KAPERSKY SECURITY 5.5 - FOR MICROSOFT EXCHANGE SERVER... Manuel de service

KASPERSKY LAB

Kaspersky Security®5.5

for Microsoft Exchange Server

2003

ADMINISTRATOR'S

GUIDE

KASPERSKY SECURITY 5.5

FOR MICROSOFT EXCHANGE SERVER 2003

Administrator's

Guide

©Kaspersky Lab

http://www.kaspersky.com

Revision date: November 2006

Table of Contents

CHAPTER 1. INTRODUCTION ...................................................................................... 7

1.1. Threats to the computer security .......................................................................... 7

1.2. The purpose and major functionality of the application...................................... 10

1.3. Hardware system requirements.......................................................................... 12

1.4. Software system requirements ........................................................................... 12

1.5. Distribution kit ...................................................................................................... 12

1.6. Services provided for registered users ............................................................... 13

1.7. Conventions......................................................................................................... 14

CHAPTER 2. OPERATION OF THE APPLICATION .................................................. 15

2.1. Security Server architecture................................................................................ 16

2.2. Server protection deployment ............................................................................. 17

2.3. Server protection system maintenance .............................................................. 18

2.4. Application’s operation on a cluster of servers ................................................... 18

CHAPTER 3. INSTALLING, UPDATING AND REMOVING THE APPLICATION..... 20

3.1. Installing the application ...................................................................................... 20

3.1.1. First-time installation ..................................................................................... 21

3.1.2. Reinstalling the application........................................................................... 24

3.2. Removing the application.................................................................................... 25

3.3. Upgrading from a previous version..................................................................... 25

CHAPTER 4. STARTING USING THE APPLICATION............................................... 26

4.1. Starting the application........................................................................................ 26

4.2. Application interface ............................................................................................ 26

4.2.1. Main application window .............................................................................. 26

4.2.2. Shortcut menu .............................................................................................. 28

4.3. Creating the list of managed servers .................................................................. 30

4.4. Connecting the Management Console to the server ......................................... 31

4.5. Minimum required configuration.......................................................................... 32

4.6. Mail server protection without additional configuration....................................... 33

4.7. Verifying the application performance ................................................................ 35

4 Kaspersky Security 5.5 for Microsoft Exchange Server 2003

4.7.1. Testing the anti-virus protection system ...................................................... 35

4.7.2. Testing the anti-spam protection system ..................................................... 36

CHAPTER 5. UPDATING THE ANTI-VIRUS AND THE CONTENT FILTRATION

DATABASES.............................................................................................................. 38

5.1. Manual updating .................................................................................................. 39

5.2. Automatic updates............................................................................................... 40

5.3. Selecting the updates source.............................................................................. 41

5.4. Configuring the connection settings.................................................................... 43

5.5. Running updates under a different user account ............................................... 45

CHAPTER 6. ANTI-VIRUS PROTECTION .................................................................. 47

6.1. Anti-virus protection levels................................................................................... 49

6.2. Enabling and disabling the anti-virus server protection. Selecting anti-virus

protection level ................................................................................................... 51

6.3. Scanning attachments......................................................................................... 53

6.4. Scanning of routed e-mail traffic ......................................................................... 56

6.5. Selecting actions to be performed with objects .................................................. 57

6.6. Background scan................................................................................................. 62

CHAPTER 7. ANTI-SPAM PROTECTION................................................................... 65

7.1. Enabling/disabling anti-spam protection............................................................. 66

7.2. Selecting the action to be performed with the message .................................... 67

7.3. Configuring TCP/IP settings................................................................................ 70

7.4. Configuring e-mail filtration.................................................................................. 70

CHAPTER 8. APPLICATION'S OPERATION EFFICIENCY....................................... 72

8.1. Anti-virus protection efficiency............................................................................. 72

8.2. Anti-spam protection efficiency ........................................................................... 73

CHAPTER 9. BACKUP COPYING ............................................................................... 74

9.1. Viewing backup storage...................................................................................... 75

9.2. Backup storage filter............................................................................................ 77

9.3. Restoring objects from the backup storage........................................................ 80

9.4. Sending e-mails to addressees .......................................................................... 81

9.5. Sending objects for analysis ............................................................................... 81

9.6. Deleting objects from the backup storage .......................................................... 82

9.7. Configuring the backup storage settings ............................................................ 83

Table of Contents 5r

CHAPTER 10. NOTIFICATIONS .................................................................................. 86

10.1. Creating a notification template......................................................................... 87

10.2. Viewing and editing notification parameters..................................................... 91

10.3. Customizing general notification settings ......................................................... 91

CHAPTER 11. PREVENTING VIRUS OUTBREAKS.................................................. 93

11.1. Creating a new virus outbreak counter............................................................. 95

11.2. Viewing and modifying virus outbreak notification settings.............................. 99

CHAPTER 12. REPORTS........................................................................................... 100

12.1. Receiving reports............................................................................................. 102

12.1.1. Creating a report template........................................................................ 104

12.1.2. Viewing and fine-tuning the report templates .......................................... 107

12.2. Viewing reports................................................................................................ 108

CHAPTER 13. APPLICATION’S EVENT LOGS........................................................ 111

13.1. Configuring the diagnostics level .................................................................... 112

13.2. Configuring log settings................................................................................... 114

CHAPTER 14. LICENSE KEYS.................................................................................. 115

14.1. License information ......................................................................................... 117

14.2. Installing the license key ................................................................................. 119

14.3. Removing a license key .................................................................................. 121

14.4. License-related notifications............................................................................ 121

14.5. Unprotected storage areas ............................................................................. 122

CHAPTER 15. APPLICATION MANAGEMENT USING KASPERSKY

ADMINISTRATION KIT............................................................................................ 124

15.1. Managing policies............................................................................................ 126

15.1.1. Creating a policy ....................................................................................... 126

15.1.2. Viewing and editing policy settings .......................................................... 130

15.1.2.1. Viewing information about the application ........................................ 131

15.1.2.2. Enabling / disabling server protection ............................................... 132

15.1.2.3. Scanning of attachments................................................................... 133

15.1.2.4. Scanning of routed mail..................................................................... 134

15.1.2.5. The choice of actions over objects.................................................... 135

15.1.2.6. The choice of actions over spam messages .................................... 136

15.1.2.7. Configuring the server protection productivity................................... 137

15.1.2.8. Updating the anti-virus and content filtration databases................... 138

6 Kaspersky Security 5.5 for Microsoft Exchange Server 2003

15.1.2.9. Notifications on detected objects....................................................... 139

15.1.2.10. Virus outbreak notification ............................................................... 140

15.1.2.11. General notification settings ............................................................ 140

15.1.2.12. Additional settings............................................................................ 141

15.1.2.13. Registration of events on program operation on Administration

Server.................................................................................................... 142

15.1.2.14. Reviewing the results of policy application ..................................... 144

15.2. Management of application settings ............................................................... 145

15.2.1. Reviewing the information about application ........................................... 147

15.2.2. Reviewing the license key information..................................................... 148

15.2.3. Start background scan ............................................................................. 148

15.2.4. Selection of protected storage ................................................................. 149

15.2.5. Viewing reports ......................................................................................... 150

15.3. Task management .......................................................................................... 152

15.3.1. Running and stopping tasks..................................................................... 154

15.3.2. Configuring task parameters .................................................................... 155

CHAPTER 16. FREQUENTLY ASKED QUESTIONS............................................... 156

APPENDIX A. TABLE OF SUBSTITUTION MACROS ............................................. 160

APPENDIX B. CONTACTING THE TECHNICAL SUPPORT SERVICE ................. 163

APPENDIX C. GLOSSARY......................................................................................... 165

APPENDIX D. KASPERSKY LAB............................................................................... 170

D.1. Other Kaspersky Lab Products ........................................................................ 171

D.2. Contact Us ........................................................................................................ 179

APPENDIX E. LICENSE AGREEMENT..................................................................... 180

CHAPTER 1. INTRODUCTION

The main source of viruses today is the global Internet. Most virus infections

happen via e-mail. The facts that almost every computer has e-mail client

applications installed and that malicious programs are able to take a full

advantage of software address book in order to find new victims are favorable

factors for the distribution of malware. Without even suspecting it, the user of an

infected computer is sending infected e-mail messages to his or her contacts,

who, in turn, send new waves of infected messages and so on. It is not

uncommon when infected files, due to someone's negligence, enter commercial

mailing lists of large companies. In this case, the virus will affect not just five, but

hundreds or even thousands recipients of such mailings who then will send

infected files to dozens thousands of their contacts.

Apart from the threat of virus or malware infection, there is a problem of

unsolicited e-mail messages (SPAM) and misuse of the Internet resources.

Although not a direct threat, unsolicited e-mail messages increase the load on

the mail servers, fill mailboxes with unwanted messages, cause the loss of

working time and inflict serious financial losses.

Additionally, it is to be noted that the newest malicious programs use the so-

called spamming technologies for efficient mass distribution and the methods of

social psychology to make the user open the message, etc. Therefore, SPAM

filtering is important not only for convenience, but also in order to protect your

computer against some new types of viruses.

It is now acknowledged that information has become an important asset. At the

same time, in order to gain profit through the use of the information, it has to be

available to the company's employees, clients and partners. This raises the issue

of data security and, as its important element, the issue of protection of the

corporate mail servers against the external threats, preventing virus outbreaks

within the corporate networks and filtering out the unsolicited correspondence.

1.1. Threats to the computer

security

There are a vast number of threats that could affect your computer today.

Reading this chapter will give you a general understanding of them.

Worms

This malicious program category largely exploits operating system vulner-

abilities to spread itself. The class was named for the way the worms

8 Kaspersky Security 5.5 for Microsoft Exchange Server 2003

crawl from computer to computer, using networks, e-mail, and other data

channels. This feature gives many worms a rather high speed in spread-

ing themselves.

Worms penetrate a computer, calculate the network addresses of other

computers, and send a burst of self-made copies to these addresses. In

addition to network addresses, worms often utilize data from e-mail client

address books. Some of these malicious programs occasionally create

working files on system disks, but they can run without any system re-

sources at all (with the exception of RAM).

Viruses

Programs that infect other programs, adding their own code to them to

gain control of the infected files when they are opened. This simple defini-

tion explains the fundamental action performed by a virus – infection.

Trojans

Programs that carry out unauthorized actions on computers, such as de-

leting information on drives, making the system hang, stealing confidential

information, etc. These malicious programs are not viruses in the tradi-

tional sense of the term, since they do not infect other programs or data;

Trojans are not capable of independently penetrating computers. Their

users spread them under the guise of useful software. The damage that

they incur can exceed that done by traditional virus attacks by several

fold.

Recently, worms have become the most widespread type of malware, followed

by viruses and Trojans. Some malicious computer programs have characteristics

of two or even all three of the above categories.

Henceforth in the text of this Administrator’s Guide the term "virus" will

be used to refer collectively to viruses, Trojan Horses, and worms. A

particular type of malware will be mentioned only when it is required.

The following potentially dangerous types of malware have also become

widespread:

Adware

Program code included in software, unbeknownst to the user, designed to

display advertisements. Adware is usually built into software that is dis-

tributed for free. The advertisement is situated in the program interface.

These programs often also collect personal data on the user and send it

back to their developer, change browser settings (start page and search

pages, security levels, etc.) and also create traffic that the user cannot

control. All this can lead to breach of the security policy and to direct fi-

nancial losses.

Introduction 9

Riskware

Potentially dangerous software that does not have a malicious function but

can be used by hackers as an auxiliary component for a malicious code,

since it contains holes and errors. Under certain conditions, having such

programs on your computer can put your data at risk. These programs in-

clude, for instance, some remote administration utilities, keyboard layout

togglers, IRC clients, FTP servers, and all-purpose utilities for stopping

processes or hiding their operation.

Spyware

Software that collects information about a particular user or organization

without their knowledge. You might never guess that you have spyware

installed on your computer. In general, the goal of spyware is to:

• trace user actions on a computer;

• gather information on the contents of the hard drive; in such

cases, this more often than not involves scanning several

directories and the system registry in order to compile a list of

the software installed on the computer;

• gather information on the quality of the connection, bandwidth,

modem speed, etc.

Jokes

Software that does not do any direct damage but displays messages stat-

ing that damage has already been done or will be done under certain con-

ditions. These programs often warn the user of dangers that do not exist,

such as messages that pop up about formatting the hard drive (although

no formatting actually takes place) or detecting viruses in uninfected files.

PornWare

Programs that make modem connections with various pay-per-use web-

sites, generally pornographic in nature.

Hack Tools

Software used by hackers to penetrate your computer for their own ends.

They include various illegal vulnerability scanners, password cracking

programs, and other types of programs for cracking network resources or

penetrating a system.

Other dangerous programs

Programs created to set up DoS attacks on remote servers, hacking into

other computers, and programs that are part of the development environ-

ment for malicious programs. These programs include hack tools, virus

10 Kaspersky Security 5.5 for Microsoft Exchange Server 2003

builders, vulnerability scanners, password cracking programs, and other

types of programs for cracking network resources or penetrating a system.

Although malicious programs are distributed mainly via email and the Internet, a

floppy disk or a CD can also be a source of infection. Therefore, the task of

comprehensive protection from potential threats now extends far beyond simple

regular scans for viruses, and includes the more complex task of real-time anti-

virus protection.

Another threat that e-mail users face daily is spam. Spam is anonymous junk e-

mail. Spam includes mailings that are marketing, political and provocative in

nature and e-mails asking for assistance. Another category of spam includes e-

mails that ask one to invest large amounts of money or to get involve in pyramid

schemes, e-mails aimed at stealing passwords and credit card numbers, and e-

mails that ask to be sent to friends (chain letters), etc. Spam significantly

increases the load on mail services and increases the risk of losing information

that is important for the user. Spam can be roughly divided into four categories:

• Formal messages – messages that are automatically generated and sent

to recipients by automated mail program functions (as, for example,

notifications of undeliverable messages or confirmation of the user's

registration at some Internet website);

• Probable SPAM - messages that can not be unambiguously identified as

SPAM, but that raise suspicions when checked (for example, some types

of mass mailing and advertising messages);

• Obscene messages– messages that contain obscene language;

• SPAM messages – message that definitely contain SPAM.

1.2. The purpose and major

functionality of the application

Kaspersky Security 5.5 for Microsoft Exchange Server 2003 (hereinafter referred

to as Kaspersky Security) is designed to ensure protection of mailboxes and

public folders located on Microsoft Exchange Server 2003 (hereinafter Microsoft

Exchange Server) against malicious programs and unsolicited e-mail messages

(SPAM).

Kaspersky Security performs the following functions:

• scanning and analyzing incoming and outgoing e-mail messages for the

presence of malicious objects. This analysis processes the bodies and

attachments of e-mail messages. Depending on the settings configured,

the application will disinfect or delete a malicious object or will add a

warning message to such objects;

Ce manuel convient aux modèles suivants

Table des matières

Autres manuels KAPERSKY Logiciel

KAPERSKY

KAPERSKY ANTI-VIRUS 5.0 - FOR SAMBA SERVERS Manuel d'utilisation et d'entretien

KAPERSKY

KAPERSKY ANTI-VIRUS 7.0 Manuel utilisateur

KAPERSKY

KAPERSKY ANTI-VIRUS - FOR FREEBSD-OPENBSD-BSDI MAIL... Manuel utilisateur

KAPERSKY

KAPERSKY ANTI-VIRUS 5.5 - FOR CHECK POINT FIREWALL-1 Manuel de service

KAPERSKY

KAPERSKY ANTI-VIRUS 5.0 - FOR LOTUS NOTES-DOMINO Manuel utilisateur

KAPERSKY

KAPERSKY ANTI-VIRUS - FOR SUN SOLARIS MAIL SERVER Manuel utilisateur

KAPERSKY

KAPERSKY ANTI-VIRUS - FOR FREEBSD-OPENBSD-BSDI FILE... Manuel utilisateur

KAPERSKY

KAPERSKY ANTI-VIRUS 5.0 - FOR SAMBA SERVERS Manuel de service

KAPERSKY

KAPERSKY ANTI-VIRUS 5.5 - FOR LINUX-FREEBSD MAIL... Manuel de service

KAPERSKY

KAPERSKY MAIL GATEWAY 5.5 - Manuel de service

KAPERSKY

KAPERSKY CORPORATE SUITE Manuel utilisateur

KAPERSKY

KAPERSKY ANTI-VIRUS 5.7 - FOR LINUX FILE SERVER Manuel de service

KAPERSKY

KAPERSKY ANTI-VIRUS 5.0 - FOR SENDMAIL WITH MILTER... Manuel d'utilisation et d'entretien

KAPERSKY

KAPERSKY SECURITY - FOR PDA 4.5 Manuel utilisateur

KAPERSKY

KAPERSKY ANTI-VIRUS 5.0 - FOR SAMBA SERVERS Manuel d'utilisation et d'entretien

KAPERSKY

KAPERSKY ANTI-VIRUS 5.6 - FOR MICROSOFT ISA SERVER 2000 ENTERPRISE... Manuel de service

KAPERSKY

KAPERSKY ANTI-VIRUS 4.5 - FOR MICROSOFT EXCHANGE... Manuel utilisateur

KAPERSKY

KAPERSKY ANTI-VIRUS 5.7 - FOR LINUX FILE SERVER Manuel de service

KAPERSKY

KAPERSKY ANTI-VIRUS 5.6 - FOR NOVELL NETWARE Manuel de service

KAPERSKY

KAPERSKY ADMINISTRATION KIT 6.0 Manuel utilisateur

KAPERSKY

KAPERSKY ANTI-VIRUS 5.5 - FOR LOTUS NOTES-DOMINO Manuel utilisateur

KAPERSKY

KAPERSKY ANTI-VIRUS 5.0 - FOR SAMBA SERVERS Manuel utilisateur

KAPERSKY

KAPERSKY ANTI-VIRUS 5.0 - FOR SAMBA SERVERS Manuel de service

KAPERSKY

KAPERSKY ANTI-VIRUS 6.0 Manuel utilisateur

Manuels Logiciel populaires d'autres marques

COMPRO

COMPRO COMPROFM Manuel utilisateur

Muratec

Muratec OFFICEBRIDGE ONLINE Manuel utilisateur

Oracle

Oracle Contact Center Anywhere 8.1 Manuel utilisateur

Adobe

Adobe 65007312 - Photoshop Lightroom Manuel

Avaya

Avaya NULL One-X for RIM Blackberry Manuel utilisateur

HP ProLiant BL420c Manuel utilisateur

PS Audio

PS Audio PowerPlay Manuel du propriétaire

Brady

Brady LOCKOUT PRO 3.0 Manuel de service

Avaya

Avaya Interaction Center Manuel utilisateur

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Manuel

Novell

Novell GROUPWISE 8 - INTERNET AGENT Manuel utilisateur

Oracle

Oracle Application 9i Manuel utilisateur

Acer

Acer RDM Manuel utilisateur

Canon

Canon Vixia HF21 Manuel utilisateur

Canon

Canon ZR950 Manuel utilisateur

Samsung

Samsung Auto Backup Manuel utilisateur

Polycom

Polycom Vortex EF2201 Instructions d'installation et d'utilisation

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Manuel utilisateur