Computer viruses and malicious computer programs

As the number of computer users increases and the exchange of data via the Internet and email becomes more available, there is an increased threat of computer virus infection and data corruption or capture by malicious computer programs or malware.
In order to be aware of potential threats to your computer, it is helpful to know what the types of malicious software ("malware") are and how they work. In general, malicious programs fall into one of the following three categories:
  • Worms use network resources for distribution. These programs were called "worms" because of their ability to tunnel from one computer to another, using networks, email and other channels. Due to this ability, worms can spread extremely fast.
    Worms penetrate a computer, determine IP addresses of other computers, and send copies of themselves to these computers. Worms also utilize data contained in the address books of mail clients installed on the infected machine. They can create work files on disks but may not utilize any resources of the infected computer except memory.
  • Viruses infect computer programs by altering the way that infected programs work to gain control when the infected program is running. This simple definition helps determine that the main action a virus performs is infecting computer programs. Viruses spread somewhat slower than worms.
  • Trojan horses perform unauthorized actions on infected computers: for instance, they can erase information on hard drives, "freeze" the system, steal confidential information. In the strict sense, Trojan Horses are not viruses as they do not infect programs or data, and are unable to sneak independently into computers but are distributed by malicious users as "useful" software. Still the damage inflicted by Trojans may be far greater than from a regular virus attack.
Recently, worms have become the most widespread type of malware, followed by viruses and Trojans. Some malicious computer programs have characteristics of two or even all three of the above categories.
Although malicious programs are distributed mainly via email and the Internet, a floppy disk or a CD can also be a source of infection. Therefore, the task of comprehensive protection from potential threats now extends far beyond simple regular scans for viruses, and includes the more complex task of real-time anti-virus protection.
Henceforth in the text of this Help the term "virus" will be used to refer to viruses, Trojan Horses and worms. A particular type of malware will be mentioned only when it is required.
Kaspersky Lab
WWW: http://www.kaspersky.com

E-mail: support@kaspersky.com


The purpose and major functions of Kaspersky Anti-Virus Personal

Kaspersky Anti-Virus Personal (hereinafter referred to as Kaspersky Anti-Virus or the application) is designed to provide anti-virus protection of personal computers running Windows (see section Hardware and software system requirements).
Kaspersky Anti-Virus performs the following functions:
  • Protection against viruses and malicious computer programs - the application detects and eradicates viruses that attempt to penetrate computers via removable and permanent storage devices, email and Internet protocols. When using the application, the following modes can be used (either jointly or separately):
    • Real-time anti-virus protection - performs an anti-virus scan of all objects being run, opened or saved.
    • On-demand scan - performs an anti-virus scan and disinfection of your entire computer or of selected disks, files, or folders. You can launch an on-demand scan manually or set up a regular scheduled scan.
  • Recovery from a virus attack - performing a full scan and disinfection using settings recommended by Kaspersky Lab will allow you to eradicate any viruses that have infected your files during a virus attack.
  • Scanning and disinfecting of incoming/outgoing email traffic - real-time protection performs an anti-virus scan and disinfection of incoming email messages before they are downloaded to your Inbox1, and of outgoing mail. In addition, the application provides on-demand scanning and disinfection of the email databases of various email clients2 (see section Protecting your mail from viruses).
  • Updating of the anti-virus database and application modules - your computer's protection is kept current by updating the anti-virus database with information about new viruses, and with methods for disinfecting objects infected with these viruses. Updates are downloaded from Kaspersky Lab's update servers or copied from a local folder in your computer.
  • Recommendations on application setup and operation - tips from Kaspersky Lab will guide you while you use Kaspersky Anti-Virus. Installation is quicker and more straightforward because the default settings are the recommended settings for optimal anti-virus protection.

When infected or possibly infected files are found, if the anti-virus database has been not updated for a critically long time, or your computer has not been scanned for a long time, the main window of Kaspersky Anti-Virus will recommend a course of action and give a supporting explanation. We have customized our application to achieve optimal performance based on the extensive expertise of Kaspersky Lab in the anti-virus protection business, and on feedback from application users. The recommended anti-virus protection settings are installed as the default application settings.

  • Quarantine - a special secure storage area where possibly infected objects are placed. You can then disinfect or delete the quarantined objects, restore them to their initial folders or send them to Kaspersky Lab for analysis. Quarantined files are stored using a special format and do not constitute any danger to your computer.
  • Reporting - results of all actions performed by Kaspersky Anti-Virus are documented in reports. A detailed scan report contains statistics of all scanned objects, settings used for each task and the history of actions performed on each individual file. Reports are also generated during real-time protection, and after updating the anti-virus database and application modules.

See also:

What's new in Version 5.0?

Hardware and software system requirements

Services provided for registered users

1The program checks only email messages received via the POP3 protocol and sent via the SMTP protocol.
2Kaspersky Anti-Virus can scan email databases for any email client program, but can disinfect only MS Outlook and MS Outlook Express email databases.


What's new in Version 5.0?

Kaspersky Anti-Virus Personal 5.0 has the following features not found in Version 4.5:
  • Maintaining scanned objects database. Version 5.0 does not scan previously analyzed objects that have not changed since their last scan. This applies both to real-time protection and to the on-demand scan. This feature greatly improves the application's speed and performance.
  • Version 5.0 scans and disinfects incoming and outgoing email messages for any email client that receives mail using the POP3 protocol and sends mail using the SMTP protocol. The previous version protected only Microsoft Exchange-compatible email clients.
  • Disinfecting infected archives. Version 5.0 disinfects infected files in zip, arj, cab, and rar archives. The previous version provided detection and disinfection of infected files in zip archives only.
Kaspersky Anti-Virus only scans self-extracting archives but does not disinfect them
  • User-friendly interface. Version 5.0 is a single application, whereas the previous release consisted of several components each performing their own anti-virus protection function. This new approach simplifies control over the most important application functions. For example, the anti-virus protection level can be set by simply moving a slider rather than editing settings.
  • Recommended settings and experts' tips. To simplify application operation, the default settings of this version of the application match the settings recommended by Kaspersky Lab, so there is no need to configure the application before use. When the anti-virus protection level is set to High Speed, the user is prompted to switch to a higher level of anti-virus protection.
  • Product license renewal. Users of Version 5.0 can now install a new license key, extending the license period.
  • Sending your files for analysis to Kaspersky Lab. Now you can send us possibly infected files detected by Version 5.0 or files that you suspect may be infected.
  • The ability to delete infected composite objects has been removed. You will not be able to delete infected composite objects (archives, email clients' databases or email files) using Version 5.0. However, you can still delete such objects, with the exception of self-extracting archives, using standard Windows tools such as Windows Explorer.

See also:

The purpose and major functions of Kaspersky Anti-Virus Personal

Hardware and software system requirements

Services provided for registered users


Hardware and software system requirements

For normal performance of Kaspersky Anti-Virus Personal 5.0, your computer must meet the following minimum requirements:
General Requirements:
  • 50 MB available space on your hard drive
  • CD-ROM drive (for installation of Kaspersky Anti-Virus from CD)
  • Microsoft Internet Explorer 5.5 (for updating the anti-virus database and application modules via the Internet)
Windows 98:
  • Intel Pentium 133 MHz processor
  • 32 MB RAM
Windows ME:
  • Intel Pentium 150 MHz processor
  • 32 MB RAM
Windows NT Workstation 4.0 (Service Pack 6a):
  • Intel Pentium 133 MHz processor
  • 32 MB RAM
Windows 2000 Professional (Service Pack 2 or later):
  • Intel Pentium 133 MHz processor
  • 64 MB RAM
Windows XP Home Edition or XP Professional (Service Pack 1 or later):
  • Intel Pentium 300 MHz processor
  • 128 MB RAM


Services provided for registered users

Kaspersky Lab offers all registered users an extensive service package enabling them to use Kaspersky Anti-Virus more efficiently.
After purchasing a subscription you become a registered user and during the period of your subscription will be provided with the following services:
  • application module and anti-virus database updates;
  • support on issues related to the installation, configuration and use of the application. Services will be provided by phone or via email;
  • information about new Kaspersky Lab products. You can also subscribe to the Kaspersky Lab newsletter which provides information about new computer viruses as they appear.
Kaspersky Lab does not provide support on issues related to the performance and the use of operating systems or other technologies.


Installing the program on your computer

Installing the application on your computer

To install Kaspersky Anti-Virus on your computer, run kavsetup.exe from the installation CD.
The installation wizard operates in an interactive mode. Each dialog box has the following buttons that you can use to navigate through the installation process:
  • Next> - accept and proceed with the installation.
  • <Back - return to the previous stage of the installation process.
  • Cancel - cancel the application installation.
  • Finish - finish the application installation.
A detailed discussion of each step of the installation process is provided below.
Step 1. Checking the version of the operating system installed on your computer
Before installation begins, your operating system and Service Packs are checked for conformity with the minimum system requirements for the Kaspersky Anti-Virus installation.
Should the application determine that any of the required Service Packs is not installed, you will be prompted to install the required Service Pack(s) using Windows Update before proceeding with the installation of Kaspersky Anti-Virus.
Step 2. Search for other anti-virus software

This step is required only if there is other anti-virus software installed on your computer.
The next step involves a search for other installed anti-virus software (including Kaspersky Lab applications). This is performed because the simultaneous use of these applications with Kaspersky Anti-Virus may cause conflicts.
If an earlier version of Kaspersky Anti-Virus is found, you will be prompted to uninstall it.

We recommend that before removing the previous version of the program (Kaspersky Anti-Virus Personal/Personal Pro 4.x) you save the valid license key used with this program. This key can be used for Kaspersky Anti-Virus Personal 5.0.
Click OK button and uninstall the earlier version of Kaspersky Anti-Virus, then run kavsetup.exe.
If any anti-virus software from a different vendor is found installed on your computer, you will be prompted to uninstall this program before proceeding with the installation of Kaspersky Anti-Virus.
We recommend that you cancel the installation of Kaspersky Anti-Virus and uninstall such program(s). To do this click the No button, uninstall the program(s), then run kavsetup.exe.
If it is determined that Kaspersky Anti-Virus Personal 5.0 has already been installed on your computer, a message will be displayed with a warning that if you proceed with the installation, the application that was installed earlier will be overwritten by the current installation.
Step 3. Start the Installation Wizard
If no other anti-virus software is found installed on your computer, a dialog box will inform you that the Kaspersky Anti-Virus installation wizard has been started.
To proceed with the installation, click Next>. To cancel the installation, click Cancel.
Step 4. Read the license agreement
The next dialog box contains a License Agreement between you and Kaspersky Lab. Read it carefully and click I Agree if you agree with all terms and conditions of the Agreement. The installation process will continue.
Step 5. Provide user information
At this point the username and the user's company name will be determined. Default information will be copied from the operating system registry and you can alter it if you wish.
To proceed with the installation, click Next>.
Step 6. Read important information about the application
During this stage of the installation process you will be asked to read important information about the application before you start using it.
This dialog box contains information about the major features and functionality of Kaspersky Anti-Virus.
After you read this information, click Next >.
Step 7. Install the license key
Perform this step only if the Kaspersky Anti-Virus Installation Wizard fails to find the key file automatically.
During this step, the license key for Kaspersky Anti-Virus will be installed. The license key is your personal "key" that stores all service information required for proper full-featured operation of Kaspersky Anti-Virus Personal, namely:
  • Technical support information (support service provider and contact information).
  • License name, number, and expiry date.
The application will not work without the license key.
Locate the license key using the standard Select File dialog box and click Next > to proceed with the installation process.
If you do not have the license key at the time of installation (for example, if you ordered via the Internet but have not received it yet), you may install it later, when you run the application for the first time. Remember that you cannot start using Kaspersky Anti-Virus without the license key.
Step 8. Select the installation folder
During this step, the destination folder will be selected for the installation of the application files. The default path is: C:\ProgramFiles\Kaspersky Lab\Kaspersky Anti-Virus Personal.
To alter the default path click the Browse... button in the dialog box, specify a new installation folder and click Next >.
After this, Kaspersky Anti-Virus application files will be copied to your computer.
Step 9. Finish setup
A Completing the Setup dialog box informs you that installation of Kaspersky Anti-Virus on your computer has been completed.
If registration of system services is required, you will be asked to restart your computer. This is a MANDATORY step for the correct completion of the application installation.

To complete the setup:
  1. Choose one of the following options:
      2. Yes, I want to restart my computer now
      No, I will restart my computer later
  2. Click Finish.
If your computer does not need to be restarted to complete the setup, you can begin using the application immediately. Perform the following steps to finish the installation:
  1. If you do not want to enable anti-virus protection of your computer immediately after the installation is completed, uncheck the box Start Kaspersky Anti-Virus Personal 5.0.
If you uncheck this box, the anti-virus protection of your computer will be automatically enabled after reboot. Before that time you can manually enable anti-virus protection from the Windows main menu (Start а Programs а Kaspersky Anti-Virus Personal)
  1. Click the Finish button.


If your computer is infected...

Sometimes it is not apparent, even to a knowledgeable user, that a computer is infected with a virus because viruses efficiently camouflage themselves among regular files. This chapter contains a detailed discussion of virus infection symptoms, methods of data recovery after a virus attack and measures aimed at prevention of data corruption by viruses.

See also:

Symptoms of infection

What should you do if you notice symptoms of infection

If no viruses are found during the scan

If viruses are found during the scan

If your computer suffers from a severe virus attack

Diagnosing the system using standard Windows tools

If nothing helps ...

After you have eradicated the infection


Symptoms of infection

There are a number of symptoms indicating that your computer has been infected. If you are noticing "strange things" happening to your computer, for example:
  • unexpected messages or images are suddenly displayed;
  • unusual sounds or music played at random;
  • your CD-ROM tray mysteriously opens and closes;
  • programs suddenly start on your computer;
  • if Kaspersky Anti-Hacker is installed on your computer, it notifies you of attempts by some programs to connect to the Internet although you did not initiate this.
If any of the above symptoms appear, it is very likely your computer has been infected with a virus.
In addition, there are some typical symptoms indicating that your computer has been infected via email:
  • your friends mention that they have received messages from you but you never sent such messages;
  • your mailbox contains many messages without the sender's email address or header.
Note that these problems may be caused by reasons other than viruses. For example, infected messages which have your address as the sender can actually be sent from a different computer.
There are also indirect symptoms that indicate your computer has possibly been infected:
  • your computer freezes frequently or encounters errors;
  • your computer slows down when programs are started;
  • you are unable to load the operating system;
  • files and folders are suddenly missing or their content changes;
  • your hard drive is accessed too often (the light on your main unit flashes rapidly);
  • Microsoft Internet Explorer "freezes" or displays unpredictable behavior, (for example you cannot close the application window).
90% of such indirect symptoms indicate that there is a hardware or software problem, but although such symptoms are unlikely to be caused by an infection, we recommend that you perform a full scan of your computer using the default settings recommended by Kaspersky Lab experts if your encounter any of these problems.


What should you do if you notice symptoms of infection

If you notice that your computer displays "suspicious" behavior:
  1. Don't panic! This golden rule may prevent the loss of important data stored on your computer and help you avoid unnecessary stress.
  2. Disconnect your computer from the Internet. This is important because if you are connected to the Internet, a virus can send important information to the penetrators or may try to send itself to the email addresses contained in your address book.
  3. If your computer is connected to a Local Area Network, disconnect it.
  4. If the symptom of an infection is that you cannot boot from your hard drive (your computer encounters an error at startup), try to start the system in Safe Mode or from the Windows boot disk that you created during the installation of the operating system on your computer.
  5. Before taking any action, back up all critical data to an external drive (a floppy disk, CD, flash card, etc.)
  6. Install Kaspersky Anti-Virus if you have not installed it yet.
  7. Download the latest anti-virus database updates. If possible, do not use the infected computer to download the updates, but instead use a friend's computer, or a computer at your office or an Internet cafй. You can also obtain the anti-virus database on a CD-ROM or a floppy disk from Kaspersky Lab or its authorized dealers and update your databases from this disk (for more details see section Downloading updates from a local folder).
  8. Apply the recommended application settings (see section Scan settings to be used).
  9. Perform a full system scan (see section Starting on-demand scan).


If no viruses are found during the scan

If no viruses are found during the scan and the symptoms that alarmed you can be classified as indirect, it is most likely you have no reason to worry. Check all hardware and software installed in your computer. Download Windows patches using Windows Update. Uninstall all unlicensed software from your computer and clean your hard drives of any junk files.


If viruses are found during the scan

If viruses are found during a scan, Kaspersky Anti-Virus Personal, in accordance with the default settings, will notify you and offer several options for treating the infected objects.
Note that in 99% of cases, personal computers are infected by e-mail worms, Trojan programs, or viruses (for details on malicious computer programs see section Computer viruses and malicious computer programs). In most cases, all lost data can be successfully recovered.

In order to remove viruses from the infected objects:
  1. From the actions you may choose to be performed we recommend disinfect for infected objects, quarantine for possibly infected objects and delete for worms and Trojans. You can find the names of all viruses resident on your computer in the report (see section Working with reports).
  2. In certain cases, you may need a special utility to recover data that have been corrupted. Connect to the Internet, visit Kaspersky Lab website (http://www.kaspersky.com/) and read the information about the virus, Trojan horse, or worm that has infected your computer. Download a special utility for data recovery if such a program exists for this virus. For example, to recover data infected with the Klez virus, download and run clrav.com program.
  3. Read carefully any information about your problem available on the website. You will probably have to take additional measures.
  4. If your computer has been infected with viruses that exploit the vulnerability of Microsoft Outlook Express (such as Nimda, Klez, Batdrans), they can be re-activated even after Kaspersky Anti-Virus Personal has cleaned the system, for example, when you open existing infected messages. To avoid this, you must set the protection mode that scans and disinfects e-mail databases (see section Protecting your mail from viruses) and install the latest security patches for Microsoft Outlook Express to ensure its safety in the future.
Unfortunately, some viruses cannot be completely removed from infected objects. Some of these viruses corrupt information on your computer during infection and this information sometimes cannot be repaired. If the Kaspersky Lab website indicates that the virus that has infected your system cannot be completely removed from your files, delete such infected files.


If your computer suffers from a severe virus attack

Some viruses and Trojan programs can cause severe damage to your computer:
  • If you cannot boot from your hard drive (your computer encounters an error at startup), try to boot from your Windows rescue disk. If the system can not "recognize" your hard drive, the virus must have damaged the Disk Partition Table. In this case, try to recover the partition table using scandisk, a standard Windows program. If this does not help, contact a computer data recovery service. Ask your computer vendor for the address of such a service.
If you have a disk management utility installed, some of your logical drives may be unavailable when you boot from the rescue disk or diskette. In this case, you should disinfect all drives that you can access, reboot from the system hard drive and disinfect the remaining logical drives.
  • Recover corrupted files and applications using backup copies (it is strongly recommended that you back up your data!) after you have scanned the external drive with these backup data.


Diagnosing the system using standard Windows tools

Although self-treatment of your computer is not recommended, you may wish to:
  • check the integrity of the file system on your hard drive (using the CHKDSK program) and repair file system errors. If there are many errors, it is necessary to create a backup of the most important files on removable media before fixing the errors;
  • scan your computer after you boot from the Windows rescue disk (if you have one);
  • use other standard Windows tools, for example, the scandisk utility.
For more details on using these utilities, refer to the Windows Help topics.


If nothing helps ...

If the symptoms described above persist even after you have scanned your computer, checked all installed hardware and software and your hard drive using Windows utilities, send a message with a full description of your problem to Kaspersky Lab Technical Support Service.
If you are sure that some files are Trojan programs or have been infected, send these files to Kaspersky Lab for expert analysis.

For details on sending messages and files to Kaspersky Lab, see section Contacting Technical Support.


After you have eradicated the infection

After you have got rid of the infection, scan all disks and floppy disks that may be infected with a virus.
Make sure that you have the latest version of Kaspersky Anti-Virus Personal installed on your computer and apply the default settings recommended by the Kaspersky Lab experts.
Read carefully the section Preventing Virus Infection and pay attention to the main security rules that will help you avoid virus infections in the future.

See also:

On-demand scan: scan settings to be used

Real-time protection: specifying application actions and setting the protection level


Anti-Virus Protection using Kaspersky Anti-Virus Personal default settings

You can use Kaspersky Anti-Virus immediately upon installation. There is no need to customize the application before using it for the first time because the default settings provide the optimal balance between protection and performance.
In the corresponding topics, we describe the default settings in detail.

See also:

Real-Time Protection

On-Demand Scan

Updating the anti-virus database


Real-Time Protection

Immediately after it is launched (that is indicated by the red [image] icon in the system tray), Kaspersky Anti-Virus scans all objects executed at the operating system startup, as well as the computer memory and its own application modules.
The default real-time protection settings are as follows:
  • Objects being opened, saved or executed on your hard drive and removable drives that are potentially infectable will be scanned, including:
    • disk boot sectors (these objects are scanned immediately after the system startup);
    • packed files and objects linked or embedded into files ( OLE objects);
    • incoming email messages (upon receipt).
Real-time protection does not scan objects that cannot contain viruses.
  • When an infected object is detected, the application denies access to this object and prompts the user for action.
  • When a suspicious or infected object is detected, the application denies access to it and prompts the user for action.
  • The results of all application actions are documented in reports (see section Working with reports).
Real-time anti-virus protection is enabled automatically after the system startup and remains active until the system shuts down.

You can disable real-time protection manually. To do this:
    • Right-click the [image] icon in the system tray.
    • When the shortcut menu appears, select Disable Real-Time Protection.
Real-time protection of your computer will be then disabled and the active [image] icon (red) will be replaced by the inactive icon [image] (gray).

You are advised not to disable real-time anti-virus protection because this considerably increases the risk of a virus infection.


On-Demand Scan

The on-demand scan feature enables anti-virus analysis of your entire computer or of specified disks, folders or files. The following are the default scan settings:
An on-demand scan of your entire system will include:
  • an on-demand scan of your entire system will scan all objects stored on hard drives, including:
    • objects executed at the operating system startup and disk boot sectors;
    • archives, packed executable files and self-extracting archives;
    • objects linked to or embedded into files (OLE-objects);
    • computer's RAM currently in use.
  • an anti-virus scan of a particular disk, folder or file will scan all files located within the selected area, including:
    • archives, packed executable files and self-extracting archives;
    • objects linked to or embedded into files (OLE-objects);
  • the user is prompted for an action when an infected object is detected;
  • the user is prompted for an action when a suspicious object is detected;
  • the results of all application actions are documented in reports (see section Working with reports).
By default, a full on-demand scan of your computer is scheduled every Friday at 8 pm. The full scan status indicator is located in the right section of the Protection tab.
The full scan of your computer is in progress
If your computer is off at the scheduled time, the scan will not be performed.

You can start a full scan of your computer manually. To do this:

right-click the [image] icon in the system tray. When the shortcut menu appears, select Scan My Computer for viruses.

or

switch to the Protection tab in the application window and click Scan My Computer in the left section.


Updating anti-virus database

Updating the anti-virus database

The application detects viruses and disinfects infected objects using the anti-virus database, which contains the definitions of all currently known viruses and methods for disinfection.
It is extremely important to update your anti-virus database periodically because new viruses appear every day.
Updating anti-virus database is an important function of Kaspersky Anti-Virus. By default, database updates are automatically downloaded from the Kaspersky Lab's update servers and installed on your computer every 3 hours. If you use your computer less than three hours a day, you are advised to either: change the frequency of the anti-virus database updates; leave your computer running; or, update the anti-virus database manually. Otherwise, the anti-virus database will not be updated.

You can update the anti-virus database manually. To do this:
right-click the [image] icon in the system tray. When the shortcut menu appears, select Update Anti-Virus Database.

or

open the Protection tab of the main application window and click link Update now in the left section.

or

click link Update your anti-virus database in the right section of the Protection tab.

For more details on updating the anti-virus database see section Downloading updates.


Program interface

Application interface

Kaspersky Anti-Virus has a simple and easy-to-use interface. In this topic the main elements of the application interface are discussed: the system tray icon, shortcut menu, main application window and the service windows.

See also:

System Tray Icon

Shortcut menu

Protection tab

Settings tab

Support tab

Scan window

Application reference system


System Tray Icon

After the application has started, an icon indicating the status of real-time anti-virus protection will appear in the Windows system tray.
When real-time anti-virus protection of your files is enabled, the icon is red (active status) [image] ; when real-time protection is disabled, the icon turns gray (inactive) [image] , even if mail and script anti-virus scanning is enabled.
When the application is scanning your computer or a particular disk or file, or when it is analyzing an object in real-time protection mode, the lower right-hand corner of the icon becomes a flashing white-and-blue folder: or [image] . When mail is being scanned, an envelope will be displayed instead of the folder.
When an important anti-virus event occurs, the recommended action will be indicated in a pop-up window above the icon.
Information message


Shortcut menu

To open a shortcut menu, right-click the application icon in the system tray. The menu includes the following items:
  • Open Kaspersky Anti-Virus - open the main application window with the Protection tab active. You can also open the main window by double-clicking the [image] icon in the system tray.
  • Scan My Computer for viruses - perform a full scan of your computer for viruses using the selected protection level settings.
  • Update Anti-Virus Database - update the anti-virus database from Kaspersky Lab's update servers.
  • Disable/Enable Real-Time Protection - enable or disable real-time protection of your computer. The application icon in the system tray changes color depending on whether real-time protection is disabled or enabled.
You are advised not to disable real-time anti-virus protection because this considerably increases the risk of virus infection.
  • About - display general information about Kaspersky Anti-Virus Personal.
  • Exit - close Kaspersky Anti-Virus and unload it from your computer's memory.
You cannot access the Exit option in the shortcut menu if you do not have Administrator's rights for this computer.

Shortcut menu
Kaspersky Lab
WWW: http://www.kaspersky.com

E-mail: support@kaspersky.com


Main application window: general structure

The main application window gives quick access to all the application's anti-virus protection capabilities. From the main application window, you can perform the following functions:
  • configure anti-virus protection settings;
  • start and stop a scan of the entire system or specified disks, folders or files for viruses;
  • download updates for the anti-virus database and application modules;
  • set up a schedules for making full scans and for updates;
  • manage quarantined objects;
  • manage reports, etc.
All anti-virus protection settings, status information and specific tasks are accessible from the following tabs of the main window:
  • Protection tab - summarises the current anti-virus protection status and gives access to on-demand scanning. This tab is the main component of the application interface.
  • Settings tab - displays the settings and status for all anti-virus tasks.
  • Support tab - displays license, contact and other support information.
Each tab has two sections as follows:
  • The left section displays a list of tasks that ensure anti-virus protection of your computer. Each tab has its own list of specific tasks.
For example, the Protection tab offers a variety of tasks related to anti-virus scanning. The Settings tab includes controls used to adjust parameters for these tasks. The Support tab includes controls related to the support of your anti-virus protection.
  • The right section contains information on the current status of the anti-virus protection of your computer, including real-time protection, on-demand scan, anti-virus database and license information.
Thus, for instance, the Protection tab displays the status of your anti-virus protection, the Settings tab displays the status of the current application settings and the Support tab displays the license status (license key information), support contact information and information about the application and your system.
Three states of anti-virus protection are indicated in the Protection and the Settings tabs by the following icons:

Critical level of anti-virus protection. This status means that real-time protection is disabled or that certain tasks (scanning and/or updating) have not been performed for a long time or that the current settings do not provide reliable anti-virus protection of your computer.

Anti-virus protection level does not match the recommended settings. This status indicates that current anti-virus protection settings do not match the recommended settings or that a certain anti-virus protection task must be perfomed.

The anti-virus protection level is set to Recommended. This status indicates that your settings fully comply with the settings recommended by Kaspersky Lab.
The status information is displayed in the following order: the real-time protection status will be displayed first, the on-demand scan status, and, finally, the status of the anti-virus database validity.
Each state described above is provided with comments and recommendations. Thus, for example, if the current anti-virus protection level does not match the recommended level, you will be prompted to restore the recommended settings to ensure the optimal protection level.


Protection tab

Using the Protection tab, you can scan your entire computer or individual disks, folders or files. You can also: update the anti-virus database; view progress reports on all running tasks, and manage quarantined objects. The tasks can be launched by clicking the corresponding hyperlinks in the left section of the tab.
The Protection tab
In the right section of the tab, you can view the current status of real-time protection, on-demand scan and anti-virus database. An example shows that real-time protection is enabled but a full scan has not been performed for a long time. Here you can also view comments on the status of each anti-virus protection task.
If the protection status is critical or does not match the recommended settings, you will be prompted to modify the current settings, restore the recommended settings, or launch a certain task. The recommendations are organized as hyperlinks so that you can easily perform the corresponding action.


Settings tab

Using the Settings tab you can evaluate and customize both the standard and advanced settings to ensure smooth performance of Kaspersky Anti-Virus.
The Settings tab
The right section of the tab displays the current settings for real-time anti-virus protection, on-demand scans, and automatic updating of the anti-virus database and application modules. It also gives detailed comments and tips from Kaspersky Lab on how to customize these settings. For example, if you manually updated your anti-virus database in the past, you will be prompted to schedule automatic updates.
By clicking links located in the left section of the Settings tab, you can edit the parameters for real-time protection, on-demand scans, and anti-virus database updating.
Here you can also customize parameters related to the quarantine where suspicious objects are placed. Finally you can customize additional settings by following the link Additional settings.


Support tab

The Support tab contains information about Kaspersky Lab's Technical Support and how to obtain assistance for problems with the application. The right section of the tab displays information about the application, the license key and the computer's operating system so that you can provide this information to Technical Support if required.
The Support tab
By following the links in the left section of the tab, you can:
  • send your questions to Kaspersky Lab's Technical Support;
  • send suspicious objects to Kaspersky Lab for analysis;
  • renew the license for Kaspersky Anti-Virus by installing a new license key.
The left section of the tab also includes the following reference links:
  • How to... - general application reference.
  • Help - reference on performing tasks and troubleshooting.
  • Virus Encyclopedia - a link to www.viruslist.com website containing detailed descriptions of all currently known malware.
  • Kaspersky Lab's Website - a link to the Kaspersky Lab's website.


Scan window

After you launch an anti-virus scan of all or part of your computer, the scan window will appear.
The Scan window
The scan window consists of two parts:
  • the top part of the window contains a scan progress bar showing the percentage of scan progress, the time the scan started, estimated time of completion of the scan, and the name of the object currently being scanned.
  • the bottom part of the window contains three tabs: Statistics, which displays the scan results; Report, which contains a report on the events that occured during the scan; and Settings, which contains a list of settings used for the current scan or for the last scan performed.
See section Working with reports for report details.


Program reference system

Application reference system

Comprehensive application reference information is available from the Support tab of the main application window by simply following the How to link in the left section of the tab.
When you need to know how to perform a particular task, follow the Help link in the main Kaspersky Anti-Virus window. Help contains a detailed description of the key anti-virus protection tasks performed by Kaspersky Anti-Virus as well as answers to FAQ (frequently asked questions).
If you have a question on a particular dialog box, press the <F1> key or click Help in the left bottom corner of this dialog box.


Preventing virus infections

Even proven and trusted preventative actions cannot ensure 100% protection against computer viruses and Trojans, but you can considerably minimize the risk of being affected by a virus attack and thus reduce the losses from a possible infection if you develop and follow certain rules.
Similar to health care, one of the main methods of fighting viruses is the prevention of infection. For computers, prevention of a virus infection includes a few rules that must be followed to reduce the risk of infection and data loss.
Listed below are the main security rules that you should follow to prevent virus attacks.
Rule 1: keep your computer protected with anti-virus programs and Internet security software. To do this:
  • Install Kaspersky Anti-Virus Personal.
  • Update your anti-virus database on a daily basis. During periods of virus outbreaks you should retrieve updates several times each day because during such periods the anti-virus database on Kaspersky Lab's update servers is updated constantly.
  • Apply the real-time protection settings recommended by Kaspersky Lab. Real-time protection is enabled immediately after system startup and prevents the penetration of viruses into your computer.
  • Apply the on-demand scan settings recommended by Kaspersky Lab and schedule the scan to be run at least once a week.
  • We also recommend that you install Kaspersky Anti-Hacker for comprehensive computer protection while you are surfing the Internet.
Rule 2: be careful when copying any new data to your computer:
  • Always scan all removable drives (floppy disks, CD-ROM drives, flash cards, etc.) for viruses before using them.
  • Be careful with email messages. Never open an email attachment, even if it was sent to you by a person your know, unless you are expecting it. In particular, do not trust emails that claim to be sent by anti-virus companies.
  • Be careful with any data downloaded from the Internet. If you are prompted to download a program, always check that it comes with a security certificate.
  • If you download an executable file from the Internet or from a LAN, scan it with Kaspersky Anti-Virus.
  • Be selective about the websites you visit. Some websites contain dangerous scripts or Internet worms.
Rule 3: Read carefully all information supplied by Kaspersky Lab.

In most cases, Kaspersky Lab warns users about new virus outbreaks long before they reach their peak. The risk of getting infected is still low at this time and if you download the up-to-date anti-virus database, you will be able to protect your computer.

Rule 4: Be suspicious about hoax virus warnings - email messages that claim to be warnings of virus threats.
Rule 5: Regularly update your operating system using the Windows Update utility.
Rule 6: Always buy licensed copies of your software from authorized dealers.
Rule 7: Limit the number of people who have access to your computer.
Rule 8: Minimize potential losses from a possible infection:
  • Backup your data on a regular basis, so that in the event of data loss, your system may be fairly quickly restored using backup copies. Your distribution disks, floppy disks and other media with software installation and other important data should be kept in a safe place.
  • Always create a bootable rescue disk from which you can boot using a "clean" operating system.

See also:

When do I need to perform an anti-virus scan?

Scan settings to be used

Starting on-demand scan

Scheduled full scan

On-demand scan of selected objects

Scanning archives


When do I need to perform an anti-virus scan?

Kaspersky Anti-Virus can perform an anti-virus scan of your entire computer or of a particular disk, folder, file or email object.

During a full computer scan, removable drives and network drives are not scanned.
Even if, as a result of an on-demand scan of selected objects, no viruses are found, this does not guarantee that your computer is virus-free. Therefore, Kaspersky Anti-Virus always checks whether your entire computer has been scanned for viruses.
During a full scan, the application scans more objects stored in your computer than it does in the real-time protection mode. Therefore, you are advised to scan your computer at least once a week, as a preventive measure. The application will remind you when it is the best time to start a full scan. If the main application window is closed, a pop-up window containing a recommendation to start a full scan will appear above the Kaspersky Anti-Virus icon [image] in the system tray (if pop-ups are not disabled, see section Additional settings of Kaspersky Anti-Virus Personal).
For more detailed information, open the main application window and see the full scan status in the right section of the Protection tab. The full scan status is represented by one of the following icons:
- It is extremely important that you perform a full computer scan now.

- You should perform a full computer scan now. You may also need to restore the recommended settings before you start the scan.

- A full scan is performed on a regular basis or is currently being performed.

If required, you can also start a full scan directly from this tab by following the perform a full computer scan link.
Kaspersky Lab recommends that you schedule a full scan to start automatically (see section Scheduled full scan). The full scan status indicates whether the scheduled scan mode is enabled.
Information about the necessity of a full scan


Scan settings to be used

After you install Kaspersky Anti-Virus, any on-demand scan (full computer scan, scan of specified objects or removable drives) will use the default settings recommended by Kaspersky Lab. The status of the current scan settings are displayed in the right section of the Settings tab of the main application window using the following icons:
- On-Demand scan settings do not match the recommended settings.

- On-Demand scan settings match the recommended maximum protection settings.

If necessary, you can change these settings. You can change the protection level and specify the type of action to be performed if a suspicious or infected object is detected.

Note that the protection level and other settings that you assign will APPLY TO ALL types of on-demand scan, including full scans of your computer and scan of selected disks, folders, files, etc.
If you exclude, for example, a particular disk from the scan scope (see section Troubleshooting on-demand scan) then this disk will not be scanned when you select it for an on-demand scan (see section On-demand scan of selected objects). The only exclusions from this rule are Microsoft Outlook and Microsoft Outlook Express mailboxes. If selected, they will be scanned, regardless of whether or not you have excluded them from the scan scope.

To change the protection level and/or type of action to be performed if a suspicious or infected object is detected:
  1. Click modify settings in the right section of the Settings tab or Configure On-Demand Scan in its left section.
  2. In On-Demand Scan settings window that opens after you click the above link, select the desired scan level, which defines the thoroughness of your computer's anti-virus protection. The default level is Recommended. You can change it by moving the Scan level slider up or down. Below is a discussion of the available protection levels together with situations when the use of a certain protection level is indicated:
    • Maximum protection - thorough scan of the entire computer or a particular disk, folder or file.

You are advised to use this protection level if you suspect that your computer has been infected by a virus. A detailed discussion of infection symptoms is provided in section Symptoms of infection.

    • Recommended - a scan of the entire computer or a specified object using settings recommended by Kaspersky Lab.

We recommend that you use this protection level by default as it ensures an optimal combination of scan speed and thoroughness.

    • High speed - high-speed anti-virus scan of your computer (including RAM and disk boot sectors) or of a selected object.

This protection level ensures scanning at maximum speed due to a reduction in the number of objects to be scanned.

The table below contains a list of all objects that will be scanned at each protection level. The + sign indicates that the object will be scanned if the corresponding protection level is selected, while the - sign indicates that the object will not be scanned.

Maximum Protection
Recommended
High Speed
Area selected by the user
+
+
+
Disk boot sectors, RAM
+
+
+
OLE-objects
+
+
+
Packed files
+
+
+
Self-extracting archives
+
+
+
Objects executed at the operating system startup
+
+
-
Archives
+
+
-
MS Outlook and MS Outlook Express mailboxes
+
+
-
Email databases and messages
+
-
-
For each of the above protection levels, you can specify exclusions - a list of objects that will not be scanned. However, you are advised to specify such exclusions only if you encounter performance problems using Kaspersky Anti-Virus, for example if your computer has slowed down considerably.
  1. Specify the type of action to be performed if a suspicious or infected object is detected during the scan:.
      2. Prompt user for action - ask user about the action to be performed on detected objects. A list of possible actions will be displayed, one of which will be recommended by Kaspersky Lab. Select this mode if you are staying at your computer during the scan.
On-demand scan settings
    Perform recommended action - perform the action recommended by Kaspersky Lab. Since the recommended actions are always well justified, you can select this mode in most cases. The recommended actions may be as follows:
  • disinfect infected objects;
  • quarantine suspicious or infected objects.
            •
    Sometimes, after a file has been quarantined, a message appears notifying the user that the object cannot be deleted. This is related to the fact that quarantined objects are copied to the quarantine folder and deleted from their initial location. However, some objects (for instance, objects contained in a self-extracting archive) cannot be deleted in this way.
  • delete malicious programs (Trojans and worms) or infected objects that could not be disinfected.
      • Delete infected objects - delete infected objects detected during the scan without making an attempt to disinfect them and without asking user's confirmation. This mode is recommended only if you are certain that you will not lose any valuable information.
      Write information to log file - the application will only report infected and suspicious objects found during the scan but will not perform any action on such objects. This mode is not recommended for most cases because all the infected and suspicious objects will remain in your computer, thus making the spread of infection virtually inevitable.

      In some situations no action can be performed on an object, for instance, if an infected object is being used by another program at the time of detection and therefore cannot be disinfected. In this case, a message will be displayed with a suggestion that you:

        • disinfect at system startup. This action will be listed only if this object can be disinfected;
        • delete at system startup;
        • skip - do not perform any action on the object, only report its detection in the application report.
    Immediate disinfection is not possible
    For successful treatement (disinfection or deletion) of objects at system startup, the scan procedure during which such objects were detected must be fully completed. If you interrupt the scan procedure, such objects will not be disinfected/deleted.


Starting on-demand scan

To start an on-demand anti-virus scan of your entire computer:
click Scan My Computer in the left section of the Protection tab.
After clicking this hyperlink, a Scan dialog box will open. This dialog box displays the scan progress, the start time of the scan, the estimated or actual time of completion of the scan and the name of the object currently being scanned.
You can view the scan results in a report.


Scheduled full scan

You can schedule a regular full scan of your computer to be performed at a specified time on certain days of the week. For example, you may choose to schedule the start of a full on-demand scan at lunch time.

To schedule an automatic start of a full scan:
  1. Click Configure On-Demand Scan in the left section of the Settings tab.
  2. When the On-Demand Scan settings dialog box opens, click Schedule Scanning to open a Schedule Scanning dialog box.
  3. When the Schedule Scanning dialog box opens, set up the schedule for this task to be performed:
Setting up a scheduled scan
      Specify scanning interval in days - perform an anti-virus scan at a certain interval in days. The default setting is a daily scan at 8 pm. If you wish to modify the default schedule and start time, select the Every option and enter the desired scan interval in days in the field beside it. Specify the scan start time in the Scan start field.
      Scan on specific weekdays - specify weekdays on which you wish the scan to be performed. By default the scan is performed weekly, every Friday at 8 pm. If you wish to modify the default schedule, select weekdays in the Scan parameters section and specify the scan start time in the Scan start field.
      Do not scan if battery charge is lower than - for portable computers: cancel the on-demand scan if the battery charge is below the specified minimum allowable level. Using the slider, select the minimum allowable battery charge level (in percents) below which scheduled scans cannot be started.
  1. Click the OK button.


On-demand scan of selected objects

Sometimes you need to scan particular objects rather than the entire computer. Such objects may include, for example, a hard drive with program files and games, email databases that you have brought from the office, an archive attached to an email message that you have received. You can select objects to be scanned by using either Kaspersky Anti-Virus or standard Windows tools (for example, Windows Explorer, My Computer, etc.)

To scan an object selected using standard Windows tools:
select and right-click the object you wish to scan and when the shortcut menu appears, select the Scan for viruses command.
Scanning an object using standard Windows tools

To select and scan objects using Kaspersky Anti-Virus please follow the instructions below.

In order to select and scan an object using Kaspersky Anti-Virus Personal:
click Scan objects in the left section of the Protection tab.

The Select Objects to Scan window opens, containing a list of objects that can be scanned for viruses, and equipped with interface buttons for editing this list and controlling the scan.

Selecting objects to be scanned
The initial list includes the following objects:
  • removable drives, including floppy disks and CD-ROM;
  • hard drives;
  • Microsoft Outlook and Microsoft Outlook Express mailboxes;
  • My Documents folder.
To add a new object to the list, click Add and in the file selection window, browse to the file or folder you wish to add. All added objects will be available in this list for future scans.
To delete an object from the list, check the corresponding box [image] and click Delete. Note, however, that you can delete from the list only those objects that you have added manually. Objects that were included in the initial list cannot be deleted.

To select and scan objects from the list:
  1. Select objects you wish to scanfrom the list.
  2. Click Scan to start the scan.
Regardless of how the scan was started (from Kaspersky Anti-Virus or from the Windows shortcut menu), the Scan window will appear. It contains a scan progress bar showing the scan progress, the time the scan started, estimated or actual time of completion of the scan, and the name of the object currently being scanned.
The scan results are documented in a report.


Scanning archives

Kaspersky Anti-Virus scans archives if the Maximum Protection or Recommended protection level is selected and if these archives have not been previously excluded from the scope of the scan (see section Troubleshooting on-demand scan).
Kaspersky Anti-Virus scans all objects contained within archives, but disinfects only zip, arj, cab and rar archives.
Self-extracting archives are not disinfected! If a virus is found within a self-extracting archive, the archive will be deleted.
If an archive or an object within an archive is protected with a password, you will be prompted for the password before scanning continues.

You can enable or disable the prompt for password by checking the [image] Do not ask for password when scanning objects box in the Troubleshooting window accessible via On-Demand Scan settings.
Entering password to scan an archive

In the Enter your password field, enter the password required to access this archive or an object within this archive and click ОК. The archive, and all objects contained within it, will be scanned after the password is entered.

While processing objects within archives, Kaspersky Anti-Virus unpacks an archive to a temporary folder, scans the objects, processes them, packs them into a new archive with the same name and copies this new archive to the initial location of the original archive, thus overwriting the existing original archive. A similar procedure is used for processing password-protected objects within archives. Note that after the objects have been processed, they will be packed into a new archive with no password.

If another password-protected archive is found within the archive being scanned, Kaspersky Anti-Virus tries to apply the password used to access the first (containing) archive to the second (contained) archive. You will only be asked to enter a new password if the password is invalid.

If you do not want to scan a particular password-protected object within an archive, click the Skip button and proceed with the scan.

If you do not know the password, the application will be unable to scan this password-protected archive and the objects contained within it. We recommend that you click Skip and proceed with the scan.

When you check the Apply to all password-protected objects within this session box the action that you select after checking this box will be applied to all password-protected objects.

For example, if you check this box and click Skip archive button, all password-protected archives will be skipped during this scan.

If you enter the password, check the box and click the OK button, then this password will be automatically used to access all password-protected objects within all archives in this session. If the password is invalid for a certain object, that object will be skipped.


Scanning a CD or a floppy disk

Your computer can easily be infected by viruses residing on floppy disks, CDs, and other removable media. If a floppy disk (or a bootable CD) you have used was infected with a boot virus, and you rebooted with the disk left in your drive, this may have gravest consequences to your system.
We recommend that you scan all removable media before using them.
You can scan removable media either from the Kaspersky Anti-Virus main window or by using the Windows shortcut menu accessed from Windows Explorer, My Computer, etc.

To scan removable media for viruses from the Windows shortcut menu:
select and right-click the drives (you can select the CD-ROM and the floppy disk at the same time). When the shortcut menu appears, select Scan for viruses.

To scan a CD-ROM or a floppy disk for viruses from the main application window of Kaspersky Anti-Virus:
  1. Insert the disk into the CD-ROM drive or the floppy disk into the floppy drive. Note that the application can scan both the CD and floppy disk at the same time.
  2. Click Scan removable drives in the left section of the Protection tab.
or
Using the Scan objects link, go to the Select Objects to Scan window, select "removable drives" and press the Scan button.

You can view the scan progress (percentage competed) in the Scan window that opens immediately after the scan is started.

If you select only one removable drive for scanning, Kaspersky Anti-Virus will prompt you to insert the disk into the next removable drive after the scan is completed.

Note the following application features:
  • If the CD or floppy disk drive is empty or disconnected, the drive will not be scanned. No message will be displayed.
  • A CD, floppy disk or other removable media inserted into its drive after the scan has started will not be scanned.
  • If you eject the CD or floppy disk, or disconnect the drive while the scan is in progress, the application will enter error information into the report but no message will be displayed. After this the next removable drive, if one exists on your computer, will be scanned.

    • Each time a new removable drive is connected to the system (i.e. when the drive is detected by the system as new hardware), it will be scanned for boot-viruses.


Configuring real-time protection

Real-time protection of your computer means that Kaspersky Anti-Virus constantly monitors all potentially unsafe actions performed on your computer. The application scans for viruses in the following objects: in files that you open or save (after you modify them); in messages you send or receive; in files that are about to be run; in scripts that are about to be executed in Microsoft Internet Explorer. When any of these actions are attempted, Kaspersky Anti-Virus first blocks the action, scans the object, and then, depending on the scan results, either permits or prohibits the action or displays a message.

See also:

Checking the protection status

Specifying application actions and setting the protection level


Checking the protection status

The current real-time protection status is displayed in the right-hand section of the Protection tab in the main application window.
The real-time protection status is indicated by the following icons:
- Real-Time Protection is enabled. Your computer's protection level is set to Recommended.

- Real-Time Protection is enabled. Your protection settings do not match the recommended settings.

- Real-Time Protection is disabled or not working. If the protection is disabled, you are advised to enable it. If real-time protection is not working, you are advised to configure the real-time protection parameters (see section Troubleshooting real-time protection) and then enable it.

See also:

Specifying application actions and setting the protection level


Specifying program actions and setting up the protection level

Specifying application actions and setting the protection level

The default protection level for Kaspersky Anti-Virus is Recommended. This level denies access to all infected objects, malware (worms, Trojan programs) and suspicious objects that are being accessed for reading, writing or execution, and displays a message prompting the user for action.

Note that archives, email databases, and plain text mail files ARE NOT SCANNED in real-time protection mode! An exception is self-extracting archives, which are scanned if the Maximum Protection level is selected.
While real-time protection is on, you can select both the level of computer protection and the type of action to be performed if a suspicious or infected object is detected.

To configure application actions upon detection of a malicious object:
  1. Click Configure Real-Time Protection in the left section of the Settings tab or modify settings in the status area of the Protection tab.
  2. When the Real-Time Protection settings dialog box opens, select the protection level using a slider. By changing the protection level, you change the balance between the speed of the scan and the number of objects to be scanned. The fewer objects scanned, the faster the scan will be.
Note that archives are not scanned or disinfected in real-time protection mode! To scan and disinfect archives use a full computer scan.
Real-time protection configuration

Kaspersky Anti-Virus allows the user to select one of three protection levels:

    • Maximum Protection - this level ensures maximum monitoring of objects that are being opened, saved or run.
    • Recommended - this level of protection is recommended by Kaspersky Lab. At this level, the same types of object are scanned as at the Maximum Protection level, except for self-extracting archives and outgoing email messages.
    • High Speed - this level ensure good computer performance while you are working with programs that require considerable RAM resources, since the list of objects to be scanned is shorter.

The table below contains a list of all objects that may be subject to an anti-virus scan. The + sign indicates that the object will be scanned if the corresponding level is selected, while the - sign indicates that the object will not be scanned.

Maximum Protection

Recommended
High Speed
Files that potentially can be infected
+
+
+
Disk boot sectors
+
+
+
Packed files
+
+
+
OLE objects
+
+
+
Incoming email messages
+
+
+
Outgoing email messages
+
-
-
Self-extracting archives
+
-
-
Email databases and messages
-
-
-

You can specify files to be excluded from the scan scope at each level of real-time protection, or disable real-time protection.

  1. Specify types of action to be performed on detection of an infected or suspicious object:
      2. Block access and prompt user for action - deny access to the object and display a message prompting the user to choose which action is to be performed on the object. This is the default mode.

If you do not specify the action within 30 seconds after the message is displayed, the recommended action will be performed on this object. Each type of detected object has its own recommended action. For example, for infected objects the recommended action is Disinfect. Beside the name of recommended action the text (recommended) is always displayed.

The list of possible recommended actions is as follows (a subset of these actions is available for each different type of object):

      • disinfect infected objects;
      • quarantine suspicious objects that are possibly infected with a virus or a virus modification;
      Sometimes, after a file has been quarantined, a message appears notifying the user that the object cannot be deleted. This is related to the fact that quarantined objects are copied to the quarantine folder and deleted from their initial location. However, some objects, for example, objects contained in a self-extracting archive, cannot be deleted in this way.
      • delete malicious programs (Trojans and worms) or infected objects that could not be disinfected;
      • skip - do not perform any action on objects, but record information on their detection in the report.
      If you want to quarantine an infected object, choose the Skip action and then quarantine the object manually (see section Working with quarantined objects).
    Block access and perform recommended action - deny access to the object and perform a recommended action on this object. The Recommended action for infected objects is Disinfect, for possibly infected objects it is Quarantine and for trojan horses and worms it is Delete.
      Block access and delete infected objects - delete objects without any additional warning to the user.

      Block access and write information to log file - deny access to the object, and do not display messages prompting user for action.

In some situations no action can be performed on an object, for instance, if an infected object is being used by another program at the time of detection and therefore cannot be processed. In this case, a message will be displayed with a suggestion that you:

      • disinfect at system startup. This action will be listed only if this object can be disinfected;

      • delete at system startup;

      • skip.
    Please note that the actions listed above do not apply to email messages and dangerous scripts:
      • Upon the detection of an infected or possibly infected email message, the recommended action is performed with no additional notification to the user.
      • Upon the detection of a dangerous script, you will always be notified and will be able to determine further actions yourself.

    See also:

    Checking the protection status


Protecting your mail from viruses

Kaspersky Anti-Virus provides real-time protection of incoming and outgoing messages.

To protect your mail from viruses:

enable real-time protection and make sure that the [image] Disable Real-Time Mail Protection box in the Troubleshooting dialog box is unchecked.

The following rules of Kaspersky Anti-Virus operation apply to email messages:
  • Your email is protected from viruses regardless of which mail client you use1. All incoming and outgoing messages are scanned as soon as they are received or sent.
  • Upon detection of an infected object in a mail message, a recommended action will be performed on each infected object: Kaspersky Anti-Virus will attempt to disinfect such object and, if disinfection is not possible, delete the object from the mail message.
  • If you use mail services of remote web-servers with an Internet browser, for example, with Microsoft Internet Explorer, Kaspersky Anti-Virus will scan attachments when you open them or save them to your disk.
Email databases imported from other computers but not yet connected may be checked for viruses by starting an on-demand scan.

To scan Microsoft Outlook or Microsoft Outlook Express mailboxes:
  1. Make sure that box [image] Do not scan mailboxes in the Troubleshooting dialog box is unchecked.
  2. Click Scan objects in the left section the Protection tab.
  3. In the Select Objects to Scan dialog box, check the box [image] Mailboxes.
  4. Click Scan.
As a result, all Microsoft Outlook and Microsoft Outlook Express mail databases and mail format files will be scanned.

As a result of processing Microsoft Outlook and Microsoft Outlook Express email databases, the date and time of their modification will always be changed, irrespective of the action selected to be performed on the object.

To scan email databases in the format of another email program (for example, TheBat) or databases that you have on disk (for instance, brought home from the office),
  1. Use the Scan objects link in the left section of the Protection tab.
  2. In the Select objects to scan window that opens select a disk or a folder where these databases are stored.
  3. Press Scan.
1Kaspersky Anti-Virus® Personal provides real-time protection of all incoming POP3 and outgoing SMTP email messages.


Treating infected and suspicious objects

The actions performed by Kaspersky Anti-Virus upon detection of infected or suspicious objects, depend on the real-time protection and on-demand scan settings that you have specified. This topic discusses situations in which Kaspersky Anti-Virus offers a choice of actions to be performed on infected or suspicious objects.
Such situations occur when you select the following actions to be performed on infected or suspicious objects:
  • Real-time protection :
      • Block access and prompt user for action
  • On-demand scan :
      • Prompt user for action
Upon detection of an infected or suspicious object a message will be displayed, containing:
  • a detailed description of the object with an indication of the name of the virus that has infected or may have infected this object, or the name of the malware if it is a malicious program;
  • a list of possible actions that you can perform on this object. This list always contains an action recommended by Kaspersky Lab, which is flagged by the word "recommended". Depending on the type of detected object, you may be offered the following actions:
    • Disinfect - attempt to disinfect the infected object if treatment is possible.
    • Delete - delete the infected or possibly infected object.
    • Skip - do not perform any actions; write information on this object into the report.
    • Quarantine - quarantine the suspicious object so that later it can be checked, restored, sent to Kaspersky Lab for analysis or deleted (see section Working with quarantined objects).
You can also apply the selected action to all objects with the same status by checking the corresponding checkbox. Thus, to apply the selected action to all infected objects that cannot be disinfected, check the [image] Apply to all infected objects, that can be disinfected (within this session) box.
If you close this window by pressing the [image] button in the top right corner of the window, the object will be skipped.
A message about the detection of an infected object


Renewing your License

You must have a license key to be able to use Kaspersky Anti-Virus. The license key is included in the distribution kit and enables you to use the application from the date of purchase and key installation.

Kaspersky Anti-Virus WILL NOT WORK without the license key!
After the license expires, Kaspersky Anti-Virus retains its functionality except for the anti-virus database and application module update services. You will still be able to scan your computer and email for viruses, and disinfect infected objects but you will only be able to use out-of-date databases that were released on the date of the license expiration. Therefore, we do not guarantee 100% protection from new viruses that appear after your Kaspersky Anti-Virus license expires.
To avoid possible infection of your computer by new viruses, you are advised to renew your Kaspersky Anti-Virus license.
Kaspersky Anti-Virus will notify you about the license expiration two weeks prior to the expiration date. A reminder message will be displayed each time you start the application during this period.

To renew your license, you must purchase and install a new license key for Kaspersky Anti-Virus Personal. To obtain a new key:
  1. Contact the vendor from whom you purchased the product and purchase a new Kaspersky Anti-Virus license key.

or

Purchase a new license key directly from Kaspersky Lab. To do this, send a request directly to the Sales Department of our company (sales@kaspersky.com) or fill in a form at our website (http://www.kaspersky.com), section Products а Renew Your License. Upon receipt of your payment, we will send a new license key to the email address specified in your order.
  1. Install the new license key as described below:
    • click License Keys in the left section of the Support tab.
    • After the window Managing License Keys opens, click Add and select the new license key in the standard Windows Select dialog box.
The Managing License Keys dialog box


Downloading updates

To maintain anti-virus protection, Kaspersky Anti-Virus users must download updates to its application modules and anti-virus database.
Timely updating of the anti-virus database ensures the safety of your computer. New viruses appear daily, and in response Kaspersky Anti-Virus experts update our anti-virus database with the latest information about these new threats. You are advised to update your anti-virus database at least once every 12 hours; during periods of virus outbreaks the anti-virus database should be updated as frequently as possible, preferably at least once every 3 hours.
To download updates, Kaspersky Anti-Virus can either connect to the Kaspersky Lab's update servers accessible via the Internet, or copy the required files from a local folder in your computer depending on the settings (for details see below).
Updates can be downloaded either on demand or automatically, by scheduled update. To download updates, your computer must be connected to the Internet. The application copies the updates from the remote update servers and installs them automatically on your computer.

See also:

When you should download updates

Downloading updates from the Internet

Downloading updates from a local folder

Updating Kaspersky Anti-Virus Personal application modules

Updater settings. Scheduled updates

On-demand updates. Updates downloading process


When you should download updates

The application will notify you when your anti-virus database needs updating. You can also check the status of your anti-virus database in the right section of the Protection tab, which will offer advice.
The following symbols are used to reflect the updating status:
- your anti-virus database has been recently updated or is being updated at the moment.

- your anti-virus database must be updated. If updating is impossible because your license has expired, the application offers you information about renewing your license.

- you must update your anti-virus database immediately because it is either very old or missing altogether.


Downloading updates from the Internet

Kaspersky Lab update the anti-virus database residing on the update servers every three hours.
Kaspersky Lab's update servers are HTTP and FTP servers where the most recent version of the anti-virus database is kept.
To ensure that your anti-virus database is always updated from Kaspersky Lab's update servers, you must apply the settings described in the instructions below:
  1. Follow the Configure Updater link in the left part of the Settings tab.
  2. When the Updater settings dialog box opens, select one of the following types of updating from the Update type drop-down list:
    • from Internet, standard databases - anti-virus database that allows you to detect all currently existing malware and disinfect objects and data infected with such malware.
    • from Internet, extended databases - standard database and additional database that allows you to detect programs giving intruders remote access to your data.
The standard anti-virus database by itself ensures efficient anti-virus protection of your computer. Using the extended database may affect the speed of the application operation.
  1. If you use a Dial-up Internet connection and you do not want Kaspersky Anti-Virus to interrupt the update process during temporarily disconnections from the Internet, check the box [image] Wait for Dial-up network connection.
This setting is used only for automatic scheduled anti-virus database update!
  1. Press ОК.
The Updater Settings dialog box

Your Internet connection settings will be copied from the Internet Explorer settings. To view and/or modify these settings, select Start а Settings а Control Panel а Internet Options а Connections.

See also:

Downloading updates from a local folder

Updating Kaspersky Anti-Virus Personal application modules

Updater settings. Scheduled updates

On-demand updates. Updates downloading process


Downloading updates from a local folder

If you do not have access to Kaspersky Lab's update servers (which may be the case if, for instance, you do not have Internet access), you may call our main office on +7 (095) 797-87-00 and get information about Kaspersky Lab partners who can supply you with the anti-virus database, compressed using zip format, on floppy disks or CD-ROMs.

When ordering the anti-virus database, make sure you specify which type of anti-virus database (standard or extended) you wish to receive.
After you receive a zip file with the anti-virus database, you can decompress the database and copy it into any folder of your computer.
To configure anti-virus database updates from a local folder:
  1. Click the Configure Updater link in the left section of the Settings tab .
  2. When the Updater settings window opens select the entry from a local folder in the Update Type drop-down list.
  3. Specify the path to the folder containing the uncompressed zip archive with your anti-virus database, using a standard Windows Browse for Folder dialog box.
  4. Press ОК.
The Updater settings dialog box

See also:

Downloading updates from the Internet

Updating Kaspersky Anti-Virus Personal application modules

Updater settings. Scheduled updates

On-demand updates. Updates downloading process


Updating Kaspersky Anti-Virus Personal program modules

Updating Kaspersky Anti-Virus Personal application modules

In addition to the anti-virus database, you can also update Kaspersky Anti-Virus application modules. Application module updates are uploaded to the Kaspersky Lab's update servers from time to time, as required.
You can update application modules either from the update servers or from a local folder. To do this, check the [image] Update program modules box in the Updater settings dialog box.
If you wish to update the application modules from a local folder, make sure to request the application module updates when ordering the anti-virus database from your vendor.

See also:

When you should download updates

Downloading updates from the Internet

Downloading updates from a local folder

Updater settings. Scheduled updates

On-demand updates. Updates downloading process


Updater settings. Scheduled updates

Kaspersky Lab experts recommend that you schedule the application to download updates every 12 hours; during periods of virus outbreaks the anti-virus database should be updated as frequently as possible, preferably at least once every 3 hours.

To schedule updating of your anti-virus database:
  1. Click the Configure Updater link in the left section of the Settings tab.
  2. After the Updater settings dialog box opens check the [image] Enable automatic updates box.
  3. Select the required updates frequency from the Update frequency drop-down list.

See also:

Downloading updates from the Internet

Downloading updates from a local folder

Updating Kaspersky Anti-Virus Personal application modules

On-demand updates. Updates downloading process


On-demand updates. Updates downloading process

To download the anti-virus database updates:

click Update now in the left section of the Protection tab or click the hyperlink in the message, prompting you to update your anti-virus database, in the right section of the Protection tab.

On-demand or scheduled updates downloading can only be initiated if your computer is connected to the Internet. If an Internet connection is unavailable, the updating process will not start.
The updates downloading process includes the following stages:
  1. The application receives a list and information on the size of updates from Kaspersky Lab's update servers.
  2. The local anti-virus database and application modules are compared with the data retrieved from the server. If you have the latest anti-virus database installed on your computer, a pop-up message will confirm that your anti-virus database is up-to-date.
  3. The Update size field of the Updating dialog box displays the total size of the updates to be downloaded. If updating is not required, the process will exit. Otherwise, the application will start copying files from Kaspersky Lab's update servers. The percentage completion of downloading is reflected in the progress bar, and the Total d ownloaded field indicates the size of downloaded updates in kilobytes. Once downloading is complete, the anti-virus database will be automatically installed on your computer.
The Updating dialog box

See also:

Downloading updates from the Internet

Downloading updates from a local folder

Updating Kaspersky Anti-Virus Personal application modules

Updater settings. Scheduled updates


Additional settings

Kaspersky Anti-Virus offers several additional options that may be used to configure and operate the product, namely:
  • Configuring the parameters of real-time protection and full computer scan.
  • Managing quarantined objects.
  • Application report analysis.
  • Additional settings.
This chapter contains a detailed discussion of each of the above options.


Configuring real-time protection

Troubleshooting real-time protection

By default real-time protection of your computer uses the settings recommended by Kaspersky Lab, but you have a high degree of control over the settings. In addition to the ability to modify the major parameters of real-time protection, you may exclude a certain group of objects from the scope of real-time protection, and either partially deactivate or completely disable real-time protection. Such exclusions allow you to decrease the total number of files scanned during real-time protection. For example, you can exclude email messages or scenarios (script files) from scanning, and limit the maximum scan time for an object in seconds.

Additional parameters apply for all real-time protection levels (Maximum Protection, Recommended, and High Speed).
These real-time protection parameters can be accessed from the Troubleshooting dialog box. You can open this dialog box by clicking Troubleshooting in the Configure Real-Time Protection dialog box.
Troubleshooting real-time protection
To exclude files of a particular type or certain folders from the scan scope, first check the [image] Enable the list of excluded objects box and click Change. To define exclusions, show the path to such selected files or specify their type using a mask (for example, *.bmp).
Valid examples of exclusion masks are shown below. In these examples, "?" is a wildcard that may represent any single character:
  • Masks used without specifying the path:
    • *.exe - all files with extension exe
    • *.ex? - all files with extension ex?
    • test - all files with filename test
  • Masks used with absolute paths to objects:
    • C:\dir\*.* - all files in folder C:\dir\
    • C:\dir\*.exe - all files with extension exe in folder C:\dir\
    • C:\dir\*.ex? - all files with extension ex? in folder C:\dir\
    • C:\dir\test - file C:\dir\test only
    • C:\dir\ - all files in folder C:\dir\ including all subfolders
  • Masks used with relative paths to objects:
    • dir\*.* - all files in all folders under dir\
    • dir\test - all files with filename test in folders under dir\
    • dir\*.exe - all files with extension exe in all folders under dir\
    • dir\*.ex? - all files with extension ex? in all folders under dir\
    • dir\ - all files in all folders under dir\ and in all their subfolders
Masks *.* and * are not legal if no path is specified.
After the Exclusions window opens, modify the list of exclusions using the Add, Edit, and Remove buttons. When the list of exclusions is complete, click OK. The modified list will be applied immediately.
Specifying exclusions from the scope of real-protection
Kaspersky Anti-Virus allows you to re-apply the default (recommended) settings at any time, thus discarding the customized settings.
To restore the default real-time protection settings, click Apply default settings recommended by Kaspersky Lab in the right section of the Settings or Protection tabs in the main application window.
Information on real-time protection status


Configuring the on-demand scan parameters

Troubleshooting on-demand scan

By default Kaspersky Anti-Virus scans on demand all objects stored on your hard drive using settings recommended by Kaspersky Lab.
In addition to selecting the anti-virus protection level and customizing the types of action to be performed upon the detection of infected or suspicious objects, you can, as with real-time protection, configure additional scan parameters for all levels that reduce the number of objects to be scanned.

Additional scan parameters can be configured for all full scan levels (Maximum Protection, Recommended and High Speed).
Additional scan parameters can be accessed from the Troubleshooting dialog box. You can open this dialog box by clicking the Troubleshooting link in the On-Demand Scan settings dialog box .
Specifying exclusions from the scope of the on-demand scan
Here you can exclude objects from the scan scope by ticking the corresponding checkbox, or selecting folders or files (using file masks) that you wish to exclude from the scan scope in the same way that exclusions from the real-time protection scope were specified.
You are advised not to exclude logical disks with file systems created using the subst command. This will not have any effect because Kaspersky Anti-Virus recognizes this logical disk as a folder, and therefore scans it.
To restore the settings recommended for any level, click restore default settings in the right section of the Settings tab or in the comments on the real-time protection status in the Protection tab.


Working with quarantined objects

A heuristic code analyzer, detecting up to 92% of new viruses, determines whether a file is suspicious in terms of possible presence of a virus. This mechanism is very effective but sometimes gives false positives. Is it possible to determine whether a file is actually infected with a new virus not yet recorded in the anti-virus database or whether this is just a false alarm?
During the scan of the entire computer or individual disks files and in real-time protection mode, Kaspersky Anti-Virus quarantines all suspicious objects. Various actions (scan, recover, delete, etc.) can later be applied to the quarantined objects. Quarantined files are stored using a special format and do not constitute any danger to your computer.
You are advised to update the anti-virus database before scanning quarantined files. The update may contain information about any viruses which have infected the quarantined files, and you may be able to repair the files.
You can work with possibly infected files in the Quarantine window, which can be opened by clicking View Quarantine in the Protection tab of the main application window or by clicking the View Quarantine link in the Scan window.
The following actions can be performed from the Quarantine window:
  • Quarantine a file suspected of being infected with a virus that is not detected by Kaspersky Anti-Virus. To quarantine a file, click Add and select the suspicious file in the standard file selection window. The file will be added to the list with the status quarantined by user.
  • Scan and disinfect all of, or a subset of, the suspicious files using the current anti-virus database. To do this, either click Scan All, or select the files to be scanned and click Scan.

After the scanning and disinfection of a quarantined object its status may change to infected, false alarm, not infected, ect. In this case, a message will give recommendations on how to treat this file.

The infected status means that the object was identified as infected but its disinfection failed. You are advised to delete such objects.

All objects with the false alarm status may be safely restored as their previous possibly infected status was incorrectly assigned by Kaspersky Anti-Virus.

Quarantine for suspicious files
  • Restore files from the quarantine folder to their original folders. To restore an object, select it in the list and click the Restore button. When restoring objects quarantined from archives, email databases and mail format files, you must specify the folder to which they are to be restored.
You are advised to restore only objects with a false alarm, not infected or disinfected status because restoring other objects may infect your computer!
  • Send suspicious objects to Kaspersky Lab for analysis. You are advised to only send objects that have retained their possibly infected status after numerous attempts to scan and disinfect them. To send a file to Kaspersky Lab, click Send (for details see section Contacting Technical Support).
Note that files that you send to Kaspersky Lab for analysis should be scanned by Kaspersky Anti-Virus, using an anti-virus database, updated at most one day before you send the file.
  • Delete a quarantined object or a selected group of objects. Delete only files that cannot be disinfected. To delete such files, select them in the list and click the Delete button.

See also:

Additional quarantine settings


Additional quarantine settings

You can customize the settings for the creation and operation of the quarantine. To configure the quarantine settings, click Configure Quarantine on the Settings tab of the main application window and edit the following parameters in the window that will open:
    Automatically scan quarantined objects every time the anti-virus database is updated. This mode provides for an automatic scan of quarantined objects each time the anti-virus database gets updated.
    Kaspersky Anti-Virus will not be able to scan quarantined objects immediately after you update your anti-virus database if you were working with quarantine at the time of update.
    Quarantine settings
    Quarantine maximum size ... MB. By default, the quarantine size is not limited. If you wish to restrict the total size of the quarantined files, check the corresponding box and specify the size using the up and down arrows of the corresponding spin-button box (the default value is 100 MB). If the quarantine size is exceeded, the application will notify you with a message.
    Delete objects stored longer than ... days. By default, the storage time of quarantined files is not limited. You can limit this period by checking the corresponding box and specifying the number of days in the corresponding spin-button box (the default value is 90 days).

See also:

Working with quarantined objects


Working with reports

The application maintains reports during anti-virus scans, while the anti-virus database is updating and while real-time protection is enabled. The reports include information about the objects scanned, processing results and general statistical data.
A complete list of all tasks performed by Kaspersky Anti-Virus may be viewed in the Reports windows. You can open this window by clicking View Reports in the left section of the Protection tab. The status of each task and the date and time of its completion are logged in these reports.
Reports
The report status icons are as follows:
or [image] - Information reports (for example, the task started, the task completed, the task is in progress, the task is paused).

- Attention (for example, Attention! Untreated objects remain).

- Note (for example, the task was interrupted).

As a rule, information reports are provided for reference only and are of no special interest. The display of information messages can be disabled by unchecking the [image] Show information reports box.
Reports can be sorted by report type, by title (in alphabetical order) and by task completion time. To sort the reports by any of the above columns, simply click the header of the corresponding column.

To view the settings, statistics and outcome of a specific task listed in the log, select the task and click the Details button, or double-click the task.

This will open a new window with a detailed report on the task in the Statistics, Report, and Settings tabs.

During a full scan, you can monitor the task performance in the same way.
For scanning tasks, the Statistics tab displays general information about the task, including: the date and time the task was started, the total number of files scanned and the number of infected, disinfected and quarantined objects. For the update task this tab will display the total size of the update files at the source (Kaspersky Lab's update servers or local folder) and the total size of files downloaded to your computer.
The Statistics tab
For scanning tasks, the Report tab by default only displays information about viruses detected. To display information about uninfected files as well, check the [image] Log all messages box in the Additional Settings window of Kaspersky Anti-Virus. If you do so, the Report tab will contain information on each scanned object. For the update task this tab displays information on each step: on establishing connection with the update servers, about the downloaded files, and installation information. This information will always be displayed irrespective of whether or not the [image] Log all messages box in the Additional Settings window is checked.
The Report tab
For scanning tasks, the Settings tab displays parameters used by the task including the scope of the scan, the protection level set for these tasks and the types of action to be performed on suspicious and infected objects. This information also includes the list of exclusions from the scan scope if such exclusions have been specified. For update tasks the update type and update source are displayed.
The Settings tab
You can select the tasks to be viewed in the Reports windows or in the detailed task report dialog box using the Next > and the < Previous buttons, or by selecting the name of the task from the corresponding drop-down list.

See also:

Displaying information in reports

Exporting and sending reports


Displaying information in reports

Kaspersky Anti-Virus allows you to choose which information will be displayed in reports. You may configure the application so that only important information will be displayed in reports, while information and other reference messages will be excluded.
If you wish all messages to be stored in the report, check the [image] Log all messages in the Additional Settings window . You may view all messages displayed for instance when you start a full computer scan in the Scan window in the Report tab.
If the Log all messages box is checked, all scan information will be logged in the report, including messages about a successful scan.
If the box is not checked, only important information will be displayed: for example a message that an object has not been scanned due to an error. Messages about successful scans will not be displayed.
To disable displaying information messages within the current session without unchecking the [image] Log all messages box,

right-click the window while viewing reports in the Report tab to open a shortcut menu and uncheck the [image] Show detailed report flag.

Shortcut menu - Report tab

If the [image] Log all messages box in the Additional Settings window is unchecked, the [image] Show detailed report option in the context menu will also be unchecked and disabled and you will not be able to configure this feature.
When you are viewing the report in the monitoring mode (i.e. during the scan in the Report tab), by default you will always see the last record of the report. To disable this mode, right-click to open shortcut menu and uncheck the [image] Show last record of the report box or simply select a record in the report.

See also:

Working with reports

Exporting and sending reports


Exporting and sending reports

Kaspersky Anti-Virus allows you to edit the list of reports created based on the results of various tasks. You may access available editing options from the shortcut menu, which you can open by right-clicking the Report window.
Shortcut used for managing reports

Depending on the type of report (the types being Attention, Note and Information message), some shortcut menu options may not be available. Thus the option of exporting a report to a file and sending it to Kaspersky Lab is available only for Attention reports (related, for instance, to tasks that have resulted in an application error). Note also that you cannot delete a report while the task creating the report is in progress.

Exporting a detailed report to a file allows you to view its contents in the form of an Microsoft Excel table.

If any task (for instance, a computer scan or anti-virus database updating process) is interrupted or results in an error and you do not know what caused this application behavior, you may send a report on the task to Kaspersky Lab.

To do this, select the report you wish to send in the Reports window, right-click the selected report and choose the Send report to Kaspersky Lab option in the shortcut menu. This will open a new window of your default email client application (for example Microsoft Outlook Express) containing a new email message with the report file attached to it. Send this message and Kaspersky Lab will respond to it as soon as possible.

Mail messages are automatically created using exclusively Microsoft Outlook or Microsoft Outlook Express. If you have a different mail program installed on your computer (for instance, The Bat), you will have to configure your mail program's Simple MAPI to ensure that automatic message creation is supported.
See also:

Displaying information in reports

Working with reports


Additional settings of Kaspersky Anti-Virus Personal

In addition to configuring the settings for particular tasks, Kaspersky Anti-Virus allows configuration of some general and service parameters. To do this, follow the link Additional Settings in the left part of the Settings tab and modify the settings as required:
    Display pop-up messages - enable the display of all pop-up tips accompanying the operation of Kaspersky Anti-Virus. You are advised not to disable this mode because the application often operates in interactive mode requiring the user's feedback when processing objects.
    Enable sound notification - enable sound effects accompanying notifications displayed during Kaspersky Anti-Virus operation. The set of audio files used for sound notifications can be changed by going to Start->Settings->Control Panel-> Sounds and Audio Devices->Sounds.
    Log all messages - enable recording of all messages in their corresponding reports (information messages, error information, etc.). By default, this mode is disabled and the report will only record important events, such as an error while performing a task, the interruption of a task, etc.
    Do not store reports longer than ... days - by default, reports are kept for thirty days. This period may be changed by entering a value in the field on the right side. To remove this restriction, uncheck the corresponding box. While the application is loading, a check for reports stored longer than the specified period will be performed and obsolete reports will be deleted.
    Launch Kaspersky Anti-Virus Personal at system startup - enable the automatic launch of Kaspersky Anti-Virus when the operating system is restarted.
You are strongly advised not to disable the automatic launch of Kaspersky Anti-Virus because this increases the risk of your computer becoming infected.

You cannot modify this setting if you do not have Administrator's rights for this computer.

    Use password for application protection - enable prompting for password when closing the main application window and when disabling real-time protection. You are advised to enable this option if there are other users who have access to your computer whom you do not to alter your anti-virus protection settings or perform any tasks with Kaspersky Anti-Virus. After you have enabled this option, enter your password in the Password field accepting alphanumeric input (the password may be from 1 to 32 characters long) and then retype the password in the Confirm password field. This password is specific to Kaspersky Anti-Virus.
Additional settings of Kaspersky Anti-Virus Personal
Kaspersky Lab
WWW: http://www.kaspersky.com

E-mail: support@kaspersky.com


Contacting Technical Support

Kaspersky Lab's Technical Support is available to all registered users of Kaspersky Anti-Virus in the following cases:
  • If the application seems to work improperly and errors are frequently encountered.
  • If Kaspersky Anti-Virus detects a suspicious file that contains critical data and the application denies access to it, while you need to continue working with the file.
To send a message to Kaspersky Lab's Technical Support about any failures encountered during application operation:

click Send question to technical support in the left section of the Support tab of the main application window.

The application will automatically create a new message using the default mail client program installed in your computer, for example, Microsoft Outlook. It will automatically attach a text file to the message with a description of your system and all required data about your copy of Kaspersky Anti-Virus. You should provide a detailed description of the application fault that you encountered and send the message. Our technical consultants will respond to your request as soon as possible.
If Kaspersky Anti-Virus quarantines a file that is possibly infected, you may wish to update the anti-virus databases and try to disinfect the object (for details see section Working with quarantined objects). However, if this attempt to disinfect the file fails and you urgently need this file, please feel free to send the file to Kaspersky Lab for expert analysis. The file may be infected with an unknown virus or it may be a false alarm situation.

Attention! You may send files that you suspect to be infected to Kaspersky Lab only after you have scanned them using the anti-virus database current on the day you are sending the file.
To send a file to Kaspersky Lab for expert analysis:

select the file in the Quarantine window and click the Send button.

The application will automatically create and open a new message using the default mail client program installed in your computer, for example, Microsoft Outlook Express, with the suspicious file attached. Send this message. Kaspersky Lab will analyze the file you have sent and try to recover all data it contains. Whatever the outcome of the recovery, you will receive a detailed report with the results of the analysis.
Note that each of the files you send must have been scanned with Kaspersky Anti-Virus maximum one day before you send it.
It may happen that even though Kaspersky Anti-Virus does not detect any possibly infected files during the scan, you feel certain that one or more files in your computer are infected with a new virus. You can send such files to Kaspersky Lab for analysis.
In order to send files you suspect of being infected to Kaspersky Lab for expert analysis:

click Send file for analysis in the left section of the Support tab. Select suspicious files using a standard Windows file selection dialog box.

The subsequent steps, required to send a mail message to Kaspersky Lab are identical to the procedure of sending possibly infected objects from the Quarantine window.


Key tasks performed using Kaspersky Anti-Virus

This section describes the key tasks that are most frequently performed using the Kaspersky Anti-Virus program.
Using this Appendix, you can quickly find information on a particular task, including instructions on how this task can be configured, started, etc.


How to update the anti-virus database

The program can initiate the updating process, whether scheduled or on-demand, only if your computer is connected to the Internet. Otherwise the updating process cannot be performed.

In order to download anti-virus database updates on demand,
use the Update now link in the left section of the Protection tab or a link located within the text of an information message about the necessity to perform updates in the right section of the tab.

In order to set up a schedule for regular anti-virus database updating,
  1. Follow the Configure Updater link in the left section of the Settings tab.
  2. After the Updater settings window opens, check the [image] Enable automatic updates box.
  3. Select the required value from the Update frequency drop-down list.


How to scan your computer for viruses

You can scan your computer for viruses either by performing an on-demand scan or by setting up a scheduled automatic scan:

In order to start an anti-virus scan of your entire computer,

follow the Scan My Computer link in the left part of the Protection tab.

In order to set up a schedule to perform a regular computer scan,
  1. Follow the Configure On-Demand Scan link in the left part of the Settings tab.
  2. After the On-Demand Scan settings window opens, follow the Schedule Scanning link.
  3. In the Schedule Scanning window that will open specify the desired scan frequency:
    4. Specify scan interval in days - perform an anti-virus scan at a certain interval in days. The default option is a daily scan at 8 pm. If you wish to modify the default schedule and start time, enter the desired scan interval in days in the Every field in the Scan parameters section. Specify the scan start time in the Scan start field.

    Scan on specific weekdays - specify weekdays on which you wish the program to perform the scan. By default the program suggests performing the scan weekly, every Friday at 8 pm. If you wish to modify the default schedule, select weekdays in the Scan parameters section and specify the scan start time in the Scan start field.

  4. Press the OK button.


How to change the protection level

The anti-virus protection of your computer is provided based on the selected protection level. The default protection level is Recommended. The parameters of this default protection level match the recommendations of Kaspersky Lab experts. You may increase or decrease the extent of your anti-virus protection, by simply changing the protection level.

In order to change the real-time protection level:
  1. Click Configure Real-Time Protection in the left section of the Settings tab or modify settings in the status area of the Protection tab.
  2. When the Real-Time Protection settings dialog box opens, select the protection level using a slider. By changing the protection level, you change the balance between the speed of the scan and the number of objects to be scanned. The fewer objects that are scanned the faster the scan will be.
In order to change the on-demand scan level:
  1. Click modify settings in the right section of the Settings tab or Configure On-Demand Scan in the left section of the tab.
  2. In the On-Demand Scan settings window that will open after you click the above link, select a desired scan level by moving the Scan level slider up or down.


How to enable / disable Kaspersky Anti-Virus

Immediately after your operating system startup, Kaspersky Anti-Virus will virus scan all objects executed at system startup, computer memory and its own application modules.
After this, real-time protection of your computer will be automatically enabled which will be indicated by a red icon [image] in the system tray.

You can disable real-time protection manually. In order to do this:
    • right-click the [image] icon in the system tray;
    • when the shortcut menu appears, select Disable Real-Time Protection.
Real-time protection of your computer will be then disabled and the active [image] icon (red) will turn inactive [image] (gray).

In order to disable automatic launch of Kaspersky Anti-Virus Personal after your system restarts:
  1. Follow the Additional Settings link in the left section of the Settings tab.
  2. In the window that will open, uncheck the [image] Launch Kaspersky Anti-Virus at the system startup box.

We strongly recommend that you do not disable Kaspersky Anti-Virus as it may result in your computer becoming infected.

In order to enable Kaspersky Anti-Virus:

press Start, select Programs, and in the list of programs that will open find the group Kaspersky Anti-Virus Personal and within this group choose the entry Kaspersky Anti-Virus Personal.


How to scan a selected object

You can select an object for scanning using Kaspersky Anti-Virus Personal or standard Windows tools (for example, Windows Explorer or My Computer, etc.)

In order to scan an object selected using standard Windows tools
select and right-click the object you wish to scan, then select the Scan for viruses option in the shortcut menu that will open.

In order to select an object using Kaspersky Anti-Virus,
  1. Follow the Scan objects link located in the left section of the Protection tab. A Select Objects to Scan window will open. This window contains the list of objects that can be scanned for viruses, and is equipped with interface buttons for editing this list and controlling the scan.
  2. Select the objects you wish to scan.
  3. If you wish to add a new object to the list, press the Add button and select the required file or folder in the standard Select File dialog box that will open.
  4. Press the Scan button to start the scan.


How to scan mail

Kaspersky Anti-Virus Personal provides real-time protection of incoming and outgoing e-mail messages.

In order to protect your mail from viruses,

simply enable real-time protection and make sure that the [image] Disable Real-Time Mail Protection box in the Troubleshooting window is unchecked.

E-mail databases imported from other computers but not yet connected may be checked for viruses by starting an on-demand scan.

In order to scan Microsoft Outlook or Microsoft Outlook Express e-mail databases:
  1. Make sure that box [image] Do not scan mailboxes in the Troubleshooting dialog box is unchecked.
  2. Click Scan objects in the left section the Protection tab.
  3. In the Select Objects to Scan dialog box check box [image] Mailboxes.
  4. Click Scan.
As a result, the program will scan Microsoft Outlook and Microsoft Outlook Express mail databases.

In order to scan e-mail databases in the format of another e-mail program or databases that you brought home on a disk (for instance, from the office),
  1. Use the Scan objects link in the left section of the Protection tab.
  2. In the Select Objects to Scan window that will open select a disk or a folder where these databases are stored.
  3. Press Scan.


How to scan a CD or a floppy disk

You can start a scan of removable drives from the main application window of Kaspersky Anti-Virus Personal or from the Windows shortcut menu available from Windows Explorer, on the Desktop and other standard Windows tools.

In order to scan removable drives from the Windows shortcut menu:
select and right-click drives you wish to scan (you may select both a CD-ROM and a floppy drive at once). In the Windows shortcut menu that will open select Scan for viruses.

In order to scan a CD-ROM or a floppy disk for viruses from the main application window of Kaspersky Anti-Virus Personal:
  1. Insert the disk into the CD-ROM drive or the floppy disk into the floppy drive. Note that the program can scan both the CD and floppy disk at the same time.
  2. Click Scan removable drives in the left section of the Protection tab.

or

Using the Scan objects link, go to the Select Objects to Scan window, select removable drives and press the Scan button.


How to disable the protection of mail, scripts, or other objects

If, for any reason, you do not want to scan mail, scripts or other objects for viruses, you should disable protection of such objects.
You may choose objects that you do not want to be scanned while they are being opened, executed or closed, and objects that should not be scanned during an on-demand scan.
In order to disable real-time protection of objects:
  1. Follow the Configure Real-Time Protection link in the left section of the Settings tab or the modify settings in the status information area of the Protection tab.
  2. In the Real-Time Protection settings window that will open, follow the Troubleshooting link to access your computer's real-time protection settings.
  3. Check objects that you do not wish to scan for viruses.
  4. In order to exclude a particular object from the scan scope, check the [image] Enable the list of excluded objects box and click the Change... button. In the window that will open, specify the exclusions and click the OK button. From that moment the objects you have excluded will not be scanned.
In order to exclude objects from the on-demand scan scope:
  1. Follow the Configure On-Demand Scan link in the left section of the Settings tab or the modify settings in the status information area of the Protection tab.
  2. In the On-Demand Scan settings window that will open, follow the Troubleshooting link to access your computer's on-demand scan settings in a similar way to the procedure described for real-time protection.
You must remember that disabling protection for any objects increases the risk of your computer becoming infected.


What should I do if I encounter errors in the operation of Kaspersky Anti-Virus Personal?

Should you encounter any problems or errors in the program operation while you are using your copy of Kaspersky Anti-Virus Personal (for example, the program displays unusual behavior, your computer slows down considerably, etc.), we recommend that you try to determine what may have caused the problem by considering the following:
  1. If the problem is a slowdown of your computer, then you may have started a computer scan using the Maximum Protection level, which does cause some decrease in performance, as does the use of the extended anti-virus database. In order to eliminate this problem, we recommend that you switch to the Recommended protection level. (see section How to change the protection level), use the standard anti-virus database rather than the extended database (see section Downloading updates from the Internet) or exclude some objects from the scope of real-time protection or on-demand scan (see section How to disable the protection of mail, scripts, or other objects).
  2. If you encounter errors during program operation, send a message including the problem description to Kaspersky Lab (see section How to send a question to Kaspersky Lab).
  3. Send a report on the task that resulted in the error to Kaspersky Lab (see section Exporting and sending reports).


How to send a question to Kaspersky Lab

In order to send a message to inform the Technical Support Service about any errors in program operation:
use the Send question to technical support link, located in the left section of the Support tab in the main application window.
The program will automatically create a new message using the default mail client program installed in your computer, for example, a Microsoft Outlook message. It will have a text file automatically attached to the message with a description of your system and all required data about your copy of Kaspersky Anti-Virus Personal. Provide a detailed description of the problem in the program operation that you have encountered and send the message. Our technical consultants will try to respond to your request as soon as possible.


How to send a suspicious file to Kaspersky Lab

In order to send a possibly infected file to Kaspersky Lab for analysis:

select the file you wish to send in the Quarantine window and press the Send button.

The program will automatically create and open a new message using the default mail client program installed in your computer, for example, Microsoft Outlook Express, with the possibly infected file attached. Send this message. Kaspersky Lab experts will carefully analyze the file you have sent and try to recover all data contained in this file. In any case, you will receive a detailed answer with the results of the analysis.
In order to send files you suspect of being infected to Kaspersky Lab for expert analysis:

click Send file for analysis in the left section of the Support tab. Select the files you wish to send using the standard Windows file selection dialog box.

The subsequent steps required to send a mail message to Kaspersky Lab, are identical to the procedure of sending possibly infected objects from the Quarantine window.


How to view a report

A complete list of all tasks performed by Kaspersky Anti-Virus Personal may be viewed in the Reports windows. You can open this window by clicking View Reports in the left section of the Protection tab. The status of each task and the date and time of its completion are logged in such reports.
You can view the settings for a specific task listed in the log, its statistics, and a report on the task results in the corresponding tabs by clicking the Details button (after you have selected the task you wish to view) or by double-clicking a task.
This will open a new window with a detailed report on the task in the Statistics, Report, and Settings tabs.

See also:

Working with reports

Displaying information in reports

Exporting and sending reports


How to restore quarantined files

Kaspersky Anti-Virus Personal quarantines all files possibly infected with a virus or a virus modification that are detected during a scan of your computer (or individual disks, files etc.) or in real-time protection mode.
In order to restore a quarantined file:

select it in the list of quarantined objects and click the Restore button.

If an object was quarantined from a composite object (archive, mail database, etc.), it cannot be restored within this original composite object and the program will prompt you for a folder into which you wish to restore this object.

We recommend that you restore only objects with a false alarm status because restoring other objects may lead to infection of your computer!


How to configure sound notification

Kaspersky Anti-Virus Personal allows you to configure the sound notification that accompanies program operation.
You may enable or disable the sound notification in the Additional Settings window that is accessible from the Settings tab by clicking the Additional Settings link and checking (or unchecking) the Enable sound notification box (checked by default).
Kaspersky Anti-Virus Personal plays a sound file when a task is completed, when the program prompts user to enter a password or when an infected object is found.
You can change the set of audio files used for the above events using files provided with the operating system or your own audio files (in order to do this go to StartаSettingsаControl PanelаSounds and Audio DevicesаSounds). You can also disable playing audio files for the above events and assign certain audio files for starting and exiting the program.


Frequently asked questions

This chapter contains a detailed discussion of questions most frequently asked by our users regarding the installation, configuration and operation of Kaspersky Anti-Virus.

Question: Why does Kaspersky Anti-Virus cause a certain decrease in my computer performance and impose a considerable load on the processor?

The process of virus detection is a purely computational (mathematical) task that involves analysis of structures, computation of checksum calculation and mathematical data transformation. Therefore, the main resource consumed by the anti-virus software is processor time. Each new virus that is added to the anti-virus database increases the overall scanning time. That is the price that computer users pay for the security of their data.

Unlike other manufacturers of anti-virus products that speed up the scan process by excluding from their databases viruses that are less easily detectable or less frequent in the geographic location of the anti-virus vendor, as well as file formats that require complicated analysis (e.g. PDF files), Kaspersky Lab believes that the purpose of an anti-virus program is to deliver to its users genuine anti-virus security rather than an illusory sense of safety, since you cannot be "half-protected". Besides, being "half-protected" is even worse than having no protection at all, as in the latter case users resort to their own "home-grown" safety measures.

Users of Kaspersky Anti-Virus have every reason to feel that they have maximum protection. Of course, the Kaspersky Anti-Virus software package allows experienced users to accelerate the anti-virus scanning process to the detriment of overall security by disabling scanning of various file types, but we do not recommend this for users who want the best possible protection.

For the purpose of maximum user protection Kaspersky Anti-Virus recognizes more than 40 types of archive and installer and is able to detect viruses in more than 350 different file formats. This is essential for anti-virus security because malicious executable code may be contained within a file of any recognizable format. However, despite the daily increase in the number of viruses detected by Kaspersky Anti-Virus (approximately 30 new viruses daily) and the ever increasing number of recognized file formats, each version of our product functions faster than the previous one. This is achieved through the use of new unique technologies, such as iChecker™ and i-Stream™, developed at Kaspersky Lab. Each file is checked for viruses only once - during the first scan. During all subsequent scans the file is not scanned for viruses provided that it has remained unchanged since the last scan. Thus, the anti-virus program performance increases drastically after the first file scanning.

Question: Do I need a license key? Will the program work without it?

Kaspersky Anti-Virus will not work without a license key.

If you haven't yet made a decision about whether you wish to buy Kaspersky Anti-Virus, we can provide you with a trial key, which will work for a two weeks (or one month) period. The key will be disabled when this period expires.

Remember that you can use your trial key only once.

Question: What happens when my license expires?

When your Kaspersky Anti-Virus license expires, the software will still work but you will have no access to anti-virus database updates. The anti-virus software will still be able to detect and disinfect infected objects but it will use its old databases only.

Downloading of the anti-virus database from the Kaspersky Lab site using Kaspersky Anti-Virus will be not be available. Even if you did not use Kaspersky Anti-Virus for downloading the database, the program will not be able to use it.

Therefore we cannot guarantee your protection against new virus infections.

Question: Can an intruder replace my anti-virus database?

All Kaspersky Lab anti-virus databases are supplied with a unique signature verified by Kaspersky Anti-Virus when the program is using them.

If you update the anti-virus database from the Kaspersky Lab update servers or receive it from our authorized dealer, we guarantee that the database is signed and that your copy of Kaspersky Anti-Virus will be able to use it. Your program may be unable to use such a database only if the database was released after your license for the product expired.

If the anti-virus update process results in an error, the mostly likely reason for this may be that the signature supplied with the updated database does not match the signature assigned by Kaspersky Lab, or that your database has been corrupted. This means that you received the database from a place other than Kaspersky Lab or that an intruder offered it to you claiming that it was a genuine Kaspersky Lab database.

Please do not use anti-virus database updates offered by unidentified vendors. This may lead to virus infection of your computer and even to the corruption of program files.

Question: What should I do if I am unable to download the anti-virus database and program module updates from the Kaspersky Lab update servers?

You may be unable to update your anti-virus database and application modules via the Internet for the following reasons:

    • you were not connected to the Internet when you started the updating process. In this case, connect to the Internet and retry the updating process.
    • your license key period has expired. In this case, renew your license by purchasing a new license key.


Verifying the proper operation of your anti-virus program

When the installation and setup of Kaspersky Anti-Virus are complete we recommend that you verify the settings and proper operation of the program using a test "virus" and its modifications.
This test "virus" has been developed by [image] (The European Institute for Computer Anti-Virus Research) specifically for the purpose of verification of the anti-virus software operation.
The test "virus" IS NOT A VIRUS and contains no code that will harm your computer. Nevertheless, most anti-virus products identify it as a virus.

Never use real viruses to test the operation of your anti-virus program!
The test "virus" can be downloaded from the official site of EICAR at: http://www.eicar.org/anti_virus_test_file.htm. If you have no Internet access, you can create a test "virus" manually. To do so enter the line below in any text editor and save the file as eicar.com:
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
The file that you download from the EICAR site or create in a text editor as described above contains the body of a standard test "virus". The anti-virus program detects it, assigns the Infected status to it and performs the action that you specified to be performed on objects with this status.
In order to test the program's response to the detection of objects of other types, you should modify the content of the standard test "virus" by adding one of the prefixes below (see table below).

You can verify the proper operation of Kaspersky Anti-Virus using modifications of the EICAR "virus" only if your anti-virus databases are dated October 24, 2003 or later (cumulative update - October 2003).

Test "virus" modifications

Prefix
Object status
No prefix, standard test "virus"
Infected. The disinfection attempt will result in an error. The object will then be deleted.
CORR-
Corrupted.
SUSP-
Possibly infected (unknown virus code).
WARN-
Infected with a virus (modified code of a known virus).
ERRO-
Could not be scanned due to a failure.
CURE-
Infected. The object will be disinfected and the text in the infected file will be changed to CURED.
DELE-
Infected. The object will be deleted automatically.
The first column of the table contains the prefixes that should be added to the beginning of the line in the standard test "virus" file (e.g. DELE-X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*).
After you add the prefix to the test "virus", save it as eicar_dele.com (or other filename depending on the prefix you use).
The second column contains the types of object identified by the anti-virus program depending on the prefix you added. Actions performed on each object are defined by the program's settings.
In order to verify the response of your copy of Kaspersky Anti-Virus,
  1. Create a folder on your hard drive and move the test "virus" files that you created to this new folder.
  2. Select the Prompt user for action option for the action to be performed by the program when an infected object is found (see section Scan settings to be used).
  3. Check the Log all messages box in the Additional settings window to log to a report file data about possibly infected objects or objects that have not been checked due to an error.
  4. Start a scan of your entire computer or of the folder where you moved all "viruses" that you created.
As the program detects an infected object, it will display dialog boxes with information about the detected object and a prompt for an action to be performed on the object.
Thus, by selecting actions in the dialog boxes that will pop up during the scan, you will be able to verify your program's response to the detection of various types of infected object.
Detailed results of the scan will be documented in the report.


Glossary

In this Help you will encounter terms that have meanings specific to anti-virus protection. The intention of this Glossary is to provide an explanation of the meaning of such terms. The entries are listed in alphabetical order to simplify the search for the explanation you need.


A

      Anti-virus database - A database created by Kaspersky Lab that contains a detailed description of all currently existing viruses and the methods used for their detection and disinfection. Our anti-virus database is regularly updated with information about new viruses as they appear; therefore, to keep your computer constantly protected from viruses, you need to update your anti-virus database as often as possible.
      Anti-virus protection status - The current status of the anti-virus protection that characterizes the security level for your computer.
      Archives - Files that include one or several files, which, in turn, can be archives.


B

      Backing up - Creating a backup copy of a file in the BACKUP folder before treating it (disinfection or deleting). This file can later be restored from the backup copy, for example, for subsequent scanning with the current version of the anti-virus database.
      BACKUP - A directory that contains backup copies of deleted and disinfected objects.
      Boot sector - A special disk area that contains the operating system loader program.
      Boot virus - A virus infecting boot sectors of your disks and of the operating system installed in your computer. During a system boot, the virus forces the system to read it into memory and to surrender control from the original loader code to the viral code.


C

      Computer memory - RAM installed in your computer.


D

      Deleting an object - A method of treating an object. To delete an object means to remove it physically from your computer. This method is recommended for objects that for whatever reason cannot be disinfected.
      Disk boot sector - An area on your hard drive or on any removable media (for example, a floppy disk or a CD-ROM). There are boot viruses that infect disk boot sectors. Kaspersky Anti-Virus scans boot sectors for viruses and disinfects them if infection is detected.
      Disinfection - A method of treating infected objects. Disinfection results in partial or full removal of malicious code from the infected data, or a decision that these files cannot be disinfected. Objects are disinfected using records contained in the anti-virus database.


E

      Email databases - Special format databases that contain email messages stored on your computer. Every incoming/outgoing message is saved in the database after you receive/send it. These databases are scanned during a full scan of your computer. In real-time protection mode, Kaspersky Anti-Virus scans all incoming and outgoing email messages for viruses as they are being sent or received.
      Exclusions - User-defined settings that exclude certain objects from the scan scope. You can customize exclusion rules for real-time protection and for on-demand scans. For instance, you can exclude archives from the scan scope during a full scan or, by using masks, specify certain file types that you do not want to scan.


F

      False alarm - Situations when the application flags a clean object as infected because the code contained in this file resembles a viral code.

      False positive - see false alarm.


H

      Heuristic code analyzer - A highly efficient technology that allows the application to detect unknown viruses. Objects that are suspected of being infected with either an unknown virus or a modified existing virus are identified using this technology.
      High speed - A protection level that enables scanning of only objects that may potentially become infected. This significantly reduces scan time.


I

      Infected object - An object containing a virus. You are advised to refrain from accessing such objects because this may lead to infection of your computer. If an infected object is found, you are advised to disinfect it using Kaspersky Anti-Virus or delete it if disinfection is not possible.


K

      Kaspersky Anti-Virus modules - Program library files included in the distributed copy of Kaspersky Anti-Virus Personal. Each of these modules corresponds to a specific function of Kaspersky Anti-Virus, such as real-time protection, on-demand scanning, updating.


L

      License key - A file with the .kеу extension that serves as your personal "key" required for the proper operation of Kaspersky Anti-Virus Personal. The license key is included in the distribution kit if you purchase your copy of Kaspersky Anti-Virus from a Kaspersky Lab dealer. If you purchase the product online, the license key file will be sent to you via email. Kaspersky Anti-Virus Personal WILL NOT WORK without the license key.
      License period - A period during which you have the right to use Kaspersky Anti-Virus. The license period is defined by a valid license key and is, as a rule, one year from the date of purchase. After your license expires, the product will still work but you will not be able to update the anti-virus database.


M

      Maximum protection - A protection level that ensures the maximum protection level that can be provided by Kaspersky Anti-Virus Personal. With this protection mode, all files stored on your hard drive, removable media and network drives (if connected to your computer) are scanned for viruses.

      Malware - the word is a contraction of "malicious software" and is a generic term for viruses, Trojans and worms.


O

      Objects executed at the operating system startup - A set of programs required for launching and correct operation of the operating system and other programs installed on your computer. Your operating system runs these objects during each startup. Some viruses infect startup objects and can prevent the operating system from loading.
      OLE object - An object linked or embedded into another file. Kaspersky Anti-Virus scans such objects for viruses. For example, a Microsoft Excel spreadsheet embedded in a Microsoft Word document will be scanned by Kaspersky Anti-Virus as an OLE object.
      On-demand scan - A mode of application operation initiated by the user that performa a scan of files of all types resident on your computer.


P

      Packed files - Files containing a program and instructions for the program execution by the operating system.
      Patch - A package of files used for updating programs. Patches are downloaded from the Internet and installed on your computer.
      Possibly infected object - An object that contains code of an unknown virus or a code reminiscent of a known virus. Possibly infected objects are detected by the heuristic code analyzer.
      Potentially infectable object - An object that has the potential to be infected. Potentially infectable objects are usually executable files, i.e. files with the com, exe and other extensions.
      Prevention - A set of measures taken to prevent viruses from penetrating your computer. Computer virus prevention includes comprehensive anti-virus protection and retrieving current updates to your application.


Q

      Quarantine - A folder to which Kaspersky Anti-Virus moves all possibly infected objects found during either a full scan of your computer or in real-time protection mode.
      Quarantining (moving to the quarantine folder) - A method of treating an infected or possibly infected objects by denying normal access to the object and moving it to the quarantine folder for subsequent treatment.


R

      Real-time protection - A mode of Kaspersky Anti-Virus launched automatically after system startup, in which all objects are scanned for viruses when they are accessed for reading, writing, or executing. If an object is identified as infected or suspicious, Kaspersky Anti-Virus will deny access to it and attempt to treat it (disinfect, quarantine, delete it, etc.) or prompt the user for action.
      Recommended level - A level of anti-virus protection using settings recommended by Kaspersky Lab, which ensures the optimal protection of your computer. This level corresponds to the default settings.
      Recovering, restoring - Moving a file from the Quarantine to its original folder where it was located before it was quarantined, disinfected, or deleted.
      Report only - In this mode, when the application detects infected or suspicious objects it blocks access to them (in the real-time protection mode) and reports the detection in the task report log.


S

      Scripts - A program file containing a sequence of actions which can, for example, be embedded into a web page and executed by the web browser (e.g. Microsoft Internet Explorer), or be standalone files for execution by the Windows operating system. In real-time protection mode, Kaspersky Anti-Virus monitors the execution of scripts, disables them, and scans for viruses. Depending on the results of the scan, you can, for example, allow or prohibit the script's execution.
      Skip - Method of treatment in which access to the object (only in real-time protection mode) will be denied, and information about the object will be recorded in the application operation report, but no other actions on the object will be performed.

      Suspicious object - see possibly infected object.


U

      Unknown virus - A new virus that is not registered in the anti-virus database. As a rule, Kaspersky Anti-Virus detects unknown viruses using the heuristic code analyzer and objects containing these viruses are flagged as possibly infected.
      Updating the anti-virus database - A function of Kaspersky Anti-Virus that maintains the validity of the anti-virus protection of your computer. The updating process includes copying the anti-virus database from the Kaspersky Lab update servers to your computer and automatic integration of the database with Kaspersky Anti-Virus Personal.
      Kaspersky Lab's update servers - A list of http- and ftp-servers updated regularly by Kaspersky Lab from which Kaspersky Anti-Virus copies the most recent version of the anti-virus database to your computer.


Index

Kaspersky Lab

Founded in 1997, Kaspersky Lab has become a recognized leader in information security technologies. It produces a wide range of data security software and delivers high-performance, comprehensive solutions to protect computers and networks against all types of malicious programs, unsolicited and unwanted email messages, and hacker attacks.
Kaspersky Lab is an international company. Headquartered in the Russian Federation, the company has subsidiary offices in the United Kingdom, France, Germany, Japan, USA (CA), the Benelux countries, China and Poland. A new company department, the European Anti-Virus Research Centre, has recently been established in France. Kaspersky Lab's partner network incorporates more than 500 companies worldwide.
Today, Kaspersky Lab employs more than 300 specialists, each of whom is proficient in anti-virus technologies, with 9 of them possessing M.B.A. degrees, 15 possessing Ph.D.'s, and two experts holding membership in the Computer Anti-Virus Researcher's Organization (CARO).
Kaspersky Lab offers best-of-breed security solutions, based on its unique experience and knowledge gained over more than 14 years of fighting computer viruses. A thorough analysis of computer virus activities enables the company to deliver comprehensive protection from current and even future threats. Resistance to future attacks is the basic policy implemented in all Kaspersky Lab's products. At all times, the company's products remain at least one step ahead of many other vendors in delivering extensive anti-virus coverage for home users and corporate customers alike.
Years of hard work has made the company one of the top security software manufacturers. Kaspersky Lab was one of the first businesses of its kind to develop the highest standards for anti-virus defense. The company's flagship product, Kaspersky Anti-Virus, provides full-scale protection to all tiers of a network, including workstations, file servers, mail gateways, firewalls, and handhelds. Its convenient and easy-to-use management tools ensure advanced automation for rapid virus protection across the enterprise. Many well-known manufacturers use the Kaspersky Anti-Virus kernel, including Nokia ICG (USA), F-Secure (Finland), Aladdin (Israel), Sybari (USA), G Data (Germany), Deerfield (USA), Alt-N (USA), Microworld (India), BorderWare (Canada), etc.
Kaspersky Lab's customers benefit from a wide range of additional services that ensure not only stable operation of the company products but also compliance with any specific business requirements. Kaspersky Lab's anti-virus database is updated in real-time every 3 hours. The company provides its customers with a 24-hour technical support service, which is available in several languages to accommodate its international clientele.

See also:

Other Kaspersky Lab Products

Contact Us

Kaspersky Lab
WWW: http://www.kaspersky.com

E-mail: support@kaspersky.com


Other Kaspersky Lab Products

Kaspersky Anti-Virus Personal Pro
This package has been designed to deliver comprehensive anti-virus protection to home computers running Windows 98/ME, Windows 2000/NT, and Windows XP as well as MS Office 2000 applications. Kaspersky Anti-Virus Personal Pro includes an easy-to-use application for automatic retrieval of daily updates to the anti-virus database and application modules. A second-generation heuristic analyzer efficiently detects unknown viruses. Kaspersky Anti-Virus Personal Pro includes many interface enhancements, making it easier than ever to use.
Kaspersky Anti-Virus Personal Pro features:
  • on-demand scans of local disks to detect all possible kinds of viruses;
  • real-time protection of all files from viruses;
  • a mail filter that scans all incoming and outgoing messages in background mode;
  • behaviour blocker that guarantees 100% protection against macro viruses.
Kaspersky Anti-Hacker
Kaspersky Anti-Hacker is a personal firewall that is designed to safeguard a computer running any Windows operating system. It protects your computer against unauthorized access and external hacker attacks from either the Internet or the local network.
Kaspersky Anti-Hacker monitors the TCP/IP network activity of all applications running on your machine. When it detects a suspicious action, the application blocks access to the network. This enhances privacy and ensures 100% security of confidential data stored on your computer.
The product's SmartStealth™ technology prevents hackers from detecting your computer from the outside. In this stealth mode, the application works seamlessly to keep your computer protected while you are connected to the Internet: while being completely transparent to the user.
  • Kaspersky Anti-Hacker blocks most common network hacker attacks and monitors for attempts to scan computer ports.
  • Configuration of the application is simply a matter of choosing one of five security levels. By default, the application starts in self-learning mode, which will automatically configure your security system, depending on your responses to various events. This makes your personal guard adjustable to your specific preferences and your particular needs.
Kaspersky Security for PDA
Kaspersky Security for PDA provides reliable anti-virus protection for data stored on PDAs running Palm OS or Windows CE. It also offers anti-virus protection against any infected files transferred from a PC or an extension card, from ROM files, and from databases. This software package includes an optimal combination of the following anti-virus tools:
  • An anti-virus scanner to allow on-demand scanning of data stored on both the PDA and extension cards;
  • An anti-virus monitor to intercept viruses in files that are either copied from other handhelds or are transferred using HotSync™ technology.
Kaspersky Security for PDA protects your handheld (PDA) from unauthorized intrusion by encrypting both access to the device and data stored on memory cards.
Kaspersky Anti-Virus Business Optimal
This package provides a configurable security solution for small- and medium-sized corporate networks.
Kaspersky Anti-Virus Business Optimal includes full-scale anti-virus protection1 for:
  • Workstations running Windows 98/ME, Windows NT/2000/XP Workstation, and Linux;
  • File and application servers running Windows NT 4.0 Server, Windows 2000, 2003 Server/Advanced Server, Windows 2003 Server, Novell Netware, FreeBSD and OpenBSD, or Linux;
  • Email systems, namely Microsoft Exchange 5.5/2000/2003, Lotus Notes/Domino, Postfix, Exim, Sendmail, and Qmail;
  • Internet-gateways: CheckPoint Firewall –1; Microsoft ISA Server.
The Kaspersky Anti-Virus Business Optimal distribution kit includes Kaspersky Administration Kit, a unique tool for automated deployment and administration.
You are free to choose from any of these anti-virus applications, according to the operating systems and applications you use.
Kaspersky Corporate Suite
This package provides corporate networks of any size and complexity with comprehensive, scalable anti-virus protection. The package components have been developed to protect every tier of a corporate network, even in mixed computer environments. Kaspersky Corporate Suite supports the majority of operating systems and applications installed across an enterprise. All package components are managed from one console and have a unified user interface. Kaspersky Corporate Suite delivers a reliable, high-performance protection system that is fully compatible with the specific needs of your network configuration.
Kaspersky Corporate Suite provides comprehensive anti-virus protection for:
  • Workstations running Windows 98/ME, Windows NT/2000/XP, and Linux;
  • File and application servers running Windows NT 4.0 Server, Windows 2000, 2003 Server/Advanced Server, Windows 2003 Server, Novell Netware, FreeBSD, OpenBSD and Linux;
  • Email systems, including Microsoft Exchange Server 5.5/2000/2003, Lotus Notes/Domino, Sendmail, Postfix, Exim and Qmail;
  • Internet-gateways: CheckPoint Firewall –1; Microsoft ISA Server;
  • Handheld computers (PDAs).
The Kaspersky Corporate Suite distribution kit includes Kaspersky Administration Kit, a unique tool for automated deployment and administration.
You are free to choose from any of these anti-virus programs, according to the operating systems and applications you use.
Kaspersky Anti-Spam
Kaspersky Anti-Spam is a cutting-edge software suite that is designed to help organizations with small- and medium-sized networks wage war against the onslaught of undesired email (spam). The product combines the revolutionary technology of linguistic analysis with cutting-edge methods of email filtration, including RBL lists and formal letter features. Its unique combination of services allows users to identify and wipe out up to 95% of unwanted traffic.
Installed at the entrance to a network, where it monitors incoming email traffic streams for objects identified as spam, Kaspersky Anti-Spam acts as a barrier to unsolicited e-mail. The product is compatible with any mail system and can be installed on either an existing mail server or a dedicated one.
Kaspersky Anti-Spam's high performance is ensured by daily updating of the content filtration database, with samples provided by Kaspersky Lab's linguistic laboratory specialists.
Kaspersky Anti-Spam Personal
Kaspersky Anti-Spam Personal is designed to protect users of mail client programs Microsoft Outlook and Microsoft Outlook Express against unwanted email messages (spam).
Kaspersky Anti-Spam Personal software package is a powerful tool that ensures detection of spam in the flow of email messages incoming via POP3 and IMAP4 protocol (only for Microsoft Outlook).
The filtering process involves the analysis of all attributes of the letter (sender's and recipient's addresses and headers), content filtration (analysis of the content of the letter, including the Subject and attached files), as well as unique linguistic and heuristic algorithms.
The application's performance is also achieved by daily updating of the content filtration database with samples provided by Kaspersky Lab’s linguistic laboratory specialists.

See also:

Kaspersky Lab

Contact us

1Depending on the type of distribution kit.


Contact Us

If you have any questions, comments, or suggestions, please refer them to one of our distributors or directly to Kaspersky Lab. We will be glad to advise you on any matters related to our product by phone or via e-mail. Rest assured that all of your recommendations and suggestions will be thoroughly reviewed and considered.

Technical support

Technical support information is available at http://www.kaspersky.com/supportinter.html

General information

WWW: http://www.kaspersky.com

http://www.viruslist.com

Email: sales@kaspersky.com

See also:

Kaspersky Lab

Other Kaspersky Lab Products