Copyright: © Panda Software


Introduction to Panda Administrator

The ever greater need to exchange information makes Local Area Networks of all types more widespread with each passing day. The resulting ease of information exchange also facilitates the rapid transmission of computer viruses to all the workstations in a network.

Really effective protection against viruses in a network means protecting both the workstations and the servers. In view of the large number of workstations to be found in any of today’s networks, the network administrator needs to have a tool at his or her disposal that allows an effective management of this problem. The administrator also needs to have a set of tools that will reliably and effectively protect the network servers, since these servers will store large quantities of undoubtedly important information.

Panda Software offers a UNIQUE and CENTRALIZED solution for Local Area Networks which enables the network administrator to manage simply and effectively both server and workstation antivirus software from a single program. Likewise, Panda Software’s network solution greatly simplifies the use of our security and inventory applications in network environments.


What is Panda Administrator?

Panda Software’s solution for the protection of a Local Area Network against viruses has the following elements:

•	Panda Antivirus for Novell NetWare servers.

•	Panda Antivirus for Windows NT servers.

•	Panda Antivirus for Exchange servers.

•	Panda Antivirus for MS Proxy servers.

•	Panda Antivirus for Lotus Domino servers.

•	Panda Antivirus for Firewall.

•	Panda Antivirus for networked PCs.

•	Panda Administrator.

Panda Administrator is the tool which manages the different antivirus tools cited above, giving the network administrator a simple and truly effective control.

Panda Administrator travels all over the network identifying the Windows NT, Novell NetWare, Exchange, MS Proxy, Lotus Domino and Firewall CVP servers. it finds and presenting them in a list. The operations indicated below can be performed on the servers it finds or on their workstations:

•	Installation of the antivirus software.

•	Configuration of the antivirus.

•	Updating the antivirus.

•	Uninstalling the antivirus.

•	Scanning of servers. Both immediate and scheduled scans can be performed.

•	Replication in BDC´s. Only in Windows NT servers is it possible to install the workstation modules in PDC’s (Principal Domain Controllers) and instruct them to subsequently replicate the installation in the BDC’s (Backup Domain Controllers). With this the BDC’s will carry out the task of distributing the antivirus to the workstations, avoiding having to use the PDC’s for this.

Therefore, Panda Administrator, is the tool which allows centralized management of all Panda Software antiviruses in a network: in both workstations and file or Internet severs. In other words, it allows you to deploy these antiviruses to the corresponding workstations and servers, configure them, update the virus detection and removal file, update the antiviruses installed in the workstations and/or servers, carry out scheduled scan jobs, visualize the current status of the scan jobs, display reports on actions performed ... etc. From any workstation with Panda Administrator installed, you can also manage all the antiviruses, taking into account all the operating systems and/or platforms in every workstation and/or server.

In addition, Panda Administrator allows a gobal view of the network. This means that the network administrator will be able to locate the servers or workstations where viruses have been detected.

A complete, centralized reporting system allows the administrator to see a detailed report of the activity of the different antivirus tools in the network (both in servers and workstations).

This product information explains the operation of Panda Administrator with Novell NetWare, Windows NT, Exchange, MS Proxy, Lotus Domino, and Firewall CVP servers and with workstations. Refer to the appropriate section of the document for detailed explanations of each of these subjects.

In addition, Panda Administrator allows you to handle Panda Software's security and inventory applications.


Installing Panda Administrator

Requirements

The following resources are necessary for the installation of Panda Administrator:

•	IBM compatible computer with a 486 or superior processor.

•	64 Mb of RAM.

•	120 Mb of free space on the hard disk.

•	Windows 95/98/2000 or superior operating system. Windows NT 3.51 or superior operating system.

•	Mouse.

Installation procedure

Panda Administrator is supplied on both floppy disks and CD-ROM. To install the version either from floppy disks or CD-ROM, put the disk in the appropriate drive and execute the SETUP program.

The installation procedure consists of the following steps:

1.	First a welcome screen is displayed.

2.	Then the user’s data are requested.

3.	You are asked for the directory in which you want to install the application.

4.	The software then requests the program group in which the antivirus access icons will be created.

5.	The copying of files to the hard disk begins.

6.	When the file copying process is finished, we recommend that you restart the computer to complete the installation.

Uninstallation

You can uninstall Panda Administrator by means of the Add / Remove Programs option offered by the Control Panel. All you need to do is select the appropriate antivirus program from the list which is presented in this option and press the Add / Remove button. You must restart the computer to complete the uninstallation.

Do not try to uninstall the version by deleting the folder where Panda Administrator was installed. Always uninstall the program by following the indicated procedure.


List of Servers

On the left-hand side of the main Panda Administrator window is a list of the different servers detected in the network. Displays Novell NetWare servers, Microsoft Windows NT servers, Exchange servers (included with those of Windows NT), MS Proxy servers, Lotus Domino servers, those which correspond with Firewall (included with those of Windows NT).

By means of the Servers button located in the server list, you can select the types of servers you want displayed in this list (NetWare, Windows NT, Exchange, MS Proxy, Lotus Domino servers, Firewall or all). Upon selecting the ALL option, all the servers will be listed regardless of the type. On the contrary, if a specific type of server is selected, only servers belonging to the type selected will be displayed.

All servers with which there is an open connection will display a “+” symbol to their left. If you click on this symbol, a “branch” will be opened below the server in question under the name of Workstations. All operations performed on Workstations will affect the workstations that connect to that server.

If you want to display only servers of one particular type, you can do so through the options offered by Panda Administrator by clicking on Servers, which appears just above the tree. The possible options offered in this menu are the following:

•	Novell Servers: by selecting this option, only active Novell servers will be displayed.

•	NT Servers: checking this option will display active NT servers.

•	Exchange Servers: select this option to only display active Exchange servers.

•	Notes Servers: select this option to only display active Lotus Domino servers.

•	RInstall Servers: the program will specifically show the servers that contain the workstation module in charge of distributing the antivirus to stations.

•	Proxy Servers: select this option to only display active MS Proxy servers.

•	Firewall Servers: select this option to only display active Firewall servers.

•	NT Workstations: the program will specifically show the Windows NT workstations that are connected to a server at the time in question.

•	All: this option permits you to display all the possible types of servers currently active.

In order to know if there is a connection open to the servers that appear in the directory tree, we shall have to observe the icons

 Not connected: there is no connection to the server even though Panda Administrator has detected it.

 Connected: the server has been detected through Panda Administrator and the connection open is depicted in the icon. This connection permits taking actions on the server antivirus as well as its workstations. Some of the possible actions would be impossible to implement if the connection does not have administrator privileges.

The information referring to the antivirus (installed, functioning, detection, disabled, …) in the servers will be reflected in the same mode in the server directory tree. All the possible icons, together with what they stand for, are displayed below.

 Antivirus installed and sentinel disabled (gray): there is a connection open with the server and the antivirus is detected to be installed, even though sentinel appears as disabled.

 Antivirus installed and disable: there is a connection open with the server and the antivirus is detected to be installed, even though it appears as disabled, or there exist communications problems with the server. It also indicates that the antivurs is not fully updated.

 Antivirus installed and enabled (green): there is a connection open with the server and the antivirus is detected to be installed and running.

 Antivirus installed and enabled (virus detected - red): there is a connection open with the server and the antivirus is installed, enabled and has detected virus activity.

 Antivirus installed, disabled and waiting: waiting for a particular operation to be finished (generally the restarting of a computer).

Besides this, the tree represents three types of Windows servers. Each one of them appears differently in function of whether they are PDCs (Principal Domain Controllers), BDCs (Backup Domain Controllers) or the normal NT servers.

 PDC Servers: represents servers known as Primary Domain Controllers. The installation of the workstation module is performed on these servers and can then be replicated onto BDC’s.

 BDC Servers: represents servers known as Backup Domain Controllers. These servers are used to lessen the workload of the PDC’s.

 Normal Servers: represents any other type of Windows NT server that is neither a PDC nor a BDC.


List of Workstations

As with the list of servers, the Panda Administrator window contains a Workstations drop-down menu. When it is shown, it is possible to indicate the types of workstations which should appear in the list. The following options are available:

•	MS DOS: when this option is selected, only workstations with versions of MS/DOS will be displayed.

•	Windows 3.x: when this option is selected, only workstations with versions of Windows 3.1 o Windows 3.11 will be displayed.

•	Windows 95/98: when this option is selected, only workstations with versions of Windows 95 o Windows 98 will be displayed.

•	NT Workstation: when this option is selected, only workstations with versions of Windows NT for Workstations will be displayed.

•	Windows 2000: when this option is selected, only workstations with versions of Windows 2000 will be displayed.

•	OS/2: when this option is selected, only workstations with the OS/2 operating system will be displayed.

•	All: when this option is selected, all workstations will be displayed.

•	Delete workstation: Allows you to delete one of the workstations.

When Workstations is selected in a server, the list of workstations shows those that receive the antivirus and which have at some time connected to the selected server.

The information shown on each workstation is as follows:

•	ID: shows the icon of the operating system installed on the workstation, as 1well as the workstation name.

•	Antivirus: indicates whether or not the antivirus is installed.

•	Version: shows the operating system version.

•	O.S.: indicates the operating system installed on the workstation.

•	Virus signature file: indicates the number of viruses recognized by the virus signature file present on the workstation.

•	User: indicates the username with which the workstation connected to the network.

•	Session startup: shows the date and time the connection was established.

Note: to view only determined types of workstations, select the Servers menu situated just above the server tree (list of servers).


Button Bar

The button bar features the most frequent operations, which are the following:

•	Install: installs the antivirus on the server or workstations that connect to a certain server.

•	Configure: permits you to configure the antivirus on one or more servers.

•	Scan: scans the areas chosen on the selected server.

•	Update: updates the antivirus on the selected servers.

•	Schedule: this allows you to automate installation, uninstallation and update processes. It also updates the virus signature file in the workstation module (only available for Windows NT servers).

•	Uninstall: uninstalls the antivirus from one or more servers or disables the distribution of the antivirus to the workstations.

•	Details: shows details on the selected server.

•	Report: shows the report of incidents occurred in the server or workstations.

•	Help: displays the program help.


Notification Bar or Event Log Bar

The Event Log bar that appears at the bottom of the Panda Administrator window to warn of events occurring in the system and to indicate the names of the files that produce errors during the installation process. To show the notification bar, you need only enable the Event Log Bar option from the View menu.

To show or hide the bar, proceed as follows:

•	Hide: click on the button situated in the top left-hand corner of the bar. Another way of hiding the bar is by accessing the View menu in Panda Administrator and selecting the Event Log Bar option. It is also possible to perform this action using the contextual menu, as explained below.

•	Show: click on the View menu in Panda Administrator and select the Event Log Bar option.

It is possible to perform several event log actions using the contextual menu. To do this, right-click inside the bar to display a menu containing the following options:

•	Clear Log: this permits you to remove the information displayed in the log.

•	Save As...: through this option you can save the contents of the bar in a text file, which by default will be given a "log" extension. A file name and extension will be offered, although you may assign others.

•	Show Automatically: selecting this option indicates that that the event log bar should always appear upon opening Panda Administrator.

•	Hide Window: the event log bar will disappear from the screen. To display it again, use the View menu in Panda Administrator.


Updating Views

Once you begin to work with Panda Administrator, the program will display a list of the active servers it finds with which we can work. This list appears under the server tree or list.

While working with Panda Administrator, it is possible that some servers disconnect and that other previously inactive or unavailable servers connect. In this case, if you need to view these severs or connect to one that does not appear on the list, you will have to update the view on the server tree.

To access this option, go to the View menu in Panda Administrator and select the Update Views option. A dialog box will be displayed, in which you can choose on of the following options:

•	Find new elements: unlike the previous option, this only adds those servers that were not previously contained in the list.

•	Complete data refresh: in this case, the list will be completely renewed to display full server information, including servers that already appeared and any new ones detected. Likewise, those servers that were previously accessible but were not detected as being active after the search will disappear from the list.

In either case, you can select specific NT domains in which you wish to refresh the server views. This will avoid searching for all the available servers in each existing domain.


Virus List

To facilitate the management of the antivirus and the detection of viruses, a file called PAV.SIG, also known as the virus signature file, is used. This file determines what viruses can be detected and eliminated.

Due to the constant appearance of new viruses, this file must be periodically updated (depending on the versions installed) in order to guarantee the disinfection of the greatest possible number of infections.

To display a list of the viruses detected by the antivirus program, select the Virus List option in the application's View menu. A window will be displayed containing the following sections:

•	Show: this displays a list in which you can indicate the types of viruses to be included in the list below. These may include program viruses, boot viruses, macro viruses, or all.

•	Name: this is the list in which you can see all the viruses recognized by the antivirus. To move about the list, use the vertical scroll bar. Upon selecting one of the virus names in the list, its characteristics will be displayed in the Virus Information section.

•	Find Virus: this is used to help find a particular virus in the list. This way, it is not necessary to go through the whole list to find what you are looking for. Entering the first characters of the name automatically takes you to the section containing all the viruses that begin with the letters or numbers you entered.

•	Virus Information: this displays concrete information on the characteristics of the virus, such as its name, size, date, what kind of files it infects, and the virus type:

•	Resident: when the virus is executed, it reserves a small part of the memory and installs itself in it in order to contaminate your system progressively from there.

•	Stealth: is a technique used by some resident viruses. It consists of camouflaging the changes the virus makes in the files it infects. When a person tries to view one of the characteristics of the file modified by the virus, this one, which is resident in memory, intercepts the consultation and offers the information previous to the modification.

•	Encrypted: viruses that have this characteristic are capable of encrypting themselves in a different way each time they infect a file. This way, it is impossible to find the virus using a string search.

•	Overwrite: Overwriting viruses, which may be resident or non-resident, overwrite the file they infect. This file then becomes useless. The size of the file does not change unless the size of the virus is greater than that of the file. The only way to remove these viruses is by deleting the infected file and putting an uninfected copy in its place.

•	Polymorphic: Polymorphic viruses are advanced versions of encrypted viruses. They are capable of changing their method of encryption from one generation to the next. Thus, there is no part of the virus which remains unchanged.

•	Companion: Companion viruses are those that, in order to contaminate an EXE file, create a COM file with the same name and with the hidden attribute enabled. The virus is resident in the cited COM file. If there are two files with the same name and EXE and COM extensions, the MS-DOS operating system will first execute the one with the COM extension. This is how this type of virus propagates itself; when an attempt is made to run a program (an EXE file), what is really executed is the virus (COM file) that is then loaded in the memory, and which will typically execute the EXE file immediately afterward so that the user will not suspect anything.


Multiple Operating Capacities

Having multiple operating capacities means being able to perform the same operation on different servers, thus simplifying the network administrator’s work.

To select several servers, proceed as follows:

•	Alternate servers in the list: what we refer to by alternate are servers that are not found one after the other in the list of servers. In order to select the servers you require, hold down the CTRL key and click on the servers in question.

•	Consecutive servers: in this case, the servers are found one after the other in the list, and what we want to select is a range of entries. To do this, click on the first entry you want to select and then, holding down the SHIFT key, click on the last server in the range. This way, you will select the two servers you have clicked on, and all those in between.

•	Alternate and consecutive servers: in this case, the selection will be a combination of the two above techniques, as what we want is to choose a range of servers as well as some that are located elsewhere in the list. It is therefore possible to combine the use of the two keys mentioned above.

The operations you can perform with the multiple operating capacities feature are:

•	Installation of the antivirus program in the server.

•	Uninstallation of the antivirus program from the server.

•	Configuration of the antivirus software of a server.

•	Updating the antivirus software.

•	Reporting.

In all the operations that can be carried out with this feature, a window is displayed which shows the status of the operation and the server on which it is being performed:

Installation

To install the antivirus program in several servers, follow the procedure outlined below:

1.	Select the servers in which you want to install the antivirus software in the server tree. To select multiple servers, click on each one of them while holding the Control key down.

2.	Press the Install button.

3.	If you have selected Microsoft NT, Exchange and Novell NetWare servers, the installation wizard for installing antivirus programs in Microsoft NT and Exchange will appear first. Then, once the installation in the selected NT servers is complete, the installation wizard for installing antivirus software in Novell NetWare servers will be displayed.

4.	A window will show the progress of the entire operation by showing at all times which operation is being performed on which server.

Uninstallation

To uninstall the antivirus tool from multiple servers, apply the following procedure:

1.	Select the servers from which you wish to uninstall the antivirus program. To select multiple servers, click on each one of them while keeping the Control key pressed.

2.	Press the Uninstall button.

3.	If you have selected Microsoft NT, Exchange and Novell NetWare servers, the antivirus files will first be uninstalled from the Microsoft NT and Exchange servers and then from the Novell NetWare servers.

4.	A window will show the progress of the entire operation by showing at all times which operation is being performed on which server.

Configuring the antivirus tool

To configure the antivirus in multiple servers, follow these steps:

1.	Select the servers whose antivirus software you wish to configure. To select multiple servers, click on them individually while keeping the Control key pressed.

2.	Press the Configure button.

3.	If you have selected Microsoft NT, Exchange and Novell NetWare servers, the Microsoft NT and Exchange servers will be configured first, followed by the Novell NetWare servers.

4.	A window will show the progress of the entire operation by showing at all times which operation is being performed on which server.

Note: on occasions, multi-operativity may not allow you to carry out operations on one type of server and not on another. For this reason, Panda Administrator incorporates a special intelligent multiselection system. Thanks to this system, if you have selected several machines on which you cannot perform the same actions, Panda Administrator will take this into account by running each of the wizards involved (collecting the necessary data in each case) and then performing each action (on each machine) in sequential order. The process will conclude when the last of the actions has finished on the last of the selected machines.


Authentication

On occasions you will need to connect to a server with which you had previously connected or with the same server as you are currently working with. In this case, it is preferable not to have to re-enter your user name and password, but rather just connect directly without further requirements.

This can be done through authentication. This process will open up the connection to the specified server with requiring the user to provide a name or password.

In short, it a fast and convenient manner to open up new connections with servers we have already connected to prior to authentication.

By default, to carry out new authentications, it is necessary to access the Authenticate Connection option in the File menu. Another way of doing it is to enable the contextual menu in the server (by right-clicking on it) and selecting the Authenticate Connection option.

Authentication can be carried out automatically on any type of server. Nevertheless, Novell servers will perform the same without the need of user intervention (once a connection to said servers has been established). However, as far as NT servers are concerned, the user needs to indicate that he/she wished to be automatically authenticated on the same (once a connection to said servers has been established, or afterwards). In other words, when connecting to a Novell server, this will carry out the authentication process, but the user must indicate that the process be performed automatically on an NT server.

Once you have indicated that the connection be made automatically (on Windows NT servers), Panda Administrator will be in charge of performing the same the moment a connection is opened with any of the available NT servers.


Reports and Data Shown in Scan Reports

As an optional feature, the various activities carried out by the antivirus of a server are recorded in a report to be consulted later.

The activities performed by the workstation antivirus tools are also registered in a report which is common to all workstations connected to the same server.

The results window shows an entry for each event recorded. An icon at the beginning of each entry indicates the type of incident (informative, virus found, etc.). To the right of the icon the date and time of the incident are shown. Finally, a description of the incident is given and the action taken.

The report can be printed by pressing the button displayed for that purpose. It can also be erased to prevent the file from getting too big. Moreover, you can convert it into a text document by clicking the Export button. You will be asked to provide the file’s path where the file will be saved and a text character that will serve as a field separator.

If you double-click on any incident, a window appears with detailed information on it. When the incident involves the detection of a virus, the information shown is as follows:

•	Date / Time: indicates the date and time of detection.

•	Virus name: the name of the virus detected is shown.

•	Path: indicates the file contaminated by the virus.

•	Type of detection: this field indicates how the virus has been detected (by permanent protection, by an immediate scan or a scheduled one).

•	Action: this point reports on the action the antivirus has taken upon detecting the virus.

•	Operation performed: lets you know whether the operation in which the virus was detected has been carried out or not. If you ordered the antivirus to take a certain action upon detecting a virus, this field indicates whether that action has been successfully performed or not.


Print this Help File

This help file will allow you to obtain information on any topics related to the Panda Global Virus Insurance. In addition, it will also allow you to print either specific sections or the complete Help file.

•	It you wish to print a specific topic, just click Print on the button bar.

•	If you wish to print a whole chapter (a book containing all the pages), press Help Topics and select the book from the main Help tab (Contents). Then, just press the Print… button.

•	If you wish to print the whole Help file, press Print Complete Help File, on the button bar. You can also use the button below (Print All) or just click here.

Notice: Printing the whole Help file can take a long time. It might take up to 211 pages depending on the printer installed and the configuration established by default.


Description of Panda Administrator for Networked PCs

When protecting a network against viruses, it is essential to protect the workstations in the network. Since a network normally contains many workstations which are in different locations, the job of installing effective antivirus protection and keeping it updated can take up a great deal of the network administrator’s time.

To obviate this problem, Panda Software has developed Panda Antivirus for networked PCs. Thanks to Panda Administrator, a network administrator can easily and automatically distribute the antivirus software to the different workstations in the network, thus ensuring security throughout the network.

As the different workstations are connected to the network, the antivirus that corresponds to their operating system will automatically be installed in them.

Panda Administrator enables the network administrator to protect all the workstations connected to it in a truly simple, effective and complication-free way.


How to Install the Antivirus in Networked Workstations

To install the antivirus software in networked workstations, first choose the server you want to take care of distributing the different versions according to the operating system used by each workstation. The antivirus will distribute itself as the workstations are connected to the network. Once you have selected the server, you should have a connection open with it with administrator privileges. For further information see the Installation (System Requirements) section.

If that connection is open before executing Panda Administrator, the program will automatically detect it. If it has not been opened previously, it can be opened from Panda Administrator.

Note: If the installation of the antivirus for workstations is being done in a Novell NetWare server from a workstation in which Windows NT has been installed, Novell NetWare’s Client 32 must also be installed. If Panda Administrator does not find said client installed, it will notify you of this situation and cancel the installation. But if the installation were to be performed on a 3.x server, this would not be necessary.

Additonally, it is important to note that Windows Millennium Edition does not execute the lines of the AUTOEXEC.BAT file. Consequently, when a computer running under Windows Millennium Edition is started or rebooted, the PAVCL.EXE antivirus file will not be run.

When you have opened the connection with administrator privileges, select the server in question and press the + sign to its left to access the workstation module. When you have accomplished this, select Stations and press the Install button. An installation wizard will then be displayed which will guide you through the entire process.

The steps to follow are:

1.	Welcome screen. This screen discusses the actions, which will be performed and makes some recommendations to facilitate the distribution of the antivirus.

2.	You will be requested to choose the versions of the antivirus (types of protection) that are going to be available for distribution. The antivirus software will only be installed in those computers that have an operating system that corresponds to one of the installed versions. The DOS version is always installed by default. We recommend installing all the versions, as they take up very little hard disk space. The possible options are displayed in a dialog box called Modules. The options are: OS/2, Windows 3.x, Windows 95 (you can choose between Panda Antivirus Windows 95/98 and Panda Antivirus Windows 95/98 Platinum), Windows NT (Panda Antivirus Windows NT or Panda Antivirus Windows NT Platinum), Exchange/Outlook Client and Lotus Notes Client.

3.	A list will be displayed, in which you can choose the language in which you wish to install the antivirus protection selected in the previous step.

4.	You will then be asked for the configuration of the antivirus that is to be distributed to the workstations. You can indicate a different configuration for each platform (Windows 95/98/2000/Me, Windows NT Workstation, MS-DOS and Windows 3.1x). The configurable options are all the ones pertaining to permanent protection; they are: status, configuration, extensions and action to take when a virus is detected.

There are substantial differences in the configuration settings of each of the protection modules to be installed. Each of these is described in detail in the following sections:

Configuration of the antivirus in DOS and WIN 3.x workstations

Configuration of the antivirus in Windows 95/98/2000/Me/NT workstations

Configuration of the antivirus in Exchange workstations

5.	Only in the case of a Windows NT server, confirmation will be requested about the replication in the installation of the workstation module from the PDCs (Principal Domain Controllers) to the BDCs (Backup Domain Controllers). Normally, when the workstations module is installed, the antivirus files are copied to a PDC (Principal Domain Controllers). From there it is distributed to a workstation when it connects to the PDCs.  There exists the possibility of replicating this installation to the BDCs so that when the installation process is completed in the PDC, this then copies the workstation module to the selected BDCs and these take charge of installing the antivirus in the workstations. This process eliminates a large portion of the information travelling over the network at the same time freeing the PDC from some of its tasks. If the checkbox Use directory replication is ticked, we then have to specify the conditions for:

•	Backup Domain Controllers: through a list, it is possible to select the BDCs to which it will replicate, in addition to permitting the introduction of the user ID and password of the domain administrator. It is also possible to specify the target directory for each.

•	Method of distribution: having clicked Next in the window where you have selected the BDC's, it will be possible to indicate when the directories should be replicated from the PDC's to the BDC's. It is possible to choose the moment at which replication has to be done from the PDCs to the BDCs. This could be Immediate (this would begin when the installation process has finalized) or Programmed (it would be done automatically at the set time and date).

6.	The versions of the antivirus for workstations will be copied, together with the distribution module, to a directory of the server. At this point you will be asked to indicate which directory will be host to the different versions of the antivirus. As is recommended in the first point of the assistant, all the users should have reading rights over this directory and it is recommended that they do not have any writing or modification/deletion privileges.

7.	For a correct distribution of the antivirus, all the workstations in the network must refer in the same manner to the directory that contains the antivirus versions. To this end, all the workstations must map the server drive in the same way. Panda Administrator will do this mapping automatically, although you will be asked to give the drive letter you wish to assign, in order to avoid using a letter that has already been used.

8.	Only if installation is being carried out on a Novell NetWare server, will it prompt the user for the type of network on which the installation is to be carried out. This may be a local (LAN) or wide area network (WAN).

9.	When installing the workstation module from NT and Novell servers, it will be possible to indicate the users (in the case of NT servers) and the tree and context (for Novell servers) the antivirus is to be distributed to.

10.	Since modifications will be made to the server’s login script, this login script will be displayed and you will be offered the possibility of changing it. If you are performing the installation on a Windows NT server, the logon script will be shown, and you will be given the possibility of modifying it.

11.	To ensure a virus-free installation, the software offers the possibility of scanning the hard disks of the server before proceeding to copy files. Likewise, it is possible to instruct the setup wizard to look for previous installations of the workstation module. This second option is also selected by means of a check box and is enabled by default.

12.	If this option is selected, the scanning of the different hard disks in the server will begin.

13.	When the scan is complete, the copying of files will start. A progress bar shows the status of the copying process.

Once the workstation module's installation has finalized, the antivirus would be distributed automatically to all those stations that connect to server in question (if immediate distribution or replication is selected). Each computer will receive the version corresponding to its operating system.


How to Configure of Antiviruses in Networked Workstations

The configuration option for networked workstations permits you to indicate how the antivirus will behave under each different type of station, depending on the platform or operating system installed. The corresponding antivirus version will be installed on each platform. When carrying out the configuration process, each group of similar workstations will share the same options selected. There are two different ways of configuring the antivirus for workstations:

•	During the installation. One of the steps of the antivirus installation process is the program’s configuration, which can be carried out for any of the versions you wish to install.

•	After the installation. In this case, the workstation antivirus is already installed, but you may want to configure the program again. To do this, you need only select the workstation(s) for which you want to configure the antivirus and then press the Configure button located in the Panda Administrator button bar.

In either of the two cases, the antivirus configuration in the workstations presents several tabs:

•	Permanent protection: Thanks to this section, it will be possible to determine the exact behavior of the antivirus for any specific type of workstation selected.

Configuration in DOS and WIN 3.x workstations

Configuration in Windows 95/98/2000/Me/NT workstations

Configuration in Exchange stations

•	User distribution: presents a list of users where all those that are to receive the antivirus on connecting (PDC or BDC) should be marked. It is also possible to edit the Script of each user. It is worth commenting that all the users selected for distribution will have the antivirus installed with the same configuration.

•	Modules: permits selecting the type of protection that should be installed in the server to be distributed to the stations. The possibilities are: All, OS/2, Windows 3.1x, Windows 95/98 (Panda Antivirus Windows 95/98 and Panda Antivirus Windows 95/98 Platinum), Windows NT (Panda Antivirus Windows NT and Panda Antivirus Windows NT Platinum), Exchange/Outlook Client, Lotus Notes Client to all of them at the same time. After having installed the workstation module, it will be possible to modify it (in this tab) by altering the type of platforms in which it should be carried out.

If you have chosen to install Panda Antivirus 95/98 Platinum and/or Panda Antivirus NT Platinum on Windows 95/98/2000/Me and/or Windows NT workstations, it will be possible to configure each of these antiviruses through the corresponding Configure buttons. On doing so, a dialog box will appear in which you can configure the behavior of the antivirus at Startup (computer and Windows startup scans), and its Resident, File and Lotus Notes Client scans.

•	General configuration: informs about directory in which the workstation module will be installed and if the replication of directories (BDC) will be used. It also allows the Script to be edited and selection of the language in which the antivirus will be installed in all the workstations.

•	Replication: presents a list of the BDCs (Backup Controllers) available to which the installation of the workstation module can be replicated from the PDC servers. Selecting one/some of them and clicking on the Synchronize button, the replication will only be done to the selected servers. This means that the PDC will install the workstation module to the BDCs selected and these in turn will carry out the installation of the antivirus in the workstations. After installation, this tab will only be displayed if the installation of the workstation module has been done with directory replication.


How to Update the Antivirus in Networked Workstations

With these updates, you can prevent the antivirus programs installed on workstations from becoming obsolete. The moment you choose to carry this out, you can opt to either renew the entire antivirus program (known as an Upgrade) or simply renew the virus signature file (Update). The latter is a file known as PAV.SIG, which contains a virus database of the latest known viruses detected by the antivirus.

Note: depending on the type of server used, you will be permitted to either carry out both update processes or just the renewal of the virus signature file.

In order to update the antivirus in workstations, proceed as follows:

1.	Select the server that will take care of distributing the antivirus to connected workstations.

2.	If there is no connection with administrator privileges open with that server, open one now.

3.	Double-click on the server to view the Workstations section below it or click on the + symbol to the left of the server name

4.	Select the Workstations section and click on the Update button in the application’s button bar.

Once the Update button has been pressed, a wizard will guide you through the update process, which is as follows:

1.	Select the files to update. You can choose to either update the PAV.SIG file ONLY, which will renew the virus signature file, or renew All files, which will upgrade each and every antivirus file, including the PAV.SIG.

2.	If you have chosen to update the PAV.SIG, a window will appear that will permit you to select from the three update sources listed below. Otherwise, the upgrade process will begin.

•	Panda Administrator Directory. The file copy process will be performed from the directory of the server on which Panda Administrator is installed.

•	Internet (Panda Software Web page). The file copy process will be carried out from a specific address. If you choose to update through the Internet, a user name and password must be entered. In addition, if the Internet connection is made through a Proxy server, its IP address and port assigned must also be specified.

•	Other Location. The file copy process will be carried out from a directory that will be specified by clicking on the button located in the right hand side of this section.


How to Uninstall the Antivirus from Networked Workstations

To uninstall the antivirus from networked workstations, you must first select the server that is distributing the antivirus software to the workstations. When you have done this, you will need to have a connection open with that server with administrator privileges.

If the cited connection has been opened before executing Panda Administrator, Panda Administrator will detect it automatically. If this connection has not been opened, it can be opened from Panda Administrator.

When you have opened the connection with administrator privileges, select the server in question and press the + sign to its left to access the workstation module. When you have accomplished this, select Stations and press the Uninstall button. An uninstallation wizard will then be displayed and will guide you through the entire process.

The steps to follow are:

1.	A welcome window will inform you of the actions that are about to be performed.

2.	A second window indicates that the antivirus distribution module will be erased. If you accept this window, the program will inform you that you should take the precaution of uninstalling the antivirus from the workstations first, since this will be impossible after the distribution module has been removed.

3.	A window with a progress bar shows the status of the uninstallation process.


Configuration of the Antivirus on DOS and Windows 3.x Workstations (Installation of the Workstation Module)

Note: this section details the configuration of the antivirus during the workstation module installation process. On accessing the configuration after the workstation module has been installed, the same options appear, the only difference being that they are accessed through the Permanent protection tab.

The configuration process permits you to choose the options that indicate how the antivirus that will be distributed to each of the network workstations should behave. Depending on the platform installed on the station in question, one of the antivirus versions will automatically be distributed to it, following the conditions indicated in the configuration section.

To install the antivirus on MS-DOS or Windows 3.x workstations, you will need to meet the following requirements: 3.3 or higher version of the MS-DOS operating system, a 386 or higher processor, 4 MB of conventional memory and 9 MB of free hard disk space. You will also need at least 400 KB of XMS memory.

The configuration of the workstation antivirus can be carried out during the installation process, but it is also possible after the same by performing the following operations:

1.	Select the server responsible for distributing the antivirus to the workstations that connect to it.

2.	If there is no connection with administrator privileges open with that server, open one now.

3.	Double-click on the server to view the Workstations section below it or click on the + symbol to the left of the server name.

4.	Select the Workstations section and click on the Configure button in the application’s button bar. During the workstation module installation process it is also possible to configure each of the protection options selected in previous stages.

At this point, a dialog box will be displayed featuring two tabs:

Note: configuration screen for DOS/Windows 3.x workstations during the workstation module installation process (the options are the same during the installation and configuration processes).

Permanent protection configuration:

•	Don’t use extended memory as data segment: selecting this option indicates that when a scan is performed, this area of memory should not be used.

•	Scan all extensions: all files will be scanned, regardless of their extension.

•	Lock system when a virus is found: if an infected file is found, the system will be blocked, thereby preventing further operations from being carried out.

•	Scan only on execution: to prevent the antivirus from consuming system resources, scans performed by the Sentinel resident protector will only scan files that are run.

•	Scan Word documents regardless of their extension: all Word-related documents will be scanned.

•	Scan only “In The Wild”: this will scan for the viruses that appear in the standard In The Wild list published periodically.

•	Detect Word templates with .DOC extensions: this will indicate that Word templates that do not have their regular extension (DOT) should also be scanned.

•	Scan files using ATTRIB: when this command is used, the resident Sentinel protector will detect all irregularities.


Configuration of Antiviruses for  Windows 95/98/2000/Me and Windows NT (Workstation Installation Module)

Note: this section details the configuration of the antivirus during the workstation module installation process. On accessing the configuration after the workstation module has been installed, the same options appear, the only difference being that they are accessed through the Permanent protection tab.

This sections deals with the configuration sections of the antivirus for Windows 95/98/2000/Me and NT, as they possess very similar characteristics. However, should there be differences, these will be highlighted.

The configuration process permits you to choose the options that indicate how the antivirus that will be distributed to each of the network workstations should behave. Depending on the platform installed on the station in question, one of the antivirus versions will automatically be distributed to it, following the conditions indicated in the configuration section.

The following are the installation requirements for the workstation antiviruses:

•	For MS-DOS/Windows 3.x workstations: 386 or higher processor, 9 Mb of free hard disk space, 4 Mb conventional memory, at least 400 Kb of XMS memory and MS-DOS 3.3 operating system and/or Windows 3.x.

•	For Windows 95/98/2000/NT workstations: 486 or higher processor, 24 MB RAM memory and 20 MB of free hard disk space.

•	For Windows NT workstations: 486 or higher processor, 24 MB RAM memory and 20 MB of free hard disk space. If you use Windows NT 3.51, you should have Service Pack 5 installed. For Windows NT 4.0, Service Pack 4 should be installed. For NT 3.50, no Service Pack is required.

•	To install Panda Antivirus Platinum: Win 95/98/2000/Me/NT-Ws operating system, 486 or higher processor, 24 MB RAM memory and 70 MB of free hard disk space. If the operating system of the workstation is Windows NT W/S 4.0, Panda Antivirus Platinum is installed. If, on the other hand, the operating system of the workstation is Windows NT W/S 3.51 it will continue to install the normal version of the antivirus (Panda Antivirus 6.0), not Platinum.

The configuration of the workstation antivirus can be carried out during the installation process, but it is also possible after the same by performing the following operations:

1.	Select the server responsible for distributing the antivirus to the workstations that connect to it.

2.	If there is no connection with administrator privileges open with that server, open one now.

3.	Double-click on the server to view the Workstations section below it or click on the + symbol to the left of the server name.

4.	Select the Workstations section and click on the Configure button in the application’s button bar.

For each of the options selected when choosing the type of protection that should be distributed (workstation module), there exists a corresponding configuration tab (with some slight differences). The possible protection options are:

•	Panda Antivirus for Windows 95/98

•	Panda Antivirus for Windows NT

•	Panda Antivirus for Windows 95/98 Platinum

•	Panda Antivirus for Windows NT Platinum

If you have chosen to install Panda Antivirus Windows 95/98 on your workstations, a special configuration window will be displayed.

Note: configuration of Windows 95/98/2000/Me workstations during the workstation module installation.

If you have chosen to install Panda Antivirus Windows NT on your workstations, a special configuration window will be displayed.

Note: configuration of Windows NT (NT 3.51) workstations during the workstation module installation.

In both cases (Panda Antivirus Windows 95/98 or Panda Antivirus Windows NT), the options displayed upon accessing the configuration area are similar, and are presented in three tabs.

•	Status: this option permits you to view the status of the driver. It may only be enabled or disabled, although in Windows NT it will also be possible to select the type of network you want to use, Microsoft or Novell.

•	Disinfection: with this option you can indicate what action should be taken when a virus is found or if one cannot be disinfected: Cancel, Ignore, Disinfect, Rename file, Delete file. It will also be possible to indicate whether or not disinfection should be automatic, although this option is not available in the Windows NT configuration. In Windows NT (3.51), a checkbox option is included, through which you can indicate that disinfection should be carried out automatically.

•	Extensions Tab: in this tab, you can select the type of files that will be scanned. The buttons with the ">" and "<" symbols should be used to add or remove an extension form the list, respectively. If you check the All extensions option, all types of files will be scanned. If you choose the Compressed files option, any file with a compressed format will be scanned.

If you have chosen to install Panda Antivirus Windows 95/98 Platinum on your workstations, a special configuration window will be displayed. This window will allow you to configure Panda Antivirus Platinum for Windows 95/98 as well as to establish the settings of the scheduled updates.

Note: configuration of Windows 95/98/2000/Me Platinum, workstations during the workstation module installation.

If you have chosen to install Panda Antivirus Windows NT Platinum on your workstations, a special configuration window will be displayed. This window will allow you to configure Panda Antivirus Platinum for Windows NT as well as to establish the settings of the scheduled updates.

Note: configuration of Windows NT Platinum (NT 4.0), workstations during the workstation module installation.

In both cases (Panda Antivirus Windows 95/98 Platinum and Panda Antivirus Windows NT Platinum), the configurable actions cover computer startup (not in Windows NT) and Windows startup, the behavior of the resident protectors (for files and the Internet), and general antivirus and scan options. For further details, please refer to the Panda Antivirus Platinum user guide.


Configuration of the Antivirus in Exchange Workstations (Installation of the Workstation Module)

Note: this section details the configuration of the antivirus during the workstation module installation process. On accessing the configuration after the workstation module has been installed, the same options appear, the only difference being that they are accessed through the Permanent protection tab.

The configuration process permits you to choose the options that indicate how the antivirus that will be distributed to each of the network workstations should behave. Depending on the platform installed on the station in question, one of the antivirus versions will automatically be distributed to it, following the conditions indicated in the configuration section.

The configuration of the workstation antivirus can be carried out during the installation process, but it is also possible after the same by performing the following operations:

1.	Select the server responsible for distributing the antivirus to the workstations that connect to it.

2.	If there is no connection with administrator privileges open with that server, open one now.

3.	Double-click on the server to view the Workstations section below it or click on the + symbol to the left of the server name.

4.	Select the Workstations section and click on the Configure button in the application’s button bar.

General: this tab contains just two options. The first permits you to choose whether you want to Scan all messages in all folders the first time the antivirus is started up. The second options allows you to enable the Change button, which makes it possible to access the antivirus alerts section by means of a password.

Note: configuration of Exchange workstations, during the workstation module installation.

Alerts: Through this section, you will be able to indicate whether you wish to create a results file, as well as select the users that will receive a message in the event of a virus being detected. The recipients of these messages and the procedures for sending them are specified as follows:

Note: configuration of Exchange workstations, during the workstation module installation.

•	Generate results file: a file detailing all the incidents will be created.

•	Insert a warning in the message: you can warn others of a virus detection with a message.

•	Warn sender: the sender of the infected message will be warned.

•	Warn other recipients: you can also warn other recipients with a message.

•	Send a message to the administrator: the network administrator can be warned with an e-mail message. You need to enter his/her e-mail address.

The buttons that appear on the right labeled Text… serve to customize the warning message that will be sent to each recipient.

Startup: this tab allows you to configure the characteristics of the startup scan. The options are as follows:

Note: configuration of Exchange workstations, during the workstation module installation.

•	Scan unread mail: this option permits you to indicate how often scans should be performed upon startup. This can be done always, every «x» startups, every «x» days, or every certain day of the week.

•	Scan options: by checking the corresponding options, you will be able to indicate whether you want to Scan nested messages (complete messages included within other messages) and/or Scan compressed archives (files that are contain other files in reduced format).

•	If a virus is found: in the event of a virus being found, one of the following options may be selected: ignore, rename, remove or disinfect.

•	If disinfection is not possible: this option enables you to choose what action should be taken if a virus cannot be disinfected: rename or delete the infected file.

Real Time: this is where you can configure the behavior of the antivirus for scans that are performed in real time. The options are as follows.

Note: configuration of Exchange workstations, during the workstation module installation.

•	Enable: this allows you to enable or disable the real-time scan.

•	Scan messages: here is where you can select what should be scanned: messages sent (messages are scanned when created and when sent); messages received by the user; messages opened (when files are opened for reading or modification, opening being considered a modification); and, lastly, messages modified (messages that have been changed in some way, such as being marked as unread).

•	Scan options: this option enables you to choose what types of messages and related files are to be scanned. Checking the Scan nested messages option will scan messages that contain other messages. Through the Scan compressed files option, you can choose to scan compressed files in any format that are attached to mail messages.

•	If a virus is found: in the event of a virus being found, one of the following options may be selected: ignore, rename, remove or disinfect.

•	If disinfection is not possible: this option enables you to choose what action should be taken if a virus cannot be disinfected: rename or delete the infected file.

On Demand: this tab permits you to configure the options for on-demand scans, which can be activated immediately upon creation or at some other time.

Note: configuration of Exchange workstations, during the workstation module installation.

•	Scan options. You can indicate what types of messages and attached files should be scanned. By selecting the Scan nested messages option, it possible to scan entire messages contained within other messages. Through the Scan compressed files option, you will be instructing the antivirus to scan e-mail attachments in compressed format.

•	If a virus is found. In the event of a virus being detected, any of the following options can be selected: Ignore, Rename, Delete or Disinfect.

•	If disinfection is not possible. You can indicate what action should be taken if disinfection is not possible. The options are to Rename or Delete the infected file.


Scan Related Reports

Panda Antivirus offers you the possibility of creating a report file in which the activities of each scan performed are summarized. This report will be saved in a file that can be assigned a maximum size. This information is very useful, as it lets you see the work that has been carried out, the date and time the scan was performed and the results obtained.

The information shown is listed in columns. The first column details the date and time the detection was made, and the second indicates the name of the virus detected. If you need a hard copy of this information, just click on the Print button. On the other hand, when you have finished viewing the information, you need only click the Seen button to close the window and return to the application. You are also offered the possibility of deleting the report. To do this, just click on the Delete button. With this, you will delete the entire report containing all the scan activity data.

The information that appears in this report window is only a summary of the complete data available. By double clicking on any of the listed scans, the following additional information will be provided:

•	Date and time: this shows the date and time that the detection occurred.

•	Name of virus: this field shows the name of the virus detected.

•	Path: the name of the infected file.

•	Type of detection: indicates through which type of scanning the virus has been detected.

•	Equipment: displays the name or identifier of the workstation where the virus has been detected.

•	User: displays the name of the user who, at the moment the virus was detected, was working with the equipment/workstation infected.

•	Action: informs about the action that should have been taken at the time the virus was detected.

•	Operation carried out: displays the action taken by the antivirus.

To conclude this section, it is worth noting that there only exists one results report. Some users may confuse the information obtained by clicking on the Monitor button, located in the Job Monitor window, for a report, when this is in fact only a presentation of the properties and activities of the scan job in progress.


Installation (System Requirements)

The antivirus programs that Global Virus Insurance distributes to each of the workstations will correspond to the operating system installed. Consequently, the requirements wil be different in each case:

System requirements to install Panda Antivirus for MS-DOS and Windows 3.x

•	386 or higher processor.

•	Al least, 9 Mb of free space on the hard disk.

•	4 Mb conventional memory.

•	Al least, 400 Kb of XMS memory.

•	MS-DOS 3.3 operating system or higher, or Windows 3.x.

System requirements to install Panda Antivirus for Windows 95/98/2000/Me

•	486 or higher processor.

•	At least 24 Mb RAM memory.

•	20 Mb of free space on the hard disk.

•	Windows 95/98/2000/Me.

•	To install the antivirus on workstations running under Windows 2000, administrator privileges are required.

System requirements to install Panda Antivirus for Windows NT Workstation

•	486 or higher processor.

•	At least 24 Mb RAM memory.

•	20 Mb of free space on the hard disk.

•	Windows 95/98 or Windows NT Workstation

System requirements to install Panda Antivirus Platinum for Windows 95/98/2000/Me/NT

•	486 or higher processor.

•	At least 24 Mb RAM memory.

•	70 Mb of free space on the hard disk.

•	Windows 95/98/2000/Me or Windows NT Workstation.


Description of Panda Administrator for Windows NT Servers

Panda Administrator can be run under Windows NT 3.51 servers with Service Pack 5 installed and under NT 4.0 servers with Service Pack 4 (or higher) installed.

The main Panda Administrator window shows the different servers found. The most commonly used options are located in a button bar in the upper part of the main window.

All of the management of Panda Antivirus for Windows NT servers is done through Panda Administrator.


How to Install the Antivirus in Networked Windows NT Servers

Note: to install the Windows NT Server antivirus, you will need a 486 or higher processor, 64 MB of RAM memory and 100 MB of free hard disk space. As for the operating system, this should be Windows NT 3.51 or higher with Service Pack 5 installed, or Windows NT 4.0 together with Service Pack 4, or higher.

To install the antivirus for Windows NT servers in a Windows NT server, you will need to have a connection opened with the server with administrator privileges.

•	486 or higher processor.

•	64 MB or RAM memory.

•	100 MB of free hard disk space.

•	Windows NT 3.51 with SP 5, or Windows 4.0 NT with SP 4.

If the cited connection has been opened before executing Panda Administrator, the latter will detect it automatically. If this connection has not been opened, it can be opened from Panda Administrator.

When you have opened the connection with administrator privileges, select the server in question and press the Install button. The version of the Operating System installed in the server will automatically be checked. If it is Windows NT, the installation program will also check that Service pack 3.0 or a later version is also installed. An installation wizard will then be displayed which will guide you through the entire process.

The procedure to follow is:

1.	Installation type: you can indicate whether the antivirus is to be installed on the NT server at once (Immediate) or at a predetermined date and time (Scheduled).

2.	Default configuration. This allows you to install using the pre-established configuration settings. To do this, click on the Skip configuration button. If you wish to specify new configuration settings and save them for subsequent installations as the default settings, check the Save as default settings option.

If you accept the default configuration settings, the setup wizard will go on to step 3 of the configuration process. If you choose not to, you will have to follow these steps:

a.	General options. The general antivirus options allow you to specify whether the Sentinel protector should be enabled or not, as well as whether you want to scan compressed files or create a results report.

b.	Viruses. This step serves to indicate the actions that should be taken If a virus is found (Ignore, Disinfect, Delete, Only block or Rename file) and/or If disinfection is not possible (Rename or Delete).

c.	Exclusions. This allows you to specify elements that should not be scanned.

d.	Extensions. By adding and removing extensions from the list, you can specify the types of files to be scanned. If the Scan all extensions option is enabled, all files will be scanned. If, on the contrary, this option is disabled, only selected or default extensions will be scanned. To add new extensions to the list, just enter the extension name in the corresponding text box and click on the button featuring the greater than (>) symbol. To remove an extension from the list, highlight it and click on the button featuring the less than (<) symbol.

e.	Network alerts. Checking the Enable Microsoft network alerts box indicates that, if virus is found, warning messages should be sent to certain network users. These messages can be sent to a single Recipient or to an entire Domain. The text you wish to send should be written in the Message text box.

f.	SMTP alerts. Enabling the Apply SMTP alerts option indicates that if a virus is detected, warning messages are to be sent via e-mail. To do this, you will first have to specify the SMTP Server they will be sent through and the e-mail addresses of the recipients.

3.	In both cases (whether you accepted the default configuration settings or followed steps a - f), you are recommended to create or update the Windows NT Repair disks. These diskettes are created during the installation of Windows NT, and can also be created at a later stage using the RDISK utility.

4.	You can choose to scan the server in search of viruses before proceeding with the installation.

5.	If you selected the Scheduled installation (the first step of the installation process), two additional screens will be displayed:

a.	Username/Password. By entering a Username and Password, you will be able to create and protect a scheduled installation.

b.	Date/Time. You will have to specify the Date (day, month and year) and Time the scheduled installation should begin. It may be helpful to write a brief Description at this point in order to make it easier to identify the process later on.

6.	Lastly, you will be informed that all the necessary data have been gathered and that the installation process can continue. At this point, the file copy process will start. It will not be necessary to restart the server once the setup process has finished.

Note: it is not necessary to restart the server after installing the antivirus.


How to Configure the Antivirus in Networked Windows NT servers

Once the antivirus has been installed in the chosen server, it can be configured. To access the configuration of antiviruses for Windows NT for network servers, select them and click on the Configure button on the toolbar.

This allows you to set the scan job characteristics for scanning the Windows NT server/s. There are two types of this scan: Permanent (permanent protection) and On-demand. The former continually scans the server (without stopping) from the moment it is created and started. Whereas on-demand scans are immediate. They start the moment they are indicated to and finish when all of the necessary components have been scanned. Each has its own configuration options.

Permanent Protection Configuration in Windows NT servers.

On-demand scanning Configuration for Windows NT servers.


How to Update the Antivirus in Networked Windows NT Servers

To update the antivirus software for Novell NetWare servers, you will need to have a connection open with the server with administrator privileges.

If that connection is open before executing Panda Administrator, the program will automatically detect it. If it has not been opened previously, it can be opened from Panda Administrator.

When you have opened the connection with administrator privileges, select the server in question and press the Update button. When you have done this, an update wizard will appear to guide you through the entire process.

The steps to follow are:

1.	The system begins by asking for the type of update desired. You can choose among updating the file containing the virus identifiers, updating the antivirus software by allowing the computer to restart or updating the antivirus without restarting. The last two options also update the file containing the virus identifiers.

2.	You are then asked for the location of the update files. They may be located in the Panda Administrator installation directory, in another location in any of the drives which are accessible from the computer in question or even in the Internet. If you are going to do the update from the Internet, we recommend doing it on only one computer and then updating the remaining computers from the updated machine to speed up the process. If you have chosen to update via the Internet, you will be required to enter your Username and Password. From where the update will be carried out.

3.	As the last step, Panda Administrator will check whether the files with which the updating is to be performed are more recent than the ones which are already installed to avoid updating with an older version or one bearing the same date.

4.	A window shows the progress of the update so that you will know its status at all times.

When these steps are completed, the antivirus software will be updated.


How to Uninstall the Antivirus from Networked Windows NT Servers

To uninstall the antivirus software for Windows NT servers from a Windows NT server, you will need to have a connection open with the server with administrator privileges.

If that connection is open before executing Panda Administrator, the program will automatically detect it. If it has not been opened previously, it can be opened from Panda Administrator.

When you have opened the connection with administrator privileges, select the server in question and press the Uninstall button. When you have done this, an uninstallation wizard will appear to guide you through the entire process.

The procedure is as follows:

1.	A window is displayed which offers you the option of having the server restart automatically so that the antivirus files can be completely uninstalled.

2.	If you accept the uninstallation, the process will begin and a window will be shown with a progress bar enabling you to follow the uninstallation process, which only takes a few seconds.

When these steps are completed, the antivirus software will have been removed from the server.


How to Scan a Windows NT Server

All the analytical activities are grouped under a single section to make their management easier. To monitor a scan or perform new scans, select the server you wish to scan and press the Scan button. The Windows NT Servers antivirus, allows you to perform two types of scan jobs:

•	On-demand: runs, or takes place, the moment it is created.

•	Permanent: the antivirus is in the memory, and without user intervention, continuously scans, detects and if necessary disinfects viruses automatically.

In this way you will access the Scan Job Monitor. The scan job management window has a central area where the different in-progress or scheduled scans are displayed. This area shows the name of each scan together with its type (permanent protection, immediate or scheduled), the number of viruses which the scan in question has found, the status of the scan and the next time that scan will be performed (the latter piece of information is only meaningful for scheduled scans).

There is always one scan job present in the central area which corresponds to permanent protection. The options available in the Scan Job Monitor are the following:

Add and/or Create a new scan job in Windows NT servers.

Delete a scan job  in Windows NT servers.

Edit and/or Modify a scan job in Windows NT servers.

Presentation of scan job reports in Windows NT servers.

Monitoring a scan job.

Stop and Abort a scan job in Windows NT servers.


Presentation of Scan Job Reports in Windows NT Servers

Panda Antivirus offers you the possibility of creating a report file in which the activities of each scan performed are summarized. This report will be saved in a file that can be assigned a maximum size. This information is very useful, as it lets you see the work that has been carried out, the date and time the scan was performed and the results obtained.

The information shown is listed in columns. The first column details the date and time the detection was made, and the second indicates the name of the virus detected. If you need a hard copy of this information, just click on the Print button. On the other hand, when you have finished viewing the information, you need only click the Seen button to close the window and return to the application. You are also offered the possibility of deleting the report. To do this, just click on the Delete button. With this, you will delete the entire report containing all the scan activity data.

The information that appears in this report window is only a summary of the complete data available. By double clicking on any of the listed scans, the following additional information will be provided:

•	Date and time: this shows the date and time that the detection occurred.

•	Name of virus: this field shows the name of the virus detected.

•	Path: this may indicate two things. First, if you are dealing with a compressed archive containing infected files, the Path field will indicate the name of the compressed archive that contains the infected files. On the other hand, if the infected file is not found in a compressed archive, this field will specify the name of the infected file, leaving the following information field (File) blank.

•	File: this is the name of the infected file in which the virus has been detected.

•	Type of detection: indicates through which type of scanning the virus has been detected.

•	Action: informs about the action that should have been taken at the time the virus was detected.

•	Operation carried out: displays the action taken by the antivirus.

To conclude this section, it is worth noting that there only exists one results report. Some users may confuse the information obtained by clicking on the Monitor button, located in the Job Monitor window, for a report, when this is in fact only a presentation of the properties and activities of the scan job in progress.


How to Schedule Tasks in Windows NT Servers

In the same way that we can carry out scheduled tasks from any of the Windows NT servers that the user can find, it is possible to program actions that each of these servers will carry out independently of each other. To do this it will be necessary to select an NT server and click on the Program button, from the Panda Administrator tool bar.

The actions or tasks that can be scheduled so that the Windows NT server executes them at a set date and time will be displayed as verification checkboxes in the Scheduled tasks window. After selecting these, click the Next button to enter the assistant, which will guide us through the scheduling process step by step.

Installation: permits setting at which moment and with what configuration the antivirus should be installed in the workstations.

Deinstallation: it is possible to control the moment at which deinstallation of the workstation module should be executed and impede the antivirus from being distributed among the workstations.

Updating: Thanks to the scheduled updates the antivirus in the workstations will not become antiquated as from the NT server it is possible to indicate the exact interval with which the antivirus or the virus signature file should be renewed.

Configuration: it is possible that the configurations of some of the workstations will change over time. In order to ensure that the current configuration is the correct one it is necessary to create a scheduled configuration.

Replication to a BDC: we already know that it is possible to distribute the workstation module from an NT server to the BDCs. At the time of installing the workstation module, it is possible to indicate whether it is to be immediate or scheduled. This is another way of saying that the replication should be scheduled by selecting the time and the properties with which it should be executed.

In each case after having selected the task that has to be done automatically, it is possible to define each of the features to be programmed. This will be possible thanks to the step by step guide presented by the scheduled tasks assistant in function of the options selected and by clicking on the Next button.


Exclusions Configuration in Windows NT Servers

By clicking on the Exclusions button which appears in the configuration dialog box, you can select which areas, files or extensions you do not want scanned. In the exclusions section you can indicate those areas, files or extensions which you do not want scanned. Regardless of what you may have indicated in Extensions, all those areas, files or extensions which are marked here will not be scanned. The options offered by this section are:

•	Exclusions: if this option is marked, the exclusion feature will be activated according to the data you have indicated.

•	Extensions:  this section displays a list of extensions which are not to be scanned. Even though some of these extensions may be on the list of extensions to be scanned, they will not be scanned.

•	Add extension: this option enables you to add an extension to the list of extensions which you do not want scanned.

•	Remove extension: thanks to this option, you can eliminate an extension from the list of extensions which are not scanned.

•	File: this section shows a list of the files which are not to be scanned.

•	Add file: this option allows you to add a file to the list of files you do not want scanned.

•	Remove file: use this option to eliminate a file from the list of files which are not scanned.

•	Paths: this section shows a list of all the directories which must not be scanned.

•	Add path: with this option you can add directories to the list of directories which will not be scanned.

•	Remove path: this option allows you to eliminate directories from the list of directories which are not to be scanned.


Extensions Configuration in Windows NT Servers

By clicking on the on the Extensions button which appears in the configuration dialog box, you can select the extensions. In this section you can configure the extensions which the permanent protection feature must scan in search of viruses. Regardless of the selection of extensions you may make, EXE and COM files will always be scanned. The options offered by the extensions window are:

•	Scan all extensions: if this option is marked, all extensions will be scanned, regardless of what may have been specified in the rest of this window.

•	New extension: here you can enter a new extension to add it to the list of extensions to be scanned.

•	Add extension: when you click on the > button, the extension indicated in the New extension section will be added to the list of extensions which must be scanned.

•	Remove extension: when you select an extension from the list of extensions to be scanned and press the  < button, the selected extension is eliminated from the list.

•	Default extensions: if you press this button, the list of extensions to be scanned returns to its default configuration.

•	Clear: when you click on this button, the list of extensions is cleared.


Alerts Configuration in Windows NT Servers

By clicking on the Notify...  button which appears in the configuration dialog box, you can configure the warnings that the antivirus generates when a virus is detected. In this section you can configure the notifications which the antivirus tool will generate when it finds a virus. The options found here are the following:

•	Selected Alerts: in this section you can choose the types of warnings to be generated. You can choose to generate warnings characteristic of Microsoft networks and / or to send an electronic mail message in SMTP format.

•	Microsoft Network: if you have chosen to send a message through the Microsoft network, you must indicate the recipient or domain to which you want the message to go as well as the message itself.

•	SMTP: if you have chosen to send an electronic mail message, you will have to indicate the server through which the message is to be sent, the recipient’s address, the subject of Eamothe message and the message itself.


Add and/or Create a New Scan Job in Windows NT Servers

By clicking on the Add, button in the Scan Monitor, a wizard will appear to facilitate the introduction of a new job.

1.- Type of scan job

Two types of scan jobs can be created: immediate or scheduled. The former is carried out the moment it is created. The latter allows you to establish a scanning “calendar” so that scan jobs can be executed periodically.

2.- Scan paths

You must indicate the areas of the server that will be scanned. The areas that have a checkmark on their left will be scanned. The All button allows you to easily indicate that the entire server should be scanned. In this step it is possible to define  what  scan jobs you want to carry out using the Journaling technique. To do this you must check the corresponding box.  It will only scan new files or files which have been modified since the last scan. Two thing s must be taken into account with Journaling:  It can only be done using Windows 2000 or Windows NT FS 5 and it can only be applied to complete disk drives (not to individual folders or directories)

3.- Job configuration

Allows you to specify the general scan options, the action to take when a virus is detected, the extensions to scan, possible exclusions (areas that should not be scanned) and the warnings that will be generated when a virus is detected.

4.- Scheduling

If it is a scheduled task, at this point we can establish when the scanning in question should be executed. The start time and date has to be indicated along with the periodicity with which the task is to be executed. It is advisable to assign a name to the task that permits it to be easily recognized at a later date. In the case of scheduled tasks, this is the time to specify the schedules that you wish to assign. For each task the following data can be specified:

•	Description: it is advisable to assign a name to each job so that it can be easily identified later.

•	Start date: indicates the date on which the scan will begin. Next to the date the scan start time is also indicated.

•	Frequency: you can indicate a weekly, monthly or even a combined weekly and monthly frequency. Thus, you can schedule a given job for each Monday and Friday, the 10th and 20th of each month or any other combination.

•	CPU load: here you assign a priority to the scan job. If you indicate a high CPU load, the scan job will be executed with a high priority. If you indicate a low CPU load, the job will be performed with a low priority.

•	Abort at: thanks to this option, you can cancel a scan job if it is not completed by a certain time.

•	End date: to complete the scheduling of jobs, you can also indicate an end date for the scheduled job. The job will thus remain in effect only between the two dates you indicate.

•	Status: allows you to indicate the status of the scan job in case you wish to deactivate it temporarily. Jobs in inactive status will not be executed again until their status has been changed to active again.

5.- Summary

In this last step, a summary of the information you have provided is shown. If you decide to continue, the scan job will be created.


Delete a Scan Job  in Windows NT Servers

By clicking on Delete, in the monitor dialog box, a selected scan job can be deleted from the list of jobs.

Any scan job can be deleted, whether it is scheduled or immediate. It does not matter if this scan job is executed or not, it can always be deleted.

However, one type of scan job that cannot be deleted is the permanent protection. In other words, the scan job which is continuously scanning for possible infections in the server (resident), can never be deleted.


Edit and/or Modify a Scan Job in Windows NT Servers

The permanent scan job monitor allows you to carry out modifications or access the status of an existing scan job. To do this, select a scan job from the list (in the monitor) and click on the Edit button. It is possible to modify any of the scan job properties which have been edited.


Monitoring a Scan Job

By clicking on the Monitor button in the scan job list (Scan job monitor), information about the scan job will be displayed (files scanned, viruses detected, information on the file being scanned, etc).


Stop and Abort a Scan Job in Windows NT Servers

Click on the Stop button in the scan job monitor dialog box, the scan job selected from the list will be temporarily stopped. The scan job will be “frozen” (it exists but it is not running) and the Stop button changes to Continue. When you click on the Continue button the previously stopped scan job will be resumed.

On the other hand, if a scan job is selected and you click on the Abort button in the Scan job monitor window, this scan job will be permanently cancelled. This does not mean that the scan job has disappeared from the list. It is still in the list but it is not running.


Permanent Protection Configuration in Windows NT Servers

The permanent protection feature is responsible for keeping watch on all the operations with files which are performed in the Windows NT server. Permanent protection also watches all boot access operations from any floppy disk or hard disk. The permanent protection options available are the following:

General options:

•	Active: this option determines whether or not permanent protection will be enabled.

•	Scan compressed files: if this option is checked, all the compressed files which are intercepted will be scanned.

•	Generate report: this option enables the creation of a report which will reflect the activity of the antivirus software.

If a virus is found:

•	Ignore: if this option is checked and a virus is found, the antivirus will notify you of the discovery, but will take no further action.

•	Disinfect: if this option is checked and a virus is found, the antivirus will attempt to disinfect the infected file.

•	Delete: if you mark this option and a virus is discovered, the antivirus will erase the infected file.

•	Only prevent access: if this option is checked and a virus is found, the operation in which the virus was detected will be canceled.

•	Rename: if this option is checked and a virus is found, the antivirus will rename the infected file.

If disinfection is not possible:

•	Rename file: if this option is checked and the antivirus has not been able to disinfect a contaminated file, this file will be renamed.

•	Delete file: if this option is checked and the antivirus has not been able to disinfect a contaminated file, this file will be erased.

Exclusions Configuration in Windows NT Servers

Extensions Configuration in Windows NT Servers

Alerts Configuration in Windows NT Servers


On-demand Scanning Configuration for Windows NT Servers

From Panda Administrator you can scan any hard disk in the Windows NT server or any directory or file on one of the server’s hard disks. Each time a scan is performed on demand, you can choose the configuration of that scan but you can also indicate a default configuration. The configuration options are as follows:

General options:

•	Scan compressed files: if you mark this option, all compressed files found will be scanned.

•	Generate report: if you check this option, a report will be generated which will reflect the activity carried out by the antivirus software.

If a virus is found:

•	Ignore: if this option is checked and a virus is found, the antivirus will notify you of the discovery, but will take no further action.

•	Disinfect: if this option is checked and a virus is found, the antivirus will attempt to disinfect the infected file.

•	Rename file: if this option is checked and a virus is found, the antivirus will rename the infected file.

•	Delete file: if you mark this option and a virus is discovered, the antivirus will erase the infected file.

If disinfection is not possible

•	Rename file: if this option is checked and the antivirus has not been able to disinfect a contaminated file, this file will be renamed.

•	Delete file: if this option is checked and the antivirus has not been able to disinfect a contaminated file, this file will be erased.

In addition to the options mentioned above, the configuration of on demand scans has a button which enables you to configure the extensions which must be scanned.

Extensions Configuration in Windows NT Servers


Description of Panda Administrator for Novell NetWare Servers

Panda Administrator is capable of working with Novell NetWare 3.x and 4.x servers.

The main window of Panda Administrator shows the different servers found. The most commonly used options are located in a button bar in the upper part of the main window.

All Panda Antivirus management for Novell NetWare servers is carried out through Panda Administrator. In addition, in the Novell NetWare console you can display the antivirus console, which provides information about the status of the antivirus.


How to Install the Antivirus in Networked Novell NetWare Servers

To install the antivirus on NetWare servers, it will be necessary to have at least 2 MB of RAM memory and 2 MB of free hard disk space.

To install the antivirus for Novell NetWare servers in a NetWare server, you will need to have a connection open with the server with administrator privileges.

•	486 or higher processor.

•	32 MB of RAM memory.

•	10 MB of free hard disk space.

•	Novell NetWare Server 3.12 with SP #6, or higher.

•	SPX, SPXII o TCP/IP.

•	Panda Administrator’s workstation: Client 32 is installed.

If the connection was opened before executing Panda Administrator, the latter will detect it automatically. If this connection has not been opened, it can be opened from Panda Administrator.

When you have opened the connection with administrator privileges, select the server in question and press the Install button. Firstly, check which version of the Operating System is installed in the server. In the case of Novell servers, check that it is 3.11 or a later version. An installation wizard will then be displayed which will guide you through the entire process.

The procedure to follow is:

1.	Welcome window which explains the operation to be performed.

2.	You are asked to give a user name and password corresponding to an administrator’s account. If Novell NetWare’s Client 32 is installed, this window will offer you facilities for choosing any user in the NetWare tree.

3.	You will then be offered the option of installing the antivirus in the server’s startup. We strongly recommend choosing this option, as it ensures a complete and efficient protection.

4.	It is possible to select a scan of the different NetWare volumes in the server in which the antivirus will be installed. By doing this you will be assured that they are not infected with a virus before starting the antivirus installation.  It is recommendable to select this option as it considerably increases security.

5.	If you have chosen to carry out the pre-installation scan in search of viruses, you will see the progress of this operation in a window provided for this purpose.

6.	When the scan is finished, a window will be displayed to show the progress of the installation process.

7.	To finish the installation process, you can load the module corresponding to the Novell server antivirus remotely, without the need to have to do it from the console.

If you did not carry out the remote load in the last step of the installation process, you will now have to load the antivirus module on the Novell NetWare server. To do this, execute the PAV command from the console. This can be done by means of the Rconsole command from any networked computer with administrator privileges, or directly in the server console itself.

When you have loaded the antivirus module, in a few seconds you will see, from Panda Administrator, the antivirus tool as activated.

Note: If you have installed the antivirus for NetWare servers in a Novell NetWare 4.x server and Novell’s 32-bit client is installed in the computer from which the installation has been performed,  the process of loading the antivirus in the server will be automatic, and therefore you will not need to execute PAV directly in the console.


How to Update the Antivirus in Networked Novell NetWare Servers

To update the antivirus software for Novell NetWare servers, you will need to have a connection open with the server with administrator privileges.

If that connection is open before executing Panda Administrator, the program will automatically detect it. If it has not been opened previously, it can be opened from Panda Administrator.

When you have opened the connection with administrator privileges, select the server in question and press the Update button. When you have done this, an update wizard will appear to guide you through the entire process. Updating consists of copying an updated version of the virus signature file over the one in current use. On the other hand, it is also possible to update the antivirus program itself. This is known as an Upgrade.

The steps to follow are:

1.	The system begins by asking for the type of update desired. You can choose among updating the file containing the virus identifiers, updating the antivirus software by allowing the computer to restart or updating the antivirus without restarting. Both antivirus update procedures update the virus signature file.

2.	It is possible to choose whether the update is immediate or scheduled. In the case of the former, the update will be performed as soon as the last step of the wizard finishes. If it is a scheduled update, you need to indicate under what circumstances and when the update should be done. When the antivirus identifies the date and time that the update should be performed it will automatically execute it.

NOTE: A scheduled update can only be carried out from a Windows NT computer (whether it is a server or a workstation).

3.	The next step, only for scheduled updates, consists of selecting which Windows NT computer will be responsible for carrying out the update (update the signature file from the Internet). For this reason, the following data should be displayed in the dialog box which appears:

NT computer: the computer with Windows NT, should carry out the virus signature file update, in the Novell server (if it is a scheduled update).

User: the name of the user (of the Novell server) who will copy the virus signature file, from the Windows NT computer, to the Novell server.

Password: the user password (of the Novell server) which allows the scheduled update to be carried out in the Novell server (this user must have access to the NOVELLSERVER/SYS/PAVNW directory.

Confirm Password: the user must re-enter their password to check that it is correct.

4.	You are then asked for the location of the update files. They may be located in the Panda Administrator installation directory, in Another location in any of the drives which are accessible from the computer in question or even in the Internet. If you are going to do the update from the Internet, we recommend doing it on only one computer and then updating the remaining computers from the updated one to speed up the process.

If you choose to update through the Internet, another two screens will appear relating to user passwords and the need of a proxy server for connection purposes. In the first of these it is possible to view and modify the Internet Address for the updates and enter the Username and Password which will allow you to access these updates. Once this has been done, another screen will be shown reminding you of the need of a Proxy server to make the Internet connection.

5.	In the last step, Panda Administrator will check whether the files with which the updating is to be performed are more recent than the ones which are already installed to avoid updating with an older version or one bearing the same date.

6.	A window shows the progress of the update so that you will know its status at all times (where the update should be carried out from).

When these steps are completed, the antivirus software will be updated.

Note: if there is no client installed the workstation module will not appear. To carry out a complete program update, it will be necessary to uninstall and then install the new version.


How to Configure the Antivirus in Networked Novell NetWare Servers

Once the antivirus has been installed in the chosen server, it is possible to indicate how it should behave in given situations. This means configuring the antivirus in the Novell NetWare for network server/s. To do this, choose which server antivirus you want to configure. When a Novell server has been selected click on the Configure button on the task bar.

A dialog box will appear, through which it is possible to control all the features of the antivirus installed in the server. This configuration is divided into three parts. Firstly, the behavior of all possible scan jobs can be set: on-demand and permanent protection, as well as the characteristics of the report which will be generated. An on-demand scan, is an immediate virus scan. It starts as soon as it is created and finishes when all of the specified files have been scanned. The permanent protection scan continuously scans for viruses, as soon as the server to be protected is switched on or started up. The configuration options are as follows:

Permanent Protection Configuration in Novell servers.

On-demand protection Configuration in Novell servers.

Scan Job Report Configuration in Novell NetWare servers


How to Uninstall the Antivirus from Networked Novell NetWare Servers

To uninstall the antivirus software from Novell NetWare servers, you will need to have a connection open with the server with administrator privileges.

If that connection is open before executing Panda Administrator, the program will automat	ically detect it. If it has not been opened previously, it can be opened from Panda Administrator.

When you have opened the connection with administrator privileges, select the server in question and press the Uninstall button. When you have done this, an uninstallation wizard will appear to guide you through the entire process.

The procedure is as follows:

1.	An initial window is displayed which informs you about the uninstallation process and requests confirmation of your desire to uninstall the antivirus program.

2.	A progress window then opens to enable you to follow the uninstallation process, which only takes a few seconds.

When these steps are completed, the antivirus software will have been removed from the server.


How to Scan a Novell NetWare Server

All the scanning activities are grouped under a single section to make their management easier. To monitor a scan or perform new scans, select the server you wish to scan and press the Scan button.

In this way you will access the Scan Job Monitor. The scan job management window has a central area where the different in-progress or scheduled scans are displayed. This area shows the name of each scan together with its type (permanent protection, immediate or scheduled), the number of viruses which the scan in question has found, the status of the scan and the next time that scan will be performed (the latter piece of information is only meaningful for scheduled scans).

There is always one scan job present in the central area which corresponds to permanent protection. The options available in the Scan Job Monitor are the following:

Add a new scan job in Novell NetWare servers.

Delete a scan job in Novell NetWare servers.

Edit or Modify a scan job in Novell NetWare servers.

Scan job reports in Novell NetWare servers.

Monitor a scan job in Novell NetWare servers.

Stop and Abort a scan job in Novell NetWare servers.


Panda Antivirus Operation from the NetWare Console

Our antivirus tool for Novell NetWare servers is designed to be used from a workstation in which Panda Administrator is installed. However, there is also a series of functions which can be executed from the Novell NetWare server console.

Description of Panda Antivirus for Novell NetWare servers

Our antivirus software for Novell NetWare servers is composed of two programs for NetWare: a loader and the antivirus tool itself. Load the NLM which corresponds to the loader, since the latter will take care of loading the NLM corresponding to the antivirus software.

How to load the antivirus

We recommend that you create a file called PAV.NCF in the SYSTEM directory with the following command line:

LOAD SYS:\PAVNW\PAV.NLM %1

When you have done this, you will only need to type PAV on the console to load the antivirus. If you prefer to perform this operation manually, type:

LOAD SYS:\PAVNW\PAV.NLM

Once inside the antivirus tool, the following keys will be available to you:

•	Cursors: will allow you to move around the antivirus screen.

•	F1: pressing this key opens a help tool with a description of the functions of the different keys which can be pressed.

•	F2: pressing this key brings up a chart containing the currently existing scan jobs. It will show both the immediate and the scheduled scans. If you position yourself on a specific job and press the Enter key, a set of options will appear which will enable you to delete, execute or view the job. If the job is being executed, the operations available to you will be: delete, cancel or stop the job.

•	F3: loads the configuration.

•	F4: changes the language of the antivirus software to one of the different languages available.

•	F5: resets the different counters of the program.

•	F7: deactivates the virus alarm which is displayed at the bottom of the screen after a virus has been detected.

•	F9: pressing this key orders a scan of the entire SYS volume. This is the only scan job that can be created from the console.

•	Escape: press this key to quit the antivirus program. Remember that, even though you quit the program, the loader will remain loaded in the NetWare server.

The keys which are available to you in the loader program are:

•	Cursors: allow you to move around the antivirus screen.

•	F1: pressing this key opens a help tool with a description of the functions of the different keys which can be pressed.

•	F4: changes the language of the antivirus software to one of the different languages available.

•	F7: loads and unloads the antivirus program.

•	F8: updates the antivirus.

•	Escape: pressing this key unloads the loader program.


Configuration of Permanent Protection in Novell NetWare Servers

if you have chosen to load the antivirus in the boot sector of the server, the permanent protection (the antivirus) will constantly monitor the file-related operations in this server. File transmissions are protected to ensure that infected files are neither sent nor received. Permanent protection options are as follows:

General options:

•	Active: this option determines whether permanent protection is going to be active.

•	Scan incoming files: if this option is checked, all files sent to the server will be scanned.

•	Scan outgoing files: if this option is checked, all files coming from the server will be scanned.

•	Scan compressed files: if this option is checked, all the compressed files which are intercepted will be scanned.

•	Generate report: this option enables the creation of a report which will reflect the activity of the antivirus software.

If a virus is found:

•	Ignore: if this option is checked and a virus is found, the antivirus will notify you of the discovery, but will take no further action.

•	Disinfect: if this option is checked and a virus is found, the antivirus will attempt to disinfect the infected file.

•	Delete: if you mark this option and a virus is discovered, the antivirus will erase the infected file.

•	Block access: if this option is checked and a virus is found, the operation in which the virus was detected will be canceled.

•	Rename: if this option is checked and a virus is found, the antivirus will rename the infected file.

•	Move to: if this option is checked and a virus is found, the antivirus will move the infected file to a location which you have indicated in the text box which is displayed for that purpose. A button next to this box allows you to choose a directory easily.

If disinfection is not possible:

•	Rename file: if this option is checked and the antivirus has not been able to disinfect a contaminated file, this file will be renamed.

•	Delete file: if this option is checked and the antivirus has not been able to disinfect a contaminated file, this file will be erased.

•	Ignore: if this option is checked and a virus that cannot be disinfected is found, the antivirus will notify the user of the situation but will not carry out any further action.

In addition to the options mentioned above, the permanent protection configuration has three buttons which enable you to configure exclusions, extensions and notifications.

EXCLUSIONS configuration.

EXTENSIONS configuration.

Alerts configuration (NOTIFY...)


Exclusions Configuration in Novell NetWare Servers

In the exclusions section you can indicate those areas, files or extensions which you do not want scanned. Regardless of what you may have indicated in Extensions, all those areas, files or extensions which are marked here will not be scanned. The options offered by this section are:

•	Directory:  this section shows a list of all the directories which are not to be scanned.

•	Add directory: you can use this option to add directories to the list of directories which are not scanned.

•	Remove directory: use this option to remove directories from the list of directories which you do not want scanned.

•	File: this section shows a list of the files which are not to be scanned.

•	Add file: this option allows you to add a file to the list of files you do not want scanned.

•	Remove file: use this option to remove a file from the list of files which are not scanned.

•	Extensions: this section displays a list of extensions which are not to be scanned. Even though some of these extensions may be included in the list of scannable extensions, they will not be scanned.

•	Add extension: this option enables you to add an extension to the list of extensions which you do not want scanned.

•	Remove extension: thanks to this option, you can remove an extension from the list of extensions which are not scanned.


Extensions Configuration in Novell NetWare Servers

In this section you can configure the extensions which the permanent protection feature must scan in search of viruses. Regardless of the selection of extensions you may make, EXE and COM files will always be scanned. The options offered by the extensions window are:

•	Scan all extensions: if this option is marked, all extensions will be scanned, regardless of what may have been specified in the rest of this window.

•	New extension: here you can enter a new extension to add it to the list of extensions to be scanned.

•	Add extension: when you click on the > button, the extension indicated in the New extension section will be added to the list of extensions which must be scanned.

•	Remove extension: when you select an extension from the list of extensions to be scanned and press the  < button, the selected extension is eliminated from the list.

•	Default extensions: if you press this button, the list of extensions to be scanned returns to its default configuration.

•	Clear: when you click on this button, the list of extensions is cleared.


Alerts Configuration in Novell NetWare Servers

In this section you can configure the notifications which the antivirus tool will generate when it finds a virus. The options found here are the following:

•	Selected Alerts: in this section you can choose the types of warnings to be generated. You can choose to generate warnings characteristic of NetWare networks, or to send an electronic mail message in SMTP format.

•	NetWare Network: if you have chosen to send a message through the NetWare network, you must indicate the recipient to whom you want the message to go as well as the message itself. As an additional feature, the possibility is offered of easily indicating that the message is to be transmitted to the network administrator, to the user of the file in which a virus has been detected, to the server console or to all the network users.

•	SMTP: if you have chosen to send an electronic mail message, you will have to indicate the server through which the message is to be sent, the recipient’s address, the subject of the message and the message itself.


On-demand scan configuration in Novell NetWare servers

From Panda Administrator you can scan any volume of the Novell NetWare server or any directory or file in one of the server volumes. Each time a scan is performed on demand, you can choose the configuration of that scan but you can also indicate a default configuration. The configuration options are as follows:

General options:

•	Scan compressed files: if you mark this option, all compressed files found will be scanned.

•	Generate report: if you check this option, a report will be generated which will reflect the activity carried out by the antivirus software.

If a virus is found:

•	Ignore: if this option is checked and a virus is found, the antivirus will notify you of the discovery, but will take no further action.

•	Disinfect: if this option is checked and a virus is found, the antivirus will attempt to disinfect the infected file.

•	Rename: if this option is checked and a virus is found, the antivirus will rename the infected file.

•	Delete: if you mark this option and a virus is discovered, the antivirus will erase the infected file.

•	Move to: if this option is checked and a virus is found, the antivirus will move the infected file to a location which you have indicated in the dialog box provided for that purpose. A button next to this box allows you to easily choose a directory.

If disinfection is not possible:

•	Rename file: if this option is checked and the antivirus has not been able to disinfect a contaminated file, this file will be renamed.

•	Delete file: if this option is checked and the antivirus has not been able to disinfect a contaminated file, this file will be erased.

•	Ignore: if this option is checked and a virus that cannot be disinfected is found, the antivirus will notify the user of the situation but will not carry out any further action.

In addition to the options mentioned above, the configuration of on-demand protection has three buttons which enable you to configure exclusions, extensions and notifications.

EXCLUSIONS configuration.

EXTENSIONS configuration.

Alerts configuration (NOTIFY...)


Scan Job Report Configuration in Novell NetWare Servers

All scan jobs performed can store certain information about scan job related incidents. This type of data or information can be configured to suit user's needs. The options available are:

•	Record system events: if this option is marked, all system events will be recorded in the report generated by the antivirus.

•	Errors: by marking this option, you can order the errors that occur to be recorded in the report produced by the antivirus for later consultation.

•	Notification messages: checking this option indicates that you want notifications to be recorded in the report generated by the antivirus.

•	Maximum size: you can set a maximum size for the report generated by the antivirus in order to avoid letting the report take up too much hard disk space.


Add/Create a New Scan Job in Novell NetWare Servers

By clicking on the Add button in the scan job window, a new scan job can be created in the Novell NetWare server selected. Then, a wizard will appear to facilitate the creation of a new scan job. This wizard includes the following steps:

1.- Type of scan job

Two types of scan jobs can be created: immediate or scheduled. The former is carried out the moment it is created. The latter allows you to establish a scanning “calendar” so that scan jobs can be executed periodically.

2.- Scan paths

You must indicate the areas of the server that will be scanned. The areas that have a checkmark on their left will be scanned. The All button allows you to easily indicate that the entire server should be scanned. It is only possible to carry out Journaling with Windows NT or Windows 2000 servers  (only scanning new files or files which have been modified since the last scan).

3.- Job configuration

Allows you to specify the general scan options, the action to take when a virus is detected, the extensions to scan, possible exclusions (areas that should not be scanned) and the warnings that will be generated when a virus is detected.

4.- Scheduling

In the case of scheduled scans, a calendar for the scan job is established. If in the first step you chose to create a scheduled scan, you can now indicate when this scan job should be executed. You must indicate the start date and time and the frequency with which the scan job will be carried out. It is highly recommended that you name each scan job in order to easily identify it in the future.

•	Description: it is advisable to assign a name to each job so that it can be easily identified later.

•	Start date: indicates the date on which the scan will begin. Next to the date, the scan start time is also indicated.

•	Frequency: you can indicate a weekly, monthly or even a combined weekly and monthly frequency. Thus, you can schedule a given job for each Monday and Friday, the 10th and 20th of each month or any other combination.

•	CPU load: here you assign a priority to the scan job. If you indicate a high CPU load, the scan job will be executed with a high priority. If you indicate a low CPU load, the job will be performed with a low priority.

•	Abort at: thanks to this option, you can cancel a scan job if it is not completed by a certain time.

•	End date: to complete the scheduling of jobs, you can also indicate an end date for the scheduled job. The job will thus remain in effect only between the two dates you indicate.

•	Status: allows you to indicate the status of the scan job in case you wish to deactivate it temporarily. Jobs in inactive status will not be executed again until their status has been changed to active again.

5.- Summary

In this last step, a summary of the information you have provided is shown. If you decide to continue, the scan job will be created.


Remove a Scan Job in Novell NetWare Servers

The list which appears in the Job Monitor, shows every scan job created, although at the time they are not being run. (For example, scheduled scans). It is possible to work on any job in this list. By clicking on the Remove button, the scan job selected in the list in the job monitor can be deleted.

Any scan job can be delete, whether it is scheduled or immediate. It does not matter if this scan job is running or not, it can always be deleted. However, the permanent protection scan can never be deleted.


Edit or Modify a Scan Job in Novell NetWare servers

The scan job monitor also allows you to modify the properties of the scan jobs selected in the list. This can be done by selecting a scan job and clicking on the Modify button. It is possible to edit and modify any scan job created, whether it is running or not.


Scan Job Reports for Novell NetWare Servers

Through the job monitor, it is also possible to view a report on the status and on the incidents in the scan job selected. By clicking on the Report button you can obtain data on the scan job in progress (or those which have finished) in a given Novell server.


Monitoring a Scan Job in Novell NetWare Servers

In the same way as it is possible to display information on a report generated by the antivirus after performing a scan job, it is also possible to view the status of the scan job in progress.

By clicking on the Monitor button in the Scan Job Monitor dialog box. A monitoring dialog box on the scan job selected will appear. This displays information on the scan job: (files scanned, viruses detected, information on the file being scanned,… etc). From the monitor it is possible to see the report, temporarily stop the scan job and cancel it.


Stop and Abort a Scan Job in a Novell NetWare Server

From the Job Monitor it is possible to stop or cancel a scan job in progress. By clicking on the Stop button the scan job selected will be temporarily stopped. To resume the scan job, click on the same button, which will have changed to Continue.

By clicking on the Abort button, a scan job in progress can be stopped or cancelled. However, this scan job will not be deleted from the scan job list. On aborting a scan job in the list it is not deleted (this would be removing the scan job). The difference is that the scan job will still appear in the list in the monitor as a finished scan job. If one of these finished scan jobs is selected, the Abort button will change to Run. By clicking on this button the scan job mentioned earlier will be executed.


Introduction to Panda Antivirus for Exchange Servers

Nowadays, due to the many advantages offered, an ever-increasing amount of work is being done through networks, especially for the sending and receiving of documentation and files. This sending of information is generally done by means of electronic mail. When working with e-mail, it is necessary to use some element capable of temporarily storing messages, sending them to their destination, and managing the system. This function is carried out by e-mail servers.

When we speak of Exchange Client, we are referring to mail system workstations that work independently. On the other hand, when we mention Exchange Server, we refer to the servers that make possible the connection between different clients or workstations and the mail system, both between the stations themselves and with other systems and servers.

Problems begin to emerge when e-mailed messages contain attached files that are infected by computer viruses. The problem is actually twofold, as it is not only possible to receive potentially infected messages, but also to distribute them throughout the entire network by forwarding the information to other users. This is what makes it necessary to create an antivirus specifically designed for each mail system that not only controls the messages from workstations, but which is also capable of scanning the server itself.

Panda Software provides two highly efficient tools for the protection against and disinfection of viruses that come in through electronic mail. Infections do not, of course, always originate in the server. On the contrary, the workstations connected to these will play an important part. For this reason, Panda Software has developed two products that are similar in principal but different in practice:

•	Panda Antivirus Exchange Client: protects the workstations of an Exchange e-mail or messaging system.

•	Panda Antivirus Exchange Server: protects the servers of an Exchange e-mail or messaging system.

This Help system describes the working of Panda Antivirus Exchange Server, which covers the need to incorporate the possibility of scanning mail messages in the server. The characteristics an antivirus designed for any type of mail server should possess can be summed up in the following points:

•	Totally automatic scanning of all messages immediately upon their reception.

•	Automatic scanning of all messages you attempt to send. This way, you prevent the possibility of sending virus-infected messages and thereby spreading the infection to other users.

•	Automatic scanning of all messages saved.

•	Scanning of all mail messages at any time upon user request.

•	Integration with the network administration program, Panda Administrator in this case.

•	Capacity to scan compressed files.

•	Capacity to scan nested messages (messages located within other messages).

•	Protection of all folders, mailboxes and public folders.

You can consult other topics related to e-mail and Exchange server protection in the following sections: infection via e-mail. Protection capacity in Exchange servers.

Infection via e-mail

Protection capacity in Exchange servers


Infection Via E-mail

By working in a mail system in which potentially infected information is shared, sent and received, we run the risk not only of becoming infected, but also of infecting the other workstations and servers that make up the system, which, needless to say, is even more dangerous. Therefore, we should all be fully aware of how we can infect and become infected through the use of electronic mail:

•	Other networked workstations: the server may be infected by sending messages to or receiving them from any of the workstations connected to the Exchange mail system.

•	Floppy disks and other storage devices: floppy disks may be used to transport and subsequently introduce files into the network. These files may then be attached to a message and sent to other users, thus spreading the infection to the server and the entire computer installation.

•	Connections to other networks: risk of infection is run when sending messages to or receiving them from other external networks or e-mail systems with lower levels of security. By handling information from them, you could easily infect your mail server.

•	Internet: the possibility of accessing messages through the Internet allows users to handle messages that do not first go through the mail server. This means that you could become infected and subsequently infect your mail server and the entire mail system.


Description of Panda Administrator for Exchange Servers

Panda Antivirus for Exchange Server is made up of two important sections or divisions. On one hand, you have what is known as the service, and on the other, the program that manages the servers and workstations. The following is a brief description of these two different parts:

•	Service: Panda Antivirus for Exchange Server is the service that scans and provides protection against virus infection by means of an internal process. It is installed on the server and does not have a user interface which you can work on directly.

•	Panda Administrator: without this, you cannot work with the antivirus. This is what permits the administrator to manage Exchange servers (among others). It is an application from which you can manage the entire working of any type of network. Panda Administrator is the direct support that permits the correct functioning and use of Panda Antivirus Exchange Server, making it possible for the antivirus to access any workstation or server connected to the Exchange system and therefore avoiding all tasks that are not strictly related to the function of an antivirus. The network administrator will be responsible for using this tool for network maintenance tasks. From here, they will be able to manage everything related to the Exchange mail system, as well as execute scan jobs.

When Panda Antivirus for Exchange servers has been installed (from Panda Administrator), in an Exchange server, a variety of operations can be carried out (configure the antivirus, execute a scan, monitor the status of scans in progress, access and update reports generated by the antivirus). For more information, it is advisable to read the following section: Operations with Panda Antivirus for Exchange servers

Each of these two parts performs specific functions within the overall make-up of the antivirus.

Service functions (Panda Antivirus for Exchange Server)

As already mentioned, this is responsible for protection and scanning. Thanks to its permanent protection feature, Panda Antivirus Exchange Server constantly intercepts all events and notifications produced by the system. This way, as soon as a notification is produced concerning actions performed on the local server folders and mailboxes, the antivirus will be ready to scan and protect all the items in question.

Another important function of the Panda Antivirus Exchange Server service is on-demand scanning. The on-demand scanning feature can be broken down into two types: those created by the user to be carried out immediately, and those that are scheduled to be executed at a specified time.

Panda Administrator functions

Panda Administrator's main task is to guarantee correct network functioning and to ensure that the antivirus is not left to perform non-related tasks. It is designed to permit users to use, manage, and administer the antivirus remotely or locally. This means that from this module it will be possible to install the antivirus, create scan processes, view the status of scans in progress, configure protection, update the antivirus using the different methods available, and even uninstall the antivirus from a specific server or servers. Panda Administrator must be installed on a server or any other computer that has Windows NT installed.

Therefore, it should be taken into account that these two modules that make up Panda Antivirus Exchange Server must always work as a whole. For the efficient protection of Exchange servers, the use of only one part of the whole makes no sense whatsoever. While the service module (the antivirus) is responsible for protection as such, it is the Panda Administrator module that manages the system's resources and capacities, and only through its use is it possible to make full use of the antivirus.

Note: when working from Panda Administrator, all connections controlled by Panda Antivirus Exchange Server will display a bear icon. This icon may appear in one of three possible colors that indicate the antivirus status: gray icon (the antivirus is disabled), green icon (the antivirus is enabled), or red icon (the antivirus is enabled and has detected a virus).


Protection Capacity in Exchange Servers

As far as protection capacity is concerned, Panda Antivirus Exchange Server offers the possibility of protecting numerous different parts of the mail system:

•	Public folders: these are located in the server and may be used by all users to store messages, although not all will have the same access privileges.

•	Mailboxes or Private folders: a mailbox is a collection of private folders located on the server, where each user has a folder to which only he/she has access.

•	Personal folders: this folder type is not located in the server, but rather on each user's hard drive. As they are not in the server, in order to protect these folders it will be necessary to install Panda Antivirus Exchange Client on the workstations.

•	Attached files: these are files that are sent together with messages, attached to or included within them, but which do not form part of the message itself.

•	Nested message: this is a message that is included inside another complete message in the form of an attachment.

•	Embedded object: these are OLE objects that are embedded, rather than attached, in the message and are seen as they actually appear rather than as icons.

•	Workstations: it is essential to protect workstations as these are points through which it is possible to infect and be infected by sending and receiving e-mail messages through both internal and external mail systems. The work of the antivirus in this case will be to perform scans that control incoming and outgoing information to and from the workstations.

•	Servers: protection will also cover the mail servers that form part of the network to prevent infections from spreading to connected workstations.

While the protection of Exchange mail service clients is absolutely necessary, it is also of vital importance that the servers be adequately protected. The following are just some of the benefits offered by Panda Antivirus Exchange Server:

•	Centralized scanning, detection and protection.

•	Possibility of scanning messages before being sent and upon modifying.

•	Prevents the spreading of viruses from the server to the mail system.

•	Scans messages sent to the server from connected workstations or external networks.

•	Prevents the overloading of the server by scanning mailboxes when the server is less busy, and in an organized manner by not scanning all at the same time.


Panda Antivirus Exchange Server Operations

Once the antivirus is installed, a number of operations can be performed, including the following:

•	Configure: it is possible to select the mode you want the antivirus to work in, indicating how and where you want to search for viruses, when the scan should be activated and under what circumstances warning messages should be sent.

•	Scan: permits you to carry out scans in search of viruses, indicating what should be scanned on the server. In addition, you will be able to choose exactly what parts of these you want scanned. As far as the scanning action is concerned, there is just one type, which can be executed in three different ways:

•	Immediate: this type of scan job is run immediately upon creation.

•	Scheduled: it is possible to create a scan job that need not be executed at that very moment, but rather at some other specified time. This job type can be scheduled to be executed repeatedly.

•	Permanent: the antivirus will be constantly enabled in memory, thereby automatically scanning, detecting and disinfecting viruses, if configured to do so, without user intervention.

•	Monitor: this permits you to view information on the status of the scans in progress as well as those already finished or yet to be performed.

•	Reports and warnings: report files of completed scan processes can be looked up and also warning messages which notify us of any possible infection to any one person or address specified.

•	Update: it is possible to perform periodic updates of the virus signature file and the entire antivirus. This guarantees that the antivirus will always be capable of detecting even the latest viruses.


How to Uninstall the Antivirus in Network Exchange Servers

By uninstallation, we mean that from the computer on which Panda Administrator is installed, it is possible to remove Panda Antivirus Exchange Server from the selected servers in such a way that neither antivirus protection nor the program itself will be available.

As with installation, the uninstallation process is extremely simple, consisting of the following steps:

1.	Select the server(s) you wish to uninstall the antivirus from.

2.	Click the Uninstall button located in the Panda Administrator toolbar.

Note: Deinstallation cannot be carried out until the main process of the antivirus has finalized (after the completion of all other processes) as with this the correct deinstallation of the antivirus is insured.


Configuration of Permanent Scan Jobs in Exchange Servers

The permanent protection feature is responsible for monitoring all message-related operations performed on the Exchange server, including creations (incoming and outgoing messages) and modifications. To access the configuration section, click on the Configure button in the toolbar.

What this feature does is detect viruses when messages are opened, modified or created (among which is included the copying of messages). This means that every time a message is opened for the first time, every time an existing message is modified or whenever a new message is created, Panda Antivirus Exchange Server will automatically scan them. As this scan is performed continuously and is of such importance, it has priority over all other scan jobs executed, whether immediate or scheduled.

General Options:

•	Enabled: checking this option will activate the permanent protection.

•	Opening-Modification: by checking this option, all unread messages that are opened will be scanned, as well as those that are modified or saved.

•	Creation: by checking this option, the permanent protection will also scan all new messages upon creation.

•	Generate report: by checking this box, a report will be generated that you can subsequently consult, and which will contain details on the scans in which viruses were found.

•	Scan compressed files: this option indicates that all compressed archives found within messages will be scanned in order to search for viruses in each of the files they contain.

•	Scan nested messages: by checking this option, not only first-level messages will be scanned, but also those that are located within other messages in the form of an attachment. There is no limit to the nesting level permitted.

If a virus is found:

•	Ignore: if this option is checked and a virus is detected in a message, you will be notified but no other action will be taken.

•	Disinfect: if this option is checked and a virus is detected in a message, the antivirus will attempt to disinfect the virus in question.

•	Rename: when this option is selected and a virus is detected, the antivirus will change the extension of all infected items found to .VIR.

•	Delete: this option indicates that all infected messages detected will be deleted.

•	Move to...: if this option is selected and a virus is detected, the infected message will be moved to another location, which may be a directory or an e-mail address.

If disinfection is not possible:

•	Rename: if this option is checked and a virus is found that cannot be detected, the antivirus will change the extension of the infected item to .VIR.

•	Delete: if this option is checked and a virus is found that cannot be detected, the infected item will be deleted.

•	Move to...: if this option is checked and a virus is found that cannot be detected, the infected message will be moved to a specified directory or e-mail address.

Configuration of Extensions

Configuration of Notifications


Configuration of On-demand/Programmed Scan Jobs in Exchange Servers

On-demand scans are carried out at specific times when the user wishes to check the status of a folder, a group of messages or individual messages. The difference between on-demand protection and permanent protection is that the latter is continuously intercepting and scanning messages that are sent and received, whereas on-demand protection is only enabled at certain times.

As far as scheduled protection is concerned, you will need to indicate a specific date, day or period of time during which the antivirus will automatically scan, detect and disinfect viruses if configured to do so.

General Options:

•	Generate report: if you enable this option, a report will be created detailing the incidents that appear in the event of a virus being detected.

•	Scan compressed files: if you select this option, all compressed files attached to a message will be scanned.

•	Scan nested messages: by selecting this option, all messages found within other messages will be scanned.

If a virus is found:

•	Ignore: if this option is checked and a virus is detected in a message, you will be notified but no other action will be taken.

•	Disinfect: if this option is checked and a virus is detected in a message, the antivirus will attempt to disinfect the virus in question.

•	Rename: when this option is selected and a virus is detected, the antivirus will change the extension of all infected items found to .VIR.

•	Delete: this option indicates that all infected messages detected will be deleted.

•	Move to...: if this option is selected and a virus is detected, the infected message will be moved to another location, which may be a directory or an e-mail address.

Configuration of EXTENSIONS

Configuration of NOTIFICATIONS


Configuration of Extensions

To access the configuration of extensions option, just click on the Extensions button. Once you have done this, a window will appear in which you can indicate the extensions or file types of items found in messages that you want scanned.

•	Scan all extensions: if this option is checked, the antivirus will scan all files attached to messages. No other option selected in this section will affect this action.

•	New extension: this option is used to add new extensions to the list. Having entered or selected the extension you want to add, click on the ≥ button, and the extension will automatically be added to the list.

•	Remove extension: as opposed to the previous action, this option serves to delete an extension from the list. To do this, select an extension from the list and click on the ≤ button. The extension in question will immediately disappear from the list of extensions.

•	Default ext.: by pressing this button, the list will once again contain the same extensions as when the antivirus was first installed. In other words, it will return to its original status.

•	Clear: this will remove all extensions from the list and leave it completely empty.


Configuration of Notifications

As we have already seen, Panda Antivirus Exchange Server will present us with a final report of the processes it has carried out, or is still carrying out, so as to leave a clear account of its activities and results. In addition, it is possible to instruct it to send messages on specific occasions to notify certain users of the possible detection of a virus and of the activities carried out by the antivirus.

The persons to whom it is possible to send mail system messages are the following:

•	Sender: if somebody sends an infected message to the system, the antivirus, once it has intercepted it and detected the virus, will notify this user of the fact that the message he/she has sent contains a virus.

•	Recipients: if somebody receives an infected message, the antivirus, once it has intercepted it and detected the virus, will notify all recipients of the fact that the message they have received contains a virus.

•	Administrator: the administrator will be notified of all viruses detected in messages intercepted and scanned by the antivirus in the Exchange network. This does not mean that the sender and recipient should not also be informed of the incident.

As for the types of warnings that can be sent to the administrator through the network or Exchange server, the following possibilities are offered in the window that is displayed when configuring the notifications:

•	Alerts selected: through this tab you will be able to consult which types of alerts or warnings are enabled at any particular time. Likewise, you can enable or disable each type of alert by checking their respective boxes: Microsoft Network, SMTP (Internet mail) or Microsoft Exchange. To configure each of these alert types, the following tabs can be accessed.

•	Microsoft Network: upon selecting this tab for the sending of a warning message through a Microsoft network, you will be asked to indicate the destination (computer or domain) you want to send the message to.

•	SMTP (e-mail): when you indicate that the message is to be sent via e-mail, it will be necessary to specify the SMTP server used to send the notifications through the network, the address you want the warning message sent to, and the message itself.

•	MS Exchange: in this case, the Exchange network itself will be used to send the notification. Within this tab there are a number of other sections:

•	Profile: this is where you can specify the Exchange mail server profile that will be used to send the notifications.

•	Address: this is the destination address you want the warning message to be sent to.

•	Type: you will have to select from a list of protocols the one that should be used to send the notifications (Display Name, Exchange, X400, SMTP, CC:Mail and Microsoft Mail).


Configuration of Reports in Exchange Servers

The antivirus is capable of generating a report file in which it will store information on the incidents related to the scan jobs it has performed. These reports provide clear and concise information on all the operations the antivirus has carried out and on those still in progress. This will enable you to see at a glance the status of any scan process in progress, those that have already finished and those that are scheduled to be executed at a specific time in the future. They will also inform you of whether viruses have been detected and how many.

In the configuration section for the notification messages, you can select any of the following characteristics:

•	Incidents to be logged in the report:

•	System events: information will be displayed on the actions carried out by the system.

•	Errors: information will be given on the possible errors that may have occurred during the detection process.

•	Notification message: this is the text that will be displayed in the event of virus detection.

•	Maximum report size: this will permit you to indicate the maximum size of the report file containing the information generated from the results of the scans performed.


How to Carry out a Scan Job in a Network Exchange Server

With Panda Antivirus Exchange Server it is possible to create, modify and monitor scan jobs of different types:

•	Immediate: these are executed as soon as they are created.

•	Scheduled: it is possible to create a scan job that need not be executed immediately upon creation, but rather at some other specified time.

•	Permanent: the antivirus will be constantly enabled in memory, thereby automatically scanning, detecting and disinfecting viruses, if configured to do so, without user intervention.

To access the scanning section, just click on the Scan button in the Panda Administrator toolbar. A window will appear containing a list of the scan jobs that are defined at the time. Some of these may be in progress (permanent and/or immediate scans), while others will be waiting for a specific date and time before being executed (scheduled scans).

This list is found in what is known as the Job Monitor. It is divided into columns and provides information on the type of scan involved (permanent, immediate or scheduled), the number of viruses detected, its current status (whether it is in progress or not) and when the scan in question will be executed next.

The column of buttons to the right permits you to work with the scans by creating, modifying, deleting, etc. All of these options may be performed on any of the scans except one: you can never remove the permanent scan. This option will, of course, be possible with any immediate or scheduled scan.

Adding or creating an Immediate and/or Scheduled scan

Removing a scan

Editing and modifying a scan

Presentation of scan reports

Monitoring of the scan status

Pausing or aborting a scan


Adding or Creating an Immediate and/or Scheduled Scan (Exchange Servers)

With a wizard to guide you through the entire creation process, select the options you require for the scan in question, which may be either immediate or scheduled. For either of the two scan types, you can select one or more accounts through which it will be possible to scan their corresponding folders and subfolders.

Note: as the steps to be taken in each of the two scan creation processes (immediate and scheduled) are almost identical, this section will only deal with the steps that are common to both scan types. The only difference in the creation process for the two scan types is the scheduling section detailed in step 4, for which a separate reference is included.

Steps for the creation of an Immediate and/or Scheduled scan

1.	Select the type of scan job desired (Immediate or Scheduled) and then click the Next button. You will then be able to specify when you want to perform the selected scan, which may be at the time of creation (Immediate) or at a later time (Scheduled).

2.	Scan paths: this is where you can indicate the mailboxes you wish to scan. Mailboxes are items that contain folders, and it is therefore recommended that you select them, for everything they include will be also scanned. You can also select public folders. It is only possible to carry out Journaling with Windows NT or Windows 2000 servers  (only scanning new files or files which have been modified since the last scan).

3.	Job Configuration: in this step of the creation process, you can choose the characteristics you want to assign to the scan job in question, the types of messages you want scanned and the actions to be taken if a virus is detected or if one cannot be disinfected:

General options:

•	Generate report: if this option is selected, information corresponding to the scan will be saved in a report file once the scan has been completed.

•	Scan compressed files: by checking this option, the antivirus will scan messages in compressed formats or those containing compressed attached files.

•	Scan nested messages: if you select this option, messages containing other nested messages will be scanned.

If disinfection is not possible: this is where you can specify the actions to take in case disinfection is not possible.

•	Rename file: by choosing this option, the name of the infected message will be changed.

•	Delete file: if you choose the Delete option, the infected file or message will be deleted.

•	Move to: enabling this option allows you to move the infected message to another hard drive directory or Internet address.

If a virus is found: here, you can choose the actions the antivirus is to take when a virus is detected.

•	Ignore: if you select this option, the virus will be detected but no action will be taken.

•	Disinfect: when this option is chosen, the virus detected will be removed.

•	Rename: by enabling this option, the name of the infected file will be changed.

•	Delete: when this option is chosen, the infected file will be deleted.

•	Move to: this option moves the infected file to another folder or Internet address.

Extensions: this button takes you to a section that allows you to specify the types of files that will be scanned. For more information on this topic, we recommend that you read the Configuration of Extensions section.

Notify...: this determines who will be warned when a virus is detected (the sender, the recipients or the administrator). For more information on this topic, we suggest you consult the Configuration of Notifications section.

4.	Only if a scheduled scan has been selected  (in the first step of this wizard), will a file be displayed which allows you to set every characteristic of this type of scan.

5.	Scan summary: a summary will be displayed on the screen, indicating the name of the immediate scan job. By clicking on the Finish button, the scan process created will begin immediately.


Delete Scan Jobs in Exchange Servers

This permits you to remove a scan from the Job Monitor list. We must highlight that you can only remove immediate or scheduled scans. A permanent scan can never be removed from the list, for then the antivirus would not constantly intercept and control all system events, and would therefore not guarantee the integrity and security of the Exchange mail system.

To remove one of the remaining scan jobs (non-permanent) from the scan job list, you must first select it. Once this has been done, you need only click the Remove button and the scan job will automatically disappear from the list, and will therefore not be executed.


Editing and Modifiying a Scan

A created scan job may be in the process of being carried out or pending a certain date and time for its execution. In addition to generating new scan jobs, you can also edit them once they have been created, thereby permitting you to change some of their characteristics. It would be like accessing a record on which all of the scan properties appear. This record is not just for consultation purposes, but rather you can modify the scanning characteristics as if you were creating the scan.

To do this, you need only select the desired scan from the Scan job list and then click on the Edit button. A dialog box will then appear, in which you can select any of the scan properties. Once this has been done, accept the changes and the characteristics will be modified. When it is time to perform the scan job, whether it is an immediate or scheduled scan, the actions will be carried out in accordance with the modified configuration.


Presentation of Scan Job Reports with Panda Antivirus Exchange Server

Panda Antivirus Exchange Server offers you the possibility of creating a report file in which the activities of each scan performed are summarized. This report will be saved in a file that can be assigned a maximum size. This information is very useful, as it lets you see the work that has been carried out, the date and time the scan was performed and the results obtained.

The information shown is listed in columns. The first column details the date and time the detection was made, and the second indicates the name of the virus detected. If you need a hard copy of this information, just click on the Print button. On the other hand, when you have finished viewing the information, you need only click the Seen button to close the window and return to the application. You are also offered the possibility of deleting the report. To do this, just click on the Delete button. With this, you will delete the entire report containing all the scan activity data.

The information that appears in this report window is only a summary of the complete data available. By double clicking on any of the listed scans, the following additional information will be provided:

•	Date and time: this shows the date and time that the detection occurred.

•	File: this is the name of the infected file in which the virus has been detected.

•	Contained in: if the infected file was contained with a compressed file (ZIP), in this section the name of the ZIP file in question will appear.

•	Name of virus: this field shows the name of the virus detected.

•	Folder: indicates where the infected file was found (mailbox, folder).

•	Subject: this shows the subject filed of the infected message.

•	Date: displays the date the message was created.

•	Operation performed: presents the action carried out by the antivirus.

To conclude this section, it is worth noting that there only exists one results report. Some users may confuse the information obtained by clicking on the Monitor button, located in the Job Monitor window, for a report, when this is in fact only a presentation of the properties and activities of the scan job in progress. For more information on this topic, please read the Monitoring of the scan status section.


Monitoring of the Scan Status

Monitoring is yet another means of obtaining information on the evolution of a scan in progress or on one that has already been completed. Clicking on the Monitor button in the Job Monitor displays a window that details information regarding the scan job selected from the list.

The total number of messages scanned up to the moment will be shown, and the program will indicate how many of these are infected and whether they have been disinfected, renamed, deleted or moved.

In addition, a section will appear that offers information on the item being scanned. In other words, you can view the current activity area of the antivirus. You are also provided with information detailing the folder and mailbox where the scan is being carried out as well as the message being scanned.

Lastly, it should be noted that besides viewing specific scan information, in this window you can also pause the scan process momentarily, after which you can resume the operation, or abort the scanning activity.


Pausing or Aborting a Scan

Another characteristic you are offered is the possibility of pausing or aborting the scan whenever you require. For this, two similar, although in practice very different, concepts are used. The first option, Pause, temporarily stops the scan in progress. This does not mean that the process will be permanently cancelled, for you can subsequently resume the operation.

On the other hand, when we refer to aborting a scan in progress, this means that it will be permanently cancelled. You will not be able to resume scanning, and if you need to run the scan again, you will have to do so from the very beginning.


What to Update and how to Update Panda Antivirus Exchange Server?

Note: we are currently working on a much more technologically advanced and easy-to-use method for the upgrading of the entire antivirus. This will be added to the update option that currently permits the renewal of the virus signature file.

The Updates option permits you to renew both the virus signature file, which contains the information concerning all the viruses detected, and the antivirus program itself. On one hand, this means that you can obtain the latest list of viruses recognized by Panda Antivirus Exchange Server (the virus signature file). On the other, you can also obtain the latest version of the antivirus. Therefore, as an answer to the question “What can be updated?”, it should be said that both the antivirus and the virus signature file can be completely renewed (taking into account the note at the beginning of this section). To perform the update in question, you need only click on the Update button located in the Panda Administrator toolbar.

The virus signature file is called PAV.SIG. When we talk of updating this file, what we really mean is that you can obtain a new and up-to-date copy of it. Carrying out an update does not entail the need to restart the server.

There are three different ways of performing updates (from the Panda Administrator installation directory, through the Internet, or from another location). You can obtain more information in the Where are updates performed from?  section.


Where to Update Panda Antivirus Exchange Server from?

Note: we are currently working on a much more technologically-advanced and easy-to-use method that will allow you to update the product through the Panda Administrator installation directory or from any other location, which means that the only option enabled at the moment is that of updating through the Internet.

Before performing the update, you will first need to have a connection open with the server with administrator privileges. When these conditions are met, you need only click the Update button located in the toolbar and a wizard will then guide you through the entire process.

•	Internet: updates can also be carried out through the Panda Software Web page. By default, the address of this page appears in the Update Address section in the update window. If this option is selected, you will be asked to enter your User name and Password.

If the user uses a proxy to connect to the Internet, before it can actually be done, a checked is done to verify if the user has to be authenticated in the said proxy server.

Note: if you choose to update the antivirus through the Internet, we recommend that you do it first on one of the networked computers, from which you can then update the remaining computers. The reason for this is that the process will be faster this way.

•	Panda Administrator installation directory: updates can be performed using the files found in the directory where Panda Administrator is installed. This feature will be available in the near future. This possibility is not accessible at the moment.

•	Other location: in this case, the update process will request that you specify the location through which the update should be performed. This feature will be available in the near future. This possibility is not accessible at the moment.


Steps for Updating Panda Antivirus Exchange Server

Panda Administrator plays an important role when updating the antivirus, as the update process, as is the case with other processes, is carried out directly from here.

Note: Before beginning the update process, it is advisable that you know from where and under which circumstances you can update the antivirus. For this, we suggest that you read the Where are updates performed from? section.

1.	Once you have selected the computer you want updated, just click on the Update button located in the toolbar.

2.	Select the type of update to perform. You can choose any of the following three options:

•	Update the virus signature file.

•	Update the antivirus and the virus signature file, without subsequently restarting the computer.

•	Update the antivirus and the virus signature file, subsequently restarting the computer.

3.	Select the location from which the necessary files will be copied in order to complete the update process:

•	From the Panda Administrator installation directory.

•	From any of the available drives.

•	From the Internet. In this last case, the address from which you can update will appear, and the program will ask that you enter a User name and Password. In addition, you will also have to indicate whether or not the access will be made through a proxy server.

4.	The files with which the update is to be performed are compared with those that are already installed in order to check that these are newer than the current ones.

5.	The file copy process begins.


Server Information

In the Panda Administrator toolbar, there is a Details button that, when pressed, displays a window containing two tabs, one labeled “Server Information” and the other “Antivirus Information”. This section will cover the Server Information tab.

After selecting this tab, you will see that the information provided is briefer than what the Antivirus Information section offers. You will first be given information on the type of server in question, which will depend on the operating system and/or network installed.

In addition, you will also see the name assigned to the server and its domain, when applicable. Another interesting characteristic is the box that appears in the lower part of the screen. This informs you about the privilege level assigned to you for the server in question.


Antivirus Information

In the Panda Administrator toolbar, there is a Details button that, when pressed, displays a window containing two tabs, one labeled “Server Information” and the other “Antivirus Information”. This section will cover the Antivirus Information tab.

This tab allows you to consult information regarding the antivirus that is installed on your system. Some important characteristics that appear include the antivirus version, summary of scans performed (this details the number of files scanned, infected, renamed, disinfected and deleted), and important information on the status of the virus file (status, total number of detectable viruses and the date the file was created). After you have finished consulting this summary, click the OK button in order to return to the previous window.


Scheduling a Scan

During the creation process of an Immediate and/or Scheduled scan, this is the last step you must take in order to completely define a scheduled scan, and which differentiates it from an Immediate scan.

4.	Scheduling: through this step, the wizard determines the date and frequency with which the scheduled scan should automatically be executed:

•	Description: this specifies the name of the scan, in order to identify it on the list.

•	Start date: this is the date on which the scan job should start to work on the server. You can specify both the date (day, month and year) and the time.

•	CPU Load: this is the level of occupation or system performance that the scan job requires of the server’s CPU, and may be high, low or normal. Depending on the value assigned, higher or lower priority will be given to the scan job. If the CPU load indication is high, the scan job will have priority over other tasks and will take up more system resources. On the other hand, if the workload is low, its priority will be lower than other processes carried out.

•	Frequency: you can define specific periods of time or days on which the scan should always be executed. You can select a certain day of the week or month, or several alternate or consecutive days. To select alternate days, click on the desired days while pressing the CTRL key. On the other hand, to choose a range of consecutive days, just click on the start date and then move the cursor (without letting go of the left mouse button) to the end date.

•	Abort: the antivirus is capable of automatically concluding the scan at a given time without user intervention.

•	Validity: this determines the date the scan job will be permanently removed. This is a way of indicating the validity period of the scan job in question. After this date, the scan job will disappear from the list of scheduled jobs pending execution.


How to Install the Antivirus for Network Exchange Servers

When installing Panda Antivirus Exchange Server, keep in mind that the following conditions must be met:

•	Pentium 133 Mhz or superior processor.

•	128 Mb of RAM memory.

•	256 Mb of free space on the hard disk.

•	You must have a Windows NT 4.0 (or higher) and Service Pack 5 or higher, or Windows 2000, computer and have Exchange Server 5.x installed with Service Pack 3.

•	You should also have the Exchange mail reader installed on the Exchange Server computer and have the service enabled.

•	Install the antivirus using the Exchange Server service administrator account.

•	The administrator account must belong to the group of administrators of the domain that includes the NT server where the Exchange Server is installed.

•	Exchange Server must have at least one mailbox and one public folder created.

The installation of the antivirus can only be performed on available Exchange servers. This process should be carried out exclusively through Panda Administrator, which must be previously installed. The antivirus can never be installed without Panda Administrator.

Initial Installation Conditions

•	The first step prior to the installation of the Exchange server antivirus is to have Panda Administrator installed on a computer working under Windows NT.

•	In addition, you will need to have a connection open with administrator privileges for the server on which you wish to install the antivirus.

Therefore, the process of installing the antivirus on a server will be performed through Panda Administrator following the steps below:

1.	Select the server(s) on which you wish to install Panda Antivirus Exchange Server.

2.	Press the Install button located in the Panda Administrator toolbar. The file copy process will begin immediately, and once this has finished, the installation of the antivirus on the selected server(s) will have concluded.

Note: it should be noted that once the Panda Antivirus Exchange Server installation process is complete, you are not required to restart the server or even pause any Exchange services. If you were to do this, the server would take some time to reboot.


How to Configure the Antivirus for Network Exchange Servers

Panda Antivirus Exchange Server allows you to configure any scan job it can carry out. These types of protection can be permanent (where the antivirus continually scans server operations), On-demand (when a job is defined scan it begins immediately), or programmed (the scan job begins at a predetermined date and time).

It is also possible to configure the warnings that the antivirus must show if it detects a virus. They can be sent to different destinations and from different origins. Furthermore, it is also possible to define how they will be sent (Microsoft Network, SMTP, Ms Exchange).

Data that should be displayed in scan job reports can also be configured.

More information can be found in the following help sections:

Configuration of  On-demand/Programmed scan jobs in Exchange servers.

Configuration of permanent scan jobs in Exchange servers.

Configuration of reports.


How to Update the Antivirus in Network Exchange Servers

The antivirus updates for Exchange servers you will need to have a connection open with the server from which you want to carry out the update job. This connection must have administrator privileges.

The antivirus updates on Exchange servers have certain special features that are worth highlighting:

•	It is possible to update both the virus Signature File (it updates the file that allows the antivirus to detect viruses; the antivirus will be able to detect a larger number of viruses) and the antivirus program itslef (the antivirus will have new scanning capablilities incorporated into it).

•	Updates can be either immediate (carried out as soon as it is created) or scheduled (carried out on a given date/time, or frequency).

•	It is possible to indicate the source from which the update files will be copied: from a specific Panda Administrator directory, from the Internet (Panda Software web page), or from the server updates folder.

•	It is possible to carry out certain actions related to updates. This is the reason why they are considered to be update jobs. It is possible to save, edit, create and remove update jobs. The fact that update jobs can be stored or edited makes it possible to save the update settings for future occasions. This makes it possible to create new update jobs, modify already existing jobs and use them to create new jobs and eliminate them from the list of jobs .

To carry out any of the update operations, it is necessary to follow certain common steps as follows:

1.	You will need to have a connection open with the server from which you want to carry out the update job. This connection must have administrator privileges. If it is already open before executing Panda Administrator, it will be automatically recognized. If it is not, it can be opened from Panda Administrator.

2.	From the Panda Administrator window, select the server from which you want to carry out an update job.

3.	Click on the Update button, in the toolbar.

4.	Select the Update Mode. There are  two options: Basic Updates or Advanced Updates. From this point on, it will be possible to select all the actions related to update jobs.


Basic Updates on Exchange Servers

With basic updates, only one server can be selected at a time. After selecting basic update mode, click on the Next button. This allows you to select the characteristics of the update job and will guide you through the update process.

1.	Select type of programming:

•	Immediate. Is carried out as soon as it is created.

•	Scheduled. Is carried out on a given date/time, or frequency

2.	When using scheduled updates, the characteristics must be set: Description (write the name you want to assign to the update job) and Time (indicate the time that the scheduled update must begin). There are two  types of scheduled updates:

•	Date: It will be carried out on a given date and at a given time. By clicking on the Next button, the Date of the update can be set.

•	Frequency: It will be carried out at regular intervals. By clicking on the Next button, you can set the frequency with which the job should be carried out: Weekly (any day of the week can be selected) or on a certain Day of the month.

3.	Select the items to be updated:

•	Update only the Signature File (PAV.SIG): only the file that allows the viruses to be detected will be updated (Update).

•	Update antivirus motor: updates the Signature File and the antivirus program itself (Upgrade).

It is advisable to carry out the updates (immediate or scheduled) corresponding to the antivirus motor when the server has less traffic.

4.	The update files can be found in a certain location. If one of them does not exist, a dialog box will appear informing you that the update cannot be carried out (the necessary files do not exist or they are not correct). Indicate from where the update must be carried out (place where the updated files are located):

•	Internet (Panda Software web page): The Virus Signature File will be updated from the Panda Software update web page. In order to do this it is necessary to enter the User name and Password to this update page. Furthermore, if the Internet connection is made through a Proxy server, you must check the box Connect via proxy server. In this case, indicate the corresponding IP Address and the number of the Port used. Before updating the files, it will check that the configuration is correct.

NOTE: the update via Internet is only available for the virus signature file, not for the whole antivirus program. When using scheduled updates, a session must be open with the server.

•	Panda Administrator Directory: the virus signature files and the antivirus files will be updated. They are located in the directory PAVSIG (where Panda Administrator was installed). Firstly, it checks that the update server service is installed correctly. If it is not, it indicates that this service must be installed. If it is, the update begins.

NOTE: the update is carried out through the Panda Administrator directory. Therefore, the computer in which it is installed must be in operation.

5.	By clicking on the Finish button, if it is an immediate update job, the update will begin. If it is a scheduled update job, it will be carried out at the scheduled time.


Advanced Updates on Exchange Servers

After selecting advanced updates mode, click on the Next button. This allows you to select the update characteristics and will guide you through the update process.

Unlike the basic updates system, the advanced allows you to carry out different update jobs, which are the following:

•	New update. Allows you to create a new update job.

•	Consult existing update jobs. Allows you to edit, consult or modify the characteristics of existing update jobs (defined on previous occasions).

•	Delete Update server. Allows you to delete the update server service, which allows update jobs to be defined.


Advanced Update - New Update Job on Exchange Servers

After selecting the server, click on the Update button and check New Update, the steps corresponding to the update job will begin.

1.	Select type of programming:

•	Immediate. Is carried out as soon as it is created.

•	Scheduled. Is carried out on a given date/time or frequency.

2.	When using scheduled updates, the characteristics must be set: Description (write the name you want to assign to the update job) and Time (indicate the time that the update must begin). There are two  types of scheduled updates:

•	Date: It will be carried out on a given date and at a given time. By clicking on the Next button, the Date of the update can be set.

•	Frequency: It will be carried out every so often. By clicking on the Next button, you can set the frequency with which the job should be carried out: Weekly (any day of the week can be selected) or on a certain Day of the month.

3.	Select the items to be updated:

•	Update only the Signature File (PAV.SIG): only the file that allows the viruses to be detected will be updated (Update).

•	Update antivirus motor: updates the Signature File and the antivirus program itself (Upgrade).

4.	The update files can be found in a certain location. Amongst which there is one called UPGRADE.DAT (it contains information on the files that must be updated and their location). If one of them does not exist or is not correct, the update cannot be carried out. Indicate from where the update must be carried out (place where the updated files are located):

•	Internet (Panda Software web page): The Virus Signature File will be updated from the Panda Software update web page. It is possible to select whether the update should be done directly or whether the corresponding files should be copied to a directory for the subsequent update:

•	One connection per server: for every server selected at the start of the process, a new connection to the update web page will be made and the corresponding files will be updated.

•	One connection for all of the servers leaving the information in: only one connection will be made to which the necessary files will be copied. The files, which are collected during the connection, will be saved in the location you indicate.

In either case, it is necessary to enter the User name and Password for accessing the update web page. Furthermore, if the Internet connection is made through a Proxy server, you must check the box Connect via proxy server. In this case enter the corresponding IP Address and the number of the Port used.

•	Panda Administrator Directory: the virus signature files and the antivirus files will be updated. They are located in the directory PAVSIG (where Panda Administrator was installed). Firstly, it checks that the update server service is installed correctly. If it is not, it indicates that this service must be installed. If it is, the update begins.

•	Other Location: it is possible to select any disk drive and directory in which the files, with which the update must be carried out, are located. The location can be selected, using the button which appears on the right. The update source may be located on a CD-ROM (it must be inserted in the CD drive). The following requirements must be met:

•	The disk drive and directory must correspond to a Windows NT server or workstation.

•	It must not be a mapped disk drive.

5.	With advanced updates, after carrying out the necessary configurations, the update job can be saved. To do this, check the corresponding box and name the job. This will not happen with updates scheduled by frequency, as they are always saved by default.

6.	By clicking on the Finish button, if it is an immediate update job, the update will begin. If it is a scheduled update job, it will be carried out at the scheduled time.


Advanced Update - Consult / Edit Existing Update Jobs on Exchange Servers

After selecting the server, click on the Update button and check Consult existing update jobs, the steps corresponding to the that update job will begin.

1.	Select computer/s. Select the computer/s, in which the update jobs you want to consult were saved (those in which the update server is located). Use the button which appears on the right and then click on Next.

2.	All of the existing update jobs in the computer will be displayed, as well as the corresponding data (description or job name, type and next execution).

•	In order to carry out (at that moment) one of the immediate updates in the list, select it and click on the Start button.

•	To access the properties of an update job, select it in the list and click on the Edit button. As well as consulting the properties, they can also be modified. Finally, other computers can be selected (as well as the current), on which the update job must also be carried out. In other words, the list of computers in which the update will be carried out, can be modified at any time (Add or Delete update jobs).

NOTE: the update jobs defined for a given platform cannot be used for other platforms. Furthermore, when an update job is edited, it is then considered as advanced.


Advanced Update - Delete the Update Server on Exchange Servers

Note: when you choose to delete an update server, ALL THE UPDATE JOBS in the computer selected, will be deleted.

To delete the update server from a computer, follow these steps:

1.	Set up a connection with administrator privileges, if one does not already exist, for the server.

2.	From Panda Administrator, select the server.

3.	Click on the Update button, on the toolbar.

4.	Select Advanced update mode.

5.	Select the update job type: Delete the Update server.

By doing this, it will be indicated where the update service is installed. By clicking on the OK button, this service will be deleted. This means that ALL UPDATE JOBS IN THIS FILE SERVER WILL BE DELETED.


Description of Panda Administrator for MS Proxy Servers

Panda Administrator works with Windows NT 4.0 with SP3, or later version. It can also support MS Proxy 2.0 servers, with Internet Information Server (IIS) 3.0 or later version, installed. The objective of Panda Antivirus for MS Proxy servers is to scan files transferred between computers in the local network to Internet and viceversa. To do this, it uses HTTP, FTP protocols and Gopher which go through the Proxy server, scanning HTML pages, applets, ActiveX controls, and scripts which HTML pages may contain, graphics, videos, sound and other types of files. All of these components are always scanned when a computer (which is part of the network) is connected to an Internet server through a protected proxy (in the antivirus installed).

The proxy server antivirus carries out the scan taking into account that two IP addresses should be covered. One of them must belong to any local network computer, and the other, to the external servers to which the proxy connects. Therefore, all files going into or coming out of the network are scanned. Consequently, all the files that coming in and out of the network will be scanned.

The main window of Panda Administrator shows the different servers found. The most commonly used options are located in a button bar in the upper part of the main window.

All of the management of Panda Antivirus for MS Proxy Servers is done through Panda Administrator.

To summarize, Panda Antivirus for MS Proxy servers protects all files that are transferred from the outside, to one of the network computers. It also protects all files that are transferred from one of the network servers.

However, files that are transferred from network workstations to a server outside the network, are not protected (for example: when an FTP operation is used to transfer files from one of the workstations to an Internet server). Other files that are not scanned, are those which are transferred to the network server from an external network workstation.


How to Install the Antivirus in Networked MS Proxy Servers

Note: When installing Panda Antivirus for MS Proxy servers, the following prerequisites must be met:

•	Pentium 133 Mhz, or higher processor.

•	Al least 64 Mb or RAM memory.

•	At least 30 Mb available on the hard disk.

•	Windows NT 4.0 SP3 (or higher SP), or later version must be installed.

•	Internet Information Server (IIS) 3.0, or later version must be available

•	MS Proxy Server 2.0. must be installed

•	The MS Proxy server must be installed and running.

•	the administrator account must have the following rights: “Start a session as a batch job”, “Act as part of the operating system” and “Start up the session as a service”. This allows the antivirus service to function correctly.

Once all of these prerequisites are met, the antivirus installation process can be started. Firstly a connection must be opened, with the server/s in which Panda Antivirus for MS Proxy servers is going to be installed. This connection must have administrator privileges, which can be established before executing Panda Administrator (the program will recognize if a connection was established before it was executed), or from Panda Administrator itself.

Note: Furthermore, the administrator account must have the following rights: “Start a session as a batch job”, “Act as part of the operating system” and “Start up the session as a service”. This allows the antivirus service to function correctly.

After establishing a connection and opening Panda Administrator, choose the Proxy server in which you want to install the antivirus.  Then click on the Install button on the toolbar. The version of the operating system installed in the server will automatically be checked. If it is possible to install the antivirus in this server (as it meets all the requirements), an Installation Wizard will appear, which will guide you through the installation step-by-step:

1.	Select stop and restart, in the MS Proxy server. It is possible to choose if you want the installation process to stop and restart the server automatically on completing installation. After completing the installation, the antivirus only functions when the server is stopped and restarted.

2.	Administrator domain and account. This second installation step requires you to enter the following administrator data: Domain, Account and Password of the computer in which the antivirus is being installed. The field, in which the administrator domain and account must be entered, must have the following format: Domain\Account.

3.	From then on, the operations of the installation itself will begin. They include copying the necessary files, installing the antivirus ISAPI filter, installing the antivirus service,... etc.

Note: If you selected stop and restart in the first step, the MS Proxy server will be restarted, so that the installation of the antivirus will come into effect. Otherwise, remember that the antivirus will only work when this happens.


How to Configure the Antivirus in Networked MS Proxy Servers

The protection or scan included in Panda Antivirus for MS Proxy servers, is defined as permanent or permanent protection. This protection continuously scans transferred files. It can also be known as resident or sentinel.

If necessary, this type of scan can be configured by the administrator. It is also possible to configure the incident reports generated by the antivirus. Files (packets) which are partially transmitted through the server, can also be configured using Panda Antivirus for MS Proxy servers.

If a virus is detected the antivirus can also send alerts, to different recipients and from different senders. You can also choose how they will automatically be sent (Microsoft network, SMTP, MS Exchange, Lotus Notes).

To configure the antivirus in Proxy servers, select it in the Panda Administrator server tree and click on the Configure button on the toolbar. A dialog box will then appear, with the following files:

Permanent Protection in Proxy Servers.

Scan Report Configuration in Proxy Servers.

Configuration of partial transmission of retained files in Proxy Servers.


How to Scan a MS Proxy Server

The scan that the antivirus carries out on the MS Proxy server is based on criteria established prior to configuration, or those which are defined by default. This means that all files sent or received are scanned, taking the following into account:

•	Type of file (extensions). The file may or may not be scanned, depending on its format. In other words, using the list of extensions to be scanned, it is possible to determine which files the antivirus should or should not scan. By default, the antivirus always scans EXE and COM files, as well as those in the list of extensions.

•	MIME type or format (type/subtype). In this case, files may or may not be scanned depending on the MIME type and subtype it belongs to, (text/html, text/html, text/plain,... ). This is defined in the lists of Types Included and Types Excluded.

Panda Antivirus for MS Proxy servers includes a permanent scan which continually scans the system. To access the scans, click on the Scan button on the Panda Administrator toolbar. It is possible to carry out the following operations on the permanent scan:

Permanent scan configuration in Proxy servers.

Presentation of scan reports


How to Update the Antivirus in Networked MS Proxy Servers

The antivirus updates for MS Proxy servers you will need to have a connection open with the server from which you want to carry out the update job. This connection must have administrator privileges.

The antivirus updates on MS Proxy servers have certain special features that are worth highlighting:

•	It is possible to update both the virus Signature File (it updates the file that allows the antivirus to detect viruses; the antivirus will be able to detect a larger number of viruses) and the antivirus program itslef (the antivirus will have new scanning capablilities incorporated into it).

•	Updates can be either immediate (carried out as soon as it is created) or scheduled (carried out on a given date/time, or frequency).

•	It is possible to indicate the source from which the update files will be copied: from a specific Panda Administrator directory, from the Internet (Panda Software web page), or from the server updates folder.

•	It is possible to carry out certain actions related to updates. This is the reason why they are considered to be update jobs. It is possible to save, edit, create and remove update jobs. The fact that update jobs can be stored or edited makes it possible to save the update settings for future occasions. This makes it possible to create new update jobs, modify already existing jobs and use them to create new jobs and eliminate them from the list of jobs .

To carry out any of the update operations, it is necessary to follow certain common steps as follows:

1.	You will need to have a connection open with the server from which you want to carry out the update job. This connection must have administrator privileges. If it is already open before executing Panda Administrator, it will be automatically recognized. If it is not, it can be opened from Panda Administrator.

2.	From the Panda Administrator window, select the server from which you want to carry out an update job.

3.	Click on the Update button, in the toolbar.

4.	Select the Update Mode. There are  two options: Basic Updates or Advanced Updates. From this point on, it will be possible to select all the actions related to update jobs.


How to Uninstall the Antivirus from Networked MS Proxy Servers

To uninstall Panda Antivirus from MS Proxy servers, you will need to have a connection open with the server with administrator privileges.

If that connection is open before executing Panda Administrator, the program will automatically detect it. If it has not been opened previously, it can be opened from Panda Administrator.

Once a connection with administrator privileges is open, select the server in question (so that it appears in the server branch of Panda Administrator, it should be installed and running), and click on the Uninstall button on the toolbar. An Uninstallation Wizard will appear, which will guide you through the process.”

The procedure is as follows:

1.	A window will appear that will inform you that the MS Proxy (not the server) will automatically be restarted when uninstallation is complete. For the antivirus to be completely uninstalled, it is necessary to restart the MS Proxy server service.

2.	If you accept the uninstallation, the process will begin and a window will be shown with a progress bar enabling you to follow the uninstallation process, which only takes a few seconds.

3.	When uninstallation is complete, the service corresponding to the MS Proxy server will stop and restart (the server will not be restarted).

When these steps are completed, the antivirus software will have been removed from the server.


Permanent Protection Configuration in MS Proxy Servers

Panda Antivirus for MS Proxy servers includes Permanent Protection, which observes all file-related operations, HTML files, Applets and ActiveX Controls, which are performed in the MS Proxy server. Permanent Protection also observes all compressed file-related operations. To configure this type of scan, you have the following options:

General options

•	Enabled: if this check box is selected,  both the permanent protection module and the proxy security module will be activated.  However the check box corresponding to each of these respective options must also be selected for the permanent protection and the security module to be enabled.

•	Antivirus module enabled: when this box is checked and with the Enabled box also checked, the antivirus is running, scanning transferred files.

•	Security module enabled: when this box is checked and the Enabled box also checked, the security options which have been established through the antivirus security module (accessed from the Security... tab), will run. This option can also be enabled or disabled through security configuration.

•	Java Applets Scan: when this box is checked, the antivirus scans Java Applets. This means that, files with the extension CLASS will also be scanned. It is important to emphasize this, if you select ‘scan all’, in the list of extensions, CLASS files will not be included.

•	ActiveX Controls Scan: when this box is checked, the antivirus scans the ActiveX Controls. This means that, files with the extensions OCX and DLL will also be scanned. It is important to emphasize that if you select ‘scan all’, in the list of extensions, OCX and DLL files will not be included.

•	Scan compressed files: if this option is checked, all the compressed files which are intercepted will be scanned.

•	Generate report: this option enables the creation of a report which will reflect the activity of the antivirus software.

If a virus is found:

•	Ignore: if this option is checked and a virus is found, the antivirus will notify you of the discovery, but will take no further action.

•	Disinfect: if this option is checked and a virus is found, the antivirus will attempt to disinfect the infected file.

•	Delete: if you mark this option and a virus is discovered, the antivirus will erase the infected file.

•	Move to: if this option is checked and a virus is found, the antivirus will move the infected file to a location which you have indicated in the text box which is displayed for that purpose. A button next to this box allows you to choose a directory easily.

If disinfection is not possible:

•	Ignore: if this option is checked and a virus that cannot be disinfected is found, the antivirus will notify the user of the situation but will not carry out any further action.

•	Delete: if this option is checked and the antivirus has not been able to disinfect a contaminated file, this file will be erased.

•	Move to: if this option is checked and a virus is found, the antivirus will move the infected file to a location which you have indicated in the text box which is displayed for that purpose.

The configuration Permanent Protection, also allows you to make other selections, such as those related to security, the format of the files to be scanned and their extensions, and virus alerts which should be sent when a virus is detected.

SECURITY configuration.

MIME format configuration.

EXTENSIONS configuration.

ALERTS configuration.


Scan Report Configuration in MS Proxy Servers

The information the antivirus generates when it performs certain operations can be saved in a file where all incidents are stored. It does not only include the viruses detected by the antivirus.

Once the antivirus configuration in one of the MS Proxy servers has been accessed and the dialog box appears, select the Reports file.  The following options will appear:

Incidents to be logged in the report. Using this checkbox, the incidents which the antivirus must include in the report can be set. The options are as follows:

•	Virus detection. The antivirus will include every virus incident in the report it generates. This means that, everytime a virus is detected, the antivirus will save the following information in the report: date and time  the virus was detected, file infected, where the infected file was found, virus detected… etc.

•	Start and end the antivirus service. Indicates when (date/time) it started running and when it ended.

•	Software and virus signature file update. Update the antivirus and the virus signature file. Indicates when the software or virus signature file (PAV.SIG) update should be carried out. It also indicates if this update was carried out correctly.

•	Configuration modifications. Indicate when global changes related to the antivirus configuration have been carried out.  It also takes into account the enabling or disabling of the permanent protection, indicating whether it has been cancelled or enabled.

Maximum size: you can set a maximum size for the report generated by the antivirus in order to avoid letting the report take up too much hard disk space.


Configuration of Partial Transmission of Files in MS Proxy Servers

The antivirus should scan all files sent or received through the Proxy server (files transferred from the Proxy server to any computer in the network and viceversa). To do this, it needs to retain every one of these files in the server until the complete file has been received. Furthermore, the file cannot be retained in the server for longer than a certain amount of time, as the client will terminate the connection (when the waiting time is exceeded).

When sending packets which are part of the file being transferred, the antivirus can scan each one without using up too much of the waiting time. The data transfer might be timed out if the delay was over the established limit. Consequently, the file will be sent in small data packets before undergoing the disinfection process. However, when the file is infected, unsent packets may contain some sections that the antivirus might need to modify in order to disinfect the file in question. Disinfection will no longer be possible once any of the parts that make up the file has alredy reached the destination.

The problem concerning the excessive delay can be solved by establishing a balance between the time and the amount of information sent. This means that the packets must be as small as possible so that they can be sent at the longest possible intervals.

To set an ideal configuration for retained files, select the MS Proxy server and click on the Configure button in the toolbar of Panda Administrator. In the dialog box which appears, select the file; Partial transmission of retained files, the following options will appear:

Retain file until it is scanned. When this box is checked, the antivirus will not send the complete file (from the MS Proxy server to the client) until it has been fully scanned. This means that the client will not receive anything until this file has been fully scanned.

Send part of the file before it is scanned. The user waiting for the file will receive it in packets. Each one will be scanned before it is sent. This means that the information arrives as sections of the file, which have already been scanned by the antivirus. This option is highly recommended. If it is selected, it is necessary to set a series of parameters, which guarantee the correct functioning of the system. They are as follows:

•	Packet Size (bytes): is the size of every packet of the information to be transferred. The file is sent from the Proxy server divided into sections of this size, which the antivirus then scans. After they are scanned, they are sent to the client one at a time. It is ADVISABLE to maintain the size assigned by default, 512 bytes, although it can be modified.

•	Seconds before sending first packet: indicates the time (in seconds) that should pass from when the file is located in the server, until the first packet, is sent.  It is ADVISABLE to maintain a time of 30 seconds.

•	Seconds between partial transmissions after first packet is sent: indicates the time (in seconds) that should pass between packet transmissions, from the moment that the first packet is sent. It is ADVISABLE to maintain a time of 10 seconds.

•	Partially sent disinfected files folder: it is possible to indicate the directory in which the antivirus should save all files which were infected when they were partially transmitted (in packets), and then disinfected.

Whilst the antivirus is scanning the packets of the partially transmitted file, a virus may be detected after the recipient has already received some of the packets. A decision must be taken depending on the permanent configuration established:

•	If the permanent configuration indicates that an infected file must be removed or deleted: the antivirus will not send any more information packets from the Proxy server to the user (client). By doing this, the waiting time for receiving the information will be exceeded and the connection will be terminated before the complete file has been received.

•	If the permanent configuration indicates that an infected file must be moved: the antivirus will not send any more information packets from the Proxy server to the user (client). Therefore, the waiting time for receiving the file will be exceeded and the connection will be terminated.

•	If the permanent configuration indicates that an infected file must be disinfected: Unlike the previous two cases, there are two possible outcomes:

•	If the user has already received some of the packets corresponding to the infected file, which have been modified by the antivirus: The file will be sent to a given directory (the one selected in the section Partially transmitted disinfected files directory, for the subsequent configuration of partially transmitted files). After this, the user will not receive any more packets and the waiting time will be exceeded. Therefore, the connection with the Proxy server will be terminated.

•	If the user has not received any packet modified by the antivirus which correspond to the infected file: the user will receive the complete file once it has been disinfected.


Presentation of Scan Job Reports in MS Proxy Servers

Panda Antivirus MS Proxy Server offers you the possibility of creating a report file in which the activities of each scan performed are summarized. This report will be saved in a file that can be assigned a maximum size. This information is very useful, as it lets you see the work that has been carried out, the date and time the scan was performed and the results obtained.

When a virus is detected by Panda Antivirus for MS Proxy servers, a report will be displayed. This report will be saved in a file which will contain certain information, depending on the configuration of the report. The following information will be displayed in a dialog box when a virus is detected:

•	Date and time: this shows the date and time that the detection occurred.

•	File: this is the name of the infected file in which the virus has been detected.

•	MIME Type: indicates the MIME format of the infected file. This section gives details on the file type and subtype, in the following way: type/subtype (for example, application/msword).

•	Name of virus: this field shows the name of the virus detected.

•	Host: Indicates the name of the Internet server (its domain) from which the file which the Proxy antivirus considers to be infected, has been transferred (downloaded).

•	URL: indicates the path or address, as well as the how the virus has been detected. Information on how it was transferred will be presented (http://, for example), the name of the server and path or location of the infected file, as well as its name (this will appear at the end).

•	Operation performed: presents the action carried out by the antivirus.


Security Configuration in MS Proxy Servers

This is an important feature of Proxy server configuration. By clicking on the Security... button in the permanent protection configuration tab, it is possible to stop the computers connected to the server from receiving or accessing certain components: ActiveX controls, Applets and/ or scripts, through the use of these in HTML pages (for example). Access to each of these can be blocked, with certain criteria (impede or block access always, under certain circumstances, depending on the server it originates from,... etc).

Enable Security Module: when this box is checked, the Proxy server antivirus will take into account security restrictions which have been selected in this dialog box. It is also possible to enable or disable security conditions through the general options of the antivirus configuration.

The drop-down list, which is below the checkbox mentioned above, allows you to select the component for which you want to set security criteria. These components can be the following: Java, Applets, ActiveX Controls and Scripts. After selecting one of these components, each option that is marked will influence the security that the antivirus will apply to that component (and not to the others).

•	Ignore: The antivirus for Proxy servers, will not carry out any blocks or security controls on the component selected from the drop-down list (Applets, ActiveX Controls or Scripts).

•	Block all components: when this box is checked, the type of component that is selected in the drop-down menu will be blocked. This means that, if one of the three components (Java Applets, ActiveX Controls, or Scripts) is selected, all files containing these components which go through the Proxy, will be blocked. Files, which contain the other two types of components, will not be blocked. If you want to block all of these components, select all the components in the list and check the box, (the configurations adopted in this section only apply to the component selected).

•	Block Unreliable Server components: blocks all types of components transferred through one of the servers in the unreliable servers list. The unreliable servers list affects all the types of components at the same time.

•	Block components from any server except reliable servers: blocks all the types of components from any server  (those not included in either of the two lists, or unreliable servers). Servers which appear in the reliable servers list will not be blocked.

•	New Reliable Server: allows you to enter a server URL address that the antivirus will consider reliable. This is not a Web page address located on a server (it admits a Web page address with the www.servidor.com format but it will not accept addresses with the the folowing format: http://www.servidor.com/página.htm). The reliable servers lists affect all the types of components at the same time.

•	New Unreliable server: allows you to enter a server URL address that the antivirus will consider unreliable. This is not a Web page address located on a server (it admits a Web page address with the www.servidor.com format but it will not accept addresses with the the folowing format: http://www.servidor.com/página.htm). The unreliable servers lists affect all the types of components at the same time.

Add List button: allows you to add the URL address of a new server to the corresponding list (reliable servers or unreliable servers).

Delete List button: allows you to remove the URL address of a server included in the corresponding list (reliable servers or unreliable servers).

Clear List button: allows you to remove all the URL addresses included in the corresponding list (reliable servers or unreliable servers).


MIME Format Configuration in MS Proxy Servers

The format known as MIME is the format which appears in information (messages or files) transferred through HTTP protocol or other types of protocols. Certain information is given through a MIME type. Firstly, the TYPE of component and secondly, that known as SUBTYPE. The browser used to connect to Internet should interpret this information and display it depending on its features. MIME information is represented by type/subtype.

By clicking on the MIME button you can define or add new types, select what should be scanned, make exclusions,… etc. It is “similar” to file extensions. Every group type/subtype, defines a “kind of information” or file format. Every kind can be included in or excluded from scanning. The file scan options, related to MIME character sets, work using two lists: the Type included list (on the left) and the Type excluded list (on the right):

•	Scan all types, except excluded: when this box is checked, all MIME type files and messages in the Included Types list, as well as other files and messages whose types are not in the Types included or the Types excluded list, will be scanned.

•	Scan included types only: when this box is checked, only MIME type files and messages which are in the Types included list will be scanned.

In the Types Included list as well as in the Types Excluded list, it is possible to add or remove, add new or other types, remove them,… etc. There are buttons for each operation, which do the following:

Add List button: allows you to add a new type/subtype to the corresponding list (Included in the scan or Excluded from the scan). When entering the name of a new type, remember the following:

•	It should always be done using the following format: Type/Subtype.

•	The antivirus does not differentiate between capital and lowercase letters; therefore, it does not matter if you enter TYPE/SUBTYPE or type/subtype.

•	The type should be entered in full and correctly. However, with subtypes an * (asterix) can be used. The asterix refers to a particular type and can refer to any subtype that it has available. For example, text/* refers to all text subtypes: text/html, text/htm, text/plain... etc.

Delete List button: After selecting a type/subtype in the list, it can be deleted.

Default Types button: Includes the types the antivirus assigns by default to the list (Included or Excluded). Depending on which list is being used, there are two kinds of default types:

•	Excluded types by default are: audio/* (all sound files), graphic/* (all graphics files), message/* (all messages), video/* (all video files), text/plain (plain text files).

•	Included types by default are: application/* (all programs or applications).

Clear List button: deletes all types/subtypes in the list.


Configuration of Extensions to be Scanned in MS Proxy Servers

In this section you can configure the extensions which the permanent protection feature must scan in search of viruses. Regardless of the selection of extensions you may make, EXE and COM files will always be scanned. Due to the fact that in the Types included by Default, the antivirus includes type/subtype application/*. The extensions window options are as follows:

•	Scan all extensions: if this option is marked, all extensions will be scanned, regardless of what may have been specified in the rest of this window.

•	New extension: here you can enter a new extension to add it to the list of extensions to be scanned.

•	Add extension: when you click on the > button, the extension indicated in the New extension section will be added to the list of extensions which must be scanned.

•	Remove extension: when you select an extension from the list of extensions to be scanned and press the  < button, the selected extension is eliminated from the list.

•	Default extensions: if you press this button, the list of extensions to be scanned returns to its default configuration.

•	Clear: when you click on this button, the list of extensions is cleared.


Alerts Configuration in MS Proxy Servers

In this section, you can configure the alerts that the antivirus will generate when a virus is detected. The options of this section are displayed in several files:

•	Selected Alerts: in this section you can choose the types of warnings to be generated. You can choose to generate warnings characteristic of NetWare networks, or to send an e-mail message in SMTP, send a message through the Microsoft Exchange network and/or a Lotus Notes network.

•	Microsoft Network: if users choose to send a message through the Microsoft network, they must indicate the recipient or the domain where the message will be sent, as well as include the message in question.

•	SMTP: if you have chosen to send an electronic mail message, you will have to indicate the server through which the message is to be sent, the recipient’s address, the subject of the message and the message itself.

•	MS Exchange: in this case, the Exchange network itself will be used to send the notification. Within this tab there are a number of other sections: profile, address, type.

•	Lotus Notes: if you have chosen to send an electronic mail message by Lotus Domino server, you will have to indicate the server through which the message is to be sent, the recipient’s address, the subject of Eamothe message and the message itself.

Alerts.

It is advisable to send an alert message when a virus is detected in a file that has been scanned and the antivirus must delete it, move it to another directory, or if the antivirus was unable to disinfect it. Therefore, alerts consist of sending a message, where the infected file will by substituted by a HTML message, when the infected file must be deleted, moved, or when it could not be disinfected.

The HTML page which sends the alert, informs the recipient about the incident. It does it in the same way as the typical administrator alerts. When alerts configuration is accessed, a dialog box will appear, in which it is possible to set the properties of the following:

•	Move or delete, substitute file for virus alert. If this box is checked, the alerts that must be sent (when an infected file is moved or deleted), will not include the infected file. On the contrary, only the alert that has been selected using the ‘Text…’ button will be sent.

•	Send a message to the administrator. If this box is checked, the administrator will receive an alert message. This message can be set using the ‘Text…’ button and the address selected in the Administrator Address section.


Basic Updates on MS Proxy Servers

With basic updates, only one server can be selected at a time. After selecting basic update mode, click on the Next button. This allows you to select the characteristics of the update job and will guide you through the update process.

1.	Select type of programming:

•	Immediate. Is carried out as soon as it is created.

•	Scheduled. Is carried out on a given date/time, or frequency.

2.	When using scheduled updates, the characteristics must be set: Description (write the name you want to assign to the update job) and Time (indicate the time that the scheduled update must begin). There are two  types of scheduled updates:

•	Date: It will be carried out on a given date and at a given time. By clicking on the Next button, the Date of the update can be set.

•	Frequency: It will be carried out at regular intervals. By clicking on the Next button, you can set the frequency with which the job should be carried out: Weekly (any day of the week can be selected) or on a certain Day of the month.

3.	Select the items to be updated:

•	Update only the Signature File (PAV.SIG): only the file that allows the viruses to be detected will be updated (Update).

•	Update antivirus motor: updates the Signature File and the antivirus program itself (Upgrade).

It is advisable to carry out the updates (immediate or scheduled) corresponding to the antivirus motor when the server has less traffic.

4.	The update files can be found in a certain location. If one of them does not exist, a dialog box will appear informing you that the update cannot be carried out (the necessary files do not exist or they are not correct). Indicate from where the update must be carried out (place where the updated files are located):

•	Internet (Panda Software web page): The Virus Signature File will be updated from the Panda Software update web page. In order to do this it is necessary to enter the User name and Password to this update page. Furthermore, if the Internet connection is made through a Proxy server, you must check the box Connect via proxy server. In this case, indicate the corresponding IP Address and the number of the Port used. Before updating the files, it will check that the configuration is correct.

NOTE: the update via Internet is only available for the virus signature file, not for the whole antivirus program. When using scheduled updates, a session must be open with the server.

•	Panda Administrator Directory: the virus signature files and the antivirus files will be updated. They are located in the directory PAVSIG (where Panda Administrator was installed). Firstly, it checks that the update server service is installed correctly. If it is not, it indicates that this service must be installed. If it is, the update begins.

NOTE: the update is carried out through the Panda Administrator directory. Therefore, the computer in which it is installed must be in operation.

5.	By clicking on the Finish button, if it is an immediate update job, the update will begin. If it is a scheduled update job, it will be carried out at the scheduled time.


Advanced Updates on MS Proxy Servers

After selecting advanced updates mode, click on the Next button. This allows you to select the update characteristics and will guide you through the update process.

Unlike the basic updates system, the advanced allows you to carry out different update jobs, which are the following:

•	New update. Allows you to create a new update job.

•	Consult existing update jobs. Allows you to edit, consult or modify the characteristics of existing update jobs (defined on previous occasions).

•	Delete Update server. Allows you to delete the update server service, which allows update jobs to be defined.


Advanced Update - New Update Job on MS Proxy Servers

After selecting the server, click on the Update button and check New Update, the steps corresponding to the update job will begin.

1.	Select type of programming:

•	Immediate. Is carried out as soon as it is created.

•	Scheduled. Is carried out on a given date/time or frequency.

2.	When using scheduled updates, the characteristics must be set: Description (write the name you want to assign to the update job) and Time (indicate the time that the update must begin). There are two  types of scheduled updates:

•	Date: It will be carried out on a given date and at a given time. By clicking on the Next button, the Date of the update can be set.

•	Frequency: It will be carried out every so often. By clicking on the Next button, you can set the frequency with which the job should be carried out: Weekly (any day of the week can be selected) or on a certain Day of the month.

3.	Select the items to be updated:

•	Update only the Signature File (PAV.SIG): only the file that allows the viruses to be detected will be updated (Update).

•	Update antivirus motor: updates the Signature File and the antivirus program itself (Upgrade).

4.	The update files can be found in a certain location. Amongst which there is one called UPGRADE.DAT (it contains information on the files that must be updated and their location). If one of them does not exist or is not correct, the update cannot be carried out. Indicate from where the update must be carried out (place where the updated files are located):

•	Internet (Panda Software web page): The Virus Signature File will be updated from the Panda Software update web page. It is possible to select whether the update should be done directly or whether the corresponding files should be copied to a directory for the subsequent update:

•	One connection per server: for every server selected at the start of the process, a new connection to the update web page will be made and the corresponding files will be updated.

•	One connection for all of the servers leaving the information in: only one connection will be made to which the necessary files will be copied. The files, which are collected during the connection, will be saved in the location you indicate.

In either case, it is necessary to enter the User name and Password for accessing the update web page. Furthermore, if the Internet connection is made through a Proxy server, you must check the box Connect via proxy server. In this case enter the corresponding IP Address and the number of the Port used.

•	Panda Administrator Directory: the virus signature files and the antivirus files will be updated. They are located in the directory PAVSIG (where Panda Administrator was installed). Firstly, it checks that the update server service is installed correctly. If it is not, it indicates that this service must be installed. If it is, the update begins.

•	Other Location: it is possible to select any disk drive and directory in which the files, with which the update must be carried out, are located. The location can be selected, using the button which appears on the right. The update source may be located on a CD-ROM (it must be inserted in the CD drive). The following requirements must be met:

•	The disk drive and directory must correspond to a Windows NT server or workstation.

•	It must not be a mapped disk drive.

5.	With advanced updates, after carrying out the necessary configurations, the update job can be saved. To do this, check the corresponding box and name the job. This will not happen with updates scheduled by frequency, as they are always saved by default.

6.	By clicking on the Finish button, if it is an immediate update job, the update will begin. If it is a scheduled update job, it will be carried out at the scheduled time.


Advanced Update - Consult / Edit Update Job on MS Proxy Servers

After selecting the server, click on the Update button and check Consult existing update jobs, the steps corresponding to the that update job will begin.

1.	Select computer/s. Select the computer/s, in which the update jobs you want to consult were saved (those in which the update server is located). Use the button which appears on the right and then click on Next.

2.	All of the existing update jobs in the computer will be displayed, as well as the corresponding data (description or job name, type and next execution).

•	In order to carry out (at that moment) one of the immediate updates in the list, select it and click on the Start button.

•	To access the properties of an update job, select it in the list and click on the Edit button. As well as consulting the properties, they can also be modified. Finally, other computers can be selected (as well as the current), on which the update job must also be carried out. In other words, the list of computers in which the update will be carried out, can be modified at any time (Add or Delete update jobs).

NOTE: the update jobs defined for a given platform cannot be used for other platforms. Furthermore, when an update job is edited, it is then considered as advanced.


Advanced Update - Delete the Update Job on MS Proxy Servers

Note: when you choose to delete an update server, ALL THE UPDATE JOBS in the computer selected, will be deleted.

To delete the update server from a computer, follow these steps:

1.	Set up a connection with administrator privileges, if one does not already exist, for the server.

2.	From Panda Administrator, select the server.

3.	Click on the Update button, on the toolbar.

4.	Select Advanced update mode.

5.	Select the update job type: Delete the Update server.

By doing this, it will be indicated where the update service is installed. By clicking on the OK button, this service will be deleted. This means that ALL UPDATE JOBS IN THIS FILE SERVER WILL BE DELETED.


Description of Panda Administrator for Firewall

Panda Administrator is capable of managing antivirus protection for Checkpoint Firewall (CVP servers). To do this, certain conditions are necessary in the Firewall system: Check Point Firewall-1 v. 3.0b, or higher version and any operating system (Windows NT 4.0 Server SP3 or higher version, Unix,... etc).

The objective of Panda Antivirus for Firewall is to protect, as files, all information transferred through Firewall to and from the Internet. In this way, it works like the other security components which are included in Firewall. This will be responsible for access control (to and from Internet), whilst the antivirus will scan information transferred in this way, and the components (ActiveX controls, Applets and scripts) it contains.

This means that Panda Antivirus for Firewall is responsible for scanning every transfer made through the protected network to Internet or viceversa. Therefore, files sent or received through FTP, HTTP and SMTP protocols (a Firewall CVP server for all the protocols or one for each protocol) will be protected in the network which contains the Firewall.

The main window of Panda Administrator shows the different servers found. The most used options are on the button bar which is in the top part of the main window. These include Firewall CVP servers, where the antivirus can be installed. The antivirus scans all files transferred to the Firewall and sends it the appropriate notification: file accepted (because it is virus-free) or file blocked until it has been disinfected. In conclusion, Panda Antivirus for Firewall acts as a security component which scans, controls and filters the files which go through the Firewall (as well as the option of Firewall accepting or denying a certain transmission).

Panda Antivirus for Firewall is managed through Panda Administrator.


How to Install the Antivirus in Networked Firewall

Note: When installing Panda Antivirus for Firewall, certain conditions on Firewall rules and requirements must be met in relation to the antivirus. It is necessary to modify the Firewall rules so that it redirects FTP, HTTP and SMTP protocol transmissions to the server which has the antivirus installed (if there is a server for every protocol, the corresponding redirection will have to be configured). If the configuration of Firewall is incorrect, the corresponding scans cannot be carried out from every possible CVP server.

Requirements and rules to be established in a Firewall

•	Check Point Firewall v. 3.0b, or later version must be installed.

•	Any operating system (Windows NT, Unix,... etc).

•	Account for CVP servers (Content Vector Protocol) in the configuration of Firewall. To do this, follow these steps:

1.	Create the CVP server. Its name must be pav_cvp_server. It must be selected in the PC and defined to implement the service FW1_cvp.

2.	Indicate the redirections via FTP, HTTP and SMTP to the appropriate CVP server (antivirus). Select the object just created as the antivirus server, pav_cvp_server, for each of the following resources: FTP_av, HTTP_av and SMTP_av.

3.	Make sure all files are redirected to the CVP server for each protocol. This means modifying the Firewall security policy, indicating that SMTP, FTP and HTTP servers must be FTP_av, HTTP_av y SMTP_av, respectively.

Antivirus for Firewall installation requirements

•	Processor Pentium 133 Mhz, or higher version.

•	64 Mb of RAM memory (128 Mb are recommended).

•	5 Mb available on the hard disk.

•	Windows NT 4.0 Server SP3, or higher version must be installed

•	Check Point Firewall-1 3.0b or higher version.

Once all of these prerequisites are met, the antivirus installation process can be started. Firstly a connection must be opened, with the server/s in which Panda Antivirus for Firewall is going to be installed. This connection must have administrator privileges, which can be established before executing Panda Administrator (the program will recognize if a connection was established before it was executed), or from Panda Administrator itself.

After establishing a connection and opening Panda Administrator, choose the NT server in which you want to install the antivirus for Firewall. Open the branch below it by clicking on the + sign to the left of it. The CVP Firewall server will be displayed in the computers installed with Windows NT 4.0 SP3 (or later version), where the antivirus installation can be carried out. Then, select it and click on the Install button on the toolbar.

1.	Administrator domain and account. This second installation step requires you to enter the following administrator data: Domain, Account and Password of the computer in which the antivirus is being installed.

The field, in which the administrator domain and account must be entered, must have the following format: Domain\Account. If the antivirus is installed from the same equipment where Panda Administrator is being executed, it will be possible to enter the domain as follows: .\Account.

The administrator account must have the following rights: “Start a session as a batch job”, “Act as part of the operating system” and “Start up the session as a service”. This allows the antivirus service to function correctly.

2.	Creating the appropriate directories, copying the necessary files, copying the files necessary to obtain an antivirus configuration by default, as well as creating and starting up the services of the CVP server. When it has finished, the process will start up the service.

When the installation process is complete, the presence of the antivirus will be indicated in the icon which corresponds to the Firewall CVP server.


How to Configure the Antivirus in Networked Firewall

Panda Antivirus for Firewall allows users to configure the scans carried out on the Firewall servers where it is installed. Similarly, it is possible to configure the following aspects: reports that the antivirus generates when certain events occur, the alerts messages that must be sent when a virus is detected, the sending of files in small data packets through the server and the transfers carried out through the following protocols: HTTP, SMTP and FTP.

To configure the antivirus in Firewall, select it in the Panda Administrator server tree and click on the Configure button on the toolbar. A dialog box will then appear, with the following files:

HTTP Transfer Configuration (Web Pages).

SMTP Transfer Configuration (e-mail).

FTP Transfer Configuration (File Transfer).

Alert Configuration.

Configuration of Partial Transmission of Files.

Reports Configuration.


How to Scan in Firewall

The scan carried out on the Firewall server is based either on pre-established or default criteria. This means that any files sent or received will be scanned according to the following:

•	Type of file (extensions). The file may or may not be scanned, depending on its format. In other words, using the list of extensions to be scanned, it is possible to determine which files the antivirus should or should not scan. By default, the antivirus always scans EXE and COM files, as well as those in the list of extensions.

•	MIME type or format (type/subtype). In this case, files may or may not be scanned depending on the MIME type and subtype it belongs to, (text/html, text/html, text/plain,... ). This is defined in the lists of Types Included and Types Excluded.

Panda Antivirus for Firewall includes a permanent scan which continually scans the system. To access the scans, click on the Scan button on the Panda Administrator toolbar. It is possible to carry out the following operations on the permanent scan:

Presentation of Firewall scan reports

Monitoring of Firewall scan jobs

Stop and abort a Firewall scan job


How to Update the Antivirus in Networked Firewall

To update Panda Antivirus for Firewall, open a connection with the server from which the update will be carried out. This connection must have administrator privileges.

The update of the antivirus for Firewall servers, has certain special characteristics which are worth highlighting:

•	It is possible to update not only the virus signature file (update only the file which allows the virus detections to be carried out, therefore, the antivirus will detect more viruses), but also the entire antivirus program (the antivirus will also include new advantages, as well as more potential and more possibilities.

•	The update can be immediate (it will be carried out at that moment) or scheduled (the antivirus will carry out the update on a given date).

•	It is possible to select from where the update files must be copied: from a specified Panda Administrator directory, from Internet (Panda Software Web page), or from a folder which corresponds to the update server.

•	It is possible to carry out operations related to updates. For this reason they are considered update jobs. Update jobs can be saved, edited to modify or create new jobs, or deleted. To sum up, whether you are saving or editing, any characteristic of a scan can be saved to use when creating another. For this reason, it will be possible to create new update jobs, modify existing jobs and use them to create others, or delete the list of jobs.

To carry out any of the update operations, it is necessary to follow certain common steps as follows:

1.	You will need to have a connection open with the server from which you want to carry out the update job. This connection must have administrator privileges. If it is already open before executing Panda Administrator, it will be automatically recognized. If it is not, it can be opened from Panda Administrator.

2.	From the Panda Administrator window, select the server from which you want to carry out an update job.

3.	Click on the Update button, in the toolbar.

4.	Select the Update Mode. There are  two options: Basic Updates or Advanced Updates. From this point on, it will be possible to select all the actions related to update jobs.


How to Uninstall the Antivirus from Networked Firewall

To uninstall Panda Antivirus from Firewall, you will need to have a connection open with the server with administrator privileges

IMPORTANT NOTE: Before starting the uninstallation process of Panda Antivirus for Firewall, it is necessary to delete every security rule defined in the configuration of the Firewall which affect the CVP server in which you want to uninstall the antivirus.

If that connection is open before executing Panda Administrator, the program will automatically detect it. If it has not been opened previously, it can be opened from Panda Administrator.

Once a connection with administrator privileges is open, select the server in question (so that it appears in the server branch of Panda Administrator, it should be installed and running), and click on the Uninstall button on the toolbar. An Uninstallation Wizard will appear, which will guide you through the process.

The procedure is as follows:

1.	If you accept the uninstallation, the process will begin and a window will be shown with a progress bar enabling you to follow the uninstallation process, which only takes a few seconds.

2.	When uninstallation is complete, the service corresponding to the Firewall will stop and restart (the server will not be restarted).

When these steps are completed, the antivirus software will have been removed from the server.


Scan Report Configuration in Firewall

The information the antivirus generates when it performs certain operations can be saved in a file where all incidents are stored. It does not only include the viruses detected by the antivirus.

Once the antivirus configuration in one of the MS Proxy servers has been accessed and the dialog box appears, select the Reports file. The following options will appear:

Incidents to be logged in the report. Using this checkbox, the incidents which the antivirus must include in the report can be set. The options are as follows:

•	Virus detection. The antivirus will include every virus incident in the report it generates. This means that, everytime a virus is detected, the antivirus will save the following information in the report: date and time  the virus was detected, file infected, where the infected file was found, virus detected… etc.

•	Start and end the antivirus service. Indicates when (date/time) it started running and when it ended.

•	Software and virus signature file update. Update the antivirus and the virus signature file. Indicates when the software or virus signature file (PAV.SIG) update should be carried out. It also indicates if this update was carried out correctly.

•	Configuration modifications. Indicate when global changes related to the antivirus configuration have been carried out.  It also takes into account the enabling or disabling of the permanent protection, indicating whether it has been cancelled or enabled.

Maximum size: you can set a maximum size for the report generated by the antivirus in order to avoid letting the report take up too much hard disk space.

The following data is stored in the report generated by the antivirus:

•	Date and time the scan was carried out.

•	If it is about an infected file, the name is given. If it is about an infected message, the subject of the message is given.

•	If it is about an infected file or an infected message, the corresponding MIME type is included.

•	If it is about an infected message, the addresses of the senders and recipients of the message are included.

•	The name of the virus which has caused the infection.

•	The operation which the virus has carried out on the infected component (file and/or message).

•	Name and URL address of the server which has transmitted the infected file.

•	Comments, date and time the antivirus service was run.

•	Comments, date and time the antivirus service finished.

•	Comments, date and time the configuration was modified.

•	Comments, date and time the virus signature file was updated.

•	Comments, date and time the URL of the HTML page is indicated, of which the controls applets and/or scripts have been blocked.


Configuration of Partial Transmission of Files in Firewall

The antivirus should scan all files sent or received through the Firewall (files transferred from the Firewall to any computer in the network and viceversa). To do this, it needs to retain every one of these files in the server until the complete file has been received. Furthermore, the file cannot be retained in the server for longer than a certain amount of time, as the client will terminate the connection (when the waiting time is exceeded).

When sending packets which are part of the file being transferred, the antivirus can scan each one without using up too much of the waiting time. If an infected file is being sent to a client using packets, the antivirus can disinfect it so that the recipient receives a disinfected file.

To set an ideal configuration for retained files, select the Firewall and click on the Configure button in the toolbar of Panda Administrator. In the dialog box which appears, select the file; Partial transmission of retained files, the following options will appear:

Retain file until it is scanned. When this box is checked, the antivirus will not send the complete file (from the Firewall server to the client) until it has been fully scanned. This means that the client will not receive anything until this file has been fully scanned.

Send part of the file before it is scanned. The user waiting for the file will receive it in packets. Each one will be scanned before it is sent. This means that the information arrives as sections of the file, which have already been scanned by the antivirus. This option is highly recommended. If it is selected, it is necessary to set a series of parameters, which guarantee the correct functioning of the system. They are as follows:

•	Packet size (Bytes): is the size of every packet of the information to be transferred. The file is sent from the Proxy server divided into sections of this size, which the antivirus then scans. After they are scanned, they are sent to the client one at a time. It is ADVISABLE to maintain the size assigned by default, 512 bytes, although it can be modified.

•	Seconds before sending first packet: indicates the time (in seconds) that should pass from when the file is located in the server, until the first packet, is sent.  It is ADVISABLE to maintain a time of 30 seconds.

•	Seconds between partial transmissions after first packed is sent: indicates the time (in seconds) that should pass between packet transmissions, from the moment that the first packet is sent. It is ADVISABLE to maintain a time of 10 seconds.

•	Partially sent disinfected files folder: it is possible to indicate the directory in which the antivirus should save all files which were infected when they were partially transmitted (in packets), and then disinfected.

Whilst the antivirus is scanning the packets of the partially transmitted file, a virus may be detected after the recipient has already received some of the packets. A decision must be taken depending on the permanent configuration established:

•	If the permanent configuration indicates that an infected file must be removed or deleted: the antivirus will not send any more information packets from the Proxy server to the user (client). By doing this, the waiting time for receiving the information will be exceeded and the connection will be terminated before the complete file has been received.

•	If the permanent configuration indicates that an infected file must be moved: the antivirus will not send any more information packets from the Proxy server to the user (client). Therefore, the waiting time for receiving the file will be exceeded and the connection will be terminated.

•	If the permanent configuration indicates that an infected file must be disinfected: Unlike the previous two cases, there are two possible outcomes:

•	If the user has already received some of the packets corresponding to the infected file, which have been modified by the antivirus: The file will be sent to a given directory (the one selected in the section Partially transmitted disinfected files directory, for the subsequent configuration of partially transmitted files). After this, the user will not receive any more packets and the waiting time will be exceeded. Therefore, the connection with the Proxy server will be terminated.

•	If the user has not received any packet modified by the antivirus which correspond to the infected file: the user will receive the complete file once it has been disinfected.

CVP server

The antivirus carries out its scan through the communications port used between the Firewall and the CVP server. This section of the configuration of partial transmission of files allows you to select which port the antivirus must scan. When the antivirus is executed, the modifications, which have been carried out in this section, do not have any effect. In other words, for the antivirus to scan everything which passes through the port which you have just selected, the antivirus service must be stopped and restarted.

•	CVP port: allows you to enter the number of the port through which the antivirus must control transmissions between the CVP server and the Firewall. It must be the same as the port associated with the FW1_cvp service (in the configuration of the Firewall). If this data is modified at any time, the antivirus must be stopped and restarted for the change to come into effect.

•	Connection authenticated: When this box is checked a connection can be established which uses authentication between the CVP server and the Firewall. This means that it is necessary to configure the CVP client (Firewall) and the CVP server (antivirus).


Presentation of Scan Job Reports in Firewall

Panda Antivirus offers you the possibility of creating a report file in which the activities of each scan performed are summarized. This report will be saved in a file that can be assigned a maximum size. This information is very useful, as it lets you see the work that has been carried out, the date and time the scan was performed and the results obtained.

The information shown is listed in columns. The first column details the date and time the detection was made, and the second indicates the name of the virus detected. If you need a hard copy of this information, just click on the Print button. On the other hand, when you have finished viewing the information, you need only click the Seen button to close the window and return to the application. You are also offered the possibility of deleting the report. To do this, just click on the Delete button. With this, you will delete the entire report containing all the scan activity data.

The information that appears in this report window is only a summary of the complete data available. By double clicking on any of the listed scans, the following additional information will be provided:

•	Date and time: this shows the date and time that the detection occurred.

•	File: this is the name of the infected file in which the virus has been detected.

•	MIME Type: indicates the MIME format of the infected file. This section gives details on the file type and subtype, in the following way: type/subtype (for example, application/msword).

•	Name of virus: this field shows the name of the virus detected.

•	Host: Indicates the name of the Internet server (its domain) from which the file which the Proxy antivirus considers to be infected, has been transferred (downloaded).

•	URL: indicates the path or address, as well as the how the virus has been detected. Information on how it was transferred will be presented (http://, for example), the name of the server and path or location of the infected file, as well as its name (this will appear at the end).

•	Operation performed: presents the action carried out by the antivirus.

To conclude this section, it is worth noting that there only exists one results report. Some users may confuse the information obtained by clicking on the Monitor button, located in the Job Monitor window, for a report, when this is in fact only a presentation of the properties and activities of the scan job in progress.


Configuration of Transmissions via HTTP (Web) in Firewall

The configuration of file transfers through the HTTP protocol allows you to determine the actions to carry out when an infected file transmitted through Web pages is detected (or when the Web page iself contains elements that might become infected). These actions are the following:

General options

•	Enabled: this option determines whether or not HTTP protection will be enabled.

•	Antivirus module enabled: When this check box is enabled the antivirus will scan the files corresponding to web pages (HTTP). Selecting this check box as well as the Security Module Enabled option will lead to the scanning of files transferred through the HTTP protocol.

•	Security module enabled: Selecting this check box will enable the antivirus protection for HTML pages (applets, Active X controls and scripts). To enable this option will be necessary to select this check box as well as the Antivirus Module Enabled option.

•	Java Applets Scan: when this box is checked, the antivirus scans Java Applets. This means that, files with the extension CLASS will also be scanned. It is important to emphasize this, if you select scan all, in the list of extensions, CLASS files will not be included.

•	ActiveX Controls Scan: when this box is checked, the antivirus scans the ActiveX Controls. This means that, files with the extensions OCX and DLL will also be scanned. It is important to emphasize that if you select ‘scan all’, in the list of extensions, OCX and DLL files will not be included.

•	Scan compressed files: if this option is checked, all the compressed files which are intercepted will be scanned.

If a virus is found:

•	Ignore: if this option is checked and a virus is found, the antivirus will notify you of the discovery, but will take no further action.

•	Disinfect: if this option is checked and a virus is found, the antivirus will attempt to disinfect the infected file.

•	Delete: if you mark this option and a virus is discovered, the antivirus will erase the infected file.

•	Move to: if this option is checked and a virus is found, the antivirus will move the infected file to a location which you have indicated in the text box which is displayed for that purpose. A button next to this box allows you to choose a directory easily.

If disinfection is not possible:

•	Ignore: if this option is checked and a virus that cannot be disinfected is found, the antivirus will notify the user of the situation but will not carry out any further action.

•	Delete: if this option is checked and the antivirus has not been able to disinfect a contaminated file, this file will be erased.

•	Move to: if this option is checked and a virus is found, the antivirus will move the infected file to a location which you have indicated in the text box which is displayed for that purpose.

Additionally, the buttons available on this section (security, MIME, extensions and advanced) will allow you to indicate how the antivirus should behave on certain occasions.

SECURITY Configuration

MIME Configuration

EXTENSIONS Configuration

ADVANCED Configuration


Configuration of Transmissions via SMTP (e-mail) in Firewall

The configuration of file transfers through the SMTP protocol (e-mail), allows users to select the actions to carry out if an infected file is detected in e-mail messages. This type of scan is focused on e-mail messages, the files they might contain, nested files (included in other messages) and files contained in nested files.

General options

•	Enabled: this option determines whether or not permanent protection will be enabled.

•	Messages received: when this box is checked, the antivirus will scan all outgoing messages. In other words, it will scan all messages received by a user belonging to the incoming domain.

•	Messages sent: when this box is checked, the antivirus will scan all incoming messages. In other words, it will scan all messages whose sender belongs to an outgoing domain.

•	Scan nested messages: a message can include files in the message body or as an attachment. In the same way, it can also include other messages inside it (nested) and these messages may include files. The antivirus scans messages which contain an attached file, if configured to do so. If this box is checked, messages which are included in other mail messages (nested), will be scanned. Furthermore, files included in messages (attached) will also be scanned, as well as those which are included in another message (nested). This means that a scan with a higher level of nesting will be performed on each message.

•	Scan compressed files: if this option is checked, all the compressed files which are intercepted will be scanned.

If a virus is found:

•	Ignore: if this option is checked and a virus is found, the antivirus will notify you of the discovery, but will take no further action.

•	Disinfect: if this option is checked and a virus is found, the antivirus will attempt to disinfect the infected file.

•	Delete: if you mark this option and a virus is discovered, the antivirus will erase the infected file.

•	Move to: if this option is checked and a virus is found, the antivirus will move the infected file to a location which you have indicated in the text box which is displayed for that purpose. A button next to this box allows you to choose a directory easily.

If disinfection is not possible:

•	Ignore: if this option is checked and a virus that cannot be disinfected is found, the antivirus will notify the user of the situation but will not carry out any further action.

•	Delete: if this option is checked and the antivirus has not been able to disinfect a contaminated file, this file will be erased.

•	Move to: if this option is checked and a virus is found, the antivirus will move the infected file to a location which you have indicated in the text box which is displayed for that purpose.

The antivirus will allow you to configure each of the properties of the SMTP transfer as well as other properties of the configuration.To do this you can use the buttons on this tab.

MIME Configuration

EXTENSIONS Configuration

DOMAIN Configuration

ADVANCED Configuration


Configuration of Transmissions through FTP (File Transfer) in Firewall

The configuration of transfers through FTP protocol (File Transfer Protocol), allows you to set the actions and functions the antivirus must carry out, if it detects an infected file transmitted through FTP. The scan can be based on inspecting normal files or compressed files. The configuration options are as follows:

General options

•	Enabled: this option determines whether or not permanent protection will be enabled.

•	Scan compressed files: if this option is checked, all the compressed files which are intercepted will be scanned.

If a virus is found:

•	Ignore: if this option is checked and a virus is found, the antivirus will notify you of the discovery, but will take no further action.

•	Disinfect: if this option is checked and a virus is found, the antivirus will attempt to disinfect the infected file.

•	Delete: if you mark this option and a virus is discovered, the antivirus will erase the infected file.

•	Move to: if this option is checked and a virus is found, the antivirus will move the infected file to a location which you have indicated in the text box which is displayed for that purpose. A button next to this box allows you to choose a directory easily.

If disinfection is not possible:

•	Ignore: if this option is checked and a virus that cannot be disinfected is found, the antivirus will notify the user of the situation but will not carry out any further action.

•	Delete file: if this option is checked and the antivirus has not been able to disinfect a contaminated file, this file will be erased.

•	Move to: if this option is checked and a virus desinfection is not possible, the antivirus will move the infected file to a location which you have indicated in the text box which is displayed for that purpose.

EXTENSIONS Configuration

ADVANCED Configuration


Configuration of Security in Firewall

This is a very important characteristic of the configuration of transfers via Firewall (SMTP, HTTP, FTP). It makes it possible to impede (in given circumstances and in certain conditions) computers which are connected to the Firewall CVP server, from receiving or accessing certain components: ActiveX controls, Applets, scripts,... etc. By clicking on the Security... button in the configuration of transfers through HTTP, the following options will be displayed:

Enable Security Module: when this box is checked, the Firewall  will take into account security restrictions which have been selected in this dialog box. It is also possible to enable or disable security conditions through the general options of the antivirus configuration.

The drop-down list, which is below the checkbox mentioned above, allows you to select the component for which you want to set security criteria. These components can be the following: Java, Applets, ActiveX Controls and Scripts. After selecting one of these components, each option that is marked will influence the security that the antivirus will apply to that component (and not to the others).

•	Ignore: The antivirus for Firewall, will not carry out any blocks or security controls on the component selected from the drop-down list (Applets, ActiveX Controls or Scripts).

•	Block all elements: when this box is checked, the type of component that is selected in the drop-down menu will be blocked. This means that, if one of the three components (Java Applets, ActiveX Controls, or Scripts) is selected, all files containing these components which go through the Firewall, will be blocked. Files, which contain the other two types of components, will not be blocked. If you want to block all of these components, select all the components in the list and check the box, (the configurations adopted in this section only apply to the component selected).

•	Block unreliable server elements: blocks all types of components transferred through one of the servers in the unreliable servers list. The unreliable servers list affects all the types of components at the same time.

•	Block all server elements, except those from reliable servers: blocks all the types of components from any server  (those not included in either of the two lists, or unreliable servers). However, components coming from servers included in the list of reliable servers will not be blocked.

•	New reliable server: allows you to enter a server URL address that the antivirus will consider reliable. The reliable servers lists affect all the types of components at the same time.

•	New unreliable server: allows you to enter a server URL address that the antivirus will consider unreliable. The unreliable servers lists affect all the types of components at the same time.

Add List button: allows you to add the URL address of a new server to the corresponding list (reliable servers or unreliable servers).

Remove List button: allows you to remove the URL address of a server included in the corresponding list (reliable servers or unreliable servers).

Clear List button: allows you to remove all the URL addresses included in the corresponding list (reliable servers or unreliable servers).


MIME Format Configuration in Firewall

The format known as MIME is the format which appears in information (messages or files) transferred through HTTP protocol or other types of protocols. Certain information is given through a MIME type. Firstly, the TYPE of component and secondly, that known as SUBTYPE. The browser used to connect to Internet should interpret this information and display it depending on its features. MIME information is represented by type/subtype.

By clicking on the MIME button you can define or add new types, select what should be scanned, make exclusions,… etc. It is “similar” to file extensions. Every group type/subtype, defines a “kind of information” or file format. Every kind can be included in or excluded from scanning. The file scan options, related to MIME character sets, work using two lists: the Type included list (on the left) and the Type excluded list (on the right):

•	Scan all types, except excluded ones: when this box is checked, all MIME type files and messages in the Included Types list, as well as other files and messages whose types are not in the Types included or the Types excluded list, will be scanned.

•	Scan only included types: when this box is checked, only MIME type files and messages which are in the Types included list will be scanned.

In the Types Included list as well as in the Types Excluded list, it is possible to add or remove, add new or other types, remove them,… etc. There are buttons for each operation, which do the following:

Add List button: allows you to add a new type/subtype to the corresponding list (Included in the scan or Excluded from the scan). When entering the name of a new type, remember the following:

•	It should always be done using the following format: Type/Subtype.

•	The antivirus does not differentiate between capital and lowercase letters; therefore, it does not matter if you enter TYPE/SUBTYPE or type/subtype.

•	The type should be entered in full and correctly. However, with subtypes an * (asterix) can be used. The asterix refers to a particular type and can refer to any subtype that it has available. For example, text/* refers to all text subtypes: text/html, text/htm, text/plain... etc.

Remove List button: After selecting a type/subtype in the list, it can be deleted.

Default Types button: Includes the types the antivirus assigns by default to the list (Included or Excluded). Depending on which list is being used, there are two kinds of default types:

•	Excluded types by default are: audio/* (all sound files), graphic/* (all graphics files), message/* (all messages), video/* (all video files), text/plain (plain text files).

•	Included types by default are: application/* (all programs or applications).

Clear List button: deletes all types/subtypes in the list.


Configuration of Extensions to be Scanned in Firewall

In this section you can configure the extensions which the permanent protection feature must scan in search of viruses. Regardless of the selection of extensions you may make, EXE and COM files will always be scanned. Due to the fact that in the Types included by Default, the antivirus includes type/subtype application/*. The extensions window options are as follows:

•	Scan all extensions: if this option is marked, all extensions will be scanned, regardless of what may have been specified in the rest of this window.

•	New extension: here you can enter a new extension to add it to the list of extensions to be scanned.

•	Add extension: when you click on the > button, the extension indicated in the New extension section will be added to the list of extensions which must be scanned.

•	Remove extension: when you select an extension from the list of extensions to be scanned and press the  < button, the selected extension is eliminated from the list.

•	Default extensions: if you press this button, the list of extensions to be scanned returns to its default configuration.

•	Clear: when you click on this button, the list of extensions is cleared.


Avanced Configurations in Firewall (Heuristic scans)

One of the interesting possiblities of Antivirus for Firewalls, is heuristic scans. This scan detects the vast majority of unknown viruses. It is possible to determine the level of  sensitivity that the scan should have.

Enabled: when this box is checked, the scan must have heuristic techniques. This means that, not only will the scan search for known viruses but it will also be able to detect more recent unknown viruses.

Level of Sensitivity

•	Maximum sensitivity: the scan will display alerts (as if it were detection) when there is the slightest sign that a file may be infected with a virus.

•	Medium sensitivity (recommended): the scan will use heuristic techniques to scan any files with suspicious characteristics, but it will not spend too much time on this control.

•	Minimum sensibility: the antivirus will only take care of those files which could have a high probability of being infected by a virus.


Configuration of Internal Mail Domains in Firewall

By configuring domains, it is possible to configure which are the internal domains (those which remain inside the network or networks used by the Firewall). From then on, it is easy to clarify the addresses of the messages (incoming/outgoing).

•	New domain: allows you to enter the URL address of the server (domain) you want to be included in the list of domains.

•	Add list: includes the URL addresses entered in the section New domain.

•	Delete list: deletes the name selected from the domain in which it is included.

•	Clear list: deletes all the list (all the domains which are included in the list).

Depending on the sender and the recipient of the message, a different transfer address for the message is considered. Therefore, it will only be scanned when necessary (when it must go through the Firewall):

•	The sender of the message is included in the network or networks which are accessed with a Firewall CVP server, and the recipient is also included in it. In this case, the message is considered incoming (it must go through the server until it reaches the internal recipient/s) and it is scanned.

•	The sender of the message is included in the network or networks which are accessed with a Firewall CVP server, and the recipient is not included in it. In this case, the message is considered outgoing (it must go through the server towards the external recipient/s) and it is scanned.

•	The sender of the message is included in the network or networks which are accessed with a Firewall CVP server, and some of the recipients are also included in it (internal) but others are not (external). In this case, the message is considered incoming (it must go through the server towards the internal recipient/s) and outgoing (it must go through the server towards the external recipient/s). Therefore, the message will be scanned.

•	The sender is outside the network or networks which are accessed with a Firewall CVP server, and the recipients are not (internal). In this case, the message is considered incoming (it must go through the server towards the internal recipient/s) and the message will be scanned.

•	The sender is outside the network or networks which are accessed with a Firewall CVP server, and the recipient is also outside (external). In this case, the message is neither incoming nor outgoing (the message should not be delivered to any user of the network and should not go through the server). Therefore, the message will not be scanned.

•	The sender is outside the network or networks which are accessed with a Firewall CVP server, and the some of the recipients are also outside (external) but others are not (internal). In this case, the message is considered incoming (it must go through the server towards the internal recipient/s. Therefore, the message will be scanned. The message which the external sender, sends to external recipients is not relevant in this case.


Alerts Configuration in Firewall

In this section you can configure the alerts generated by the antivirus when a virus is detected. The options in this section are the following:

•	Replace an infected file with an alert when it is moved or deleted: files which must be moved or deleted (as the antivirus has detected that they are infected with a virus), are substituted by an HTML page. This page includes the alert text, which has already been selected (using the Text... button), and the information which corresponds to this type of alert.

•	Send notification to the administrator: when this option is selected, whenever a virus is detected, the administrator will be notified. In the Administrator Management section, the corresponding e-mail address must be entered. The content of this alert can be entered by clicking on the Text button. Also, by clicking on the Select button, the user can indicate what type of alert should be sent and configure the characteristics.

The following options are available for the configuration of every possible alert generated by the antivirus when a virus is detected:

•	Selected Alerts: in this section you can choose the types of warnings to be generated. You can choose to generate warnings characteristic of NetWare networks, or to send an e-mail message in SMTP, send a message through the Microsoft Exchange network and/or a Lotus Notes network.

•	Microsoft Network: if you have chosen to send a message through the NetWare network, you must indicate the recipient to whom you want the message to go as well as the message itself. As an additional feature, the possibility is offered of easily indicating that the message is to be transmitted to the network administrator, to the user of the file in which a virus has been detected, to the server console or to all the network users.

•	SMTP: if you have chosen to send an electronic mail message, you will have to indicate the server through which the message is to be sent, the recipient’s address, the subject of the message and the message itself.

•	MS Exchange: in this case, the Exchange network itself will be used to send the notification. Within this tab there are a number of other sections: profile, address, type.

•	Lotus Notes: if you have chosen to send an electronic mail message by Lotus Domino server, you will have to indicate the server through which the message is to be sent, the recipient’s address, the subject of Eamothe message and the message itself.


Monitoring of the Scan Status In Firewall

Monitoring is yet another means of obtaining information on the evolution of a scan in progress or on one that has already been completed. Clicking on the Monitor button in the Job Monitor displays a window that details information regarding the scan job selected from the list.


Pausing or Aborting a Scan in Firewall

If users press the Pause button in the scan monitor dialog box, the scan job currently selected will be momentarily paused. Then, the permanent scan will remain "frozen" (it continues to be exist but momentarily inactive) and the Pause button is renamed to Continue. When the Continue button is pressed, the scan job paused will go back into action.

Additionally, if a scan job is selected and the Abort button in the scan monitor is pressed, the scan job will terminate. This does not necessarily mean that it will disappear from the list. This means that the scan job is not eliminated, but rather continues to be listed, though inactive.


Basic Updates in Firewall

With basic updates, only one server can be selected at a time. After selecting basic update mode, click on the Next button. This allows you to select the characteristics of the update job and will guide you through the update process.

1.	Select type of programming:

•	Immediate. Is carried out as soon as it is created.

•	Scheduled. Is carried out on a given date/time, or frequency.

2.	When using scheduled updates, the characteristics must be set: Description (write the name you want to assign to the update job) and Time (indicate the time that the scheduled update must begin). There are two  types of scheduled updates:

•	Date: It will be carried out on a given date and at a given time. By clicking on the Next button, the Date of the update can be set.

•	Frequency: It will be carried out at regular intervals. By clicking on the Next button, you can set the frequency with which the job should be carried out: Weekly (any day of the week can be selected) or on a certain Day of the month.

3.	Select the items to be updated:

•	Update only the Signature File (PAV.SIG): only the file that allows the viruses to be detected will be updated (Update).

•	Update antivirus motor: updates the Signature File and the antivirus program itself (Upgrade).

It is advisable to carry out the updates (immediate or scheduled) corresponding to the antivirus motor when the server has less traffic.

4.	The update files can be found in a certain location. If one of them does not exist, a dialog box will appear informing you that the update cannot be carried out (the necessary files do not exist or they are not correct). Indicate from where the update must be carried out (place where the updated files are located):

•	Internet (Panda Software web page): The Virus Signature File will be updated from the Panda Software update web page. In order to do this it is necessary to enter the User name and Password to this update page. Furthermore, if the Internet connection is made through a Proxy server, you must check the box Connect via proxy server. In this case, indicate the corresponding IP Address and the number of the Port used. Before updating the files, it will check that the configuration is correct.

NOTE: the update via Internet is only available for the virus signature file, not for the whole antivirus program. When using scheduled updates, a session must be open with the server.

•	Panda Administrator Directory: the virus signature files and the antivirus files will be updated. They are located in the directory PAVSIG (where Panda Administrator was installed). Firstly, it checks that the update server service is installed correctly. If it is not, it indicates that this service must be installed. If it is, the update begins.

NOTE: the update is carried out through the Panda Administrator directory. Therefore, the computer in which it is installed must be in operation.

5.	By clicking on the Finish button, if it is an immediate update job, the update will begin. If it is a scheduled update job, it will be carried out at the scheduled time.


Advanced Updates in Firewall

After selecting advanced updates mode, click on the Next button. This allows you to select the update characteristics and will guide you through the update process.

Unlike the basic updates system, the advanced allows you to carry out different update jobs, which are the following:

•	New update. Allows you to create a new update job.

•	Consult existing update jobs. Allows you to edit, consult or modify the characteristics of existing update jobs (defined on previous occasions).

•	Delete Update server. Allows you to delete the update server service, which allows update jobs to be defined.


Advanced Update - New Update Job in Firewall

After selecting the server, click on the Update button and check New Update, the steps corresponding to the update job will begin.

1.	Select type of programming:

•	Immediate. Is carried out as soon as it is created.

•	Scheduled. Is carried out on a given date/time or frequency.

2.	When using scheduled updates, the characteristics must be set: Description (write the name you want to assign to the update job) and Time (indicate the time that the update must begin). There are two  types of scheduled updates:

•	Date: It will be carried out on a given date and at a given time. By clicking on the Next button, the Date of the update can be set.

•	Frequency: It will be carried out every so often. By clicking on the Next button, you can set the frequency with which the job should be carried out: Weekly (any day of the week can be selected) or on a certain Day of the month.

3.	Select the items to be updated:

•	Update only the Signature File (PAV.SIG): only the file that allows the viruses to be detected will be updated (Update).

•	Update antivirus motor: updates the Signature File and the antivirus program itself (Upgrade).

4.	The update files can be found in a certain location. Amongst which there is one called UPGRADE.DAT (it contains information on the files that must be updated and their location). If one of them does not exist or is not correct, the update cannot be carried out. Indicate from where the update must be carried out (place where the updated files are located):

•	Internet (Panda Software web page): The Virus Signature File will be updated from the Panda Software update web page. It is possible to select whether the update should be done directly or whether the corresponding files should be copied to a directory for the subsequent update:

•	One connection per server: for every server selected at the start of the process, a new connection to the update web page will be made and the corresponding files will be updated.

•	One connection for all of the servers leaving the information in: only one connection will be made to which the necessary files will be copied. The files, which are collected during the connection, will be saved in the location you indicate.

In either case, it is necessary to enter the User name and Password for accessing the update web page. Furthermore, if the Internet connection is made through a Proxy server, you must check the box Connect via proxy server. In this case enter the corresponding IP Address and the number of the Port used.

•	Panda Administrator Directory: the virus signature files and the antivirus files will be updated. They are located in the directory PAVSIG (where Panda Administrator was installed). Firstly, it checks that the update server service is installed correctly. If it is not, it indicates that this service must be installed. If it is, the update begins.

•	Other Location: it is possible to select any disk drive and directory in which the files, with which the update must be carried out, are located. The location can be selected, using the button which appears on the right. The update source may be located on a CD-ROM (it must be inserted in the CD drive). The following requirements must be met:

•	The disk drive and directory must correspond to a Windows NT server or workstation.

•	It must not be a mapped disk drive.

5.	With advanced updates, after carrying out the necessary configurations, the update job can be saved. To do this, check the corresponding box and name the job. This will not happen with updates scheduled by frequency, as they are always saved by default.

6.	By clicking on the Finish button, if it is an immediate update job, the update will begin. If it is a scheduled update job, it will be carried out at the scheduled time.


Advanced Update - Consult / Edit Update Job in Firewall

After selecting the server, click on the Update button and check Consult existing update jobs, the steps corresponding to the that update job will begin.

1.	Select computer/s. Select the computer/s, in which the update jobs you want to consult were saved (those in which the update server is located). Use the button which appears on the right and then click on Next.

2.	All of the existing update jobs in the computer will be displayed, as well as the corresponding data (description or job name, type and next execution).

•	In order to carry out (at that moment) one of the immediate updates in the list, select it and click on the Start button.

•	To access the properties of an update job, select it in the list and click on the Edit button. As well as consulting the properties, they can also be modified. Finally, other computers can be selected (as well as the current), on which the update job must also be carried out. In other words, the list of computers in which the update will be carried out, can be modified at any time (Add or Delete update jobs).

NOTE: the update jobs defined for a given platform cannot be used for other platforms. Furthermore, when an update job is edited, it is then considered as advanced.


Advanced Update - Delete the Update Job in Firewall

Note: when you choose to delete an update server, ALL THE UPDATE JOBS in the computer selected, will be deleted.

To delete the update server from a computer, follow these steps:

1.	Set up a connection with administrator privileges, if one does not already exist, for the server.

2.	From Panda Administrator, select the server.

3.	Click on the Update button, on the toolbar.

4.	Select Advanced update mode.

5.	Select the update job type: Delete the Update server.

By doing this, it will be indicated where the update service is installed. By clicking on the OK button, this service will be deleted. This means that ALL UPDATE JOBS IN THIS FILE SERVER WILL BE DELETED.


Description of Panda Administrator for Lotus Domino Servers

Panda Administrator can work with Lotus Domino 4.x and 5.0.x, under the platforms Windows NT 4.0 SP3 (or later version), or Windows 2000. It also allows you to use Lotus Domino 4.x and 5.0.x partitioned servers. The objective of Panda Antivirus for Lotus Domino servers is to scan all the components of the Lotus Domino system: Lotus servers (partitioned or not), documents (when they are created, opened or saved in the Lotus server data base), compressed files, message which include attached files (sent to one or several users), data bases (shared or not), servers which contain one or more mailboxes.

Panda Antivirus for Lotus Domino servers includes several types of scan: permanent, immediate and scheduled. The first type, continuously scan the system. It is done from the memory, which means that the scan is carried out much faster. Immediate scans are carried out the moment they are created by the administrator. Scheduled scans are carried out at a time previously specified by the administrator.

The main window of Panda Administrator shows the different servers found. The most commonly used options are located in a button bar in the upper part of the main window.

Panda Antivirus for Lotus Domino servers is managed through Panda Administrator.

To summarize, Panda Antivirus for Lotus Domino servers protects all files that are transferred from the outside, to one of the network computers. It also protects all files that are transferred from one of the network servers.


How to Install the Antivirus in Lotus Domino Servers

When installing Panda Antivirus for Lotus Domino servers, the following requirements must be met:

•	Pentium 133 Mhz or higher processor.

•	64 Mb of RAM memory (128 Mb recommended).

•	With servers which are not compartimentated, it is necessary to have a minimum of 10Mb available on the hard disk.

•	With compartimentated servers, it is necessary to have 10 Mb available on the hard disk, as well as 10 Kb for every antivirus to be installed.

•	Have a Windows NT 4.0 SP3 (or later version) or Windows 2000 platform.

•	Lotus Domino 4.5, or later version must be installed.

•	Have an account (with administrator privileges), in the Windows NT server where the Lotus server is installed.

NOTE: Lotus Domino servers can be partitioned. Panda Antivirus for Lotus Domino servers takes this possibility into account and reacts accordingly. It allows a maximum of six partitioned servers and it is possible to perform installations, scans, configurations, updates, uninstallations in any of them (as well as in the servers which are not partitioned).

Once all of these prerequisites are met, the antivirus installation process can be started. Firstly a connection must be opened, with the server/s in which Panda Antivirus for Lotus Domino servers is going to be installed. This connection must have administrator privileges, which can be established before executing Panda Administrator (the program will recognize if a connection was established before it was executed), or from Panda Administrator itself.

After establishing a connection and opening Panda Administrator, choose the Lotus Domino server in which you want to install the antivirus. Then click on the Install button on the toolbar.

The version of the operating system installed in the server will automatically be checked. If it is possible to install the antivirus in this server (as it meets all the requirements), an Installation Wizard will appear, which will guide you through the installation step-by-step. This will guide you through the installation process. This process depends on the type of server selected:

1.	If you have selected partitioned servers amongst the servers you have chosen, it is necessary to select which ones must carry out the installation and which ones must not. To facilitate this task, Panda Antivirus for Lotus Domino servers displays a dialog box (on antivirus installations, configurations, scans, updates or uninstallations). From this box it is possible to select each and every partitioned server.

2.	Select Lotus Domino server restart. It is possible to choose if you want the installation process to stop and restart the server automatically on completing installation. After completing the installation, the antivirus only functions when the server is stopped and restarted.

3.	Administrator domain and account. This second installation step requires you to enter the following administrator data: Account and Password (as well as confirmation of the password). It must be taken into account, that if you are working with partitioned servers, the account and password will be the same for all of them (the account and password for all of the computers should be entered in only one of them).

4.	The file copy process will begin immediately, and once this has finished, the installation of the antivirus on the selected server(s) will have concluded.

Note: If you selected stop and restart in the first step, the Lotus Domino server will be restarted, so that the installation of the antivirus will come into effect. Otherwise, remember that the antivirus will only work when this happens.


How to Configure the Antivirus in Lotus Domino Servers

Panda Antivirus for Lotus Domino servers includes not only immediate scans but also scheduled scans, as well as permanent protection. Permanent protection continuously scans any documents, databases and /or messages it is working with. The administrator can configure any of the above scans when necessary.

Furthermore, if a virus is detected the antivirus can also send alerts, to different recipients and from different sources. To do this, it allows you to select how they will automatically be sent, (Microsoft Network, SMTP, MS Exchange, Lotus Notes).

To configure the antivirus in Lotus Domino servers, select them from the Panda Administrator server tree and click on the Configure button in the toolbar. If you are working with partitioned servers you must indicate which ones the configuration must be applied to (it is advisable to read the section Selecting Lotus Domino servers with partitioning, in this help). After selecting the servers you want to configure (with or without partitioning), a dialog box containing the following three files will be displayed:

Permanent Protection Configuration.

On-demand Scanning Configuration.

Reports Configuration.


How to Scan a Lotus Domino Server

To facilitate management, all scan activities are pooled in the same section. To monitor a scan or to carry out new scans, select the server/s in question and click on the Scan button. It is possible to select Lotus Domino servers which use the partitioning system. In this case, to select each of these servers correctly, follow the steps explained in the section Selecting Lotus Domino Partitioned Servers in this help. After selecting the servers (with or without partitioning), you will be able to access each and every scan (immediate and/or scheduled) and set every one of its characteristics.

This way you will be allowed to access the scan monitor window. The central part of the scan monitor displays either currently active or scheduled scan jobs. The followig details will be displayed on this area: the name of each scan job along with the scan type (permanent protection, immediate or scheduled), the number of viruses found, the scan status and the next time the scan will be activated (only on scheduled scans).

Panda Antivirus for Lotus Domino servers includes permanent scans which continuously scan the system and furthermore, it also includes scans which the administrator can carry out. These scans can be Immediate and/or Scheduled. The former, are automatically executed once they have been defined, whilst scheduled scans allow you to set the date and time (or the frequency) they should automatically be performed.

To access the scans, select the server you want to scan and click on the Scan button in the Panda Administrator toolbar.

There is always one scan job present in the central area which corresponds to permanent protection. The options available in the Scan Job Monitor are the following:

Add and/or Create a new scan job.

Delete a scan job.

Edit and/or Modify a scan job.

Presentation of scan job reports.

Monitoring a scan job.

Stop and Abort a scan job.


Presentation of Scan Job Reports in Lotus Domino Servers

Panda Antivirus offers you the possibility of creating a report file in which the activities of each scan performed are summarized. This report will be saved in a file that can be assigned a maximum size. This information is very useful, as it lets you see the work that has been carried out, the date and time the scan was performed and the results obtained.

The information shown is listed in columns. The first column details the date and time the detection was made, and the second indicates the name of the virus detected. If you need a hard copy of this information, just click on the Print button. On the other hand, when you have finished viewing the information, you need only click the Seen button to close the window and return to the application. You are also offered the possibility of deleting the report. To do this, just click on the Delete button. With this, you will delete the entire report containing all the scan activity data.

The information that appears in this report window is only a summary of the complete data available. By double clicking on any of the listed scans, the following additional information will be provided:

•	Date and time: this shows the date and time that the detection occurred.

•	Name of virus: this field shows the name of the virus detected.

•	Path: this may indicate two things. First, if you are dealing with a compressed archive containing infected files, the Path field will indicate the name of the compressed archive that contains the infected files. On the other hand, if the infected file is not found in a compressed archive, this field will specify the name of the infected file, leaving the following information field (File) blank.

•	File: this is the name of the infected file in which the virus has been detected.

•	Type of detection: indicates through which type of scanning the virus has been detected.

•	Action: informs about the action that should have been taken at the time the virus was detected.

•	Operation carried out: displays the action taken by the antivirus.

To conclude this section, it is worth noting that there only exists one results report. Some users may confuse the information obtained by clicking on the Monitor button, located in the Job Monitor window, for a report, when this is in fact only a presentation of the properties and activities of the scan job in progress.


How to Update the Antivirus in Lotus Domino Servers

To update Panda Antivirus for Lotus Domino servers, open a connection with the server from which the update will be carried out. This connection must have administrator privileges.

The update of the antivirus for Lotus Domino servers, has certain special characteristics which are worth highlighting:

•	It is possible to update not only the virus signature file (update only the file which allows the virus detections to be carried out, therefore, the antivirus will detect more viruses), but also the entire antivirus program (the antivirus will also include new advantages, as well as more potential and more possibilities.

•	The update can be immediate (it will be carried out at that moment) or scheduled (the antivirus will carry out the update on a given date).

•	It is possible to select from where the update files must be copied: from a specified Panda Administrator directory, from Internet (Panda Software Web page), or from a folder which corresponds to the update server.

•	It is possible to carry out operations related to updates. For this reason they are considered update jobs. Update jobs can be saved, edited to modify or create new jobs, or deleted. To sum up, whether you are saving or editing, any characteristic of a scan can be saved to use when creating another. For this reason, it will be possible to create new update jobs, modify existing jobs and use them to create others, or delete the list of jobs.

The antivirus updates for Lotus Domino servers can be considered as jobs. There are various types (creation, viewing or consultation, modification, and even removal of update jobs). However, every one of these operations has some common preliminary steps:

1.	You will need to have a connection open with the server from which you want to carry out the update job. This connection must have administrator privileges. If it is already open before executing Panda Administrator, it will be automatically recognized. If it is not, it can be opened from Panda Administrator.

2.	From the Panda Administrator window, select the server from which you want to carry out an update job.

3.	Click on the Update button, in the toolbar.

4.	As it is a Lotus Domino server, it must be taken into account that that some of the servers may be partitioned. In this case, before starting the update process, it is necessary to select every partitioned server you want to update.

5.	Select the Update Mode. There are  two options: Basic Updates or Advanced Updates. From this point on, it will be possible to select all the actions related to update jobs.


How to Uninstall the Antivirus for Lotus Domino Servers

To uninstall Panda Antivirus from Lotus Domino servers, you will need to have a connection open with the server with administrator privileges

If that connection is open before executing Panda Administrator, the program will automatically detect it. If it has not been opened previously, it can be opened from Panda Administrator.

Once a connection with administrator is open, select the preferred server (so that it appears in the servers branch of Panda Administrator, it must be installed and running) and click on the ‘Uninstall’ button on the toolbar. A wizard will appear to help you with the uninstallation process.

1.	A window will appear indicating that the service, which corresponds to the server, will automatically be restarted when uninstallation is complete. To uninstall the antivirus completely, the service of the Lotus Domino server needs to be restarted. If the antivirus corresponds to partitioned servers, a window will appear which shows the status of the antiviruses installed in the computer/s. It is possible to select each antivirus (servers) which you want to uninstall and continue with the uninstallation process.

2.	If you accept the uninstallation, the process will begin and a window will be shown with a progress bar enabling you to follow the uninstallation process, which only takes a few seconds.

3.	When uninstallation is complete, the service which corresponds to the Lotus Domino will stop and restart (the server will not be restarted).

When these steps are completed, the antivirus software will have been removed from the server.


Selecting Lotus Domino Servers with Partitioning

Panda Antivirus for Lotus Domino servers allows you to work with up to a maximum of six (the maximum allowed by Lotus) Lotus servers which include partitioning. Whenever a Lotus server of these characteristics intervenes in an operation carried out with the antivirus (install, configure, scan or uninstall), you must select every Lotus Domino server with which you want to work.

For this reason, Panda Antivirus for Lotus Domino servers displays a dialog box which shows certain information. Every Lotus Domino partitioned servers is displayed. If the server icon is displayed, it means that the antivirus is not installed. If the Panda Software bear logo appears, it means that the antivirus is installed in that server. It may be enabled (green bear icon) or disabled (gray bear icon). Furthermore, the second column indicates the directory where the NOTES.INI file is located. If you are working with partitioned servers, it will be the DATAx directory (where x is the partitioned server number). Finally, the status of the server will be shown (stopped or started) and the status of the antivirus (not installed, enabled, or disabled).

In the dialog box you can select the partitioned servers you want to work with. In these servers, Panda Antivirus for Lotus Domino will be installed, configured, scanned, updated or uninstalled.

The initial information shown in the partitioned servers list corresponds to all those which it has been able obtain information about. However, there may be others. For example, information may appear about one of the partitioned servers installed in a particular computer, but not about the rest. To display the information about the rest of the partitioned servers, click on the button which appears at the bottom of this dialog box (on the left of the Add button).

By doing this, you can access the directories which contain the different partitioned servers. To be able to this, the directory which contains them (where the Lotus Domino server is installed), must be shared.

Through this hierarchical structure of directories shown, you must open the corresponding branches, until you reach the directory where the Lotus Domino server is installed. Beneath this directory you will be able to see the different partitioned servers (no more than six), in their corresponding DATAx directories (where x is the number which corresponds to a given partitioned server). Then, select the DATA directory you are interested in, and click on the OK button. This selects the partitioned server you are interested in. To include it in the list, you only have to click on the Add button.

When all the Lotus Domino partitioned servers you want to include, have been added, they can be selected from the list to carry out any operation with them. In this case, select them and click on the OK button. The process corresponding to the operation you want to carry out (install, configure, scan or uninstall) will continue as usual.

NOTE: Remember, if you are working with partitioned servers, they all have the same user name and password (as they are located in the same computer).


Permanent Protection Configuration in Lotus Domino Servers

Panda Antivirus for Lotus Domino servers includes permanent protection, which observes all the operations of documents, databases, messages,... etc. which are carried out with Lotus Domino servers. Permanent protection starts working automatically when the Lotus server is started up. It also observes all the operations carried out with compressed files. To configure this type of scan, there are several options:

General options:

•	Enable: this option determines whether or not permanent protection will be enabled.

•	Scan compressed files: if this option is checked, all the compressed files which are intercepted will be scanned.

•	Generate report: this option enables the creation of a report which will reflect the activity of the antivirus software.

If a virus is found:

•	Ignore: if this option is checked and a virus is found, the antivirus will notify you of the discovery, but will take no further action.

•	Disinfect: if this option is checked and a virus is found, the antivirus will attempt to disinfect the infected file.

•	Delete: if you mark this option and a virus is discovered, the antivirus will erase the infected file.

•	Move to: if this option is checked and a virus is found, the antivirus will move the infected file to a location which you have indicated in the text box which is displayed for that purpose. A button next to this box allows you to choose a directory easily.

If disinfection is not possible:

•	Rename file: if this option is checked and the antivirus has not been able to disinfect a contaminated file, this file will be renamed.

•	Delete file: if this option is checked and the antivirus has not been able to disinfect a contaminated file, this file will be erased.

•	Move to: if this option is checked and a virus is found, the antivirus will move the infected file to a location which you have indicated in the text box which is displayed for that purpose.

The configuration Permanent Protection, also allows you to make other selections, such as those related to security, the format of the files to be scanned and their extensions, and virus alerts which should be sent when a virus is detected.

EXTENSIONS configuration.

ALERTS configuration.

AVANCED configuration.


Configuration of Extensions to be Scanned in Lotus Domino Servers

By clicking on the on the Extensions button which appears in the configuration dialog box, you can select the extensions. In this section you can configure the extensions which the permanent protection feature must scan in search of viruses. Regardless of the selection of extensions you may make, EXE and COM files will always be scanned. The options offered by the extensions window are:

•	Scan all extensions: if this option is marked, all extensions will be scanned, regardless of what may have been specified in the rest of this window.

•	New extension: here you can enter a new extension to add it to the list of extensions to be scanned.

•	Add extension: when you click on the > button, the extension indicated in the New extension section will be added to the list of extensions which must be scanned.

•	Remove extension: when you select an extension from the list of extensions to be scanned and press the  < button, the selected extension is eliminated from the list.

•	Default extensions: if you press this button, the list of extensions to be scanned returns to its default configuration.

•	Clear: when you click on this button, the list of extensions is cleared.


Alerts Configuration in Lotus Domino Servers

By clicking on the Notify... button which appears in the configuration dialog box, you can configure the warnings that the antivirus generates when a virus is detected. In this section you can configure the notifications which the antivirus tool will generate when it finds a virus. The options found here are the following:

•	Selected Alerts: in this section you can choose the types of warnings to be generated. You can choose to generate warnings characteristic of Microsoft networks and / or to send an electronic mail message in SMTP format.

•	Microsoft Network: if you have chosen to send a message through the Microsoft network, you must indicate the recipient or domain to which you want the message to go as well as the message itself.

•	SMTP: if you have chosen to send an electronic mail message, you will have to indicate the server through which the message is to be sent, the recipient’s address, the subject of Eamothe message and the message itself.

•	MS Exchange: in this case, the Exchange network itself will be used to send the notification. Within this tab there are a number of other sections: profile, address, type.

•	Lotus Notes: if you have chosen to send an electronic mail message by Lotus Domino server, you will have to indicate the server through which the message is to be sent, the recipient’s address, the subject of Eamothe message and the message itself.


On-demand Scanning Configuration for Lotus Domino Servers

From Panda Administrator you can scan any hard disk in the Lotus Domino server or any directory or file on one of the server’s hard disks. Each time a scan is performed on demand, you can choose the configuration of that scan but you can also indicate a default configuration. The configuration options are as follows:

General options:

•	Generate report: if you check this option, a report will be generated which will reflect the activity carried out by the antivirus software.

•	Scan compressed files: if you mark this option, all compressed files found will be scanned.

If a virus is found:

•	Ignore: if this option is checked and a virus is found, the antivirus will notify you of the discovery, but will take no further action.

•	Disinfect: if this option is checked and a virus is found, the antivirus will attempt to disinfect the infected file.

•	Rename file: if this option is checked and a virus is found, the antivirus will rename the infected file.

•	Delete file: if you mark this option and a virus is discovered, the antivirus will erase the infected file.

•	Move to: if this option is checked and a virus is found, the antivirus will move the infected file to a location which you have indicated in the dialog box provided for that purpose. A button next to this box allows you to easily choose a directory.

If disinfection is not possible

•	Rename file: if this option is checked and the antivirus has not been able to disinfect a contaminated file, this file will be renamed.

•	Delete file: if this option is checked and the antivirus has not been able to disinfect a contaminated file, this file will be erased.

•	Move to: if this option is checked and a virus is found, the antivirus will move the infected file to a location which you have indicated in the dialog box provided for that purpose. A button next to this box allows you to easily choose a directory.

In addition to the options mentioned above, the configuration of on demand scans has a button which enables you to configure the extensions which must be scanned.

EXTENSIONES Configuration.

ALERTS Configuration.

AVANCED Configuration.


Scan Report Configuration in Lotus Domino Servers

The information the antivirus generates when it performs certain operations can be saved in a file where all incidents are stored. It does not only include the viruses detected by the antivirus.

Once the antivirus configuration in one of the Lotus Domino servers has been accessed and the dialog box appears, select the Reports file. The following options will appear:

Incidents to be logged in the report. Using this checkbox, the incidents which the antivirus must include in the report can be set. The options are as follows:

•	Virus detection. The antivirus will include every virus incident in the report it generates. This means that, everytime a virus is detected, the antivirus will save the following information in the report: date and time  the virus was detected, file infected, where the infected file was found, virus detected… etc.

•	Start and end the antivirus service. Indicates when (date/time) it started running and when it ended.

•	Software and virus signature file update. Update the antivirus and the virus signature file. Indicates when the software or virus signature file (PAV.SIG) update should be carried out. It also indicates if this update was carried out correctly.

•	Configuration modifications. Indicate when global changes related to the antivirus configuration have been carried out.  It also takes into account the enabling or disabling of the permanent protection, indicating whether it has been cancelled or enabled

Maximum size: you can set a maximum size for the report generated by the antivirus in order to avoid letting the report take up too much hard disk space.


Add and/or Create a New Scan Job in Lotus Domino Servers

By clicking on the Add, button in the Scan Monitor, a wizard will appear to facilitate the introduction of a new job.

1.- Type of scan job

Two types of scan jobs can be created: immediate or scheduled. The former is carried out the moment it is created. The latter allows you to establish a scanning “calendar” so that scan jobs can be executed periodically.

2.- Scan paths

You must indicate the areas of the server that will be scanned. The areas that have a checkmark on their left will be scanned. The All button allows you to easily indicate that the entire server should be scanned

3.- Job configuration

Allows you to specify the general scan options, the action to take when a virus is detected, the extensions to scan, possible exclusions (areas that should not be scanned) and the warnings that will be generated when a virus is detected.

4.- Scheduling

If it is a scheduled task, at this point we can establish when the scanning in question should be executed. The start time and date has to be indicated along with the periodicity with which the task is to be executed. It is advisable to assign a name to the task that permits it to be easily recognized at a later date. In the case of scheduled tasks, this is the time to specify the schedules that you wish to assign. For each task the following data can be specified:

•	Description: it is advisable to assign a name to each job so that it can be easily identified later.

•	Start date: indicates the date on which the scan will begin. Next to the date the scan start time is also indicated.

•	Frequency: you can indicate a weekly, monthly or even a combined weekly and monthly frequency. Thus, you can schedule a given job for each Monday and Friday, the 10th and 20th of each month or any other combination.

•	CPU load: here you assign a priority to the scan job. If you indicate a high CPU load, the scan job will be executed with a high priority. If you indicate a low CPU load, the job will be performed with a low priority.

•	Abort at: thanks to this option, you can cancel a scan job if it is not completed by a certain time.

•	End date: to complete the scheduling of jobs, you can also indicate an end date for the scheduled job. The job will thus remain in effect only between the two dates you indicate.

•	Status: allows you to indicate the status of the scan job in case you wish to deactivate it temporarily. Jobs in inactive status will not be executed again until their status has been changed to active again.

5.- Summary

In this last step, a summary of the information you have provided is shown. If you decide to continue, the scan job will be created.


Delete a Scan Job in Lotus Domino Servers

The list that appears in the Job Monitor, shows every scan job defined (created), although they are running at the time (for example, scheduled scan). In this list, it is possible to select any of the scan jobs to work on. By clicking on the Delete button you can remove the scan job selected in the list in the monitor.

Any scan job, immediate or scheduled can be deleted whether it is being run or not. However, the permanent protection scan job can never be deleted.


Edit or Modify a Scan Job in Lotus Domino Servers

The permanent scan job monitor allows you to carry out modifications or access the status of an existing scan job. To do this, select a scan job from the list (in the monitor) and click on the Edit button. It is possible to modify any of the scan job properties which have been edited.


Monitoring a Scan Job in Lotus Domino Servers

By clicking on the Monitor button in the scan job list (Scan job monitor), information about the scan job will be displayed (files scanned, viruses detected, information on the file being scanned, etc).


Stop and Abort a Scan Job in Lotus Domino Servers

Click on the Stop button in the scan job monitor dialog box, the scan job selected from the list will be temporarily stopped. The scan job will be “frozen” (it exists but it is not running) and the Stop button changes to Continue. When you click on the Continue button the previously stopped scan job will be resumed.

On the other hand, if a scan job is selected and you click on the Abort button in the Scan job monitor window, this scan job will be permanently cancelled. This does not mean that the scan job has disappeared from the list. It is still in the list but it is not running.


Avanced Configurations in Lotus Domino Servers (Heuristic scans)

One of the interesting possiblities of Antivirus for Lotus Domino, is heuristic scans. This scan detects the vast majority of unknown viruses. It is possible to determine the level of  sensitivity that the scan should have.

Enabled: when this box is checked, the scan must have heuristic techniques. This means that, not only will the scan search for known viruses but it will also be able to detect more recent unknown viruses.

Level of Sensitivity

•	Maximum sensitivity: the scan will display alerts (as if it were detection) when there is the slightest sign that a file may be infected with a virus.

•	Medium sensitivity (recommended): the scan will use heuristic techniques to scan any files with suspicious characteristics, but it will not spend too much time on this control.

•	Minimum sensibility: the antivirus will only take care of those files which could have a high probability of being infected by a virus.


Basic Updates in Lotus Domino Servers

With basic updates, only one server can be selected at a time. After selecting basic update mode, click on the Next button. This allows you to select the characteristics of the update job and will guide you through the update process.

1.	Select type of programming:

•	Immediate. Is carried out as soon as it is created.

•	Scheduled. Is carried out on a given date/time, or frequency.

2.	When using scheduled updates, the characteristics must be set: Description (write the name you want to assign to the update job) and Time (indicate the time that the scheduled update must begin). There are two  types of scheduled updates:

•	Date: It will be carried out on a given date and at a given time. By clicking on the Next button, the Date of the update can be set.

•	Frequency: It will be carried out at regular intervals. By clicking on the Next button, you can set the frequency with which the job should be carried out: Weekly (any day of the week can be selected) or on a certain Day of the month.

3.	Select the items to be updated:

•	Update only the Signature File (PAV.SIG): only the file that allows the viruses to be detected will be updated (Update).

•	Update antivirus motor: updates the Signature File and the antivirus program itself (Upgrade).

It is advisable to carry out the updates (immediate or scheduled) corresponding to the antivirus motor when the server has less traffic.

4.	The update files can be found in a certain location. If one of them does not exist, a dialog box will appear informing you that the update cannot be carried out (the necessary files do not exist or they are not correct). Indicate from where the update must be carried out (place where the updated files are located):

•	Internet (Panda Software web page): The Virus Signature File will be updated from the Panda Software update web page. In order to do this it is necessary to enter the User name and Password to this update page. Furthermore, if the Internet connection is made through a Proxy server, you must check the box Connect via proxy server. In this case, indicate the corresponding IP Address and the number of the Port used. Before updating the files, it will check that the configuration is correct.

NOTE: the update via Internet is only available for the virus signature file, not for the whole antivirus program. When using scheduled updates, a session must be open with the server.

•	Panda Administrator Directory: the virus signature files and the antivirus files will be updated. They are located in the directory PAVSIG (where Panda Administrator was installed). Firstly, it checks that the update server service is installed correctly. If it is not, it indicates that this service must be installed. If it is, the update begins.

NOTE: the update is carried out through the Panda Administrator directory. Therefore, the computer in which it is installed must be in operation.

5.	By clicking on the Finish button, if it is an immediate update job, the update will begin. If it is a scheduled update job, it will be carried out at the scheduled time.


Advanced Updates in Lotus Domino Servers

After selecting advanced updates mode, click on the Next button. This allows you to select the update characteristics and will guide you through the update process.

Unlike the basic updates system, the advanced allows you to carry out different update jobs, which are the following:

•	New update. Allows you to create a new update job.

•	Consult existing update jobs. Allows you to edit, consult or modify the characteristics of existing update jobs (defined on previous occasions).

•	Delete Update server. Allows you to delete the update server service, which allows update jobs to be defined.


Advanced Update - New Update Job in Lotus Domino Servers

After selecting the server, click on the Update button and check New Update, the steps corresponding to the update job will begin.

1.	Select type of programming:

•	Immediate. Is carried out as soon as it is created.

•	Scheduled. Is carried out on a given date/time or frequency.

2.	When using scheduled updates, the characteristics must be set: Description (write the name you want to assign to the update job) and Time (indicate the time that the update must begin). There are two  types of scheduled updates:

•	Date: It will be carried out on a given date and at a given time. By clicking on the Next button, the Date of the update can be set.

•	Frequency: It will be carried out every so often. By clicking on the Next button, you can set the frequency with which the job should be carried out: Weekly (any day of the week can be selected) or on a certain Day of the month.

3.	Select the items to be updated:

•	Update only the Signature File (PAV.SIG): only the file that allows the viruses to be detected will be updated (Update).

•	Update antivirus motor: updates the Signature File and the antivirus program itself (Upgrade).

4.	The update files can be found in a certain location. Amongst which there is one called UPGRADE.DAT (it contains information on the files that must be updated and their location). If one of them does not exist or is not correct, the update cannot be carried out. Indicate from where the update must be carried out (place where the updated files are located):

•	Internet (Panda Software web page): The Virus Signature File will be updated from the Panda Software update web page. It is possible to select whether the update should be done directly or whether the corresponding files should be copied to a directory for the subsequent update:

•	One connection per server: for every server selected at the start of the process, a new connection to the update web page will be made and the corresponding files will be updated.

•	One connection for all of the servers leaving the information in: only one connection will be made to which the necessary files will be copied. The files, which are collected during the connection, will be saved in the location you indicate.

In either case, it is necessary to enter the User name and Password for accessing the update web page. Furthermore, if the Internet connection is made through a Proxy server, you must check the box Connect via proxy server. In this case enter the corresponding IP Address and the number of the Port used.

•	Panda Administrator Directory: the virus signature files and the antivirus files will be updated. They are located in the directory PAVSIG (where Panda Administrator was installed). Firstly, it checks that the update server service is installed correctly. If it is not, it indicates that this service must be installed. If it is, the update begins.

•	Other Location: it is possible to select any disk drive and directory in which the files, with which the update must be carried out, are located. The location can be selected, using the button which appears on the right. The update source may be located on a CD-ROM (it must be inserted in the CD drive). The following requirements must be met:

•	The disk drive and directory must correspond to a Windows NT server or workstation.

•	It must not be a mapped disk drive.

5.	With advanced updates, after carrying out the necessary configurations, the update job can be saved. To do this, check the corresponding box and name the job. This will not happen with updates scheduled by frequency, as they are always saved by default.

6.	By clicking on the Finish button, if it is an immediate update job, the update will begin. If it is a scheduled update job, it will be carried out at the scheduled time.


Advanced Update - Consult / Edit Update Job in Lotus Domino Servers

After selecting the server, click on the Update button and check Consult existing update jobs, the steps corresponding to the that update job will begin.

1.	Select computer/s. Select the computer/s, in which the update jobs you want to consult were saved (those in which the update server is located). Use the button which appears on the right and then click on Next.

2.	All of the existing update jobs in the computer will be displayed, as well as the corresponding data (description or job name, type and next execution).

•	In order to carry out (at that moment) one of the immediate updates in the list, select it and click on the Start button.

•	To access the properties of an update job, select it in the list and click on the Edit button. As well as consulting the properties, they can also be modified. Finally, other computers can be selected (as well as the current), on which the update job must also be carried out. In other words, the list of computers in which the update will be carried out, can be modified at any time (Add or Delete update jobs).

NOTE: the update jobs defined for a given platform cannot be used for other platforms. Furthermore, when an update job is edited, it is then considered as advanced.


Advanced Update - Delete the Update Job in Lotus Domino Servers

Note: when you choose to delete an update server, ALL THE UPDATE JOBS in the computer selected, will be deleted.

To delete the update server from a computer, follow these steps:

1.	Set up a connection with administrator privileges, if one does not already exist, for the server.

2.	From Panda Administrator, select the server.

3.	Click on the Update button, on the toolbar.

4.	Select Advanced update mode.

5.	Select the update job type: Delete the Update server.

By doing this, it will be indicated where the update service is installed. By clicking on the OK button, this service will be deleted. This means that ALL UPDATE JOBS IN THIS FILE SERVER WILL BE DELETED.