Small Office Security 2. Scan PC for viruses and vulnerabilities

Transcription

1 Small Office Security 2 Scan PC for viruses and vulnerabilities

2 Table of content Table of content... 1 Scan PC for viruses... 2 What is Scan... 2 Starting scan... 2 Starting scan from the main application window... 2 Creating a shortcut to start scan... 4 Starting scan under a different account... 4 Changing security level... 5 Changing an action performed on detected threat... 6 Default action... 6 Actions defined by the user... 7 Actions for each object... 7 How to specify an action on detected threats... 8 Creating scan schedule... 9 Scan scope Creating list of scan objects Changing the type of objects to scan Scan optimization Scan of compound files Selecting scan method Selecting scan technologies Scanning removable drives on connection Vulnerability scan What is vulnerability scan Starting vulnerabilities scan Starting Vulnerabilities scan task Creating shortcut Creating scan schedule Creating a list of scan objects for vulnerabilities scan Starting vulnerabilities scan task under different account

3 Scan PC for viruses What is Scan Scanning the computer for viruses and vulnerabilities is one of the most important tasks in ensuring the computer's security. In the result of scan the possibility of spreading malicious programs that have not been discovered by protection components, for example, because of a low security level set, is detected. Developers of malicious programs make a lot of efforts to hide malware activity, which is why you may not know that malware is present on your PC. During the installation of KSOS 2, the quick scan task is performed automatically. The aim of this task is to find and neutralize malicious programs in operating system startup objects. Kaspersky Lab specialists distinguish the following virus scan tasks: Object Scan. Any object of the computer's file system can be scanned. Full Scan. The following objects are scanned by default: system memory, programs run on startup, system backup, databases, hard drives, removable storage media and network drives. Quick Scan. Operating system startup objects are scanned. After the virus scan task starts, its progress is displayed in the Scan section of the main application window, in the field under the name of the started task. When searching for threats, information on the results is logged in a report. The Scan section also contains the information when the scan task was stopped or finished. The time reference is a link which opens a window with the task short report. Starting scan Starting scan from the main application window The tasks Full Scan, Quick Scan and Objects Scan can be started from the main application window. For this perform the following actions: 2. Select the Scan section. 3. In the right part of the window launch the necessary task by clicking the corresponding button. 2 25

4 The Scan tab displays information when the scan task was paused or finished, and how long the scan will take if the task is being executed at the moment. The time reference is a link which opens a window with the task short report. The tasks Full Scan and Quick Scan can be started using an existing shortcut. 3 25

5 Creating a shortcut to start scan The application provides the option of creating shortcuts for a quick start of full scan tasks and quick scan tasks. This allows starting the required scan task without opening the main application window or the context menu. To create a shortcut for scan task start, please do the following: 2. In the right upper part of the window click the Settings link. 3. In the upper part of the Settings window select the Scan section. 4. In the left part of the Settings window select General Settings. 5. In the right part of the window in the Scan tasks quick run section click the Create shortcut button next to the necessary task (Full Scan, Quick Scan). 6. In the Save as window browse the path to save the shortcut and its name. By default the shortcut is created with a name of a task on the Desktop of the current computer user. 7. Click the OK button. Starting scan under a different account By default scan tasks are started under an account you registered in the system. If you account does not have enough rights, you can specify a different account under whose rights each scan task will be started. To specify an account, perform the following steps: 2. In the right upper part of the window click the Settings link. 3. In the upper part of the Settings window select the Scan section. 4. In the left part of the Settings window select the necessary task (Full Scan, Quick Scan, Objects Scan). 5. For the selected task in the Run mode section click the Settings button. 4 25

6 6. In the opened window on the Run mode tab in the User account section check the Run task as box. In the fields below specify the user name and password. 7. Click the OK button. 8. In the Settings window click the OK button. Changing security level Security level is a predefined set of scan settings. Kaspersky Lab specialists distinguish three security levels. You should make the decision on which level is to select, based on your own preferences. You can select one of the following security levels: 5 25

7 High. It should be enabled if you suspect that your computer has a high chance of becoming infected. Recommended. This level is suitable in most cases, and is recommended for using by Kaspersky Lab specialists. Low. If you are using applications requiring considerable RAM resources, select the Low security level because the application puts least demand on system resources in this mode. If you are not satisfied with any preset security levels you can independently configure scan settings. As a result of your actions the name of the security level will change to Custom. In order to select one of the preset security levels, perform the following actions: 2. In the upper part of the window click the Settings link. 4. In the left part of the window select the necessary task ((Full Scan, Quick Scan, Objects Scan). 5. For the selected task in the Security level section set the required security level. 6. In the Settings window click the OK button. Changing an action performed on detected threat If infected or potentially infected objects are detected, the application performs the specified action. Depending on your current preferences you can configure virus scan settings or allow the program to select an action. Default action By default the application decides on its own what action to perform on a detected threat. If in the result of scan, the application failed to define whether the object is infected or not, then such object is quarantined. 6 25

8 If in the result of a scan KSOS 2 assigns the status of a malicious program to the object, the program will try to disinfect an infected object. If disinfection is impossible, the object is deleted. Before attempting to disinfect or delete an infected object, KSOS 2 creates a backup copy of it to allow later restoration or disinfection. Actions defined by the user You can also define an action to be performed for detected threats: Disinfect Delete Delete, if disinfection fails (this option appears if you checked the Disinfect box) If the Disinfect variant is selected, the program functions the following way: If the object can be disinfected, it will be disinfected and will return to the user. If as a result of scan the program failed to define whether the object is infected or not, the object is quarantined. If the option to scan quarantined files after each database update is enabled, then when a new disinfection signature is received the quarantined object can be disinfected and returned to the user. If the status of a virus is assigned to the object and its disinfection is impossible, the object is blocked and is added to the report about detected threats. You can select only the Delete variant, but in this case all objects will be deleted, even if they could be available for the user after disinfection. Kaspersky Lab specialists recommend to select the following actions for the detected threats: Disinfect Delete if disinfection fails In this case the program will perform the following actions over an object: Disinfect, if disinfection is possible. After disinfection you can continue your work with the object. Quarantine, if the program failed to define if the object is infected or not. If the option to scan quarantined files after each database update is enabled, then when a new disinfection signature is received the quarantined object can be disinfected and returned to the user. Delete, if the virus status is assigned to the object and its disinfection is impossible. Actions for each object You can also specify actions for every detected object individually. For this enable KSOS 2 interactive mode: 2. In the top right corner of the window click the Settings link. 3. In the top part of the Settings window select the Protection section. 4. In the left part of the Settings window select General Settings. 5. In the Interactive protection section uncheck the Select action automatically box. 7 25

9 7. Click the OK button. Interactive mode can only be enabled for the whole program. When the mode is enabled you will have to select an action for every object detected by any KSOS 2 component. How to specify an action on detected threats To specify an action over detected threats, please do the following: 2. In the upper part of the window click the Settings link. 4. In the left part of the Settings window the necessary task (Full Scan, Quick Scan or Objects Scan). 5. In the Action section select an action over detected threats: Select action automatically Select action: o Disinfect o Delete (Delete if disinfection fails) 8 25

10 6. In the bottom right corner of the window click the OK button. If the Select action option is enabled but no action is chosen, the application will block dangerous objects and quarantine them notifying the user about the quarantined objects. The Delete, if disinfection fails options appears only if the Disinfect box is checked. Remember, when configuring scan settings you can always return to the recommended settings. These are optimal settings recommended by Kaspersky Lab experts and are grouped under the Recommended security level. In order to restore the recommended scan settings, perform the following actions: 2. In the upper part of the window click the Settings link. 4. In the left part of the Settings window select the necessary task (Full Scan, Quick Scan or Objects Scan). 5. For the selected task in the Security level section click the Default level button. 6. In the bottom right corner of the window click the OK button. Creating scan schedule In KSOS 2 you can choose whether to start the full scan task manually or by schedule (automatically). If you select the Manually variant, then you can start the task at any time convenient for you. The scan process takes some time to be completed and you cannot use some applications installed on your computer during the scan process. Selecting the By schedule variant allows to configure the automatical start of the full scan task. If you select this variant, you can set the scan task frequency. In the schedule settings you can select one of the following frequencies: minutes, hours, days, every week, at a specified time, every month, after application startup, after every update. For every frequency you can specify the interval. For example, if you select Every month you can select a particular day to start the scan task (1, 2, 3...) and set particular time (05:00 p.m.). 9 25

11 To protect your computer, it would be optimal to perform full computer scan not less than one time a week. In order to schedule a scan task, perform the following actions: 2. In the upper part of the window click the Settings link. 4. In the left part of the Settings window select the necessary task (Full Scan, Quick Scan or Objects Scan). 5. For the selected task in the Run mode section click the Settings button. 6. In the window on the Run mode tab in the Schedule section select By schedule and create a task launch schedule with the frequency and a definite time interval to start a scan task

12 You can configure the program to automatically start a skipped scan task as soon as it becomes possible. For example, the computer was not on at that time when a full scan task was scheduled. In this case the scan will start as soon as computer is enabled. To do so, in the Schedule section check the Run skipped tasks box. Scheduled tasks feature additional functionality, for example, you can pause scheduled scan when screensaver is inactive or computer is unlocked. This functionality postpones the task launch until the user has finished working on the computer. So, the scan task will not take up system resources during the work. 7. Click the OK button. 8. In the Settings window click the OK button. Scan scope Creating list of scan objects You can create your own list of objects for the Full Scan and Quick Scan tasks. For example, if you do not want to scan the whole system and all applications installed on your computer you can create your own list of applications, network and logical drives to scan. If no object is selected in the scan scope, full or quick scan task cannot be started. In order to add, modify or delete objects from the scan scope, perform the following actions: 2. In the upper part of the window click the Settings link. 4. In the left part of the Settings window select the necessary task (Full Scan, Quick Scan or Objects Scan). 5. In the right part of the Settings window in the Objects to scan section click the Settings button. 6. In the Objects to scan window you can change the list of scanned objects. To add a new object, click the Add link, to change or delete an existing object Edit or Delete correspondingly

13 7. You can also enable scan of subfolders. For this, in the Select objects to scan window check the Include subfolders box, when adding or editing an object. 8. In the lower part of the Select objects to scan window click the OK button. 9. In the Settings window click the OK button. Changing the type of objects to scan You can specify the object types that will be scanned by the selected task when searching for threats. All files. With this option, all files will be scanned without exception. Files scanned by format. If you select this group, the program will only scan potentially infected objects, i.e. files into which a virus could infiltrate. Before searching for viruses in an object, its internal header is analyzed to determine the file format (.txt,.doc,.exe, etc.). When scanning, file extensions are also taken into consideration. Files scanned by extension. In this case, the application will scan potentially infected files only. At that, file format will be determined based on its extension

14 Extensionless files are always scanned, irrespective of the file type selected. When selecting file types please remember the following: Probability of penetration of malicious code into several file formats (such as.txt) and its further activation is quite low. At the same time, there are formats that contain or may contain an executable code (such as.exe,.dll,.doc). The risk of penetrating and activating malicious code in such files is quite high. The intruder can send a virus to your computer in an executable file renamed as txt file. If you have selected the scan of files by extension, such a file is skipped by the scan. If the scan of files by format is selected, then, regardless of the extension, File Anti-Virus will analyze the file header, and reveal that the file is an.exe file. Such a file would be thoroughly scanned for viruses. To change the type of scanned objects, perform the following actions: 2. In the upper part of the window click the Settings link. 4. In the left part of the Settings window select the necessary task (Full Scan, Quick Scan or Objects Scan). 5. For the selected task in the Security level section click the Settings button. 6. In the opened window on the Scope tab in the File types section select the necessary variant. 7. Click the OK button. 8. In the Settings window click the OK button

15 Scan optimization You can shorten the scan time and speed up KSOS 2. This can be achieved by scanning only new files and those files that have altered since the last time they were scanned. This mode applies both to simple and compound files. You can also set a restriction on scan duration for an object. When the specified time interval expires, the object will be excluded from the current scan (except for archives and files comprised of several objects). To optimize scan, perform the following actions: 2. In the upper part of the window click the Settings link. 4. In the left part of the Settings window select the necessary task (Full Scan, Quick Scan or Objects Scan). 5. For the selected task in the Security level section click the Settings button. 6. In the Settings window on the Scope tab in the Scan optimization section specify the necessary settings. 7. For the program to scan only new and changed files, check the Scan only new and changed files box. 8. To restrict scan duration, check the Skip objects scanned linger than box and specify the scan duration for a file. 9. Click the OK button. 10. In the Settings window click the OK button. Scan of compound files A common method of concealing viruses is to embed them into compound files: archives, databases, etc. To detect viruses that are hidden this way a compound file should be unpacked, which can significantly lower the scan speed. To modify the list of scanned compound files, perform the following actions:

16 2. In the upper part of the window click the Settings link. 4. In the left part of the Settings window select the necessary task (Full Scan, Quick Scan or Objects Scan). 5. For the selected task in the Security level section click the Settings button. 6. On the Scope tab in the Scan of compound files section, select the required type of compound files to be scanned. For each type of compound file, you can select to scan either all files or only new ones. To make your selection, click the link next to the name of the object. It changes its value when you left-click it. If you select the scan new and changed files only mode, you will not be able to select the links allowing you to scan all or new only files. You can restrict the maximum size of the compound file being scanned. Compound files larger than the specified value will not be scanned. For this in the Scan of compound files section click the Additional button, in the opened Compound files window check the Do not unpack large compound files box and specify the maximum size of scanned objects

17 7. Click the OK button. 8. In the Settings window click the OK button. When large files are extracted from archives, they will be scanned even if the Do not unpack large compound files box is checked. Selecting scan method KSOS 2 uses various scan methods: Signature analysis. Signature analysis uses KSOS 2 databases, which contain descriptions of known threats and methods for eradicating them. Protection using signature analysis provides a minimal level of security. Heuristic analysis. The scan is based on the analysis of typical sequences of operations, allowing an almost definite conclusion about the nature of the file. The advantage of using this method is that new threats are detected before virus analysts have encountered them. Additionally you can set the detail level for scans: light scan, medium scan, or deep scan. Rootkit scan. If you are scanning for viruses, you can enable the deep scan for rootkits by checking the Deep scan box, which will scan carefully for these programs by analyzing a large number of various objects. These checkboxes are deselected by default, since this mode requires significant operating system resources. Rootkits are sets of tools that can hide malicious programs in your operating system. These utilities are injected into the system, hiding their presence and the presence of processes, folders and the registry keys of other malicious programs installed with the rootkit. The signature analysis method is always enabled in the application. To enhance the application efficiency, you can additionally enable other scan methods. For this perform the following actions: 2. In the upper part of the window click the Settings link. 4. In the left part of the Settings window select the necessary task (Full Scan, Quick Scan or Objects Scan). 5. For the selected task in the Run mode section click the Settings button. 6. In the opened window on the Additional tab in the Scan methods section the necessary values

18 7. Click the OK button. 8. In the Settings window click the OK button. Selecting scan technologies In addition to the scan methods you can use special technologies: ichecker is a technology that increases scan speed by excluding certain objects from the scan. An object is excluded from the scan with a special algorithm that uses the release date of Computer Protection databases, the date of the object's last scan, and any changes in the scan settings. There are limitations to ichecker: it does not work with large files and applies only to the objects with a structure that the application recognizes (for example,.exe,.dll,.lnk,.ttf,.inf,.sys,.com,.chm,.zip,.rar). iswift is a technology that builds on ichecker technology for computers using NTFS. There are limitations to iswift: it is bound to a specific file's location in the file system and can apply only to objects in NTFS. The technologies iswift and ichecker allow to increase the virus scan speed by excluding the files that have not been modified since they were last scanned. By default, both technologies are used. To change the set of scan technologies, perform the following actions: 2. In the upper part of the window click the Settings link. 4. In the left part of the Settings window select the necessary task (Full Scan, Quick Scan or Objects Scan). 5. For the selected task in the Security level section click the Settings button. 6. In the opened window on the Additional tab in the Scan methods section the necessary values

19 7. Click the OK button. 8. In the Settings window click the OK button. Scanning removable drives on connection Nowadays, malicious objects using operating systems' vulnerabilities to replicate via networks and removable media have become increasingly widespread. KSOS 2 allows to scan removable drives when connecting them to the computer. In order to configure scan of removable drives on connection to the computer, perform the following actions: 2. In the upper part of the window click the Settings link. 4. In the left part of the Settings window select the General Settings subsection. 5. In the right part of the Settings window in the Scan removable drives on connection section select an action and, if necessary, define the maximum size of a drive to scan in the field below

20 6.In the Settings window click the OK button. Vulnerability scan What is vulnerability scan Vulnerability scan performs the diagnostics of operating system and detects software features that can be used by intruders to spread malicious objects and obtain access to personal information. Vulnerability scan is a special tool which helps to search and eliminate security vulnerabilities of applications, installed on your computer, and in operating system settings. All the problems detected at the system analysis stage will be grouped based on the degree of danger it poses. Kaspersky Lab specialists offer a set of actions for each group of problems which help to eliminate vulnerabilities and weak points in the system's settings. There are three groups of problems distinguished, and, respectively, three groups of actions associated with them: Strongly recommended actions will help eliminate problems posing a serious security threat. You are advised to perform all actions of this group. Recommended actions help eliminate problems posing a potential threat. You are advised to perform all actions of this group too. Additional actions help repair system damages which do not pose a current threat but may threat the computer's security in the future. As a result of search of possible vulnerabilities in the operating system and in the applications installed on the computer direct links to critical fixes (application updates) are displayed. After the vulnerability scan task start, its progress is displayed in the Vulnerability Scan window, in the Finish field. Vulnerabilities detected when scanning the system and applications, are displayed in the same window, on the System vulnerabilities and Vulnerable applications tabs. When searching for threats, information on the results is logged in a Computer Protection report. By default, the applications already installed on the computer are selected as scan objects

21 Starting vulnerabilities scan Starting Vulnerabilities scan task Vulnerabilities scan can be started the following ways: From the main application window; Using an existing shortcut. To start a vulnerabilities scan task from the main application window, perform the following actions: 2. Go to the Scan section. 3. In the right part of the window click the Open Vulnerability Scan window button. 4. To start the vulnerabilities scan task in the Vulnerability Scan window click the Start Vulnerability Scan button. The scan results will be displayed in the Vulnerability Scan window in two tabs: System vulnerabilities Vulnerable applications

22 To start a vulnerability scan task with an existing shortcut, double-click a shortcut for vulnerabilities scan task. Progress of the task performance is displayed in the Vulnerability Scan window and in the main application window in the Scan section. To fix vulnerability in the system, highlight the object and click the Fix button. On the Vulnerable applications tab there are two variants to choose if you select an object: you can read the vulnerability description by clicking Details button; you can create an exclusion rule for the selected vulnerability by clicking Add to exclusions button. In the Vulnerability Scan window the information about when the scan task was stopped or completed is displayed. The time is also the link to open the detailed report. In the detailed report you can find information about start, stop or completion of the vulnerability scan task and the list of vulnerable objects with the link to open the description for them. Creating shortcut A vulnerabilities scan task can be started using an existing shortcut. To create a shortcut for the task, perform the following actions: 2. In the upper right part of the window click the Settings link. 4. In left part of the Settings window select the General Settings subsection. 5. In the right part of the window in the Scan task quick run section click the Create shortcut button next to Vulnerability scan. 6. In the Save as window browse the path to save the shortcut and its name. By default the shortcut is created with a name of a task on the Desktop of the current computer user. 7. Click the OK button. A shortcut for vulnerabilities scan will appear in the specified location:

23 Creating scan schedule In KSOS 2 you can choose whether to start the vulnerability scan task manually or by schedule (automatically). If you select the Manually variant, then you can start the task at any time convenient for you. The scan process takes some time to be completed and you cannot use some applications installed on your computer during the scan process. Selecting the By schedule variant allows to configure the automatical start of the vulnerability scan task. If you select this variant, you can set the vulnerability scan task frequency. In the schedule settings you can select one of the following frequencies: minutes, hours, days, every week, at a specified time, every month, after application startup, after every update. For every frequency you can specify the interval. For example, if you select Every month you can select a particular day to start the scan task (1, 2, 3...) and set particular time (05:00 p.m.). In order to schedule a scan task, perform the following actions: 2. In the upper part of the window click the Settings link. 4. In the left part of the window select Vulnerability scan. 5. For the selected task in the Run mode section click the Settings button. 6. In the window on the Run mode tab in the Schedule section select By schedule and create a task launch schedule with the frequency and a definite time interval to start a scan task. You can configure the program to automatically start a skipped scan task as soon as it becomes possible. For example, the computer was not on at that time when a full scan task was scheduled. In this case the scan will start as soon as computer is enabled. To do so, in the Schedule section check the Run skipped tasks box. Scheduled tasks feature additional functionality, for example, you can Pause scheduled scan when screensaver is inactive or computer is unlocked. This functionality postpones the task launch until the user has finished working on the computer. So, the scan task will not take up system resources during the work

24 7. Click the OK button. 8. In the Settings window click the OK button. Creating a list of scan objects for vulnerabilities scan You can create your own list of objects for the Vulnerabilities Scan task. For example, if you do not want to scan the whole system and all applications installed on your computer you can create your own list of applications, network and logical drives to scan. If no object is selected in the scan scope, full or quick scan task cannot be started. In order to add, modify or delete objects from the scan scope, perform the following actions: 2. In the upper part of the window click the Settings link. 4. In the left part of the Settings window select Vulnerability Scan. 5. In the right part of the Settings window in the Objects to scan section click the Settings button. 6. In the Objects to scan window you can change the list of scanned objects. To add a new object, click the Add link, to change or delete an existing object Edit or Delete correspondingly

25 7. You can also enable scan of subfolders. For this, in the Select objects to scan window check the Include subfolders box, when adding or editing an object. 8. In the lower part of the Select objects to scan window click the OK button. 9. In the Settings window click the OK button. Starting vulnerabilities scan task under different account By default scant tasks are started under an account you registered in the system. If you account does not have enough rights, you can specify a different account under whose rights each scan task will be started. To specify an account, perform the following steps: 2. In the right upper part of the window click the Settings link. 3. In the upper part of the Settings window select the Scan section. 4. In the left part of the Settings window select Vulnerabilities Scan. 5. For the selected task in the Run mode section click the Settings button

26 6. In the opened window on the Run mode tab in the User account section check the Run task as box. In the fields below specify the user name and password. 7. Click the OK button. 8. In the Settings window click the OK button