Small Office Security 2. File Anti-Virus

Transcription

1 Small Office Security 2 File Anti-Virus

2 Table of content Table of content... 1 File Anti-Virus... 2 What is File Anti-Virus... 2 Enabling/Disabling File Anti-Virus... 2 Operating algorithm of File Anti-Virus... 3 Security levels of File Anti-Virus... 3 Actions to be performed by File Anti-Virus on detected threats... 4 Default actions... 4 Actions that can be set by the user... 4 Actions for each object... 6 How to specify action on detected threats... 6 Configuring File Anti-Virus parameters... 7 Selecting file types scanned by File Anti-Virus... 8 Selecting location of files scanned by File Anti-Virus... 8 Scan methods of File Anti-Virus... 9 Optimization of files scan Setting scan of compound files Scan modes of File Anti-Virus iswift и ichecker scan technologies Pausing File Anti-Virus Rollback to default settings of File Anti-Virus

3 File Anti-Virus What is File Anti-Virus The file system may contain viruses and other malicious programs. Such malware may reside in your file system for several years having once intruded your computer and not reveal themselves. However once you open an infected file or, for example, try to copy it on the disk, the virus will reveal itself. The File Anti-Virus component monitors the computer file system and prevents infection of the computer's file system. The component starts upon startup of the operating system, continuously remains in the computer's RAM, and scans all files being opened, saved, or launched on your computer and all connected drives. Enabling/Disabling File Anti-Virus In order to enable or disable File Anti-Virus, perform the following actions: 1. Open the main application window 2. Select Protection Center tab 3. Click the Settings button. As a result the Settings window will open. 4. In the list of components on the left select File Anti-Virus. 5. In the File Anti-Virus Settings section Check the Enable File Anti-Virus box, if you wish to enable the component. Uncheck the Enable File Anti-Virus box, if you wish to disable the component 6. In the Settings window click Apply. 2 19

4 Operating algorithm of File Anti-Virus By default File Anti-Virus functions according to the following algorithm: 1. The component intercepts every attempt by the user or by any program to access any file. File Anti-Virus scans the ichecker and iswift databases (see details further) for information about the intercepted file and determines if it should scan the file, basing on the information retrieved. The scan includes the following steps: 2. The file is scanned for viruses based on the application databases. After the analysis you have the following available courses of action for File Anti-Virus: If malicious code is detected in the file, File Anti-Virus blocks the file, creates a backup copy, and attempts to perform disinfection. After the file is successfully disinfected, it becomes operable to the user. If disinfection fails, the file is deleted. If potentially malicious code is detected in the file (but the maliciousness is not absolutely guaranteed), the file proceeds to disinfection and then is sent to the special storage area called Quarantine If no malicious code is discovered in the file, it is immediately restored. Security levels of File Anti-Virus The security level is defined as a preset configuration of the File Anti-Virus component settings, which provide a protection level of files and the RAM. Different sets of the protection parameters (security levels) suit different working conditions. Kaspersky Lab specialists distinguish three security levels. The decision of which level to select should be made by the user based on the operational conditions and the current situation: If the computer has a high chance of becoming infected, it is necessary to select the high security level. 3 19

5 While working in a protected environment (for example, in a corporate network with centralized security management) or with resource-consuming applications, it is recommended selecting the low security level. Recommended level provides an optimum balance between efficiency and security, being suitable for most cases. In order to modify the security level of File Anti-Virus, perform the following actions: 1. In the right part of section File Anti-Virus set the security level by dragging the vertical slider to the necessary position. 2. In the Settings window click Apply. Actions to be performed by File Anti-Virus on detected threats Default actions By default program chooses the actions on detected objects itself. If as a result of scan the program failed to define whether the object is infected or not, the object is quarantined. Quarantine is a special storage, which contains objects that can be infected viruses. Objects in the quarantine cannot harm your computer. If as a result of the scan object is given the status of malicious software, File Anti-Virus will try to disinfect it. If the disinfection is impossible, the object is deleted. Before disinfecting or deleting of the object KSOS 2 creates its backup in case there is necessity to restore the object or in case the way to disinfect the object turns up. Actions that can be set by the user You can set the action to be performed on detected threats by yourself. File Anti-Virus can perform the following actions on detected threats: Disinfect; Delete; Delete if disinfection fails (appears if Disinfect option is enabled). 4 19

6 If the Disinfect variant is selected, the program functions the following way: If the object can be disinfected, it will be disinfected and will return to the user. If as a result of scan the program failed to define whether the object is infected or not, the object is quarantined. If the option to scan quarantined files after each database update is enabled, then when a new disinfection signature is received the quarantined object can be disinfected and returned to the user. If the virus status is assigned to the object and its disinfection is impossible, the object is blocked and is added to the report about detected threats. If you want infected objects which cannot be disinfected would be deleted check the Delete if disinfection fails box (the box appears if the Disinfect option is enabled). You can select only the Delete variant, but in this case all objects will be deleted, even if they could be available for the user after disinfection. In order to select the necessary action, check the box next to the action and click the Apply button to save the changes. Kaspersky Lab specialists recommend to select the following actions for the detected threats: Disinfect Delete if disinfection fails In this case the program will perform the following actions over an object: Disinfect, if disinfection is possible. After disinfection you can continue your work with the object. Quarantine, if the program failed to define if the object is infected or not. If the option to scan quarantined files after each database update is enabled, then when a new disinfection signature is received the quarantined object can be disinfected and returned to the user. Delete, if the virus status is assigned to the object and its disinfection is impossible. 5 19

7 Actions for each object You can also specify File Anti-Virus actions for every detected object individually. For this enable KSOS 2 interactive mode: 1. In the left part of the Settings window select General Settings. 2. In the left part of the window in the Interactive protection section clear the Select action automatically box. 3. Click the Apply button. Interactive mode can only be enabled for the whole program. When the mode is enabled you will have to select an action for every object detected by any KSOS 2 component. How to specify action on detected threats To specify an action on detected threats, please do the following: 1. In the left part of the Settings window select File Anti-Virus. 2. Make sure that the Enable File Anti-Virus box is checked in the right part of the window 3. In the Action section select an action over detected threats: Select action automatically Select action: o Disinfect o Delete (Delete if disinfection fails) 4. In the Settings window click the OK button. If the Select action option is enabled but no action is chosen, File Anti-Virus will block dangerous objects and quarantine them notifying the user about the quarantined objects. The Delete, if disinfection fails options appears only if the Disinfect box is checked. 6 19

8 Configuring File Anti-Virus parameters To fine-tune the File Anti-Virus settings, in the Security level section click the Settings button. The File Anti-Virus window will open. 7 19

9 Selecting file types scanned by File Anti-Virus In the File Anti-Virus window on the General tab you can set/ select file types to be scanned by File Anti-Virus. By default File Anti-Virus scans only potentially infected files (files into which a virus can penetrate), started on all hard, removable and network drives. You can select on your own the file types which should be scanned by File Anti-Virus for viruses. The following file types can be set for scan: All files File Anti-Virus analyzes all files irrespective of their name (for example, pressrelease ) or extension (for example, «.doc»). Files scanned by format File anti-virus analyzes only the file header (text, executable and etc). Files scanned by extension File Anti-Virus analyzes the file extension (doc, txt, exe and etc). When selecting the file type scanned by File Anti-Virus, consider the following peculiarities. For example, the cyber criminal can send a virus to your computer with a txt extension, though in reality such file can be executable, renamed into a txt-file. If the Files scanned by extension option is selected, then during scan such file will be skipped. If the Files scanned by format option is selected, then in spite of the extension File Anti-Virus will analyze the file header. In the result of scan it will become clear that the file has an exe-format. Such file will be scanned for viruses. Selecting location of files scanned by File Anti-Virus You can also specify location of the scanned files in the Protection scope section. In order to add a new object to the scan scope, perform the following actions: 1. Click the Add link. 8 19

10 2. In the Select object to scan window browse an object and click Add. 3. After you have added all necessary objects in the Select object to scan window click the OK button. Scan methods of File Anti-Virus By default, File Anti-Virus scans objects using signature analysis (bases with the description of known threats and their disinfection methods). The component compares the object under scan with the records in the base and defines whether the object is malicious. Since new malicious objects appear daily, there is always some malware which are not described in the databases, and which can only be detected using heuristic analysis. This method presumes the analysis of the 9 19

11 actions an object performs within the system. If its actions are typical of malicious objects, the object is likely to be classed as malicious or suspicious. In order to configure heuristic analysis, perform the following actions: 1. In the File Anti-Virus window select the Performance tab. 2. In the Heuristic analysis section move the slider bar to set the necessary scan level Click OK to save the changes. Optimization of files scan To shorten the scan time and to increase the program operation speed, configure scan of only new files and of files which were modified since the moment of the previous analysis. For this, 1. In the File Anti-Virus window open the Performance tab. 2. In the Scan optimization section check the Scan only new and changed files box. 3. Click OK. 1 The higher the detail level, the more resources the scan will require, and the longer it will take. On the other hand the more time scan will take, but the more meticulous the analysis will be performed

12 Setting scan of compound files Compound files for example, archives and OLE-objects are a structured storage for several other files. Cyber criminals often hide malicious objects by embedding them into compound files (archives). In order to detect such objects, File Anti-Virus unpacks an archive which considerably decreases the scan time. To enable scan of archives, perform the following actions: 1. In the File Anti-Virus window choose the Performance tab. 2. In the Scan of compound files section check the Scan archives box

13 Installer packages and installation packages (files to install different programs) files containing OLE objects (like images, texts, drafts, tables created in one program, but which can be opened with the help of other programs) are executed when they are opened, which makes them more dangerous than archives. In order to enable scan of installation packages and OLE-objects, perform the following actions: 1. In the File Anti-Virus window choose the Performance tab 2. In the Scan of compound files section check the corresponding boxes. 3. Click OK to save the made changes

14 During scan of large compound files their preliminary unpack may take some time. You can reduce the time by performing scan in the background mode (i.e. while user is working with some other programs). If a malicious object is detected in such file, File Anti-Virus will notify. To enable scan of compound files in background mode, perform the following actions: 1. In the File Anti-Virus window on the Performance tab in the Scan of compound files section click Additional. 2. In the Compound files window check the Extract compound files in the background box. 3. In the Minimum file size field specify the minimum file size for background scan in megabytes. Files of lesser size will be scanned in normal mode

15 To reduce the delay when accessing compound files, one may disable unpacking the files of a size, which is larger than the specified value. For this perform the following actions: 1. In the Size limit section specify the maximum size of the scanned files. This option does not cover files extracted from archives. 2. Click OK to save the changes. Scan modes of File Anti-Virus You can select one of four scan modes in File Anti-Virus: Smart mode. On access and modification (the application scans objects when they are opened or modified). On access (the application scans objects only when they are attempted to open). On execution (the application scans objects only when they are attempted to run). By default, KSOS 2 uses smart mode, which determines if the object is subject to scan, based on the actions performed on it. For example, when working with a Microsoft Office document, File

16 Anti-Virus scans the file when it is first opened and last closed. Intermediate operations that overwrite the file do not cause it to be scanned. To set the scan mode, perform the following actions: 1. In the File Anti-Virus window go to the Additional tab. 2. In the Scan mode section select the necessary scan mode. 3. Click OK to save the changes. iswift и ichecker scan technologies Intellectual technologies ichecker and iswift allow accelerating work of File Anti-Virus. Technologies achieve the highest efficiency some time after installation of the product. These technologies add to each other thus accelerating anti-virus scan of various objects in different file and operating systems. During the first scan with ichecker technology the check sum of an object is saved. Check sum is a unique digital signature of an object (file) that allows identifying this object (file). Check sum changes every time the object is modified. This information is saved in a special table. During the next scan of an object the previous and current check sums are compared. If the check sum is different the object should be scanned for a malicious code once again, if the check sum is the same, the object is not scanned. The ichecker technology works with limited number of formats such as exe, dll, lnk, ttf, inf, sys, com, chm, zip, rar and does not scan files larger than 4 GB, as in such cases it is quicker to scan the whole file, than to calculate its check sums. The iswift technology has been developed for NTFS file system. In this system NTFS-identifier is given to each object. This NTFS-identifier is compared with the values in the special iswift database. This algorithm considers the previous scan date. If from the moment of the first scan to the last scan the same period or more passed then the object will be re-scanned. The object will be also scanned in the case of the object settings were changed to stricter ones. The technology is connected to a definite file location in the file system. If the file was copied/relocated then it is scanned again

17 In order to enable the use of iswift and ichecker technologies, perform the following actions: 1. In the File Anti-Virus window choose the Additional tab. 2. In the Scan technologies section check the iswift technology and ichecker technology boxes. 3. Click OK to save the changes. Pausing File Anti-Virus When carrying out resource-intensive works, you can pause File Anti-Virus. To reduce workload and ensure quick access to objects, you can configure automatic pausing of the component at a specified time. For this perform the following actions: 1. In the File Anti-Virus window go to the Additional tab. 2. In the Pause task section check the By schedule box. 3. Click the Schedule button

18 4. In the pausing the task window in the fields Pause task at and Resume task at specify the time for which protection will be paused 5. Click OK. Besides pausing the component at a specified time, you can also configure pausing of File Anti- Virus when handling specified programs. For this perform the following actions: 1. In the File Anti-Virus window go to the Additional tab. 2. In the Pause task section check the At application startup box. 3. Click the Select button

19 4. In the Applications window click the Add link. Then perform the following actions: Select the program from the Applications list or Click Browse and select the program in the browser window. 5. Create the list of programs and in the Applications window click OK. Rollback to default settings of File Anti-Virus You can always roll back to default File Anti-Virus settings. For this perform the following actions: 1. Open the File Anti-Virus window. 2. In the Settings window in the Security level section click the Default level button

20 19 1 9