiVir Server Console. The Avira AntiVir Server service protects your Windows Server from viruses and malware. The AntiVir Server Console is used for management, control and monitoring of the servers to be protected or of the AntiVir services on the servers to be protected. You can access any number of servers via the AntiVir Server Console. The Avira AntiVir Server service... protects your servers against viruses and malware. You install the service on all Windows servers to be protected on the network. The AntiVir Server service provides comprehensive functions to protect your system in one package with several program components and other help programs. Overview of the main components: The Scanner scans your computer system for viruses and unwanted programs (on-demand scan). Affected files are deleted, repaired or moved to quarantine depending on the configuration. Scanner scans are performed automatically. The interval and scope of scans can be configured. The Guard runs in the background. It monitors and repairs files, if necessary, during operations such as opening, writing and copying in real time. The Scheduler supports you in planning regular tasks such as scans and updates via the Internet or Intranet. The Updater always keeps your program up to date via an Internet or intranet connection. 3

9 Avira AntiVir Server The quarantine manager conveniently manages and monitors the files placed in quarantine. AntiVir Server Console... provides a desktop for AntiVir Server services with which you can control, configure and monitor AntiVir Server services. You install the AntiVir Server Console on at least one computer with a network connection to the servers to be protected. AntiVir Server Console can also be installed on the servers to be protected. The AntiVir Server Console can be connected to any number of servers to be protected and provides access to components, reports, events and to the Configuration of the connected AntiVir Server service. 3.2 Delivery scope Main features: Console for monitoring, management and control of the whole program Simple, keyword-based configuration: support for configuration through integrated wizard and context-sensitive help Configuration and operation from separate computer possible: user interface (AntiVir Server Console) can be installed separately from the AntiVir Server service Network management via the Avira Security Management Center (SMC) Scanner (on-demand scan) with profile-controlled and configurable scan for all known types of viruses and malware Resident virus guard (real-time scan or on-access scan) for constant monitoring of all file accesses Extremely high virus and malware detection via innovative scanning technology (scan engine) including heuristic scanning method Innovative AHeAD (Advanced Heuristic Analysis and Detection) technology for detection of unknown or fast changing attackers for proactive security Detection of all conventional archive types including detection of nested archives and smart extension detection Comprehensive filter functions and file caching to increase scanning speed "Multi-threading capability": simultaneous scanning of many files at high speed Configurable reactions to a detection: repair, deletion, moving to a quarantine directory, blocking, renaming and isolation of programs or files; automatic removal of viruses and malware Quarantine manager: infected files can be deleted in the quarantine directory or restored at their place of origin Integrated scheduler for planning one-off or recurring jobs such as updates or scans Automatable updating via the Internet or network-wide distribution (without system interruption) 4

10 Product information Comprehensive logging, warning and messaging functions for the administrator; sending of warnings in Windows networks and by (SMTP), SMTP authentication possible Protection against modification of the program files as a result of intensive selftest Extended terminal server support Rootkit protection (not under Windows XP 64 bit, Windows bit, Windows Server bit) Support for Windows Management Instrumentation 3.3 System requirements The Avira AntiVir Server has the following requirements for successful use of the Avira AntiVir Server service and the AntiVir Server Console: Computer Pentium or later, at least 266 MHz Operating system Windows XP, SP2 (32 or 64 bit) or Windows Vista (32 or 64 bit, SP 1 recommended) or Windows 7 (32 or 64 bit) or Windows Server 2003, SP1 (32 or 64 bit) or Windows Server 2008 (32 or 64 bit) or Windows Server 2008 R2 (64 bit only) At least 150 MB of free hard disk memory space (more if using quarantine for temporary storage) At least 512 MB RAM under Windows Server 2003 At least 1024 MB RAM under Windows Vista, Windows 7, Windows Server 2008 and Windows Server 2008 R2 For installation of the Avira AntiVir Server: Administrator rights Internet access For regular updates it is necessary for a server in your network to have Internet access. Alternatively, the updates can also be downloaded from a file or HTTP server in the Intranet. More information is available under Update. 3.4 Licensing You require a license to use Avira AntiVir Server. Activate your license for Avira AntiVir Server with the license file hbedv.key. You can obtain the license file by from Avira GmbH. The license file contains the license for all products that you have ordered in one order process. You thereby accept the license terms. 5

11 Avira AntiVir Server License models You can use the many functions of Avira AntiVir Server with the following license models: Evaluation version: Complete range of functions, 30-day license. Full version Licensing comprises a license for all platforms and depends on the number of users in the network who are to be protected by Avira AntiVir Server. For further information on the licensing versions and the optional support offers, please go to our website: The delivery scope of a full version comprises: provision of AntiVir version to download from the Internet four weeks installation support from date of purchase newsletter service (by ) update service via Internet 6

12 4 Installation and uninstallation 4.1 Installation Before installing Avira AntiVir Server, certain conditions must be met: Please ensure that the system requirements are met (see System requirements), and that the Windows Server used is running. Ensure that you are logged in on the server as an administrator or as a user with administrator rights. Ensure that an Internet connection or network connection to a download server exists for updating the Avira AntiVir Server. If you use a fileserver, you may require a user name and a password for server login. When installing the full version: ensure that a valid license file hbedv.key exists and is stored in a local directory on the server. When installing the service Avira AntiVir Server: If you want to connect remotely to the protected server with the AntiVir Server Console, ensure that the following ports are opened: 139 (NetBIOS SSN) 137 (NetBIOS NS) 138 (NetBIOS DGM) Installation types During installation you can select a setup type in the installation wizard: Express Avira AntiVir Server is installed together with the Avira AntiVir Server service, the AntiVir Server Console and all recommended program components. No destination folder can be selected for the program files to be installed. User-defined You can select whether you want to install the Avira AntiVir Server service and/or the AntiVir Server Console. You have the option to select and install additional functions for the Avira AntiVir Server service: AntiVir Rootkit Protection: This function contains the rootkit scan profile, which you can use to look for hidden malware. VMware Offline Scanner: This function contains the VMware-Image scan profile, which you can use to perform an offline scan of VMware images for viruses and unwanted programs. Shell Extension: This function generates an entry in the context menu of Windows Explorer that can be used to scan directories for viruses and unwanted programs. AntiVir Systray tool: This function generates a tray icon for the Avira AntiVir Server in the notification area of the protected server. This enables you to monitor the status of the Avira AntiVir Server and gives you access to other Avira AntiVir Server functions. The function is part of the express installation and can be deselected if you are performing a user-defined installation. 7

13 Avira AntiVir Server A target folder can be selected for the program files to be installed. Performing installation Installing the Avira AntiVir Server: Start the setup by double-clicking the installation file that you have downloaded from the Internet or insert the program CD. The installation wizard opens. Follow the instructions of the installation wizard. Complete the following installation steps: Where appropriate, install Microsoft Visual C Redistributable Kit, if the kit has not already been installed. Avira AntiVir Server uses the runtime libraries of the Microsoft Visual C Redistributable Kit. To use the Avira AntiVir Server, Microsoft Visual C Redistributable Kit must be installed. Confirmation of license agreements Selection of the type of setup (express installation or user-defined installation) Licensing of the Avira AntiVir Server: Load the license file or select a 30-day test license Installation of Avira AntiVir Server service and/or AntiVir Server Console If you have installed the Avira AntiVir Server service, a configuration wizard opens after the installation has been completed. You have the option of configuring the most important settings of the installed Avira AntiVir Server service. Defining AHeAD (Advanced Heuristic Analysis and Detection) technology settings. The settings are defined for Scanner and Guard. Selection of extended threat categories: By selecting other extended threat categories to be detected and reported by the Avira AntiVir Server, you can adapt the protective function of the Avira AntiVir Server to meet your needs. Selection of product exceptions (Guard): You can select software products to be exempt from monitoring by the Guard (on-access Scanner). In this way you can avoid any loss of performance that the Guard may cause. Select settings: You can define the server settings for sending . Avira AntiVir Server uses SMPT to send s send alerts to the Avira AntiVir Server administrator. After installation, your own system is automatically added by the AntiVir Server Console (Local Host/ ) as a server to be protected, even if no AntiVir Server service is installed. If you want to add or remove program components of the current Avira AntiVir Server installation, use the Avira AntiVir Server setup. 4.2 Uninstallation Carry out uninstallation via the Control Panel of the operating system or via the setup of your AntiVir program. 8

14 Installation and uninstallation During uninstallation, the AntiVir services are stopped, all report files and infected files (in quarantine) are deleted. During uninstallation you can specify that the directories with the report files and the quarantine are not deleted. 4.3 Installation and uninstallation on the network To simplify installation of AntiVir programs on a network of multiple client computers for the system administrator, your AntiVir program has a special procedure for the initial installation and the change installation. For automatic installation, the setup program works with the control file setup.inf. The setup program (presetup.exe) is contained in the program s installation package. Installation is started with a script or batch file and all necessary information is obtained from the control file. The script commands therefore replace the usual manual inputs during installation. Please note that a license file is obligatory for initial installation on the network. Please note that an installation package for the AntiVir program is required for installation via a network. An installation file for Internet-based installation cannot be used. AntiVir programs can be easily shared on the network with a server login script or via SMS. For information on installation and uninstallation on the network: see Chapter: Command line parameter for the setup program see Chapter: Parameter of the file setup.inf see Chapter: Installation on the network see Chapter: Uninstallation on the network Installation on the network The installation can be script-controlled in batch mode. The setup is suitable for the following installations: Initial installation via the network (unattended setup) Change installation and update We recommend that you test automatic installation before the installation routine is implemented on the network. To install AntiVir programs on the network automatically: You must have administrator rights (also required in batch mode) Configure the parameter of the file setup.inf and save the file. 9

15 Avira AntiVir Server Begin installation with the parameter /inf or integrate the parameter into the login script of the server. Examples: presetup.exe /inf="c:\temp\setup.inf" Uninstallation on the network To uninstall AntiVir programs on the network automatically: You must have administrator rights (also required in batch mode) Start the uninstallation with the parameters /inf and /AVUNINSTALL or integrate the parameters into the login script of the server Command line parameter for the setup program Use the following parameters for installation and uninstallation: /INF=<Script name with path> The setup program starts with the script mentioned and retrieves all parameters required. Installation: PRESETUP.EXE /INF=e:\disks\setup.inf Uninstallation: PRESETUP.EXE /INF=e:\disks\setup.inf /AVUNINSTALL /SILENT The setup script runs down completely without user interaction Parameter of the file setup.inf In the control file setup.inf, you can set the following parameters in the [DATA] field for the automatic installation of the AntiVir program. The sequence of the parameters is unimportant. If a parameter setting is missing or wrong, the setup routine is aborted and an error message is displayed. InstallPath Destination path in which the Avira AntiVir Server is installed. It has to be included to the script. The environment variable cannot be used. Example: InstallPath="%PROGRAMFILES%\Avira\AntiVir Server\" 10

16 Installation and uninstallation LicenseFile=<Path and file name of the license file> Avira AntiVir Server is installed with the license. If you enter the file name only, the license file will be searched in the source folder of the setup only. Example: LicenseFile="A:\hbedv.key" RestartWindows= 0 1 If a restart of the system is required after the installation, this can be performed automatically (standard) or a message box is displayed. 0: Disabled (restart with Message Box) 1: Enabled (automatic restart) DeleteFolderOnUninstall=1 Deletes the configuration during uninstallation Guard= 0 1 Installs the AntiVir Guard (on-access Scanner). 1: Install AntiVir Guard (default) 0: Do not install AntiVir Guard RootKit= 0 1 Installs the AntiVir rootkit protection module. The module detects malware hidden in the system. 1: Install AntiVir Rootkit Protection 0: Do not install AntiVir rootkit protection (default) VMWare= 0 1 Installs the VMWare offline Scanner. The module performs an offline scan of VMWare images for viruses and malware. 1: Install VMWare offline Scanner 0: Do not install VMWare offline Scanner (default) ShellExtension= 0 1 Installs the Shell extension. Directories can be scanned directly for viruses and unwanted programs using an entry in the Windows Explorer context menu. 1: Install Shell extension (default) 0: Do not install Shell extension Systray=

17 Avira AntiVir Server Installs the Systray tool. An Avira AntiVir Server tray icon is visible in the notification area of the protected server. The Tray Icon lets you monitor the status of the Avira AntiVir Server and gives you access to other Avira AntiVir Server functions. 1: Install Systray tool (default) 0: Do not install Systray tool GUI= 0 1 Installs the AntiVir server console user interface, which allows you to remotely manage and configure the AntiVir server services running on protected servers. 1: Installs the AntiVir server console (default) 0: Does not install the AntiVir server console In the [FEEDBACK] section the setup enters error codes and error test which are reported by the setup: Example: ErrCode=0 ErrMsg=Product was installed successfully 12

18 5 User interface and operation 5.1 User interface: AntiVir Server Console The Avira AntiVir Server service that is installed on the servers to be protected is managed via the AntiVir Server Console. The AntiVir Server Console is a snap-in of the Microsoft Management Console (MMC). You can create any number of servers to be protected on the AntiVir Server Console in order to configure and monitor them on the AntiVir Server Console. Please note that only the proprietary elements of the AntiVir Server Console are documented in this help. For information on the MMC and on manual integration of a snap-in, please refer to the user manual or the online help of the operating system. Starting and closing the AntiVir Server Console Start the AntiVir Server Console via the Avira AntiVir Server user interface link in the Windows Start menu or under All programs. You can also load the AntiVir Server Console directly in the MMC. You will find the preconfigured AntiVir Server Console in the installation directory of the AntiVir Server Console. To close the AntiVir Server Console, you must close MMC. Operation Navigate via the console structure in the left-hand window of the MMC. Navigation elements are also displayed as objects in the right-hand detail window of the MMC. Open these objects in the detail window by double-clicking. The Configuration is located under the Settings node. You can select various configuration sections in the detail window: the window Settings is opened in which you can configure the selected section. Commands and actions are available via icons in the detail window and via context menus of the individual console nodes or of objects in the detail window. 13

19 Avira AntiVir Server When configuring a server, you must confirm information in the window Settings with the button OK or Accept in order to accept the new settings. Your settings are cancelled with the button Cancel. AntiVir Server Console overview Avira AntiVir Server Display of the created servers with connection status Actions: Add server The local AntiVir server and all AntiVir severs added by the registered user are displayed on the AntiVir Server Console. Server Display of server status Overview Actions: Start product update, update license file, reload configuration, display report file, rename server, disconnect server, connect server, delete server Overview of... the system status (last system test, last update, license) the statistical data of the on-access scan of the Guard and the on-demand scan of the Scanner the program version Contact and support addresses Profiles Display of the default profiles and of the profiles created for the on-demand scan Actions: create new profiles, rename profiles, delete profiles Quarantine Display of the objects in quarantine Actions: Display object properties, restore object, add file to quarantine, send object to Avira Malware Research Center, delete object Scheduler Display of all created scanning and update jobs Actions: insert new jobs, display job properties, edit job, delete job Reports Display reports of scans of on-demand scan and updates Display report, display report file, print report, delete report Events Display all events of the Avira AntiVir Server service on the server to be protected Actions: display events, export events, delete events Settings Configuration of the Avira AntiVir Server service on the server to be protected Configuration sections: Scanner: Configuration of on-demand scan Guard: Configuration of on-access scan 14

20 User interface and operation General: Extended risk categories for on-demand and on-access scans, password protection for the server on the AntiVir Server Console, security alerts for outdated Avira AntiVir servers, directories used, restriction of reports and of event log Update: Download via web server or file server, product updates, configuration of connection to the download server Alerts: Configuration of network alerts of the Guard and Scanner Configuration of alerts via SMTP from the Guard, Scanner, Updater modules 5.2 User interface: Tray icon After installation of the Avira AntiVir Server service, the Avira AntiVir Server tray icon is displayed on the protected server in the notification area. The tray icon displays the status of the AntiVir Guard service: Icon Description AntiVir Guard is enabled AntiVir Guard is disabled You can access the functions via the tray icon context menu. To open the context menu, click the tray icon with the right-hand mouse button. Start AntiVir: Opens the AntiVir Server Console for management of the connected AntiVir Server. This option is only available if an AntiVir Server Console has been installed locally on the computer and if you are logged on to the computer with administrator rights. Check 'My Documents': Starts the Scanner scan profile "My Documents": The default "My files" location of the logged-in user is scanned for viruses and unwanted programs. Help: opens the Online Help. Avira on the Internet: Opens the Avira web portal. The AntiVir Server Console can also be opened by double-clicking the tray icon. 5.3 Quickstart Carry out these steps if you are using the Avira AntiVir Server for the first time: 1. Installation Install the Avira AntiVir Server service on the servers that you want to protect against viruses and unwanted programs. Install the AntiVir Server Console on at least one computer on your network. See chapter Installation. 15

21 Avira AntiVir Server 2. Management on the AntiVir Server Console Add server Add all servers on the AntiVir Server Console that you want to manage on the AntiVir Server Console. See Chapter AntiVir Server Console. Carry out the following steps for every server added: Configuration Configure the Avira AntiVir Server service on the server to be protected. Assign a password for the server on the AntiVir Server Console. See Chapters Settings and Settings::General::Password. Carry out update and system scan First carry out an update. For this, create an update job in the Scheduler. Select "Immediately" as the start time. Carry out a complete system scan. For this, create a scan job in the Scheduler. For the scan job, select "Local hard disks" as the profile and "Immediately" as the start time. See Chapter Scheduler. Define scans and update jobs Define scans and update jobs. To configure Scanner scans, first create, where appropriate, user-defined profiles under Scheduler In the next step you can create the scans and update jobs under Scheduler. See Chapters Scan and Scheduler. 16

22 6 Scanner 6.1 Scanner With the Scanner component, you can carry out targeted scans (on-demand scans) for viruses and unwanted programs. The following options are available for scanning for infected files: Scan in Scheduler (remote and local) The Scheduler gives you the option to schedule the times at which scan jobs are to be executed on the protected server. Scan via Profile (remote and local) Profiles enable you to initiate defined and configured scan profiles on the protected server. Shell Extension: Scan from the context menu in Windows Explorer (local only) You have the option to use the Scan selected files with AntiVir entry in the context menu of a directory to scan that directory for viruses and unwanted programs. The Shell Extension function is an additional component that is only available if it was selected during the user-defined installation. Scanning of own documents using the context menu of the tray icon (local only) You can initiate a scan for viruses and unwanted programs in the Windows 'My files' user directory of the protected server by choosing the My Documents entry in the tray icon context menu. Special processes are required when scanning for rootkits, boot sector viruses, and when scanning active processes. The following options are available: Scan for rootkits via the scan profile Scan for Rootkits and active malware Scan active processes via the scan profile Active processes Scan for boot sector viruses in all scan profiles by activating the corresponding options under Settings::Scanner::Scan: Additional settings 17

23 7 Updates The effectiveness of anti-virus software depends entirely on the scanning engine and the virus definitions being up-to-date. For this reason, regularly download updates for the Avira AntiVir Server from our download servers. To enable regular updates to be performed, the Updater component is integrated in the Avira AntiVir Server. The Updater component updates the following program components: Virus definition file Scan engine Program files (product update) The Scheduler facility on the AntiVir server console allows you to create update jobs that will be executed by AntiVir Updater at the specified intervals. Following the installation of AntiVir server, an update job is created that will be executed by default at the following interval: 60 minutes. With every update order, the status of the virus definition files and the scan engine is checked and updated if necessary, product updates are performed in accordance with the configuration. You can initiate a manual product update from the context menu of a server node on the AntiVir Server Console. A restart of the system after an update is required only after a product update. You can obtain updates via the following servers: directly from the Internet via a web server of Avira GmbH via a web server or file server on an intranet, which downloads the update files from the Internet as the master server and supplies them to other servers. This is useful if you want to update Avira AntiVir Server on more than one computer on a network. A download server on an intranet can be used to ensure the Avira AntiVir Server is up-to-date on the protected servers using a minimum of resources. To set up a functioning download server on an intranet, you need a server that is compatible with the update structure of the Avira AntiVir Server. When a web server is used, the HTTP protocol is used for the download. When using a file server, access to the update file is provided via the network. The update is configured on the AntiVir Server Console. You can use AntiVir Internet Update Manager (file server or web server in Windows) as a web server or file server in the intranet. AntiVir Internet Update Manager mirrors the download servers of AntiVir products (including the Avira AntiVir Server) and can be obtained on the Internet from the Avira website: 18

24 8 Viruses and more 8.1 Viruses and other malware Adware Adware is software that presents banner ads or in pop-up windows through a bar that appears on a computer screen. These advertisements usually cannot be removed and are consequently always visible. The connection data allow many conclusions on the usage behavior and are problematic in terms of data security. Backdoors A backdoor can gain access to a computer by bypassing the computer access security mechanisms. A program that is being executed in the background generally enables the attacker almost unlimited rights. User's personal data can be spied with the backdoor's help.. But are mainly used to install further computer viruses or worms on the relevant system. Boot viruses The boot or master boot sector of hard disks is mainly infected by boot sector viruses. They overwrite important information necessary for the system execution. One of the awkward consequences: the computer system cannot be loaded any more Bot-Net A bot-net is defined as a remote network of PCs (on the Internet) that is composed of bots that communicate with each other. A bot-net can comprise a collection of cracked machines running programs (usually referred to as worms, Trojans) under a common command and control infrastructure. Bot-nets serve various purposes, including denialof-service attacks etc., usually without the affected PC user's knowledge. The main potential of bot-nets is that the networks can achieve grow to thousands of computers and their total bandwidth exceeds most conventional Internet accesses. Exploit An exploit (security gap) is a computer program or script that takes advantage of a bug, glitch or vulnerability leading to privilege escalation or denial of service on a computer system. One form of exploitation for example is an attack from the Internet with the help of manipulated data packages. Programs can be infiltrated in order to obtain higher access. Hoaxes 19

25 Avira AntiVir Server For several years, Internet and other network users have received alerts about viruses that are purportedly spread via . These alerts are spread via with the request that they should be sent to the highest possible number of colleagues and to other users, in order to warn everyone against the "danger". Honeypot A honeypot is a service (program or server) installed in a network. Its function is to monitor a network and log attacks. This service is unknown to the legitimate user - because of this reason he is never addressed. If an attacker examines a network for the weak points and uses the services which are offered by a honeypot, it is logged and an alert is triggered. Macro viruses Macroviruses are small programs that are written in the macro language of an application (e.g. WordBasic under WinWord 6.0) and that can normally only spread within documents of this application. Because of this, they are also called document viruses. In order to be active, they need that the corresponding applications are activated and that one of the infected macros has been executed. Unlike "normal" viruses, macro viruses consequently do not attack executable files but they do attack the documents of the corresponding host application. Pharming Pharming is a manipulation of the host file of web browsers to divert enquiries to spoofed websites. This is a further development of classic phishing. Pharming fraudsters operate their own large server farms on which fake websites are stored. Pharming has established itself as an umbrella term for various types of DNS attacks. In the case of a manipulation of the host file, a specific manipulation of a system is carried out with the aid of a Trojan or virus. The result is that the system can now only access fake websites, even if the correct web address is entered. Phishing Phishing means angling for personal details of the Internet user. Phishers generally send their victims apparently official letters such as s that are intended to induce them to reveal confidential information to the culprits in good faith, in particular user names and passwords or PINs and TANs of online banking accounts. With the stolen access details, the phishers can assume the identities of the victims and carry out transactions in their name. What is clear is that: banks and insurance companies never ask for credit card numbers, PINs, TANs or other access details by , SMS or telephone. Polymorph viruses Polymorph viruses are the real masters of disguise. They change their own programming codes - and are therefore very hard to detect. Program viruses 20

26 Viruses and more A computer virus is a program that is capable of attaching itself to other programs after being executed and cause an infection. Viruses multiply themselves unlike logic bombs and Trojans. In contrast to a worm, a virus always requires a program as host, where the virus deposits its virulent code. The program execution of the host itself is not changed as a rule. Rootkit A rootkit is a collection of software tools that are installed after a computer system has been infiltrated to conceal logins of the infiltrator, hide processes and record data - generally speaking: to make themselves invisible. They attempt to update already installed spy programs and reinstall deleted spyware. Script viruses and worms Such viruses are extremely easy to program and they can spread - if the required technology is on hand - within a few hours via round the globe. Script viruses and worms use one of the script languages, such as Javascript, VBScript etc., to insert themselves in other, new scripts or to spread themselves by calling operating system functions. This frequently happens via or through the exchange of files (documents). A worm is a program that multiplies itself but that does not infect the host. Worms cannot consequently form part of other program sequences. Worms are often the only possibility to infiltrate any kind of damaging programs on systems with restrictive security measures. Spyware Spyware are so called spy programs that intercept or take partial control of a computer's operation without the user's informed consent. Spyware is designed to exploit infected computers for commercial gain. Trojan horses (short Trojans) Trojans are pretty common nowadays. Trojans include programs that pretend to have a particular function, but that show their real image after execution and carry out a different function that, in most cases, is destructive. Trojan horses cannot multiply themselves, which differentiates them from viruses and worms. Most of them have an interesting name (SEX.EXE or STARTME.EXE) with the intention to induce the user to start the Trojan. Immediately after execution they become active and can, for example, format the hard disk. A dropper is a special form of Trojan that 'drops' viruses, i.e. embeds viruses on the computer system. Zombie A zombie PC is a computer that is infected with malware programs and that enables hackers to abuse computers via remote control for criminal purposes. On command, the affected PC starts denial-of-service (DoS) attacks, for example, or sends spam and phishing s. 21

27 Avira AntiVir Server 8.2 Extended threat categories Dialer (DIALER) Certain services available in the Internet have to be paid for. They are invoiced in Germany via dialers with 0190/0900 numbers (or via 09x0 numbers in Austria and Switzerland; in Germany, the number is set to change to 09x0 in the medium term). Once installed on the computer, these programs guarantee a connection via a suitable premium rate number whose scale of charges can vary widely. The marketing of online content via your telephone bill is legal and can be of advantage to the user. Genuine dialers leave no room for doubt that they are used deliberately and intentionally by the user. They are only installed on the user s computer subject to the user s consent, which must be given via a completely unambiguous and clearly visible labeling or request. The dial-up process of genuine dialers is clearly displayed. Moreover, genuine dialers tell you the incurred costs exactly and unmistakably. Unfortunately there are also dialers which install themselves on computers unnoticed, by dubious means or even with deceptive intent. For example they replace the Internet user s default data communication link to the ISP (Internet Service Provider) and dial a cost-incurring and often horrendously expensive 0190/0900 number every time a connection is made. The affected user will probably not notice until his next phone bill that an unwanted 0190/0900 dialer program on his computer has dialed a premium rate number with every connection, resulting in dramatically increased costs. We recommend that you ask your telephone provider to block this number range directly for immediate protection against undesired dialers (0190/0900 dialers). Your AntiVir program can detect the familiar dialers by default. If the option Dialers is enabled with a check mark in the configuration under Extended threat categories, you receive a corresponding alert if a dialer is detected. You can now simply delete the potentially unwanted 0190/0900 dialer. However, if it is a wanted dialup program, you can declare it an exceptional file and this file is then no longer scanned in future. Games (GAMES) There is a place for computer games - but it is not necessarily at work (except perhaps in the lunch hour). Nevertheless, with the wealth of games downloadable from the Internet, a fair bit of mine sweeping and Patience playing goes on among company employees and civil servants. You can download a whole array of games via the Internet. games have also become more popular: numerous variants are circulating, ranging from simple chess to "fleet exercises" (including torpedo combats): The corresponding moves are sent to partners via programs, who answer them. Studies have shown that the number of working hours devoted to computer games has long reached economically significant proportions. It is therefore not surprising that more and more companies are considering ways of banning computer games from workplace computers. Your AntiVir program recognizes computer games. If the Games option is enabled with a check mark in the configuration under Threat categories, you receive a corresponding alert if your AntiVir program detects a game. The game is now over in the truest sense of the word, because you can simply delete it. 22

28 Viruses and more Jokes (JOKES) Jokes are merely intended to give someone a fright or provide general amusement without causing harm or reproducing. When a joke program is loaded, the computer will usually start at some point to play a tune or display something unusual on the screen. Examples of jokes are the washing machine in the disk drive (DRAIN.COM) or the screen eater (BUGSRES.COM). But beware! All symptoms of joke programs may also originate from a virus or Trojan. At the very least users will get quite a shock or be thrown into such a panic that they themselves may cause real damage. Thanks to the extension of its scanning and identification routines, your AntiVir program is able to detect joke programs and eliminate them as unwanted programs if required. If the option Jokes is enabled with a check mark in the configuration under Threat categories, a corresponding alert is issued if a joke program is detected. Security Privacy Risk (SPR) Software that may be able to compromise the security of your system, initiate unwanted program activities, damage your privacy or spy on your user behavior and could therefore be unwanted. Your AntiVir program detects "Security Privacy Risk" software. If the option Security Privacy Risk is enabled with a check mark in the configuration under Extended threat categories, you receive a corresponding alert if your AntiVir program detects such software. Backdoor Clients (BDC) In order to steal data or manipulate computers, a backdoor server program is smuggled in unknown to the user. This program can be controlled by a third party using backdoor control software (client) via the Internet or a network. Your AntiVir program recognizes "Backdoor control software". If the Backdoor control software (BDC) option is enabled with a check mark in the configuration under Extended threat categories, you receive a corresponding alert if your AntiVir program detects such software. Adware/Spyware (ADSPY) Software that displays advertising or software that sends the user s personal data to a third party, often without their knowledge or consent, and for this reason may be unwanted. Your AntiVir program recognizes "Adware/Spyware". If the option Adware/Spyware (ADSPY) is enabled with a check mark in the configuration under Extended threat categories, you receive a corresponding alert if your AntiVir program detects adware or spyware. Unusual Runtime Packers (PCK) Files that have been compressed with an unusual runtime packer and that can therefore be classified as potentially suspicious. 23

29 Avira AntiVir Server Your AntiVir program recognizes "Unusual runtime packers". If the option Unusual runtime packers is enabled with a check mark in the configuration under Extended threat categories, you receive a corresponding alert if your AntiVir program detects such packers. Double Extension Files (HEUR-DBLEXT) Executable files that hide their real file extension in a suspicious way. This camouflage method is often used by malware. Your AntiVir program recognizes "Double Extension Files". If the option Double Extension files (HEUR-DBLEXT) is enabled with a check mark in the configuration under Extended threat categories, you receive a corresponding alert if your AntiVir program detects such files. Phishing Phishing, also known as brand spoofing is a clever form of data theft aimed at customers or potential customers of Internet service providers, banks, online banking services, registration authorities. When submitting your address on the Internet, filling in online forms, accessing newsgroups or websites, your data can be stolen by "Internet crawling spiders" and then used without your permission to commit fraud or other crimes. Your AntiVir program recognizes "Phishing". If the option Phishing is enabled with a check mark in the configuration under Extended threat categories, you receive a corresponding alert if your AntiVir program detects such behavior. Application (APPL) The term APPL refers to an application which may involve a risk when used or is of dubious origin. Your AntiVir program recognizes "Application (APPL)". If the option Application (APPL) is enabled with a check mark in the configuration under Extended threat categories, you receive a corresponding alert if your AntiVir program detects such behavior. 24

30 9 Info and Service This chapter contains information on how to contact us. see Chapter Contact address see Chapter Technical support see Chapter Suspicious files see Chapter Report false positives see Chapter Your feedback for more security 9.1 Technical support Avira support provides reliable assistance in answering your questions or solving a technical problem. All necessary information on our comprehensive support service can be obtained from our website: So that we can provide you with fast, reliable help, you should have the following information ready: License information. You can find the program interface under the menu item Help :: About Avira AntiVir Server :: License information Version information. You can find the program interface under the menu item Help :: About Avira AntiVir Server:: Version information. Operating system version and any Service Packs installed. Installed software packages, e.g. anti-virus software of other vendors. Exact messages of the program or of the report file. 9.2 Suspicious file Viruses that may not yet be detected or removed by our products or suspect files can be sent to us. We provide you with several ways of doing this. Identify the file in the quarantine manager of the AntiVir Server Console and select the item Send file via the context menu or the corresponding button. Send the required file packed (WinZIP, PKZip, Arj etc.) in the attachment of an to the following address: virus@avira.com As some gateways work with anti-virus software, you should also provide the file(s) with a password (please remember to tell us the password). You can also send us the suspicious file via our website: 25

31 Avira AntiVir Server 9.3 Reporting false positives If you believe that your AntiVir program is reporting a detection in a file that is most likely "clean", send the relevant file packed (WinZIP, PKZip, Arj etc.) as an attachment to the following address: virus@avira.com As some gateways work with anti-virus software, you should also provide the file(s) with a password (please remember to tell us the password). 9.4 Your feedback for more security At Avira, our customers security is paramount. For this reason, we don't just have an inhouse expert team that tests the quality and security of every Avira GmbH solution before the product is released. We also attach great importance to the indications regarding security relevant gaps that could develop and we treat those seriously. If you think you have detected a security gap in one of our products, please send us an to the following address: vulnerabilities@avira.com 26

32 10 Reference: Configuration options The configuration reference documents all available configuration options Scanner Here you define the basic behavior of the scan routine for an on-demand scan. If you select certain directories to be scanned with an on-demand scan, depending on the configuration the Scanner scans: with a certain scanning power (priority), also boot sectors and main memory, certain or all boot sectors and the main memory, all or selected files in the directory. Files The Scanner can use a filter to scan only those files with a certain extension (type). All files If this option is enabled, all files are scanned for viruses or unwanted programs, irrespective of their content and file extension. The filter is not used. If All files is enabled, the button File extensions cannot be selected. Smart Extensions If this option is enabled, the selection of the files scanned for viruses or unwanted programs is automatically chosen by the program. This means that your AntiVir program decides whether the files are scanned or not based on their content. This procedure is somewhat slower than Use file extension list, but more secure, since not only on the basis of the file extension is scanned. This option is enabled as the default setting and is recommended. If Smart Extensions is enabled, the button File extensions cannot be selected. Use file extension list If this option is enabled, only files with a specified extension are scanned. All file types that may contain viruses and unwanted programs are preset. The list can be edited manually via the button "File extension". If this option is enabled and you have deleted all entries from the list with file extensions, this is indicated with the text "No file extensions" under the button File extensions. File extensions 27