Copyright: Copyright © 2001 Ëàáîðàòîðèÿ Êàñïåðñêîãî


About Kaspersky Lab

Kaspersky Lab is the major Russian developer of antivirus systems: More then half of Russian users have chosen the high quality and reliability of our products. As an independent entity the company was established in summer 1997. The development and distribution of our major product—Kaspersky Anti-Virus—began in 1989

Kaspersky Lab is the recognised leader of antivirus technologies. Many technological features of almost all the up-to-date anti-viruses were first applied in our products. Some of the major western antivirus developers use the Kaspersky Anti-Virus kernel in their software products. Extremely reliable and highly qualitative Kaspersky Anti-Virus is rewarded with lots of marks and certificates of Russian and western computer magazines and independent testing centres.

Anti-viruses are the major products of Kaspersky Lab and our team concentrate main efforts on these products. We develop products for home computer as well as for corporate networks of any size. Antivirus solutions of Kaspersky Lab allow full control of all the potential sources of viruses: they are used on workstations, file servers, WEB servers, in mail systems and firewalls. The control utilities enable a user to automate antivirus protection of computers and corporate networks.

If you have any questions, comments or suggestions please refer them to our distributors listed in your Readme.txt or directly to Kaspersky Lab. We will be glad to advise you on any matters related to our product by phone or e-mail and all your recommendations and suggestions will be thoroughly reviewed and considered.

  Contact Us


Actions Performed with Infected and Suspicious Objects

Actions in case of virus detection—in case of detecting the infected or suspicious objects, the program will perform one of the following actions.

Display disinfect dialog—in case of detecting a virus, the scanner will open up the dialog box. This dialog box contains a name of infected file, name of the detected virus and the list of possible actions to be performed with infected object, that is a list of all possible actions except for [image] Display disinfect dialog. Besides, the appearing dialog box contains the Apply to all infected objects checkbox; by selecting it, you can extent an action selected from the dialogue to all defected objects which will be detected later, and opening a dialogue box was specified as actions for those. Then upon detecting the next infected object, the dialog box will not appear again. Three following buttons: “OK” (acceptance of selected actions), “Cancel” (closing the dialog box and continuing the scanning process) and “Stop” (stopping the scanning process) are located at the bottom of this dialog box.

Report only—when detecting the infected or suspicious objects, the program will only inform you about them. The report on check can be seen in the report window.

Disinfect—to attempt to cure all infected objects without preliminary inquiry. As a result of curing the infected object, viruses will be removed, and object will be restored as an operable one.

Make backup file before disinfection—-to create a copy of the infected object before starting a cure. A directory where the copy will be created is specified in a settings’ tree of the Options category (see item "Objects’ renaming options"). The copy will not be deleted upon completion of a treatment.

If disinfection impossible—a treatment is not possible for all infected objects, because some viruses damage the computer data irreversibly. In this case, the scanner program can operate using one of three following methods:  Report only—that is to inform about unsuccessful attempt of treatment, [image] Rename—that is to rename the file not subject to treatment, [image] Delete—that is to delete the damaged.

Rename—to rename all infected objects. The renaming rules are specified in a settings’ tree of the Options category (see item  "Objects’ renaming options").

Delete—to delete all infected objects without warning.

  Contact Us


Additional Options. Customize Category

A Customize category contains additional options of the program operation.

Sound effects—to select a mode of playing sound signals which accompanies an operation of the program.

InfectedSnd—InfectedSnd—a name of the sound file, which is played when the infected object is detected. When selecting the file in a file scroll box you can listen to it by pressing the Test button.

FinishSnd—a name of the sound file, which is played when scanning is completed. When selecting the file in a file scroll box you can listen to it, by pressing the Test button.

Pop-up Kaspersky Anti-Virus Scanner window after scan finish—to review results immediately upon the program termination. If the main dialog box of the scanner was closed and you have started scanning from the system menu, the main dialog box will be opened after a scanning termination.

Switch to statistic tab after scan start—after start of scanning, to switch automatically to the Statistics category to monitor the course of the program operation.

Switch to statistic tab after scan finish—after completion of scanning, to swath automatically to the Statistic category for reviewing results of the program operation.

Insert next disk prompt for removable drives—to prompt for check of the next removable disk. If you always check only one disk, it is more convenient to disable this message.

Other attention messages—to bring up other warning messages on the screen.

New updates check—to carry out an automatic start of the virus databases update program upon expiration of a certain number of days as specified in the edit dialog box Check interval … days (the edit dialog box will be activated when this checkbox is selected).

If you review the program properties from Control Center, then a part of Customize category settings which make no sense at all in case of program operation jointly with Control Center, is not available in a settings’ tree.

  Contact Us


Additional Scanning Modes

Scanning of Compound Objects

You can select additional modes—scanning the archives, packed files, mail databases and files of mail formats.

 Process compound files as folders—to process compound objects as folders containing a set of objects.

Archives—to search for viruses in files of archives, which are created with archivers ZIP, ARJ, LHA, RAR, CAB and some other.

Archives with self-extractors—to search for viruses in files packed with utilities PKLITE, DIET, LZEXE, EXEPACK etc.

Mail databases—to scan mail databases.

Plain mail—to scan the e-mail files of formats Eudora Pro & Lite, Pegasus Mail, Netscape Navigator Mail, JSMail, base on the SMTP/POP3 server users.

KAV Scanner does not delete viruses from archives, mail databases and files of mail text formats, it detects them.

Embedded objects—to scan OLE-objects embedded in checked files.

Heuristic Analyzer

You can select the mode of files’ heuristic scanning scanning to detect some viruses which are unknown yet to the program (those not included in virus databases).

Code analyzer—to include a check with Heuristic Analyzer.

Redundant Scanning

Sometimes, incorrect infection of the file with a virus occurs, or the file is “undetreated”, that is the file is restored, but a virus is not cut off. In this case, a slow search method (redundant scanning method), is used which allows to detect viruses in such files.

Redundant scanning—to select the redundant scanning mode.

After selecting the mode of redundant scanning, a window will appear with warning that the scanning process will be substantially slowed down.

  Contact Us


Change of Scanning Priorities

You can change a priority of the scanning process without its stopping. To do this:

1.	Select the Set scan priority item from the Scan menu.

2.	From the opening dialog box, select one of following three priority values: "High", "Normal", "Low" from the drop-down list

You can not change other options in the course of scanning! If you want to change options, first stop the scanning process and change settings. After that you can restart the scanning process.

  Contact Us


Check Box

A check-box may be

—unchecked meaning that this type of virus check will not be performed.

—checked meaning that the program will perform this type of virus check.

To check and uncheck a box you must use the following methods:

What to do	How it might be done
To check the box	The SPACE key on your keyboard. The  [image] command of the right-click menu. Click it with your mouse.
To uncheck the box	The Space key on your keyboard. The  [image] command of the right-click menu. Click it with your mouse.
  Contact Us


Checking Mail Databases and Plain Mail Files

Kaspersky Anti-Virus can check mail databases and plain mail files.

Kaspersky Anti-Virus checks mail databases of the following formats:

·	Microsoft Outlook, Microsoft Exchange (files *.pst and *.pab, a type of MS Mail archive)

·	Microsoft Internet Mail (files *.mbx, a type of MS Internet Mail archive)

·	Eudora Pro & Lite

·	Pegasus Mail

·	Netscape Navigator Mail

·	JSMail SMTP/POP3 server (user database)

If the mail database scan mode is enabled, Kaspersky Anti-Virus checks every entry in mail databases and scans attached files. The following formats are supported: UUEncode; XXEncode; btoa (up to 5.0); btoa 5.*; BinHex 4.0; ship; NETRUN 3.10; NETSEND 1.0 (not packed); NETSEND 1.0C (packed); MIME base64.

If the plain mail check mode is enabled Kaspersky Anti-Virus checks every file for message header and attached data (UUEncode, XXEncode and etc.) and checks it for viruses.

The mail database and plain mail modes noticeably slows down the Kaspersky Anti-Virus scanning rate. Therefore we do not recommend their use in a regular virus-check.

  Contact Us


Contact us

Address: Russia, 123363, Moscow, Geroyev Panfiloftsev, 10

Sales Dept.	+7 (095) 797-8700 +7 (095) 948-4331	sales@kaspersky.com
Help Desk Dept.	+7 (095) 797-8707	support@kaspersky.com
Marketing and Advertising Dept.	+7 (095) 948-5650	info@kaspersky.com
Antiviral Lab (for sending new viruses only):		newvirus@kaspersky.com
  Contact Us


Contents


Context-sensitive Menu

The elements of the settings’ tree have a context menu; by using this, it is possible to perform operations applicable to these particular elements.

To call the context-sensitive menu of element of the settings’ tree,

1.	Move a mouse pointer to the necessary element.

2.	Press the right mouse button. After that, the context-sensitive menu of the element will open up

?

Context-sensitive menu of the settings’ tree element

  Contact Us


Control Indicators

When setting your anti-virus to check for viruses in the disk hierarchy (see item "Selection of Scanning Area") you must use the so-called Rules of Succession, i.e. if you define some settings for the My computer item, they will be automatically assigned for all disks on your computer.

Some macro-instruction icons and control indicators completely depend on those of the group. These macro-instructions inherit the group rule. By default all the macro-instructions inherit the group rule.

Some macro-instruction icons and control indicators differ from those of the group. These macro-instructions have their independent rules.

To define some macro-instruction as having an independent rule you need to assign to this macro-instruction a rule that is different from that of the group or change its control indicator status.

Macro-instructions with independent rules may be restored to macro-instructions inheriting the group rule.

Some macro-instructions may have icons and control indicator statuses strictly independent from those of the group. These macro-instructions have strictly independent rules.

To define some macro-instruction as having a strictly independent rule you need just to select the Set Strict command from the right-click menu. In this case the macro-instruction control indicator appearance will change for the red square with black tick.

To disable the status of strictly independent rule select the Remove Strict command from the right-click menu.

Rules of macro-instructions with strictly independent rules are fully independent from the group rule and control indicator status.

The control indicator may look similar to the following:

Looks like	Description	Meaning
	A square with a tick inside. The square may be red or black.	The check mode is enabled. The square is red—the inheriting mode is disabled, The square is black—the inheriting mode is enabled.
	A square with the tick inside and the triangle in the right-bottom corner. The triangle may be red or black.	The inheriting mode is enabled, but some objects are excluded from the group and have their own settings The triangle is red—for one or more objects the inheriting mode is disabled. The triangle is black—for one or more objects the rule is changed.
	A square without the tick and with the triangle in the right-bottom corner. The triangle may be red or black.	The check mode is disabled, but for one or more objects this mode is enabled. The triangle is red—for one or more objects the inheriting mode is disabled. The triangle is black—for one or more objects the rule is changed.
  Contact Us


Customization Tree

Every joint in this tree may have branches. If the branch is visible the corresponding joint looks similar to this [image], and if the branch is hidden the corresponding joint will change for [image].

To change some certain setting you must make its branch visible.

To display and hide a branch you must use the following methods:

What to do	How it might be done
To display a branch (joint looks like  [image])	The [image] key on your keyboard. The [image] command of the right-click menu. The "*" key on your keypad (all branches of the joint become visible).
To hide a branch  (joint looks like  [image])	The [image] key on your keyboard. The [image] command of the right-click menu . The "-" key on your keypad (all branches of the joint disappear from your screen).
  Contact Us


Drop-down List

Drop-down list allows you to select one of the items from this list. To browse the list you must use the [image] and [image] keys on your keyboard. To automatically scroll down/up the list you must use the CTRL+ [image] and CTRL+ [image] key combinations.

Drop-down list

  Contact Us


Error Messages

Can't open file: [file name]	KAV could not open a file it needs for proper operation (such as AVP.SET)
Database kernel proc absent	Please contact support
interface fault	Please contact support
kernel fault	Please contact support
Object code not linked	Please contact support
Old or corrupted antiviral database	One or several .AVC anti-virus database files are either out of date or corrupted
This copy of AVP® does not have a valid key file.	The AVP.KEY file is missing. AVP will disable part of its functions. Contact your distributor for more information.
This copy of AVP® is not licensed to be run from remote drives.	KAV will disable part of its functions. Contact your local KAV Distributor for more information.
This copy of AVP® is not licensed to be run under Windows 95.	Your version will only run under Windows95. Contact your local distributor for more information.
This copy of AVP® is not licensed to be run under Windows NT.	KAV will disable part of its functions. Your version will not run under WindowsNT. Contact your local distributor for more information.
Wrong set file: [file name]	Invalid set file
You started AVP® under Windows NT without Admin rights.	You do not have administrator access privileges. For security reasons, KAV will not scan physical sectors.
  Contact us


Feedback
If you have any suggestions on improvement of this reference system, please, contact Kaspersky Lab: support@kaspersky.com.


General Options. Options Category

An Options category contains options for recording the scanning results to the file, settings to rename the infected files as well as levels of scanning priority.

See	Report Options,

Objects’ renaming options,

Scanning Process Priority.

  Contact Us


Generating a List of Known Viruses

You can review a list of all viruses known to the program at present. To do this:

1.	Select the Make virus list item from the Tools menu.

2.	In the opening dialog box Kaspersky Anti-Virus List Generator, specify a name of file to which the list of viruses should be recorded. To do this, press the Browse button and specify the filename.

3.	Press the Generate button.

To review the list, press the Show list button. After that, the Report Viewer program will be started, with which you can review the created list.

Press the Exit button to close the Kaspersky Anti-Virus List Generator dialog box.

  Contact Us


Help Desk for Registered Users

Kaspersky Lab offers a large service package enabling its legal customers to efficiently employ Kaspersky Anti-Virus.

If you register and purchase a subscription you will be provided with the following services for the period of your subscription:

·	Anti-virus database daily updates provided with email

·	New versions of the Kaspersky Lab antiviral software provided on the free basis

·	Phone, e-mail or in-office advising on matters related to the operation of our antiviral software

·	Information about the Kaspersky Lab new products and about new computer viruses (for those users who subscribed for the Kaspersky Lab newsletter)

Kaspersky Lab does not provide information related to operation and use of your operation system, and various technologies.

  Contact Us


How to Keep your Computer Virus Free

One of the main methods in the struggle against computer viruses is, as in medicine, taking preventive measures. Such preventive measures consist of following a small set of recommendations and paying a little bit of attention.

Here are some recommendations (this list is in no way complete):

Backup your vital data regularly

Create a "clean", garantueed virus-free bootable emergency system diskette, and copy an antivirus program onto it along with other utilities you may think are useful. Write-protect the diskette

Check all diskettes before using them. The most common viruses are boot-viruses! Do not start unverified files, including files you transferred from a LAN/WAN or the Internet. Check them for viruses first

Limit the number of people that have access to your computer

Systematically check your computer for viruses with a quality anti-virus application. Keep your anti-virus applications up-to-date
Just as a side note: KAV is usually updated on a weekly basis

Watch your computer for strange "behaviour" (such as performance problems, appearance of strange files, file size increases, decrease of total conventional memory, and such). "Strange" system behaviour needn't be an indication for a virus infection, e.g. the software you use can be buggy or your computer system may have a hardware problem, etc.

Only buy original software from a trusted source (official resellers, etc.).
Note: there have been very few cases, where viruses were accidentally shipped with shrink-wrapped original software. Nevertheless - this possibility exists and as such virus scanning of such software is also recommended!

  Contact Us


If your Computer is Infected...

There's no need to panic!

Find below some general guidelines on how to deal with virus infections:

Important:

Before "curing" vital data, back it up (if you haven't already done so), even if infected, before starting the cleaning process. Should a "cure" fail, you still can recover your data from the backup and try to repair it through another method.

In the left panel of the Objects category, select all local and floppy disks (it wouldn't be bad to also check the network drives, especially if you have administrative access to a server and have recently worked on it). In the right panel of the Objects category, enable Scan memory, Scan sectors, Scan files of following types (for reliability select All radio button), Scan MS Outlook Express data bases, Scan compound files of the following types, Archives with self-extractors and, if you suspect having gotten the virus in an archive file you downloaded from a BBS or the Internet, you may also enable "Archives (KAV Scanner does not clean infected files inside archive files). You may elso check Mail databases, Plain mail and Embedded objects swithes.

The choice you make in the Actions in case of virus detection group on the right panel of Objects category depends on how much data you store on your computer, and how valuable you consider this data to be. Select Ask user if you wish KAV Scanner to stop before doing anything when it encounters a virus, so you can decide individually for every object, what you want KAV Scanner to do with it ("cure" it, delete it or copy it to another folder).

When infected objects are discovered, you can try to cure them with Disinfect. Unfortunately, curing is not always possible as some viruses corrupt data beyond repairing possibility. In this case you will be forced to delete the infected object. (Hopefully, you can restore it from a backup)

If no viruses were discovered, but you are almost certain, that your computer has been infected, check the Enable code Analyzer and Enable redundant scan mode in the Objects category and start scanning again.

If KAV Scanner outputs messages about "suspicious" files/sectors, you may have a new, yet unidentified/unclassified virus. Try to isolate some infected objects and send them to the Kaspersky Lab research team for detailed analysis. A special update for such a new virus will be made available as soon as possible (the Kaspersky Lab research team works fast !!)

Should disinfection from inside the Windows95 environment not succeed, boot your system from a clean, write-protected DOS boot floppy diskette, and run a DOS based scanner (such as KAV for DOS 32).

  Contact Us


Input Field Defining the Number of …

To input new value in the number field you must type it in from your keyboard or use the courser controlling keys to change the current value. You may see the number field current value enclosed with angle brackets at the right of the field name.

—the number input field.

To edit a number in the field use the following methods:

What to do	How it might be done
To edit the field value	Click with your mouse on the field icon. The  [image] command of the right-click menu . The F2 key on your keyboard.
  Contact Us


Input Field Defining the Path to…

To edit value of the path field you must use the conventional Windows dialog allowing to select the directory or file.

—the path input field.

To edit a path field value use the following methods:

What to do	How it might be done
To edit the field value	Click with your mouse on the field icon. The  [image] command of the right-click menu . The F2 key on your keyboard.
  Contact Us


Kaspersky Antivirus
Kaspersky Antivirus is the package of antivirus software by Kaspersky Lab, intended for both home users and corporate networks. You may get detailed information about Kaspersky Antivirus on http://www.kasperskylabs.ru/products.asp. Furthermore you may buy Kaspersky Antivirus in our on-line shop http://store.kaspersky.com/.


Kaspersky Lab
"Kaspersky Lab" is a leading Russian vendor of anti-virus safety systems: more than a half of Russian users have chosen the quality and reliability of our products. Being an independent corporate body, the company was founded in the summer of 1997. The development and commercial distribution of Kaspersky Labs. main product—Kaspersky Antivirus started in 1989.

Today Kaspersky Lab. is represented by more than 100 dealers and distributors from Russia and ex-USSR republics. Since 2000 Kaspersky Lab offers Web page owners an opportunity to join the Affiliate Program and get profit by distributing Kaspersky Antivirus via Internet. For more detail,  please, refer to http://www.kasperskylabs.com.

Address: Russia, 123363, Moscow, Geroyev Panfiloftsev, 10

Sales Dept.	+7 (095) 797-8700 +7 (095) 948-4331	sales@kaspersky.com
Help Desk Dept.	+7 (095) 797-8707	support@kaspersky.com
Marketing and Advertising Dept.	+7 (095) 948-5650	info@kaspersky.com
Antiviral Lab (for sending new viruses only):		newvirus@kaspersky.com


Kaspersky Lab.

"Kaspersky Lab" is a leading Russian vendor of anti-virus safety systems: more than a half of Russian users have chosen the quality and reliability of our products. Being an independent corporate body, the company was founded in the summer of 1997. The development and commercial distribution of Kaspersky Labs. main product—Kaspersky Antivirus started in 1989.

Today Kaspersky Lab. is represented by more than 100 dealers and distributors from Russia and ex-USSR republics. Since 2000 Kaspersky Lab offers Web page owners an opportunity to join the Affiliate Program and get profit by distributing Kaspersky Antivirus via Internet. For more detail,  please, refer to http://www.kasperskylabs.com.

Address: Russia, 123363, Moscow, Geroyev Panfiloftsev, 10

Sales Dept.	+7 (095) 797-8700 +7 (095) 948-4331	sales@kaspersky.com
Help Desk Dept.	+7 (095) 797-8707	support@kaspersky.com
Marketing and Advertising Dept.	+7 (095) 948-5650	info@kaspersky.com
Antiviral Lab (for sending new viruses only):		newvirus@kaspersky.com
  Contact Us


Launch of the Anti-Virus Scanner

The program can be launched one of the following ways:

·	From the Windows main menu

·	From Control Center

·	From command line.

One of quick ways to launch the program is to launch it through the Windows start menu. To do this, press the Start button, select Programs section, enter Kaspersky Anti-Virus group and run the KAV Scanner item. After that, the program main dialog box will open), and the icon [image] will appear in the task bar; by clicking the right mouse button on it, you can open the system menu.

Other way to launch the program is to start from Control Center, i.e. by creating a special task which will run the scanner program at a specified time and with specified settings.

To launch the Anti-Virus scanner from command line, it is necessary to move to the folder with the Kaspersky Anti-Virus and then start the avp32.exe program.

When starting you can use the following command line options:

[/P=settings’_file_name]—starting the scanner with settings from the file of settings with a name "settings’_file_name";

[/S]—to start checking for virusese immediately upon starting the scanner;

[/W]—to create a report file;

[/N]—to minimize the scanner main dialog box immediately upon starting;

[/Q]—to close the scanner main dialog box immediately upon scanning termination;

[/D]—means that the scanner will not be run, if within this day the scanning have already been carried out and successfully completed, i.e. it was not interrupted and no viruses have been detected during scanning.

[/@[!]=file_name]—to scan only those objects which are specified in the file with the name file_name, where the "file_name" file is a common text file (ASCII), containing list of names of files intended for scanning. Each line should contain only one filename (with a complete path indicated). If there is the character «!» in a key (i.e. /@!=file_name (filename)) then the "file_name" file will be deleted after scanning termination. If there is no the character "!" (i.e. /@=file_name (filename)), the file will not be deleted.

[/virlist=file_name]—to create a file with the name "file_name", and to write in it the list of names of viruses known at present, which can be detected with the scanner.

Files and folders which should be checked for viruses can be specified in the command line. If long names containing spaces are present in the name of file or folder, this name should be written in quotes. Using an access masks which contain characters ‘*’ or ‘?’ in file names is not allowed, i.e. expressions like “*.exe”, “av?32.exe” are invalid.

Let's consider some examples with command line options:

Example 1. Starting the scanner and subsequent check for viruses of files which are in the “My documents” folder.

"C:\Program Files\AVP\Avp32.exe" /S "C:\My documents"

Example 2. Starting the scanner program, creating a list of viruses in the E:\virlist.txt file and subsequent closing the program.

"C:\Program Files\AVP\Avp32.exe" /virlist=E:\virlist.txt /q

Example 3. Starting the scanner with subsequent check for viruses if previous check was carried out the previous days, or check was carried out at the same day, but viruses have been detected. Upon finishing scanning—close the program.

"C:\Program Files\AVP\Avp32.exe" /s/d/q

  Contact Us


Main Dialog Box

The main KAV Scanner program dialog box is used to change scanning settings, start / stop of scanning and to review the results. You can close the main dialog box without unloading the program from memory.

In the main dialog box of the KAV Scanner program, the following items are located:

·	menu

·	toolbar

·	working area

·	status bar

  Contact Us


Menus

The menus are located at the top of the main dialog box. Some items are duplicated with key combination shortcuts or buttons in the toolbar. The key combinations are indicated in the menu next to appropriate items.

Menu [image] item	Function
File [image] Set profile as default	Specify a set of options loaded by default
File [image] Load profile	Load a set of options from the settings file
File [image] Save profile	Save a set of options in the file of settings
File [image] Save profile As êàê	Save a set of options to the settings file with another name
File [image] Unload Kaspersky Anti-Virus Scanner	Unload the KAV Scanner program from memory
File [image] Close window	Close the program main dialog box
Scan [image] Start scan / Stop scan	Start / stop the scanning process
Scan  [image] Pause scan / Continue scan	Suspend / continue the scanning process
Scan [image] Set scan priority	Change the scanning process priority (this item is accessible only with the scanning process active)
Scan  [image] Preview scan	Show parameters as the sequential
Tools [image] Update now	Update Anti-Virus databases
Tools [image] Show report	Show the window with report
Tools [image] Make virus list	Generate a list of all known viruses
Help [image] Contents	Call the Help
Help [image] About	Show the brief information about the program
  Contact Us


Monitoring Report

If you have selected options of supporting the report, you can monitor a course of the Anti-Virus scanner operation using the Report Viewer program. To start it, select the Show report item from the Tools menu or press the button [image] in the toolbar. After that, the main window of the Report Viewer program will open, where you can review the messages about a course of scanning.

  Contact Us


Notation Conventions

To call the context-sensitive menu of element of the settings’ tree...	A user operational sequence description
Caution!	For notes and important information
File	The window banners, program names, file names, etc.
· Item 1 · Item 2	For enumerations
  Contact Us


Objects for Scanning. Memory, Sectors and Files

Areas of different hierarchy level in the computer file system have different settings lists. The "My Computer" area has a settings’ tree with the maximum number of settings available. The scanning options for RAM, boot sectors, groups of disks and MS Outlook Express databases are included in the list of settings. The options of disk area allow only to scan the boot sectors of this disk, as well as select or clear a checkbox of scanning the disk file system. The options of folder area do not allow to clear a checkbox of scanning the file system. But choosing operations with infected and suspicious objects, choosing type of scanned files, and selection of additional scan modes are included in options of folders, as well as all overlying areas.

Scan files—to scan object files (including files with attributes System, Hidden and Read Only). The checkbox is only accessible from a settings’ tree of the "My Computer" object and disks. It is impossible to clear it for such objects as "folder" or "file". You can specify checking for particular types of files only, namely:

All infectable—to scan all files which can contain viruses: programs.

All—to scan all files.

By mask—to scan files with masks, specified into input fields located below. The number of mask, which you can input, is unlimited, however in every input field only one value should be specified.

Except by mask—to eliminate from scanning files with masks, specified in the input fields as located below. The number of mask, which you can input, is unlimited, however in every input field only one value should be specified.

Scan sectors—to scan sectors (main boot sector, boot sectors). The chechbox is accessible only from a settings’ tree of the "My Computer" object and disks.

Scan memory—to scan RAM. The checkbox is accessible only from a settings’ tree of the "My Computer" object and disks.

Scan MS Outlook Express data bases—to scan MS Outlook Express databases. The checkbox is accessible only from a settings’ tree of the "My Computer" object and disks.

  Contact Us


Objects, Options, Customize and Statistics Categories

A working area of the main dialog box consists of two parts. In the left part, the list of categories and their icons is located. In the right parts, contents of categories are displayed. There are four categories: Objects, Options, Customize and Statistics.

The Objects category allows to specify a scanning area, objects to be scanned, and rules of processing the infected objects. All these settings are organized in a specialized control element, namely tree of object hierarchy settings.

The Options category allows to specify common settings, and the Customize category allows to specify particular settings of the program using a common tree of settings (see items "General Options. Options Category", "Additional Options. Customize Category").

The Statistics category allows to review results of the program operation in a table.

  Contact Us


Objects' Renaming Options
Objects’ Renaming Options

 For renaming of infected objects use—a group of option buttons which specify a way to rename the infected objects. The program will apply this way when processing objects, which the operation "Rename" in a settings’ tree of the Objects category was specified to.

Special folder—to move infected objects to the special directory specified in the Folder for infected objects field. If such renaming way is used, the infected files are transferred in the special directory without changing their names and extensions.

The same folder—to keep the infected objects in the old directories, but to change their extensions with those specified in the Extension of infected file field.

  Contact Us


Option Button

The option button is a member of the group. A group of option buttons may consist of two and more buttons. You must use this group to select one of the options. The option button may be:

—selected (enabled).

—deselected (disabled).

You can select only one option button from the group.

To select and deselect an option button you must use the following methods:

What to do	How it might be done
To select the option button	The SPACE key on your keyboard. The  [image] command of the right-click menu. Click it with your mouse.
To deselect the option button	Select some other option button from the group.
  Contact Us


Options of Object Scanning. Objects Category

An Objects category contains options for selection of scanning area, for actions performed with infected and suspicious objects, for additional scanning modes also.

See	Selection of Scanning Area,

Objects for Scanning. Memory, Sectors and Files,

Actions Performed with Infected and Suspicious Objects,

Additional scanning modes.

  Contact Us


Possible Symptoms of a Virus Attack

Symptoms of a virus infection can be:

Slow-down of program execution

File size increase

Appearance of new "strange" files

Reduction of total available conventional memory

Suddenly appearing "strange" video and sound effects

If you experience such "behaviour" of your system, we advise you to check your system for viruses.

  Contact Us


Preview of Options before a Scanning Start

The scanning options can be reviewed as sequential text. Such text will show the rules of processing all file system objects, from "My Computer" to the individual file. For example, if for the "autoexec.bat" file the rules differ from those for the parent object "System disk (C:)", then a list of the file rules will be output separately.

To review scanning options as sequential text, select the Preview scan item from the File menu or press the button [image] in toolbar.

After that, the Preview scan window, containing values of option set of Objects and Options categories, will appear on the screen. You can review and copy values of options. To terminate an operation press OK.

The options of scanning as sequential text are also recorded at the beginning of the report file.

  Contact Us


Purpose and Main Functions

Kaspersky Anti-Virus Scanner (KAV Scanner)—is a program designed for checking a computer for viruses on user request and deleting viruses upon detection.

When operating, the Anti-Virus scanner performs the following functions.

·	It detects and deletes viruses of all types in files on the disks specified for checking, in boot sectors and RAM

·	It detects and deletes viruses from files packed with PKLITE, LZEXE, DIET, COM2EXE and other compression utilities

·	It detects viruses in the archived files of all most popular formats (ZIP, ARJ, LHA, RAR etc.)

·	It detects viruses in local mailboxes of all most popular mail systems

·	It uses an improved heuristic mechanism to search for unknown viruses (efficiency is up to 92%)

KAV Scanner can test your system for virus presence in:

·	System memory

·	Files, including archive and packed files

·	System sectors, e.g. Master Boot Record (MBR) of harddisks and Boot sectors of floppy and harddisks

Main features of KAV Scanner:

·	Can detect and remove thousands of viruses (it also handles highly polymorphic viruses)

·	Recursively scans in packed and archive files

·	Includes a 'heuristic' module "Code Analyzer" to detect new, yet unclassified viruses

·	Tests and disinfects resident viruses in system memory

·	Works in infected environment. It can self-repair it's executables when infected and deactivate memory resident viruses

·	Checks files and system sectors to discover changes in them

·	Is up-to-date—thanks to usually weekly updates

·	Custom user interface for Windows 95/NT

·	Possibility of setting, saving and loading different custom settings (profiles)

·	Hypertext Help-system

  Contact Us


Report Options

 Save report file—to save the report to the file. If you select this checkbox, you can monitor a course of the Anti-Virus scanner operation using the Report Viewer program. When displaying results, this program will use all settings of the Save report file subtree.

Report file name.

By default, a report is created in the directory which is specified during the program installation. If the program operates without the connection to Control Center, you can change a folder by specifying a complete path to the report file. Otherwise, it is impossible to change a default path.

Show pack info in the report—to include the information about packed or archived objects in the report. The information will appear in the Report Viewer table as follows: name of the object will be in the "Object" column, record "Packed" or "Archive" will be in the "Result" column, name of wrapper or archiver program will be in the "Description" column.

Show clean object in the report—to include the information about uninfected objects in the report. The information will appear in the Report Viewer table as follows: name of the object will be in the "Object" column, record "OK" will be in the "Result" column..

Append—to add checking results to the already existing report file. So you can save all previous results of checks. If you clear this checkbox, the new report file will be created every time the scanner is started.

Limit size of report file (Kb)—to limit a file size to the number specified in edit checkbox. The value 2048 Kbit is used by default.

  Contact Us


Return Codes

Return Code:	Description:
0	Clean—no viruses found
1	Scan could not be completed
2	Warning(s)
3	Suspicious object(s) found
4	Known virus(es) found
5	All detected viruses cured
7	AVP32.EXE is corrupted
10	Internal Error
  Contact Us


Reviewing Statistics. Statistics Category

If you have not select options of supporting the report, you can monitor change of statistics in the table of the Statistics category.

The table is divided into two parts: "Scanned" and "Found". The top part, that is "Scanned", contains the number of checked sectors, files, folders, archives and packed files. The bottom part, that is "Found" contains an information about the number of:

·	Found viruses

·	Bodies of viruses, that is the number of files infected with one or another known virus

·	Cured objects, that is the objects, which the viruses were correctly deleted from

·	Deleted objects

·	Renamed objects

·	Warnings, that is the messages on the number of objects containing the code similar to a version of a known virus

·	Suspicions on virus detection, that is the code analyser messages

·	Damaged objects

·	Input/output errors

An operation rate (in Kbit/s) and overall time spent to check all objects is displayed at the bottom of the table.

  Contact Us


Saving Options in Settings File. Loading Options from Settings File

The sets of scanner options can be saved on the disk to settings files to load them after, for some scanner operations to be executed. So, you can save a set with a name "Check of removable disks," and load it for checking a few diskettes on a virus, and with a name "Full check of all disks"—for redundant checking all files in case of suspicion that penetration of viruses into your computer occurs, etc.

You can specify one of settings files as to be loaded by default. Then every time upon starting the scanner the settings will be loaded from this settings file.

	Main Menu	Toolbar	Keyboard
Load options	File [image] Load profile		<Ctrl>+<O>
Save options	File [image] Save profile,  File [image] Save profile as
Specify options as loaded by default	File [image] Set profile as default
By default, the scanner settings files have the extension .klr.

If no settings file is specified as to be loaded by default, the scanner will use built in settings.

  Contact Us


Scanning Process Priority

Scan process priority—levels of scanning process priority. You can select one of three following values from the list: "High"—is high priority, when the operating system transfers a control to the scanner more often and for longer period in comparison with the other running applications; "Normal"—is common priority, when the processor transfers a control to the scanner on the common terms as to other started applications, and "Low"—is low priority, when any of applications started slows down the scanner operation.

  Contact Us


Selection of Scanning Area

An Objects category of the working area is used to select a scanning area and objects to be scanned. The selection of area and objects is carried out using a tree of objects’ settings. The tree of objects’ settings can be reviewed in common mode or expert mode. Moving from the common mode to the expert mode is carried out with the Standard and Expert buttons of the main dialog box.

In the common mode, the tree of objects’ settings consists of two panels: the left panel is a list of computer disks, and the right is a settings’ tree of the object, selected from the left list.

In the expert mode, a tree of objects’ settings consists of three panels: the left panel is an hierarchy of computer file system, the right is a settings’ tree of the object selected from hierarchy and the lower is a list of files located in the root of the object, selected from hierarchy. Besides in the expert mode, a "Network environment" object is included into file system hierarchy.

A checking area is specified in the left panel, which contains the hierarchy of the computer file system together with checkboxes of scanning for every of file system areas. The scanning checkbox can be either selected: , that corresponds to the instruction to check the selected area, or cleared: , that corresponds to the instruction to skip the selected area.

For the program to scan an area of file system it is necessary to select the scanning checkbox located at the left of its name.

To select a group of disks for scanning, select a "My Computer" line from the panel with a file system hierarchy, and select the necessary checkbox in the right panel with a tree of settings:

Scan local removable drives—to scan all removable disks. The checkbox is only accessible from a settings’ tree of the "My Computer" object. Its selection is equivalent to selection of scanning checkboxes for all removable disks in file hierarchy of objects.

Scan local hard drives—to scan all local hard disks. The checkbox is only accessible from a settings’ tree of the "My Computer" object. Its selection is equivalent to selection of scanning checkbox for all local hard disks in file hierarchy of objects.

Scan network drives—to scan all accessible network disks. The checkbox is only accessible from a settings’ tree of the "My Computer" object. Its selection is equivalent to selection of scanning checkbox for all accessible network disks in file hierarchy of objects.

By selecting the checkbox of some area in a file system, you automatically select checkboxes of all areas contained within the selected one. However if you wish you could skip some folder or file, when moving to the expert mode.

For example, you have selected disks C: and D: for scanning, but you do not the folder D:\public\archives to be checked as you are sure that its contents is virus-free. In this case, you can select checkboxes at the left of names of disks C: and D:, and then by opening the disk D in file hierarchy, clear the checkbox near to the folder name D:\public\archives.

If you have eliminated a folder from scanning, the checkbox with a tick [image] will change by the checkbox with a tick and triangle at the right below: . for all "parent" areas of the file system. So the program shows a situation, when one of file system areas contained within the selected area is checked differently than the whole area. You can remove discrepancies of check rules inside one area or, vice versa, fix them for a long time.

You can assign the specific scanning options to every area of the file system. In every checked area selected for scanning you set checked objects using a settings’ tree of the right panel.

  Contact Us


Starting a Program of Updating Virus Bases

You can start the program of upgrading virus bases from the main dialog box of the KAV Scanner program. To do this, select the Update now item from the Tools menu or press the [image] button on the toolbar.

  Contact Us


Starting and Stopping Scanning

Starting and stopping of scanning can be carried out either automatically using the Control Center program, or manually from the Control Center program, or manually from the scanner main dialog box.

After beginning of the scanning you can suspend and continue the scanning process, change its priority as well as stop scanning.

	Main menu	System menu	Toolbar
Starting	Scan [image] Start scan	Start scan
Stopping	Scan [image] Stop scan	Stop scan
Suspending	Scan [image] Pause scanå	Pause scan
Continuing	Scan [image] Continue scan	Continue scanå
Let's review initial operations of the Anti-Virus scanner, which it carries out immediately upon starting. Immediately after starting, the scanner loads Anti-Virus databases and checks itself for viruses. In case of successful loading, the following message is output in a bottom line of the program dialog box:

Antiviral bases were loaded. Known viruses: XXXX

where XXXX stands for the number of known viruses, and in a case of infecting the program itself, an attempt will be made to cure it. If the treatment is successful, the program will be restarted, and the information message about deleting viruses from the program will appear on the screen. If a treatment can not be carried out, the program will not be started, and the appropriate information will appear on the screen. If you have a distribution copy of Kaspersky Anti-Virus available, please delete the infected copy of the program and reinstall Kaspersky Anti-Virus.

Upon terminating an operation, the Anti-Virus scanner delivers return codes which you can use when creating packet files. The scanner can return one of the following values:

0—viruses are not detected;

1—scanning is not terminatedíî;

2—objects containing a modified or defective virus are found;

3—objects are found which suspected as those contained;

4—known virus is detected;

5—all detected viruses are deleted;

7—scanner program is damagedåíà;

10—internal error of scanner program.

  Contact Us


Status bar

At the bottom of the main dialog box, a status bar is located. The following information is displayed in it:

·	Context-sensitive prompt / name of scanned object

·	Check box of scanning process execution.

  Contact Us


System Menu

When starting the program the program main dialog box will open on the screen, and the icon [image] will appear in the task bar; by clicking the right mouse button on it you can open the system menu. The system menu consists of the following items:

·	Kaspersky Anti-Virus Scanner Settings—to open the program main dialog box

·	Start scan / Stop scan

·	Pause scan / Continue scan

·	Set scan priority—to change a scanning process priority (this item is accessible only with the scanning process active)

·	Show report—to show a report dialog box with the program operation results

·	About Kaspersky Anti-Virus Scanner—to show an "about" dialog box with information about the program

·	Unload Kaspersky Anti-Virus Scanner—to unload the program from memory

  Contact Us


Technical Support

If you should have any Kaspersky Labs. We provide customer support by telephone and e-mail. We will give full answers to all your questions.

Adress: Russia, 123363, Moscow, Geroev Panfilovtsev Str., 10.

Telephone: +7 (095) 797-8707

E-mail: support@kaspersky.com.

  Contact Us


Text Field

To edit value of the text field you must use your keyboard. You may see the text field current value enclosed with angle brackets at the right of the field name.

—the text field.

To edit a text field value use the following methods:

What to do	How it might be done
To edit the field value	Click with your mouse on the field icon. The  [image] command of the right-click menu . The F2 key on your keyboard. The text field will change its appearence for [image].
After you finish editing the text field value press the ENTER key on your keyboard or click with your mouse outside of this text field.

  Contact Us


The About dialog

The upper part of the About dialog displays information about the program (version number, last update, registration information).

The middle part of the dialog contains information on available keys. The Key column shows the key number, the License column-the license type, Description-the license description, Expiration date-the license expiration date, Key file-the key file name.

The lower part of the dialog displays information about the Developers. If you click on Support button you will get the information on how to get in touch with Kaspersky Lab technical support service.

  Contact Us


The Extracting Engine

The extracting engine is designed to check for viruses in files archived with various versions of the following archivers: ZIP, ARJ, LHA, RAR, CAB and etc.

Ability to virus-check archives is very important as an infected file can stay in your archive for months or years, and the virus will be inactive and therefore invisible for you, but some day the virus may break loose and ruin your system.

KAV Scanner is unable to extract files from passworded archives.

KAV Scanner does not delete viruses from archives but just detects them.

If the unpacking and extracting engines are enabled KAV Scanner will be able to detect an infected file even though it was enciphered by the CryptCOM utility, then packed by PKLITE and, finally, added to the PKZIP archive.

  Contact Us


The Heuristic Checker (Code Analyser)

The heuristic checker (Code Analyser) examines the structure of a program down to several sublevels. If it finds instructions (such as opening another file and adding code into it, or intercepting system interrupts) it thinks are suspicious, the following message will appear on your screen:

Suspicion: <TYPE>,

where <TYPE> will be replaced by one of the following:

·	Com—looks like a .COM file infector;
Exe—looks like a .EXE file infector;
ComExe—looks like a .COM and .EXE file infector;
ComTSR, ExeTSR, ComExeTSR—looks like a memory resident Com, Exe or ComExe infector

·	Boot—looks like an image file of boot virus or boot virus dropper

·	Trojan—looks like a trojan horse program

·	encrypted—a suspicious file contains a decryption routine

·	Trivial—looks like uknown infector which replaces executable files in current directory for himself (usually the lenght of that virus doesn't exceed 300 byte)

·	HLL—looks like uknown infector which corrupts executable files. It was written on the one of higher-level programming languages (C, Pascal)

·	Win32—looks like uknown Windows infector

·	Formula—a Excel-file contains suspicious commands

·	Macro.Word97.Fs—looks like Macro.Word97.Fs infector

·	RemoteTemplate—a suspicious document contains a reference to the template which automatically loaded on files opening

·	HTML.SecurityBreach.2—an HTML-files or a HTML-letter contains a reference to a suspicious object

·	IRC-Worm.generic—looks like uknown worm infector which sends itself through IRC channels

·	BAT—looks like uknown infector which corrupts BAT-files

·	VBS.I-Worm—looks like uknown worm infector which sends itself

The heuristic checker, just like any others of its type, may occasionally produce false alarms—that is, the program may identify a virus-free file as infected. If you do encounter a false alarm while checking files using the code analyser, please let us know and send us copies of the virus-free files that were identified as infected so we can study them at Kaspersky Lab.

When it’s in action, the code analyser examines the structure of a program down to several sublevels. This mechanism detects 92% of the viruses in Kaspersky Lab’s database, and we believe that new-found viruses that aren’t yet in the database will be detected with the same degree of probability.

  Contact Us


The Redundant Scan Mode

The redundant scan mode virus-checks not just the entry points into a file that are used by the system when processing, but the entire contents of the examined files. This mode allows detection of files that are infected in the so called «incorrect» way and turns out to be «under-treated» what means that they are recovered but the virus isn't cut off.

The redundant scan mode is recommended if no virus was detected in a normal scan but the system is still behaving strangely (for example, there are frequent instances where the computer restarts by itself, unnaturally slow performance from applications, and etc.) Otherwise, we do not recommend enabling the redundant scan mode as it noticeably slows down the scanning rate and increases the probability of “false alarms.”

  Contact Us


The Unpacking Engine

Packed executable files contain special unpacking modules. When an executable program designed this way is started, the module unpacks the file to RAM and then runs it.

If a virus known to Kaspersky Anti-Virus was detected in some packed file it can be deleted (if the scanner was pre-set to disinfect files). In this case the infected file will be replaced by the unpacked and disinfected one. If the unpacking engine is disabled, packed executable modules will be scanned as unpacked and the scanner will only be able to detect viruses that enrooted in files when they were already packed.

Packing utilities can pack infected files along with clean ones. If these are scanned by an ordinary antivirus scanner, the infected file would be passed as virus-free, because the virus body was packed together with the program code.

The unpacking engine unpacks files that have been packed by various versions of the most popular utilities: DIET, PKLITE, LZEXE, EXEPACK and etc., to temporary files so the scanner can virus-check them. When the check is completed the temporary files will be deleted.

The unpacking device is able to correctly unpack files that have been compressed multiple times. It can also deal with some versions of immunizers, programs protecting executable files from viruses by attaching checking code blocks (CPAV and F-XLOCK) and enciphering programs (CryptCOM) to them.

  Contact Us


Toolbar

Buttons are located in the toolbar; by pressing them you can initiate some or other operation.

Button	Menu	Function
	File [image] Load profile	Load parameters from the settings file
	File [image] Save profile	Save parameters to the settings file
	—	Save parameters to the settings file and specify them as loaded by default
	Scan [image] Start scan	Start a scanning process
	Scan [image] Pause scan / Continue scan	Suspend/continue a scanning process
	Scan [image] Stop scan	Stop a scanning process
	Scan [image] Preview scan	Show options as sequential text
	Tools [image] Show report	Show a report window
	Tools [image] Update now	Start a program of anti-viral database updating
	File [image] Unload Kaspersky Anti-Virus Scanner	Unload the program from memory
  Contact Us


Unload Kaspersky Anti-Virus Scaner

When you select the Unload Kaspesky Anti-Virus Scaner item from the File menu or from the system menu Kaspersky Anti-Virus Scanner will be terminated.

  Contact Us


What is Tree-Chart

The Kaspersky Anti-Virus interface uses the so-called Tree-Chart technology.

Tree-Chart is the universal technology of data presentation that is developed by Kaspersky Lab experts for both beginners and advanced users. As provided by this technology the entire data is presented in the form of a tree with conventional controls as joints (buttons, drop-down lists, check-boxes and etc.).

This technology provides the clear and easy-to-understand picture of interrelations between various settings and makes it easy to study the program.

In this help system all the controls are illustrated by the pictures. So that you may see how do they look like in the program windows.

  Contact Us


What is a Computer Virus?

A computer virus is a program (a certain sequence of executable code/instructions), which is capable to create copies of itself (which can be different from the "master"), and "inject" them into different objects of a computer system (files, system sectors). These usually fully functional copies allow a virus to spread further.

Viruses are usually classified by where they reside on a computer (e.g. files, boot sectors), the infection method (e.g. memory resident/non-resident, slow/fast etc.), their destruction capabilities ("harmless", not dangerous, dangerous, very dangerous), and any special features of the virus algorithm (e.g. polymorphic, stealth, etc.)

"Trojan horse" and "Backdoor" programs and "worms" are NOT viruses by the above definition.

A trojan horse is a program or part of a program that usually performs destructive actions, such as formatting your hard-drive. The analogy to greek mythology comes from the circumstance, that a trojan program is usually "disguised" as being something else, such as a well-known game or utility, but in this case, was replaced (or part of the program was changed) by the trojan-program in order to cause damage on a user's computer system.

As a trojan horse program does not replicate itself, it does not fall under the definition of a computer virus.

Though worms do replicate themselves (e.g. over networks), they do not infect files. They can cause "damage" in a sense, that they consume system resources, which can severly affect your systems' performance.

"Backdoor" programs are a fairly new category of malware. Such programs, once installed on your system, allow somebody to remotely control your PC over the Internet. Besides causing damage, your personal data is at risk. If you ever had such a backdoor program installed on your system, it is suggested you change your passwords as soon as possible - and of course, remove the backdoor program immediately.

Another category of viruses, which also do not fall strictly under the above virus definition are so called "companions". "Companions" do not change their "target"-file, but create e.g. .COM files beside the .EXE originals with the same name. As DOS executes .COM files before .EXE files if only the filename, but not the extension is given, the "companions" get executed first, perform their actions and then launch the original .EXE file.

This help only covers some basic virus classifications. For a much finer and more detailed virus classification and more valuable virus-information, we recommend taking a look at the "comp.virus"-FAQ, which is available on the Internet from many sites. The AVP Virus Encyclopaedia, a regularly updated database of virus-descriptions, also features detailed information on the inner workings of viruses.

  Contact Us


What to do with Suspicious Objects

If KAV Scanner gave out a report about some object being "suspicious", do the following:

Files: copy the "suspicious" files on a diskette, or pack them into a ZIP or ARJ compressed file

Sector-objects: copy a system sector, containing Boot sector, Master Boot Record (where applicable) and FAT, into a file by means of a special program. (Several such utilities are available on the Internet, if you don't have one)

Send the diskettes or archive files to your nearest KAV distributor or to Kaspesky Lab. To speed up the process send such files via e-mail newvirus@kaspersky.com

  Contact Us


Why is it Necessary to Fight Computer Viruses?

Though virus infections do not happen as often as one is led to believe by some media reports, they do happen, and if they do can cause substantial damage (rendering vital data inaccessible or unusable, impact your computer's performance, etc.). Additionally, for liability and ethical reasons, you should avoid to spread viruses to e.g. your customers and friends.

Taking the necessary precautions can help you minimize the probability of viruses infecting your computer systems, or at least reduce the possible impact of a virus infection. Even "harmless" viruses (e.g. viruses that simply spread, but do not cause any other damage) can cause you problems in a sense that they "paralyse" your company during the time it takes to clean all infected files/objects (a very time-consuming, thus costly task, if you have to clean hundreds of PC's).

  Contact Us