Introduction to Kaspersky Internet Security 7.0 Help

Greetings from the specialists of Kaspersky Lab. We hope that the information in Help will assist you in building a computer protection system using Kaspersky Internet Security.
Where to begin

Before getting started with the program, we recommend that you learn a little about the threats that your computer can be subjected to, how they penetrate your system, and what the consequences are.

Next, you can read about the key features of Kaspersky Internet Security.

To start working with the program, we recommend that you read through the information in the Getting Started section. It contains a description of the first steps you need to take to ensure the security of your computer.

How to use Help

Help texts are accompanying by warnings, tips, and examples that we recommend reading thoroughly. Warning text is red, and tips and comments are green.

We have tried to make using the program as simple as possible. Practically every operation and task described in help links directly to those actions in the program. To do you so, you need only use the [image] button. A window will open where you can perform the operation described in Help.

How to find information in Help

You can search for information in Help by key word or by operation or task that you want the program to perform.

You can search by keyword on the Index and Search tabs. The difference is that:

    • The Index tab contains a list of key words that are indicative of the basic functions of the program and terms that users may have questions about. When you select the appropriate key word, you will see a list of sections where you can read information on the keyword.
    • On the Search tab, you can enter a key word in the search field and Help will display a selection of Help sections where that word is found.

You can search by operation using Help contents. We have tried to organize it so that you can find the answers to your question as quickly as possible. To make searching easier, descriptions are broken down into the components, tasks, and support services of Kaspersky Internet Security in the same way as the program interface. For each component:

    • A description and its purpose within the program are given and the operation algorithms are examined.
    • The various statuses that a component may have in the process of program operation are explained.
    • Component operation is covered in depth: how to pause it, disable it, and enable it again.
    • Component settings are described, and examples are given.
    • Operation statistics are discussed.
For example, if you want to know how to pause a component, go to Pause / Disable; if you want to learn how to change the security level, browse the information in the Selecting a security level section, etc.


Threats to Computer Security

As information technology has rapidly developed and as it has penetrated every aspect of human existence, the number of crimes aimed at breaching information security has grown.
Cyber criminals have displayed great interest in the activity of state structures and commercial enterprises. They make attempts at theft and disclosure of confidential information, doing damage to business reputations, breaching business continuity, and consequently breach an organization's information resources. These acts can do extensive damage to assets, both tangible and intangible.
It is not big companies alone who are at risk. Individual users can also be attacked. Using various tools, criminals gain access to personal data (bank account and credit card numbers and passwords), cause your system to malfunction, or gain complete access to your computer. Then that computer can be used as part of a zombie network, a network of infected computers used by hackers to attack servers, send out spam, harvest confidential information, and spread new viruses and Trojans.
In today's world, everyone acknowledges that information is a valuable asset and should be protected. At the same time, information must be accessible for a certain user group (for instance, employees, clients and partners of a business). This is why there is a need to create a comprehensive information security system. This system must take account of all possible sources of threats, whether human, man-made, or natural disasters, and use a complete array of defensive measures, on the physical, administrative, and software level.
Also see:

Sources of threats

How threats spread

Types of threats

Signs of infection

What to do if you show signs of infection

Preventing infection


Sources of Threats

A person, a group of people, or even some phenomena unrelated to human activity can serve as an information security threat. Following from this, all threat sources break down into three groups:
  • The human factor. This group of threats concerns the actions of people with authorized or unauthorized access to information. Threats in this group can be divided into:
    • External, including cyber criminals, hackers, internet scams, unprincipled partners, and criminal structures.
    • Internal, including actions of company staff and users of home PCs. Actions taken by this group could be deliberate or accidental.
  • The technological factor. This threat group is connected with technical problems - equipment used becoming obsolete and poor-quality software and hardware for processing information. This all leads to equipment failure and often to data loss.
  • The natural-disaster factor. This threat group includes any number of events brought on by nature and other events independent of human activity.

All three threat sources must be accounted for when developing a data security protection system. This User Guide only covers the one that is directly tied to Kaspersky Lab's expertise - external threats involving human activity.

Also see:

How threats spread

Types of threats

Signs of infection

What to do if you show signs of infection

Preventing infection


How threats spread

As modern computer technology and communications tools develop, hackers have more opportunities for spreading threats. Let's take a closer look at them:
The Internet

The Internet is unique, since it is no one's property and has no geographical borders. In many ways, this has promoted development of countless web resources and the exchange of information. Today, anyone can access data on the Internet or create their own webpage.

However, these very features of the worldwide web give hackers the ability to commit crimes on the Internet, making them difficult to detect and punish as they go.

Hackers place viruses and other malicious programs on Internet sites and disguise it as useful freeware. In addition, scripts which are run automatically when certain web pages are loaded may perform hostile actions on your computer by modifying the system registry, retrieving your personal data without your consent, and installing malicious software.

By using network technologies, hackers can attack remote PCs and company servers. Such attacks may result in a resource being disabled or used as part of a zombie network, and in full access being gained to a resource and any information residing on it.

Ever since it became possible to use credit cards and e-money through the Internet in online stores, auctions, and bank homepages, online scams have surfaced as one of the most common crimes.

Intranet

Your intranet is your internal network, specially designed for handling information within a company or a home network. An intranet is a unified space for storing, exchanging, and accessing information for all the computers on the network. Therefore, if any one network host is infected, other hosts run a significant risk of infection. To avoid such situations, both the network perimeter and each individual computer must be protected.

E-mail

Since practically every computer has mail clients installed on it and since malicious programs exploit the contents of electronic address books, conditions are usually right for spreading malicious programs. The user of an infected host unwittingly sends infected messages out to other recipients who in turn send out new infected messages, etc. It is common that infected file documents go undetected at are sent out with business information from a large company. When this occurs, more than a handful of people are infected. It could be hundreds or thousands, all of whom then send the infected files to tens of thousands of subscribers.

Beyond the threat of malicious programs lies the program of electronic junk mail, or spam. Although not a direct threat to your computer, spam increases the load on mail servers, eats up bandwidth, fills up your mailbox, and wastes working hours, thereby incurring financial harm.

Also, note that hackers have begun using mass mailing programs and social engineering methods to convince users to open e-mails or click a link to a certain website. It follows that spam filtration capabilities are both for stopping junk mail and for counteracting new types of online scans, such as phishing, and for stopping the spread of malicious programs.

Removable storage media

Removable media (floppies, CD/DVD-ROMs, and USB flash drives) are widely used for storing and transmitting information.

When you open a file that contains malicious code from a removable storage device, you can damage data stored on your computer and spread the virus to your computer's other drives or other computers on the network.

Also see:

Sources of threats

Types of threats

Signs of infection

What to do if you show signs of infection

Preventing infection


Types of Threats

There are a vast number of threats that could affect your computer today. This section will go over the threats that Kaspersky Internet Security blocks.
Worms

This malicious program category largely exploits operating system vulnerabilities to spread itself. The class was named for the way the worms crawl from computer to computer, using networks and e-mail. This feature gives many worms a rather high speed in spreading themselves.

Worms penetrate a computer, search for network addresses of other computers, and send a burst of self-made copies to these addresses. In addition to network addresses, worms often utilize data from e-mail client address books. Some of these malicious programs occasionally create working files on system disks, but they can run without any system resources at all (with the exception of RAM).

Viruses

Programs that infected other programs, adding their own code to them to gain control of the infected files when they are opened. This simple definition explains the fundamental action performed by a virus - infection.

Trojans

Programs that carry out unauthorized actions on computers, such as deleting information on drives, making the system hang, stealing confidential information, etc. This class of malicious program is not a virus in the traditional sense of the word (meaning it does not infect other computers or data). Trojans cannot break into computers on their own and are spread by hackers, who disguise them as regular software. The damage that they incur can exceed that done by traditional virus attacks by several fold.

Recently, the most widespread type of malicious program damaging computer data has been worms. Then follow viruses and Trojans. Some malicious programs combine features of two or even three of these classes.

Adware

Program code included in software, unbeknownst to the user, designed to display advertisements. Adware is usually built into software that is distributed free. The advertisement is situated in the program interface. These programs often also collect personal data on the user and send it back to their developer, change browser settings (start page and search pages, security levels, etc.) and create traffic that the user cannot control. All this can lead to breach of the security policy and to direct financial losses.

Spyware

Software that collects information about a particular user or organization without their knowledge. You might never guess that you have spyware installed on your computer. In general, the goal of spyware is to:

    • trace user actions on a computer;
    • gather information on the contents of your hard drive; in such cases, this more often than not involves scanning several directories and the system registry in order to compile a list of the software installed on the computer;
    • gather information on the quality of the connection, bandwidth, modem speed, etc.
Riskware

Potentially dangeerous applications include software that has not malicious features but could form part of the development environment for malicious programs or could be used by hackers as auxiliary components for malicious programs. This program category includes programs with backdoors and vulnerabilities, as well as some remote administration utilities, keyboard layout togglers, IRC clients, FTP servers, and all-purpose utilities for stopping processes or hiding their operation.

Yet another type of malicious program that goes along with programs like adware, spyware, and riskware is programs that plug into your web browser and redirect traffic. You have most certainly encountered such programs if you have ever opened one web site when you thought you were pulling up another.

Jokes

Software that does not cause a host any direct harm but displays messages that such harm has already been caused or will result under certain conditions. These programs often warn the user of dangers that do not exist, such as messages that pop up about formatting the hard drive (although no formatting actually takes place) or detecting viruses in uninfected files.

Rootkits

Utilities used to conceal malicious activity. They mask malicious programs to keep anti-virus programs from detecting them. Rootkits modify the operating system on the computer and alter its basic functions to hide its own existence and actions that the hacker undertakes on the infected computer.

Other dangerous programs

Programs created to set up DoS attacks on remote servers, hacking into other computers, and programs that are part of the development environment for malicious programs. These programs include hack tools, virus builders, vulnerability scanners, password-cracking programs, and other types of programs for cracking network resources or penetrating a system.

Hacker attacks

Hacker attacks can be initiated by hackers or by malicious programs. They are aimed at stealing information from a remote computer, causing the system to malfunction, or gaining full control of the system's resources. A description of existing network exploits is shown in Types of network attacks section.

Some types of online scams

Phishing is an online scam that uses mass mailings to steal confidential information from the user, generally of a financial nature. Phishing e-mails are designed to maximally resemble informative e-mails from banks and well-known companies. These e-mails contain links to fake sites set up by hackers to copy the site of the organization that they claim to represent. On this site, the user is asked to enter, for example, his credit card number and other confidential information.

Dialers to pay-per-use websites - type of online scam using unauthorized use of pay-per-use Internet services (these are commonly web sites of a pornographic nature). The dialers installed by hackers initiate modem connections from your computer to the number for the pay service. These numbers often have very high rates and the user is forced to pay enormous telephone bills.

Intrusive advertising

This includes popup windows and banner ads that open when using your web browser. The information in these windows is generally not of benefit to you. Popup windows and banner ads distract the user from the task and take up bandwidth.

Spam

Spam is anonymous junk email, and includes several different types of content: adverts; political messages; requests for assistance; emails that ask one to invest large amounts of money or to get involved in pyramid schemes; emails aimed at stealing passwords and credit card numbers, and emails that ask to be sent to friends (chain letters).

Spam significantly increases the load on mail servers and the risk of loosing important data.

Kaspersky Internet Security uses two methods for detecting and blocking these threat types:
  • Reactive - it is a method designed to search for malicious objects using continuously updating application databases. This method requires at least one instance of infection to add a threat signature to the databases and to distribute a database update.
  • Proactive - in contrast to reactive protection, this method is based not on analyzing the object's code but on analyzing its behavior in the system. This method is aimed at detecting new threats that are still not defined in the signatures.
By employing both methods, Kaspersky Internet Security provides comprehensive protection for your computer from both known and new threats.
Also see:

Sources of threats

How threats spread

Signs of infection

What to do if you show signs of infection

Preventing infection


Signs of Infection

There are a number of signs which show that a computer is infected. If you notice that your computer is doing strange things, specifically:
  • Unexpected messages or images appear on your screen or you hear unusual sounds;
  • The CD/DVD-ROM tray opens and closes unexpectedly;
  • The computer arbitrarily opens a program without your assistance;
  • Warnings pop up on the screen about a program on your computer attempting to access the Internet, even though you initiated no such action, then, it is highly probable that your computer has become infected with a virus.
There are also several typical traits of a virus infection through e-mail:
  • Friends or acquaintances tell you about messages from you that you never sent;
  • Your inbox houses a large number of messages without return addresses or headers.
It must be noted that these signs can results from problems other than viruses. They can sometimes arise from different causes. For example, in the case of the e-mail, infected messages can be sent with your return address but not from your computer.
There are also indirect indications that your computer is infected:
  • Your computer freezes or crashes frequently;
  • Your computer loads programs slowly;
  • You cannot boot up the operating system;
  • Files and folders disappear or their contents are distorted;
  • The hard drive is frequently accessed (the light blinks);
  • The web browser (for example, Microsoft Internet Explorer) freezes up or behaves unexpectedly (for example, you cannot close the program window).
In 90% of cases, these indirect systems are caused by malfunctions in hardware or software. Despite the low likelihood that these symptoms are indicative of infection, a full scan of your computer is recommended.


What to do if you show signs of infection

If you notice that your computer is behaving suspiciously...
  1. Do not give in to panic! This is the golden rule, and it could save you from losing important data and from a lot of fretting.
  2. Disconnect your computer from the Internet or local network, if it is on one.
  3. If the infection symptom is that you cannot boot from the computer's hard drive (the computer displays an error message when you turn it on), try booting in safe mode or with the emergency Microsoft Windows boot disk that you created when you installed the operating system on the computer.
  4. Before doing anything else, back up your work on removable storage media (floppy, CD/DVD, flash drive, etc.).
  5. Install Kaspersky Internet Security, if you have not done so already.
  6. Update databases and program modules. If possible, get the updates off the Internet from an uninfected computer at a friend's, an Internet café, or work. It is better to use a different computer, since when you connect to the Internet with an infected computer, there is a chance that the virus will send important information to hackers or spread the virus to the addresses in your address book. That is why if you suspect that you have a virus, the best thing to do is to immediately disconnect from the Internet. You can also get threat signature updates on floppy disk from Kaspersky Labs or its distributors and update your signatures with the disk.
  7. Select the security level recommended by the experts at Kaspersky Lab.
  8. Start a full computer scan.


Preventing Infection

The most reliable and thought-out measures cannot provide you with 100% protection from computer viruses and Trojans, but, with this set of rules in mind, you will significantly lower the likelihood of virus attacks and the level of potential damage.
One of the basic methods of battling viruses is, as in medicine, well-timed prevention. Computer prophylactics involve a rather small number of rules that, if complied with, can significantly lower the likelihood of being infected with a virus and losing data.
Below is a listing of basic safety rules which, if followed, will help mitigate the risk of virus attacks.
Rule No. 1: Use antivirus software and Internet security programs. To do so:
  • Install Kaspersky Internet Security as soon as possible.
  • Regularly update the application databases. Updates may be performed several times a day in the event of virus epidemics. Under such circumstances application databases on Kaspersky Lab update servers update immediately.
  • Select the security settings recommended by Kaspersky Lab for your computer. You will be protected constantly from the moment the computer is turned on and it will be harder for viruses to get onto your computer.
  • Configure the settings for complete scan recommended by the experts at Kaspersky Lab and schedule scans for at least once per week. If you have not installed Firewall, we recommend that you do so to protect your computer when using the Internet.
Rule No. 2: Use caution when copying new data to your computer:
  • Scan all removable storage drives for viruses (floppies, CD/DVDs, flash drives, etc.) before using them.
  • Treat e-mails with caution. Do not open any files that have come through e-mail if you are not certain that they were really supposed to be sent to you, even if they were sent by people you know.
  • Be careful with information obtained through the Internet. If any web site suggests that you install a new program, be certain that it has a security certificate.
  • If you are copying an executable file from the Internet or local network, be sure to scan it with Kaspersky Internet Security.
  • Use discretion when selecting which web sites you visit. Many sites are infected with dangerous script viruses or Internet worms.
Rule No. 3: Pay close attention to information from Kaspersky Lab.

In most cases, Kaspersky Lab announces a new outbreak long before it reaches its peak. The corresponding likelihood of infection is still low, and you will be able to protect yourself from new infection by downloading updated application databases.

Rule No. 4: Do not trust virus hoaxes, such as prank programs and e-mails about infection threats.
Rule No. 5: Use the Microsoft Windows Update tool and regularly install Microsoft Windows operating system updates.
Rule No. 6: Buy legit copies of software from official distributors.
Rule No. 7: Limit the number of people who are allowed to use your computer.
Rule No. 8: Lower the risk of unpleasant consequences of a potential infection:
  • Back up data regularly. If you lose your data, the system can fairly quickly be restored if you have backup copies. Store distribution floppies, CDs, flash drives, and other storage media with software and valuable information in a safe place.
  • Create a Rescue Disk that you can boot with, using a clean operating system.
Rule No. 9: review the list of software installed on your computer on a regular basis. This can be accomplished using the Install/Remove Programs service under Control Panel or simply by viewing the contents of the Program Files folder and the startup folder. You can discover software here that was installed on your computer without your knowledge, for example, while you were using the Internet or installing a program. Some of them are almost always potentially dangerous programs.


Kaspersky Internet Security 7.0

Kaspersky Internet Security 7.0 is a new generation of data security products.
What really sets Kaspersky Internet Security 7.0 apart from other software, even from other Kaspersky Lab products, is the multifaceted approach to data security on the user's computer.
Also see:

What's new in Kaspersky Internet Security

What Kaspersky Internet Security defense is built on


What's new in Kaspersky Internet Security

What's new in Kaspersky Internet Security 7.0

Kaspersky Internet Security 7.0 is an essentially new approach to data security. The program's main feature is that it unites and noticeably improves the existing features of all the company's products in one protection solution. The program ensures not only anti-virus protection but protection from spam and hacker attacks. New modules offer protection from unknown threats and certain types of internet fraud, as well as capability to monitor computer user access to the Internet.
You no longer need to install several programs on a computer to give yourself full protection. You can simply install Kaspersky Internet Security 7.0.
The multifaceted defense covers all channels for data transmission and exchange. A flexible configuration of all application components allows for maximum customization of Kaspersky Internet Security to the needs of each user. Unified configuration for all the protection components is also built-in.
Let's take closer look at the new features in Kaspersky Internet Security 7.0:
New Protection Features
  • Now Kaspersky Internet Security not only protects you from known malicious programs, but programs that are not yet known as well. The Proactive Defense component is the number one advantage of the program. It is built on the analysis of behavior of applications installed on your computer, monitoring changes to the system registry and fighting with hidden threats. The component uses an heuristic analyzer that can detect various types of malicious programs. In doing so, a history is kept of malicious activity, on the basis of which the actions of a malicious program can be rolled back and the system can be restored to the state prior to the malicious activity.
  • The program protects users from rootkits and autodialers, blocks banner ads, pop-up windows, and malicious scripts loaded from websites,detects phishing sites, and protecting users from unauthorized transmission of confidential data (passwords for Internet connections, e-mail, or ftp servers).
  • File Anti-Virus technology has been improved: now you can lower the load on your processor and disk subsystems and increase the speed of file scans. This is accomplished using the iChecker™ and iSwift™ technologies. By operating this way, the program rules out repeat scans of files.
  • The scan process now runs in the background while you work. A scan can take up a fair amount of time and system resources, but the user can perform his work simultaneously. If any operation requires system resources, the virus scan will be paused until that operation is completed. The scan then resumes from the point where it left off.
  • Individual tasks are provided for scanning Critical Areas of the computer and startup objects that could cause serious problems if infected and for detecting rootkits used to hide malware on your system. You can configure these tasks to run automatically every time the system is started.
  • Protection of mail on the user's computer from malicious programs and spam has been significantly improved. The program scans e-mail sent on these protocols for viruses and spam:
    • IMAP, SMTP, POP3, regardless of which mail client you use;
    • NNTP (virus scan only), regardless of the mail client;
    • Regardless of the protocol (including MAPI and HTTP), using plug-ins for Microsoft Office Outlook and The Bat!
  • Special plug-ins are available for widely used mail clients such as Microsoft Office Outlook, Microsoft Outlook Express (Windows Mail), and TheBat! that can configure mail protection directly in the mail client both from viruses and from spam.
  • Anti-Spam is trained as you work with the mail in your inbox, taking into account all the details of how you deal with mail and providing maximum flexibility in configuring spam detection. Training is built around the iBayes algorithm. In addition, you can create black and white lists of addressees and key phrases that would mark an e-mail as spam.
    • Anti-Spam uses a phishing database. It can filter e-mails out that are designed to obtain confidential information of a financial nature.
  • The program filters inbound and outbound traffic, traces and blocks threats from common network attacks, and lets you be on the Internet in Stealth Mode.
  • When working on a network, you can also define on your own what network to trust 100% and which to monitor with absolute strictness.
  • The user notification function has been expanded for certain events that arise during program operation. You can select the method of notification yourselves for each of these event types: e-mails, sound notifications, pop-up messages, event log entries.
  • Scanning has been added for data transmitted across secure SSL connections.
  • The program has added self-defense features: protection against unauthorized remote use of the program’s tools, and password-protected program settings. These features help keep malicious programs, hackers, and unauthorized users from disabling protection.
  • A feature has been added that can create a rescue disk. Using the rescue disk, you can reboot the operating system after a virus attack and scan the computer for malicious files.
  • A new Kaspersky Internet Security component, Parental Control, enables users to monitor computer access to the Internet. This function allows or blocks user access to certain internet resources. In addition, this component provides a capability to limit time online.
  • A News Agent has been added. It is a module designed for real-time delivery of news content from Kaspersky Lab.
  • Support has been added for IP Protocol, Version 6 (IPv6).
New Program Interface Features
  • The new Kaspersky Internet Security interface makes the functions of the program simple and easy to use. You can also change the appearance of the program by using your own graphics and color schemes.
  • When using the program, it regularly provides you with helpful information: Kaspersky Internet Security displays informative messages on the level of protection, accompanies its operation with comments and tips, and includes a through help section. A security wizard built into the application provides a complete snapshot of a host's protection status and allows to proceed directly to issue resolution.
New Program Update Features
  • This version of the program debuts our improved update procedure: Kaspersky Internet Security automatically checks the update source for updates. If it finds new updates, Anti-Virus downloads them and installs them on the computer.
  • Only updates that you do not yet have are downloaded from the update site. This lowers the download traffic for updates by up to ten times.
  • Updates are downloaded from the most efficient source.
  • Now you can choose not to use a proxy server, if the program updates are downloaded from a local source. This noticeably reduces the traffic passing through the proxy server.
  • A rollback capability has been implemented to recover to a previous application database version in the event of file corruption or copy errors.
  • A new feature has been added that allows updates to be copied to a local folder so that other computers on the network can access them, thereby reducing Internet traffic.


What Kaspersky Internet Security defense is built on

Kaspersky Internet Security protection is built with the sources of threats in mind. In other words, each threat is dealt with by a separate program component that monitors it and the takes the necessary actions to forestall the malicious effects of that source on the user's data. This makes setup flexible, with easy configuration options for all of the components tailored to the needs of a specific user or business as a whole.
Kaspersky Internet Security includes:
  • Protection Components, providing real-time protection of all data transfer and input paths through your computer.
  • Virus Scan Tasks, used to scan individual files, folders, drives, or areas for viruses or to perform a full computer scan.
  • Update, providing internel application modules state, and also are used for threats scan, hack attacks and spam messages detection.
  • Support Features that provide information support for working with the program and expanding its capabilities.


Protection Components

The following protection components provide defense for your computer in real time:
File Anti-Virus

A file system can contain viruses and other dangerous programs. Malicious programs can be stored in computer file system for years after one day making it through on a removable drive or from the Internet without showing themselves at all. But you only need open the infected file, and the virus is instantly activated.

File Anti-Virus - the component that monitors the computer's file system. It scans all files that are opened, run, and saved on your computer and any attached drives. Kaspersky Internet Security intercepts each attempt to access a file and scans such file for known viruses. The file can only be used further if the file is not infected or is successfully treated by the Anti-Virus. If a file cannot be disinfected for any reason, it will be deleted (with a copy of the file saved in backup) or will be moved to quarantine.

Mail Anti-Virus

E-mail is widely used by malefactors to spread malicious programs. It is one of the chief means for spreading worms. This makes it extremely important to monitor all mail messages.

Mail Anti-Virus - the component that scans all incoming and outgoing e-mails on your computer. It analyzes e-mails for malicious programs. The e-mail is available to the addressee only if it does not contain dangerous objects.

Web Anti-Virus

Opening various web sites you put your computer at risk for infection with viruses which will be installed using scripts contained in such web pages as well as for downloading dangerous objects.

Web Anti-Virus is specially designed to forestall such situations. This component intercepts and blocks scripts on web sites if they pose a threat. All http traffic is subject to careful inspection.

Proactive Defense

The number of malicious programs grows daily. Such programs become more complex combining several types of threats and modifying delivery routes. They become more difficult to detect.

To detect a new malicious program before it has time to do any damage, Kaspersky Lab has developed a special component - Proactive Defense. It is designed around monitoring and analyzing the behavior of all applications installed on your computer. Judging by the actions executed by an application, Kaspersky Internet Security makes a decision. Is the application potentially dangerous? So your computer is protected not only from known viruses, but from new ones as well that still have not been discovered.

Privacy Control

Various online scams have become common recently (phishing, autodialers, confidential data theft, such as logins and passwords). These actions can do serious financial damage.

Privacy Control traces these online scams on your computer and blocks them. For example, this component will block programs attempting to perform unauthorized autodialing, analyze web pages for phishing scams, intercept unauthorized access and user personal data downloads.

Firewall

Hackers will exploit any potential vilnerability to break into your computer including an open port, transfer of information from computer to computer, etc.

Firewall is a component designed for protecting your computer while you are using the Internet and other networks. It monitors inbound and outbound connections and scans ports and data packets.

In addition, Firewall blocks unwanted advertisements (banner ads and popup windows), which cuts down the amount of downloaded Internet traffic and saves the user time.

Anti-Spam

Although not a direct threat to your computer, spam increases the load on mail servers, fills up your mailbox, and takes up your time, and thereby does financial harm.

The Anti-Spam component plugs into the mail client installed on your computer and scans all incoming mail for spam subject matter. All e-mails that contain spam are marked with a special header. Anti-Spam can also be configured to process spam as you like (auto delete, move to a special folder, etc.).

Parental Control

One of the features of the Internet is the lack of censorship, and consequently many websites contain illegal or unwanted information, or information aimed at an adult audience. More websites containing racism, pornography, violence, use of weapons, and illicit drug use appear every day. Furthermore, these sites often contain a large number of malicious programs that run on your computer when you view them.

Restricting user access to the these websites, especially for minors, is a key task for new information security software.

Parental Control is a component designed to control user access to certain sites on the Internet. This might mean sites with objectionable content or any other sites that the user chooses in the Kaspersky Internet Security settings. Control is exercised not only over the content of requested resources but also over time spent online. Access to the Internet may be granted at certain times or a limit may be placed on the total time spent online in a 24-hour period.


Virus scan tasks

In addition to the protection of all the ways that malicious programs can penetrate, it is extremely important to periodically scan your computer for viruses. This is required to stop the spread of malicious programs not detected by real-time protection components because of the low level of protection selected or for other reasons.
The following tasks are provided by Kaspersky Internet Security to perform virus scans:
Critical Areas

Scans all critical areas of the computer for viruses. These include: system memory, system startup objects, master boot records, Microsoft Windows system folders. The objective is quickly to detect active viruses on the system without starting a full computer scan.

My Computer

Search for viruses on your computer with a through scan of all disk drives, memory, and files.

Startup Objects

Scans for viruses all auto launched programs that are loaded when the operating system boots up and also operating memory and boot disk sectors.

Rootkit scan

Scans the computer for rootkits that hide malicious programs in the operating system. These utilities injected into system, hiding their presence and the presence of processes, folders, and registry keys of any malicious programs described in the configuration of the rootkit.

Other scan tasks may also be created and scheduled to run. For example, you can create scan task for mailboxes once per week or search for viruses in the My Documents folder.
Also see:

Protection status for My Computer

How to Scan Your Computer for Viruses

How to scan critical regions of the computer


Update

In order to always be on guard for any hacker attack and be ready to delete a virus or some other dangerous program, Kaspersky Internet Security needs real-time support. Update is designed to do exactly that. It is responsible for updating databases and application modules utilized by Kaspersky Internet Security.

The update download feature provides the capability to save database and application module updates received from Kaspersky Lab servers to a local folder to be shared with other hosts on the network to reduce internet traffic.


Support features of the program

Kaspersky Internet Security includes a number of support features. They are designed to provide software support in real time, expanding the capabilities of the program and for assisting you as you use it.
Reports

When using the program, each protection component, virus search task, and program update creates a report. The reports contain information on completed operations and their results. By using the Reports feature, you will always stay up-to-date on the operation of all the Kaspersky Internet Security components. Should problems arise, you can send the reports to Kaspersky Lab so our specialists can study the situation in greater depth and help you as quickly as possible.

Kaspersky Internet Security sends all files suspected of being dangerous to a special Quarantine area. They are stored there in an encrypted form to avoid infecting the computer. You can scan these objects for viruses, restore them to their previous locations, delete them, or add files to Quarantine on your own. All files that turn out not to be infected upon completion of the virus scan are automatically restored to their former locations.

The Backup Storage holds copies of files disinfected and deleted by the program. These copies are created in case you need to restore the files or information on their infection. The backup copies of the files are also stored in an encrypted form to avoid further infections. You can restore a file from Backup to the original location and delete the copy.

Activation

When purchasing Kaspersky Internet Security, you enter into a licensing agreement with Kaspersky Lab which governs the use of the application as well as your access to application database updates and Technical Support over a specified period of time. The term of use and other information necessary for full functionality of the program are provided in a key file.

Using the Activation feature, you can find detailed information on the key you are using or purchase a new key.

Support

All register Kaspersky Internet Security users can take advantage of our technical support service. In order to learn where exactly you can get technical support, use the Support feature.

By following appropriate links you can go to the Kaspersky Lab product user forum, send an error report to Technical Support, or application feedback by completing a special online form.

You also have access to online Technical Support, Personal User Cabinet Services; and our personnel are always happy to provide you with telephone support for Kaspersky Internet Security.


Program interface

Kaspersky Internet Security has a fairly simple and easy-to-use interface. This section will discuss its basic features.
  • icon in the taskbar notification area
  • context menu
  • main window
  • program settings window
In addition to the main program interface, there are plugins for Microsoft Office Outlook (scan for viruses and spam processing), Microsoft Outlook Express (Windows Mail), The Bat! (scan for viruses and spam processing), Microsoft Internet Explorer and Microsoft Windows Explorer. The plugins expand the features of these programs by making Kaspersky Internet Security management and settings possible from their interfaces.


Icon in the taskbar notification area

Right after installing Kaspersky Internet Security, its icon will appear in the taskbar notification area.
The icon is a sort of indicator for Kaspersky Internet Security operations. It reflects the state of protection and shows a number of basic functions performed by the program.
If the icon is active [image] (color), your protection is fully active or some of its components are running. If the icon is inactive [image] (black and white), all protection components are disabled.
The Kaspersky Internet Security icon changes in relation to the operation being performed:

e-mail being scanned.

script being scanned.

a file that you or some program are opening, saving, or running is being scanned.

Kaspersky Internet Security databases and application modules are being updated.

Computer needs to reboot to apply updates.

an error has occurred in some Kaspersky Internet Security component.
The icon also provides access the basics of the program interface: context menu and the main window.
To open the context menu, right-click on the program icon.
To open the Kaspersky Internet Security main window on the Protection section (this is the default first screen when you open the program), double-click the program icon. If you click once, the main window will open to the section that was active when you last closed it.
If news from Kaspersky Lab is available, the following icon will appear in the taskbar notification area [image]. Double click the icon to view the news in the resulting window.


Context Menu

You can run basic protection tasks from the context menu.
The Kaspersky Internet Security menu contains the following items:
    Scan My Computer - start a complete scan of your computer for dangerous objects. The files on all drives, including removable storage media, will be scanned.
    Virus Scan: select objects and start a virus scan. By default, the list contains a number of files, such as the My Documents folder, the Startup folder, mailboxes, all the drives on your computer, etc. You can add to the list, select files to be scanned, and launch virus scans.
    Update - start Kaspersky Internet Security module and database updates and install updates on your computer.
    Network Monitoring - view the list of network connections established, open ports, and traffic.
    Block network traffic - temporarily block all the computer's network connections. When you select this item from the menu, the Firewall Security level will change to Block all. If you want to allow the computer to interact with the network, select this item from the context menu again.
    Activate... - activate the program. You must activate your version of Kaspersky Internet Security to obtain registered user status which provides access to the full functionality of the application and Technical Support. This menu item is only available if the program is not activated.
    Settings... - view and configure settings for Kaspersky Internet Security.
    Open Kaspersky Internet Security - open the main program window.
    Pause protection / Resume protection - temporarily disable or enable protection components. This menu option does not affect product updates or virus scan task execution.
    About the program- calls up a window with info about Kaspersky Internet Security.
    Exit - close Kaspersky Internet Security (when this option is selected, the application will be unloaded from the computer’s RAM).
If a virus scan task is running, its name as well as its progress status (percent complete) will be shown in the context menu. By selecting the task you can go to the report window to view current performance results.


Main Program Window

The Kaspersky Internet Security main window [image] provides you with a simple and easy-to-use interface for interacting with the program. It can be divided into three parts:
  • upper part of window indicates your computer‘s current protection status.

    • There exist three possible protection statuses. Each of them is visually displayed by a certain color, by analogy with the traffic lights. Green color signifies that protection of your computer is performed on the right level, yellow and red colors warn about the presence of different problems in settings configuration or in Kaspersky Internet Security operation.

    To obtain detailed troubleshooting information and speedy problem resolution, use Security Wizard which opens when the security threat notification link is clicked;

  • the left part of the window, the navigation panel, can switch quickly and easily to any component, virus scan task performance, updates, or the program's help features;
  • the right part of the window, the information panel, contains information in the protection component selected in the left part of the window and displays settings for each of them, giving you tools for carrying our virus scans, working with quarantined files and backup copies, managing license keys, etc.
After selecting a section or component in the left part of the window, you will find information in the right-hand part that matches your selection.
We will now examine the elements in the main window navigation panel in greater detail.
Main Window Section
Purpose

The primary purpose of the Protection section is to provide access to your computer’s basic real-time protection components.
To view the status of a protection component or its modules, to configure its settings or open a relevant report, select this component from the list under Protection.
This section also contains links that provide access to the most common tasks: virus scan of objects and application database updates. You can view information on the status of these tasks, configure them, or run them.

The Scan section provides access to virus scan tasks for objects . It shows tasks created by Kaspersky Lab experts, (virus scan of critical areas, startup objects, full host scan, rootkit scan), as well as user tasks .

When a task is selected from the right pane, relevant task information is provided, task settings may be configured, a list of objects to be scanned is generated, or the task is run.

To scan a single object (file, folder, or drive), select Scan, use the right pane to add an object to the list to be scanned, and run the task.

In addition, this section may be used to create a rescue disk.

The Update section contains information on application updates: Database publication date and virus signature record count.

Appropriate links may be used to start an update, view a detailed report, configure updates, roll an update back to a previous version.

Reports and Data Files may be used to view a detailed report on any application component, a virus scan or update task, and work with an object placed in quarantine or backup storage.

The Activation section is used to handle keys required for the applications to be fully functional.

If a key is not installed, it is recommended that it be purchased without delay and that the application be activated.

If a key is installed, this section shows information on the type of key used and its expiration date. Once a current key expires, it may be renewed at the Kaspersky Lab website.

The Support section provides information on Technical Support available to Kaspersky Internet Security registered users.
Each element of the navigation panel is accompanied by a special context menu. Thus, the menu contains points for the protection components that help the user quickly configure them, manage them, and view reports. Virus scan tasks have an additional menu option to create user tasks based on a selected task, to delete and rename created tasks.

You can change the appearance of the program by creating and using your own graphics and color schemes.

The lower left-hand side of the window houses two buttons: Help , which provides access to the Kaspersky Internet Security help system, and Settings, which opens the application settings window.


Program settings window

The Kaspersky Internet Security [image] settings window may be accessed from the application main window or the application context menu. To call up this window, click the Settings link at the bottom of the application main window or select an appropriate option on the application context menu.

The settings window is designed like the main window:
  • the left pane provides fast and easy access to the settings of each application protection component, virus scan task, update, and application support function;
  • the right part of the window contains a list of settings for the component, task, etc. selected in the left part of the window.
When you select any section, component, or task in the left part of the settings window, the right part will display the basic settings for it. To configure advanced settings, you can open a second and third level settings window. You can find a detailed description of how to configure settings in Help.


Getting started

One of the main goals of the Kaspersky Lab specialists in making Kaspersky Internet Security was to provide optimum configuration for all the program's options. This makes it possible for a user with any level of computer literacy to protect their computer right after installation without spending hours on the settings.
However, configuration details for your computer or the jobs you do with it can have their own specifics. That is why we recommend performing a preliminary configuration to achieve the most flexible, personalized approach to protecting your computer.
For the user's convenience, we have united the preliminary configuration stages in one Initial Setup Wizard interface that starts as soon as the program is installed. By following the Wizard's instructions, you can activate the program, configure settings for updates and running virus scans, password-protect access to the program, and configure Firewall to fit the properties of your network.
After completing installation and starting the program, we recommend taking the following steps:
  • Check the current protection status to make sure that Kaspersky Internet Security is operating on the appropriate level.
  • Perform Anti-Spam Training on your e-mails.
  • Update the program (if the Setup Wizard did not do so automatically after installing the program).
  • Scan the computer for viruses.
Also see:

Initial Setup Wizard

How to scan a file, folder, or drive for viruses


Initial Setup Wizard

The Kaspersky Internet Security 7.0 Setup Wizard starts at the end of program installation. It's task is to help you perform the initial configuration of application parameters basing on specific features and tasks of your computer.
The Setup Wizard interface is designed like a standard Microsoft Windows Wizard and consists of a series of steps that you can move between using the Back and Next buttons or complete using the Finish button. The Cancel button will stop the Wizard at any point.
You can skip this initial settings stage when installing the program by closing the Wizard window. In the future, you can run it again from the program interface if you restore the default protection settings for Kaspersky Internet Security.
Also see:

Using objects saved with Version 5.0

Activating the program

Selecting a security mode

Configuring update settings

Configuring a virus scan schedule

Restricting application access

Application Integrity Control

Configuring Firewall settings

Finishing the Setup Wizard


Using objects saved with Version 5.0

This wizard window appears when you install the application on top of Kaspersky Anti-Virus 5.0. You will be asked to select what data used by version 5.0 you want to import to version 7.0. This might include quarantined or backup files or protection settings.

To use this data in Version 7.0, check the necessary boxes.


Activating the program

Before activating the program, make sure that the computer's system date settings match the actual date and time.

The activation procedure consists in installing a key used by Kaspersky Internet Security to verify the license to use the application and its expiration date.

A key contains service information required for the application to be fully functional as well as additional data:

  • support information (who provides the support and where you can obtain it);
  • key name, number, and expiration date.
Depending on whether you have a key for Kaspersky Internet Security or need to obtain one from the Kaspersky Lab server, you have several options for activating the program:
Activate using the activation code. Select this activation option if you have purchased the full version of the program and were provided with an activation code. Using this activation code you will obtain a key file providing access to the application's full functionality throughout the effective term of the license agreement.
Activate trial version. Select this activation option if you want to install the trail version of the program before making the decision to buy a commercial version. You will be given a free key valid for a term specified in the trial version license agreement.
Apply existing license key. Activate the program using Kaspersky Internet Security 7.0 key file, obtained earlier.
Activate later. If you choose this option, you will skip the activation stage. Kaspersky Internet Security 7.0 will be installed on your computer and you will have access to all program features except updates (only one application update will be available immediately following installation).
Caution!
An Internet connection is required for the first two activation options. If at the time of installation an Internet connection is unavailable, you can perform the activation later using the application interface or connect to the Internet from a different computer, and obtain a key using an activation code obtained by registering on the Kaspersky Lab Technical Support web site.
Also see:

Entering the activation code

Obtaining a license key

Selecting a license key file

Completing program activation


Entering the activation code

You must enter an activation code to activate the program. If you purchase the program through the Internet, you will receive the activation code by e-mail. If you purchase a boxed version of the program, you will find the activation code on the installation CD-ROM envelope.

The activation code is a sequence of numbers and letters separated by dashes into four sections of five characters each, no spaces. For example, 11AA1-11AAA-1AA11-1A111. Note that the code must be entered in Latin characters.

If you have already registered with Kaspersky Lab at the web site of the Tech-nical Support service and you have a customer number and password, enable the checkbox [image] I already have a Customer ID and enter that information in the lower window part.

If you have not registered yet, press the Next button leaving the box un-checked. Enter you client number and password at the bottom of the window if you have gone through the Kaspersky Lab client registration procedure and have these data. Leave the fields blank if you have not registered yet, and the activation wizard will request your contact information in the next step and perform the registration. At the end of registration you will be assigned a client number and a password which are required to obtain technical support. When using the activation wizard to register, the client number may be viewed in the Support section of the application main window.


User Registration

This step of the activation wizard requires you to provide your contact information: email address, city and country of residence. This information is required for Kaspersky Lab Technical Support to identify you as a registered user.

After the information is entered, it will be sent by the activation wizard to an activation server, and you will be assigned a client ID and a password for the Personal Cabinet on the Technical Support web site. Information on client ID is available under Support in the application main window.


Obtaining a license key

Obtaining a key file

The Settings Wizard connects to Kaspersky Lab servers and sends them your registration data (the activation code and personal information), which are inspected on the server.
If the activation code passes inspection, the Wizard receives a key file. If you install the demo version of the program, the Settings Wizard will receive a trial key file without an activation code.
The file received will be installed automatically to use the program and you will see an activation completion window with detailed information on the key being used.
Note
When this activation method is selected, the application does not download a physical file with the *.key extension from a server but rather obtains certain data that are written to the operating system registry and the file system.
User registration at the Kaspersky Lab website is required to obtain an actual activation key.
If the activation code does not pass inspection, you will see a corresponding message on the screen. If this occurs, contact the software vendors from whom you purchased the program for information.


Selecting a license key file

Selecting a key file

If you have a key file for Kaspersky Internet Security 7.0, the Wizard window will ask if you want to install it. If you do, use the Browse button and select the path for the file (with .key extension) in the standard file selection window.

Following successful key installation, current key information will be displayed at the bottom of the window: owner name, key code, key type (commercial, for beta testing, trial, etc.), as well as the license agreement expiration date.


Completing program activation

The Settings Wizard shall inform you that the program has been successfully activated. In addition, information on the installed key is displayed: owner name, key code, key type (commercial, for beta testing, trial, etc.), as well as the license agreement expiration date.


Selecting a security mode

In this window, the Settings Wizard asks you to select the security mode that the program will be operated with:

    Basic protection. This is the default setting and is designed for users, who do not have extensive experience with computers or anti-virus software. It sets all the program’s components to their recommended security levels and only informs the user of dangerous events, such as detecting malicious code or dangerous actions being executed.

    Interactive protection. This mode provides more customized defense of your computer’s data than Basic mode. It can trace attempts to alter system settings, suspicious activity in the system, and unauthorized activity on the network. All of the activities listed above could be signs of malicious programs or standard activity for some of the programs you use on your computer. You will have to decide for each separate case whether those activities should be allowed or blocked. If you choose this mode, specify when it should be used:

    Enable Firewall Training Mode – prompts user to accept actions when programs installed on your computer attempt to connect to a certain network resource. You can either allow or block that connection and configure Firewall rule for that program. If you disable Training Mode, Firewall runs with minimal protection settings, meaning that it grants all applications access to network resources.

    Enable Registry Guard – prompts user for a response when attempts to modify system registry keys are detected.

    If the application is installed on a computer running Microsoft Windows XP Professional x64 Edition, Microsoft Windows Vista or Microsoft Windows Vista x64, the interactive mode settings listed below will not be available.

    Enable Application Integrity Control – prompts user to accept actions when attempts are made to embed modules into monitored applications.

    Enable Extended Proactive Defense – analyzes all suspicious application activity in the system, including browsers opening with command line settings, injection into application processes, and injection of window hook interceptors (disabled by default).


Configuring update settings

Protection quality on your computer directly depends on updating the databases and program modules regularly. In this window, the Settings Wizard asks you to select a program update setting and configure schedule properties.
Automatically. Kaspersky Internet Security checks the update source for updates at specified intervals. During virus outbreaks, the check frequency may increase, and decrease when they are gone. If it finds new updates, Anti-Virus downloads them and installs them on the computer. This is the default setting.
Every 1 day(s) at 3:00 PM (time changes depending on settings). Updates will run automatically according to the schedule created. You can configure the schedule properties in another window by clicking Change.
Manually. If you choose this option, you will run program updates yourself.
Note that program modules included with the software may be outdated by the time you install the program. That is why we recommend downloading the latest program updates. To do so, click Update now. Then Kaspersky Internet Security will download the necessary updates from update sites and will install them on your computer.

To configure updates (select update source, run updates under a specified login, or activate update download to a local source), click the Settings button.


Configuring a virus scan schedule

Scanning selected areas of your computer for malicious objects is one of the key tasks in protecting your computer.
When you install Kaspersky Internet Security, several default virus scan tasks are created. In this window, the Settings Master asks you to choose a scan task setting:
Scan Startup objects

By default, scan of the startup objects is performed automatically at Kaspersky Internet Security startup. You can change the schedule settings in the dialog box, that opens using the Change button.

Scanning Critical Areas

In order to scan critical areas of your computer (system memory, Startup objects, boot sectors, Microsoft Windows system folders) for viruses automatically, check the corresponding box. You can configure the schedule properties in another window by clicking Change.

The default setting for this automatic scan is disabled.

Complete Scan

For a full virus scan of your computer to run automatically, check the box in the corresponding section. You can configure the schedule properties in another window by clicking Change.

The default setting for running this task according to schedule is disabled. However, we recommend running a full virus scan of your computer immediately after installing the program.


Restricting program access

Restricting application access

Since several people with different levels of computer literacy might use a personal computer, and since malicious programs can disable protection, you have the option of password-protecting access to Kaspersky Internet Security. Using a password can protect the program from unauthorized attempts to disable protection or change settings.
To enable password protection, check [image] Enable password protection and complete the New password and Confirm new password fields.
Below, specify the area that you want password protection to apply to:
    All operations (except notifications of dangerous events). Request password if the user attempts any action with the application except for responses to dangerous object detection notifications.
    Selected operations:
      Editing application settings - request password when a user attempts to save changes to program settings.
      Exiting the program - request password when user attempts to exit the application.
      Stopping / pausing protection components or scan tasks - request password if user attempts to pause or fully disable any real-timeprotection component or scan task.


Application Integrity Control

In this stage, the Kaspersky Internet Security wizard will analyze the applications installed on your computer (dynamic library files, digital manufacture signatures), count application checksum files, and create a list of programs that can be trusted from a virus security perspective. For example, this list will automatically include all applications digitally signed by Microsoft.
In the future, Kaspersky Internet Security will use information obtained while analyzing application structure to prevent malicious code from being imbedded in application modules.
Analyzing the applications installed on your computer may take some time.


Configuring Firewall settings

Firewall is the component of Kaspersky Internet Security that secures your computer on local networks and the Internet. At this stage, the Setup Wizard asks you to create a list of rules that will guide Firewall when analyzing your computer's network activity.
Also see:

Determining a security zone’s status

Creating a list of network applications


Determining a security zone’s status

In this stage, the Settings Wizard analyzes your computer’s network environment. Based on the analysis, the entire network space is broken down into conventional zone:

    Internet – the World Wide Web. In this zone, Kaspersky Internet Security operates as a personal firewall. In doing so, default rules for packets and applications regulate all network activity to ensure maximum security. You cannot change protection settings when working in this zone, other than enabling Stealth Mode on your computer for added safety.

    Security zones – certain conventional zones that mostly correspond with subnetworks that your computer is included on (this could be local subnetworks at home or at work). These zones are by default average risk-level zones when working in them. You can change the statuses of these zones based on how much you trust a certain subnetwork, and you can configure rules for packet filtering and applications.

All detected zones will be displayed on the list. Each of them is shown with a description, address and subnetwork mask. The list also contains statuses according to which any given network activity will be allowed or blocked within the scope of the Firewall component operation:

  • Internet. This is the default status assigned to the Internet, since when you are on it, your computer is subjected to all potential threat types. This status is also recommended for networks that are not protected by any anti-virus programs, firewalls, filters, etc. When you select this status, the program ensures maximum security while you are using this zone, specifically:
    • blocking any network NetBios activity within the subnetwork;
    • blocking rules for applications and packet filtering that allow NetBios activity within this subnetwork.
    Even if you have created a shared folder, the information in it will not be available to users from subnetworks with this status. Additionally, if this status is selected for a certain subnetwork, you will not be able to access files and printers of this subnetwork.
  • Local Network. The program assigns this status to the majority of security zones detected when it analyzes the computer’s network environment, except the Internet. It is recommended to apply this status to zones with an average risk factor (for example, corporate LANs). If you select this status, the program allows:
    • any network NetBios activity within the subnetwork;
    • rules for applications and packet filtering that allow NetBios activity within this subnetwork.
    Select this status if you want to grant access to certain folders or printers on your computer but block any other outside activity.
  • Trusted. It is only recommended to apply this status to zones that in your opinion are absolutely safe where your computer is not subject to attacks and attempts to gain access to your data. If you select this status, all network activity is allowed. Even if Maximum Protection is selected and block rules are created, they will not function for remote computers from a trusted zone.

You can use Stealth Mode for added security when using networks labeled Internet. This feature only allows network activity initiated from your computer. This actually means that your computer becomes invisible to its surroundings. This mode does not affect your computer’s performance on the Internet.

We do not recommend using Stealth Mode if the computer is being used as a server (for example, a mail or http server). Otherwise, the computers that connect to the server will not see it as connected.

To change the status of a zone or to enable/disable Stealth Mode, select it from the list, and use the appropriate links in the Rule description box below the list. You can perform similar tasks and edit addresses and subnetwork masks in the Zone settings window, which you can open by clicking Edit.

You can add a new zone to the list while viewing it. To do so, click Refresh. Firewall will search for available zones for registration, and if any are detected, the program will ask you to select a status for them. In addition, you can add new zones to the list manually (for example, if you connect your laptop to a new network). To do so, use the Add button and fill in the necessary information in the Zone settings window.

Warning!

Networks with similar or wider address ranges may conceal other networks. Concealed networks can only be autodetectable. In the event that a network with a wider address range appears on the list, all concealed networks manually added by user will be removed. Any settings configured for the wider network will be inherited by concealed networks. In the event the wider network is removed, concealed networks separate and inherit current settings.

To delete the network from the list, click the Delete button.


Creating a list of network applications

The Settings Wizard analyzes the software installed on your computer and creates a list of applications that use a network connection.
Firewall creates a rule to control network activity for each such application. The rules are applied using templates for most common applications that use network connections, created at Kaspersky Lab and included with the software.
You can view the list of network applications and the rules for them in the Firewall settings window, which you can open by clicking Applications.
For added security, we recommend disabling DNS caching when using Internet resources. This feature drastically cuts down on the time your computer is connected to the needed Internet resource; however, it is at the same time a dangerous vulnerability, and by using it, malefactors can create data leaks that cannot be traced using the firewall. Therefore, to increase the degree of security for your computer, we recommend disabling this feature, which saves information about domain names in the cache.


Using Outgoing Email to Train Anti-Spam

This step is used by the wizard to train Anti-Spam using your account's outgoing email messages. This requires that the contents of the Sent folder and any subfolders in Microsoft Office Outlook or Microsoft Outlook Express (Windows Mail) be analyzed. This analysis updates the Anti-Spam databases and the "white” address list with the training results.

To stop training Anti-Spam, click the Stop button. Only the results of training gathered prior to the button being clicked will be added to the Anti-Spam database.

Please note that you will not be able to return to training if it is interrupted or if you use the wizard’s Back/ Next buttons to navigate to other windows.


Finishing the Setup Wizard

The last window of the Wizard will ask if you want to restart your computer to complete the program installation. You must restart for Kaspersky Internet Security component drivers to register.

You can wait to restart, but if you do, some program protection components will not work.


What protection status does my computer have?

Your computer's protection status graphically tells you whether threats are currently impacting your system's overall security level. These threats include both malicious programs detected and using outdated databases for the program, disabling protection components, using minimum program operation settings, etc.

Protection status is displayed at the top of the application [image] main window and is color coded like a traffic light . Depending on the situation the color motif of the top section of the window will change, and in the event of security threats the color will be supplemented by information messages implemented as links to the Security Wizard .

The following color codes are used to show protection status:

  • Application Main Window is green. This status is an indication that your computer is properly protected.
    • Which means that the databases have been updated in a timely manner, all protection components are activated, the application is running with the settings recommended by Kaspersky Lab specialists, no malicious objects were discovered by a full computer scan or such malicious objects were disabled.
  • Application Main Window is yellow. Your computer's protection level is lower than its previous status. This protection status is indicative of certain problems with the application or application settings.
    • There are, for example, certain small deviations from the recommended mode of operation, application databases have not been updated in several days, Anti-Spam has not been trained.
  • Application Main Window is red . Your computer is seriously at risk of infection. This status points to problems that could lead to your computer being infected and to data loss.

    For example, one or more protection components have failed, the product has not been updated in a long time or malicious objects have been discovered and urgently need to be disabled, the product has not been activated .

If there are problems in the protection system, we recommend fixing them immediately. Use the Security Wizard which will be accessed by clicking the notification of security threats. The security wizard will help you look through all the current threats in order and will take you to the appropriate place to remove them. The criticality of the threat is depicted by the color of the indicator:

    - the indicator is directing your attention to non-critical threats that may, however, lower the overall protection level on your computer. Please pay heed to the recommendations from Kaspersky Lab specialists.
    - the indicator is showing that there are serious threats to your computer's security. Please carefully follow the recommendations below. They are all aimed at better protecting your computer. The recommended actions are given as links.

To browse the list of existing threats, click the Next button. A description is given of each threat and the following courses of action are available:

  • Eliminate threat immediately. By using the corresponding links, you can directly eliminate the threat. For in-depth information on events related to this threat, you can view the report file. The recommended action is immediately eliminating the threat.
  • Postpone threat elimination. If for any reason you cannot immediately eliminate the threat, you can postpone that action and come back to it later. To do so, use the Postpone link.

    Note that this option is not available for serious threats. Such threats include, for example, malicious objects that cannot be disinfected, crashes in components, or corrupted program database files.

If you still have threats left after you have finished the Security Wizard, a reminder will appear in the upper part of the main window telling you that you need to eliminate them. If you open the Security Wizard again, the postponed threats will not be on the list of active threats. However, you can still come back to view and eliminate postponed threats by clicking the View threats with postponed decisions link in the final window of the wizard.

Also see the current status of:

File Anti-Virus

Mail Anti-Virus

Web Anti-Virus

Proactive Defense

Firewall and persuasive advertising

Privacy Control

Anti-Spam

Parental Control

Virus scan tasks

Program updates


How to Scan Your Computer for Viruses

Following installation, the application will display a notification in the left pane that a full computer scan has not been performed and will recommend that the computer be scanned for viruses immediately.
Kaspersky Internet Security includes a task for a computer virus scan. It is located in the program's main window in the Scan section.
Selecting the My Computer task will display task settings: current security level, action to take with respect to malicious objects. A report of the latest scan is also available .
To scan your computer for malicious programs,
  1. Select the [image] My Computer task under Scan in the application main window.
  2. Click the Start Scan link.
As a result, the program will start scanning your computer, and the details will be shown in a special window. When you press the Close button, the window with information on the scan progress will close, although the scan will continue.
Also see:

How to Scan Critical Areas

How to Scan a File, Folder or Disk for Viruses


How to scan critical regions of the computer

There are areas on your computer that are critical from a security perspective. These are the targets of malicious programs aimed at damaging your operating system, processor, memory, etc.
It is extremely important to protect these critical areas of your computer to ensure that it keeps running. For your convenience, we have preprogrammed a special virus scan task for these areas. It is located in the program's main window in the Scan section.
Selecting Critical areas will display task settings: current security level, the action to be applied to malicious objects. Here you can select which critical areas you want to scan and immediately start a virus scan in the selected areas.
To scan critical areas of your computer for malicious programs,
  1. Select the [image] Critical Areas task under Scan in the application main window.
  2. Click the Start Scan link.
As a result, a scan of the selected areas will begin, and the details will be shown in a special window. When you press the Close button, the window with information on the scan progress will close, although the scan will continue.
Also see:

How to scan a file, folder, or drive for viruses

How to Scan Your Computer for Viruses


How to Scan a File, Folder or Disk for Viruses

There are situations when it is necessary to scan individual objects for viruses but not the entire computer. For example, one of the hard drives, on which your programs and games, e-mail databases brought home from work, and archived files that came with e-mail are located, etc. You can select an object for scan with the standard tools of the Microsoft Windows operating system (for example, in the Explorer program window or on your Desktop, etc.).
In order to launch an object scan,

place the cursor or the name of the selected object, open the Microsoft Windows context menu by right-clicking the mouse button, and select Scan for viruses.

Scanning an object, selected using the standard Microsoft Windows tools, for viruses
A scan of the selected object will then begin, and the details will be shown in a special window. When you press the Close button, the window with information on the scan progress will close, although the scan will continue.
Also see:

How to Scan Your Computer for Viruses

How to Scan Critical Areas


How to train Anti-Spam

One of the steps in getting started is training Anti-Spam using your e-mails. Spam is junk e-mail, although it is very difficult to say what constitutes spam for any given user. Of course, there are mail categories which can be applied to spam with a high degree of accuracy (for example, mass mailings, advertisements), but such e-mails could belong in the inbox of some users.
Therefore, we ask that you determine yourself what mail is spam and what isn't. Kaspersky Internet Security will ask you after installation if you want to train Anti-Spam to differentiate between spam and good mail. You can do this with special buttons that plug into your mail client (Microsoft Office Outlook, Microsoft Outlook Express (Windows Mail), The Bat!) or using the special training wizard.
To train Anti-Spam with the special buttons,
  1. open your computer's default mail client (ex. Microsoft Office Outlook). You will see two buttons on the toolbar: Spam and Not spam.
  2. Select a good e-mail or group of e-mails that contains good e-mail and click Not spam. From this point onward, e-mails from the senders in the e-mails you selected will always be processed as not spam.
  3. Select an e-mail that you consider spam, a group of e-mails, or a folder with such e-mails and click Spam. Anti-Spam will analyze the contents of these e-mails, and in the future it will consider all e-mails with similar contents to be spam.
To train Anti-Spam using the Training Wizard,

select the [image] Anti-Spam component under Protection in the left pane of the application main window and click on Start Training Wizard. More detail on the Anti-Spam Training Wizard is provided in the relevant help section.

When an e-mail arrives in your inbox, Anti-Spam scans it for spam content and adds a special [Spam] tag to the subject line of spam. You can configure a special rule in your mail client for these e-mails, such as a rule that deletes them or moves them to a special folder.
Also see:

Protection from spam


How to Update the Program

Kaspersky Lab updates Kaspersky Internet Security databases and modules using dedicated update servers.
The Kaspersky Lab's update servers are the Kaspersky Lab internet sites where the program updates are stored.
Warning!
You will need a connection to the Internet to update Kaspersky Internet Security.
By default, Kaspersky Internet Security automatically checks for updates on the Kaspersky Lab servers. If the server contains a fresh set of updates, Kaspersky Internet Security will download and install them in the silent mode.
To update Kaspersky Internet Security on your own,
  1. Select the [image] Update section in the application main window.
  2. Click on Update databases.
As a result, Kaspersky Internet Security will begin to be updated. All the details of the process with be displayed in a special window.
Also see:

Updating the application


What to do if protection is not running

If problems or errors arise in the performance of any protection component, be sure to check its status. If a component status is not running or running (subsystem malfunction), try restarting the component or Kaspersky Internet Security.
If the problem is not solved by restarting the program, you are advised to correct possible errors with the help of program restoration utility (Start → Programs → Kaspersky Internet Security 7.0 → Modify, Repair or Remove).
If the problem is not solved by repairing the program, you are advised to contact Kaspersky Lab Technical Support Service. Please save a report about the component’s performance and send it to Kaspersky Lab beforehand, to help our Technical Support specialists understand the problem in depth.
To save a report regarding a single component to a file ,

  1. Select component under Protection in the application main window and click on Open report (component currently running) or Open last start report (component disabled).
  2. In the report window, click Actions → Save as and in the window that opens, specify the name of the file in which the report will be saved.


Multi-tasked protection management

This section of the Kaspersky Internet Security help system provides information on configuring common application settings used by all real-time protection components and tasks as well as information on creating protection areas and lists of threats to be handled by the application and a list of trusted objects to be overlooked by protection.


Common Protection Settings

The [image] Protection section of the application settings window presents Kaspersky Internet Security common settings.

  • management of real-time protection;
  • utilization of Advanced Disinfection Technology;
  • running tasks on a portable computer;
  • cooperation of Kaspersky Internet Security with other applications;
  • compatibility of Kaspersky Internet Security with other applications' self-defense features.


Enabling and disabling protection on your computer

By default, Kaspersky Internet Security boots at startup and protects your computer the entire time you are using it. The words Kaspersky Internet Security 7.0 in the upper right-hand corner of the screen let you know this. All protection components are running.
You can fully or partially disable the protection provided by Kaspersky Internet Security.
Warning!
The Kaspersky Lab specialists strongly recommend that you do not disable protection, since this could lead to an infection on your computer and data loss.
Note that in this case protection is discussed in the context of the protection components. Disabling or pausing protection components does not effect the performance of virus search tasks and program updates.
Also see:

Pausing protection

Fully disabling protection

Restoring protection on Your Computer

Shutting down the program


Pausing protection

Pausing protection means temporarily disabling all the protection components that monitor the files on your computer, incoming and outgoing mail, executable scripts, application behavior, Firewall, Anti-Spam and Parental Control.
To pause Kaspersky Internet Security operation,
  1. Select [image] Pause protection in the program's context menu.
  2. In the Pause protection window that opens, select the period of time have which you want protection to be enabled:
    • In <time interval> - protection will be enabled this amount of time later. Use the dropdown menu to select the time interval.
    • At next program restart - protection will be enabled if you open the program from the Start menu or after restarting your computer (provided the program is set to start automatically on startup).
    • By user request only - protection will be disabled until you start it yourself. To enable protection, select Enable protection from the program's context menu.
As a result of temporarily disabling protection, all protection components will be paused. This is indicated by:
  • Inactive (gray) names of the disabled components in the [image] Protection section of the main window.
  • Inactive (gray) application icon in the taskbar notification area.
Also see:

Fully disabling protection

Restoring protection on Your Computer

Shutting down the program


Fully disabling computer protection

Fully disabling protection means stopping your protection components. Virus scan tasks and updates continue to work in this mode.
If protection is fully disabled, it can be only be enabled by user demand. Protection components are not automatically enabled after restarting the system or the program in such a case. Remember that if Kaspersky Internet Security is somehow in conflict with other programs installed on your computer, you can pause individual components or create an exclusion list.
In order to fully disable computer protection,
  1. Open the application settings window and select [image] Protection .
  2. Uncheck [image] Enable protection.
As a result of disabling protection, all protection components will be stopped. This is indicated by:
  • Inactive (gray) names of the disabled components in the [image] Protection section of the main window.
  • Inactive (gray) application icon in the taskbar notification area.
Also see:

Pausing protection

Restoring protection on Your Computer

Shutting down the program


Restoring protection on Your Computer

If at some point you paused or fully disabled protection on your computer, you can enable it using one of the following methods:
  • From the context menu.
    • To do so, select Enable protection.
  • From the program's main window.
    • Select the [image] Protection section in the left-hand side of the main window and click on Start.
The protection status immediately changes to running. The application icon in the taskbar notification area becomes active (color).
Also see:

Pausing protection

Fully disabling protection


Advanced Disinfection Technology

Today's malicious programs can invade the lowest levels of an operating system, which makes them practically impossible to delete. Kaspersky Internet Security 7.0 asks you if you want to run Advanced Disinfection Technology when it detects a threat currently active in the system. This will neutralize the threat and delete it from the computer.

After this procedure, you will need to restart your computer. After restarting your computer, we recommend running a full virus scan. To apply the extended disinfection procedure, open the application settings window, select [image] Protection, and check [image] Enable Advanced Disinfection Technology under Additional.


Power settings

Configuring program productivity settings

To save power on a portable computer, virus scan tasks may be postponed .

Since scanning a computer for viruses and updating the program frequently requires significant resources and time, we recommend that such tasks be scheduled. This will allow you to save battery life . If needed, you will be able to update the application or start a virus scan manually. To use the battery saving functionality open the application settings window, select [image] Protection, and check [image] Disable Scheduled Scans while Running on Battery Power under Additional.


Runtime Computer Performance

Virus scan tasks may be postponed to limit CPU and storage subsystem load.

Scanning for viruses increases CPU and storage subsystem loads thereby slowing other programs down. If this should happen, the application will suspend virus scanning by default and make resources available to user applications.

However, there are a number of programs which start execution as CPU resources become available and run in the background. To have scans run independently from such programs, open the application settings window, select [image] Protection, and uncheck [image] Concede Resources to Other Applications under Additional.

It should be noted that this setting may be configured for each individual virus scan task. The individual task setting will have higher priority.


Resolving conflicts with other applications

In some cases, Kaspersky Internet Security may cause conflicts with other applications installed on a computer. This is because those programs have built-in self-defense mechanisms that turn on when Kaspersky Internet Security attempts to inspect them. These applications include the Authentica plug-in for Acrobat Reader, which verifies access to .pdf files, Oxygen Phone Manager II, and some computer games that have digital rights management tools.
To resolve this issue, open the application settings window, select [image] Protection, and check [image] Compatibility with Application Self-Defense under Compatibility . You must restart your operating system for this change to take effect.

Caution!

If the application is installed on a computer running microsoft Windows Vista and Microsoft Windows Vista x64, resolution of compatibility issued for other applications' built-in tamper-proof mechanisms is not supported.
Please note, however, that when this box is checked Privacy Control modules (Anti-Dialer and Protection of confidential data) as well as Anti-Spam plugin for Microsoft Outlook Express will not run. When these modules are activated, the compatibility mode is disabled automatically; however, the modules will not run until after the application is restarted.


Protection Scope

The [image] Threats and Exclusions section of the application main window is used to create Kaspersky Internet Security protection scope:

  • list of threats, protection against which is provided by the application;
  • list of trusted objects, which will be overlooked by protection.


Types of malicious programs monitored

Kaspersky Internet Security protects you from various types of malicious programs. Regardless of your settings, the program will always protect your computer from the most dangerous types of malware, such as viruses, Trojans, and hack tools. These programs can do significant damage to your computer. To make your computer more secure, you can expand the list of threats that the program will detect by making it monitor additional types of dangerous programs.

To select the types of malicious programs Kaspersky Internet Security will protect from, open the application settings window and select [image] Threats and Exclusions .

The Malware categories box contains threat types:
Viruses, worms, Trojans, hack tools. This group combines the most common and dangerous categories of malicious programs. This is the minimum admissible security level. Per recommendations of the experts at Kaspersky Lab, Kaspersky Internet Security always monitors this category of malicious program.
Spyware, adware, dialers. This group includes potentially dangerous software that could inconvenience a user or do significant damage.
Potentially dangerous software (riskware). This group includes programs that are not malicious or dangerous, however under certain circumstances they could be used to cause harm to your computer.
The groups listed above govern the completeness of utilizing the application databases when scanning objects in real time and when searching for viruses on your computer.
If all groups are selected, Kaspersky Internet Security provides the fullest possible anti-virus protection for your computer. If the second and third groups are disabled, the program will only protect you from the most common malicious programs. This does not include potentially dangerous programs and others that could be installed on your computer and could damage your files, steal your money, or take up your time.
Kaspersky Lab does not recommend disabling monitoring for the second and third groups. If a situation arises when Kaspersky Internet Security classifies a program as riskware but you do not feel that it is dangerous, you can configure an exclusion for it.


Creating a trusted zone

A trusted zone is a list of objects that the user creates that Kaspersky Internet Security does not monitor. Other words, it is a set of programs excluded from protection.
The user creates a trusted zone based on the properties of the files he uses and the programs installed on his computer. You might need to create such an exclusion list if, for example, Kaspersky Internet Security blocks access to an object or program and you are sure that the file or program is absolutely safe.
You can exclude files of certain formats from the scan, use a file mask, or exclude a certain area (for example, a folder or a program), program processes, or objects according to Virus Encyclopedia threat type classification (the status that the program assigns to objects during a scan).
Attention!
An exclusion object is not scanned when the disk or folder where it is located is scanned. However, if you select that object specifically, the exclusion rule will not be applied.
In order to create an exclusion list,
  1. Open the application settings window and select [image] Threats and Exclusions.
  2. Click on Trusted Zone under Exclusions .
  3. Configure exclusion rules for objects and create a list of trusted applications in the window that opens.
Also see:

Exclusion rules

Trusted applications


Exclusion rules

Exclusion rules are sets of conditions that Kaspersky Internet Security uses to know not to scan an object.
You can exclude files of certain formats from the scan, use a file mask, or exclude a certain area (for example, a folder or a program), program processes, or objects according the Virus Encyclopedia threat type classification.
The Threat type is the status that Kaspersky Internet Security assigns to an object during the scan. A verdict is based on the classification of malicious and potentially dangerous programs found in the Kaspersky Lab Virus Encyclopedia.
Potentially dangerous software does not have a malicious function but can be used as an auxiliary component for a malicious code, since it contains holes and errors. This categories includes, for example, remote administration programs, IRC clients, ftp services, all-purpose utilities for stopping processes or hiding them, keyloggers, password macros, autodialers, etc. Such software is not classified as viruses, but it can be divided into several types, e.g. Adware, Jokes, Riskware, etc. (for more information on potentially dangerous programs detected by Kaspersky Internet Security, see the Virus Encyclopedia at www.viruslist.com). Resulting from the scan, such programs may be blocked. Since several of them are widely used by users, you have the option of excluding them from the scan. To accomplish this, add the threat name or mask as defined in the Virus Encyclopedia to the trusted zone.
For example, you use a Remote Administrator program frequently in your work. This is a remote access system with which you can work from a remote computer. Kaspersky Internet Security views this sort of application activity as potentially dangerous and may block it. To keep the application from being block, you must create an exclusion rule that specifies "not-a-virus:RemoteAdmin.Win32.RAdmin.22" as the threat type.
When you add an exclusion, a rule is created that several program components (File Anti-Virus, Mail Anti-Virus, Proactive Defense, Privacy Control module for the Protection of Confidential Data, Web Anti-Virus ) and virus scan tasks can later use. You can create exclusion rules in a special window that you can open from the program settings window, from the notice about detecting the object, and from the report window.
To add exclusions on the Exclusion Rule tab:
  1. Click on the Add button in the [image] Exclusion Rule window.
  2. In the window that opens, click the exclusion type in the Properties section:
      3. Object - exclusion of a certain object, directory, or files that match a certain mask from scans.

      Threat Type means excluding an object from the scan based on its status from the Virus Encyclopedia classification.

      If you check both boxes at once, a rule will be created for that object with a certain threat type according to Virus Encyclopedia classification. In such a case, the following rules apply:

      • If you specify a certain file as the Object and a certain status in the Threat Type section, the file specified will only be an exclusion if during the scan it is classified as the threat selected.
      • If you select an area or folder as the Object and the status (or verdict mask) as the Threat Type, then objects with that status will only be excluded from the scan in that area or folder.
  3. Assign values to the selected exclusion types. To do so, left-click in the Rule description section on the specify link located next to the exclusion type:
    • For the Object type, enter its name in the window that opens (this can be a file, a particular directory, or a file mask). Check [image] Include subfolders for the object (file, file mask, folder) to be recursively excluded from the scan. For example, if you assigned C:\Program Files\winword.exe as an exclusion and checked the subfolder option, the file winword.exe will be excluded from the scan if found in any C:\Program Files subfolders.
    • Enter the full name of the threat that you want to exclude from scans as given in the Virus Encyclopedia or use a mask for the Threat Type.
      • For some objects excluded by threat type, you can assign advanced conditions for applying exclusions in the Advanced settings field.
  4. Define which Kaspersky Internet Security components must use this rule. If all is selected, this rule will apply for all components. If you want to restrict the rule to one or several components, click on all, which will change to selected. In the window that opens, check the boxes for the components that you want this exclusion rule to apply to.
To create an exclusion rule from the program notification that it has detected a dangerous object:
  1. Use the Add to trusted zone link in the notification window.
  2. In the window that opens, be sure that all the exclusion rule settings suit you. The object name and threat type assigned to it are filled in automatically based on the information from the notification. To create the rule, click OK.
To create an exclusion rule from the report window:
  1. Select the object in the report that you want to add to the exclusions.
  2. Open the context menu and select Add to trusted zone.
  3. The exclusion settings window will then open. Be sure that all the exclusion rule settings suit you. The object name and threat type assigned to it are filled in automatically based on the information in the report. To create the rule, click OK.
Also see:

Trusted applications


Exclusion components/tasks

Selecting an exclusion component/task

In the Selecting an exclusion component/task window, you can define which Kaspersky Internet Security components or tasks will use the exclusion rule.

By default, an exclusion rule is utilized by all virus scan tasks, by File and Mail Anti-Virus components, by Proactive Defense, by Protection of Confidential Data module of Privacy Control and by Web Anti-Virus. If the rule does not need to apply to any of these components, uncheck the box next to that task or component.


Selecting exclusions

You can enter exclusion objects in the Object name window. This could be a file, a file mask, or a directory. You can select an object from the directory tree or enter it in the Object field.


Allowed file exclusion masks

Let's look at some examples of permitted masks that you can use when create file exclusion lists:
  1. Masks without file paths:
    • *.exe - all files with the extension .exe
    • *.ex? - all files with the extension .ex?, where ? can represent any one character
    • test - all files with the name test
  2. Masks with absolute file paths:
    • C:\dir\*.* or C:\dir\* or C:\dir\ - all files in the folder C:\dir\
    • C:\dir\*.exe - all files with the extension .exe in the folder C:\dir\
    • C:\dir\*.ex? - all files with the extension .ex? in the folder C:\dir\, where ? can represent any one character
    • C:\dir\test - only the file C:\dir\test
    If you do not want the program to scan files in the subfolders of this folder, check Include subfolders when creating the mask.
  3. Masks with relative file paths:
    • dir\*.* or dir\* or dir\ - all files in all dir\ folders
    • dir\test - all test files in dir\ folders
    • dir\*.exe - all files with the extension .exe in all dir\ folders
    • dir\*.ex? - all files with the extension .ex? in all dir\ folders, where ? can represent any one character
    If you do not want the program to scan files in the subfolders of this folder, check Include subfolders when creating the mask.
Tip:
*.* and * exclusion masks can only be used if you assign a threat type excluded according to the Virus Encyclopedia. Then the threat specified will not be detected in any objects. Using these masks without selecting a threat type essentially disables monitoring.
We also do not recommend that you select a virtual drive as an exclusion that was created on the basis of a file system directory using the subst command. There is no point in doing so, since during the scan, the program perceives such a virtual drive as a folder and consequently scans it.
Also see:

Permitted threat exclusion masks


Permitted threat exclusion masks

Permitted verdict exclusion masks

When adding threats with a certain verdict from Virus Encyclopedia classification as exclusions, you can specify:
  • the full name of the threat as given in the Virus Encyclopedia at www.viruslist.com (for example, not-a-virus:RiskWare.RemoteAdmin.RA.311 or Flooder.Win32.Fuxx);
  • threat name by mask. For example:
    • not-a-virus* - exclude legal but potential dangerous programs from the scan, as well as joke programs.
    • *Riskware.* - exclude riskware from the scan.
    • *RemoteAdmin.* - exclude all remote administration programs from the scan.
For some threat types, you can assign advanced conditions for applying rules in the Advanced settings field. In most cases, this field is filled in automatically when you add an exclusion rule from a Proactive Defense notice.
You can add advanced settings for the following verdicts, among others:
  • Invader. For this verdict, you can give a name, mask, or complete path to the object being embed (for example, a .dll file) as an additional exclusion condition.
  • Launching Internet Browser. For this verdict, you can list browser open settings as additional exclusion settings.
    For example, you blocked browsers from opening with certain settings in the Proactive Defense application activity analysis. However, you want to allow the browser to open for the domain www.kaspersky.com with a link from Microsoft Office Outlook as an exclusion rule. To do so, select Outlook as the exclusion Object and Launching Internet Browser as the Threat object , and enter an allowed domain mask in the Advanced settings field.
Also see:

Allowed file exclusion masks


Trusted applications

Kaspersky Internet Security can create a list of trusted applications, that need not have their file and network activity monitored, suspicious or otherwise.
For example, you feel that objects used by Microsoft Windows Notepad are safe and do not need to be scanned. In other words, you trust this program. To exclude objects used by this process from scanning, add Notepad to the trusted applications list. However, the executable file and the trusted application process will be scanned for viruses as before. To fully exclude the application from scanning, you must use exclusion rules.
In addition, some actions classified as dangerous are perfectly normal for the features of a number of programs. For example, programs that automatically toggle keyboard layouts, such as Punto Switcher, regularly intercept text entered on your keyboard. To account for the specifics of such programs and stop monitoring their activity, we recommend adding them to the trusted application list.
Using trusted application exclusion can also solve potential compatibility conflicts between Kaspersky Internet Security and other applications (for example, network traffic from another computer that has already been scanned by the anti-virus application) and can boost computer productivity, which is especially important when using server applications.
By default, Kaspersky Internet Security scans objects opened, run, or saved by any program process and monitors the activity of all programs and the network traffic they create.
You can create a trusted applications list on the special [image] Trusted applications tab. This contains by default a list of applications that will not be monitored based on Kaspersky Lab recommendations when you install Kaspersky Internet Security. If you do not trust an application on the list, deselect the corresponding checkbox. You can edit the list using the Add, Edit, and Delete buttons on the right.
To add a program to the trusted application list:
    1. Click the Add button located in the right-hand part of the Trusted applications tab.
    2. In the Trusted Application window that opens, select the application using the Browse button. A context menu will open, and by clicking Browse you can go to the standard file selection window and select the path to the executable file, or by clicking Applications you can go to a list of applications currently running and select them as necessary.

      When you select a program, Kaspersky Internet Security remembers the internal attributes of the executable file and uses them to identify the program as trusted during scans.

      The file path is inserted automatically when you select its name.
    3. Then specify the actions performed by this process that Kaspersky Internet Security will not monitor:
        4. Do not scan opened files - exclude all files that the trusted application process opens from the scan.
        Do not restrict application activity - exclude any activity, suspicious or otherwise, that the trusted application is performing, from Proactive Defense monitoring.
        Do not restrict registry access – exclude attempts to access the system registry from scanning when initiated by trusted applications.
        Do not scan network traffic - exclude network traffic that the trusted application initiates from scans for viruses. You can exclude all the application’s network traffic or encrypted traffic (SSL) from the scan. To do so, click the all link. It will change to encrypted. In addition you can restrict the exclusion to specific remote host or port. To create a restriction, click all, which will change to selected, and enter a value for the remote port/host.
        Note that if Do not scan network traffic is checked, traffic for that application will only be scanned for viruses and spam. However, this does not affect whether Firewall scans traffic. Firewall settings govern analysis of network activity for that application.
Also see:

Exclusion rules


Selecting a remote port

You must enter a remote port number in the Remote port window that limits exclusion of network traffic for the trusted application.

You can enter the port number manually or use the scrolling arrow.


Selecting a remote IP address

You must enter a remote port address in the Remote IP address window that limits exclusion of network traffic for the trusted application.


Anti-virus protection of the computer file system

A special component is included in Kaspersky Internet Security 7.0 to protect your computer's file system from infection, File Anti-Virus. It loads when you start your operating system and runs in your computer's RAM. It scans all files that are opened, saved, or executed.
The indicator of the component's operation is the Kaspersky Internet Security icon in the taskbar notification area, which looks like [image] whenever a file is being scanned.
File Anti-Virus by default only scans NEW OR CHANGED FILES; in other words, files that have been added or changed since the previous scan. Files are scanned according to the following algorithm:
  1. User or program access to each file is intercepted by the component.
  2. File Anti-Virus scans the iChecker ТМ and iSwift ТМ databases for information on the file intercepted. A decision is made whether to scan the file based on the information retrieved.
The scanning process includes the following steps:
  1. The file is analyzed for viruses. Malicious objects are detected by comparison with application databases used by the program. The databases contain descriptions of all the malicious programs, threats, and network attacks known to date and methods for neutralizing them.
  2. After the analysis, the program may take the following courses of action:
    1. If malicious code is revealed in a file, File Anti-Virus blocks it and attempts its disinfection. After successful disinfection the file becomes accessible for further operations with it. If disinfection fails, the application deletes it. When a file is disinfected or deleted, Anti-Virus places a copy of that file in Backup.
    2. If the Anti-Virus detects in a file unknown code that resembles malware but there is no absolute certainty about that, such file will be placed in special storage – Quarantine. Later you can try disinfecting it with updated databases.
    3. If no malicious code is discovered in the file, it is immediately restored.
Also see:

File Anti-Virus status

Pausing / disabling File Anti-Virus

Selecting a file security level

File Anti-Virus settings

File Anti-Virus statistics

Delayed object treatment


File Anti-Virus status

To view current component status, select [image] File Anti-Virus under Protection in the left pane of the application main window. In the right-hand part, you will see comprehensive information on file protection.

Component run status is the most important indicator :

  • File Anti-Virus : running - file protection is active for the level selected.
  • File Anti-Virus : paused File Anti-Virus is disabled for a certain length of time. The component will resume operation automatically after the assigned period has expired or after restarting the program. You can also resume file protection manually. To do so, use the Resume operation link.
  • File Anti-Virus : disabled - component stopped by user. You can resume file protection manually. To do so, click Enable.
  • File Anti-Virus: not running - File Anti-Virus is not available for some reason.
  • File Anti-Virus: error - the component has encountered an error. If this occurs, contact Kaspersky Lab Technical Support.
    • If a component encounters an error, try restarting it . If restart should result in an error, review component report which might contain the reason for the failure . If you are unable to troubleshoot the issue on your own, save the component report to a file using Action → Save As and contact Kaspersky Lab Technical Support.

Component status is followed by file protection security level and the action to be taken by File Anti-Virus with respect to an infected or a potentially infected object. To edit current File Anti-Virus settings click on Configure.

Certain file protection statistics are displayed in the main window : number of objects scanned since component was started, number of malicious objects detected and information on the last object scanned . Use the Open Report link to view a detailed report on the component's current performance .

If for some reason the component is paused or stopped at a given moment in time, its results at the time of deactivation may be viewed by clicking Open Last Start Report.


Pausing / disabling File Anti-Virus

There are several ways to deactivate File Anti-Virus and your computer's file protection . However, we recommend that you first define the reason why you wish to deactivate the component. It is possible that you could solve the problem using a different method, by changing the protection level or only disabling protection for certain files.
Thus, for example, if you are working with a particular database that in your opinion could not contain viruses, simply select the directory with its files and add to exclusions.
There are several ways of disabling File Anti-Virus. Let's look at them in more detail.
To pause File Anti-Virus,

select [image] File Anti-Virus in the Protection section of the main window and use the Pause link.

The component status will change to paused. File system protection from dangerous objects will be paused until you restart the program or enable the component using the Resume operation link.

When you pause File Anti-Virus, the component statistics for the current Kaspersky Internet Security session are saved and will continue to be recorded after the component is updated.

To stop File Anti-Virus,

select File Anti-Virus in the Protection section of the main window and using the Stop link. Then the component status will change to stopped. Protection will be disabled until you resume using the Enable button.

File protection may also be shut down from the application settings window. Select [image] File Anti-Virus under Protection and uncheck [image] Enable File Anti-Virus.

When you stop File Anti-Virus, all the statistics from previous work are cleared and when the component is started they are recorded over.

Warning!
Remember that if you disabled File Anti-Virus in the settings window, it will NOT automatically be enabled after restarting the program. To restore file system protection, you must check [image] Enable File Anti-Virus .
By disabling File Anti-Virus in the main window, the component status changes to disabled, and the component list in the Protection section its name will go inactive (gray).
File Anti-Virus can also be disabled by fully disabling protection on your computer.


Selecting a file security level

File Anti-Virus protects files that you work with on one of the following levels:

    Maximum protection - the level with the most comprehensive monitoring of files being opened, saving, or run.

    Recommended. Kaspersky Lab experts recommend this settings level. It will scan the following object categories:

    • programs and files by contents;
    • new objects and objects modified since the last scan;
    • embedded OLE objects.
    High speed - level with settings that let you comfortably use applications that require significant system resources, since the set of files scanned is cut back.

By default, the File Anti-Virus is set to Recommended.

You can raise or lower the protection level by selected the level you want or changing the settings for the current level.
In order to change the security level,

Adjust the sliders. By adjusting the security level, you define the ratio of scan speed and the total number of files scanned: the fewer files are subject to analysis for viruses, the higher the scan speed.

If none of the file security levels listed meet your needs, you can customize the protection settings. It is recommended to select a level closest to your requirements as a starting point and edit its settings. This will change the name of the security level to Custom. Let us look at an example when preconfigured security level settings may need to be modified.
Example:

The work you do on your computer leads you to use a large number of different types of files, some of which may be fairly large. You would not want to run the risk skipping any files in the scan because of the size or extension, even if this would somewhat affect the productivity of your computer.

Tip for selecting a level:

Based on the source data, one can come to the conclusion that there is a fairly high risk of being infected by a malicious program. The size and type of the files being handled is quite varied and skipping them in the scan would put the information on the computer at risk. The basic requirement for the scan is analyzing the files handled for the contents, not by extension.

It is recommended that you use Recommended as your basic pre-installed security level, with the following changes: remove the restriction on the size of files scanned and optimize File Anti-Virus operation by only scanning new and changed files. In such a case, the load on the computer when scanning files will be reduced, so you can comfortably use other applications.

To modify the settings for the current security level,
  1. Open the application settings window and select [image] File Anti-Virus under Protection .
  2. Click the Customize button in the Security Level area.
  3. Edit file protection settingss in the resulting window and click OK.
Also see:

Configuring File Anti-Virus

Restoring default protection settings

Selecting actions for objects


Configuring File Anti-Virus settings

A configuration set determines how File Anti-Virus will carried out on your computer. The settings can be broken down into the following groups:
  • the settings that define what object types are to be scanned for viruses;
  • the settings that form the protected area;
  • the settings that define the list of files not to be scanned by File Anti-Virus;
  • the settings that determine whether heuristic analysis will be used by File Anti-Virus;
  • additional File Anti-Virus settings.
This Help section will examine the groups listed above in detail.
Also see:

Restoring default settings


Defining the types of objects to be scanned

When specifying the types of files to be scanned, you establish what file formats, sizes, and what drives will be scanned for viruses when opened, executed, or saved.

To make configuration easier, all files are divided into two groups: simple and compound. Simple files do not contain any objects. Compound objects can include several objects, each of which may also have several nesting levels. There are many examples: archives, files containing macros, tables, e-mails with attachments, etc.

The types of file to be scanned are defined in the [image] File types section. Select one of the three options:

    Scan all files. With this option selected, all file system objects that are opened, started, or saved will be subject to analysis without exceptions.

    Scan programs and documents (by content). If you select this group of files, File Anti-Virus will scan only potentially infected files - files that a virus could imbed itself in.

    Note:
    There are a number of file formats that have a fairly low risk of having malicious code injected into them and subsequently being activated. An example would be .txt files.

    And vice versa, there are file formats that contain or can contain executable code. Examples would be the formats .exe, .dll, or .doc. The risk of injection and activation of malicious code in such files is fairly high.

    Before searching for viruses in a file, its internal header is analyzed for the file format (txt, doc, exe, etc.). If the results of the analysis show that the file format is type that cannot be infected, it is not scanned for viruses and is immediately restored for use. If the file format makes it possible for the file to be infected, the file is scanned for viruses.

    Scan programs and documents (by extension). In this case, File Anti-Virus will only scan potentially infected files, but the file format will be determined by extension. Using the extension link, you can review a list of file extensions that are scanned in this case.
Tip:
Do not forget that someone could send a virus to your computer with the extension .txt, although in reality it could be an executable file renamed as a .txt file. If you select the Programs and documents (by extension) option, such a file would be skipped by the scan. If the Programs and documents (by contents) is selected, ignoring extensions, File Anti-Virus will analyze file headers, which will uncover that the file is an .exe file. Such a file would be thoroughly scanned for viruses.

In the [image] Productivity section, you can specify that only new files and those that have been modified since the previous scan should be scanned for viruses. This mode of operation noticeably cuts down on scan time and increases the program's performance speed. To do so, you must check [image] Scan new and changed files only. This mode extends to simple and compound files.

In the [image] Compound files section, specify which compound files must be analyzed for viruses:

    Scan All/New only archives - scan ZIP, CAB, RAR and ARJ archives.
    Scan All/New only installation packages - analyze self-extracting archives for viruses.
    Scan All/New only embedded OLE objects - scan objects imbedded in files (for example, Excel spreadsheets or a macro imbedded in an Microsoft Office Word file, e-mail attachments, etc.).

For each type of compound file, you can select and scan all files or only new ones. To do so, use the link next to the name of the object. It changes its value when you left-click it. If the Productivity section has been set up only to scan new and changed files, you will not be able to select the type of compound files to be scanned.

To specify what compound files should not be scanned for viruses, use the following settings:

    Extract archives in background if larger than ... MB. If the size of a compound object exceeds this restriction, the program will scan it as a single object (by analyze the header) and will return it to the user. The objects that it contains will be scanned later. If the box is not checked, access to files larger than the size indicated will be blocked until they have been scanned.
    Do not process archives larger than.. MB. In this case, files larger than the size specified will be skipped by the scan.
Also see:

Creating a protection area

Restoring default protection settings

Selecting actions for objects


List of files scanned by extension

If [image] Scan Programs and documents (By Extension) is selected as the File Antivirus or virus scan task option, files with the extensions listed below will be analyzed closely for viruses:
    com - executable file for a program no larger than 64 KB
    exe - executable file or self-extracting archive
    sys - system file
    prg - program text for dBase, Clipper or Microsoft Visual FoxPro, or a WAVmaker program
    bin - binary file
    bat - batch file
    cmd - command file for Microsoft Windows NT (similar to a .bat file for DOS), OS/2.
    dpl - compressed Borland Delphi library
    dll - dynamic loading library
    scr - Microsoft Windows splash screen
    cpl - Microsoft Windows control panel module
    ocx - Microsoft OLE (Object Linking and Embedding) object
    tsp - program that runs in split-time mode
    drv - device driver
    vxd - Microsoft Windows virtual device driver
    pif - program information file
    lnk - Microsoft Windows link file
    reg - Microsoft Windows system register key file
    ini - initialization file
    cla - Java class
    vbs - Visual Basic script
    vbe - BIOS video extension
    js, jse - JavaScript source text
    htm - hypertext document
    htt - Microsoft Windows hypertext header
    hta - hypertext program for Microsoft Internet Explorer
    asp - Active Server Pages script
    chm - compiled HTML file
    pht- HTML with built-in PHP scripts
    php - script built into HTML files
    wsh - Microsoft Windows Script Host file
    wsf - Microsoft Windows script
    the - Microsoft Windows 95 desktop wallpaper
    hlp - Win Help file
    eml - Microsoft Outlook Express e-mail file
    nws - Microsoft Outlook Express new e-mail file
    msg - Microsoft Mail e-mail file
    plg - e-mail
    mbx- extension for saved Microsoft Office Outlook e-mails
    doc* - Microsoft Office Word document, such as : doc - Microsoft Office Word document, docx - Microsoft Office Word 2007 document with XML support, docm - Microsoft Office Word 2007 document with macro support.
    dot*- Microsoft Office Word document template, such as, dot - Microsoft Office Word document template, dotx - Microsoft Office Word 2007 document template, dotm - Microsoft Office Word 2007 document template with macro support.
    fpm - database program, start file for Microsoft Visual FoxPro
    rtf - Rich Text Format document
    shs - Shell Scrap Object Handler fragment
    dwg - AutoCAD blueprint database
    msi - Microsoft Windows Installer packet
    otm - VBA project for Microsoft Office Outlook
    pdf- Adobe Acrobat document
    swf - Shockwave Flash file
    jpg, jpeg, png - compressed image graphics format
    emf - Enhanced Metafile format Next generation of Microsoft Windows OS metafiles. EMF files are not supported by 16-bit Microsoft Windows.
    ico - icon file
    ov? - MS DOC executable files
    xl* - Microsoft Office Excel documents and files, such as: xla - Microsoft Office Excel add-on, xlc - diagram, xlt - document template, xlsx - Microsoft Office Excel 2007 work book, xltm - Microsoft Office Excel 2007 work book with macro support, xlsb - Microsoft Office Excel 2007 in binary (non-XML) format, xltx - Microsoft Office Excel 2007 template, xlsm - Microsoft Office Excel 2007 template with macro support, xlam - Microsoft Office Excel 2007 add-on with macro support.
    pp* - Microsoft Office PowerPoint documents and files, such as: pps - Microsoft Office PowerPoint slide, ppt - presentation, pptx - Microsoft Office PowerPoint 2007 presentation, pptm - Microsoft Office PowerPoint 2007 presentation with macro support, potx - Microsoft Office PowerPoint 2007 presentation template, potm - Microsoft Office PowerPoint 2007 presentation template with macro support, ppsx - Microsoft Office PowerPoint 2007 slide show, ppsm - Microsoft Office PowerPoint 2007 slide show with macro support, ppam - Microsoft Office PowerPoint 2007 add-on with macro support.
    md* - Microsoft Office Access documents and files, such as: mda - Microsoft Office Access work group, mdb - database, etc.
    sldx - a Microsoft PowerPoint 2007 slide.
    sldm - a Microsoft PowerPoint 2007 slide with Macro support.
    thmx - a Microsoft Office 2007 theme.

Remember that the actual format of a file may not correspond with the format indicated in the file extension.


Creating a protection area

File Anti-Virus by default scans all files when they are used, regardless of where they are stored, whether it be a hard drive, CD/DVD-ROM, or flash disk.
You can limit the scope of protection. To do so:
  1. Open the application settings window and select [image] File Anti-Virus under Protection .
  2. Click the Customize button in the Security Level area.
  3. Select [image] Protection Scope tab in the resulting dialog.
The tab displays a list of objects that File Anti-Virus will scan. Protection is enable by default for al objects on hard drives, removable media, and network drives connected to your computer. You can add to and edit list using the Add, Edit, and Delete buttons.
If you want to narrow the range of the protected objects, you can do so using the following methods:
  • Specify only folders, drives, and files that need to be protected.
  • Create a list of objects that need not be protected.
  • Combine methods one and two; in other words, create a protection scope from which a number of objects are excluded.
Warning!
Remember that File Anti-Virus will scan only the files that are included in the protection scope created. Files that are not included in that scope will be available for use without scanning. This increases the risk of infection on your computer.
Also see:

Selecting objects to scan

Creating an exclusion list

Restoring default protection settings


Selecting objects to scan

The Select Object to Scan window displays a list of all the objects on your computer that you can scan for viruses.
In order to add one of the listed objects to the virus scan list, select it and click OK.

You can use masks when you add objects for scanning. Note that you can only enter masks will absolute paths to objects:

  • C:\dir\*.* or C:\dir\* or C:\dir\ - all files in the folder C:\dir\
  • C:\dir\*.exe - all files with the extension .exe in the folder C:\dir\
  • C:\dir\*.ex? - all files with the extension .ex? in the folder C:\dir\, where ? represents any one character
  • C:\dir\test - only the file C:\dir\test
In order for the scan to be carried out recursively, check [image] Include subfolders.


Configuring additional settings

As additional File Anti-Virus settings, you can specify the file system scanning mode and configure the conditions for temporarily pausing the component.

To configure additional File Anti-Virus settings:

  1. Open the application settings window and select [image] File Anti-Virus under Protection .
  2. Click the Customize button in the Security Level area .
  3. Select the [image] Additional tab in the resulting dialog.

The file scanning mode determines the File Anti-Virus processing conditions. You have following options:

  • Smart mode. This mode is aimed at speeding up file processing and return them to the user. When it is selected, a decision to scan is made based on analyzing the operations performed with the file.
    • For example, when using a Microsoft Office file, Kaspersky Internet Security scans the file when it is first opened and last closed. All operations in between that overwrite the file are not scanned.
    Smart mode is the default.
  • On access and modification – File Anti-Virus scans files as they are opened or edited.
  • On access – only scans files when an attempt is made to open them.
  • On execution – only scans files when an attempt is made to run them.

You might need to pause File Anti-Virus when performing tasks that require significant operating system resources. To lower the load and ensure that the user regains access to files quickly, we recommend configuring the component to disable at a certain time or while certain programs are used.

To pause the component for a certain length of time, check [image] On schedule and in the window that opens click Schedule to assign a time frame for disabling the component.

To disable the component when working with programs that require significant resources, check [image] On applications startup and edit the list of programs in the window that opens by clicking Applications.


Configuring a schedule for pausing the component

In this window, you can configure a schedule for pausing and resuming File Anti-Virus. To do so, enter a value in the format HH:MM in the corresponding fields.


Creating an application list

In this window, you can create a list of applications that will pause File Anti-Virus when they are running.

To add an application to the list, use the Add button. A context menu will open, and by clicking Browse you can go to the standard file selection window and specify the executable file the application to add. Or, go to the list of applications currently running from the Applications item and select the one you want.

To delete an application, select it from a list and click Delete.

You can temporarily disable the pause on File Anti-Virus when using a specific application. To do so, uncheck the name of the application. You do not have to delete it from the list.


Using heuristic methods with File Anti-Virus

Using Heuristic Methods for File Anti-Virus

On the Heuristic analyzer, you can enable and disable use of heuristic methods for detecting new threats with File Anti-Virus. To do so, take the following steps:

  1. Open the application settings window and select [image] File Anti-Virus under Protection .
  2. Click the Customize button in the Security Level area.
  3. Select the [image] Heuristic Analyzer tab in the resulting dialog.

Of course, scanning using the signature method with a database created previously containing a description of known threats and methods for treating them will give you a definite answer regarding whether a scanned object is malicious and what dangerous program class it is classified as. The heuristic method, unlike the signature method, is aimed at detecting typical behavior of operations rather than malicious code signatures that allow the program to make a conclusion on a file with a certain likelihood. The advantage of heuristic analysis is that you do not have to update the database before scanning. Because of this, new threats are detected before virus analysts have encountered them.

Heuristic analyzer emulates object execution in the Kaspersky Internet Security secure virtual environment. If an object does not exhibit suspicious behaviour, its execution in operating environment is allowed. If suspicious activity is discovered as the object executes, the object will be deemed malicious and will not be allowed to run on the host or a message will be displayed requesting further instructions from the user:

  • Quarantine the new threat to be scanned and processed later using updated databases
  • Delete the object
  • Skip (if you are positive that the object cannot be malicious).

To use the heuristic method, select [image] Use heuristic analyzer. You can additionally select the level of detail of the scan. To do so, move the slider to one of these positions: Shallow, Medium, or Detailed. The level of detail of the scan provides the balance between caution and quality of the scan for new threats and the load on operating system resources, as well as the duration of the scan. The higher you set the heuristics level, the more system resources the scan will require, and the longer it will take.

Warning:

New threats detected using heuristic analysis are quickly analyzed by Kaspersky Lab, and methods for disinfecting them are added to the hourly database updates.

Therefore, if you update your program databases regularly and maintain the optimal protection level on your computer, you will not need to use the heuristic method regularly.


Restoring default protection settings

When configuring File Anti-Virus, you can always return to the recommended performance settings. The Kaspersky Lab experts consider them to be optimal and have collected them in the Recommended security level.
In order to restore the default File Anti-Virus settings,
  1. Open the application settings window and select [image] File Anti-Virus under Protection .
  2. Click the Default button in the Security Level area.
If you modified the list of objects included in the protected zone when configuring File Anti-Virus settings, the program will ask you if you want to save that list for future use when you restore the initial settings. To save the list of objects, check Protected scope in the Restore Settings window that opens.


Selecting actions for objects

If, while scanning a file for viruses, it is discovered that it is infected or suspected of being infected, the subsequent actions of File Anti-Virus depend on the objects status and the selected action.
File Anti-Virus can label an object with one of the following statuses:
  • status as a malicious program (for example, virus, Trojan).
  • Potentially infected, when the scan cannot determine whether the object is infected. This means that the program detected a sequence of code in the file from an unknown virus or modified code from a known virus.
By default, all infected files are subject to disinfection, and if they are potentially infected, they are sent to Quarantine.
To change an action for an object,

open the application settings window and select [image] File Anti-Virus under Protection . All possible actions are shown in the section of the same name .

If the action selected was
When a dangerous object is detected
Prompt for action
File Anti-Virus issues a warning message containing information about what malicious program has infected or potentially infected the file and gives you the choice of one of the following actions. Depending on the status of the object, actions can vary.
Block access
File Anti-Virus blocks access to the object. Information about this is recorded in the report. You can try to treat this object later.
Block access
    Disinfect
File Anti-Virus will block access to the object and will attempt to disinfect it. If it is successfully disinfected, it is restored for regular use. If the file could not be treated, it will be assigned the status of potentially infected and is moved to Quarantine. Information about this is recorded in the report. Later you can attempt to disinfect this object.
Block access
    Disinfect
    Delete if disinfection fails
File Anti-Virus will block access to the object and will attempt to disinfect it. If it is successfully disinfected, it is restored for regular use. If the object cannot be disinfected, it is deleted. A copy of the object will be stored in Backup.

Block access

    Disinfect
    Delete
File Anti-Virus will block access to the object and will delete it.
Before attempting to treat the object or delete it, Kaspersky Internet Security creates a backup copy and sends it to Backup in case the object needs to be restored or an opportunity arises to treat it.


File Anti-Virus statistics

All operations carried out by File Anti-Virus are recorded in a special report.
Certain current component statistics (number of objects scanned since File Anti-Virus was last started, number of malicious objects detected, the file being scanned at the moment) are shown in the application main window . Select [image] File Anti - Virus under Protection to view .
To view a detailed component report, click Open Report (component currently running) or Open Last Start Report (component disabled).
Primary component run data are grouped on tabs in the central part of the window :

  • All dangerous objects detected in the File system protection process are listed on the Detected tab. Here you will find the full path to the location of each object and the status assigned to it by File Anti-Virus: if what malicious program infected the object was successfully established, it will be assigned the appropriate status. For example, virus, Trojan, etc. If the type of malicious effect cannot be exactly established, the object is assigned the status suspicious. Next to the status, the action taken for the object is specified (detected, not found, disinfected).
    • In order for this tab not to contain information about disinfected objects, uncheck [image] Show neutralized objects.
  • A complete list of events that have arisen while using File Anti-Virus is kept on the Events tab. The events can have the following statuses:
    • Informative event (for example: object not processed: skipped by type).
    • Warning (for example: a virus is detected).
    • Note (for example: the archive is password protected).

As a rule, the informative messages are of a reference nature and are not of particular interest. You can disable display of informative messages. To do so, uncheck [image] Show all events.

  • Scan Statistics appear on the appropriate tab. Here you will find the total number of objects scanned, and then special columns separately display how many objects out of the total number scanned are archives, how many are dangerous, how many have been disinfected, how many sent to Quarantine, etc.
  • The Settings that File Anti-Virus is running with are displayed on the Settings tab. Use the Change settings link to quickly configure the component.
Information types may be selected in each of the report tabs, information may be sorted by columns in ascending or descending order and searched. This is accomplished by using context menus accessible by right-clicking report column headers .

Also see:

Delayed object treatment

What to do if File Anti-Virus is not running


Delayed object treatment

If you selected as the action for malicious programs [image] Block access, the objects will not be treated and access to them will be blocked.
If the actions selected were:
      Block access
        Disinfect
all untreated objects will also be blocked.
In order to regain access to blocked objects, you first have to disinfect them. To do so:
  1. Select [image] File Anti-Virus under Protection in the main window and click on Open Report.
  2. Select the objects that interest you on the Detected tab and click the Action → Neutralize all button.
If it is successfully disinfected, it will restored for regular use. If the object cannot be treated, you will be offered to options to delete or skip it. In the latter case, access to the file will be restored. However, this significantly increases the risk of infection on your computer. It is strongly recommended not to skip dangerous objects.
Also see:

Selecting actions for objects


Mail Anti-Virus

Kaspersky Internet Security includes a special component that protects incoming and outgoing mail from dangerous objects, Mail Anti-Virus. It loads when the operating system is started and is always running and scans all e-mail on protocols POP3, SMTP, IMAP, MAPI1 and NNTP, as well as secure connections (SSL) for POP3 and IMAP.
The indicator of the component's operation is the Kaspersky Internet Security icon in the taskbar notification area, which looks like [image] whenever an e-mail is being scanned.
By default, e-mail protection is carried out as follows:
  1. Each e-mail received or sent by the user is intercepted by Mail Anti-Virus.
  2. The e-mail is broken down into its parts: the e-mail heading, its body, and attachments.
  3. The body and attachments of the e-mail (including OLE attachments) are scanned for dangerous objects. Malicious objects are detected using the databases included in the program and with the heuristic algorithm. The databases contain descriptions of all the malicious programs known to date and methods for neutralizing them. The heuristic algorithm can detect new viruses that have not yet been entered in the databases.
  4. After the virus scan, the following behavior options are available:
    • if the body or attachments of the e-mail contain malicious code, Mail Anti-Virus will block the e-mail, place a copy of the infected object in back-up, and will try to disinfect the object. If the e-mail is successfully disinfected, it becomes available to the user again. If not, the infected object in the e-mail is deleted. After the anti-virus scan, special text is inserted in the subject line of the e-mail, stating that the e-mail has been processed by Kaspersky Internet Security.
    • If code is detected in the body or an attachment that appears to be malicious but there is no guarantee, the suspicious part of the e-mail is sent to Quarantine.
    • If no malicious code is discovered in the e-mail, it is immediately made available again to the user.
A special plug-in is provided for Microsoft Office Outlook that can configure mail scans more exactly.
If you use The Bat!, Kaspersky Internet Security can be used in conjunction with other anti-virus applications. The rules for processing e-mail traffic are configured directly in The Bat! and supersede the Kaspersky Internet Security mail protection settings.
When working with other mail programs (including Microsoft Outlook Express (Windows Mail), Mozilla Thunderbird, Eudora, Incredimail), Mail Anti-Virus scans mail on SMTP, POP3, IMAP, and NNTP protocols.
Note that e-mails transmitted on IMAP are not scanned in Thunderbird if you use filters that move them out of your Inbox.
Also see:

Mail protection status

Pausing / disabling e-mail protection

Selecting a security level

Configuring mail protection

Component operation statistics

1E-mails sent with MAPI are scanned using a special plug-in for Microsoft Office Outlook and The Bat!


Mail protection status

To view current component status, select [image] Mail Anti-Virus under Protection in the left pane of the application main window. Summary information on email protection will be presented on the right .
The most important is Mail Anti-Virus status:
  • Mail Anti-Virus : running - protection is enabled for your e-mail against viruses.
  • Mail Anti-Virus : paused - mail protection from spam is disabled for a certain period of time. The component refreshes its work automatically when the program is restarted or after the length of time has expired for which Kaspersky Internet Security was paused. You can also enable Mail Anti-Virus manually. To do so, use the Resume operation link on the right-hand side of the main window.
  • Mail Anti-Virus : disabled - the component has been stopped by the user. You can enable e-mail protection. To do so, use the Enable link on the right-hand side of the main window.
  • Mail Anti-Virus : malfunction - e-mail protection is not available for some reason.
  • Mail Anti-Virus : running (subsystem malfunction) - the component encountered an error.
    • If a component encounters an error, try restarting it . If restart should result in an error, review component report which might contain the reason for the failure . If you are unable to troubleshoot the issue on your own, save the component report to a file using Action → Save As and contact Kaspersky Lab Technical Support.
Component status information will be followed by email protection level and the action to be applied by Mail Anti-Virus to an infected or a potentially infected object. In addition, information is shown as to whether POP3, SMTP, IMAP, and NNTP traffic is being scanned as well as traffic for Microsoft Office Outlook and The Bat! mail clients. To edit current Mail Anti-Virus settings click on Configure.
Certain mail protection statistics are displayed in the main window : number of mail messages scanned since the component was started as well as the number of malicious objects detected . Use the Open Report link to view a detailed report on the component's current performance .
If for some reason a component is paused or stopped at a given moment in time, its results at the time of deactivation may be viewed by clicking Open Last Start Report.


Pausing / disabling e-mail protection

E-mail protection is enabled by default. You can pause Mail Anti-Virusfor a certain length of time or completely.
Here we will examine the methods for disabling the component in greater detail.
To pause Mail Anti-Virus,

select [image] Mail Anti-Virus in the Protection section of the main window and use Pause link.

The component status will change to paused. E-mail protection from dangerous objects will be paused until you restart the program or resume the component using the Resume operation link.

When you pause Mail Anti-Virus, the component statistics for the current Kaspersky Internet Security session are saved and will continue to be recorded after the component is updated.

To stop Mail Anti-Virus,

select Mail Anti-Virus under Protection in the main window and use the Stop link. Then the component status will change to stopped. Protection will be disabled until you resume using the Enable link.

Mail protection may also be shut down from the application settings window . Select [image] Mail Anti-Virus under Protection and uncheck [image] Enable Mail Anti-Virus .

When you stop Mail Anti-Virus, all the statistics from previous work are cleared and when the component is started they are recorded over.

Warning!
Remember that if you disabled Mail Anti-Virus in the settings window, it will not automatically be enabled after restarting the program. To resume e-mail protection, you must check [image] Enable Mail Anti-Virus.
By disabling Mail Anti-Virus in the main window, the component status changes to disabled, and the component list in the Protection section its name will go inactive (gray).
Mail Anti-Virus can also be disabled by fully disabling protection on your computer. Kaspersky Lab does not recommend fully disabling Mail Anti-Virus.

In the [image] Connectivity section you can enable/disable streaming mail sacnas on POP3, SMTP, IMAP, and NNTP protocols. You can configure the ports by clicking the hyperlink with the name of the protocols.

You can also enable/disable mail scanning for Microsoft Office Outlook and The Bat!


Selecting an e-mail security level

Kaspersky Internet Security protects your e-mail on one of the following levels:
    Maximum Protection - the level with the most comprehensive monitoring of incoming and outgoing e-mails. The program scans e-mail attachments in detail regardless of the time of the scan, including for archives.
    Recommended. Kaspersky Lab experts recommend this level. They determine the scan of the same objects as Maximum Protection , with the exception of attachments or e-mails that will take more than three minutes to scan.
    High Speed - security level with settings that let you comfortably use applications that require significant system resources, since the set of e-mail objects scanned is cut back. Thus, only your incoming e-mail is scanned on this level, and in doing so archives and objects (e-mails) attached are not scanned that take more than three minutes to scan. It is recommended to use this level if you have additional e-mail protection software installed on your computer.
By default, e-mail security is set to Recommended.
You can raise or lower the e-mail protection level by selected the level you want or changing the settings for the current level.
In order to change the security level,

Adjust the sliders. By altering the security level, you define the ratio of scan speed and the total number of objects scanned: the fewer e-mail objects are subject to analysis for dangerous objects, the higher the scan speed.

If any of the pre-installed levels does not fully meet your needs, you can alter its settings. It is recommended that you select a level closest to your requirements as basis and edit its parameters . This will change the name of the security level to Custom . Let us look at an example when preconfigured security level settings may need to be modified.
Example:

Your computer is outside of the local network and uses a dial-up Internet connection. You use Microsoft Outlook Express as a mail client for receiving and sending e-mail, and one of the free e-mail services as a mail service. For a number of reasons, your mail contains archived attachments. How do you maximally protect your computer from infection through e-mail?

Tip for selecting a level:

By analyzing source data, one can come to the conclusion that danger of a malicious program infecting your computer through e-mail in the scenario outline is extremely high (no centralized e-mail protection and the method for connecting to the Internet).

It is recommended that you use Maximum Protection as your basic pre-installed security level, with the following changes: it is recommended that you reduce the scan time for attachments, for example, to 1-2 minutes. The majority of archived attachments will be scanned for viruses and the processing speed will not be seriously slowed.

To modify the settings for a preconfigured security level,
  1. Open the application settings window and select [image] Mail Anti-Virus under Protection .
  2. Click the Customize button in the Security Level area.
  3. Edit mail protection parameters in the resulting window and click OK .

This will create a fourth security level containing protection settings made by you.
Also see:

Selecting a protected e-mail group

Creating an exclusion list

Selecting actions for dangerous e-mail objects


Configuring e-mail protection

The rules with which your e-mail is scanned are defined by a collection of settings. The settings can be broken down into the following groups:
  • settings that define the protected group of e-mails;
  • the settings that assign the list of objects not scanned by Mail Anti-Virus;
  • settings, which determine whether heuristic analysis will be used by File Anti-Virus;
  • settings that define actions on dangerous e-mail objects.
This Help section will examine the settings listed above in detail.


Selecting a protected e-mail group

Mail Anti-Virus allows you to select exactly what group of e-mails must be scanned for dangerous objects.
By default, this component protects emails as prescribed by the Recommended security level which means that both incoming and outgoing messages are scanned. When you first begin working with the program, it is recommended to scan outgoing mail, since it is likely that there are worms on your computer that use e-mail as a channel for distributing themselves. This will help to avoid unpleasant situations related to the unmonitored mass mailing of infected e-mails from your computer.
If you are certain that the e-mails that you are sending cannot contain dangerous objects, you can disable the outgoing mail scan. To do so:
  1. Open the application settings window and select [image] Mail Anti-Virus under Protection .
  2. Click the Customize button in the Security Level area.
  3. In the resulting window [image] select [image] Only Incoming Email under Scope .

In addition to selecting an e-mail group, you can specify whether archived attachments should be scanned and also set the maximum amount of time for scanning one e-mail object. These settings are configured in the Restrictions section.
If your computer is not protected by any local network software, and going on the Internet does not involve a proxy server or a firewall, it is recommended not to disable the archived attachment scan and not to set a time limit on scanning.
If you are working in a protected environment, you can change the time restrictions on scanning to increasing the e-mail scan speed.
You can configure the filtration conditions for objects connected to an e-mail in the Attachment filter section:
    Disable filtering - do not use additional filtration for attachments.
    Rename selected attachment types - filter out a certain attachment format and replace the last character of the file name with an underscore. You can select the file type by clicking the File types button.
    Delete selected attachment types - filter out and delete a certain attachment format. You can select the file type by clicking the File types button.
By using the filter, you add security to your computer, since malicious programs spread through mail most frequently as attachments. By renaming or deleting certain attachment types, you protect your computer from automatically open attachments when a message is received and other potential hazards.
Also see:

Attachment types

Configuring e-mail processing in Microsoft Office Outlook

Configuring e-mail scans in The Bat!


Attachment types

If you have enabled attachment filtration, specify the extensions that will be renamed or deleted by the filter:
    com - executable file for a program
    exe - executable file or self-extracting archive
    sys - system driver
    prg - program text for dBase, Clipper or Microsoft Visual FoxPro, or a WAVmaker program.
    bin - binary file
    bat - batch file
    cmd - command file for Microsoft Windows NT (similar to a .bat file for DOS), OS/2.
    dpl - compressed Borland Delphi library
    dll - dynamic loading library
    scr - Microsoft Windows splash screen
    cpl - Microsoft Windows control panel module
    ocx - Microsoft OLE (Object Linking and Embedding) object
    tsp - program that runs in split-time mode
    drv - device driver
    vxd - Microsoft Windows virtual device driver
    pif - program information file
    lnk - Microsoft Windows link file
    reg - Microsoft Windows system register key file
    ini - initialization file
    cla - Java class
    vbs - Visual Basic script
    vbe - BIOS video extension
    js, jse - JavaScript source text
    htm - hypertext document
    htt - Microsoft Windows hypertext header
    hta - hypertext program for Microsoft Internet Explorer
    asp - Active Server Pages script
    chm - compiled HTML file
    pht - HTML with built-in PHP scripts
    php - script built into HTML files
    wsh - Microsoft Windows Script Host file
    wsf - Microsoft Windows script
    the - Microsoft Windows 95 desktop wallpaper
    hlp - Win Help file
    eml - Microsoft Outlook Express e-mail file
    nws - Microsoft Outlook Express new e-mail file
    msg - Microsoft Mail e-mail file
    plg - e-mail
    mbx - extension for saved Microsoft Office Outlook e-mails
    doc* - Microsoft Office Word document, such as : doc - Microsoft Office Word document, docx - Microsoft Office Word 2007 document with XML support, docm - Microsoft Office Word 2007 document with macro support.
    dot*- Microsoft Office Word document template, such as, dot - Microsoft Office Word document template, dotx - Microsoft Office Word 2007 document template, dotm - Microsoft Office Word 2007 document template with macro support.
    fpm - database program, start file for Microsoft Visual FoxPro
    rtf - Rich Text Format document
    shs - Shell Scrap Object Handler fragment
    dwg - AutoCAD blueprint database
    msi - Microsoft Windows Installer packet
    otm - VBA project for Microsoft Office Outlook
    pdf - Adobe Acrobat document
    swf - Shockwave Flash file
    jpg, jpeg, png - compressed image graphics format
    emf - Enhanced Metafile format Next generation of Microsoft Windows OS metafiles. EMF files are not supported by 16-bit Microsoft Windows.
    ico - icon file
    ov? - MS DOC executable files
    xl* - Microsoft Office Excel documents and files, such as: xla - Microsoft Office Excel add-on, xlc - diagram, xlt - document template, xlsx - Microsoft Office Excel 2007 work book, xltm - Microsoft Office Excel 2007 work book with macro support, xlsb - Microsoft Office Excel 2007 in binary (non-XML) format, xltx - Microsoft Office Excel 2007 template, xlsm - Microsoft Office Excel 2007 template with macro support, xlam - Microsoft Office Excel 2007 add-on with macro support.
    pp* - Microsoft Office PowerPoint documents and files, such as: pps - Microsoft Office PowerPoint slide, ppt - presentation, pptx - Microsoft Office PowerPoint 2007 presentation, pptm - Microsoft Office PowerPoint 2007 presentation with macro support, potx - Microsoft Office PowerPoint 2007 presentation template, potm - Microsoft Office PowerPoint 2007 presentation template with macro support, ppsx - Microsoft Office PowerPoint 2007 slide show, ppsm - Microsoft Office PowerPoint 2007 slide show with macro support, ppam - Microsoft Office PowerPoint 2007 add-on with macro support.
    md* - Microsoft Office Access documents and files, such as: mda - Microsoft Office Access work group, mdb - database, etc.
    sldx - a Microsoft PowerPoint 2007 slide.
    sldm - a Microsoft PowerPoint 2007 slide with Macro support.
    thmx - a Microsoft Office 2007 theme.

Remember that the actual format of a file may not correspond with the format indicated in the file extension.


Adding a file name mask

In this window, you can add a file name mask that will filter e-mail attachments.

File mask is a file name and extension represented with wildcards. The two basic wildcards used in file masks are * and ?, * standing for any number of characters, and ? standing for any one character. Using these wildcards, you can represent any file. Note that the file name is always separated from the extension by a period.


Using Heuristic Methods for Mail Anti-Virus

Heuristic methods are utilized by several real-time protection components and virus scan tasks.

Heuristic methods of detecting new threats may be enabled / disabled for the Mail Anti-Virus component . This requires that the following steps be performed:

  1. Open the application settings window and select [image] Mail Anti-Virus under Protection.
  2. Click the Customize button in the Security Level area. Select the Heuristic Analyzer tab in the resulting dialog.
  3. Check [image] Use Heuristic Analyzer .

To use heuristic methods, check [image] Use Heuristic Analyzer . Additionally, a level of granularity may be set for the scan by moving the slider to one of the following settings: Shallow, Medium, or Detail.


Configuring e-mail processing in Microsoft Office Outlook

If you use Microsoft outlook as your mail client, you can set up custom configurations for virus scans.
A special plug-in is installed in Microsoft Office Outlook when you install Kaspersky Internet Security. It can quickly bring up configuration of Mail Anti-Virus settings and also determine at what time the e-mail will be scanned for dangerous objects.
The plug-in comes in the form of a special Mail Anti-Virus tab located under Service ® Settings.
Select the e-mail scan modes:
    Scan upon receiving - analyze every e-mail when it enters your inbox.
    Scan when read - scan the e-mail when you open it to read it.
    Scan upon sending - analyze each e-mail you send for viruses at the time that you send it.
Warning!
If you use the Microsoft Office Outlook connection to your mail service using IMAP protocol, it is recommended that you do not use Scan upon receiving mode. Enabling this mode will lead to forcing e-mails to be copies to the local computer when delivered to the server, and consequently the main advantage of IMAP is lost - creating less traffic and dealing with unwanted e-mail on the server without copying them to the user's computer.
The action that will be taken on dangerous e-mail objects is set in the Mail Anti-Virus settings. You can configure them by clicking here.
Also see:

Configuring e-mail scans in The Bat!

Selecting actions for dangerous e-mail objects


Configuring e-mail scans in The Bat!

Actions on infected e-mail objects in The Bat! are defined with the program's own tools.

Warning!
The Mail Anti-Virus settings that determine whether incoming and outgoing e-mail is scanned, as well as actions on dangerous e-mail objects and exclusions, are ignored. The only thing that The Bat! takes into account is scanning archived attachments and time limits on scanning one e-mail object.

To set up e-mail protection rules in The Bat!,
  1. Select Oprions from the Preferences menu.
  2. Select Virus protection from the settings tree.
The protection settings presented extend to all the anti-virus modules installed on the computer that support work with the Bat!
You must decide:
  • What group of e-mails will be subject to anti-virus scans (incoming, outgoing);
  • At what point in time e-mail objects will be scanned for viruses (when opening an e-mail or before saving one to disk);
  • The actions taken by the mail client when dangerous objects are detected in e-mails. For example, you could select:
      • Try to cure infected parts - tries to treat the infected e-mail object, and if the object cannot be disinfected, it stays in the e-mail. Kaspersky Internet Security will always inform you that the e-mail object is infected. But even if you select Delete in the Mail Anti-Virus notice window, the object will remain in the e-mail, since the action selected in The Bat! takes precedent over the actions of Mail Anti-Virus.
      Delete infected parts - delete the dangerous object in the e-mail, regardless of whether it is infected or suspected of being infected.

By default, The Bat! places all infected e-mail objects in the Quarantine folder without treating them.

Warning!
The Bat! does not give e-mails containing dangerous objects special headers.

Also see:

Configuring e-mail processing in Microsoft Office Outlook

Selecting actions for dangerous e-mail objects


Restoring default Mail Anti-Virus settings

When configuring Mail Anti-Virus, you can always return to the recommended performance settings. Kaspersky Lab considers them to be optimal and has combined them in the Recommended security level.

To restore the default Mail Anti-Virus settings:
  1. Open the application settings window and select [image] Mail Anti-Virus under Protection .
  2. Click the Default button in the Security Level area.


Selecting actions for dangerous e-mail objects

If scanning e-mails for viruses shows that an e-mail or any of its parts (body, attachment) is infected or is suspected to be infected, the further operations of Mail Anti-Virus depend on the status of the object and the action selected.
One of the following statuses can be assigned to the e-mail object after the scan:
  • status of a type of malicious program (for example, virus, Trojan).
  • Potentially infected, when the scan cannot determine whether the object is infected. This means that the program detected a sequence of code in the file from an unknown virus or modified code from a known virus.
By default, upon detection of a dangerous of potentially infected object, Mail Anti-Virus displays a warning on the screen and offers a choice of several actions for the object.
To change an action for an object,

open the application settings window and select [image] Mail Anti-Virus under Protection . All possible actions are shown in the section of the same name .

Let's look at the possible options for processing dangerous e-mail objects in more detail.
If the action selected was
When a dangerous object is detected
Prompt for action
Mail Anti-Virus will issue a warning message containing information about what malicious program has infected (potentially infected) the file and gives you the choice of one of the following actions.
Block access
Mail Anti-Virus blocks access to the object. Information about this is recorded in the report. Later you can attempt to disinfect this object.
Block access
      Disinfect
Mail Anti-Virus blocks access to the object and attempts to disinfect it. If it is successfully disinfected, the object will be available for regular use. If the object cannot be disinfected, it is moved to Quarantine. Information about this is recorded in the report. Later you can attempt to disinfect this object.
Block access
      Disinfect
      Delete if disinfection fails 1
Mail Anti-Virus blocks access to the object and attempts to disinfect it. If it is successfully disinfected, the object will be available for regular use. If the object cannot be disinfected, it is deleted. A copy of the object will be stored in Backup. Potentially infected objects are moved to Quarantine.
Block access
      Disinfect
      Delete
When Mail Anti-Virus detects an infected or potentially infected object, it deletes it without informing the user.
1If The Bat! is used as a mail client and this action of Mail Anti-Virus is applied, dangerous objects will be either disinfected or deleted (depending on the type of action, selected in The Bat!).
Before attempting to treat the object or delete it, Kaspersky Internet Security creates a backup copy and sends it to backup in case the object needs to be restored or an opportunity arises to treat it.
Also see:

Pausing / disabling e-mail protection

Selecting an e-mail security level


E-mail protection statistics

Certain current component statistics (number of email messages scanned since File Anti-Virus was last started and the number of malicious objects detected) are shown in the application main window . Select [image] Mail Anti - Virus under Protection to view .

To view a detailed component report, click Open Report (component currently running) or Open Last Start Report (component disabled).
Basic information on component operation is grouped by tab in the middle of the window.
  • All the dangerous objects detected in your e-mails are listed on the Detected tab. In order for this tab not to contain information about disinfected e-mail objects, uncheck [image] Show neutralized objects.
  • A complete list of events that have arisen while using Mail Anti-Virus is kept on the Events tab. Events can be either informative or critical. As a rule, the informative events are of a reference nature and are not of particular interest. You can disable display of such events. To do so, uncheck [image] Show all events.
  • Scan Statistics appear on the appropriate tab. Here you will find the total number of e-mail objects scanned and then in special columns it is separately indicated how many objects out of the total number scanned are archives, how many are dangerous, how many have been disinfected, how many sent to Quarantine, etc.
  • All component operation settings are displaying on the Settings tab.

Information types may be selected in each of the report tabs, information may be sorted by columns in ascending or descending order and searched. This is accomplished by using context menus accessible by right-clicking report column headers .


Web Anti-Virus

Whenever you use the Internet, you subject information stored on your computer to the risk of infection by dangerous programs. They can penetrate your computer when you read an article on the Internet.
Kaspersky Internet Security includes a special component for ensuring the security your Internet use - Web Anti-Virus. It protects information coming to your computer via HTTP and also prevents dangerous scripts from being loaded on the computer.
Warning!
Web Anti-Virus only monitors http traffic that passes through the ports listed on the monitored port list. A list of ports that are most commonly used for transmitting e-mail and HTTP traffic is included in the program package. If you use ports that are not on this list, add them to it to protect traffic moving through them.
If you are working in unprotected space it is recommended that you use Web Anti-Virus to protect yourself while using the Internet. If your computer is running on a network protected by a firewall of HTTP traffic filters, Web Anti-Virus provides additional protection for using the Internet.
The indicator of the component's operation is the Kaspersky Internet Security icon in the taskbar notification area, which looks like [image] whenever scripts are being scanned.
Let's look at the layout of component operation in more detail.
Web Anti-Virus consists of two modules that handle:
  • HTTP traffic protection - scan of objects that enter the user's computer via HTTP.
  • Script scan - scans all scripts, processed in Microsoft Internet Explorer, and also all WSH-scripts (JavaScript, Visual Basic Script etc.) that are loaded while the user is on the computer and on the Internet.
    • A special plug-in is provided for Microsoft Internet Explorer that installed when Kaspersky Internet Security is installed. The [image] button in the browser tool panel tells you that it is installed. If you click it, an information panel opens with Web Anti-Virus statistics on the number of scripts scanned and blocked.
HTTP traffic is protected using the following algorithm:
  1. Each web page or file that can be accessed by the user or by a certain program via HTTP is intercepted and analyzed by Web Anti-Virus for malicious code. Malicious objects are detected using the databases included in Kaspersky Internet Security and with the heuristic algorithm. The databases contain descriptions of all the malicious programs known to date and methods for neutralizing them. The heuristic algorithm can detect new viruses that have not yet been entered in the databases.
  2. As a result of the analysis, the following behavior options are available:
    • If a web page or an object accessed by a user contains malicious code, access to such an object is blocked. A notification is displayed that the object or page being requested is infected .
    • If a file or a web page contains no malicious code, it becomes immediately available to the user .
Scripts are scanned according to the following algorithm:
  1. Each script run on a web page is intercepted by Web Anti-Virus and is analyzed for malicious code.
  2. If the script contains malicious code, Web Anti-Virus blocks it and informs the user with a special pop-up message.
  3. If no malicious code is discovered in the script, it is run.
Caution!
To intercept and scan http traffic and scripts for viruses, Web Anti-Virus has to be running before a connection to a web resource is established . Otherwise, traffic will not be scanned.
Also see:

Web Anti-Virus status

Pausing / disabling Web Anti-Virus

Selecting the Web Anti-Virus level

Configuring Web Anti-Virus

Viewing Current Web Anti-Virus statistics


Web Anti-Virus status

To view current component status, select [image] Web Anti-Virus under Protection in the left pane of the application main window. The right pane will present summary information on browsing protection .

The most important is the Web Anti-Virus status:

  • Web Anti-Virus : running - protection of data downloaded from the Internet via HTTP protocol and scanning of all scripts run are enabled.
  • Web Anti-Virus : paused - protection of HTTP traffic and script scanning is disabled for a certain period of time. The component refreshes its work automatically when the program is restarted or after the length of time has expired for which Kaspersky Internet Security was paused. You can also enable Web Anti-Virus manually. To do so, use the Resume operation link.
  • Web Anti-Virus : disabled - the component has been stopped by the user. You can enable protection of data coming from the Internet. To do so, click Enable.
  • Web Anti-Virus : malfunction - web traffic protection and script scanning is not available for some reason.
  • Web Anti-Virus : running (subsystem malfunction) - the component encountered an error.
    • If a component encounters an error, try restarting it . If restart should result in an error, review component report which might contain the reason for the failure . If you are unable to troubleshoot the issue on your own, save the component report to a file using Action → Save As and contact Kaspersky Lab Technical Support.

Current component status information is followed by browsing protection security level and the action to be applied by Web Anti-Virus if a malicious object is detected. In addition, it is shown whether Web Anti-Virus modules (http traffic scanner and script scanner) are running. To edit current Mail Anti-Virus settings, click Configure.
Certain browsing protection statistics are displayed in the main window : the number of web pages and scripts scanned since the component was started as well as the number of malicious objects detected . Use the Open Report link to view a detailed report on the component's current performance .

If for some reason a component is paused or stopped at a given moment in time, its results at the time of deactivation may be viewed by clicking Open Last Start Report.


Pausing / disabling Web Anti-Virus

By default, HTTP protection is enabled and all scripts are scanned for malicious code. You can pause Web Anti-Virus for a certain length of time or completely.
Here we will examine the methods for disabling the component in greater detail.
To pause Web Anti-Virus,

select [image] Web Anti-Virus in the Protection section of the main window and use Pause link.

The component status will change to paused. HTTP protection and script scanning will be paused until you restart the program or enable the component enable the component using the Resume operation link.

When you pause Web Anti-Virus, the component statistics for the current Kaspersky Internet Security session are saved and will continue to be recorded after the component is updated.

To stop Web Anti-Virus,

select Web Anti-Virus under Protection in the main window and use the Stop link. Then the component status will change to stopped. Protection will be disabled until you resume using the Enable link.

File protection may also be shut down from the application settings window . Select [image] Web Anti-Virus under real-time Protection and uncheck [image] Enable Web Anti-Virus .

When you stop Web Anti-Virus, all the statistics from previous work are cleared and when the component is started they are recorded over.

Warning!
Remember that if you disabled Web Anti-Virus in the settings window, it will not automatically be enabled after restarting the program. To resume Web Anti-Virus, you must check [image] Enable Web Anti-Virus.
By disabling Web Anti-Virus in the main window, the component status changes to disabled, and the component list in the Protection section its name will go inactive (gray).
Web Anti-Virus can also be disabled by fully disabling protection on your computer.
Kaspersky Lab specialists do not recommend fully disabling Web Anti-Virus. If the component causes you any difficulties while you are using the Internet (for example, it blocks you from downloading files that you need), you can opt to exclude a series of events from Web Anti-Virus or disable either of the Web Anti-Virus modules. Do not forget that one of them controls HTTP traffic and one handles script scanning. . If you do not want to use a certain module, uncheck its box in the [image] Connectivity section of the component settings window.


Selecting the Web Anti-Virus level

Kaspersky Internet Security protects you while you use the Internet on one of the following levels:
    Maximum Protection - the level with the most comprehensive monitoring of scripts and objects incoming via HTTP. The program performs a thorough scan of all objects, using the full set of application databases. This security level is recommended for aggressive environments, when no other HTTP protection tools are being used.
    Recommended. Kaspersky Lab experts recommend this level. They determine the scan of the same objects as Maximum Protection, with the exception of objects that will take more than three minutes to scan.
    High Speed - security level with settings that let you comfortably use applications that require significant system resources, since the set of objects scanned is cut back by using a limited set of threat signatures. It is recommended to select this protection level if you have additional web protection software installed on your computer.
By default, the protection level is set to Recommended.
You can raise or lower the protection level by selected the level you want or changing the settings for the current level.
In order to modify a security level,

Adjust the sliders. By altering the security level, you define the ratio of scan speed and the total number of objects scanned: the fewer objects are subject to analysis for dangerous objects, the higher the scan speed.

If a preset level does not meet your needs, you can create a Custom settings security level. It is recommended that you select a level closest to your requirements as basis and edit its parameters . This will change the name of the security level to Custom. Let us look at an example when preconfigured security level settings may need to be modified.
Example:

Your computer connects to the Internet via modem. It is not on the corporate LAN, and you have no anti-virus protection for incoming HTTP traffic.

Due to the nature of your work, you regularly download large files from the Internet. Scanning files like these, as a rule, takes up a fair amount of time.

How do you maximally protect your computer from infection through HTTP traffic or a script?

Tip for selecting a level:

By analyzing source data, one can come to the conclusion that your computer is running in an aggressive environment, and the danger of a malicious program infecting your computer through HTTP traffic is extremely high (no centralized Web Anti-Virus and the method for connecting to the Internet).

It is recommended that you use Maximum Protection as your basic pre-installed security level, with the following changes: we recommend limiting the caching time for file fragments during the scan.

To modify the settings for a pre-installed security level,
  1. Open the application settings window and select [image] Web Anti-Virus under Protection .
  2. Click the Customize button in the Security Level area.
  3. Edit browsing protection parameters in the resulting window and click OK .
Also see:

Pausing / disabling Web Anti-Virus

Selecting actions on dangerous objects


Configuring Web Anti-Virus

Web Anti-Virus includes scanning all objects that are loaded on your computer via HTTP and monitors all WSH-scripts (JavaScript, Visual Basic Script etc.) run.
You can configure a number of Web Anti-Virus settings aimed at increasing component operation speed, specifically:
  • Configuring general scan settings;
  • Create a list of trusted web addresses;
  • Enable / disable heuristic analysis.
Beyond this, you can select actions on dangerous HTTP objects that Web Anti-Virus will execute.
This Help section will examine the settings listed above in detail.
Also see:

Selecting actions on dangerous objects


General scan settings

To increase its success in detecting malicious code, Web Anti-Virus caches fragments of objects downloaded from the Internet. When using this method, Web Anti-Virus only scans an object after it has downloaded it completely. The object is then analyzed for viruses and, pursuant to the results, the program returns the object to the user or blocks it.
However, using caching increases object processing time and the time before the program returns objects to the user, and can also cause problems when copying and processing large objects because of the connection with the HTTP client timing out.
We suggest limiting the caching time for web object fragments downloaded from the Internet to solve this problem. When this time limit expires, the user will receive the downloaded part of the file without it being scanned, and once the object is fully copied, it will be scanned in its entirety. This can deliver the object to the user faster and solve the problem of interrupting the connection without reducing security while using the Internet.
By default, caching time for file fragments is limited to one second. Increasing this value or deselecting the caching time limit will lead to better anti-virus scans, but somewhat slower delivery of the object.
To limit the caching time for file fragments or remove the limit:
  1. Open the application settings window and select [image] Web Anti-Virus under Protection .
  2. Click the Customize button in the Security Level area.
  3. In the window that opens, select the option you want in the [image] Scan settings section.


Creating a trusted address list

You have the option of creating a list of trusted addresses whose contents you unconditionally trust. Web Anti-Virus will not analyze data from those addresses for dangerous objects. This option can be used in cases where Web Anti-Virus interferes with downloading a particular file, blocking the attempts to download it.
To create a list of trusted addresses,
  1. Open the application settings window and select [image] Web Anti-Virus under Protection .
  2. Click the Customize button in the Security Level area.
  3. In the window that opens, create a list of trusted servers in the [image] Trusted URLs section. To do so, use the buttons to the right of the list.
When entering a trusted address, you can create masks with the following special symbols:
* - any combination of characters.
Example: If you create the mask *abc*, no URL contain abc will be scanned. For example: www.virus.com/download_virus/page_0-9abcdef.html
? - any one symbol.
Example: If you create mask Patch_123?.com, URLs containing that series of characters plus any character following the 3 will not be scanned. For example: Patch_1234.com However, patch_12345.com will be scanned.
If an asterix or question mark is part of an actual URL added to the list, when you enter them, you must use a backslash to override the asterix or question mark following it.

Example: you want to add this following URL to the trusted address list: www.virus.com/download_virus/virus.dll?virus_name=

For Kaspersky Internet Security not to process ? as a wildcard, you use put a backslash in front of it. Then the URL that you are adding to the exclusion list will be as follows: www.virus.com/download_virus/virus.dll\?virus_name=


Using Heuristic Methods for Web Anti-Virus

Heuristic methods are utilized by several real-time protection components and virus scan tasks.

Heuristic methods of detecting new threats may be enabled / disabled for the Web Anti-Virus component . This requires that the following steps be performed:

  1. Open the application settings window and select [image] Web Anti-Virus under Protection.
  2. Click the Customize button in the Security Level area. Select the Heuristic Analyzer tab in the resulting dialog.
  3. Check [image] Use Heuristic Analyzer .

To use heuristic methods, check [image] Use Heuristic Analyzer . Additionally, a level of granularity may be set for the scan by moving the slider to one of the following settings: Shallow, Medium, or Detail.


Restoring default Web Anti-Virus settings

When configuring Web Anti-Virus, you can always return to the recommended performance settings. Kaspersky Lab considers them to be optimal and has combined them in the Recommended security level.

To restore the default Web Anti-Virus settings:
  1. Open the application settings window and select [image] Web Anti-Virus under Protection .
  2. Click the Default button in the Security Level area.


Selecting actions on dangerous objects

If analyzing an http object shows that it contains malicious code, further Web Anti-Virus operations depend on the action you select.
To configure Web Anti-Virus reactions to detecting a dangerous object:

open the application settings window and select [image] Web Anti-Virus under Protection . All possible actions are shown in the section of the same name .

By default, upon detection of a dangerous http object, Web Anti-Virus displays a warning on the screen and offers a choice of several actions for the object.
Let's look at the possible options for processing dangerous HTTP objects in more detail.
If the action selected was | If a dangerous object is detected in the HTTP traffic
Prompt for action | Web Anti-Virus will issue a warning message containing information about what malicious code has potentially infected the object and will give you the choice of one of the following actions.
Block | Web Anti-Virus will block access to the object and will display a message on screen about blocking it. Similar information will be recorded in the report.
Allow | Web Anti-Virus will grant access to the object. Information about this will be recorded in the report.
As for actions on dangerous objects, Web Anti-Virus always blocks them and issues pop-up messages that inform the user of the action taken. You cannot change the action on a dangerous script other than disabling the script scanning module.
Also see:

Pausing / disabling Web Anti-Virus

Selecting the Web Anti-Virus level


Web Anti-Virus statistics

Certain current component statistics (number of web pages and scripts scanned since component was last started and number of malicious objects detected) are shown in the application main window . Select [image] Web Anti-Virus under Protection to view .

To view a detailed component report, click Open Report (component currently running) or Open Last Start Report (component disabled).
Basic information on component operation is grouped by tab in the middle of the window.
  • All the dangerous objects detected by Web Anti-Virus in the HTTP traffic are shown on the Detected tab. The name of the object and the name of the dangerous object are shown here. In order for this tab not to contain information about disinfected HTTP traffic objects, uncheck [image] Show neutralized objects.
  • A complete list of events that have arisen while using Web Anti-Virus is kept on the Event log tab. Events can be either informative or critical. As a rule, the informative events are of a reference nature and are not of particular interest. You can disable display of such events. To do so, uncheck [image] Show all events.
Information types may be selected in each of the report tabs, information may be sorted by columns in ascending or descending order and searched. This is accomplished by using context menus accessible by right-clicking report column headers .


Proactive Defense

Warning!
There is no Application Integrity Control component in this version of the application for computers running Microsoft Windows XP Professional x64 Edition, Microsoft Windows Vista or Microsoft Windows Vista x64.

Kaspersky Internet Security protects you both from known threats and from new ones about which there is no information in the application databases. This is ensured by a specially developed component - Proactive Defense.
The need for Proactive Defense has grown as malicious programs have begun to spread faster than anti-virus updates can be released to neutralize them. The reactive technique that anti-virus protection is based on requires that a new threat infect at least one computer and requires time to analyze the malicious code to add it to the application databases and to update these databases on user computers. By that time, the new threat can incur massive damages.
The preventative technologies provided by Kaspersky Internet Security Proactive Defense can avoid losing time and neutralize new threats before they harm your computer. How is this done? In contrast with reactive technologies, which analyze code based on records in a application databases, preventative technologies recognize a new threat on your computer by a sequence of actions executed by a certain program. The program includes a set of criteria that can determine how dangerous the activity of a program is. If analysis of a sequence of actions makes the program suspicious, Kaspersky Internet Security takes the action assigned by the rule for that type of activity.
Dangerous activity is determined by the total set of program actions. For example, when actions are detected such as a program copying itself to network resources , the startup folder, or the system registry, and then sending copies of itself, it is highly likely that this program is a worm. Dangerous behavior also includes:
  • Changes to the file system
  • Modules being imbedded in other processes
  • Masking processes in the system
  • Changes to certain Microsoft Windows system registry keys.
Proactive Defense tracks and blocks all dangerous operations.
During operation, Proactive Defense uses a set of rules include with the program, as well as user-defined rules. A rule is a set of criteria that define the scope of suspicious activities and how Kaspersky Internet Security should react to them.
Individual rules are provided for application activity and monitoring changes to the system registry and programs run on the computer. You can edit the rules at your own discretion by adding, deleting, or editing them. Rules can block actions or grant permissions.
Let's examine the Proactive Defense algorithms:
  1. Immediately after the computer is started, Proactive Defense analyzes the following factors:
    • Actions of each application running on the computer. Proactive Defense records a history of actions taken in order and compares them with sequences characteristic of dangerous activity (a database of dangerous activity types comes with the Kaspersky Internet Security and is updated with the application databases).
    • Integrity of the program modules of the programs installed on your computer, which helps avoid application modules being substituted for malicious code embedded in them.
    • Each attempt to edit the system registry (deleting or adding system registry keys, entering values for keys in a format that is not acceptable or prevents them from being viewed or edited, etc.).
  2. The analysis is based on the allow and block rules of Proactive Defense
  3. After the analysis, you have the following available courses of action:
    • If the activity satisfies the conditions of the Proactive Defense allow rule or does not match any block rule, it is not blocked.
    • If the block rule matches the activity, the next steps taken by the component match the instructions specified in the rule. Such activity is usually blocked. A message will be displayed on the screen specifying the application, its activity type, and a history of actions taken. You must accept the decision, block, or allow this activity on your own. You can create a rule for such activity and cancel the actions taken in the system.
      • If the user does not take any actions when a Proactive Defense notification appears, after a time the program will apply the default action recommended for that threat. The recommended action can be different for different threat types.
Note that not all verdicts that Proactive Defense assigns necessarily mean that dangerous operations are being executed. Some of these operations are normal behavior for programs being run on the computer. For more in-depth information, see the Proactive Defense verdicts section.
Also see:

Proactive Defense status

Pausing / disabling Proactive Defense

Configuring Proactive Defense

Proactive Defense statistics

Proactive Defense verdicts


Proactive Defense status

To view current component status, select [image] Proactive Defense under Protection in the left pane of the application main window. In the right-hand part, you will see composite information on unknown threats.

The most important is Proactive Defense status:

  • Proactive Defense : running - protection against new malicious and dangerous programs is enabled.
  • Proactive Defense : paused - Proactive Defense is disabled for a certain period of time. The component will resume operations automatically after the assigned period has expired or after restarting the program. You can also enable Proactive Defense manually. To do so, use the Resume operation link.
  • Proactive Defense : disabled - the component has been stopped by the user. You can enable Proactive Defense. To do so, use the Enable link.
  • Proactive Defense : malfunction - Proactive Defense is not available for some reason.
  • Proactive Defense : running (subsystem malfunction) - the component encountered an error.
    • If a component encounters an error, try restarting it . If restart should result in an error, review component report which might contain the reason for the failure . If you are unable to troubleshoot the issue on your own, save the component report to a file using Action → Save As and contact Kaspersky Lab Technical Support.
Component status is followed by information on whether Proactive Defense modules (Application Activity Analyzer, Application Integrity Analyzer, and Registry Guard) are running . To edit current component settings, click Configure.
Certain unknown threat protection statistics are displayed in the main window : number of suspicious events recorded by the component . Use the Open Report link to view a detailed report on the component's current performance.
If for some reason the component is paused or stopped at a given moment in time, its results at the time of deactivation may be viewed by clicking Open Last Start Report.


Pausing / disabling Proactive Defense

By default, your computer's protection from new threats is enabled. You can pause Proactive Defense for a certain length of time or disable it completely. You also have the option of only disabling individual modules of Proactive Defense.
However, remember that by disabling Proactive Defense you drastically lower the security level on your computer, since you become vulnerable to new threats.
Let's look at the ways to disable Proactive Defense in more detail.
To pause Proactive Defense,

select [image] Proactive Defense in the Protection section of the main window and use Pause link.

The component status will change to paused. Protection will be paused until you restart the program or enable the component using the Resume operation link.

When you pause Proactive Defense, the component statistics for the current Kaspersky Internet Security session are saved and will continue to be recorded after the component is updated.

To stop Proactive Defense,

select Proactive Defense under Protection in the main window and use the Stop link. Then the component status will change to stopped. Protection will be disabled until you resume using the Enable link.

Proactive Defense and its individual modules may also be disabled using the application settings window . Select [image] Proactive Defense under Protection and uncheck [image] Enable Proactive Defense or uncheck the individual modules that you want to disable .

Please remember that for Proactive Defense to function at least one module must be running .

When you stop Proactive Defense, all the statistics from previous work are cleared and when the component is started they are recorded over.

Warning!
Remember that if you disabled Proactive Defense in the settings window, it WILL NOT automatically be enabled after restarting the program. To restore protection from new threats, you must check [image] Enable Proactive Defense.
By disabling Proactive Defense in the main window, the component status changes to disabled, and the component list in the Protection section its name will go inactive (gray).
Proactive Defense can also be disabled by fully disabling protection on your computer.


Proactive Defense settings

Proactive Defense is carried out in strict correspondence with settings that define:
  • Whether application activity is subject to monitoring on your computer.

This Proactive Defense mode is controlled by the [image] Enable Application Activity Analyzer box. By default the analyzer is enabled providing a detailed analysis of actions performed by any program started on the host. A set of dangerous activities is highlighted for each of which you can configure the application processing procedure for that activity. You can also create Proactive Defense exclusions, with which you can stop the activity of selected applications from being monitored.

  • Whether Application Integrity Control is enabled.

This feature is responsible for the integrity of the modules of applications installed on your computer and is controlled by the [image] Enable application Integrity Control box. Integrity is tracked by the composition of the program modules and checksum of the program itself. You can create integrity control rules for application modules. To do so, you must add the application to the monitored applications list.

This Proactive Defense component is not available under Microsoft Windows XP Professional x64 Edition, Microsoft Windows Vista, or Microsoft Windows Vista x64.
  • Whether system registry changes are monitored.

By default, [image] Enable Registry Guard is checked, which means the Kaspersky Internet Security analyzes all attempts to make changes to the Microsoft Windows system registry keys.

You can create your own rules for monitoring dependent on the registry key.

You can configure exclusions for Proactive Defense modules and create a trusted application list.
This Help section will examine the aspects listed above in detail.


Activity control rules

Note that configuring application control under Microsoft Windows XP Professional x64 Edition, Microsoft Windows Vista or Microsoft Windows Vista x64 differs from the configuration process on other operating systems.

  • Specifics of configuring application activity control under Microsoft Windows 2000 or Microsoft Windows XP;
  • Specifics of configuring application activity control under Microsoft Windows XP Professional x64 Edition, Microsoft Windows Vista or Microsoft Windows Vista x64.

Specifics of configuring application activity control under Microsoft Windows 2000 or Microsoft Windows XP

Kaspersky Internet Security monitors application activity on your computer. The application includes a set of event descriptions that can be tracked as dangerous. A monitoring rule is created for each such event. If the activity of any application is classified as a dangerous event, Proactive Defense will strictly adhere to the instructions stated in the rule for that event.
Select the [image] Enable Application Activity Analyzer checkbox if you want to monitor the activity of applications.
Let's take a look a several types of events that occur in the system that the application will track as suspicious::
  • Dangerous behavior. Kaspersky Internet Security analyzes the activity of applications installed on your computer, and based on the list of rules created by Kaspersky Lab, detects dangerous or suspicious actions by the programs. Such actions include, for example, masked program installation, or programs copying themselves.
  • Launching Internet browser with parameters. By analyzing this type of activity, you can detect attempts to open a browser with settings. This activity is characteristic of opening a web browser from an application with certain command prompt settings: for example, when you click a link to a certain URL in an advertisement e-mail.
  • Intrusion into process (invaders) - adding executable code or creating an additional stream to the process of a certain program. This activity is widely used by Trojans.
  • Hidden processes (rootkit). Rootkit is a set of programs used to mask malicious programs and their processes in the system. Kaspersky Internet Security analyzes the operating system for masked processes.
  • Window hooks. This activity is used in attempts to read passwords and other confidential information displayed in operating system dialog boxes. Kaspersky Internet Security traces this activity if attempts are made to intercept data transferred between the oprating system and the dialog box.
  • Suspicious values in registry. The system registry is a database for storing system and user settings that control the operation of Windows, as well as any utilities established on the computer. Malicious programs, attempting to mask their presence in the system, copy incorrect values in registry keys. Kaspersky Internet Security analyzes system registry entries for suspicious values.
  • Suspicious system activities. The program analyzes actions executed by the Windows operating system and detects suspicious activity. An example of suspicious activity would be an integrity breach, which involves modifying one or several modules in a monitored application since the time it was last run.
  • Keylogger detection. This activity is used in attempts by malicious programs to read passwords and other confidential information which you have entered using your keyboard.
  • Task Manager protection. Kaspersky Internet Security protects Task Manager from malicious modules injecting themselves into it when aimed at blocking Task Manager operation.
The list of dangerous activities is added to automatically when Kaspersky Internet Security is updated, and it cannot be edited. You can:
  • turn off monitoring for one activity or another by unchecking the [image] next to its name;
  • Edit the rule that Proactive Defense uses when it detects dangerous activity
  • Create an exclusion list by listing applications with activity that you do not consider dangerous.
To configure activity monitoring,
  1. Open the application settings window and select [image] Proactive Defense under Protection.
  2. Click the Settings button under Application Activity Analyzer

The types of activity that Proactive Defense monitors are listed in the [image] Settings: Application Activity Analyser window.

To edit a dangerous activity monitoring rule, select it from the list and assign the rule settings in the lower part of the tab:
  • Assign the Proactive Defense reaction to the dangerous activity.
    • You can assign any of the following actions as a reaction: allow, prompt for action, and terminate. Left-click on the link with the action until it reaches the value that you need. In addition to stopping the process, you can place the application that initiated the dangerous activity in Quarantine. To do so, use the On. / Off. link across from the appropriate setting. To detect masked processes, you can also assign a time value for how often the scan will start.
  • Specify if it is necessary to generate a report on the operation carried out. To do so, use the On. / Off. link.

To turn off monitoring for one dangerous activity or another, uncheck the [image] next to the name of the dangerous activities on the list.

Specifics of configuring application activity control under Microsoft Windows XP Professional x64 Edition, Microsoft Windows Vista or Microsoft Windows Vista x64

If you are running one of the operating systems listed above, only one type of system event is controlled, dangerous activity (behavior analysis). Kaspersky Internet Security analyses the activity of applications installed on the computer and detects dangerous or suspicious activities basing on the list of rules, created by Kaspersky Lab specialists.

If you want Kaspersky Internet Security to monitor the activity of system processes in addition to user processes, select the [image] Monitor system user accounts checkbox. This option is disabled by default.

User accounts control access to the system and identify the user and his/her work environment, which prevents other users from corrupting the operating system or data. System processes are processes launched by system user accounts.

Also see:

Creating an exclusion list

Trusted applications


Application Integrity Control

This Proactive Defense component does not work under Microsoft Windows XP Professional x64 Edition, Microsoft Windows Vista or Microsoft Windows Vista x64.
There are a number of programs that are critical for the system that could be used by malicious programs to distribute themselves, such as browsers, mail clients, etc. As a rule, these are system applications and processes used for accessing the Internet and in working with e-mail and other documents. It is for this reason that such applications are considered critical regarding monitoring their activity.
Proactive Defense monitors critical applications and analyzes their activity, integrity of the modules of those applications, and those applications starting other processes. Kaspersky Internet Security comes with a list of critical applications and a monitoring rule has been created for the activity of each of them. You can add other applications that you consider critical to this list and remove or edit the rules for the applications on the list provided.
Besides the list of critical applications, there is a set of trusted modules allowed to be opened in all controlled applications. For example, modules that are digitally signed by the Microsoft Corporation. It is highly unlikely that the activity of applications that include such modules could be malicious, so it is not necessary to monitor them closely. Kaspersky Lab specialist have created a list of such modules to lighten the load on your computer when using Proactive Defense.
Components with Microsoft-signed signatures are automatically added to trusted applications. If necessary, you can add or delete components from the list.
Monitoring processes in the system can be turned on by checking [image] Enable Application Integrity Control. The box is unchecked by default. If you are controlling integrity, each application opened or application module is scanned against the critical and trusted applications list. If the application is on the list of critical applications, its activity is controlled by Proactive Defense in accordance with the rule created for it.
To configure process monitoring,
  1. Open the application settings window and select [image] Proactive Defense under Protection.
  2. Click the Settings button under Application Integrity Control .
Let's examine working with critical and trusted processes in greater detail.
Also see:

Configuring critical application monitoring rules

Creating a list of general components


Configuring critical applications control rules

Critical applications are executable files of programs which are extremely important to monitor, since malicious files uses such programs to distribute themselves.
A list of critical applications, formed by Kaspersky Lab specialists and included into program distribution kit, is given on the Critical applications tab. A monitoring rule is created that regulates the activity of that application. You can edit current rules and create your own.
Proactive Defense analyzes the following operations involving critical applications: starting them, changing the makeup of application modules, and starting an application as a daughter process. You can select the Proactive Defense reaction to each of the operations listed (allow or block the operation) and also specify whether it is necessary to record activity in the report on component operation. Practically all critical operations are allowed to start, be edited, or started as daughter processes by default.
To add an application to the list of critical applications and create a rule for it,
  1. Click Add on the [image] Critical applications tab. A context menu will open, and by clicking Browse you can go to the standard file selection window, or by clicking Applications you can go to a list of applications currently running and select them as necessary. The application will be added as the first on the list. A allow rule will be created for it by default. When that application is first started, a list of the modules used when the program is started will be created and those modules will be granted permission.
  2. Select a rule on the list and assign the rule settings in the lower portion of the tab:
    • Define the Proactive Defense reaction to attempts to open, edit the makeup, or start a daughter process with a critical application.
      You can use any of the following actions as a reaction: allow, prompt for action, and block. Left-click on the link with the action until it reaches the value that you need.
    • Specify if it is necessary to generate a report on the operation carried out. To do so, click log / do not log.
To turn off monitoring of the activity of an application, you need only uncheck the [image] next to its name.

Use the Details button to view a detailed list of modules for the application selected.

Also see:

Creating a list of general components


Controlled module list

The Settings : application modules window contains a list of the modules that are used when a monitored application is started and make up the application. You can add to and edit list using the Add and Delete buttons in the right-hand portion of the window.
You can also allow any controlled application modules to load or block them. To modify the action, select the module from the list and click the Modify button.

Note that Kaspersky Internet Security trains the first time you run the controlled application after installing Kaspersky Internet Security until you close that application. The training process produces a list of modules used by the application. Integrity Control rules will be applied the next time you run the application.

Also see/b>:

Selecting actions for a module


Selecting actions for a module

Use this window to allow any controlled application modules to load or block them. By default, an allow rule is created for each module. If you want to block a module from being loaded, select the corresponding action from the dropdown list.

Click OK button for the changes to take effect. To exit the window without applying the changes, click Cancel.

Also see:

Controlled module list


Selecting modules or folders with modules

In the Select Module/Module Path window, you can select a folder with program modules that you want to add to the shared components list. You can select a directory with modules or enter it manually in the Object field.


Creating a list of general components

Kaspersky Internet Security comes with a list of includes a list of common components which are allowed to be embedded into all controlled applications. These components are listed on the [image] Trusted modules tab. The list includes modules that Kaspersky Internet Security uses and those which are signed by Microsoft Corporation.
You can install various programs on your computer and have those with modules signed by Microsoft Corporation automatically added to the trusted modules list. To do so, check [image] Automatically add components signed by Microsoft Corporation to this list. In this case, if the controlled application attempts to open a Microsoft-signed module, the program will automatically allow the module to load and it will be placed on the list of shared components.
To add to the trusted module list, click Add and in the standard file selection window, select the module.
Also see:

Configuring critical application monitoring rules


Monitoring changes in the system registry

One of the goals of many malicious programs is to edit the registry of the operating system on your computer. These can be harmless joke programs or more dangerous malicious programs that present a real threat to your computer.
For example, malicious programs can copy their information to the registry key that makes applications open automatically on startup. Malicious programs will then automatically be started when the operating system boots up.
The special Proactive Defense module traces modifications of system registry files. You can turn this module on or off by checking [image] Enable Registry Guard.
To configure system registry monitoring,
  1. Open the application settings window and select [image] Proactive Defense under Protection .
  2. Click the Settings button in the Registry Guard section.
Kaspersky Lab has already created a list of rules that control operations with registry objects and have included it in the program. Operations with registry objects break down into logical groups such as System Security, Internet Security, etc. Each such group includes system registry objects and rules for working with them. This list is updated when the rest of the program is updated.
The [image] Registry key groups window contains a complete list of rules.
Each group of rules has an execution priority that you can raise or lower using the Move Up and Move Down buttons. The higher the group is on the list, the higher priority is assigned to it. If the same registry object falls under several groups, the first rule applied to the object will be the one from the group with the higher priority.
You can stop using any group of rules in the following ways:
  • Uncheck the box [image] next to the group's name. In this case, the group of rules will remain on the list but will not be used.
  • Delete the group of rules from the list. We do not recommend deleting the groups created by Kaspersky Lab, since they contain a list of system registry objects most often used by malicious programs.
You can create your own groups of monitored system registry objects. To do so, click Add in the objects group window.
Take these steps in the window that opens:
  1. Enter the name of the new group for monitoring system registry objects in the Group name field.
  2. Create a list of objects from the system registry that the group will include on the Keys tab. This could be one or several objects.
  3. Create a rule for registry objects on the Rules tab. You can create several rules and set their order of application.


Selecting registry objects for creating a rule

The objects group created should contain at least one system registry object. The Keys tab provides a list of objects for the rule.

To add a system registry file, click the Add button, and in the Select registry path that opens, take the necessary steps.

Also see:

Creating a rule for monitoring registry keys

Select registry path


Select registry path

Use this window to add a system registry file to the created file group that Proactive Defense will monitor.

To add a system registry file:
  1. Select a system registry file or a group of files for which you want to create a monitoring rule.
  2. Specify the key value or a mask for a group of keys that you want the rule to apply to in the Value field.
  3. Check [image] Including subkeys for the rule to apply to all keys attached to the system registry key selected for the rule.
You only need to use masks with an asterix and a question mark at the same time as the Include subkeys feature if the wildcards are used in the name of the key.

If you select a group of registry files using a mask and specify a specific value for it, the rule will be applied to that value for any key in the group selected.

Also see:

Creating a Registry Guard rule

Selecting registry keys for creating a rule


Creating a rule for monitoring registry objects

A system registry object monitoring rule consists of definitions of:
  • the application to which the rule will be applied if it attempts to access system registry objects;
  • the program's reaction to an application attempting to execute an operation with the system registry.
To create a rule for your selected system registry objects,
  1. Click New on the Rules tab. The general rule will be added as the first on the rule list.
  2. Select a rule on the list and assign the rule settings in the lower portion of the tab:
    • Specify the application.
      • The rule is created for any application by default. If you want the rule to apply to a specific application, left-click on any and it will change to this. Then use the specify application name link. A context menu will open, and by clicking Browse you can go to the standard file selection window, or by click Applications you can go to a list of applications currently running and select them as necessary.
    • Define the Proactive Defense reaction to the selected application attempting to read, edit, or delete system registry objects.
      • You can use any of the following actions as a reaction: allow, prompt for action, and block. Left-click on the link with the action until it reaches the value that you need.
    • Specify if it is necessary to generate a report on the operation carried out. To do so, click log event / do not log event .
You can create several ruse and rank their priority using the Up and Down buttons.
You can also create a allow rule for a system registry object from the notice of the attempt to execute an operation with the object. To do so, click Create allow rule in the notice and specify the system registry object that the rule will apply to in the window that opens.
Also see:

Selecting keys for creating a rule


Proactive Defense statistics

Certain current component statistics are shown in the application main window . Select [image] Proactive Defense under Protection to view.
To view a detailed component report, click Open Report (component currently running) or Open Last Start Report (component disabled).

A point-by-point description of all actions for protection from new threats is given in the main part of the report. All events are sorted by various tabs depending on what Proactive Defense module detected and processed them:

  • All objects classified as dangerous are collected on a separate Detected tab.
  • Events related to monitoring application activity are listed on the Events tab.
  • The Registry tab contains all operations involving the system registry.
You can select the type of information on each report tab, sort it in ascending and descending order for each of the columns, and search for information in the report. To do so, use the options on the context menu, which you can open by right-clicking on the report column headings.


The Events tab

Each instance of detecting dangerous activity is recorded on the Events tab of the report unless it has been disabled by an activity monitoring rule.
This tab contains:
  • the name of the process with activity classified as dangerous
  • a brief description of process activity
  • the action that Kaspersky Internet Security took in accordance with a rule or user selection in the notification window
  • the time of the event
Since events can be of varying status (information, warnings, alerts), you can define which events you want to see on this report tab. If you do not want to see informative events, uncheck [image] Show all events.
To delete all events listed on the tab, click Actions → Clear all.


The Registry tab

The program records operations with registry objects that have been attempted since the program was started on the Registry tab, unless forbidden by a rule.
The tab lists the full name of the object, its value, the data type, and information about the operation that has taken place: what action was attempted, at what time, and whether it was allowed.
To delete all events listed on the tab, click Actions → Clear all.


Proactive Defense verdicts

This section covers Proactive Defense verdicts. Note that not all verdicts should necessarily be taken as a threat. Some of these operations are normal behavior for programs being run on the computer or reactions of the operating system to the operation of those programs. However, in some cases the same operations can be called up by hacker activity or malicious programs.

Verdicts with a high danger level are highlighted in red throughout the text. Verdicts that are not always indicative of threats are in black.

Stack overflow

Stack overflow is one of the most common techniques today for gaining unauthorized access to a system.

The concept works as follows. A program usually needs a stack structure in the RAM where it can store and retrieve intermediate values. When the program calls up a procedure or subprogram, it sends the return address to the stack, and the procedure then knows where to return control once it is complete. A stack overflow is when a block of data larger than the stack is sent to the stack. The excess data are recorded in the part of the stack designated for correctly returning from the procedure. Thus, the overflow alters the normal process of executing the program, and instead of correctly returning to executing it further, it is transferred to the address that was rewritten in the command because of the stack overflow.

To cause a stack overflow, hackers use exploits, programs containing machine instructions executed by the processor. The address that the processor goes to because of the stack overflow will be specified in these instructions.

The likelihood of a stack overflow when using standard programs in normal mode is extremely low. When a stack overflow is detected, it is very likely that it means that this vulnerability is being taken advantage of for malicious ends.

Data execution

This technique uses errors in software installed on your computer. The errors used are errors that replace correct data with data provided by a malicious object, which cause these data to be processed incorrectly.

The most common object of attacks using data execution are browsers, many of which do not perform the necessary scans while view web pages, images, and multimedia, and malicious code implanted in objects on web pages can gain control.

Microsoft uses DEP (Data Execution Prevention) to protect executable code in Microsoft Windows. This solution is included in updates for Microsoft Windows XP and Microsoft Windows Server 2003.

Hidden Install

Hidden Install is the process of installing a malicious program or running executable files without notifying the user of such. A hidden install process can be detected using standard tools, such as Microsoft Windows Task Manager, but since there are no standard installation windows on screen when the malicious program is installed, it is unlikely that a user would think to track the processes running in the system.

Hidden Object

Hidden Object is a process that standard tools (Microsoft Windows Task Manager, Process Explorer, etc.) cannot detect. A rootkit, in other words, a toolkit for gaining root user rights, is a program or set of programs for hidden control of a hacked system. This term came from UNIX.

Within Microsoft Windows, "rootkit" generally refers to a program used to mask software that is installed on the system and intercepts and distorts system messages about the processes running in the system and the folders on drives. In other words, a rootkit works like a proxy server, letting some information through and blocking or distorting other information. In addition, rootkits can generally mask the presence in the system of any processes, folders and files on disk, and registry keys described in its configuration. Many masking programs install their drivers and services in the system, which are naturally invisible to system administration tools like Task Manager or Process Explorer, as well as to anti-virus programs.

Root Shell

This vulnerability consists of rerouting input/output of the command prompt (usually to the network), which generally is used to gain remote access to a computer.

The malicious object attempts to gain access to the command line on the victim computer from which future commands will be executed. Access is usually gained through a remote attack and running a scripted that takes advantage of this vulnerability. The script launches a command line interpreter on the computer connected via TCP. The hacker can then control the system remotely.

Starting Internet Browser

Browsers can be started hidden and data can be sent to it for hackers to exploit later. Monitoring browsers being opened enables you to intercept this.

Browsers are usually opened with settings containing, for example, user passwords, whenever he/she clicks a link in the body of an e-mail in a mail client or an instant messaging program, which is not a suspicious action. If you add a mail client and ICQ to the trusted zone, meaning if you allow only certain programs to open browser windows with settings, all other cases when data is transmitted through a browser from a hacker and not the computer user will may be assessed as suspicious.

Strange Behaviour

This refers to detection not of dangerous or suspicious behaviour of a specific process but of a change in state of the operating system itself, such as direct memory access or modification of an R0-R3 access point.

Dangerous behavior detected (generic behavior)

This group of malicious action detectors includes Trojan.generic, Worm.generic, and Worm.P2P.generic, fairly complex algorithms for detecting dangerous behavior. A verdict is issued that a certain process is most likely an unknown malicious process based on analysis of a set of actions, not on one or two factors. The Generic verdict is not assigned the first time a suspicious action is attempted. Each time a suspicious action is made, the suspicion rating of the process rises. Proactive Defense processes it as soon as it reaches a critical level. This method ensures an extremely low level of false positives. The likelihood of a good program displaying several aspects of malicious activity immediately is extremely low.

Actions that affect the suspicion rating:

  • actions typical of infections or malicious objects injecting into the system;
  • directly malicious actions;
  • actions typical of replicating malicious objects.

Application Changed

This event signifies that the executable file of the monitored application has been modified since it was last run. It should be pointed out that an executable file could have been modified by malicious code injecting itself into the application or by a standard program update, such as the executable file for Microsoft Internet Explorer being modified by Microsoft Windows updates.

Integrity Violation

An integrity violation is when one or several modules of a monitored application could have been modified since the time the application was last run. It could have been modified by program updates and not only by malicious code injecting itself into the application (for example, the libraries used by Microsoft Internet Explorer could be modified by a Microsoft Windows update).

Critical Application

The Application Integrity Control module has an additional feature for monitoring application start. In this mode, Kaspersky Internet Security issues a warning whenever an application specified by the user is started. The warning only appears if the rule Run: Prompt for action is configured for the monitored application. This mode is disabled by default.

Running as child

There are a number of malicious programs that use well known programs to create data leaks or to download malicious code from the Internet. To do so, the malicious program opens a standard program that the firewall rules and other defense tools grant access to the Internet (a web browser, for example). When this happens, the monitored application is run as a child process.

The warning only appears if the rule Run child process: Prompt for action is configured for the monitored application . Since some programs are run by others child processes, the event is common enough that by default warnings are not displayed for these events, although the events are logged in Proactive Defense operation reports.

Hosts file modification

The hosts file is one of the most important system files of Microsoft Windows. It is designed to redirect access to websites by transforming URL addresses into IP address on the DNS servers, but right on the local computer. The hosts file is a plain text file, with each line defining the correlation between the character name of a server (URL) and its IP address.

Malicious programs often use this file to redefine anti-virus update server addresses to block any chance of updating and preventing the malicious program from being detected, and for other ends as well.

Invader / Loader

There are countless varieties of malicious programs that are masked as executable files, libraries, or plug-ins for well-known programs and load themselves into standard processes. A data leak from the user's computer can be orchestrated in this way. Network traffic initiated by malicious code will pass through the firewall freely, since the firewall thinks that this traffic belongs to an application that is allowed to access the Internet.

Trojans commonly invade other processes. However, a number of benign programs, updates, and installer programs also exhibit this behavior. You should only allow this type of activity if you are certain that the program being load is harmless.

Keyloggers

Keyloggers are programs that record every key you press on your keyboard. This type of malware can send information harvested from the keyboard (logins, passwords, and credit card numbers) to a hacker. However, standard programs can also log keys. Keylogging is often used to call up program functions from different applications using hotkeys.

Registry access

Registry access tracks modifications to registry keys.

Malicious programs modify the registry to register themselves so they start automatically when you start your operating system, to change your homepage in Microsoft Internet Explorer, and other destructive actions. However, remember that standard applications might also access the system registry.

The module contains a predefine list of six groups of critical keys. Users may also add their only groups of keys and configure rules for various programs to access them.

Registry strange

The module enables you to intercept attempts to create hidden keys in the registry that are not displayed by standard programs, such as regedit. Keys are created with incorrect names so that the registry editor cannot display these values correctly, which makes it more difficult to diagnose malicious software in the system.

Trojan downloader

Trojan Downloader is a program with the chief function of hiding unauthorized downloads of software from the Internet. Hacker sites are the best known source of Trojan Downloaders. A Trojan downloader is not a direct threat on its own. They are dangerous namely because they download and start software uncontrolled. Trojan Downloaders are mostly used for downloading and running viruses, Trojans, and spyware.


Protection against advertising and Internet-fraud

Protection against Internet-fraud

Recently, malware has come to include more and more programs that aim to:
  • steal your confidential information (passwords, credit card numbers, important documents, etc.)
  • track your actions on the computer and analyze the software installed on it
  • gain unauthorized access to the Internet from your computer to various websites
Phishing and keyboard interceptors focus on stealing your information; autodialers, joke programs, and adware can eat up your time and money. Protecting you from these programs is what Privacy Control is designed to do.
Privacy Control includes the following modules:
  • Anti-Phishing protects you from phishing.
    • Phishing generally consists of e-mails from would-be financial institutions that contain links to their websites. The message text convinces the reader to click the link and enter confidential information in the window that follows, for example, a credit card number or a login and password for an Internet banking site where financial operations can be carried out.
    A common example of phishing is an e-email from a bank that you use with a link to the official site. By clicking the link, you go to an exact copy of the bank's website and can even see the real address in the browser, even though you are actually on a counterfeit site. From this point forward all the actions you take on the site are tracked and can be used to steal your money.
    You might receive a link to a phishing site through an e-mail or by different means, such as an ICQ message. Anti-Phishing tracks attempts to open phishing sites and blocks them.

    Kaspersky Internet Security threat signatures include all the sites currently known to be used for phishing. The Kaspersky Lab specialists replenish it with addresses obtained from the Anti-Phishing Working Group, an international organization. You fill this list by updating application databases.

  • Anti-Dialer protects you from unauthorized attempts to make connections through your modem.

    • Dialers generally establish connection with specific websites, such as sites with pornographic material. Then you are forced to pay for expensive traffic that you never wanted or used. If you want to exclude any number from the blocked list, you must place it on the trusted numbers list.

  • The Protection of confidential data module intercepts attempts at unauthorized transmission of confidential data from your computer.

    Confidential information includes, above all, data located in Windows Protected Storage (local passwords, e-mail client passwords, Auto-Complete information, etc.).

    In addition, this Privacy Control module analyzes any attempt to transmit information from your computer using a hidden process, such as a web browser.

Also see:

Privacy Control status

Pausing / disabling Privacy Control

Configuring Privacy Control

Privacy Control statistics


Privacy Control status

To view current component status, select the [image] Privacy Control under Protection in the left pane of the application main window. You will see composite information in the right-hand part of the screen on module operation.

The most important is the Privacy Control status:

  • Privacy Control : running - protection on your computer is enabled against Internet scams. You will see this status if at least one of the modules is running.
  • Privacy Control : paused - protection from Internet theft is disabled for a certain period of time. The component will resume operations automatically after the assigned period has expired or after restarting the program. You can also enable Privacy Control manually. To do so click Resume operation .
  • Privacy Control : disabled - the component has been stopped by the user. You can enable Privacy Control. To do so click Enable.
  • Privacy Control : malfunction - Privacy Control is not available for some reason.
  • Privacy Control : running (subsystem malfunction) - the component encountered an error.
    • If a component encounters an error, try restarting it . If restart should result in an error, review component report which might contain the reason for the failure . If you are unable to troubleshoot the issue on your own, save the component report to a file using Action → Save As and contact Kaspersky Lab Technical Support.
Component status is followed by information on whether Privacy Control modules (Anti-Phishing, Anti-Dialer, and Protection of confidential data) are running. To edit current component settings, click Configure.

Certain computer Internet fraud protection statistics are displayed in the main window : number of detected attempts to open phishing web sites and to dial out to premium-rate telephone numbers. Use the Open Report link to view a detailed report on the component's current performance .

If for some reason the component is paused or stopped at a given moment in time, its results at the time of deactivation may be viewed by clicking Open Last Start Report.


Pausing / disabling Privacy Control

By default, your computer's protection against Internet scams is enabled. You can pause Privacy Control or disable it for a certain length of time or completely. You can also disable individual the component modules.
Let's look at the ways to disable Privacy Control in more detail.
To pause Privacy Control,

select [image] Privacy Control in the Protection section of the main window and use Pause link.

The component status will change to paused. Protection will be paused until you restart the program or enable the component using the Resume operation link.

When you pause Privacy Control, the component statistics for the current Kaspersky Internet Security session are saved and will continue to be recorded after the component is updated.

To stop Privacy Control,

select Privacy Control under Protection in the main window and use the Stop link. The component status will be changed to Disabled. The component will be disabled till you click Enable link.

Privacy Control and its individual modules may also be disabled using the application settings window . Select [image] Privacy Control under Protection and uncheck [image] Enable Privacy Control or uncheck the individual modules that you want to disable .

Please remember that for Privacy Control to function at least one module must be running.

When you stop Privacy Control, all the statistics from previous work are cleared and when the component is started they are recorded over.

Warning!
Remember that if you disabled Privacy Control in the settings window, it will not automatically be enabled after restarting the program. To restore Internet fraud protection, you must check [image] Enable Privacy Control.
By disabling Privacy Control in the main window, the component status changes to disabled, and the component list in the Protection section its name will go inactive (gray).
Protection against Internet-fraud can also be disabled by fully disabling protection on your computer.


Configuring Privacy Control

Protection against Internet-fraud is provided taking into account all the programs known to Kaspersky Lab specialists that could steal your confidential information or your money. You can configure the component more specifically by:
  • Creating trusted telephone number list for dial-up connections that you allow
  • Configuring settings for protection from confidential data theft.


Creating an Anti-Dialer trusted number list

The Anti-Dialer module monitors telephone numbers used to secretly connect to the Internet. A connection is considered secret if it is configured not to inform the user of the connection or if it is a connection that you do not initialize.
Whenever a secret connection is attempted, the program notifies you by issuing special message on the screen. You must decide to allow or block it in that notice. If you did not initialize that connection, it is highly likely that this is due to a malicious program.
If you want to allow connections to certain numbers without the program asking you, you must add them to the trusted number list. To do so:

  1. Open the application settings window and select [image] Privacy Control under Protection .

  2. Check [image] Enable Anti-Dialer and click Trusted Numbers under Anti-Dialer .

  3. Click [image] Add in the resulting dialog . Specify number or number mask to be allowed in the New Phone Number window.

The new exclusion will be added to the beginning of the trust number list. To stop using the number exclusion that you have added, just uncheck the box [image] next to it on the list. If you want to remove an exclusion entirely, select it on the list and click Delete.

Also see:

Adding a new number


Adding new numbers

Use this window to add a new number to the Anti-Dialer trusted number list. To do so, enter a number or a mask for numbers that you do not want to block connections with.

Tip:
When entering a trusted number mask, you can use the characters * or ?.
For example, 8???79787* will cover any numbers beginning with 79787 and the area code is three digits.

Click OK button for the changes to take effect. To exit the window without applying the changes, click Cancel.

Also see:

Creating an Anti-Autodialer trusted number list


Protection of confidential data

Privacy Control includes a Protection of confidential data module that keeps your confidential information secure from unauthorized access and transmission.

To enable the modules, select [image] Enable Protection of confidential data in the Privacy Control settings window.

This module controls the following methods of accessing confidential data:

  • Attempt to send personal data through WebBrowser component.

    • To send data with this method, malicious code runs a hidden process on your computer, generally a web browser, such as iexplorer.exe. Since the firewall always allows the activity of these programs, the appearance of such a process is nothing to signal of a potential threat. This process serves as transport for sending any data from your computer via http. The data are extracted from the corresponding file and are encrypted for transmission.
  • Attempt to access personal data or passwords located in Protected Storage.

    • This Microsoft Windows feature stores secret data, such as local passwords, POP and SMTP e-mail passwords, Internet access passwords, passwords for automatic login to secure areas of websites, web data, passwords for Auto-Complete, etc.

    This data is entered in the corresponding files of mail clients and browsers. You generally have the option of saving the data in these input field. You must select a checkbox to do so. In such a case, Windows saves the data entered in Protected Storage.

    It should be noted that even users who guard against data leaks from Protected Storage and for that reason do not save passwords and data in browsers usually save e-mail passwords, since entering them every time you send or receive e-mail would take too much time. Taking into account that ISPs often have the save Internet access and e-mail passwords, retrieving it might provide access both to your inboxes and your Internet connection.

    Data from Protected Storage can be extracted using special spyware and then be send to hackers. To prevent this, the Protection of confidential data module notifies you of each attempt to read data from Protected Storage by an application that is not digitally signed by Microsoft Corporation. Depending on whether you trusted the application attempting to access data from Storage, you can allow or block execution of this operation.
To configure settings for Protection of confidential data, take the following steps:
  1. Open the application settings window and select [image] Privacy Control under Protection .
  2. Check [image] Enable Protection of Confidential Data and click Settings under Protection of Confidential Data .

In the [image] Settings : Protection of Confidential Data window, select the checkboxes across from the events that the module should monitor. To stop monitoring an event, deselect the checkbox next to its name in the list.

To edit a rule for monitoring access to confidential data, select it from the list and assign the settings for the rule in the lower part of the window:

  • Define Protection of confidential data module response.

    You can assign any of the following actions as a response: block, allow, prompt for action, and terminate process. Left-click on the link with the action until it reaches the value that you need. In addition to stopping the process, you can quarantine the application attempting to access the data. To do so, use the On / Off link across from the appropriate setting.
  • Choose if you want to generate a report on the operation carried out. To do so, use the On / Off link.


Privacy Control statistics

Certain current component statistics (number of detected attempts to download phishing web sites and to dial out to premium-rate telephone numbers) are shown in the application main window . Select [image] Privacy Control under Protection to view.
To view a detailed component report, click Open Report (component currently running) or Open Last Start Report (component disabled).

A detailed description of all Privacy Control operations is given in the main part of the report. All events are sorted on various tabs depending on what Privacy Control module they were tracked with.

  • All objects classified as dangerous are collected in the Detected tab.
  • All phishing attempts are listed on the Phishing sites tab.
  • All malicious program attempts to connect to paid websites are recorded on the Dial attempts tab.
  • All attempts to access or send personal data are listed on the Data transfer attempts.

You can select the type of information on each report tab, sort it in ascending and descending order for each of the columns, and search for information in the report. To do so, use the options on the context menu, which you can open by right-clicking on the report column headings.


The Phishing sites tab

The Phishing tab

This Privacy Control report tab displays all phishing attempts carried out during the current Kaspersky Internet Security session. The report lists a link to the phishing site detected in the e-mail or however it was delivered to you, the date and time that the attack was detected, and the attack status. (whether it was blocked).
If you want to delete the phishing attack addresses listed in the report, click Actions → Clear all.


The Dial attempts tab

This tab displays all secret dial attempts to establish connections to paid Internet sites. Such attempts are generally carried out by malicious programs installed on your computer.
In the report, you can view what program attempted to dial the number to connect to the Internet and the attempt status: blocked or allowed for some reason.

To delete the information given in the report, click Actions → Clear all.


The Data transfer attempts tab

The Data transfer attempts
tab

This Privacy Control report tab displays all attempts to gain access to your confidential data and attempts to transmit it. The report indicates what program module attempted to transmit the data, which the event was logged, and the action that the program took.

If you want to delete the information cited in the report, click Actions →Clear all.


Firewall

Today computers have become quite vulnerable when on the Internet. They are subjected not only to virus infections but other types of attacks as well that take advantage of vulnerabilities in operating systems and software.
Kaspersky Internet Security contains a special component, Firewall, to ensure your security on local networks and the Internet. It protects your computer on the network and application level and masks your computer on the net to prevent attacks. Let's take a closer look at how Firewall works.
You are protected on the network level by using global packet filtration rules where network activity is allowed or blocked based on analyzing settings such as packet direction, the data packet transfer protocol, and the outbound packet port. Rules for data packets establish access to the network, regardless of the applications installed on your computer that use the network.
In addition to the packet filtration rules, the Intrusion Detection System (IDS) provides additional security on the network level. The goal of the system is the analyze inbound connections, detect port scans on your computer, and filter network packets aimed at exploiting software vulnerabilities. When running, the Intrusion Detection System blocks all inbound connections from an attacking computer for a certain amount of time, and the user receives a message stating that his computer underwent an attempted network attack.
The Intrusion Detection System is based on using a special network attack database in analysis, which is regularly supplemented by Kaspersky Lab's specialists. It is updated along with the threat signatures.
Your computer is protected on the application level by applying application rules for using network resources to the applications installed on your computer. Like the network protection level, the application protection level is built on analyzing data packets for direction, transfer protocol, and what ports they use. However, on the application level, both data packet traits and the specific application that sends and receives the packet are taken into account.
Using application rules helps you to configure more specific protection when, for example, a certain connection type is banned for some applications but not for others.
There are two Firewall rule types, based on the two Firewall protection levels:
  • Rules for packet filtering. Used to create general restrictions on network activity, regardless of the applications installed. Example: if you create a packet rule that blocks inbound connections on port 21, no applications that use that port (an ftp server, for example) will be accessible from the outside.
  • Rules for applications. Used to create restrictions on network activity for specific applications. Example: If connections on port 80 are blocked for each application, you can create a rule that allows connections on that port for Firefox only.
There are two types of rules for applications and rules for packet filtering: allow and block. The program installation includes a set of rules that regulate network activity for the most common applications and using the most common protocols and ports. Kaspersky Internet Security also includes a set of allow rules for trusted applications whose network activity is not cause for suspicion.
Kaspersky Internet Security breaks down the entire network space into security zones to make settings and rules more user-friendly, which largely correspond to the subnetworks that your computer belongs to. You can assign a status to each zone (Internet, Local Area Network, Trusted), which determine the policy for applying rules and monitoring network activity in that zone.

A special feature of Firewall, Stealth Mode, prevents the computer from being detected from the outside. Thus the hackers lose the object of attack. This mode does not affect your computer's performance on the Internet (under condition that your computer is not used as a server).

In addition, Firewall includes two modules : Anti-Publicity and Anti-Banner, which filter traffic for persistent advertising . Recently, a multitude of programs emerged to display various advertisements in browser windows, popup windows, and various software banners. These programs are not a direct threat; however, they increase network traffic, cause users to waste time, and to suffer damages .

Also see:

Firewall status

Pausing / disabling Firewall

Filtration system

Configuring Intrusion Detector

Anti-Publicity

Anti-Banner

Types of network attacks

Viewing Firewall statistics


Firewall status

To view current component status, select [image] Firewall under Protection in the left pane of the main application window. Summary information on firewall modules will be shown on the right.
Firewall status is the most important parameter
  • Firewall : running - network protection is enabled. This component status indicates that at least one module (Filtration System, Intrusion Detection System, Anti-Publicity, or Anti-Banner) is enabled .
  • Firewall : Paused – component (component modules) suspended for a period of time. Component will restart automatically on application restart . You can also enable Firewall manually. Click Resume operation.
  • Firewall : disabled - the component has been stopped by the user. You can enable network protection. Click Enable.
  • Firewall : malfunction - protection from network attacks, monitoring of network activity on your computer, and Stealth Mode are not available for some reason.
  • Firewall : running (subsystem malfunction) - the component encountered an error.
    • If a component encounters an error, try restarting it. If restart should result in an error, review component report which might contain the reason for the failure. If you are unable to troubleshoot the issue on your own, save the component report to a file using Action → Save As and contact Kaspersky Lab Technical Support .
Component status is followed by Traffic Filtration system security level and information on whether the other Firewall modules are running, such as the Intrusion Detection System, Anti-Publicity, and Anti-Banner. To edit current Firewall settings, click on Configure.

Certain network protection statistics are displayed in the main window : number of network attacks, connections, popup ad windows, and banners blocked during current component session . Use the Open report link to view a detailed report on the component's current performance
If for some reason a component is paused or stopped at a given moment in time, its results at the time of deactivation may be viewed by clicking Open last start report.

The lowermost section of the main window shows the total volume of outgoing and incoming traffic for the current day. To view detailed information on all your computer's current connections and open ports, as well as on the amount of incoming and outgoing traffic showing the IP address of hosts your computer is talking to, click View current network activity.


Pausing / disabling Firewall

Network attack protection, network traffic monitoring, popup and banner blockers are enabled on your computer by default. You can pause Firewall and its modules, disable it for a time, or completely stop it.
Here we will examine the methods for disabling the component in greater detail.
To pause Firewall,

select [image] Firewall in the Protection section of the main window and use the Pause link .

The component status will change to paused. Network monitoring, network attack, popup, and banner blockers as well as invisible mode will remain suspended until the application is restarted or until Resume operation is clicked.

When you pause Firewall, the component statistics for the current Kaspersky Internet Security session are saved and will continue to be recorded after the component is updated.

To stop Firewall,

select Proactive Defense under Protection and click Stop. In this case, the component status will change to disabled. All component modules will be disabled until you enable the component with the Enable link.

Firewall and its individual modules may also be disabled using the application settings window . Select [image] Firewall under Protection and uncheck [image] Enable Firewall or uncheck the individual modules that you want to disable .

When you stop Firewall, all the statistics from previous work are cleared and when the component is started they are recorded over.

Warning!
Remember that if you disabled Firewall in the settings window, it will not automatically be enabled after restarting the program. To resume network protection, you must check [image] Enable Firewall.
Stopping Firewall will change the component's status in the main application window to disabled and make its name inactive (grayed out) in the Protection section component list.
Firewall can also be disabled by fully disabling protection on your computer.
Kaspersky Lab specialists do not recommend fully disabling Firewall. If the component is in any way interfering with your work, you can:
  • lower the protection level
  • stop using rules for applications and packets
  • disable any of the Firewall modules: Packet Filtering System , which monitors all network activity on your computer, Intrusion Detection System , which protects from network attacks, Anti-Publicity , which acts as a popup blocker, or Anti-Banner , which prevents banners from displaying. To accomplish this uncheck appropriate modules in the component configuration window .


Configuring Firewall

While on a network, your computer is protected by the following Firewall modules:

  • Filtering System which filters incoming and outgoing traffic at the network (packet) and application (program) levels.

    Traffic is filtered based on the configured security level and a continuously updating database of allow and deny rules. To simplify rule configuration and application, the entire global network is partitioned into security areas depending on the associated risk.
  • Intrusion Detection System which protects your computer from all currently known network exploits. The database is continuously updated by Kaspersky Lab specialists and updates are downloaded together with the application databases.
  • Anti-Publicity module which is a popup blocker.
  • Anti-Banner module which is a banner blocker.

All Firewall modules are enabled by default. Firewall or its individual modules may be disabled and configured. To accomplish this:

open the application settings window and select [image] Firewall under Protection. To activate the Firewall component, check [image] Enable Firewall. Individual modules may be enabled / disabled and fine-tuned in the appropriate areas of the settings window.


Configuring the filtration system

Filtration system

Filtration system is a Firewall module that protects your computer while on the Internet. This module filters inbound and outbound traffic on the network/packet and application levels. Traffic is filtered using an updateable database of "allow" and "block" rules. To make configuring and applying rules easier, all network space is divided into security zones depending on the degree of risk they pose.

You can configure the following settings for the Filtration system:

  • Level of protection from network attacks
  • Application rules
  • Packet filtering rules
  • Rules for security zones
  • Firewall mode


Selecting the Firewall protection level

Selecting security level

When you use the network, Kaspersky Internet Security protects your computer on one of the following levels:
    Block all - a security level under which all network activity on your computer is blocked. If you select this protection level, you will not be able to use any network resources or programs that require a network connection. We recommend that you only select this level in the event of a network attack or when using an insecure network.
    High security - a security level under which the only network activity allowed is activity for which an allow rule exists. Firewall uses preconfigured or user defined rules . The set of rules included with Kaspersky Internet Security includes allow rules for applications whose network activity is not suspicious and for data packets that are absolutely safe to send and receive. However, if there is a block rule in the list of rules for an application with higher priority than the allow rule, the program will block the network activity of that application.
    Warning!
    If you select this protection level, any network activity not recorded in an Firewall allow rule will be blocked. Therefore we recommend only using this level if you are certain that all the programs that you need are allowed by the rules and that you do not plan on installing new software.
    Training mode - security level where Firewall rules are created. On this level, every time a program attempts to use a network resource, Firewall checks to see if there is a rule for that connection. If there is a rule, Firewall follows its instructions. If there is no rule, a message will appear on the screen. It will contain a description of the network connection (what program initiated it, what port, the protocol, etc.). You must decide whether you should allow this connection or not. Using a special button in the message window, you can create a rule for that connection so that in the future Firewall will use the conditions in the rule for that connection without warning you on screen.
    Low Security - a security level under which only explicitly prohibited network activity is blocked . Firewall in accordance with block rules included with the program or that you have created. However, if there is a allow rule in the list of rules for an application with higher priority than the block rule, the program will allow the network activity of that application.
    Allow all - a security level under which all network activity on your computer is allowed . We recommend setting protection to this level in extremely rare cases when no active network attacks have been observed and you fully trust all network activity.
You can raise or lower the network protection level by selected the level you want or changing the settings for the current level.
In order to modify the network security level,
  1. Open the application settings window and select [image] Firewall under Protection .
  2. Move slider under Filtration System on the right
In order to configure the network security level,
  1. Select a security level closest to your preferences .
  2. Click on Settings under Filtration System and edit Filtration System settings in the [image] Settings: Firewall dialog.
Also see:

Rules for applications

Rules for packet filtering

Rules for security zones

Allowing and blocking network activity

Configuring Intrusion Detector

Firewall mode


Rules for applications

Kaspersky Internet Security includes a set of rules for the most common Microsoft Windows applications. You can create several permissions and block rules for the same program. These would generally be programs with network activity that has been analyzed in detail by Kaspersky Lab specialist and is strictly defined as dangerous or safe.
Depending on the security level selected for the Firewall and the type of network the computer is running on, the list of rules for programs can be used in various ways. For example, with High Security all application network activity that does not match the allow rules is blocked.
To work with the application rule list,
  1. Open the application settings window and select [image] Firewall under Protection .
  2. Click on Settings under Filtration System .

  3. In the Settings : Firewall window, select the [image] Rules for Applications tab.
All the rules on this tab can be grouped in one of the following ways:
  • Rules for applications. If [image] Group rules by application is checked, that is how the list of rules will be displayed. The tab will contain a list of applications for which rules have been created. The following information is given for every application: name and icon of the application, command prompt, root directory where the application's executable file is, and the number of rules created for it.
    • Using the Edit button, you can go to the list of rules for the application selected on the list and edit it: add a new rule, edit existing ones, and change the rank of their priority.
    Using the Add button, you can add a new application to the list and create a rule for it.
    The Export and Import buttons are designed to carry over the rules created to other computers. This helps to configure Firewall quickly.
  • General list of rules without grouping by application name. You can display the list of rules in this manner by unchecking [image] Group rules by application. The general list of rules displays complete information on a rule: in addition to the application name and command for starting it, the action of the rule is displayed (allow or block network activity), the data transfer protocol, direction of data (inbound or outbound), and other information.
    • Using the Add button, you can create new rules, and you can edit a rule selected on the list with the Edit button. You can also edit the basic settings in the lower part of the tab.
    You can change their priority ranking with the Move Up and Move Down buttons.
Also see:

Creating rules manually

Creating rules with templates

Fine-tuning rules for applications and packet filtering

Rules for packet filtering

Rules for security zones

Firewall mode


Creating rules manually

To create an application rule manually,
  1. Select the application. To do so, click the Add button on the [image] Rules for Applications tab. This will display a context menu which will take you to a standard file selection dialog through its Browse option or to a list of running applications through its Applications option allowing you to make your selection . A list of rules for the application selected will open. If rules for it already exists, they will all be listed in the upper part of the window. If no rules exists, the rules window will be empty.
  2. Click Add in the rule window for the selected application.
The New rule window that opens has a form that you can use to fine-tune a rule.
Also see:

Creating rules with templates


Creating rules with templates

The program includes ready-made rule templates that you can use when creating your own rules.

The entire gamut of existent network application can be broken down into several types: mail clients, web browsers, etc. Each type is characterized by a set of specific activities, such as sending and receiving mail, or receiving and displaying html pages. Each type uses a certain set of network protocols and ports. This is why having rule templates helps to quickly and easily make initial configurations for rules based on the type of application.

To create a rule for an application using a template,
  1. On the [image] Rules for Applications tab check [image] Group Rules by Application if unchecked and click Add .
  2. This will display a context menu which will take you to a standard file selection dialog through its Browse option or to a list of running applications through its Applications option allowing you to make your selection . This will open a rules window for the selected application . Rules for the application will be displayed in the top part of the window . If there are no rules, the window will be empty .

  3. click Template in the rules for applications window and select one of the rule templates from the context menu.
    4. Allow all is a rule that allows any network activity for the application. Block all is a rule that blocks any network activity for the application. All attempts to initiate a network connection that the application for which the rule is create makes will be blocked without notifying the user.

    Other templates listed on the context menu create rules typical for the corresponding programs. For example, the Mail client template creates a set of rules that allow standard network activity for mail clients, such as sending mail.

  4. Edit the rules created for the application, if necessary. You can edit the action, direction of the network connection, remote address, ports (local and remote), and time range for the rule.
  5. If you want the rule to be applied to the application opened with certain settings in the command line, check [image] Command line and enter the string in the field to the right.
  6. If you do not want the Firewall to control modification of files belonging to the controlled application each time it attempts to reach the network, check [image] Do not monitor file modification flag.
The rule or set of rules created will be added to the end of the list with the lowest ranking priority. You can increase the priority ranking of the rule.
You can create a rule from the network activity detection alert window.
Also see:

Creating rule manually


Rules for packet filtering

Kaspersky Internet Security is delivered with a set of rules used by your computer to filter incoming and outgoing packets. You can initiate data packet transfer or an application installed on your computer can. The program includes rules for filtering packets which Kaspersky Lab specialists have thoroughly analyzed and defined as dangerous or safe.
Depending on the security level selected for the Firewall and the type of network the computer is running on, the list of rules can be used in various ways. For example, with High Security all packets that do not fall under an allow rule are blocked.
Important!

Note that rules for security zones have higher priority than blocking packet rules. So, for example, if you select the status Local Network, packet exchanges will be allowed, and so will access to shared folders regardless of blocking packet rules.

To work with the list of rules for packet filtering,
  1. Open the application settings window and select [image] Firewall under Protection .
  2. Click on Settings under Filtration System .

  3. In the Settings : Firewall window, select the [image] Rules for Packet Filtering tab.
The following information is given for every filtration rule: name of the rule, action (allow or block packet transfer), data transfer protocol, direction of the packet, and network connection settings used to transfer the packet.
If the name of the rule for packet filtering is checked, it will be used.
You can work with the rule list using the buttons to the right of the list.
To create a new packet filtration rule:

Click the Add button on the Rules for Packet Filtering tab.

The New Rule window that opens has a form that you can use to fine-tune a rule.
Also see:

Rules for applications

Rules for security zones

Firewall mode


Fine-tuning rules for applications and packet filtering

The New Rule window for advanced rule settings is practically identical for applications and data packets.

Step One is:

  • Entering a name for the rule. By default the program uses a standard name that you can replace.
  • Selecting network connection settings with which the rule will act: remote IP-address, remote port, local IP-address, local port, and time when the rule is active. Check all the settings that you want to use in the rule.
  • Configuring other settings that are responsible for informing the user that the rule has been applied. If you want a pop-up message to appear on the screen when a rule is used with brief commentary on it, check [image] Notify User. If you want the program to record information about rule performance in the Firewall report, check [image] Log event. The box unchecked by default when the rule is created. We recommend that you use additional settings when creating block rules.
    • Note that when you create a blocking rule in the Firewall training mode, information about the rule being applied will automatically be entered in the report. If you do not need to record this information, deselected the Log event checkbox in the settings for that rule.

Step two in creating a rule is assigning values for rule parameters and selecting actions. These operations are carried out in the Rule description section.

The action of every rule created is allow. To change it to a block rule, left-click on the Allow link in the rule description section. It will change to Block.

Kaspersky Internet Security will still scan network traffic for programs and packets for which an allow rule as been created. This could result in data being transmitted more slowly.

If you are creating a rule for an application and did not select the application prior to creating the rule, you will need to do so by clicking select application. Left-click on the link and, in the standard file selection window that opens, select the executable file of the application for which you are creating the rule.

Then you must determine the direction of the network connection for the rule. The default value is a rule for a both inbound and outbound network connection. To change the direction, left-click on incoming and outgoing and select the direction of the network connection in the window that opens.

Then you must set the protocol that the network connection uses. TCP is the default protocol for the connection. If you are creating a rule for applications, you can select one of two protocols, TCP or UDP. To do so, left-click on the link with the protocol name until it reaches the value that you need. If you are creating a rule for packet filtering and want to change the default protocol, click on its name and select the protocol you need in the window that opens. If you select ICMP, you may need to further indicate the type.

If you selected network connection settings (address, port, time range), you will have to assign them exact values as well.

The rule created will be added to the beginning of the list with top priority. You can lower the priority ranking of the rule.

After the rule is added to the list of rules for the application, you can perform its additional configuration:

  • If you want the rule to be applied to the application opened with certain settings in the command line, check [image] Command line and enter the string in the field to the right. The rule will not be applied to the applications, started with different command line settings.
  • If you do not want the Firewall to control modification of files belonging to the controlled application each time it attempts to reach the network, check [image] Do not monitor application files modification flag.
You can create a rule from the network activity detection alert window.

Also see:

Selecting the connection direction

Defining the network connection address

Selecting a data transfer protocol

Defining the connection port

Defining the rule time range

Determining your ICMP packet type


Selecting the connection direction

One of the properties for rules for applications and packet filtering is network connection direction. A rule can apply to the network activity directions:
Inbound stream. The rule is applied to network connections opened by a remote computer.
Inbound packet. The rule applies to data packets received by your computer, with the exception of TCP packets.
Inbound and Outbound streams. The rule is applied to inbound and outbound traffic regardless of what computer, yours or a remote computer, initiated the network connection.
Outbound stream. The rule is only applied to network connections opened by your computer.
Outbound packet. The rule applies to data packets transferred from your computer, with the exception of TCP packets.
If it is important for you to specifically set the direction of packets in the rule, select whether they are inbound or outbound packets. If you want to create a rule for a stream of data, select stream: inbound, outbound, or both.
The difference between stream direction and packet direction is that when you create a rule for a stream, you define what direction the connection is opened in. The direction of packets when transferring data on this connection is not taken into consideration.
For example, if you configure a rule for data exchange with an FTP server that is running in passive mode, you must allow an outbound stream. To exchange data with an FTP server in active mode, it is necessary to allow both outbound and inbound streams.
To change the direction of the data stream, left-click inbound and outbound in the rule creation window and in the Direction window that opens select one of the directions listed.
Also see:

Defining the address of a network connection

Selecting a data transfer protocol

Defining a port for a connection

Defining a rule's time range

Determining your ICMP packet type


Defining the network connection address

If you selected a remote or local network IP address as a rule setting, you will need to specify a value that will trigger the rule. To do so, left-click the Specify IP address link in the rule creation window. In the Specify addresses window that opens, select the IP address type, the TCP/IP version used in your network, and configure settings.
For a computer with a static IP address, you can specify its value in the rule or the character-based name of the computer (in such a case the IP address is determined automatically). To do so, select [image] IP address and enter its value in the IP Address / Symbol Name field.
Please note that the address format for IPv6 is different from that used by Version 4. Example: 2001:db8::1234:5678.
If you want to create a rule for a range of IP addresses, select [image] Range of IP addresses. Enter the first address in the Begins at field and the last in the Ends on field.
If the rule is created for a connection with a computer without a static IP address, you can use the address or mask of the subnetwork in the rule. To do so, select [image] Subnetwork address and specify the subnetwork address and/or mask in the corresponding fields. When IPv4 is selected, specify an address and a subnet mask. The new protocol version has subnet addresses consisting of the address itself and a prefix length, such as, 2001:0db8:: / 64 . In this instance, 2001:0db8:: is the network address and 64 is the prefix length which is an indication of how many first bits of the address are significant. Prefixes may be between 1 and 128 bits. Standard local area network prefix length is 64.
Please note that a Windows environment variable may be used in lieu of an IP address in a packet rule.
You can use one type of IP address or several types for one rule. You can assign several addresses for each type. To do so, create a List of addresses in the lower potion of the window using the Add and Delete buttons.
Also see:

Defining the direction of a network connection

Selecting a data transfer protocol

Defining a port for a connection

Defining a rule's time range

Determining your ICMP packet type


Selecting a data transfer protocol

One of the properties for rules for applications and packet filtering is the data transfer protocol for the network connection. TCP is used for both applications and packets by default when a rule is created.
To change the data transfer protocol, left-click on the name of the protocol in the rule creation window.
Also see:

Defining the direction of a network connection

Defining the address of a network connection

Defining a port for a connection

Defining a rule's time range

Determining your ICMP packet type


Defining the connection port

When configuring rules, you can assign values for remote and local ports.
Remote port - port of a remote computer for connection.
Local port - a port on your computer.
To do so, left-click on specify port in the rule creation window. In the Specify port window that opens, enter the value or the port or a range of ports.
Local and remote ports for data transfer are correctly defined when a rule is created directly from a notice on suspicious activity. This information is recorded automatically.
Also see:

Defining the direction of a network connection

Defining the address of a network connection

Selecting a data transfer protocol

Defining a rule's time range

Determining your ICMP packet type


Defining the rule time range

You can assign each rule a time range over the course of the day for it to operate in. For example, you can block ICW from 9:30 am to 6:30 pm.
To do so, left-click specify time range in the rule creation window. In the Specify Time Range window that opens, enter the times for the rule in the From and Till fields.
Also see:

Defining the direction of a network connection

Defining the address of a network connection

Selecting a data transfer protocol

Defining a port for a connection

Determining your ICMP packet type


Selecting your ICMP packet type

ICMP (Internet Control Message Protocol) is used to inform the packet sender of errors or complicated situations that occur during data transfer.

If you select ICMP as the data transfer protocol in a packet filtration rule that you create, you can also specify the type of ICMP message.

For example, using the Ping utility that sends certain ICMP queries and receives replies to them, a hacker could learn if your computer is on or not. The program includes a rule that blocks ICMP queries and replies to them, which in turn prevents potential attacks on your computer.

Also see:

Defining the direction of a network connection

Defining the address of a network connection

Selecting a data transfer protocol

Defining a port for a connection

Defining the rule time range


Ranking rule priority

Each application or packet rule has an assigned execution priority . When other conditions are equal (for example, the network connection settings), the action applied to the program activity will be the rule with the higher priority.
The priority of a rule is determined by its position on the list of rules. The first rule on the list has the highest priority. Each rule created manually is added to the beginning of the list. Rules created using a template or from a special notice are added to the end of the list of rules.
To rank the priority of rules for application, take the following steps:
  1. Select the application's name on the [image] Rules for applications tab and click on Edit.
  2. Use the Move up and Move down buttons in the window that opens for rules created for applications to move rules on the list, thereby changing their priority ranking.
To prioritize rules for packet filtering, take the following steps:
  1. Select the rule on the [image] Rules for packet filtering tab.
  2. Use Move Up and Move Down buttons to move rules around in the list changing their priority.


Rules for security zones

After you install Firewall on your computer, it analyzes your computer’s network environment. Based on the analysis, the entire network space is broken down into conventional zone:

    Internet – the World Wide Web. In this zone, Kaspersky Internet Security operates as a personal firewall. In doing so, default rules for packets and applications regulate all network activity to ensure maximum security. You cannot change protection settings when working in this zone, other than enabling Stealth Mode on your computer for added safety.

    Security zones – certain conventional zones that mostly correspond with subnetworks that your computer is included on (this could be local subnetworks at home or at work). These zones are by default average risk-level zones when working in them. You can change the statues of these zones based on how much you trust a certain subnetwork, and you can configure rules for packet filtering and applications.

If Firewall Training Mode is enabled, a window will open every time your computer connects to some new zone, displaying a basic description about it. You must assign a status to the zone, and network activity will be allowed based on that status.

  • Internet. This is the default status assigned to the Internet, since when you are on it, your computer is subjected to all potential threat types. This status is also recommended for networks that are not protected by any anti-virus programs, firewalls, filters, etc. When you select this status, the program ensures maximum security while you are using this zone, specifically:
    • blocking any network NetBios activity within the subnetwork;
    • blocking rules for applications and packet filtering that allow NetBios activity within this subnetwork.
    Even if you have created a shared folder, the information in it will not be available to users from subnetworks with this status. Additionally, if this status is selected for a certain subnetwork, you will not be able to access files and printers of this subnetwork.
  • Local Network. The program assigns this status to all zones detected when it analyzes the computer’s network environment, except the Internet. It is recommended to apply this status to zones with an average risk factor (for example, corporate LANs). If you select this status, the program allows:
    • any network NetBios activity within the subnetwork;
    • rules for applications and packet filtering that allow NetBios activity within this subnetwork.
    Select this status if you want to grant access to a certain folder or printer on your computer but block any other outside activity.
  • Trusted. It is only recommended to apply this status to zones that in your opinion are absolutely safe where your computer is not subject to attacks and attempts to gain access to your data. If you select this status, all network activity is allowed. Even if Maximum Protection is selected and have created block rules, they will not function for remote computers from a trusted zone.
Note that any restrictions or access to files is only in effect without this subnetwork.

You can use Stealth Mode for added security when using networks labeled Internet. This feature only allows network activity initiated from your computer. This actually means that your computer becomes invisible to its surroundings. This mode does not affect your computer’s performance on the Internet.

We do not recommend using Stealth Mode if the computer is being used as a server (for example, a mail or http server). Otherwise, the computers that connect to the server will not see it as connected.

The list of zones that your computer is registered on is displayed on the [image] Zones tab. Each of them is assigned a status, a brief description of the network, and whether Stealth Mode is used.

Warning!

Networks with similar or wider address ranges may conceal other networks. Concealed networks can only be autodetectable. In the event that a network with a wider address range appears on the list, all concealed networks manually added by user will be removed. Any settings configured for the wider network will be inherited by concealed networks. In the event the wider network is removed, concealed networks separate and inherit current settings.

To change the status of a zone or to enable/disable Stealth Mode, select it from the list, and use the appropriate links in the Rule description box below the list. You can perform similar tasks and edit addresses and subnetwork masks in the Zone settings window, which you can open by clicking Edit.

You can add a new zone to the list while viewing it. To do so, click Browse. Firewall will search for potential zones for registration, and if any are detected, the program will ask you to select a status for them. In addition, you can add new zones to the list manually; for example, if you connect your laptop to a new network). To do so, use the Add button and fill in the necessary information in the Zone settings window.

To delete the network from the list, click the Delete button.

Also see:

Rules for applications

Rules for packet filtering

Firewall mode


Zone settings

You can find detailed information on each zone that your computer is registered on in the Zones window. This window is also displayed whenever a new zone is added manually (for example, when a portable computer is connected to a new network).

The Description field provides a summary of the zone. TCP/IP version and protocol settings are shown below. When a new zone is added automatically, these fields are populated by the application.

When adding a new zone manually, select TCP/IP version used by your network: 4 or 6 (more recent). When IPv4 is selected, specify an address and a subnet mask. The new protocol version has subnet addresses consisting of the address itself and a prefix length, such as, 2001:0db8:: / 64. In this instance, 2001:0db8:: is the network address and 64 is the prefix length which is an indication of how many first bits of the address are significant. Prefixes may be between 1 and 128 bits. Standard local area network prefix length is 64.

The program assigns each zone added the default Local network status. You can change the status by selecting the option you need. You can also use Stealth Mode when using zones labeled Internet.

Also see:

Rules for security zones


Firewall mode

Firewall mode governs this component's compatibility with software establishing multiple network connections and network games .

    Maximum compatibility – the Firewall mode ensuring that Firewall will work optimally with programs that establish multiple network connections (file-sharing network clients). However, this mode may lead to slow reaction time in network games. If you encounter such problems, it is recommended that you use High Speed.

    High speed – the Firewall mode ensuring the best possible reaction time during network games. However, file-sharing network clients or other network applications may experience conflicts with this mode. To solve the problem, disable Stealth Mode.

To select a Firewall mode:
  1. Open the application settings window and select [image] Firewall under Protection .
  2. Click the Settings button in the Filtration System area.

  3. Select the [image] Additional tab in the Settings : Firewall window and select the mode you want, Maximum Compatibility or High Speed.
Changes to the Firewall mode will not take effect until after Firewall has been restarted.


Configuring Intrusion Detector

All currently known network attacks to which computers are susceptible are listed in the Firewall databases which are a subset of the application databases . This list of attacks lies at the core of the Firewall Intrusion Detection System module . The list of attacks that Intrusion Detector can detect is updated in the signature update process.
Intrusion Detector tracks network activity typical of network attacks and if it detects an attempt to attack your computer, it blocks all network activity of that computer involving your computer for one hour. A warning will appear on the screen stating that an network attack attempt has taken place, with specific information about the computer which attacked you.
Intrusion Detection System may be configured . To do so:
  1. Open the application settings window and select [image] Firewall under Protection .
  2. Check [image] Enable Intrusion Detection System and specify whether the attacking computer is to be added to the blocked list and for how long . By default, the attacking computer will be blocked for 60 minutes . This time can be increased or decreased by modifying the value of the field located next to checkbox [image] Add attacking computer to the blocked list for … min. Uncheck this option if you do not want to block the attacking computer's network activity targeting your computer .

Also see:

Types of network attacks


Anti-Publicity

Anti-Publicity blocks access to internet resources containing advertising information such as popup windows.

Popup windows do not usually display useful information. These windows are opened automatically when a web site is first loaded or when a hyperlink is followed. They contain advertising and other information that you did nothing to request. Anti-Publicity blocks these windows and displays a special balloon message above the application icon in the taskbar notification area. This message may be used directly to block or allow the popup.

Anti-Publicity is compatible with the Microsoft Internet Explorer popup blocker bundled with Microsoft Windows XP Service Pack 2. The application installs a browser plug-in which controls the opening of popup windows in the browser directly.

There are some web sites which use popup windows for faster and more convenient access to information. If you access such sites frequently, and the information in such popup windows is critical, we recommend that you add them to the trusted site list. Popup windows at trusted sites will not be blocked.

When a popup is blocked during a Microsoft Internet Explorer session, the icon [image] is displayed in the browser status line. A popup may be unblocked or a site added to the trusted list by clicking the icon.


Creating an Pop-Up Blocker trusted address list

By default, the Anti-Publicity module blocks most self-opening popup windows . The exception is pop-up windows from websites added to the trusted site list in Microsoft Internet Explorer and Intranet sites that you are registered on at that moment.

If you are running Microsoft Windows XP with Service Pack 2, Internet Explorer already has its own pop-up blocker. You can configure it, selecting which windows in particular you want to block and which windows you do not. Anti-Publicity supports working with this blocker with the following principle: when a pop-up window attempts to open, a blocking rule will always take precedence. For example, the address of a certain pop-up window is on the allowed windows list for Internet Explorer but not for Pop-Up Blocker. This window will be blocked. And vice versa, if the browser is configured to block all pop-up windows, a pop-up window will be blocked even if its address is not the Pop-Up Blocker trusted address list. For this reason, we recommend configuring the browser and Pop-Up Blocker together if you run Microsoft Windows XP Service Pack 2.

If you want to view any windows for one reason or another, you must add them to the trusted address list. To do so:
  1. Open the application settings window and select [image] Firewall under Protection .
  2. Check [image] Enable Popup Blocker under Popup Blocking and click on Trusted Sites .
  3. Click on Add in the resulting [image] Settings: Trusted URLs dialog and enter trusted URL address masks.
  1. Specify if addresses in the Internet Explorer trusted zone or addresses on your local area network will be excluded from the scan. The program considers them trusted by default and does not block pop-up windows from these addresses.
The new exclusion will be added to the beginning of the trust address list. To stop using the exclusion that you have added, just uncheck the box [image] next to its name. If you want to remove an exclusion entirely, select it on the list and click Delete.
If you want to block pop-ups from your intranet or websites included on the Microsoft Internet Explorer trusted site list, uncheck the corresponding boxes in the Trusted zone section.

When pop-up windows that are not on the trusted address list try to open, a message pops up over the program icon stating that it has blocked the window. With the links in that message, you can cancel the block and add the window's address to the trusted address list.

You can take similar actions working with Internet Explorer as included in Microsoft Windows XP Service Pack 2. To do so, use the context menu that you can open over the program icon in the lower part of the browser when pop-up windows are blocked.

Also see:

Adding a new address


Adding a new address

Use this window to add a new address to the Popup Blocker address list. To do so, enter a mask for sites whose popup windows you do not want to block.

Tip:
When entering a trusted address mask, you can use the characters * or ?.
For example, the mask http://www.test* excludes popups from any site that begins with that series of characters.

Click OK button for the changes to take effect. To exit the window without applying the changes, click Cancel.

Also see:

Creating Popup Blocker trusted address list


Anti-Banner

Anti-Banner blocks advertising information located on special banners online or built into interfaces of various programs installed on your computer.

Advertising information on banners is not useful. It is also distracting and serves to increase network traffic. Anti-Banner blocks the the most common types of banners known at this time whose descriptions in the form of regular expressions are delivered with Kaspersky Internet Security. Banner blocking may be disabled, and custom lists of allowed and disallowed sites may be created.

To integrate Anti-Banner with the Opera browser edit section [Image Link Popup Menu] of standard_menu.ini to add the following line:

Item, «New banner» = Copy image address & Execute program, «<drive>\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\opera_banner_deny.vbs», «//nologo %C»

Replace <drive> with the name of your system drive.

A list of regular expression describing the most common advertising banners has been created by Kaspersky Lab specialists based on a special study and is bundled with the distribution. Advertising banners matching the expressions on the list will be blocked by the application unless banner blocking is disabled.

In addition, white and black banner lists may be created to manage whether banners will be displayed or blocked.

Please note that if a domain mask is included in the disallowed banner list or a black list, access to the web site root is not blocked.
For example, if truehits.net is included in the list of disallowed banners, access to http://truehits.net will be allowed while access to http://truehits.net/a.jpg will be blocked.

See also:

Configuring standard blocked banner list

White Banner List

Black Banner List


Configuring the standard banner ad blocking list

Kaspersky Internet Security includes masks for the most common banner ads on websites and program interfaces. This list is compiled by Kaspersky Lab specialists and is updated along with the application databases.
You can select what standard banner ad masks you want to use when using Anti-Banner. To do so:
  1. Open the application settings window and select [image] Firewall under Protection .
  2. Check [image] Enable Anti-Banner under Publicity Banners Blocking and click Settings .

  3. Open the General tab in the [image] Settings: Banners Blocking dialog . Banners matching the listed masks will be blocked by Anti-Banner . You can use the mask string anywhere in the banner address.
The list of standard blocked masks cannot be edited. If you do not want to block a banner covered by a standard mask, uncheck the box [image] next to the mask.

To analyze banner ads that do not match the masks from the standard list, check [image] Use heuristic analysis methods. Then the program will analyze the images loaded for signs typical of banner ads. Pursuant to this analysis, the image might be identified as a banner and blocked.

You can also create your own lists of allowed and blocked banners. You can do so on the White list and Black list tabs.
Also see:

Banner ad white lists

Banner ad black lists


Banner ad white lists

Users create banner ad white lists while using the program if they need not to block certain banners. This list contains masks for allowed banner ads.
To add to a new mask to the white list:

  1. Open the application settings window and select [image] Firewall under Protection .

  2. Check [image] Enable Anti-Banner under Publicity Banners Blocking and click Settings .

  3. Open the White List tab in the [image] Settings: Banners Blocking
Use the dialog displayed to add a mask for a trusted banner to the list by clicking Add . You can specify the URL for the banner or a mask for it. In the latter case, when a banner attempts to load, the program will scan it for the mask specified.
The wildcards * and ? may be used when entering banner masks (where * represents any string, and ? any single character).
To stop using a mask that you created, you do not have to delete it from the list; just uncheck the box [image] next to it. Then banners that fall under this mask will not be processed as an exclusion.
Using the Import and Export buttons, you can copy the allowed banner lists you create from one computer to another.
Also see:

Configuring the standard banner ad blocking list

Banner ad black lists


Banner ad black lists

In addition to the standard list of banners blocked by Anti-Banner, you can create your own list. To do so:

  1. Open the application settings window and select [image] Firewall under Protection .
  2. Check [image] Enable Anti-Banner under Publicity Banners Blocking and click Settings
  3. Open the Black List tab in the [image] Settings: Banners Blocking dialog .

Use the dialog displayed to add the banner to be blocked by Anti-Banner to the list by clicking the Add button . You can specify the URL for the banner or a mask for it. In the latter case, when a banner attempts to load, the program will scan it for the mask specified.

When creating a mask, you can use the wildcards * or ? (where * represents a sequence of characters and ? represents any one character).

To stop using a mask that you created, you do not have to delete it from the list; just uncheck the box [image] next to it.

Using the Import and Export buttons, you can copy the blocked banner lists you create from one computer to another.

Also see:

Configuring the standard banner ad blocking list

Banner ad white lists


Types of network attacks

Note

This section provides general information on the most common types of network exploits and their potential consequences. A list of active attacks directly detected by the Firewall component, may be modified by Kaspersky Lab specialists depending on the current situation and may be updated with the application databases.

There are currently a multitude of various network attacks that utilize operating system vulnerabilities and other software, system or otherwise, installed on your computer. Malefactors are constantly perfectly attack methods, learning how to steal confidential information, making the system malfunction, or full taking over your computer to use it as part of a zombie network for carrying out new attacks.

To ensure the security of your computer, you must know what kinds of network attacks you might encounter. Known network attacks can be divided into three major groups:

  • Port scan – this threat is not an attack in and of itself, but usually precedes one, since it is one of the common ways of obtaining information about a remote computer. The UDP/TCP ports used by the network tools on the computer in question are scanned to find out what state they are in (closed or open).

    Port scans can tell a hacker what types of attacks will work on that system and what types will not. In addition, the information obtained by the scan (a model of the system) will help the malefactor to know what operating system the remote computer uses. This in turn further restricts the number of potential attacks, and, correspondingly, the time spent running them. It also aid a hacker in attempting to use vulnerabilities particular to that operating system.
  • DoS (Denial of Service) attacks – these are attacks that result in the system attacked reaching an unstable or entirely inoperable state. The consequences of these attacks can be damage or corruption of the information resources that they target and the inability to use those resources.

    There are two basic types of DoS attacks:
    • Sending the target computer specially created packets that the computer does not expect, which cause the system either to restart or to stop
    • Sending the target computer many packets within a timeframe that the computer cannot process, which cause system resources to be exhausted

The following attacks are common examples from this group:

    • Ping of death consists of sending a ICMP packet with a size greater than the maximum of 64 KB. This attack can crash some operating systems.
    • Land consists of sending a request to an open port your computer to establish a connection with itself. This sends the computer into a cycle, which intensifies the load on the processor and can end with some operating systems crashing.
    • ICMP Flood consists of sending a large quantity of ICMP packets to your computer. The attack leads to the computer being forced to reply to each inbound packet, which seriously weighs down the processor.
    • SYN Flood consists of sending a large quantity of queries to your computer to establish a fake connection. The system reserves certain resources for each of those connections, which completely drains your system resources, and the computer stops reacting to other connection attempts.
  • Intrusion attacks, which aim to take over your computer. This is the most dangerous type of attack, since if it is successful, the hacker has complete control of your computer.

    Hackers use this attack when they need to obtain confidential information from a remote computer (for example, credit card numbers, passwords) or to take hold of the system to use its resources later for malicious purposes (using the captured system in zombie networks or as a platform for new attacks).

    This group is also contains more attacks than any other. They can be divided into three subgroups based on operating system: Microsoft Windows attacks, Unix attacks, and a group for network services running either operating system.

    The most common types of attacks that use operating system network tools are:
    • Buffer overflow attacks – type of vulnerability in software that surfaces because of no control or insufficient control in handling massive amounts of data. This is one of the oldest vulnerability types and the easiest for hackers to exploit.
    • Format string attacks – type of vulnerability in software that arise from insufficient control of input values for I/O functions such as printf(), fprintf(), scanf(), and others from the C standard library. If a program has this vulnerability, the hacker, with the ability to send queries created with a special technique, can gain complete control or the system.

Intrusion Detector automatically analyzes and blocks attempts to exploit these vulnerabilities in the most common network tools (FTP, POP3, IMAP) if it is running on the user’s computer.

Microsoft Windows attacks are based on taking advantage of vulnerabilities in software installed on the computer (for example, programs such as Microsoft SQL Server, Microsoft Internet Explorer, Messenger, and system components that can be accessed through the network – DCom, SMB, Wins, LSASS, IIS5).

In addition, there are isolated incidents of intrusion attacks using various malicious scripts, includes scripts processed by Microsoft Internet Explorer and Helkern-type worms. The essence of this attack type consists of sending a special type of UDP packets to a remote computer that can execute malicious code.

Remember that, while on the network, your computer is at risk every day of being attacked by a hacker. To ensure your computer's security, be sure to enable Firewall when using the Internet and regularly update the hacker attack database .


Firewall statistics

Certain current component statistics (number of network attacks, connections, popup windows, and banners blocked during current component session) are shown in the application main window . Select [image] Firewall under Protection to view.
To view a detailed component report, click Open Report (component currently running) or Open Last Start Report (component disabled).
Basic information on component operation is grouped by tab in the middle of the report window.
  • A list of all the network attacks that have been attempted during the current session of Kaspersky Internet Security is given on the Network attacks tab.
  • The Blocked access list tab displays a list of all hosts that have been blocked for a variety of reasons. For example, they attempted to attack your computer or were blocked by a rule.
  • The Application Activity tab of the Firewall report shows you the activity of applications on your computer.
  • All data packets subject to filtration in accordance with Firewall rules are listed on the Packet filtering tab.
  • The URLs of all blocked popups are listed on the Popups tab.

  • Banners detected and blocked during the application's current session are listed on the Banners tab

Information types may be selected in each of the report tabs, information may be sorted by columns in ascending or descending order and searched. This is accomplished by using context menus accessible by right-clicking report column headers .

To view detailed information on all connections to your computer, open ports, and the amount of incoming and outgoing traffic, click on View Current Network Activity. This information is collected and analyzed by the Filtration System module. Therefore, if this Firewall module is disabled, network activity is not monitored .
The window that opens will display information on the following tabs:
  • The Established connections tab displays all network connections currently active on your computer. This includes both connections initialized by your computer and inbound connections.
  • The Open ports tab lists all the ports open on your computer.
  • The Traffic tab contains the volume of information received and sent between your computer and other computers on the network that you are currently work on.


The Network attacks tab

This tab displays a brief overview of network attacks on your computer. This information is recorded if Intrusion Detector is enabled, which monitors all attempts to attack your computer.
The Network attacks tab lists the following information on attacks:
  • Source of the attack. This could be an IP address, host, etc.
  • Local port number on which the attack on the computer was attempted.
  • Brief description of the attack.
  • The time when the attack was attempted.
To delete all the attacks from list, click Actions → Clear all.
Also see:

Types of network attacks

Configuring Intrusion Detector


The Banned hosts tab

Blocked Access List Tab

All computers that have been blocked after an attack was detected by Intrusion Detection System are listed on this report tab.
The name of each computer and the time that it was banned are shown. You can unblock a computer on this tab. To do so, select it from the list and click the Actions → Unblock button.


The Application activity tab

All applications whose activity matches application rules and has been recorded by the Filtration System during the current Firewall session, are listed on the Application Activity tab .
Activity is only recorded if Log event flag is checked in the rule. It is deselected by default in application rules included with Kaspersky Internet Security.
This tab displays the basic properties of each application (name, PID, rule name) and a brief summary of its activity (protocol, packet direction, etc.). Information is also listed about whether the application's activity is blocked.

To delete all the applications from list, click Actions → Clear all.


The Packet filtering tab

The Packet filtering tab contains information about sending and receiving packets that match filtration rules and were loged during the current session of the Firewall.
Activity is only recorded if Log event flag is checked in the rule. It is deselected by default in the packet filtering rules included with Kaspersky Internet Security.
The outcome of filtration (whether the packet was blocked), direction of the packet, protocol, and other network connection settings for sending and receiving packets are indicated for each packet.
To delete the information about packets from the report, click Actions → Clear all.


The Pop-up windows tab

The Popups tab

This report tab lists the addresses of all the pop-up windows that Anti - Publicity has blocked with the Pop-Up Blocker module. This windows generally open from websites.
The address and date and time when Pop-Up Blocker blocked the window are recorded for each pop-up.
To delete the pop-up window addresses listed in the report, click Actions → Clear all.


The Banners tab

This Firewall report tab lists the URLs of banners blocked by Anti-Banner . Each banner is described by its URL and zone status : banner blocked or banner displayed.

You can allow blocked banners to be displayed. To do so, select the object you want from the list and click Actions → Allow.

If you want to delete the banner ad addresses listed in the report, click Actions → Clear all.


The Established connections tab

All active network connections established on your computer at present are listed on the Established connections tab. Here you will find the name of the application that initiated the connection, the protocol used, the direction of the connection (inbound or outbound), and connection settings (local and remote ports and IP addresses). You can also see how long a connection has been active and the volume of data sent and received. You can create a rule for connection or get rid of it. To do so, use the appropriate options on the context menu.


The Opened ports tab

All ports open on your computer for network connections at present are listed on the Open ports tab. It lists the number, data transfer protocol, name of the application that uses the port, and the time period over which the port has been open for connection for each port.
This information may be useful during virus breakouts and network attacks when you know exactly which port is vulnerable. You can find out whether that port is open on your computer and take the necessary steps to protection your computer (for example, enabling Intrusion Detector, closing the vulnerable port, or creating a rule for it).


The Traffic tab

This tab holds information on all the inbound and outbound connections established between your computer and other computers, including web servers, mail servers, etc. The following information is given for every connection: name and IP address of the host that the connection is with, and the amount of traffic sent and received.


Anti-Spam

Kaspersky Internet Security 7.0 includes a special component that detects spam and processes it according to the rules of your mail client, saving you time when using e-mail.
E-mail is scanned for spam according to the following algorithm:
  1. The sender's address is scanned for matches on black and white lists of addresses.
    • If the sender's address is on the white list, the e-mail is assigned the status not spam.
    • If the sender's address is on the black list, the e-mail is assigned the status spam. Further processing depends on the action you select.
  2. If the sender’s address is not detected on a white or black list, the e-mail is analyzed using PDB technology.
  3. Anti-Spam examines the text of the e-mail headers in detail and scans it for lines from the black or white list.
    • If the body of a message contains a single string from the "white" string list, the message is classified as Not Spam.
    • If the body contains phrases from the "black" list of strings, a cumulative number is computed for all such phrases based on a spam weight assigned each phrase. If the number is greater than or equal to 100, the email message is classified as spam. Subsequent message processing depends on the action you specify.
  4. If the email does not contain phrases from the black or white list, it is analyzed for phishing. If the text of the email contains an address contained in the anti-phishing database, the email is marked as spam. Subsequent message processing depends on the action you specify.
  5. If the e-mail does not contain phishing lines, it is scanned for spam using special technologies:
    • image analysis using GSG technology
    • message text analysis using spam recognition algorithm - iBayes algorithm
    • message text analysis using the Recent Terms technology for phrases commonly encountered in spam.
  6. Then the e-mail is scanned for additional spam filtration factors set by the user when configuring Anti-Spam. This could include scanning for correctness of html tags, font size, or hidden characters.
You can disable each of the stages listed above that the e-mail undergoes when being analyzed for spam.
Anti-Spam is built into the following mail clients as an plug-in:
  • Microsoft Office Outlook.
  • Microsoft Outlook Express (Windows Mail).
  • The Bat!

Microsoft Office Outlook and Microsoft Outlook Express (Windows Mail) toolbars offer two buttons: Spam and Not Spam, which allow Anti-Spam configuration to identify spam in your specific email traffic. The Bat! does not offer these buttons but it may be trained using the Mark As Spam and the Mark as NOT Spam options under the Special menu. Also, special processing parameters for undesirable email are added to all mail client settings.

Anti-Spam uses a modified self-training iBayes algorithm, which allows the component over time to more accurately distinguish between spam and accepted mail. The source of data for the algorithm is the contents of the letter.
Situations arise when the modified self-training iBayes algorithm is unable to classify a certain e-mail as either spam or good mail to a high degree of accuracy. Such an e-mail will be assigned the status of probable spam.
In order to reduce the number of e-mails that are probable spam, we recommended that you conduct additional Anti-spam training for such e-mails. To do so, you must specify which of those e-mails should be classified as spam, and which as not spam.
E-mails that are spam or probable spam are modified: the markings [!! SPAM] or [?? Probable Spam], are correspondingly added to the subject line.
The rules for processing e-mails noted as spam or probable spam for Microsoft Office Outlook, Microsoft Outlook Express (Windows Mail), or The Bat! are assigned in special plug-ins created for those mail clients. For other mail clients, you can configure filtration rules so that they take into account the subject line and, for example, depending on whether the e-mail contains [!! SPAM] or [?? Probable Spam], so that they move the e-mail to the corresponding folder. For a more detailed look at the filtration mechanism, please consult the documentation for your mail client.

Also see:

Status of Anti-Spam

Pausing / disabling Anti-Spam

Selecting the sensitivity level of Anti-Spam

Training Anti-Spam

Configuring Anti-Spam settings

Anti-Spam statistics


Status of Anti-Spam

To view current component status, select [image] Anti-Spam in the Protection section in the left pane of the application main window . In the right-hand part, you will see composite information on spam.
The most important is Anti-Spam status:
  • Anti-Spam : enabled - protection from receiving spam is enabled. Since you are protected from spam, it depends on how well Anti-spam is trained.
  • Anti-Spam : paused - Anti-Spam is disabled for a certain period of time. The component will resume operations automatically after the assigned period has expired or after restarting the program. You can also enable Anti-Spam manually. To do so click Resume operation link.
  • Anti-Spam : disabled - the component has been stopped by the user. You can enable Anti-Spam. To do so click Enable.
  • Anti-Spam : malfunction - protection from spam is not available for some reason.
  • Anti-Spam : running (subsystem malfunction) - the component encountered an error.
    • If a component encounters an error, try restarting it . If restart should result in an error, review component report which might contain the reason for the failure . If you are unable to troubleshoot the issue on your own, save the component report to a file using Action → Save As and contact Kaspersky Lab Technical Support .

Component status is followed by the sensitivity of spam protection as well as information as to whether POP3, SMTP, and IMAP traffic and Microsoft Office Outlook and The Bat! mail client traffic are scanned for spam. To edit current component settings, click on Configure.

Certain computer spam protection statistics are displayed in the main window : number of messages scanned during current component session, number of spam messages detected as well as the size of the spam collection used in the scan . Use the Open Report link to view a detailed report on the component's current performance .
If for some reason the component is paused or stopped at a given moment in time, its results at the time of deactivation may be viewed by clicking Open Last Start Report.


Pausing / disabling Anti-Spam

By default, Anti-Spam is enabled on your computer. You can pause Anti-Spam or disable it for a certain length of time or completely.
Let's look at the ways to disable Anti-Spam in more detail.
To pause Anti-Spam,

Select the [image] Anti-Spam component in the Protection section of the main window and click Pause link.

The component status will be changed to paused. Protection will be paused until you restart the program or enable the component using Resume operation link.

When you pause Anti-Spam, the component statistics for the current Kaspersky Internet Security session is saved and will continue to be recorded after the component is updated. Current mail connections that are being monitored when you pause Anti-Spam will not be broken as well.

To stop Anti-Spam,

select Anti-Spam under Protection in the main window and use the Stop link. In this case, the component status will be changed to disabled. Email spam protection will be disabled until Enable is clicked.

Mail spam protection may also be shut down from the application settings window . Select [image] Anti-Spam under Protection and uncheck [image] Enable Anti-Spam .

When you stop Anti-Spam, all the statistics from previous work are cleared and when the component is started they are recorded over.

Warning!
Remember that if you disabled Anti-Spam in the settings window, it will not automatically be enabled after restarting the program. To resume Anti-Spam, you must check [image] Enable Anti-Spam.
By disabling Anti-Spam in the main window, the component status changes to disabled, and the component list in the Protection section its name will go inactive (gray).
Anti-Spam can also be disabled by fully disabling protection on your computer.


Selecting the sensitivity level of Anti-Spam

Kaspersky Internet Security protects you from spam on one of the following levels:
    Block all - strictest level of sensitivity, on which any mail other than messages containing lines from the phrase white list and senders listed on the white list are recognized as spam. On this level, the e-mail is only analyzed against the white list. All other features are disabled.
    High - a stricter level that when activated raises the likelihood that some e-mails that are not actually spam will be marked as spam. On this level the message is analysed using the white and black lists, and also using PDB, GSG, Recent Terms technologies and iBayes algorythm.
    This level should be applied in cases when there is a high likelihood that the recipient's address is unknown to spammers. For example, when the recipient is not registered in the mass mailings and does not have an e-mail address on free/non-corporate mail servers.
    Recommended - the most universal settings level for classifying e-mail.
    At this level, it is possible that some spam will not be detected and some good mail will be classified as spam. This shows that Anti-Spam is not trained well enough. We recommend that you conduct additional training for the module using the Training Wizard or the Spam/Not spam button (menu items in the Bat!).
    Low - the most loyal settings level. It could be recommended for users whose incoming correspondence for some reason contains a significant number of words recognized by Anti-Spam as spam, but is not. The cause of such a situation may be the professional activity of the recipient, by virtue of which he is forced to use professional terms in his correspondence with colleagues that are widespread in spam. All spam detection technologies are used to analyze e-mails on this level.
    Allow all - the lowest sensitivity level, on which only mail that contains lines from the phrase black list and senders listed on the address black list are recognized as spam. On this level, the e-mail is only analyzed against the black list. All other features are disabled.
By default, Anti-Spam is set to the Recommended sensitivity level. You can boost or reduce or the level or change the settings for the current level.
In order to modify a sensitivity level,

Adjust the sliders. By adjusting the sensitivity level, you define the correlation between spam, probable spam, and good mail factors.

To modify the settings for the current level,
  1. Open the application settings window and select [image] Anti-Spam under Protection .
  2. Click the Customize button in the Sensitivity area.

  3. Edit mail spam protection parameters in the resulting window and click OK .

As a result, the sensitivity level will be user customized .

Also see:

Configuring scanning settings

Training Anti-Spam


Training Anti-Spam

Anti-Spam comes with a preinstalled e-mail database containing fifty spam samples. It is recommended that the Anti-Spam module undergo further training on your e-mails.
There are several approaches to training Anti-Spam:
  • Use the Training Wizard.
  • Training Anti-Spam using the outgoing email messages, including the procedure using initial setup wizard.
  • Train directly while working with e-mail by using special buttons in the mail client tools panel or menu items.
  • Train when working with Anti-Spam reports.
Training with the Training Wizard is preferable from the very onset of using Anti-Spam. The wizard can train Anti-Spam on a large number of e-mails.
Note that you cannot train Anti-Spam with more than 50 e-mails per folder. If there are more e-mails in the folder, the program will use the last fifty for training.
Additional training using special buttons in the mail client interface are preferable when working directly with e-mail.


Training Wizard

The Training Wizard can train Anti-Spam by indicated which mailbox folders contain spam and good mail.
To open Training Wizard,

select the [image] Anti-Spam component under Protection in the left pane of the application main window and click on Start Training Wizard.

Application settings window may also be used to start Anti-Spam training. Select the [image] Anti-Spam component under Protection and click on Training Wizard in the Training area.

Training Wizard includes step-by-step procedures for training Anti-Spam. Clicking the Next button will take you to the next step of training, and the Back button will take you to the previous one.

Step One of Training Wizard consists of selecting folders that contain good correspondence. In this stage, you must only select the folders whose contents you fully trust.
Step Two of Training Wizard consists of selecting folders that contain spam. Skip this step if your mail client does not have spam folders.
In Step Three, Anti-Spam is automatically trained on the folders you selected. The e-mails in those folders will fill the Anti-Spam database. The senders of good mail are automatically added to the address white list.
In Step Four, the results of training must be saved using one of the following methods: add the results of training to the current Anti-Spam database or replace the current database with the database created through training. Please bear in mind that the program must be trained on at least 50 good e-mails and 50 spam e-mails for spam detection to work correctly. If you do not, the iBayes algorithm will not work.

To save time, the Training Wizard only trains on 50 e-mails in each selected folder.
Also see:

Training using outgoing email messages

Training in the mail client

Training Anti-Spam while working with reports

Spam processing rules


Training using outgoing email messages

You can train Anti-Spam with outgoing e-mails from your mail client. Then the Anti-Spam address white list will be filled based on analyzing outgoing messages. Only the first fifty e-mails are used for training. Then training is complete.

To train Anti-Spam with outgoing emails:

  1. Open the application settings window and select [image] Anti-Spam under Protection.
  2. Check [image] Training Using Outgoing Email Messages under Training .
Warning!

Anti-Spam will only train itself with outgoing e-mails sent via MAPI protocol if you check [image] Scan upon sending in the Microsoft Office Outlook Mail Anti-Virus plugin.


Training using your mail client

Training while working directly with e-mail involves using special buttons on your mail client's tools panel.
When you install Anti-Spam on your computer, it is built in to the following mail clients:
  • Microsoft Office Outlook.
  • Microsoft Outlook Express (Windows Mail).
  • The Bat!
Thus, the following items will appear in the toolbar of Microsoft Office Outlook: two buttons, Spam and Not spam and the Anti-Spam tab with actions in the Help® Settings menu. In Microsoft Outlook Express (Windows Mail) the Settings button appears on the toolbar in addition to Spam and Not spam buttons. Using this button a window with actions on spam can be opened. In The Bat! there are no such buttons, although the program can be trained using the special items Mark as spam and Mark as NOT spam on the Special menu.
If you decide that the selected email is spam, click the Spam button. If the email is not spam, click Not spam. After this, Anti-Spam will perform training on the letter selected. If you select several emails, training will take place on all the selected emails.
Warning!
In cases when you need to immediately select several emails, or are certain that a certain folder only contains emails of one group (spam or not spam), you can take a multi-faceted approach to training using Training Wizard.
Also see:

Training Wizard

Training Anti-Spam while working with reports

Spam processing rules


Training using Anti-Spam reports

You have the option of training Anti-Spam judging by reports.
To view the Anti-Spam reports,
  1. Select [image] Anti-Spam in the Protection section of the main program window.
  2. Click Open report link.
The component's reports can help you make a conclusion about the accuracy of its configuration, and, if necessary, make certain corrections to Anti-Spam.
To mark a certain e-mail as spam or not spam,
  1. Select it from the report list on the Event Log tab and use the Actions button.
  2. Select one of the following items:
    • Mark as Spam
    • Mark as Not Spam
    • Add to White list
    • Add to Black list
Anti-Spam will continue further training on the basis of this e-mail.
Also see:

Training Wizard

Training in the mail client

Spam processing rules


Configuring Anti-Spam settings

The delicate configuration of Anti-Spam is an integral part of the spam protection feature. All settings for component operation are located in the Kaspersky Internet Security settings window and allow you to:
  • Determine the particulars of operation of Anti-Spam.
  • Select the different spam filtration technologies.
  • Regulate accuracy of the spam and probable spam definition.
  • Create white and black lists for senders and key phrases.
  • Configure additional characteristics of spam filtration.
  • Maximally reduce the amount of spam in your inbox through preliminary work with the Mail Dispatcher.
This Help section will examine the settings listed above in detail.


Configuring scanning settings

You can configure the following scan settings:
  • Should traffic from POP3, SMTP and IMAP protocols be scanned. Kaspersky Internet Security scans by default mail on all these protocols.
  • Should plug-ins be activated for Microsoft Office Outlook, Microsoft Outlook Express (Windows Mail) and The Bat!
  • Should e-mail be viewed via POP3 in the Mail Dispatcher prior to downloading it from the mail server to the user's inbox.
To configure the settings listed above,
  1. Open the application settings window and select [image] Anti-Spam under Protection .
  2. Check the corresponding boxes in the Connectivity section.
  3. Edit the network settings, if necessary.

Warning!

If you are using Microsoft Outlook Express as your mail client, the email application has to be restarted every time the Enable Microsoft Office Outlook, Outlook Express and The Bat! support flag status changes.


Configuring spam detection settings

On the Spam detection tab, you can:

  • Select spam filtration technologies
  • Define spam and probable spam factors

Selecting spam filtration technologies

E-mails are scanned for spam by using state-of-the-art filtration technologies:

  • iBayes, based on the Bayes theorem, analyzes e-mail text to detect phrases that mark it as spam. The analysis uses the statistics obtained by training Anti-Spam.
  • GSG, which analyzes graphic elements in e-mails using special graphic signatures to detect spam in graphics.
  • PDB, which analyzes e-mail headers and classifies them as spam based on a set of heuristic rules.
  • Recent Terms, which performs an email message text analysis to identify any phrases commonly encountered in spam. The analysis is performed using databases created by Kaspersky Lab specialists.

The program utilizes all the filtration technologies by default, checking e-mail for spam as completely as possible.

To disable any of the filtration technologies:

  1. Open the application settings window and select [image] Anti-Spam under Protection .
  2. Click Settings in the Sensitivity section and in the window that opens select the [image] Spam recognition tab.
  3. Deselect the boxes next to the filtration technologies that you do not want to use for detecting spam.

To shield intranet email traffic (such as, corporate email) from being scanned for spam, check [image] Do not scan Microsoft Exchange Server Internal Email. Please note, that messages will be regarded as internal mail if Microsoft Office Outlook is used as the mail client throughout the network and user mailboxes are located on a single Exchange server or several servers linked with X400 connectors. Uncheck the option to have Anti-Spam scan these messages.

Defining spam and probable spam factors

Kaspersky Lab specialists have optimally configured Anti-Spam to recognize spam and probable spam.

Spam detection is based on the use of state-of-the-art filtration technologies which allow to train Anti-Spam to recognize quite accurately spam, probable spam, and good mail with a certain number of emails from your inbox.

Anti-Spam is trained while working with the Training Wizard and while training from mail clients. In doing so, every individual element of accepted email or spam is assigned a factor. When an email enters your inbox, Anti-Spam scans the email with iBayes for elements of spam and of good email. The factors for each element are totaled and then spam factor and potential spam factor are calculated.

The probable spam factor value defines a limit after which the email will be classified as probable spam. If you are using the Recommended Anti-Spam sensitivity level, any email with factor value between a 50% and 59% will be considered probable spam. Good mail refers to mail that, after being scanned, has a spam factor of less than 50%.

The spam factor value defines a limit after which the email will be classified as spam. Any email with factor value higher than the one specified will be perceived as spam. By default, the spam factor value is 59% for the Recommended level. This means that any email with factor value of more than 59% will be marked as spam.

In all, there are five sensitivity levels, three of which (High, Recommended, and Low) are based on various spam and probable spam factor values.

You can edit the Anti-Spam algorithm on your own. To do so:
  1. Open the application settings window and select [image] Anti-Spam under Protection .
  2. Click on Customize under Sensitivity and open the [image] Spam Recognition tab in the resulting dialog.
  3. Adjust spam and probable spam ratings in the relevant areas.


Creating white and black lists manually

Users create black and white lists manually by using Anti-Spam with their e-mail. These lists house information on user addresses that are considered safe or spam and various key words and phrases that identify them as spam or safe mail.
The chief application of the lists of key phrases, and in particular the white list, is that you can make agreements with trusted addressees, for example, with your colleagues, to sign your correspondence with a certain phrase. It can be any phrase. You could use, for example, a PGP signature as a signature. You can use wildcards in the signatures and in the addresses: * and ?. An asterix represents any sequence of characters of any length. A question mark represents any one character.

If there are asterixes and questions marks in the signature, to prevent errors with Anti-Spam processes them, they should be preceded by a backslash. Then two characters are used instead of one: * and ?.

Also see:

White list

Black list


White list of addresses and phrases

The white list contains key phrases from e-mails that you marked as not spam, and addresses of senders from whom spam would not come. The white list is filled manually, and the list of senders' addresses is done automatically while training the Anti-Spam component. You can edit this list.
To configure the white list,
  1. Open the application settings window and select [image] Anti-Spam under real-time Protection.
  2. Click on Customize under Sensitivity and open the [image] White List tab.
The tab is divided into two sections: the upper portion contains the addresses of senders of good mail, and the lower contains key phrases from such e-mails.
To enable phrase and address white lists during spam filtration, check the corresponding boxes in the Allowed senders and Allowed phrases sections.
You can edit the lists using the buttons in each section.
You can assign both addresses and address masks as the address list. When entering an address, the register is not taken into account. Let’s look at som examples of address masks:
  • ivanov@test.ru - e-mails from this address will always be classified as good mail;
  • *@test.ru - e-mail from any sender in the domain test.ru is good, for example: petrov@test.ru, sidorov@test.ru;
  • ivanov@* - a sender with this name, regardless of the mail domain, always sends only good mail, for example: ivanov@test.ru, ivanov@mail.ru;
  • *@test* - e-mail from any sender in a domain that begins with test is not spam, for example: ivanov@test.ru, petrov@test.com;
  • ivan.*@test.??? - e-mail from a sender whose name begins with ivan. and whose domain name begins with test and ends in any three characters is always good, for example: ivan.ivanov@test.com, ivan.petrov@test.org.

You can also use masks for phrases. When entering a phrase, the register is not taken into account. Where are some examples of some of them:

  • Hi, Ivan! - an e-mail that only contains this text is a good e-mail. It is not recommended to use such a phrase as a white list phrase.
  • Hi, Ivan!* - an e-mail beginning with the phrase Hi, Ivan! is good.
  • Hi, *! * - e-mails beginning with the greeting Hi and an exclamation point anywhere in the e-mail are not spam.
  • * Ivan? * - the e-mail contains a greeting to a user with the name Ivan, whose name is followed by any character, and is not spam.
  • * Ivan\? * - e-mails containing the phrase Ivan? are good.
If at present you want to cancel classification of a certain address or phrase as good mail attributes, it is not necessary to delete them from the list; simply uncheck their names.
Addresses on the White List may be imported from *.txt or *.csv files or the Microsoft Office Outlook/ Microsoft Outlook Express address book. To do this use the Import button and select import method from the context menu.
Also see:

Black list of addresses and phrases

Training Wizard

Training using Anti-Spam reports


Importing "White" Listed Addresses from a Microsoft Office Outlook/ Microsoft Outlook Express Address Book

This window will be displayed when the option of importing Microsoft Office Outlook/ Microsoft Outlook Express address book addresses into the Anti-Spam "white" list is selected.

Check the address books to be copied into the Anti-Spam "white" address list below.


Black list of addresses and phrases

The black list of senders stores key phrases from e-mails that you feel constitute spam, and the addresses of their senders. The list is filled manually.
To fill the black list,
  1. Open the application settings window and select [image] Anti - Spam under real - time Protection.
  2. Click on Customize under Sensitivity and open the [image] Black List tab.

The tab is divided into two sections: the upper portion contains the addresses of senders of spam, and the lower contains key phrases from such e-mails.

To enable phrase and address black lists during spam filtration, check the corresponding boxes in the Blocked senders and Blocked phrases sections.

You can edit the lists using the buttons in each section.

You can assign both addresses and address masks as the address list. When entering an address, the register is not taken into account. Let’s look at som examples of address masks:

  • ivanov@test.ru - e-mails from this address will always be classified as spam;
  • *@test.ru - e-mail from any sender in the domain test.ru is spam, for example: petrov@test.ru, sidorov@test.ru;
  • ivanov@* - a sender with this name, regardless of the mail domain, always sends only spam, for example: ivanov@test.ru, ivanov@mail.ru;
  • *@test* - e-mail from any sender in a domain that begins with test is spam, for example: ivanov@test.ru, petrov@test.com;
  • ivan.*@test.??? - e-mail from a sender whose name begins with ivan. and whose domain name begins with test and ends in any three characters is always spam, for example: ivan.ivanov@test.com, ivan.petrov@test.org.

You can also use masks for phrases. When entering a phrase, the register is not taken into account. Where are some examples of some of them:

  • Hi, Ivan! - an e-mail that only contains this text is a spam. It is not recommended to use such a phrase as a listed phrase.
  • Hi, Ivan!* - an e-mail beginning with the phrase Hi, Ivan! is spam.
  • Hi, *! * – e-mails beginning with the greeting Hi and an exclamation point anywhere in the e-mail are spam.
  • * Ivan? * – the e-mail contains a greeting to a user with the name Ivan, whose name is followed by any character, and is spam.
  • * Ivan\? * – e-mails containing the phrase Ivan? are spam.

If at present you want to cancel classification of a certain address or phrase as signs of spam, it is not necessary to delete them from the list; simply uncheck their names.

Also see:

White list of addresses and phrases


Additional characteristics of spam filtration

Additional spam filtration features

In addition to the main features that are used to filter spam (creating white and black lists, phishing analysis, analysis using filtration technologies), you can assign additional features.

To configure additional spam filtration features:

  1. Open the application settings window and select [image] Anti-Spam under Protection .
  2. Click on Customize under Sensitivity and open the [image] Additional tab .

The tab lists a series of indicators that will classify e-mail as being, more likely than not, spam.

To use any additional filtration indicators, check the flag next to it. Each of the factors additionally requires that you set a spam factor (in percentage points) that defines the likelihood that an e-mail will be classified as spam. The default value for the spam factor is 80%. The e-mail will be marked as spam if the sum of the likelihoods for all additional factors exceeds 100%.

Spam could be empty e-mails (no subject or body), e-mails containing links to images or with imbedded images, with text that matches the background color, or text in a very small font size. Spam can also be e-mails with invisible characters (the text matches the background color), e-mails containing hidden elements (the elements are not displayed at all), or incorrect html tags, as well as e-mails containing scripts (a series of instructions executed when the user opens the e-mail).

If you enable filtration for “messages not addressed to me”, you must specify the list of your addresses in the window that opens by clicking My addresses.

Also see:

Creating a trusted addresses list


Creating the list of trusted addresses

If you enable spam filtration for “messages not addressed to me," you must specify your trusted e-mail addresses.

The recipient’s address will be scanned when the e-mail is analyzed. If the address does not match any of those on your list, the e-mail will be labeled as spam.

You can create and edit an address list in the [image] My addresses using the Add, Edit, and Delete button.


Mail Dispatcher

Warning!
Mail Dispatcher is only available if you receive mail via POP3 protocol and provided the POP3 server supports the viewing of email headers.
Mail Dispatcher is designed for viewing the list of e-mail messages on the server without downloading them to your computer. This way you can refuse to accept messages, saving not only time and money when working with e-mail, but reducing the likelihood of downloading spam and viruses to your computer.
Mail Dispatcher opens if the box [image] Open Mail Dispatcher when receiving email in the [image] Anti-Spam configuration dialog is checked.
To delete e-mails from the server without downloading them onto your computer,

check the boxes on the left of the e-mails that should be deleted and client the Delete button. The e-mails checked with be deleted from the server. The rest of your mail will be downloaded to your computer after closing the Mail Dispatcher window.

Sometimes it can be difficult to decide whether you ought to accept a certain e-mail judging only by the sender and the e-mail's subject line. In such cases, Mail Dispatcher will provide you will more information on the e-mail by downloading its headers.
To view an e-mails headers,

select the e-mail from the list of incoming mail. E-mail headers will be displayed in the lower part of the form.

E-mail headers are not of a significant size, generally a few dozen bytes, and cannot contain malicious code.
It may help to view headers, for example, in the following situation: spammers have installed a malicious program on your colleague's computer that sends spam with his name on it, using his mail client's contact list. The likelihood that you are on your colleague's contact list is extremely high, which will undoubtedly lead to your inbox being filled with spam from your colleague. In such a situation, it is impossible to tell judging by the sender's address alone whether the e-mail was sent by your colleague or the spammer. Use the e-mail headers! Check carefully to see who sent the e-mail, when, and what size it is. Trace the path of the e-mail from the send to your mail server. All this information should be in the e-mail headers. Make a decision whether it is really necessary to download that e-mail from the server or if it is actually best to delete it.
Note:
You can sort e-mails by any of the columns of the e-mail list. To apply sorting, click on the column heading. The lines will be software in ascending order. To change the direction of sorting, click on the column heading again.


Actions on spam

If after scanning you find that an e-mail is spam or probable spam, further operations of Anti-Spam depend on the status of the object and the action selected. By default, e-mails that are spam or probable spam are modified: the markings [!! SPAM] or [?? Probable Spam], are correspondingly added to the subject line.
You can select additional actions on spam or probable spam. In Microsoft Office Outlook, Microsoft Outlook Express (Windows Mail) and The Bat! special plug-ins are provided to do so. For other mail clients, you can configure the filtration rules.
Also see:

Configuring spam processing in Microsoft Office Outlook

Configuring spam processing in Microsoft Outlook Express (Windows Mail)

Configuring spam processing in The Bat!


Configuring spam processing in Microsoft Office Outlook

By default, e-mail that is classified by Anti-Spam as spam or probable spam is marked with special markings [!! SPAM] or [?? Probable Spam] in the Subject line.
Additional actions on spam and probable spam in Microsoft Office Outlook can be found on the special Anti-Spam tab on the menu Help® Settings.
It opens automatically when the mail client is first opened after installing the program and asks if you what to configure spam processing.
You can assign the following processing rules for both spam and probable spam:
    Move to folder - spam is moved to the folder of your inbox that you specify.
    Copy to folder - a copy is created of the e-mail and it is moved to the specified folder. The original e-mail stays in your inbox.
    Delete - delete spam from the user's mailbox
    Skip - leave the e-mail in the inbox
To do so, select the appropriate value from the dropdown list in the Spam or Probable Spam section.

You can also configure Microsoft Office Outlook and Anti-Spam to work together:

    Scan upon receiving. All e-mails that enter the user’s inbox are initially processed according to the Microsoft Office Outlook rules. After processing is complete, the remaining messages that do not fall under any of the rules are processed by the Anti-Spam plugin. In other words, e-mails are processed according to the priority of the rules. Sometimes the priority sequence may be ignored, if, for example, a large number of e-mails arrive in your inbox at the same time. In such a case, situations could arise when information about an e-mail processed by a Microsoft Office Outlook rule is logged in the Anti-Spam report as spam. To avoid this, we recommend configuring the Anti-Spam plugin as a Microsoft Office Outlook rule.
    Use Microsoft Office Outlook rule. With this option, incoming messages are processed based on a hierarchy of Microsoft Office Outlook rules that have been created. One of the rules must be a rule about Anti-Spam processing e-mails. This is the best configuration. It will not cause conflicts between Microsoft Office Outlook and the Anti-Spam plugin. The only shortcoming of this arrangement is that you must create and delete spam processing rules through Microsoft Outlook manually.

To create a spam processing rule:

  1. Open Microsoft Outlook and go to Service →Message rules in the main menu. The command for opening the tool depends on your version of Microsoft Office Outlook. This Help file describes how to create a rule using Microsoft Office Outlook 2003.
  2. In the Rules and Alerts windows that opens, click New Rule on the E-mail Rules tab to open the Rules Wizard.The Rule Wizard will guide you through the following windows and steps:

    step one

    You can choose to create a rule from scratch or from a template. Select Start from a blank rule and select Check messages when they arrive. Click the Next button.

    step two

    In the Rule Conditions window, click Next without checking any boxes. Confirm in the dialog box that you want to apply this rule to all e-mails received.

    step three

    In the window for selecting actions to apply to messages, check [image] perform a custom action from action list. In the lower portion of the window click custom action. In the window that opens, select Kaspersky Anti-Spam from the dropdown menu and click OK.

    step four

    In the window for selecting exceptions to the rule, click Next without checking any boxes.

    step five

    In the window for finishing creating the rule, you can edit its name (the default is Kaspersky Anti-Spam). Make sure that [image] Turn on this rule is checked and click Finish.
  1. The default position for the new rule is first on the rule list in the E-mail Rules window. If you like, move this rule to the end of the list so it is applied to the e-mail last.

All incoming e-mails are processed with these rules. The order in which the program applies the rules depends on the priority you assign to each rule. The rules are applied from the beginning of the list. Each subsequent rule is ranked lower than the previous one. You can change the priority for applying rules to e-mails.

If you do not want the Anti-Spam rule to further process e-mails after a rule is applied, you must check [image] Stop processing more rules in the rule settings (see Step Three in creating a rule).

If you are experienced in creating e-mail processing rules in Microsoft Office Outlook, you can create your own rule for Anti-Spam based on the setup that we have suggested.
Also see:

Configuring spam processing in Microsoft Outlook Express (Windows Mail)

Configuring spam processing in The Bat!


Configuring spam processing in Microsoft Outlook Express (Windows Mail)

Warning!

When enabling/disabling the Microsoft Outlook Express plugin, the email application must be restarted.

Microsoft Outlook Express plugin will de disabled if you enable compatibility mode of Kaspersky Internet Security with other applications.
By default, e-mail that is classified by Anti-Spam as spam or probable spam is marked with special markings [!! SPAM] or [?? Probable Spam] in the Subject line.
Additional actions on spam and probable spam in Microsoft Outlook Express (Windows Mail) can be found in a special window that opens when you click the Settings button near the other Anti-Spam buttons on the tasks panel: Spam and Not spam.
It opens automatically when the mail client is first opened after installing the program and asks if you what to configure spam processing.
You can assign the following processing rules for both spam and probable spam:
    Move to folder - spam is moved to the folder of your inbox that you specify.
    Copy to folder - a copy is created of the e-mail and it is moved to the specified folder. The original e-mail stays in your inbox.
    Delete - delete spam from the user's mailbox
    Skip - leave the e-mail in the inbox
To do so, select the appropriate value from the dropdown list in the Spam or Probable Spam section.
Also see:

Configuring spam processing in Microsoft Office Outlook

Configuring spam processing in The Bat!


Configuring spam processing in The Bat!

Actions on spam and probable spam in The Bat! are defined by the client's own tools:
To set up spam processing rules in The Bat!,
  1. Select Preferences from the Options menu.
  2. Select Spam protection from the settings tree.
The protection settings for spam presented extend to all the anti-spam modules installed on the computer that support work with the Bat!
You must set the rating level and specify how to respond to e-mails with a certain rating (in the case of Anti-Spam, the likelihood that the e-mail is spam):
  • Delete the e-mails with a rating higher than a given value.
  • Move e-mails with a given rating to a special folder for spam.
  • Move spam marked with special headers to the spam folder.
  • Leave spam in the Incoming folder.

Warning!
After processing an e-mail, Kaspersky Internet Security assigns a spam or probable spam status to the e-mail based on a factor with a value that you can adjust. The Bat! has its own e-mail rating algorithm for spam, also based on a spam factor. So that there is no discrepancy between the spam factor in Kaspersky Internet Security and in The Bat!, all the e-mails scanned by Anti-Spam are assigned a rating in accordance with the e-mails status: good mail - 0%, probably spam - 50 %, spam - 100 %.
Thus, the e-mail rating in The Bat! Corresponds not to the e-mail factor assigned in Anti-Spam but to the factor of the corresponding status.

For more details on the spam rating and processing rules, see documentation for The Bat!
Also see:

Configuring spam processing in Microsoft Office Outlook

Configuring spam processing in Microsoft Outlook Express (Windows Mail)


Anti-Spam statistics

Certain current component statistics (number of messages scanned during current component session, number of spam messages detected as well as the size of the spam collection used in the scan) are shown in the application main window . Select [image] Anti-Spam under Protection to view.
To view a detailed component report, click Open Report (component currently running) or Open Last Start Report (component disabled) .

Anti-Spam comprehensive statistics are shown in the upper part of the report and contain the total number of e-mails processed and the number of e-mails marked as spam. If Anti-Spam does not have enough information to accurately classify mail, the heading of the report says how many e-mails are necessary to perform additional training. You can complete training using the Training Wizard, with outgoing e-mails, from mail clients, and also directly from the report.

Basic information on Anti-Spam operation is grouped on tabs in the middle of the window.

  • A complete list of events that have arisen while using the component is kept on the Events tab. This is where the results of the Anti-Spam training are displayed, showing the factor, category, and reasons for one or another e-mail classification.
    • Using the special context menu, you can train while viewing the report. To do so, select the name of the e-mail and open the context menu by right-clicking and select Mark as spam, if the e-mail is spam, or Mark as accepted, if the selected e-mail is accepted e-mail. In addition, based on the information obtained by analyzing the e-mail, you can add to the Anti-Spam white and black lists. To do so, use the corresponding items on the context menu.
  • Settings used for filtering and processing e-mails are listed on the Settings tab.

Information types may be selected in each of the report tabs, information may be sorted by columns in ascending or descending order and searched. This is accomplished by using context menus accessible by right-clicking report column headers .


Viewing Message Information

This window shows message details: source address, subject, send date as well as message status assigned by the scan (spam or not spam).

The table shows the criterion used to determine the status of a message as well as a spam or potential spam weight and additional scan parameters, which contributed to the status being assigned.


Parental Control

Parental Control is a Kaspersky Internet Security component that monitors user access to the Internet. Its main objective is to restrict access, first and foremost, to the following resources:

  • Websites for an adult audience or whose contents deal with pornography, weapons, illicit drugs, violence, etc.
  • Websites that could lead to wasting time (chat rooms, games) or money (e-stores, auctions).

It should be noted that such websites often contain a large number of malicious programs, and downloading data from such sites as gaming sites can substantially boost Internet traffic.

User access to web resources may be restricted by assigning a user one of the three preinstalled browsing profiles.

User access to websites is restricted by giving a user a profile for accessing the Internet. A profile consists of a set of rules that control any user attempt to access any website. The decision to grant or deny access to a requested web page is made by comparing its URL with a white and a black list of web addresses and by making a determination whether the content of the web page belongs to one or more prohibited categories .

If no profile is assigned, the most restrictive Child profile is assigned by default. A single profile may be assigned several accounts. When using his/her account to log into the system, a user is granted access to web resources as permitted by the settings in the user profile.

Access to the Child or the Teenager profiles may be password protected. You can only switch to a password-protected profile after entering this password.

Let's take a look at how Parental Control works:

  1. The user logs into the system.
    • if the account under which the user logs into the system is not assigned one of the available profiles, the most restrictive (as compared to the other profies) Child profile is loaded by default;
    • if the profile assigned an account is disabled, the account is assigned the Child profile;
    • if the user account is linked to a certain profile, that profile is loaded.
  2. The user accesses a website while using the computer under the user account controlled by the profile.

    A verification is performed for access time limitations. The URL of the requested page is scanned and matched against the white and the black lists , and page content is analyzed to determine whether it falls under disallowed categories .
    3. In the event that after the above actions are completed no time constraint is discovered, the web address is explicitly specified in the white list and is not listed in the black list and in the event that the page is not in a disallowed category, it is loaded into the browser window . If even one of these conditions is not met, the website is blocked.
  3. The user is not given access to the requested website because of the restrictions on the active profile. For example, profile with substantial restrictions is currently active. If the user has access to the password for a profile other than the active one, he/she can switch to that profile.

Also see:

Parental Control Status

Pausing/disabling Parental Control

Switch users

Parental Control Settings

Parental Control Statistics


Parental Control Status

To view current component status, select [image] Parental Control under Protection in the left pane of the application main window. Summary information on firewall modules will be shown on the right .

Parental Control status is the most important parameter :

  • Parental Control : running – any user attempt to access websites is scanned according to the settings of the active profile.
  • Parental Control : paused – the component is paused. Component will restart automatically after a given period of time or after the application is restarted . Component may be activated manually. Click Resume operation.
  • Parental Control : disabled – the component has been disabled by the user. Parental Control may be reactivated by clicking Enable.
  • Parental Control : not running – the component is not available for some reason. For example, you do not have a license key to use the program.
  • Parental Control : error - the component has encountered an error.
    • If a component encounters an error, try restarting it . If restart should result in an error, review component report which might contain the reason for the failure . If you are unable to troubleshoot the issue on your own, save the component report to a file using Action → Save As and contact Kaspersky Lab Technical Support .

Component status is followed by the currently active user profile as well as the security level used to monitor web access . To edit current component settings, click Configure.

Certain component statistics are displayed in the main window : number of web pages scanned and number of attempts to view disallowed web resources . Use the Open Report link to view a detailed report on the component's current performance .

If for some reason the component is paused or stopped at a given moment in time, its results at the time of deactivation may be viewed by clicking Open last start report.


Pausing/disabling Parental Control

Parental Control is enabled by default. If required, http and https connection scanning may be suspended or disabled . Let us look at ways of disabling the component in greater detail .

To pause Parental Control for a certain amount of time:

Select [image] Parental Control under Protection in the main window and use the Pause link.

Component status will change to Paused . Web access monitoring will be suspended until the application is restarted or until the component is activated by clicking Resume operation.

When you pause Parental Control, the component statistics for the current Kaspersky Internet Security session are saved and will continue to be recorded after the component is updated.

To stop Parental Control:

select Parental Control under Protection in the main window and use the Stop link. Component status will change to disabled . Web access monitoring will be disabled until Enable is clicked.

Component may also be shut down from the application settings window . Select [image] Parental Control under Protection and uncheck [image] Enable Parental Control.

When Parental Control is stopped, all previous statistics are reset and will be generated from scratch once the component is restarted.

Please note that once the component is completely shut down it will not be automatically re-enabled after the application is restarted . The component will need to be restarted manually by clicking [image] Enable Parental Control.

Stopping the component will change its status to disabled and make its name inactive (grayed out) in the Protection section component list .

Website access control can also be disabled by fully disabling protection on your computer.


Switch users

The currently active profile may be changed . This may be required if the active profile has restrictions on access to web resources and prevents you from having unrestricted access to the Internet.

If you know the Parent or Teenager profile password (no password may be specified for the Child profile), you can switch profiles in the Kaspersky Internet Security main window . Select [image] Parental Control under Protection in the main window left pane and click on Change profile to.... Select the desired profile from a drop down list in the resulting window and enter password .


Parental Control Settings

Warning:
When using Parental Control, we recommend enabling program password protection. This helps to avoid unauthorized changes to profile settings by other users.

To configure the Parental Control settings, take the following actions:

  • Assign profiles to user accounts;

  • Password protect access to profiles;
  • Set restrictions for each profile and configure filters for the selected level of restriction.
  • Select actions to be undertaken in the event of an attempt to access disallowed web sites .

  • Set a time limit for each profile.


Working with profiles

A Profile is a set of rules that control user access to certain websites. There are three default preinstalled profiles:

  • Child (this profile is the default)
  • Teenager
  • Parent

An optimized set of rules has been developed for each preinstalled profile, taking into account age, experience, and other group characteristics. The Child profile has the greatest restrictions, whereas the Parent profile has none. Preinstalled profiles may not be deleted but Child and Teenager may be modified at user discretion .

Following installation, the Child profile is used by default for all accounts which have not been assigned a profile .

To use preconfigured Teenager and Parent profiles check Use Profile on the [image] Settings: Profiles window . As a result, the selected profiles will be displayed in a drop-down list under Profiles in the [image] Parental Control configuration dialog.

Under Password specify a password for the selected profile. Subsequent switching to profile will not be possible without entering the password. Child is not password protected.

Under Users Microsoft Windows accounts may be assigned the selected Parental Control profile .

If you need more than the preinstalled profiles, you can create your own. To do so, use the Add button to the right of the list. To configure and delete profiles, use the appropriate buttons. You might also need to temporarily disable a certain profile. To do so, deselect the [image] checkbox next to it.

If you do not want the configured profile to be applied to user account, select this user in the list and press the Delete button.

For Parental Control to work optimally, it is recommended to connect the profile to a particular user account. If several profiles are being used under one user account, it is recommended to regularly clear the cache of your web browser (cached web pages, temporary files, cookies, saved passwords). Otherwise there is a risk that web pages viewed by a user with an unrestricted profile by a user with a profile with minimum rules.

To edit profile settings:

  1. Open the application settings window and select Parental Control under [image] Protection.
  2. Select a preinstalled profile to modify from a drop-down list under Profiles and click Settings .


Selecting Security Level

Parental Control provides access control to Internet resources at one of the following levels:

    Maximum Protection: a level at which access to all categories of web sites is restricted.
    Recommended. this level's settings are recommended by Kaspersky Lab experts. It allows access to web mail and chat rooms.
    High Speed: a level whose settings allow access to all internet resources except for those in the "hardest" categories, such as : drugs, violence, pornography, etc.

By default access control to internet resources is set to the Recommended level. This level of access control may be raised or lowered by selecting the appropriate settings or reconfiguring the current security level.

To modify security level:

move slider. By adjusting the security level, you define the number of disallowed web site categories which will be considered for access to internet resources.

If none of the restriction levels meet your requirements, their settings may be customized. Select a level closest to your requirements as basis and edit its parameters. This will change the security level to Custom. Let us look at an example when preconfigured restriction level settings may need to be modified.

Example:

You would like to prevent your child from visiting adult web sites or web sites that will potentially cause loss of time or money. However, you must send your child email messages with some useful information.

Tip on level selection:

Select the Child profile. The High level of restrictions may be used as basis. Add the external mail service with your child's mailbox to the white list. This will give your child access to this mail service only.

To change current level of restrictions:
  1. Open the application settings window and select [image] Parental Control under Protection.
  2. Click Customize under Limitation Level.
  3. Edit access control settings in the resulting window and click OK.

This will create a fourth security level (Custom) with customized security settings.


Configuring Filters

Restrictions applied to Parental Control profiles are based on filters. A Filter is a series of criteria used by Parental Control to make decisions to load a web site.

To change filter settings for current level of restrictions:
  1. Open the application settings window and select [image] Parental Control under Protection .
  2. Select a profile from the drop-down list under Profiles and click Customize under Limitation Level .
  3. Edit filter settings in the appropriate tabs of the [image] Profile Settings: <profile name> window.

See also:

Blocking by Category

White List Filtering

Black List Filtering

Adding Web Site Address Masks to Filter


Filter settings

This window is used to configure blocking by category. First "bad" sites that are related to pornography, weapons, drugs, etc. are blocked. Then, the content of websites is analyzed using keywords that classify them in certain thematic categories. If the number of words in an unwanted category exceeds the selected threshold, access to that site will be blocked.

A keyword and website database is included with Kaspersky Internet Security and is updated along with the program.

Note: The blocked categories listed is limited to the default list. You cannot create your own blocked categories.

To configure filtering by category, specify categories of web sites to be blocked .

Also see:

White List Filter

Black List Filtering

Adding addresses to the website address filter


White List Filtering

This window is used to configure filtering based on the white list which is a listing of allowed sites .

To configure the white list filter create a listing of web addresses which may be accessed by clicking Add and entering the requisite data in the resulting dialog.

Use appropriate buttons to edit entries in or delete entries from the white list .

Also see :

Filter settings

Black List Filtering

Adding addresses to the website address filter


Black List Filtering

This window is used to configure filtering based on the black list which is a listing of disallowed sites .

To configure the black list filter create a listing of web addresses which may not be accessed by clicking Add and entering the requisite data in the resulting dialog.

Use appropriate buttons to edit entries in or delete entries from the black list .

Also see :

Filter settings

White List Filtering

Adding addresses to the website address filter


Adding addresses to the website address filter

To create a list of allowed or blocked addresses, you must enter each address in the corresponding field in the Add URL mask window.

When entering a trusted address, you can create masks with the following wildcards:

    * - any combination of characters.
    Example: If you create the mask *abc*, no URL contain abc will be scanned. For example: www.virus.com/download_virus/page_0-9abcdef.html.
    ? - any one character.
    Example: If you create mask Patch_123?.com, URLs containing that series of characters plus any character following the 3 will not be scanned. For example: Patch_1234.com. However, patch_12345.com will be scanned.

If an * or ? is part of an actual URL added to the list, when you enter them, you must use a backslash to override the * or ?, or \ following it.

Example: You want to add this following URL to the trusted address list: www.virus.com/download_virus/virus.dll?virus_name=

For Kaspersky Internet Security not to process ? as a wildcard, put a backslash in front of it. Then the URL that you are adding to the exclusion list will be as follows: www.virus.com/download_virus/virus.dll?virus_name=


Recovering Default Profile Settings

In configuring Parental Control, there is always the option to fall back on the recommended settings. These are considered optimized, are recommended by Kaspersky Lab specialists, and are grouped into the Recommended security level.

To restore default email protection settings,
  1. 1. Open the application settings window and select [image] Parental Control under Protection.
  2. Click the Default button under Limitation level .


Configuring Response to Attempts to Access Disallowed Web Sites

If there is an attempt to access a disallowed web resource, the [image] Parental Control component performs the action specified under Action in the Parental Control section of the application settings window.

By default, the Parental Control component will block and log information on any attempt to access a disallowed site. Let us look at control options relative to an attempt to access disallowed web sites.

If you specified | that if unauthorized access to a disallowed web resource is detected the action is to
Log Event | Component logs information on attempts to access a disallowed resource
Block Access | Component blocks access to the disallowed site and logs the event


Access Time Limit

Time limits on Internet access may be configured under Time Limit in the [image] Parental Control section of the application settings window. Click Settings to configure restrictions .

Under Maximum Time, you may specify the total amount of time (hours) access to the Internet is granted in a 24-hour period.

To limit access to the Internet to the certain hours within day, check Allow Internet access at specified time and set time intervals when work on the Internet is allowed. For this use the Add button and in the opened window specify time limits. For editing the list of the resolved work intervals use corresponding buttons.

If you specified both the time limits with one limit greater than the other, the lesser value will be selected.

Example: for the Child profile you specified 3 hours under Maximum Time that a user with this profile will have access to internet resources, and 2 pm to 3 pm under Allowed time. As a result, access to the Internet will be allowed during the latter time period only despite the permitted number of hours.


Defining a Time Interval

A time interval may be specified for each profile during which users with that profile will have the use of internet resources. Thus, for example, internet access may be permitted between 2:30 pm and 5:00 pm. Set a time limit using the from and the to fields. Several time intervals may be set within the same 24-hour period.


Parental Control Statistics

Certain current component performance statistics (number of web pages scanned and number of blocked attempts to access disallowed web resources) are displayed in the application main window . Select [image] Parental Control under Protection to view .

To view a detailed component report, click Open Report (component currently running) or Open Last Start Report (component disabled).

Basic information on component operation is grouped on tabs in the middle of the window.

  • A complete list of events that have arisen while using the component is kept on the Events tab. Events can be either informative or critical. As a rule, the informative events are of a reference nature and are not of particular interest. You can disable these notices. To do this, deselect the [image] Show all events checkbox.
  • The Statistics tab contains information on each profile used in the component: the total number of user attempts to access various websites and the number of attempts blocked.

Information types may be selected in each of the report tabs, information may be sorted by columns in ascending or descending order and searched. This is accomplished by using context menus accessible by right-clicking report column headers .


Scanning for viruses on your computer

One of the important parts of protecting your computer from viruses is scanning for viruses in the areas that the user specifies. Kaspersky Internet Security 7.0 can scan individual items for viruses (files, folders, disks, plug-and-play devices), or the entire computer as a whole. Scanning for viruses rules out the possibility of malicious code from spreading that has escaped detected by protection components for one reason or another.
Kaspersky Internet Security 7.0 includes the following scan tasks.
Critical areas

Scans all critical areas of the computer for viruses. This includes: system memory, programs loaded on startup, boot sectors on the hard drive, and the Windows and system32 system directories. The aim is to quickly detect active viruses in the system without fully scanning the computer.

My Computer

Search for viruses on your computer with a through scan of all disk drives, memory, and files.

Startup objects

Scans all programs that are loaded when the operating system boots up for viruses.

Rootkit scan

Scans the computer for rootkits that hide malicious programs in the operating system. These utilities injected into system, hiding their presence and the presence of processes, folders, and registry keys of any malicious programs described in the configuration of the rootkit.

The default settings for these tasks are the recommended ones. You can edit these settings or create a schedule for running tasks.
You also have the option of creating virus scan tasks and creating a performance schedule for them. For example, you can create a scan task for mailboxes once per week or a virus scan task for the My Documents folder.
In addition, you can scan any object for viruses (for example, the hard drive where programs and games are, e-mail databases that you've brought home from work, an archive attached to an e-mail, etc.) without creating a special scan task. You can select an object to scan from the Kaspersky Internet Security 7.0 interface or with the standard tools of the Microsoft Windows operating system (for example, in the Explorer program window or on your Desktop, etc.).
You can view a complete list of virus scan tasks for your computer in the [image] Scan section in the left portion of the main program window.
You can create a rescue disk designed to help recover the system following a virus attack resulting in operating system file damage and boot failure. To accomplish this, click on Create Rescue Disk.
Also see:
Virus scan task status
Managing virus scan tasks
Creating a list of objects to scan
Creating virus scan tasks
Configuring virus scan tasks
Virus scan statistics


Virus scan task status

To view virus scan task status, open the application main window and select the desired task (such as, My Computer ) under [image] Scan.
You will see the list of objects to be scanned during a given task in the upper part of the window under the status line. You can edit this list by adding or removing objects from it.
Click on Start Scan to scan selected objects . The main window will display task status while the task is running : number of objects scanned and the estimated time of completion . Use the Details link to view a detailed report .
A task may be suspended by clicking on Pause or stopped by clicking Stop. To re-start a suspended task click Resume. If the task is stopped, clicking Start Scan will display a prompt either to resume or to re-start the scan.
If a scan task is not running, the results of its previous run may be viewed by clicking Last Start Report.
The Settings section displays the settings with which the current task is operating. This specifies the Security Level, task run mode, and the action to be performed by the application when malicious objects are detected. To edit current task settings , click Settings.
Use the New Scan Task link to create a new virus scan task from current task settings. It should be noted that the new task will inherit the settings of the parent task; therefore, it is recommended that they be edited. The newly created task can also be renamed or deleted.


Managing virus scan tasks

You can run a virus scan task manually or automatically using a schedule.
To start a virus scan task manually,

select task name under [image] Scan in the application main window and click Start Scan.

The tasks currently being performed are displayed in the context menu by right-clicking the application icon in the taskbar notification area.

To pause a virus scan task ,

Select the task name in the Scan section of the main program window and click Pause link in the context menu. This will pause the scan until you start the task again manually or it starts again automatically according to the schedule. To start the manual scan use the Resume link.

To stop a virus scan task ,

Select the task name in the Scan section of the main program window and click Stop link in the context menu. This will stop the scan until you start the task again manually or it starts again automatically according to the schedule. The next time you run the task, the program will ask if you would like to continue the task where it stopped or begin it over.


Creating a lists of objects to scan

To view a list of objects to be scanned with a particular task, select the task name (for example, My computer) in the [image] Scan section of main program window. The list of objects will be displayed in the right-hand part of the window.
Object scan lists are already made for default tasks created when you install the application. When creating your own tasks or when selecting an object for a virus scan task, you can create a list of objects.
You can add to and edit an object scan list using the buttons to the right of the list. To add a new scan object to the list, click the Add button, and in the window that opens select the object to be scanned.To delete an object, select it in the list (when you do so, the name of the object will be highlighted in gray) and click the Delete button. You can temporarily disable scanning for individual objects for any task without deleting them from the list. To do so, you only need to uncheck the object that you do not want scanned.
For the user’s convenience, you can add categories to a scan area such as user mailboxes, RAM, startup objects, operating system backup, and files in the Kaspersky Internet Security Quarantine folder.
In addition, when you add a folder that contains embedded objects to a scan area, you can edit the recursion. To accomplish this, select an object from the list of objects to be scanned, open the context menu, and use the Include Subfolders option .
To start scan, click on Start Scan.
In addition, you can select an object to be scanned with the standard tools of the Microsoft Windows operating system (for example, in the Explorer program window or on your Desktop, etc.). To do so, place the cursor or the name of the selected object, open the Microsoft Windows context menu by right-clicking, and select Scan for viruses.


Creating your own virus scan tasks

Creating virus scan tasks

To scan objects on your computer for viruses, you can use built-in scan tasks included with the program, as well as creating your own tasks. New tasks are created based on scan tasks that already exist.
To create a new virus scan task,
  1. Select the task with the settings closest to those you need in the [image] Scan section of the main program window.
  2. Open context menu and select Save As or click on New Scan Task.

  3. Enter the name for the new task in the window that opens and click OK. A task with that name will then appear in the list of tasks in the Scan section of the main program window.
Warning!
There is a limit to the number of tasks that the user can create. Maximum number of tasks is four.
The new task inherits all the properties of the task on which you based it. You need to continue setting it up by creating an scan object list, setting up properties that will govern the task, and, if necessary, configuring a schedule for running the task automatically.
To rename a newly created task,

select a task under Scan in the application main window and click Rename.

Enter the new name for the task in the window that opens and click OK. The task name will the be changed in the Scan section.
To delete a created task ,

select a task under Scan in the application main window and click Delete.

Confirm that you want to delete the task in the window that asks you for confirmation. The task will then be deleted from the list of tasks in the Scan section.
Warning!
You can only rename and delete tasks that you have created.
Also see:
Configuring virus scan tasks


Configuring virus scan tasks

What methods you use to scan objects on your computer is determined by a set of properties assigned for each task.
To begin configuring task settings,

open application settings window and select task name under [image] Scan.

You can use the settings window for each task to:
  • select a security level with the settings that the task will use;
  • edit advanced settings:
    • specify the settings that define what file types are to be scanned for viruses;
    • configure task start using a different user profile;
    • configure advanced scan settings;
    • enable rootkit scan and heuristic analysis.
  • restore default scan settings;
  • select an action that the program will apply when it detects an infected or potentially infected object;
  • create a schedule to automatically run tasks.
In addition, you can configure universal settings for running all tasks.
This Help section will examine the task settings listed above in detail.


Selecting a security level

Each virus scan task scans objects on one of these levels:
Maximum Protection - the most complete scan of the entire computer or individual disks, folders, or files. We recommend using this level if you suspect that a virus has infected your computer.
Recommended. Kaspersky Lab experts recommend this level. The scan works the same as on Maximum Protection , except for e-mail formatted files.
High Speed - level with settings that let you comfortably use applications that require significant system resources, since the set of files scanned is cut back.
By default, file scanning is set to Recommended.
You can raise or lower the scan security level by selected the level you want or changing the settings for the current level.
In order to change the security level,

Adjust the sliders. By adjusting the security level, you define the ratio of scan speed and the total number of files scanned: the fewer files are subject to analysis for viruses, the higher the scan speed.

If none of the file security levels listed meet your needs, you can customize the scan settings. It is recommended that you select a level closest to your requirements as basis and edit its parameters . This will change the name of the security level to Custom.
To modify the settings for the current security level,
  1. Open application settings window and select scan task name under [image] Scan.
  2. Click the Customize button in the Security Level area.

  3. Edit file protection parameters in the resulting window and click OK .
Also see:
Defining the types of objects to be scanned
Other virus scan settings
Restoring default scan settings


Defining the types of objects to be scanned

When specifying the types of objects to be scanned, you establish what file formats, sizes, and what drives will be scanned for viruses this task runs.
The types of file to be scanned is defined in the File types section. Select one of the three options:
    Scan all files. With this option, all files will be scanned without exception.
    Scan programs and documents (by content). If you select this group of programs, only potentially infected files will be scanned - files into which that a virus could imbed itself.
    Note:
    There are a number of file formats that have a fairly low risk of having malicious code injected into them and subsequently being activated. An example would be .txt files.

    And vice versa, there are file formats that contain or can contain executable code. Examples would be the formats .exe, .dll, or .doc. The risk of injection and activation of malicious code in such files is fairly high.

    Before searching for viruses in an object, its internal header is analyzed for the file format (txt, doc, exe, etc.).

    Scan programs and documents (by extension). In this case, the program will only scan potentially infected files, and in doing so, the file format will be determined by extension. Using the extension link, you can review a list of file extensions that are scanned in this case.
    Tip:
    Do not forget that someone could send a virus to your computer with the extension .txt, although in reality it could be an executable file renamed as a .txt file. If you select the Programs and documents (by extension) option, such a file would be skipped by the scan. If the Programs and documents (by content) is selected, ignoring extensions, the program will analyze file headers, which will uncover that the file is an .exe file. Such a file would be thoroughly scanned for viruses.

In the Productivity section, you can specify that only new files and those that have been modified since the previous scan should be scanned for viruses. This mode of operation noticeably cuts down on scan time and increases the program's performance speed. To do so, you must check [image] Scan only new and changed files. This mode extends to simple and compound files.

You can also set time and file size limits for scanning in the Productivity section:

    Stop if scan takes longer than... sec. Check this option and enter the maximum scan time for an object. Then, if this time is exceeded, this object will be removed from the scan queue.
    Do not scan archives larger than... MB.. Check this option and enter the maximum size for an object. Then, if this size is exceeded, this object will be removed from the scan queue.
In the Compound files section, specify which compound files must be analyzed for viruses:
Scan All/New only archives – scan .RAR, .ARJ, .ZIP, .CAB, .LHA, .JAR, and .ICE archives.
Warning!

Kaspersky Internet Security does not delete compressed file formats that it does not support (for example, .ha, .uue, .tar) automatically, even if you select the option of automatically curing or deleting if the objects cannot be cured.

To delete such compressed files, click the Delete archives link in the dangerous object detection notification. This notification will be displayed on the screen after the program begins processing objects detected during the scan. You can also delete infected archives manually.

Scan All/New only embedded OLE objects - scan objects imbedded in files (for example, Excel spreadsheets or a macro imbedded in a Microsoft Word file, e-mail attachments, etc.).
For each type of compound file, you can select and scan all files or only new ones. To do so, use the link next to the name of the object. It changes its value when you left-click it. If the Productivity section has been set up only to scan new and changed files, you will not be able to select the type of compound files to be scanned.
Parse email formats - scan e-mail format files and e-mail databases. If this checkbox is enabled, Kaspersky Internet Security disects the mail format file and analyzes each component of the e-mail (body, attachments, etc.) for viruses. If this box is not checked, the file format file will be scanned as a single object.
Please note these points of scanning password-protected e-mail databases:
  • Kaspersky Internet Security detects malicious code in Microsoft Office Outlook 2000 databases but does not treat them;
  • the program does not support scans for malicious code in Microsoft Office Outlook 2003 protected databases.
Scan password-protected archives - scans password protected archives. With this feature, a window will request a password before scanned archived objects. If this box is not checked, password-protected archives will be skipped.
Also see:

Restoring default scan settings


Advanced virus scan options

In addition to configuring the basic virus scan settings, you can also use advanced settings:

  • Starting tasks under another user account
  • Configuring use of virus scan technologies and performance settings for virus scans

Starting tasks with another user’s rights

Kaspersky Internet Security 7.0 has a feature that can start scan tasks under another profile. This feature is by default disable, and tasks are run under the profile under which you are logged into the system.
So, for example, you might need access rights to a certain object during a scan. By using this feature, you can configuring tasks to run under a user that has the necessary privileges.
To configure a scan task that starts under a different user profile,
  1. Open application settings window and select task name under [image] Scan.
  2. Click on Customize under Security Level and open the Additional tab in the resulting dialog.
To enable this feature, check [image] Run this task as. Enter the data for the login that you want to start the task as below: user name and password.

Other virus scan settings

Additional settings of virus scan tasks are configured under Advanced Options:
    Use iChecker technology - use technology that can increase the scan speed by skipping certain objects. An object is excluded from the scan using a special algorithm that takes into account the release date of the threat signatures, the date the object was last scanned, and modifications to scan settings.
    For example, you have an archived file that the program scanned and assigned the status of not infected. The next time, the program will skip this archive, unless it has been altered or the scan settings have been changed. If the structure of the archive has changed, because a new object has been added to it, if the scan settings have changed, or if the application databases have been updated, the program will scan the archive again.
    There are limitations to iChecker: it does not work with large files and only applies to objects with a structure that Kaspersky Internet Security recognizes (for example, .exe, .dll, .lnk, .ttf, .inf, .sys, .com, .chm, .zip, .rar).
    Use iSwift technology - This technology is a development of iChecker technology for computers using an NTFS file system. There are limitations to iSwift: it is bound to a specific location for the file in the file system and can only be applied to objects in an NTFS file system.
    Register information about dangerous objects in application statistics: - save information on dangerous objects detected in the application’s overall statistics and display list of threats on the Detected tab of the report window. If this box is unchecked, dangerous object data will not be recorded in the report; therefore, these objects will be impossible to process.
    Concede resources to other applications – pause the given virus scan task if the processor is busy with other applications.


Detecting rootkits and using heuristic methods to scan for viruses

On the Heuristic analyzer tab, you can enable/disable rootkit detection and use heuristic methods to run virus scan tasks. To do so, take the following steps:

  1. Open application settings window and select scan task name under [image] Scan.
  2. Click on Customize under Security Level and open the Heuristic Analyzer tab in the resulting dialog.

Scanning for rootkits

Rootkits are sets of tools that can hid malicious programs in your operating system. These utilities injected into system, hiding their presence and the presence of processes, folders, and registry keys of any malicious programs described in the configuration of the rootkit.

You can scan for rootkits with any virus scan task (provided that this feature is enabled in the settings for that task). However, Kaspersky Lab has created and optimized an independent scan task for this type of malicious program.

To enable rootkit detection, select [image] Enable rootkit detection in that section. If you are scanning for viruses, you can set up in-depth scanning for rootkits by selecting [image] Enable extended rootkit scan. If you do so, the scan will carefully search for these programs by analyzing a large number of various objects. These checkboxes are deselected by default, since this mode requires significant operating system resources.

Using heuristic methods

Of course, scanning using the signature method with a database created previously containing a description of known threats and methods for treating them will give you a definite answer regarding whether a scanned object is malicious and what dangerous program class it is classified as. The heuristic method, unlike the signature method, is aimed at detecting typical behavior of operations rather than malicious code signatures that allow the program to make a conclusion on a file with a certain likelihood. The advantage of heuristic analysis is that you do not have to update the database before scanning. Because of this, new threats are detected before virus analysts have encountered them.

Heuristic analyzer emulates object execution in the Kaspersky Internet Security secure virtual environment. If an object does not exhibit suspicious behaviour, its execution in operating environment is allowed. If suspicious activity is discovered as the object executes, the object will be deemed malicious and will not be allowed to run on the host or a message will be displayed requesting further instructions from the user:

  • Quarantine the new threat to be scanned and processed later using updated databases
  • Delete the object
  • Skip (if you are positive that the object cannot be malicious).

To use the heuristic method, select [image] Use heuristic analyzer. You can additionally select the level of detail of the scan. To do so, move the slider to one of these positions: Shallow, Medium, or Detail. The level of detail of the scan provides the balance between caution and quality of the scan for new threats and the load on operating system resources, as well as the duration of the scan. The higher you set the heuristics level, the more system resources the scan will require, and the longer it will take.

Warning:

New threats detected using heuristic analysis are quickly analyzed by Kaspersky Lab, and methods for disinfecting them are added to the hourly database updates.

Therefore, if you update your program databases regularly and maintain the optimal protection level on your computer, you will not need to use the heuristic method regularly.


Configuring a scan task schedule

You can run a virus scan task manually or automatically using a schedule.
The default schedule setting for the tasks created when the program is installed is off. The exception is startup items, which are scanned every time you start your computer.
If the task settings do not meet your needs, edit the settings for automatic scans. To accomplish this, open application settings window and select task name under [image] Scan .
To schedule a task, check the box next to scheduled task frequency under Run Mode . Task parameters may be modified in the Schedule dialog accessible through the Change button .
The most important step is to determine the frequency of how often the virus scan task starts. You can select one of these options:
At a specified time. The task will run once on the day and at the time that you specify.
At application startup. The task starts up every time Kaspersky Internet Security is run.
After every update. The task starts after each application databases update.
Minutely. The time interval between scans will be several minutes. Specify the number of minutes between scans in the schedule settings. It must not exceed 59 minutes.
Hours. The interval between scans is calculated in hours. If you select this frequency, specify the interval in the schedule settings: Every N-th hour and enter the value for N. For example, enter Every 1 hour if you want the task to run hourly.
Days - the task will run every several days. Specify how often the scan should run in the schedule settings:
  • Select the Every n-th day option and enter a value for n. Enter Every 2 day if you want to run the scan every other day.
  • Select Every weekday if you want the scan to run daily, Monday through Friday.
  • Select Every weekend for the task to run on Saturdays and Sundays only.

In addition to the frequency, specify what time of day or night the scan task will run in the Time field.

Weeks - the scan task will run on certain days of the week. If you select this option, put checkmarks next to the days of the week that on which you want the scan to run in the schedule settings. Also enter the time at which the scan task will run in the Time field.
Monthly - the scan task will run once per month at the specified time.

If a scan task is skipped for any reason (for example, the computer was not on at that time), you can configure the task that was missed to start automatically as soon as it can. To do so, check [image] Run task if skipped in the schedule window.

Also see:
Managing virus scan tasks


Restoring default scan settings

When configuring scan task settings, you can always return to the recommended settings. The Kaspersky Lab experts consider them to be optimal and have collected them in the Recommended security level.
In order to restore the default file scanning settings,
  1. Open application settings window and select task name under [image] Scan .
  2. Click the Default button in the Security Level area.
Also see:
Selecting a security level


Selecting actions for objects

If, while scanning a file for viruses, it is discovered that it is infected or suspected of being infected, the program's subsequent actions depend on the object's status and the action selected.
One of the following statuses can be assigned to the object after the scan:
  • status of a type of malicious program (for example, virus, Trojan).
  • Potentially infected, when the scan cannot determine whether the object is infected. It is likely that the program detected a sequence of code in the file from an unknown virus or modified code from a known virus.
By default, all infected files are subject to disinfection, and if they are potentially infected, they are sent to Quarantine.
To change an action for an object,

open application settings window and select task name under [image] Scan. All possible actions are shown in the relevant section .

If the action selected was
When it detects a malicious or potentially infected object
Prompt for action when the scan is complete
The program does not process the objects until the end of the scan. When the scan is complete, the statistics window will pop up with a list of objects detected, and you will be asked if you want to process the objects.
Prompt for action during scan
The program will issue a warning message containing information about what malicious code has infected (potentially infected) the file and gives you the choice of one of the following actions.
Do not prompt for action
The program records information about objects detected in the report without processing them or notifying the user. We do not recommend using this feature, since infected and potentially infected objects stay on your computer and it is practically impossible to avoid infection.
Do not prompt for action
Disinfect
The program attempts to treat the object detected without asking the user for confirmation. If disinfection fails, the file will be assigned the status of potentially infected, and it will be moved to Quarantine. Information about this is recorded in the report. Later you can attempt to disinfect this object.
Do not prompt for action
Disinfect
Delete if disinfection fails
The program attempts to treat the object detected without asking the user for confirmation. If the object cannot be disinfected, it is deleted.
Do not prompt for action
Disinfect
Delete
The program automatically deletes the object
Before attempting to treat the object or delete it, Kaspersky Internet Security creates a backup copy and sends it to backup in case the object needs to be restored or an opportunity arises to treat it.


Designating universal scan settings for all tasks

Each scan task is executed according to its own settings. By default, the tasks created when you install the program on your computer use the settings recommended by Kaspersky Lab experts.
You can configure universal scan settings for all tasks. You will use a set of properties used to scan an individual object for viruses as a starting point.
To assign universal scan settings for all tasks:
  1. Open program settings window and select [image] Scan section.
  2. Configure the scan settings: select the security level, configure advanced level settings, and select an action for objects.
  3. To apply these new settings to all tasks, click the Apply button in the Other scan settings section. Confirm the universal settings that you have select in the pop-up dialogue box.


Virus scan statistics

You can find general information about the operation of each virus scan task in the main window of the program. To review this information, select a task name in the [image] Scan section of the main program window.
Information on the latest task run and its current status is shown in the right pane of the application main window .
To view detail , click on Last Start Report. You will see a complete report on the results of the last scan, if the scan is already complete, or about the progress of the task. If the task is currently running , click Details.
The upper portion of the report contains composite statistics on the results of the task, as well as information on the number of objects scanned, the number of malicious objects detected, and the number of objects to be processed. Scan start time, estimated completion time, and duration are also shown.
Basic information on scan results is grouped by tab in the middle of the window.
  • All dangerous objects detected while scanning are listed on the Detected tab. Here you will find the full path to the location of each object and the status assigned to it by the program: if what malicious program infected the object was successfully established, it will be assigned the appropriate status. For example, virus, Trojan, etc. If the type of malicious effect cannot be exactly established, the object is assigned the status suspicious. Next to the status, the action taken for the object is specified (detected, not found, disinfected).
    • In order for this tab not to contain information about disinfected objects, uncheck [image] Show neutralized objects.
  • The Events tab displays a complete list of events that have arisen during the scan. The events can have the following statuses:
    • Informative event (for example: object not processed: skipped by type).
    • Warning (for example: a virus is detected).
    • Note (for example: archive is password-protected).

As a rule, the informative messages are of a reference nature and are not of particular interest. You can disable display of informative messages. To do so, uncheck [image] Show all events.

  • Scan statistics appear on the appropriate tab. Here you will find the total number of objects scanned, and then special columns separately display how many objects out of the total number scanned are archives, how many are dangerous, how many have been disinfected, how many sent to Quarantine, etc.
  • The settings used for the scan with are displayed on the Settings tab. Use the Edit settings link to quickly configure the task.
    In addition, you can configure advanced settings for scan tasks:
    • Establish a scan task priority ranking to be used when the processor is weighed down. The default setting for [image] Concede resources to other applications is unchecked. With this feature, the program tracks the load on the processor and disk subsystems for the activity of other applications. If the load on the processor increases significantly and prevents the user's applications from operating normally, the program reduces scanning activity. This increases scan time and frees up resources for the user's applications.
    • Enable the Do shut down the computer when finished feature. You can set up the computer to shut down, restart, or go into standby or sleep mode. To select an option, left-click on the hyperlink until it displays the option you need.
      • This feature is helpful if, for example, you run virus scans at the end of the work day and do not want to wait for it to finish.
      However, this feature requires a few additional steps: before launching the scan, you must disable password requests for objects being scanned, if enabled, and enable automatic processing of dangerous objects. Then the program's interactive features will be disabled. The program will not ask questions that require an answer from you, which interrupts the scanning process.

Information types may be selected in each of the report tabs, information may be sorted by columns in ascending or descending order and searched. This may be accomplished by using context menus accessible by right-clicking report column headers .

If any errors occur during the scan, run the task again. If the attempt crashes, save a report with the results of task execution to file using the Actions → Save as button. Then contact the Technical Support Service. Kaspersky Lab specialists will assist you.

You can hide the report window with the current scan results. To do so, click Close. The virus scan will then continue.


Testing Kaspersky Internet Security features

After Kaspersky Internet Security is installed and configured, we recommend verifying the correctness of its settings and operation using a test "virus" and its modifications.

Also see:

Test "virus" EICAR and its modifications.

Testing File Anti-Virus

Testing Virus scan tasks


Test "virus" EICAR and its modifications

This test "virus" was specially designed by EICAR (The European Institute for Computer Antivirus Research) for testing anti-virus products.

The test "virus" IS NOT A VIRUS because it does not contain code that can harm your computer. However, most anti-virus products manufacturers identify this file as a virus.

Never use real viruses for testing the operation of an anti-virus product!

You can download this test "virus" from the official website of the EICAR organization at: http://www.eicar.org/anti_virus_test_file.htm.

The file that you downloaded from the EICAR website contains the body of a standard test virus. Kaspersky Internet Security will detect it, label it a virus, and take the action set for that object type.

To test the response of Kaspersky Internet Security when other types of objects are detected, modify the content of this standard test "virus" by adding one of the prefixes listed in Table below.

Prefix | Test virus status | Corresponding action when the application processes the object
No prefix, standard test virus | The file contains a test virus. You cannot disinfect the object. | The application will identify the object as malicious and not subject to treatment and will delete it.
CORR- | Corrupted. | The application could access the object but could not scan it, since the object is corrupted (for example, the file structure is breached, or it is an invalid file format).
SUSP- WARN- | The file contains a test virus (modification). You cannot disinfect the object. | This object is a modification of a known virus or an unknown virus. At the time of detection, the threat signature databases do not contain a description of the procedure for treating this object. The application will place the object in Quarantine to be processed later with updated threat signatures.
ERRO- | Processing error. | An error occurred while processing the object: the application cannot access the object being scanned, since the integrity of the object has been breached (for example, no end to a multivolume archive) or there is no connection to it (if the object is being scanned on a network drive).
CURE- | The file contains a test virus. It can be cured. The object is subject to disinfection, and the text of the body of the virus will change to CURE.. | The object contains a virus that can be cured. The application will scan the object for viruses, after which it will be fully cured.
DELE- | The file contains a test virus. You cannot disinfect the object. | This object contains a virus that cannot be disinfected or is a Trojan. The application deletes these objects.

The first column of the table contains the prefixes that need to be added to the beginning of the string for a standard test virus. The second column describes the status and reaction of Kaspersky Internet Security to various types of test virus. The third column contains information on objects with the same status that the application has processed.

Values in the anti-virus scan settings determine the action taken on each of the objects.


Testing File Anti-Virus

To test the functionality File Anti-Virus:

  1. Allow all events to be logged so the report file retains data on corrupted objects and objects not scanned because of errors. This is accomplished by checking [image] Log Non-Critical Events under [image] Reports and Data Files in the application settings dialog.
  2. Create a folder on a disk, copy to it the test virus downloaded from the organization's official website, and the modifications to the test virus that you created.

File Anti-Virus will intercept your attempt to access the file, will scan it, and will inform you that it has detected a dangerous object:

When you select different options for dealing with detected objects, you can test File Anti-Virus's reaction to detecting various object types.

You can view details on File Anti-Virus performance in the report on the component.


Testing Virus scan tasks

To test Virus scan tasks:

  1. Create a folder on a disk, copy the test virus downloaded from the organization's official website, and the modifications of the test virus that you created.
  2. Create a new virus scan task and select the folder, containing the set of test viruses as the objects to scan.
  3. 3. Allow all events to be logged so the report file retains data on corrupted objects and objects not scanned because of errors. To do so, check [image] Log non-critical events in the [image] Reports and Data Files settings window.
  4. Run the virus scan task.

When you run a scan, as suspicious or infected objects are detected, notifications will be displayed on screen will information about the objects, prompting the user for the next action to take:

This way, by selecting different options for actions, you can test Kaspersky Internet Security reactions to detecting various object types.

You can view details on virus scan task performance in the report on the component.


Updating the application

Keeping protection updated is a prerequisite of reliable protection of your computer. Because new viruses, Trojans, and malicious software emerge daily, it is important to update regularly the application to keep your information constantly protected.
Updating of the application implies that the following components will be downloaded and installed on your computer:
  • Anti-Virus and Firewall databases and network drivers

The application uses databases to protect information on your computer. The software components that provide protection use them to search for and disinfect harmful objects on your computer. The databases are added to every hour with new records of new threats and methods of how to fight them. Therefore, it is recommended that they be updated on a regular basis.

In addition to the Anti-Virus and Firewall databases, network drivers that enable protection components to intercept network traffic are updated.

Previous versions of Kaspersky Lab applications have supported both standard and extended databases sets. Each dealt with protecting your computer from different types of dangerous objects. In Kaspersky Internet Security you do not need to worry about selecting the appropriate databases set. Current versions of our products use Kaspersky Internet Security databases which protect both from malicious objects and riskware of various kinds and from hacker attacks .

  • Application Modules

In addition to the program databases, you can upgrade the modules for Kaspersky Internet Security. New application updates appear regularly.

Special Kaspersky Lab update servers are the primary update source for Kaspersky Internet Security .
For successful download of updates from servers your computer has to be connected to the Internet . In that event that connection to the Internet is through a proxy server, you will need to configure connection settings

If you do not have access to Kaspersky Lab update servers (for example, your computer is not connected to the Internet), you can call the Kaspersky Lab main office at +7 (495) 797-87-00 or +7 (495) 645-79-39 to request contact information of Kaspersky Lab partners that can provide you with zipped updates on floppy disks or CDs.
Updates can be downloaded in one of the following modes:
  • Automatically. Kaspersky Internet Security checks for updates from an update source at specified intervals. During virus outbreaks, the check frequency may increase, and decrease when they are gone. If it finds new updates, Anti-Virus downloads them and installs them on the computer. This is the default setting.
  • By schedule. The application is updated in accordance with the specified schedule.
  • Manually. You launch the updating procedure manually.
In the course of an update, the application modules and databases on your computer are compared against those at the update source. If your computer has the latest version of the databases and application modules, you will see a notification window confirming that the protection of your computer is up-do-date. If the databases and modules on your computer and on the update server differ, the application downloads only the incremental part of the updates. Not all the databases and modules are downloaded, which significantly increases the speed of copying files and saves Internet traffic.
Before updating program databases, Kaspersky Internet Security creates backup copies of them. This backup copy can be used if you do not want to use the last version of the database for any reason.

You might need the rollback option, for example, if you update the threat databases and they are damaged in the process. You can easily roll back to the previous version and try to update the databases later.

You can distribute updates to a local source simultaneously while updating the application. This feature enables you to update databases and modules used by version 7.0 applications on networked computers to conserve bandwidth.

Also see:

Update status

Starting the update process

Rolling back to the previous update

Configuring update settings

Update distribution

Update statistics

Possible problems during the update


Update status

Application updates keep your computer's defenses current. If you have not installed updates for some time, the protection of your data becomes less reliable as the time passes.
Top view update details, open the mail window and select [image] Update. Note the component's status .
Pay attention to the component activity status:
  • Task Not Performed: update never performed.
  • Database update is running (%): update in progress.
  • Completed: database update completed without errors.
The application main window shows some summary application update information, including database publication date, the date of last update attempt, and the number of records in the databases installed on your computer. The number of records is the number of threats from which your computer is now protected. To view detailed information about the last update, click Last update report link. A report will open on the screen for this procedure.
To run update right now, click Update application databases. To return to the previous version of databases used, click Rollback to previous version.
To change the current update settings, click Update Settings link. The Schedule link provides access to update configuration.
Also see:

Starting the update process

Rolling back to the previous update

Configuring update settings

Update distribution


Starting Update

You can begin the update process at any time. It will run from the update source that you have selected.

You can start Update from:

  • from the context menu;
  • from the program's main window.
To start Update from the context menu:
  1. Right click the application icon in the taskbar notification area to open the shortcut menu.
  2. Select Update.
To start Update from the main program window:
  1. Open application main window and select the [image] Update component.
  2. Click Update databases.

Update information will be displayed in the main window. To obtain detailed information on the update process, click Details. This will display a detailed update task report. The report window may be closed by clicking the Close button. The update will continue.

Note that updates are distributed to the local source during the update process, provided that this service is enabled.

Also see:

Rolls back to the previous update


Rolling back to the previous update

Every time you begin updating, Kaspersky Internet Security first creates a backup copy of the current databases and program modules and after this starts downloading updates. This way you can return to using the previous version of databases if an update fails.
To rollback to the previous database of known threats:
  1. Open application main window and select the [image] Update component.
  2. Click Rollback to the previous databases link in the right part of the window.


Configuring update settings

Updating is performed in accordance with settings that define the following:
  • the source from which the updates are downloaded and installed
  • application update run mode and the specific components updated
  • How frequently will the update run if scheduled
  • Which user will the scheduled update run as
  • whether updates are to be copied to a local source;
  • what actions you should perform after updating is complete
This section of the Kaspersky Internet Security help describes these settings in detail.


Selecting an update source

The update source is where you download updates for Kaspersky Internet Security databases and program modules. Update sources can be HTTP and FTP servers, local or network folders.

The main update source is Kaspersky Lab update servers. These are special web sites containing available updates for the databases and program modules for all Kaspersky Lab products.

If you do not have access to Kaspersky Lab update servers (for example, your computer is not connected to the Internet), you can call the Kaspersky Lab main office at +7 (495) 797-87-00 or +7 (495) 645-79-39 to request contact information of Kaspersky Lab partners that can provide you with zipped updates on floppy disks or CDs.

Warning:
When requesting updates on removable media, please specify whether you want to have the updates for application internal modules as well.

You can copy the updates from a disk and upload them to an FTP or HTTP site or save them in a local or network folder.

An update source is selected on the [image] Update source tab.

The list contains only the default, Kaspersky Lab update servers». The server list cannot be edited. When updating, Kaspersky Internet Security calls this list, selects the address of the first server, and tries to download files from this server. If updates cannot be downloaded from the first server, the application tries to connect and retrieve the updates from the next server.

To update from an ftp or http site or from a particular folder, click the Add button and in the Select Update Source window that opens, select the ftp or http site or folder.

Kaspersky Internet Security adds a new update source to the top of the list and automatically checks off this source as enabled.

If several resources are selected as update sources, the application tries to connect to them one after another, starting from the top of the list, and retrieves the updates from the first available source. You can change the order of sources in the list using the Move up/Move down buttons.

To edit the list, use the Add, Edit and Delete buttons. The only type of sources you cannot edit or delete is the Kaspersky Lab update servers.

If you use Kaspersky Lab update servers as an update source, you can select the optimal server location for downloading updates. Kaspersky Lab has servers in several countries. Choosing the Kaspersky Lab update server closest to you will save you time and download updates faster.

To choose the closest server, check [image] Define region (do not use autodetect) and select the country closest to your current location from the dropdown list. If you check this box, updates will run taking the region selected in the list into account. This checkbox is deselected by default and information about the current region from the operating system registry is used.

Also see:

Adding a new update source


Adding a new update source

Use this window to configure update retrieval from ftp and http sites or from a certain folder.

To update from a particular site, select the target ftp or http site or specify the IP address, character name, or URL address of the site in the Source field. When selecting an ftp site as an update source, authentication settings must be entered in the URL of the server in the format ftp://user:password@server.

Warning:
If you select a resource outside the LAN as an update source, you must have an Internet connection to update.

To update the application from a specific folder, select the folder or specify the full path to that folder in the Source field.

Click OK button for the changes to take effect. To exit the window without applying the changes, click Cancel.

Also see:

Selecting an update source


Selecting the mode and objects to be updated

When configuring updating settings, it is important to define what objects will be updated and how updating will be performed (i.e. updating mode).
Update objects are the components that will be updated:
  • application databases;
  • network drivers that enable protection components to intercept network traffic;
  • Firewall database containing network attack descriptions;
  • application modules.
Application databases, network drivers and Firewall database are always updated, and the application modules are only updated if the settings are configured for it.
If you want to download and install updates for application modules:

open application settings window, select [image] Update and check [image] Update application modules.

If there are currently program module updates on the update source, a special window, containing the description of all changes in the program modules, will appear on your screen. Basing on this description, you can decide whether the update should be installed.

If the next program update occurs before the computer is restarted and the before program module updates downloaded earlier are installed, only the threat signatures will be updated.

Updating mode defines how updating is launched. One of the following modes may be selected under Run Mode:
Automatically. Kaspersky Internet Security checks the update source for updates at specified intervals. If it finds new updates, the program downloads them and installs them on the computer. This mode is used by default.

If a network resource is specified as an update source, Kaspersky Internet Security tries to launch updating after a certain amount of time has elapsed as specified in the previous update package. If a local folder is selected as an update source, the application tries to download the updates from the local folder at a frequency specified in the update package that was downloaded during the last updating. This option allows Kaspersky Lab to regulate the updating frequency in case of virus outbreaks and other potentially dangerous situations. Your application will receive the latest updates for the databases, and software modules in a timely manner, thus excluding the possibility for malicious software to penetrate your computer.

Every n hour(s). Updating is scheduled to start at a specified time. By default, scheduled updates will occur daily. To edit the default schedule, click the Change... button near the mode title and make the necessary changes in the window that opens.
Manually. In this case, you launch the updating procedure manually. Kaspersky Internet Security notifies you when updating is required.
Also see:

Setting up the schedule

Selecting the update source

Actions after updating the program

Starting program updates on behalf of a different user


Setting up the schedule

If scheduled updating is selected as the updating mode, by default updating occurs every day. If this schedule is inconvenient for you, you can change it in the [image] Schedule dialog box.
You should first define the frequency for updating. The following options are available:
At a specified time. The task will run once on the day and at the time that you specify.
At aplication startup. The task starts up every time Kaspersky Internet Security is run.
Minutely. The program is updated every few minutes. Enter the number of minutes between updates. The maximum is 59.
Hours. The updating frequency is counted in hours. If you choose this option, in the schedule settings select Every N-th hour and specify the value of N. For example, to download updates every hour, select Every 1 hour.
Days. The application is updated once in several days. In the schedule settings, select the following options:
  • Every N days and specify the value of N if you want to have an interval of several days between updating sessions. Thus, to start updating every two days, enter Every 2 days.
  • Every weekday if you want to update the program Monday through Friday.
  • Every weekend to run updating only on Saturdays and Sundays.

In addition to the frequency, specify the start time in the Time field.

Weeks. The application is updated on certain days of the week. If this option is selected, in the schedule settings mark the days of the week when you need the application to download updates. Also specify the start time in the Time field.
Monthly. The scan task will run once per month at the specified time.
If an update is skipped for any reason (for example, the computer was not on at that time), you can configure the task that was missed to start automatically as soon as it can. To do so, check [image] Run task if skipped in the schedule window.


Additional update settings

In addition to the basic update settings, you can also use advanced settings:

  • Starting tasks under another user account
  • Configuring the update distribution server

Running updates with another user’s rights

Kaspersky Internet Security has a feature that can start program updates for another profile. This feature is by default disable, and tasks are run under the profile under which you are logged into the system.
Since the program can be updated from a source that you do not have access to (for example, the network updates directory) or authorized user rights to the proxy server, you can use this feature to run program updates using the login of a user that has such privileges.
You can configure this feature on the [image] Additional tab.
To enable this feature, check [image] Run this task as. Enter the data for the login that you want to start the task as below: user name and password.
Note that if you do not run the task with privileges, the scheduled update will be run with the privileges of the current user account. If no users are currently registered on the computer, running updates under another user account has not been configured, and updates run automatically, they will run with the SYSTEM privileges.

Update distribution

If home PCs are linked by a home network, updates do not need to be downloaded and installed on each of them individually, since this will boost network traffic. You can use the update distribution service to conserve bandwidth. To do so, set up update distribution as follows:

  1. One of the computers on the network retrieves an application update package from the Kaspersky Lab web servers or from another web resources hosting a current set of updates. The updates retrieved are placed in a shared folder.
  2. Other computers on the network access the shared folder to retrieve application updates.

To enable update distribution, select the Update distribution folder checkbox on the [image] Additional tab, and in the field below, specify the shared folder where updates retrieved will be placed. You can enter the path manually or selected in the window that opens when you click Browse. If the checkbox is selected, updates will automatically be copied to this folder when they are retrieved.

Note that Kaspersky Internet Security 7.0 only retrieves update packages necessary for its own update from the Kaspersky Lab update servers.

If you want other computers on the network to update from the folder that contains updates copied from the Internet, you must take the following steps:

  1. Grant public access to this folder.
  2. Specify the shared folder as the update source on the network computers in the Updater settings.


Actions after updating the program

Every application database update contains new records that protect your computer from the latest threats.
Kaspersky Lab experts recommend that you scan the quarantined objects and startup objects each time after the database is updated.
Why these objects should be scanned?
The quarantine contains objects that have been flagged by the application as suspicious or possibly infected. However, during that scan it was impossible to identify the malicious software that caused infection. It is possible that after the database update Kaspersky Internet Security may be able to identify the threat and eliminate it.
By default, the application scans quarantined objects after each update. We also recommend that you periodically view the quarantined objects because their statuses can change after several scans. Some objects can then be restored to the previous locations and you will be able to continue working with them.
To disable scans of quarantined objects, clear the [image] Rescan Quarantine box in the [image] Actions after update section.
Startup objects are critical for the safety of your computer. If one of them is infected with a malicious application, this can cause even an operating system startup failure. To scan this area Kaspersky Internet Security has a built-in startup objects scan task. We recommend that you set up a schedule for this task so that it is launched automatically after each database update.


Update statistics

Certain current update session information (date of last update, database publication date for databases being used by the applications, database record count) is shown in the application main window . Select [image] Update to view.
Note.
If you have never updated the application, there will be no information about the most recent update.

You can view information about previous updates in general application report. If the update is currently in progress use the Details link. You will see a detailed report on the current update status.

Update status displays information on whether the procedure was successful. If the operation fails, check that the settings for Updater are correct and that the update source is available. Restart the update. If the attempt crashes, save a report to file using the Actions → Save as button. Then contact the Technical Support Service. Kaspersky Lab specialists will assist you.

Brief update statistics are displayed in the upper part of the report window. You can see the size of copied and installed updates, downloading speed, duration of the updating procedure, and other information.
A description of all operations performed during updating is displayed in the main part of the report on the Events tab. You can find exact files that were copied and replaced. To delete all events from the report, click Actions → Clear all.
The settings that are used to run updates are listed on a tab with the same name. To quickly configure update settings, you can use the Change settings link.


Selecting the mode and objects to be updated

Possible problems during the update

When you update the Kaspersky Internet Security application modules or databases, errors can occur associated with incorrect update configuration, connection problems, and other factors. This Help section covers the majority of errors and gives tips for eliminating them. If you encounter errors not covered in Help or want detailed recommendations for eliminating them, try finding information in the Knowledge Base in the Technical Support web portal in the "If a program generated an error..." section. If the recommendations given in this section do not help you solve the problem or if there is not information about the error in the Knowledge Base, send a question to the Technical Support Team.

Configuration errors

Errors in this group occur largely because the application is installed incorrectly or the application configuration has been modified, leading to a loss of functionality.

General recommendations:

If errors in this group are generated, we recommend restarting updates. If the error occurs again in the future, contact Technical Support.

If the problem is connected to the application being installed incorrectly, we recommend reinstalling it.

No update source specified

None of the source contain update files. It is possible that no update source is specified in the update settings. Make sure that the update settings are configured correctly and try again.

Error verifying key

This error is generated if the key used by the application is blocked and placed in the black list of keys.
Error retrieving update settings

Internal error retrieving update task settings. Please make sure that the update settings are configured correctly and try again.

Insufficient privileges to update

This error usually occurs when the user account used to start the update does not have access privileges to the update source or the folder where the updates are located. We recommend making sure that user account has the necessary privileges.

This error could also be generated when attempt to copy update files to a folder that cannot be created.

Update component operation error

Internal logical error in update task. Please make sure that the update settings are configured correctly and try again.

Error verifying updates

This error is generated if the files downloaded from the update source do not pass internal verification. Please try updating later.

Errors that occur when working with files and folders

This type of error occurs when the user account being used to run updates has restricted rights or no rights to the update source or the folder where the updates are located.

General recommendations:

If errors of this type occur, we recommend verifying that the user account has sufficient access rights to those files and folders.

Cannot create folder

This error is generated if a folder cannot be created during the update procedure.

Insufficient privileges to execute file operation

This error occurs if the user account being used to run the update does not have sufficient privileges to execute operations with the files.

File or folder not found

This error occurs if a file or folder needed in updates is missing. We recommend verifying that the specified file or folder exists and is available.

Error handling files

This error is an internal logical error of the update module when executing operations with files.

Network errors

Errors in this group occur when there are connection problems or when Internet settings are not configured correctly.

General recommendations:

If errors in this group occur, we recommend making sure your computer is connected to the Internet, the connection settings are correctly configured, and the update source is available. Then try updating again. If this fails, contact Technical Support.

Network error when downloading update files

An error was generated while retrieving update files. If you encounter this error, check your computer's network connection.

Connection interrupted

This error occurs when the connection with the update source is terminated by the update server for any reason.

Wait time for network operation expired

The connect time with the update source has expired. When configuring the program's update settings, you may have set a low time-out value for the connection with the update source. If your computer cannot connect to the server or the update folder within that time, the program returns this error. In such a case, we recommend checking that the settings for Updater are correct and that the update source is available.

Authorization error on FTP server

This error occurs if authorization settings for the FTP server used as the update source are entered incorrectly. Please make sure that the ftp server settings are configured to allow this user account to download files.
Authorization error on proxy server

This error is generated if the settings for updating via proxy server incorrectly indicate the name and password or if the user account under which the updates are run does not have access privileges to the update source. Edit the authorization settings and try to update again.

No update source found

This error is generated if no update source is detected. It is possible that the update source address is indicated incorrectly, the network settings are incorrect, or the DNS server is unavailable. We recommend checking your update settings and availability of update sources, and try again.

Error connecting to the update source

This error occurs is there is no connection with the update source. Please make sure that the update source settings are configured correctly and try again.

Error connecting to proxy server

This error is generated if the proxy server connections settings are indicated incorrectly. To solve the problem, we recommend making sure that settings are configured correctly, the proxy server is available, and the Internet is available, and trying to update again.

No proxy server found

This error is generated if the proxy server is not detected. We recommend making sure that the proxy server settings are correct and that the DNS server is available.

Errors related to corrupted databases

These errors are linked to corrupted files in the update source.

General recommendations:

If you are updating from Kaspersky Lab web servers, try updating again. If this fails, contact Technical Support.

If you are updating from a different source, such as a local folder, we recommend updating it from the Kaspersky Lab web servers. If the error occurs again, contact Kaspersky Lab Technical Support.

Update files corrupted

All files downloaded and installed on your computer during the update process are listed in a special file included in the update. This error occurs if there are any files on the update list that are not on the update source.

This error might be returned by the application if the electronic digital signature of the update pack being downloaded is corrupted or does not match the Kaspersky Lab signature.

Index file corrupted or missing

This error is generated if the .xml format index file used for updating is missing from the update source or corrupted.

Various codes

This group includes errors that cannot be classified in any of the groups listed above.

Files for rollback operation missing

This error is generated if another rollback attempt is made after completing rollback of updates, but no updates were made between them. You cannot repeat the rollback procedure until the program has been updated successfully, we will result in restoring the backup set of files.


Managing keys

Kaspersky Internet Security needs a license key to operate. You are provided with a key when you buy the program. It gives you the right to use the program from the day you purchase it and install the key.

Without a license key, unless a trial version of the application has been activated, Kaspersky Internet Security will run in one update mode. The program will not download any new updates.

If a trial version of the program has been activated, after the trial period expires, Kaspersky Internet Security will not run.

When the license key expires, the program will continue working, except that you will not be able to update databases. As before, you will be able to scan your computer for viruses and use the protection components, but only using the databases that you had when the license expired. We cannot guarantee that you will be protected from viruses that surface after your program license expires.

To protect your computer from infection with new viruses, we recommend that you renew your application key. Kaspersky Internet Security will notify you in advance of your key’s impending expiration date. An appropriate message will be displayed every time the application is started.

Information on the current key is shown under [image] Activation in the application main window . The Installed Keys section shows key ID, type (commercial, trial, for beta testing), number of hosts on which this key may be installed, key expiration date and number of days remaining to expiration . Click View Detailed Info on Keys to view additional information .

To view the provision of the application license agreement, click on View End User License Agreement. To remove a key from the list, click Delete.

To purchase or renew a key:
  1. Purchase a new key by clicking on Purchase New Key (application has not been activated) or Extend key. The resulting web page will contain all the information on purchasing a key through the Kaspersky Lab online store or corporate partners.

    If you purchase online, a key file or an activation code will be mailed to you at the address specified in the order form once payment has been made .
  2. Install the key by clicking Install Key under Activation in the Kaspersky Internet Security main window or Activation on the application context menu. This will start the Activation Wizard.
Kaspersky Lab regularly has special pricing offers on license extensions for our products. Check for specials on the Kaspersky Lab website in the Products → Sales and special offers area.


Additional options

Beyond protecting your data, the program has other features that expand the possibilities for using Kaspersky Internet Security.
While working the program places some objects in special repositories. The purpose of this is to ensure maximum protection of data with minimum losses.
  • Backup contains copies of objects that were changed or deleted by Kaspersky Internet Security. If any object contained information that was important to you that could not be fully saved during anti-virus processing, you can always restore the object from its backup copy.
  • Quarantine contains potentially infected objects that could not be processed using the current application databases.
It is recommended that you periodically examine the list of objects. It is possible that some of them are already irrelevant, but some may be restored.
Some of the features are meant to aid you in working with the program. For example:
  • Technical Support Service provides multi-faceted help with Kaspersky Internet Security operation. The Kaspersky Lab experts have tried to include all the possible means of support: on-line support, user forum , Knowledge Base.
  • Notifications about events help to set up user notifications about key moments in Kaspersky Internet Security operation. These could be either events of an informative nature or errors that must be eliminated immediately and it is extremely important to know about them.
  • Access Restriction to program use ensures the restriction of rights of other users on your computer for several actions with Kaspersky Internet Security. For example, changing the level of protection can significantly influence information security on your computer.
  • The application configuration management service maintains application settings and helps deploy them to other computers as well as recover default settings.

The program also provides reference information and detailed reports on the operation of all protection components and completing all virus scan tasks, updates.

Create controlled port list can regulate the monitoring between several Kaspersky Internet Security protection components of the information received and transmitted by them. Configuration of proxy server settings provides the application access to the Internet which is critical for certain real-time protection components and updates.
Create rescue disk helps recover computer’s functionality to what it was prior to an infection. This is particularly helpful when you cannot load your computer’s operating system after malicious code has damaged system files.
You can also change the appearance of Kaspersky Internet Security can configure program interface settings.
Let us examine the features given in more detail.


Program data files

Program data files are objects that Kaspersky Internet Security places in quarantine and backup and report files on component operation and program tasks.

In order to work with program data files:

Open application main window and select [image] Reports and Data Files section.

The file will display information for each of the storage areas: the number of files in them and the total size of the storage.

To view and work with stored files, left-click anywhere in the appropriate box. For example, if you want to view report files on program operation, select the Reports box.

If you want to empty the contents of storage, use the Clear link. A window will then open where you can select which storage areas you want to empty:

    Delete history Reports (except for the active ones) – empty the report archive, except for files currently being in use.
    Delete objects from Quarantine – empty Quarantine. Note that if you do this, all potentially infected objects will be deleted from your computer.

    Delete objects from Backup – empty the backup archive of infected objects.

Also see:

Quarantine for potentially infected objects

Backup copies of dangerous objects

Reports


Quarantine for potentially infected objects

Quarantine is a special repository that objects are placed in that could be infected with viruses.
Potentially infected objects are objects that are suspected of being infected with viruses or modifications of them.
Why potentially infected? It is not always possible to exactly determine where an object is infected. This could be for the following reasons:
  • The code of the object being analyzed resembles a known threat but is partially altered.

Application databasescontain threats that have to date been studied by Kaspersky Lab specialists. If a malicious program is altered and these changes have not yet been entered into the databases, Kaspersky Internet Security classifies the object infected with the changed malicious program as a potentially infected object and without fail will indicated what threat this infection resembles.

  • The code of the object detected is reminiscent in structure of a malicious program; however, nothing similar is recorded in the application databases.

It is quite possible that this is a new type of threat, so Kaspersky Internet Security classifies that object as a potentially infected object.

Suspicions of a file containing a virus are determined through heuristic code analyzer. This mechanism is fairly effective and very rarely leads to false positives.
A potentially infected object can be detected and placed in the quarantine by File Anti-Virus, Mail Anti-Virus, Proactive Defense or in the course of a virus scan.
You can place an object in the quarantine by yourself by clicking Quarantine in the special notice that pops up when a potentially infected object is detected.
When object is placed to Quarantine it is moved and not copied: object is deleted from the disk or from the email message and saved to the quarantine folder. Files in the quarantine are saved in a special format and are not dangerous.
Also see:

Working with quarantined objects

Configuring Quarantine settings


Working with quarantined objects

The total number of objects in Quarantine is displayed in the [image] Reports and Data Files section of the main window. In the right-hand part of the screen there is a special Quarantine section that displays:
  • the number of potentially infected objects detected during Kaspersky Internet Security operation;
  • the current size of the repository.
Here you can delete all objects in the quarantine using the Clear link. Please note that during this operation backup objects and reports will be also deleted.
In order to work with objects in quarantine,

use the Quarantine link.

You can take the following actions on the quarantine tab:
  • Move a file to quarantine that you suspect of being infected by the program did not detect. To do so, click Add and in the standard selection window select the file you need. It will be able to a list with the status added by user.
    • If a file is quarantined manually and after a subsequent scan turns out to be uninfected, its status after the scan will not immediately be changed to OK. This will only occur if the scan took place after a certain amount of time (at least three days) after quarantining the file.
  • Scan and disinfect all potentially infected objects in the quarantine using the current application databases. To do so, click Scan all.
    • By scanning and disinfecting any quarantined object, its status can change to infected, potentially infected, false positive, OK, etc.

    The status infected means that the object has been identified as infected but it could not be treated. We recommend that you delete such objects.

    All objects with the status false positive can be restored without worries, since their former status as potentially infected was not confirmed by the program after being scanned again.

  • Restore files to the folders from which they were moved to quarantine. To restore an object, select it from a list and click Restore. When restoring objects placed in quarantine from archives, mail databases, and mail format files, you must also specify the directory to which they will be restored.
    • Tip:
    We recommend that you only restore objects with the status false positive, OK, and disinfected, since restoring other objects could lead to infecting your computer.
  • Delete any quarantined object or group of selected objects. Only delete objects that cannot be disinfected. In order to delete the objects, select them in the list and click Delete.


Configuring Quarantine settings

You can configure the settings for the composition and operation of Quarantine, specifically:
  • Assign the automatic scan mode for objects in quarantine after each update of the threat signatures (for more details, see section Actions after updating the program).
    • Warning!
    The program will not be able to scan quarantined objects immediately after updating the threat signatures, if you are working with quarantine.
  • Set the maximum duration for storing objects in the quarantine.
    • By default, the duration for storing objects in quarantine is 30 days, at the end of which the objects will be deleted. You can change the maximum period for storing potentially infected objects or shut of this restriction altogether.

To do so:

  1. Open the application settings window and select the [image] Reports and Data Files section.
  2. Set the duration for storing objects in quarantine in the Quarantine & Backup section on the right-hand part of the screen.


Backup copies of dangerous objects

Sometimes during disinfection of objects, their integrity cannot be saved. If the disinfected file contained important information, and after disinfection it became inaccessible in part or in full, you can attempt to restore the original object from its backup copy.
Backup copy is a copy of the original dangerous object that is created when first disinfecting or deleting the object and it is saved in backup.
Backup is a special repository that contains backup copies of dangerous objects subject to processing or deletion. The main function of backup is the ability to restore an original object at any time. Files in backup are saved in a special format and are not dangerous.
Also see:

Working with backup copies

Configuring backup settings


Working with backup copies

The total number of backup copies of objects placed in the repository is displayed in the [image] Reports and Data Files section of the main window. In the right-hand part of the screen there is a special Backup section that displays:
  • the number of backup copies of objects created during Kaspersky Internet Security operation;
  • the current size of Backup.
Here you can delete all copies in backup using the Clear link. Please note that during this operation quarantine objects and reports will be also deleted.
In order to work with copies of dangerous objects,

use the Backup link.

A list of backup copies is displayed in the central portion of the backup tab. The following information is given for every copy: the full name of the object with the path to the original location, the status of the object, and its size.
You can restore the selected copies using the Restore button. The object is restored from the backup copy with the same name that it had prior to disinfection.
If there is an object in the original location with that name (this situation is possible with a restored object with a copy created prior to disinfection), a corresponding warning will pop up. You can change the location of the restored object or rename it.
We recommend that you scan the object for viruses immediately after restoring it. It is possible that with updated databases you will be able disinfect it without losing file integrity.
We do not recommend that you restore backup copies of objects unless absolutely necessary. This could lead to an infection on your computer.
We recommend that you periodically examine the repository and empty it using the Delete button. You can also set up the program so that it independently deletes the oldest copies from backup.


Configuring backup settings

You can define the maximum period for storing copies in backup.
By default, the duration for storing copies of dangerous objects in quarantine is 30 days, at the end of which the copies will be deleted. You can change the maximum period for storing copies or remove this restriction altogether. To do so:
  1. Open the application settings window and select the [image] Reports and Data Files section.
  2. Set the duration for storing backup copies in the repository in the Quarantine & Backup section on the right-hand part of the screen.


Working with reports

Performance of each Kaspersky Internet Security component and performance of each virus scan and update is recorded in a report.
The total number of reports created by the program at a given point in time and their total size in bites is displayed in [image] Reports and Data Files section of the main program window. This information is displayed in the Report section.
To view reports,

use the Report link.

As a result a window will open in the Reports tab. This shows the latest reports on all components, virus scan tasks, and updates run during current Kaspersky Internet Security session. The results are shown across from each component or task. For example, running , paused , or disabled. If you want to view the full history of report creation for the current session of the program, check [image] Show report history.
To review all the events recorded in the report about component performance or task performance,

select the name of the component or task on the Reports tab and click the Details button.

As a result a window will pop up that contains detailed information on the performance of the selected component or task. The resulting statistics on performance are displayed in the upper part of the window, and detailed information is given on the various tabs in the central part. Depending on the component or task, the composition of the tabs can vary:
  • Detected tab contains a list of dangerous objects detected by the component or by a virus scan task performed.
  • Events tab displays events in component or task performance.
  • Statistics tab contains detailed statistics for all scanned objects.
  • Settings tab displays a collection of settings that are used by a protection component, a virus scan, or a application database update.
You can export the entire report as a text file. For example, this is helpful in cases where an error has occurred in component performance of task completion that you cannot eliminate on your own and you need assistance from our Technical Support Service. In such a case, the report must be sent in text format to Technical Support so our specialists can study the problem in detail and solve it as soon as possible.
To export the report as a text file,

click Actions → Save as and specify where you want to save the report file.

After you are done working with the report, click Close.
Also see:

The Registry tab

The Phishing sites tab

The Autodial attempts tab

The Data transfer attempts tab

Network attacks tab

Banned hosts tab

Application activity tab

The Pop-up windows tab

The Banners tab

Packet filtering tab

Established connections tab

Opened ports tab

Traffic tab


Configuring report settings

To configure settings for creating and saving reports:

  1. Open the application settings window and select the [image] Reports and Data Files section.
  2. Set up the Reports section as follows:
    • allow or block logging informative events. As a rule, these events are not important for security. To allow logging, check [image] Log non-critical events;
    • choose only to save events in the report that have occurred since the last time the task was run. This saves disk space by reducing the report size. If [image] Keep only recent events option is checked, the information in the report will be updated every time you restart the task. However, only non-critical information will be overwritten;
    • set the storage term for reports. By default, the duration for storing reports is 30 days, at the end of which the copies will be deleted. You can change the maximum storage term or remove this restriction altogether.

In addition to configuring the settings for processing and saving reports, you can set restrictions on how long objects are stored in Quarantine and Backup.


Detected tab

This tab contains a list of dangerous objects detected by Kaspersky Internet Security. The full name is indicated for each object, along with the status assigned to it by the program when it was scanned or processed.
For the list to contain not only dangerous objects but also those that were successfully neutralized, check [image] Show neutralized objects.
You can perform a number of actions on objects from the list. To do so, click Actions and make a selection from the dropdown menu:
    Disinfect - attempt to disinfect a dangerous object. If the object is not successfully disinfected, you can leave it on this list to scan later with updated application databasesor delete it. You can apply this action either to one object on the list or to several selected objects.
    Delete - delete dangerous object from computer.
    Delete from the list – remove the record on the object detected from the report.
    Add to trusted zone – exclude the object from protection. A window will open with an exclusion rule for the object.
    Show file – open the folder where the object is located in Microsoft Windows Explorer.
    Neutralize all – neutralize all objects on the list. Kaspersky Internet Security will attempt to process the objects using application databases.
    Discard all – clear the report on detected objects. When you use this function, all detected dangerous objects remain on your computer.
    View on www.viruslist.com – got to a description of the object in the Virus Encyclopedia on the Kaspersky Lab website.
    Search - enter search terms for objects on the list by name or status.
    Select all – select all objects on the list. You might need this function to assign group actions to objects.
    Copy – copy a line of the report to the clipboard. Then you can paste this information into a text file or e-mail.
    Save as - save report as a text file.
In addition, you can sort the information displayed in the window by ascending and descending order for each of the columns.

To process dangerous objects detected by Kaspersky Internet Security, press the Neutralize button (for one object or a group of selected objects) or Neutralize all (to process all the objects on the list). After each object is processed, a message will appear on screen. Here you will have to decide what to do with them next.

If you check [image] Apply to all in the notification window, the action selected will be applied to all objects with the status selected from the list before beginning processing.


Events tab

A complete list of all the important events in protection component operation, or of when a virus scan task is performed, is recorded on this tab.
The events can be of the following types:
    Critical events are events of a critical importance that point to problems in program operation or gaps in protection on your computer. For example, virus detected, error in operation.
    Important events are events that must be paid attention to, since they reflect important situations in the operation of the program. For example, stopped.
    Informative messages are reference-type messages which as a rule do not contain important information. For example, OK, not processed. These events are reflected in the Event Log only if [image] Show all events is checked.
The format for displaying events in the Event Log may vary with the component or task. Thus, the following information is given for update tasks:
  • event name;
  • name of the object for which that event is recorded;
  • time at which the event occurred;
  • size of the loaded file.
For virus scan tasks, the Event Log contains the name of the object scanned and the status assigned to it as a result of the scan/processing.


Statistics tab

Detailed statistics on component operation or completion of a virus scan task are shown on this tab. Here you can learn:
  • How many objects were scanned for dangerous objects in this session of component operation or when the task is completed. The number of scanned archives, compressed files, and password protected and corrupted objects are displayed.
  • How many dangerous objects were detected, how many of them were not disinfected, deleted, and placed in quarantine.


The Settings tab

A complete overview of the settings in correspondence with which the protection component is operating or a virus scan or program update is being performed is displayed on the Settings tab. You can learn what security level the component is running on or what level virus scans are running on, what actions are being taken with dangerous objects or what settings are being used for program updates, etc. Use the Change settings link to configure the component.

You can configure advanced settings for virus scans:

  • Establish a scan task priority ranking to be used when the processor is weighed down. The default setting for [image] Concede resources to other applications is checked. With this feature, the program tracks the load on the processor and disk subsystems for the activity of other applications. If the load on the processor increases significantly and prevents the user's applications from operating normally, the program reduces scanning activity. This increases scan time and frees up resources for the user's applications.
  • Set the computer’s mode of operation for after the virus scan is complete. You can set up the computer to shut down, restart, or go into standby or sleep mode. To select an option, left-click on the hyperlink until it displays the option you need.

    You may need this feature if, for example you start a virus scan at the end of the work day and do not want to wait for it to finish.

    However, to use this feature, you must take the following additional steps: before launching the scan, you must disable password requests for objects being scanned, if enabled, and enable automatic processing of dangerous objects. Then the program’s interactive features will be disabled. The program will not ask questions that require an answer from you, which interrupts the scanning process.


Rescue disk

Kaspersky Internet Security has a tool for creating a rescue disk.

The rescue disk is designed to restore system functionality after a virus attack that damaged system files of the operating system and made it impossible to start. This disk includes:

  • Microsoft Windows XP Service Pack 2 system files
  • A set of operating system diagnostic utilities
  • Kaspersky Internet Security program files
  • files containing application databases

To create a rescue disk:

  1. Open the program’s main window and select area in the [image] Scan section.
  2. Click the Create Rescue Disk link to begin the rescue disk creation process.
A Rescue Disk is designed for the computer that it was created on. Using the disk on other computers could lead to unforeseeable consequences, since it contains information about the parameters of a specific computer (info on boot sectors, for example).
You can only create a rescue disk under Windows XP or Microsoft Windows Vista. You cannot create a rescue disk on computers running Microsoft Windows XP Professional x64 Edition or Microsoft Windows Vista x64.

Also see:

Creating a rescue disk

Working with the rescue disk


Creating a rescue disk

Warning! You need the Microsoft Windows XP Service Pack 2 installation disk to create a rescue disk.

You need the program PE Builder to create the Rescue Disk.

You must install these PE Builder on your computer beforehand to create an emergency disk with it.

A special Wizard tool walks you through the creation of a rescue disk. It consists of a series of windows/steps, and you can navigate between them using the Back and Next buttons, and you can complete the Wizard by clicking Finished. The Cancel button will stop the Wizard at any point.


Getting ready to make the disk

To create a rescue disk, specify the path to the following folders:

  • PE Builder program folder
  • Folder where the rescue disk files are saved before burning the CD

    If you are not creating a rescue disk for the first time, this folder will already contain a set of files made the last time. To use files saved previously, check the corresponding box.
Note that a version of rescue disk files created previously contains outdated threat signatures. To optimally analyze the computer for viruses and to restore the system, we recommend updating threat signatures and creating a new version of the rescue disk.
  • The Microsoft Windows XP Service Pack 2 installation CD

After entering the paths to the folders required, click Next. PE Builder will start up and the rescue disk creation process will begin. Wait until the process is complete. This could take several minutes.


Creating an ISO file

After PE Builder has completed creating the rescue disk files, a Create new ISO file window will open.

The ISO file is an image of the future rescue disk, saved as an archive. The majority of CD burning programs correctly recognize ISO files (Nero, for example).

If this is not the first time that you have created a rescue disk, you can select the ISO file from the previous disk. To do so, select Use existing ISO file.


Burning the disk

This Wizard window will ask you to choose when to burn the rescue disk files to CD: now or later.

If you chose to burn the disk right away, specify whether you want to erase the contents of the CD before burning. To do so, check the corresponding box. You only have this option if you are using a CD-RW.

The CD burning process will begin when you click the Next button. Wait until the process is complete. This could take several minutes.


Finishing creating a rescue disk

This Wizard window informs you that you have successfully created a rescue disk.


Using the rescue disk

Note that Kaspersky Internet Security only works in system rescue mode if the main window is opened. When you close the main window, the program will close.
Bart PE, the default program, does not support .chm files or Internet browsers, so you will not be able to view Kaspersky Internet Security Help or links in the program interface while in Rescue Mode.

If a situation arises when a virus attack makes it impossible to load the operating system, take the following steps:

  1. Create a rescue disk by using Kaspersky Internet Security on an uninfected computer.
  2. Insert the emergency disk in the disk drive of the infected computer and restart. Microsoft Windows XP SP2 will start with the Bart PE interface.

    Bart PE has built-in network support for using your LAN. When the program starts, it will ask you if you want to enable it. Agree to enable network support if you plan to update databases from the LAN before scanning your computer. If you do not need to update, cancel enabling network support.
  3. To open Kaspersky Internet Security, click Start→Programs→Kaspersky Internet Security 7.0→Start.
    4. The Kaspersky Internet Security main window will open. In system rescue mode, you can only access virus scans and application databasesupdates from the LAN (if you have enabled network support in Bart PE).
  4. Start the virus scan.
Note that databases from the date that the rescue disk is created are used by default. For this reason, we recommend updating databases before starting the scan.
It should also be noted that the application will only use the updated application databasesduring the current session with the rescue disk, prior to restarting your computer.
Warning!
If infected or potentially infected objects were detected when you scanned the computer, and they were processed and then moved to Quarantine or Backup Storage, we recommend completing processing those objects during the current session with a rescue disk.
Otherwise, these objects will be lost when you restart your computer.


Traffic Monitoring

The [image] Traffic Monitoring section of the application settings window is used to generate a list of ports, monitored by real-time protection and to configure secure connection scanning.


Creating a list of monitored ports

When using protection components like Mail Anti-Virus, Web Anti-Virus, data streams are monitored that are transmitted using certain protocols and pass through certain open ports on your computer. Thus, for example, Mail Anti-Virus analyzes information transferred using SMTP protocol and Web Anti-Virus analyzes information transferred using HTTP.
A list of ports that are usually used for transmitted e-mail and HTTP traffic is included in the program package. You can add a new port or disable monitoring for a certain port, thereby disabling analysis of the traffic passing through that port for dangerous objects.
To edit a list of monitored ports, take the following steps:
  1. Open the application settings window and select [image] Traffic Monitoring .
  2. Click Port Settings .
  3. Update the list of monitored ports in the [image] Port Settings dialog .

For example, there is a nonstandard port on your computer through which data is exchanged with a remote computer using HTTP protocol. Web Anti-Virus monitors HTTP traffic. To analyze this traffic for malicious code, you can add this port to a list of controlled ports.
When any of its components starts, Kaspersky Internet Security opens port 1110 as a listening port for all incoming connections. If that port is busy at the time, it selects 1111, 1112, etc. as a listening port.
If you use Kaspersky Internet Security and another company’s firewall simultaneously, you must configure that firewall to allow the avp.exe process (internal Kaspersky Internet Security process) on all the ports listed above.
For example, your firewall contains a rule for iexplorer.exe that allows that process to establish connections on port 80.
However, when Kaspersky Internet Security intercepts the connection query initiated by iexplorer.exe on port 80, it transfers it to avp.exe, which in turn attempts to establish a connect with the web page independently. If there is no allow rule for avp.exe, the firewall will block that query. The user will then be unable to access the webpage.
Also see:

Checking encrypted connections

Configuring monitored ports

Adding/editing ports


Configuring monitored ports

You can edit the list of monitored ports in [image] Port Settings window.

To add a new port to the list or edit the settings for those already on the list, click the Add / Edit button, and enter the necessary data in the window that opens.

This window provides a list of ports monitored by Kaspersky Internet Security. To scan data streams enter on all open network ports, select the option [image] Monitor all ports. To edit the list of monitored ports manually, select [image] Monitor selected ports only.

Also see:

Checking protected connection

Creating a monitored port list

Adding/editing ports


Adding/editing ports

Use this window to add a new port to the list or to edit the settings of those already on the list. To do so, specify the port number and add a description for it in the corresponding fields.

Click OK button for the changes to take effect. To exit the window without applying the changes, click Cancel.

Also see:

Checking protected connection

Creating a monitored port list

Configuring monitored ports


Checking your SSL connection

Connecting using SSL protocol protects data exchange through the Internet. SSL protocol can identify the parties exchanging data using electronic certificates, encode the data being transferred, and ensure their integrity during the transfer and ensure their integrity in transit.

These features of the protocol are used by hackers to spread malicious programs, since most antivirus programs do not scan SSL traffic.

Kaspersky Internet Security 7.0 provides the option of scanning SSL traffic for viruses. When an attempt is made to connect securely to a web resource, a notification will appear on screen prompting the user for action.

The notification contains information on the program initiating the secure connection, along with the remote address and port. Select one of the options below to continue or discontinue scanning:

  • When connecting to a trusted web resource, such as your bank’s web page, where you manage your personal account. In this case, it is important to receive confirmation of the authenticity of the bank's certificate.
  • If the program establishing the connection checks the certificate of the website being accessed. For example, MSN Messenger checks the authenticity of the Microsoft Corporation digital signature when it establishes a connection with the server.

You can configure SSL connection scan settings on the [image] Traffic monitoring tab of the program settings window:

    Check all encrypted connections – scan all traffic incoming on SSL protocol for viruses.
    Prompt for scan when a new encrypted connection is detected – display a message prompting the user for action every time an SSL connection is established.
    Do not check encrypted connections – do not scan traffic incoming on SSL protocol for viruses.


Configuring connection settings

Connection to a proxy server may be configured using the [image] Proxy Server section of the application settings window (if connection to the Internet is through a proxy) . Kaspersky Internet Security utilizes these settings for several real-time protection components and to update application databases and modules.
Check the [image] Use proxy server box if you are using a proxy server to access the Internet and, if necessary, specify the following settings:
  • Select the proxy server settings that will be used:
      • Automatically detect the proxy server settings. If you select this option, the proxy settings are detected automatically using WPAD (Web Proxy Auto-Discovery Protocol). If this protocol cannot detect the address, Kaspersky Internet Security will use the proxy server settings specified in Microsoft Internet Explorer.
      Use specified proxy server settings - Use a proxy that is different from that specified in the browser connection settings. In the Address field, enter either the IP address or the symbolic name of the proxy server and specify the number of the proxy port used to update the application in the Port field.
    Not to use a proxy server for updates from local or network directories check [image] Bypass proxy server for local addresses .

  • Specify whether authentication is required on the proxy server. Authentication is the process of verifying user registration data for access control purposes.

    • If authentication is required to connect to the proxy server, check [image] Use authentification and specify the username and password in the fields below. In this event, first NTLM authentication and then BASIC authentication will be attempted.

    If the check box is unchecked, NTLM authorization will be attempted using the login under which the task (such as an update) is running .

    If the proxy server requires authentication and you did not enter the username and password or the data specified were not accepted by the proxy server for some reason, a window will pop up, asking for a username and password for authentication. If authorization is successful, the specified user name and password will be remembered for subsequent use. Otherwise, the authentication settings will be requested again.

    Pressing the Cancel button in the authentication prompt dialog replaces the current source of updates with the next one from the list; the authentication parameters specified in that window or defined in the program interface will be ignored. Therefore, the application will attempt NTLM authentication based on the account used to launch the task.

If you are updating from an ftp server, the server is connected to in passive mode by default. If this connection fails, it will attempt to connect in active mode.
By default, the time allotted to connect to the update service is one minute. If the connection fails, once this time has elapsed the program will attempt to connect to the next update server. This continues until a connection is successfully made or until all the available update servers are attempted.


Configuring the Kaspersky Internet Security interface

Kaspersky Internet Security gives you the option of changing the looks of the program by creating and using various graphic elements and color schemes. You can also configure the use of active interface elements such as application icon in the taskbar notification area and pop-up messages.
To configure the Kaspersky Internet Security:
    Open the application settings window and select [image] Appearance section.
In the right-hand part of the window, you can determine:
  • Using your own graphical elements and color schemes in the program interface.
    • By default, the system colors and styles are used in the program's skin. You can remove them by unchecking [image] Use system colors and styles. Then the styles that you specify in the screen theme settings will be used.
    All the colors, fonts, icons, and texts used in the Kaspersky Internet Security interface can be changed. You can create your own graphics for the program or can localize it in another language. To use a skin, specify the directory with its settings in the Directory with skin descriptions field. Use the Browse button to select the directory.
  • Degree of transparency of pop-up messages.
    • All Kaspersky Internet Security operations that must immediately reach you or require you to make a decision are presented as pop-up messages above the application icon in the taskbar notification area. The message windows are translucent so as not to interfere with your work. If you move the cursor over the message, the transparency disappears. You can change the degree of transparency of such messages. To do so, adjust the Transparency factor scale to the desired position. To remove message transparency, uncheck [image] Enable semi-transparent windows.
  • Whether to use animation of application icon in the taskbar notification area.
    • Depending on the program operation performed, the application icon changes. Thus, for example, if a script is being scanned, a small depiction of a script appears in the background of the icon, and if an e-mail is being scan, a picture of a letter. Icon animation is used by default. If you want to turn off animation, uncheck [image] Animate taskbar icon when processing items. Then the icon will only reflect the protection status of your computer: if protection is enabled, the icon is in color, and if protection is paused or disabled, the icon becomes gray.
  • Display notifications of Kaspersky Lab news.
    • By default, when news is received, the taskbar notification area displays a special icon, which displays a window containing the piece of news when clicked. If you wish to disable the notification, uncheck [image] Use taskbar icon for news notifications.
  • Whether to display the Kaspersky Internet Security protection indicator when the operating system starts.
    • This indicator by default appears in the upper right-hand corner of the screen with the program loads. It informs you that you computer is protected for any type of threat. If you do not want to use the protection indicator, uncheck [image] Show icon above Microsoft Windows login window.
Note that modifications to the Kaspersky Internet Security interface settings are not saved if you restore default settings or uninstall the program.

Also see:

Notifications about Kaspersky Internet Security events


Selecting skins

Select the folder where skin files are located in the Select skin window.


Using additional tools

Kaspersky Internet Security provides you with the following additional features:
  • Start Kaspersky Internet Security at system start up.
  • User e-mail notifications on certain events occurring in the program
  • Kaspersky Internet Security self-defense from modules being disabled, deleted, or edited, as well as password protection for the program
  • Importing and exporting Kaspersky Internet Security settings
  • Restoring the default settings
To set up these services,
    Open the program settings window and select the [image] Service section.
In the right-hand part of the screen, you can define whether to use additional features in program operation.


Notifications about Kaspersky Internet Security events

During Kaspersky Internet Security operation, different kinds of events arise. They can be of an informative nature or contain important information. For example, an event can inform you on the successful completion of a program update or can record an error in the operation of a certain component that must be immediately eliminated.
In order to receive updates on Kaspersky Internet Security operation, you can use the notification feature.
Notices can be delivered in one of the following way:
  • Pop-up messages above the application icon in the taskbar notification area.
  • Audio message.
  • E-mail messages.
  • Recording information in the event log.
To use this feature, you must:
  1. Check [image] Enable notifications under [image] Events notifications in the Appearance section of the application settings window.
  2. Define the event types from Kaspersky Internet Security about which you want to be notified and the method for the notices.
  3. Configure settings for sending notices by e-mail, if that is the notification method that is being used.


Types of events and ways of sending notifications

During Kaspersky Internet Security operation, the following kinds of events arise:
    Critical notifications are events of a critical importance, notifications about which are highly recommended to receive, since they point to problems in program operation or vulnerabilities in protection on your computer. For example, application databases corrupt or license expired.
    Error notifications – events that lead to the program not working. For example, no license or application databases.
    Important notifications are events that must be paid attention to, since they reflect important situations in the operation of the program. For example, protection disabled or computer has not been scanned for viruses for a long time.
    Minor notifications are reference-type messages which as a rule do not contain important information. For example, all dangerous objects disinfected.

To specify which events the program should notify you of and how:

  1. Open the application settings window and select [image] Appearance .
  2. Check [image] Enable Notifications under Events Notification and go to advanced settings by clicking Advanced .

Using the [image] Events notification settings dialog, the following methods of notification of the above events may be configured :

  • Pop-up messages above the application icon in the taskbar notification area that contain an informative message on the event that occurred.
    • To use this type of notice, check [image] in the Balloon section across from the event about which you want to be informed.
  • Audio message.
    • If you want this notice to be accompanied by a sound file, check Sound [image] across from the event.
  • Notification by e-mail.
    • To use this type of notice, check [image] in the Email section across from the event about which you want to be informed and configure settings for sending notifications.
  • Recording information in the event log.
    • To record information about any event occurring in the log, check the box [image] across from it in the Log chart and configure the event log settings.


Configuring notification by e-mail

After you have selected the events about which you wish to receive a notification by e-mail, you must set up notifications. To do so:
  1. Open the application settings window and select [image] Appearance .
  2. Click Advanced in the Events notification section.
  3. In the [image] Events notification settings window, select the [image] checkbox in the Email column for events that should trigger an email message.
  4. In the window that opens when you click Email settings, configure the following settings for sending email notifications:
    • Assign the sending notification setting for From section.
    • Specify the e-mail address to which notices will be sent in To section.
    • Assign a mode for sending e-mail notifications in the Send mode. For the program to send an e-mail as soon as the event occurs, select [image] Immediately when event occurs. For notifications about events within a certain period of time, fill out the schedule for sending informative e-mails by click Change. Daily notices are the default.


Configuring an e-mail notification schedule

Schedule settings for e-mail event notifications are shown in the Schedule window.

The most important step is to determine the frequency of how often notifications are sent. You can select one of these options:

At a specified time. Send the notification on program operation once at a specified time.

At application startup. Send the notification on program operation each time after Kaspersky Internet Security starts. You can also specify a time interval after starting the program after which a notification will be sent.

Minutely. The time interval between notifications will be several minutes. Specify the number of minutes between notifications in the schedule settings. It must not exceed 59 minutes.

Hourly. The interval between notifications is calculated in hours. If you select this frequency, specify the interval in the schedule settings: Every n-th hour and enter the value for n. For example, enter Every 1 hour if you want to send notifications hourly.

Daily – the program will send notifications every several days. Specify how often the program should send notifications in the schedule settings:

  • Select the Every n-th day option and enter a value for n if you want to space out notifications by days.
  • Select Every weekday if you want to send notices daily, Monday through Friday.
  • Select Every weekend to receive notifications on Saturdays and Sundays only.
    • In addition to the frequency, specify what time of day or night the program will send notifications in the Time field.

Weekly – the notices will be sent on certain days of the week. If you select this option, put checkmarks next to the days of the week that on which you need to send the notifications. You can also enter the send time for the notification in the Time field.

Monthly – the program will send notifications once per month at the specified time.

If notification is skipped for any reason (for example, the mail client is not installed or the computer was not on at that time), you can configure the task that was missed to send the notification automatically as soon as it can. To do so, check [image] Run missed task.


Configuring event log settings

To configure event log settings:
  1. Open the application settings window and select [image] Appearance.
  2. Click Advanced in the Interaction with user section.

In the [image] Notification events settings window, select the option of logging information for an event and click the Log Settings button.

Kaspersky Internet Security has the option of recording information about events that arise while the program is running, either in the Microsoft Windows general event log (Application) or in a dedicated Kaspersky Internet Security event log (Kaspersky Event Log).

Logs can be viewed in the Microsoft Windows Event Viewer, which you can open by going to Start/Settings/Control Panel/Administration/View Events.


Program self-defense and access restriction

Kaspersky Internet Security ensures your computer’s security against malicious programs, and by virtue of that fact, it itself can be the target of malicious programs that try to block the program or even delete it from the computer.

Moreover, several people can use a PC, all with varying levels of computer literacy. Leaving access to the program and its settings open could dramatically lower the security of the computer as a whole.

To ensure the stability of your computer's security system, self-defense remote access defense, and password protection mechanisms have been added to the program.

On computers running 64-bit operating systems and Microsoft Windows Vista, self-defense is only available for preventing the program's own files on local drives and system registry records from being modified or deleted.

To enable the program’s self-defense mechanisms:

  1. Open the program settings window and select the [image] Service section.
  2. Make the following configurations in the Self-defense section:
      3. Enable Self-Defense. If this box is checked, the program's mechanism of protecting its own files on the drive, processes in memory, and entries in the system registry from being deleted or modified will be enabled.
      Disable external service control. If this box is checked, any remote administration program attempting to use the program will be blocked.
      For remote administration tools (such as, RemoteAdmin) to gain access to Kaspersky Internet Security, these tools must be added to the trusted application list, and the setting [image] Do not monitor application activity must be enabled.

If any of the actions listed are attempted, a message will appear over the application icon in the taskbar notification area (unless the notification service has been disabled by user).

To password-protect the program, check [image] Enable Password protection, and enter the password and area that the access restriction will cover in the window that opens when you click Settings. You can block any program operations except notifications of detecting dangerous objects or prevent any of the following actions from being performed:

  • Change program performance settings.
  • Close Kaspersky Internet Security.
  • Disable or pause protection on your computer.

Each of the actions listed above leads to a lower level of protection on your computer, so try to establish which of the users on your computer you trust to take such actions.

Now whenever any user on your computer attempts to perform the actions you selected, the program will always request a password.


Password protection

You can password-protect access to the program in the [image] Password protection window.

If you want to set a password, fill in the New password and Confirm new password fields. If you are already using a password and want to change it, you must also fill in the Old password field.

Below, specify the area that you want password protection to apply to:

    All operations (except notifications of dangerous events). Request password if the user attempts any action with the program except for responses to notifications on detection of dangerous objects.
    Selected operations:
      Editing application settings – request password when a user attempts to save changes to program settings.
      Exiting the program – request password if a user attempts to close the program.
      Stopping/pausing protection components or scan tasks – request password if user attempts to pause or fully disable any protection component or virus scan task.


Importing and exporting Kaspersky Internet Security settings

Kaspersky Internet Security includes the option of importing and exporting settings.
This is a helpful feature when, for example, the program is installed on your home computer and in your office. You can configure the program the way you want it at home, save those settings on a disk, and using the import feature, load them on your computer at work. The settings are saved in a special configuration file.
In order to export the current program settings,
  1. Open the program settings window and select the [image] Service section.
  2. Click the Save button in the Configuration Manager section.
  3. Enter configuration file name and destination folder.
To import settings from a configuration file,
  1. Open the program settings window and select the [image] Service section.
  2. Click on the Load button and select the file from which you want to import Kaspersky Internet Security settings.
Also see:

Restoring the default settings


Restoring the default settings

You can always return to the recommended program settings. They are considered the optimum and are recommended by Kaspersky Lab experts. You can reset settings with the Program Setup Wizard.

In order to reset protection settings,
  1. Open the program settings window and select the [image] Service section.
  2. Click the Reset button in the Configuration Manager section.

The window that opens asks you to define which settings should be saved for which components and which not when the recommended security level is restored.

The list displays program components with settings that the user changed or the program accumulated through training (Firewall or Anti-Spam). If special settings were created for any of the components, they will also be shown on the list.

Examples of special settings would be white and black lists of phrases and addresses used by Anti-Spam, trusted address lists and trusted ISP telephone number lists used by Web Anti-Virus and Privacy Control, exclusion rules created program components, packet filtering and application rules for Firewall, and application rules for Proactive Defense.

These lists are populated gradually by using the program, based on individual tasks and security requirements, and creating them often takes some time. Therefore, we recommend saving them when you reset program settings.

The program saves all the custom settings on the list by default (they are unchecked). If you do not need to save one of the settings, check the box next to it.

After you are done configuring the settings, click the Next button. Setup Wizard will open. Follow its instructions.

After you are finished with the Setup Wizard, the Recommended security level will be set for all components, except for the settings that you decided to save when you reset the settings. In addition, settings that you configured with the Setup Wizard will also be applied.

Also see:

Importing and exporting Kaspersky Internet Security settings


User technical support

Information on technical support made available to users by Kaspersky Lab is provided under [image] Support in the application main window.

The top section presents general application information : version, database publication date, as well as a summary of your computer's operating system .

If problems should arise while running Kaspersky Internet Security, first make sure that troubleshooting instructions for the problem are not provided in this help system or the Knowledge Base at the Kaspersky Lab Technical Support web site . The Knowledge Base is a separate section of the Technical Support web site and comprises recommendations for Kaspersky Lab products and answers to frequently asked questions . Try using this resource to find an answer to your question or a solution to your issue . Click on Web Support to go to the Knowledge Base.

The Kaspersky Lab user forum is another application information resource . It is also made into a separate section at the Technical Support web site and contains user questions, feedback, and requests . You can view the main topics, leave feedback, or find an answer to a question . Click User Forum to go to this resource .

If you do not find a solution to your problem in Help, the Knowledge Base, or User Forum, we recommend that you contact Kaspersky Lab Technical Support .

Please note that you have to be a registered user of Kaspersky Internet Security commercial version to obtain technical support. No support is provided to users of trial versions.

User registration is performed through an activation wizard if you are activating with an activation code. Under this option, once registration is complete a client number will be assigned , which may be viewed in the Support section of the main window. A client number is a personal user ID which is required for phone or web form-based technical support .

If a key file is used for activation, register directly at the Technical Support web site.

A new service referred to as the Personal Cabinet provides users access to a personal section of the Technical Support web site . The Personal Cabinet enables you:

  • to send Technical Support requests without registering first;
  • exchange messages with Technical Support without using email;
  • monitor requests in real-time;
  • view the complete history of your Technical Support requests ;
  • obtain a backup copy of the key file.

Use the Create Request link to send a web form request to Technical Support . Enter your Personal Cabinet on the Technical Support site which will open as a result and complete the request form.

For urgent support, consult the help system and call the appropriate contact numbers. Telephone support is provided 24/7 in Russian, English, French, German, and Spanish.

Use the Online Course link to obtain further information on training events for Kaspersky Lab products.


Shutting down the program

If you have to shut down Kaspersky Internet Security, select Exit from the program's context menu. Then the program will close, which means that your computer will be running unprotected.
If network connections that the program monitors are established on your computer when you close the program, a notice will appear on the screen stating that these connections will be disabled. This is necessary for the program to shut down correctly. The connections are cut off automatically after ten seconds or by clicking Yes. The majority of connections terminated will be restored after some time.
Note that if you are downloading a file without a download manager when the connection is terminated, the file transfer will be interrupted. You will have to download the file over again.
You can choose not to interrupt the connections by clicking No in the notice window. If you do so, the program will continue running.
If you closed the program, you can enable computer protection again by opening Kaspersky Internet Security Start → Programs → Kaspersky Internet Security 7.0 → Kaspersky Internet Security 7.0.
Protection can also be resumed automatically after restarting your operating system. To enable this mode, select [image] Service in the application settings window and check [image] Launch Application on Computer Startup under Autoloading.


Frequently asked questions

This chapter is devoted to the most frequently asked questions from users pertaining to installation, setup and operation of the Kaspersky Internet Security; here we shall try to answer them here in detail.

Question: Is it possible to use Kaspersky Internet Security 7.0 with anti-virus products of other vendors?

We recommend uninstalling anti-virus products of other vendors prior to installation of Kaspersky Internet Security to avoid software conflicts.

Question: Kaspersky Internet Security does not rescan files that have been scanned earlier. Why?

This is true. Kaspersky Internet Security does not rescan files that have not changed since the last scan.

That has become possible due to new iChecker and iSwift technologies. The technology is implemented in the program using a database of file checksums and file checksum storage in alternate NTFS streams.

Question: Why is activation required? Can Kaspersky Internet Security run without a key file?

Kaspersky Internet Security will run without a license key, although you will not be able to access the Updater and Technical Support.

If you still have not decided whether to purchase Kaspersky Internet Security, we can provide you with a trial license that will work for two weeks or a month. Once that time has elapsed, the key will expire.

Question: After the installation of Kaspersky Internet Security the operating system started “behaving” strangely (“blue screen of death”, frequent restarting, etc.) What should I do?

Although rare, it is possible that Kaspersky Internet Security and other software installed on your computer will conflict.

In order to restore the functionality of your operating system do the following:

  1. Press the F8 key when the computer just started loading until the boot menu is displayed.
  2. Select the Safe Mode item and load the operating system.
  3. Open Kaspersky Internet Security.
  4. In the program setttings window, select [image] Servise section.
  5. Uncheck [image] Launch Kaspersky Internet Security on computer startup and click OK.
  6. Reload the operating system in the regular mode.

Send a request to Kaspersky Lab Technical Support . Open the application main window, select [image] Support , and click Send Request. Describe the problem and its signature in as much detail as possible .

Make sure that you attach to your question a file containing a complete dump of Microsoft Windows operating system. In order to create this file, do the following:

  1. Right-click My computer and select the Properties item in the shortcut menu that will open.
  2. Select the Advanced tab in the System Properties window and then press the Settings button in the Startup and Recovery section.
  3. Select the Complete memory dump option from the drop-down list in the Write debugging information section of the Startup and Recovery window. By default, the dump file will be saved into the system folder as memory.dmp. You can change the dump storage folder by editing the folder name in the corresponding field.
  1. Reproduce the problem related to the operation of Kaspersky Internet Security.
  2. Make sure that the complete memory dump file was successfully saved.


Types of notifications

When events occur in Kaspersky Internet Security operation, special messages pop up on the screen . Depending on the degree of criticality of the event regarding computer security, you might receive the following types of notifications:
    Alert. A critical event has occurred. For instance, malicious code or dangerous activity has been detected on your system. You should immediately decide how the program should react. This type of notification is in red.
    Warning. A potentially dangerous event has occurred. For instance, potentially infected files or suspicious activity has been detected on your system. You must instruct the program depending on how dangerous you think this event is. This type of notification is in yellow.
    Info. This notification tells you about events that are not critical. This notification type includes, for example, notifications that pop up during Firewall training. Info notifications are in blue.


Malicious objects discovered

If File Anti-Virus, Mail Anti-Virus, or a virus scan detects malicious code, a special notification will pop up.
The notification will contain:
  • The name of the component that detected the object (for example, Virus scan).
  • The threat type (for instance, virus, Trojan) and name of the malicious code as listed in the Kaspersky Lab Virus Encyclopedia. The name of the malicious object is given as a link to www.viruslist.com, where you can find more detailed information on the type of threat detected on your computer.
  • Full name of the malicious object and a path to it.
  • Brief description and a set of potential actions to take for the object. This description shows what sort of object the malicious program has infected.
You are asked to select one of the following responses to the object:
  • Disinfect - attempt to disinfect the malicious object. Before treatment, a backup copy is made of the object in case the necessity arise to restore it or a portrait of its infection.
  • Delete - delete the malicious object. Before deleting, a backup copy is made of the object in case the necessity arise to restore it or a portrait of its infection.
  • Skip - block access to the object but take no actions on it; simply record information about it in the report .

You can later come back to skipped malicious objects in the report window. However, you cannot postpone processing objects detected in e-mails.

To apply the selected action to all objects with the same status detected during the current session of the protection component or task, check [image] Apply to all. The current session is the time from when the component is started until it is disabled or the application is restarted or the time from beginning a virus scan until it is complete.


When you cannot disinfect object

There are some cases when it is impossible to disinfect a malicious object. This could happen if a file is so damaged that it is impossible to delete malicious code from it and restore integrity. The treatment procedure cannot be applied to several types of dangerous objects, such as Trojans.
In such cases, a special notification will pop up containing:
  • The name of the component that detected the object (for example, Virus scan).
  • The threat type (for instance, virus, Trojan) and name of the malicious code as listed in the Kaspersky Lab Virus Encyclopedia. The name of the malicious object is given as a link to www.viruslist.com, where you can find more detailed information on the type of threat detected on your computer.
  • Full name of the malicious object and a path to it.
  • Brief description and a set of potential actions to take for the object. This description shows what sort of object the malicious program has infected.
You are asked to select one of the following responses to the object:
  • Delete - delete the malicious object. Before deleting, a backup copy is made of the object in case the necessity arise to restore it or a portrait of its infection.
  • Skip - block access to the object but take no actions on it; simply record information about it in the report .

You can later come back to skipped malicious objects in the report window. However, you cannot postpone processing objects detected in e-mails.

To apply the selected action to all objects with the same status detected during the current session of the protection component or task, check [image] Apply to all. The current session is the time from when the component is started until it is disabled or the application is restarted or the time from beginning a virus scan until it is complete.


Special treatment required

When you detect a threat that is currently active in the system (for example, a malicious process is detected in your RAM or startup objects), a message will pop up prompting you to use Advanced Disinfection Technology.
Kaspersky Lab strongly recommends agreeing to run Advanced Disinfection Technology. To do so, click OK. However, note that your computer will restart once it is completed, so we recommend saving your current work and closing all applications before running the procedure.
During the treatment procedure, you cannot open mail clients or edit the operating system registry. After restarting your computer, we recommend running a full virus scan.


Suspicious objects discovered

If File Anti-Virus, Mail Anti-Virus, or a virus scan detects an object containing code from an unknown virus or modified code of a known virus, a special notification will pop up.
The notification will contain:
  • The name of the component that detected the object (for example, Virus scan).
  • The threat type (for instance, virus modification) and name of the object as listed in the Kaspersky Lab Virus Encyclopedia. The name of the dangerous object is given as a link to www.viruslist.com, where you can find more detailed information on the type of threat detected on your computer.
  • Full name of the object and a path to it.
  • Brief description and a set of potential actions to take for the object. This description shows what sort of object the dangerous program has infected.
You are asked to select one of the following responses to the object:
  • Quarantine - Move the suspicious object to Quarantine. When you place an object in Quarantine, it is moved, not copied. The object is deleted from the disk or e-mail and is saved in the Quarantine folder. Files in Quarantine are saved in a special format and are not dangerous.
    • When you scan Quarantine later with updated application databases, the status of the object could change. For example, the object may be identified as infected and can be processed using an updated database. Otherwise, the object could be assigned the status not infected and could be restored.

    If a file is quarantined manually and after a subsequent scan turns out to be uninfected, its status after the scan will not immediately be changed to OK. This will only occur if the scan took place after a certain amount of time (at least three days) after quarantining the file.
  • Delete - delete the object. Before deleting, a backup copy is made of the object in case the necessity arise to restore it or a portrait of its infection.
  • Skip - block access to the object but take no actions on it; simply record information about it in the report.

You can later come back to skipped objects in the report window. However, you cannot postpone processing objects detected in e-mails.

To apply the selected action to all objects with the same status detected during the current session of the protection component or task, check [image] Apply to all. The current session is the time from when the component is started until it is disabled or the application is restarted or the time from beginning a virus scan until it is complete.

If you are sure that the object detected is not what the program has classified it as, we recommend adding it to the trusted zone to avoid the program making repeat false positives when you use the object.
For example, you created a certain file that the program evaluates as suspicious, although you are absolutely certain that it is not so. You regularly use that file and are completely certain that it cannot do damage to your computer. Use the Add to Trusted zone link and look over the exclusion settings in the window that opens.

Also see:

Proactive Defense verdicts


Dangerous object detected in traffic

When Web Anti-Virus detects a malicious object in traffic, a special notification pops up on screen.
The notification will contain:
  • The threat type (for instance, virus modification) and name of the dangerous object as listed in the Kaspersky Lab Virus Encyclopedia. The name of the object is given as a link to www.viruslist.com, where you can find more detailed information on the type of threat detected.
  • Full name of the dangerous object and a path to the webpage.
  • Brief description and a set of potential actions to take for the object. This description shows what sort of object the malicious program has infected.
You are asked to select one of the following responses to the object:
  • Allow - keeps the object open.
  • Block - blocks the object from loading from the webpage.

To apply the selected action to all objects with the same status detected during the current session of the protection component or task, check [image] Apply to all. The current session is the time from when the component is started until it is disabled or the application is restarted or the time from beginning a virus scan until it is complete.

Also see:

Proactive Defense verdicts


Dangerous activity detected in the system

When Proactive Defense detects dangerous application activity on your system, a special notification pops up containing:
  • The name of the threat as it is listed in the Kaspersky Lab Virus Encyclopedia. The name of the threat is given as a link to www.viruslist.com, where you can find more detailed information on the type of threat detected.
  • Full name of the file of the process that initiated the dangerous activity and a path to it.
    • Note that you can access more detailed information about a process that initiated dangerous activity in the system if you are running the program under Microsoft Windows XP x64, Microsoft Windows Vista x32 or Microsoft Windows Vista x64. To do so, go to the Info on process window by clicking on the Details button.

  • Brief description of the threat.
  • Possible responses:
    • Quarantine - closes the process and puts the executable file in Quarantine. When you place an object in Quarantine, it is moved, not copied. Files in Quarantine are saved in a special format and are not dangerous.
      • When you scan Quarantine later with updated application databases, the status of the object could change. For example, the object may be identified as infected and can be processed using an updated database. Otherwise, the object could be assigned the status not infected and could be restored.
      If a file is quarantined manually and after a subsequent scan turns out to be uninfected, its status after the scan will not immediately be changed to OK. This will only occur if the scan took place after a certain amount of time (at least three days) after quarantining the file.
    • Close - shuts down the process.
    • Allow - allows the process to execute.

To apply the selected action to all objects with the same status detected during the current session of the protection component or task, check [image] Apply to all. The current session is the time from when the component is started until it is disabled or the application is restarted or the time from beginning a virus scan until it is complete.

If you are sure that the program detected is not dangerous, we recommend adding it to the trusted zone to avoid Kaspersky Internet Security making repeat false positives when detecting it.
Use the Add to Trusted zone link and look over the exclusion settings in the window that opens.
If the user does not take any actions when a Proactive Defense notification appears, after a time the program will apply the default action recommended for that threat.

Also see:

Proactive Defense verdicts

Info on process


Rolling back dangerous actions

If when Proactive Defense detects dangerous application activity you have opted to move the file of the process to Quarantine or to shut down the process, the program will ask you if you want to roll back modifications it made to your system
You can view complete information about actions that it carried out in the window that opens when you click View history.
To roll back modifications, click Rollback. If you decide that the actions selected are not dangerous, click the Skip button.
If you are sure that the program detected is not dangerous, we recommend adding it to the trusted zone to avoid Kaspersky Internet Security making repeat false positives when detecting it.
Use the Add to Trusted Zone link and look over the exclusion settings in the window that opens.
If the user does not take any actions when a Proactive Defense notification appears, after a time the program will apply the default action recommended for that threat.

Also see:

Proactive Defense verdicts


Invader detected

When Proactive Defense detects one process attempting to inject into another on your system, a special notification pops up containing:
  • The name of the threat as it is listed in the Kaspersky Lab Virus Encyclopedia. The name of the threat is given as a link to www.viruslist.com, where you can find more detailed information on the type of threat detected.
  • Full name of the file of the process that initiated the invader attempt and a path to it.
  • Brief description of the threat. You can view complete information in the window that opens when you click Details.
  • Possible responses:
    • Close - fully shuts down the process attempting to inject.
    • Block - blocks invaders.
    • Skip - takes no actions; simply records information about it in the report.

To apply the selected action to all objects with the same status detected during the current session of the protection component or task, check [image] Apply to all. The current session is the time from when the component is started until it is disabled or the application is restarted or the time from beginning a virus scan until it is complete.

If you are sure that this action is not dangerous, we recommend adding it to the trusted zone to avoid Kaspersky Internet Security making repeat false positives when that process attempts to inject into another process.
For example, you use an automatic keyboard layout toggler. Kaspersky Internet Security identifies that actions of such programs as dangerous, since attempts to implement in other processes as used by these programs is typical of several malicious programs (for example, password interceptors, etc.).
Use the Add to Trusted zone link and look over the exclusion settings in the window that opens.
If the user does not take any actions when a Proactive Defense notification appears, after a time the program will apply the default action recommended for that threat.

Also see:

Proactive Defense verdicts


Attempt to executive buffer overflow code detected

When Proactive Defense detects attempts to execute code to create buffer overflow (this threat pertains to vulnerabilities in Microsoft Windows), a special notification pops up containing:
  • The name of the threat as it is listed in the Kaspersky Lab Virus Encyclopedia. The name of the threat is given as a link to www.viruslist.com, where you can find more detailed information on the type of threat detected.
  • Full name of the file of the process that initiated the attempt to execute buffer overflow code and a path to it.
  • Brief description of the threat. You can view complete information on the process that initiated the attempt to execute buffer overflow code in the window that opens when you click Details.
  • Possible responses:
    • Allow - allows the action.
    • Block - blocks the action.
If you are sure that this action is not dangerous, we recommend adding it to the trusted zone to avoid Kaspersky Internet Security making repeat false positives when that process attempts to executive buffer overload code. To do so, use the Add to Trusted zone link and look over the exclusion settings in the window that opens.
If the user does not take any actions when a Proactive Defense notification appears, after a time the program will apply the default action recommended for that threat.

Also see:

Proactive Defense verdicts


Attempt to open browser with command line parameters

When Proactive Defense detects an attempt to open a browser with command line parameters, a special notification pops up containing:
  • The name of the threat as it is listed in the Kaspersky Lab Virus Encyclopedia. The name of the threat is given as a link to www.viruslist.com, where you can find more detailed information on the type of threat detected.
  • Full name of the file of the process that initiated the attempt to open a browser with command line parameters and a path to it.
  • Brief description of the threat. You can view complete information on the process that initiated the attempt open a browser with parameters and a list of command line keys in the window that opens when you click Details.
  • Possible responses:
    • Allow - allows the browser to open.
    • Block - blocks the browser from opening.
If you are sure that this action is not dangerous, we recommend adding it to the trusted zone to avoid Kaspersky Internet Security making repeat false positives when that process attempts to open a browser with command line parameters. To do so, use the Add to Trusted zone link and look over the exclusion settings in the window that opens.
If the user does not take any actions when a Proactive Defense notification appears, after a time the program will apply the default action recommended for that threat.

Also see:

Proactive Defense verdicts


Hidden process detected

When Proactive Defense detects a hidden process on your system, a special notification pops up containing:
  • The name of the threat as it is listed in the Kaspersky Lab Virus Encyclopedia. The name of the threat is given as a link to www.viruslist.com, where you can find more detailed information on the type of threat detected.
  • Full name of the hidden process file and a path to it.
  • Brief description of the threat.
  • Possible responses:
    • Quarantine - Move the process's executable file to Quarantine. When you place an object in Quarantine, it is moved, not copied. Files in Quarantine are saved in a special format and are not dangerous.
      • When you scan Quarantine later with updated application databases, the status of the object could change. For example, the object may be identified as infected and can be processed using an updated database. Otherwise, the object could be assigned the status not infected and could be restored.

      If a file is quarantined manually and after a subsequent scan turns out to be uninfected, its status after the scan will not immediately be changed to OK. This will only occur if the scan took place after a certain amount of time (at least three days) after quarantining the file.
    • Close - shuts down the process.
    • Allow - allows the process to execute.
To apply the selected action to all objects with the same status detected during the current session of the protection component or task, check [image] Apply to all. The current session is the time from when the component is started until it is disabled or the application is restarted or the time from beginning a virus scan until it is complete.
If you are sure that the program detected is not dangerous, we recommend adding it to the trusted zone to avoid Kaspersky Internet Security making repeat false positives when detecting it.
Use the Add to Trusted zone link and look over the exclusion settings in the window that opens.
If the user does not take any actions when a Proactive Defense notification appears, after a time the program will apply the default action recommended for that threat.

Also see:

Proactive Defense verdicts


Attempt to breach application module integrity detected

When Proactive Defense detects attempts to breach the integrity of application components, a special notification pops up containing:
  • The name of the threat as it is listed in the Kaspersky Lab Virus Encyclopedia. The name of the threat is given as a link to www.viruslist.com, where you can find more detailed information on the type of threat detected.
  • Full name of the file of the process that initiated the attempt to load a new or modified module and a path to it.
  • Brief description of the threat. You can view complete information on the modified module and the process that opened the module in the window that opens when you click Details.
  • Possible responses:
    • Allow - allows the dangerous action to execute.
    • Block - blocks the dangerous action.

To apply the selected action to all objects with the same status detected during the current session of the protection component or task, check [image] Apply to all. The current session is the time from when the component is started until it is disabled or the application is restarted or the time from beginning a virus scan until it is complete.

If you are sure that the process attempting to open a new or modified module is not dangerous, add it to the list of shared components allowed to open in all monitored applications. To do so, click Add to Shared dll List. In the window that opens, select one of the following options:
  • Allow this process to open this module. If you select this option, the modified module will be added to the Trusted Modules list.
  • Allow this process to open any module. If you select this option, all modules loaded by this process will be added to the Trusted Modules list.
If the user does not take any actions when a Proactive Defense notification appears, after a time the program will apply the default action recommended for that threat.

Also see:

Proactive Defense verdicts


Attempt to access the system registry detected

When Proactive Defense detects an attempt to access system registry keys, a special notification pops up containing:
  • The registry key being accessed.
  • Full name of the file of the process that initiated the attempt to access the registry keys and a path to it.
  • Brief description of the threat. You can view complete information on the threat and the process that initiated execution in the window that opens when you click Details.
  • Possible responses:
    • Allow - allows the dangerous action to execute once.
    • Block - blocks the dangerous action once.
To perform the action you check automatically every time this activity is initiated on your computer, check [image] Create rule.
If you are sure that any activity by the application that attempted to access system registry keys is not dangerous, add the application to the trusted application list. To do so, use the Add to trusted applications link and look over the exclusion settings in the window that opens.
If the user does not take any actions when a Proactive Defense notification appears, after a time the program will apply the default action recommended for that threat.

Also see:

Proactive Defense verdicts


Attempt to redirect calling of system functions detected

When Proactive Defense detects attempts to imbed code into the Microsoft Windows operating system kernel to modify the address for calling system functions, a special notification pops up.
The notification is to inform the user, since this behavior could be caused by hidden malicious programs or a new virus on the system.
You can view complete information about suspicious activity in the system when you click Details.
In this situation, we recommend updating application databases and running a full scan.
If the user does not take any actions when a Proactive Defense notification appears, after a time the program will apply the default action recommended for that threat.

Also see:

Proactive Defense verdicts


Network activity detected

If the Training Mode is enabled for Firewall, each time a network connection is attempted that has no rule, a special notice appears on the screen.
The notification will contain:
  • Description of activity - name of the application and features in brief of the connection that it is initiating. Generally, the connection type, local port from which it is being initiated, remote port, and address being connected to are given. To obtain detailed information on the connection, the process that initiated it, and the developer of the application, left-click anywhere in the box.
  • Action - series of operations that Firewall will perform regarding the network activity detected.
Carefully review the information on network activity and only then select actions for Firewall. We recommend that you use these tips when making a decision:
  1. Before doing anything else, decide whether to allow or block the network activity. It is possible that in this situation a set of rules already created for this application or packet will help you (assuming that such have been created). To do so, use the Edit rules link. Then a window will open with a complete list of rules created for the application or data packet.
  2. Then decide whether to perform this action once or automatically every time this activity is detected.
To perform the action this time only:

uncheck [image] Create a rule and select the needed action, Allow or Block.

To perform the action you select automatically every time this activity is initiated on your computer:
  1. Make sure that [image] Create a rule is checked.
  2. Select the type of activity that you want the action to apply to from the dropdown list:
    • Any Activity - any network activity initiated by this application.
    • Custom - specific activity that you will have to define in a rule-creating window .
    • <Template> - name of the template that includes the set of rules typical of the network activity of the application. This activity type appears on the list if Kaspersky Internet Security includes an appropriate template for the application that initiated the network activity. In such a case, you will not have to customize what activity to allow or block. Use the template and a set of rules for the application will be created automatically.
  3. Select the needed action, Allow or Block.
Remember that the rule created will be used only when all of the connection parameters match it. This rule will not apply to a connection established from a different local port, for example.
If you do not want notifications from Firewall when applications attempt to establish network connections, click Turn off training mode. After this, Firewall will switch to Minimum Protection Mode, which allows all network connections except those that rules clear ban.


New network detected

Every time your computer connects to a new zone (i.e. network), a special notification will pop up.
The upper portion of the notification contains a brief description of the network, specifying the IP address and subnet mask.
The lower part of the window asks you to assign a status to the zone, and network activity will be allowed based on that status.
  • Internet (block access to files and printers). A high-risk network in which your computer is in danger of any possible type of threat. This status is also recommended for networks that are not protected by any anti-virus programs, firewalls, filters, etc. When you select this status, the program ensures maximum security while you are using this zone.
  • LAN (allow access to files and printers). This status is recommended for zones with an average risk factor (for example, corporate LANs).
  • Trusted (allow all connections). This status is only recommended for zones that you feel are safe where your computer is not subject to attacks or attempts to gain access to your data.
You can use Stealth Mode for added security when using networks labeled Internet. This feature only allows network activity that the user or an allowed application initiates. This actually means that your computer becomes invisible to its surroundings. This mode does not affect your computer's performance on the Internet.

We do not recommend using Stealth Mode if the computer is being used as a server (for example, a mail or HTTP server). Otherwise, the computers that connect to the server will not see it as connected.


Phishing attack detected

Every time Privacy Control detects a phishing attack, a special notification will pop up.
The notification will contain:
  • The name of the threat (phishing attack) as a link to the Kaspersky Lab Virus Encyclopedia with a detailed overview of the threat.
  • The web address for the phishing attack.
  • Possible responses:
    • Allow - keeps the phishing site open.
    • Block - blocks the phishing site.


Attempt to transmit confidential data detected

If the Protection of confidential data module detects any attempt to transmit data from a process imitating a trusted process, a special notification will appear on the screen, containing:

  • the name of the threat as it is listed in the Kaspersky Lab Virus Encyclopedia. The name of the threat is given as a link to http://www.viruslist.com, where you can find more detailed information on the type of threat detected.
  • Full name of the file of the process that attempted to transmit your data and a path to it.
  • Brief description of the threat. You can view detailed information about the process initiating the attempt to access data (PID of the process, address to which the process is attempting to transmit data, string with encrypted data) in the window that opens when you click the Details link.
  • Possible responses:
    • Quarantine – closes the process and puts the executable file in Quarantine. When you place an object in Quarantine, it is moved, not copied. Files in Quarantine are saved in a special format and are not dangerous.

    When you scan Quarantine later with updated application databases, the status of the object could change. For example, the object may be identified as infected and can be processed using an updated database. Otherwise, the object could be assigned the status not infected and could be restored.

    If a file is quarantined manually and after a subsequent scan turns out to be uninfected, its status after the scan will not immediately be changed to OK. This will only occur if the scan took place after a certain amount of time (at least three days) after quarantining the file.
    • Close - shuts down the process.
    • Allow – allows the process to execute.

To apply the action selected to all objects with the same status detected in the current session of the protection component or the task, select [image] Apply to all. The current session is considered the time that the component is running, from the time it is started until it is disabled or restarted, or the time that a task has been running from the time it starts until completion.

If you are sure that the program detected is not dangerous, we recommend adding it to the trusted zone to avoid Kaspersky Internet Security making repeat false positives when detecting it.

In this situation, use the Add to Trusted zone link and look over the exclusion settings in the window that opens.

Also see:

Protection of confidential data


Autodialer attempt detected

When Privacy Control detects dial attempts to certain numbers, a special notification pops up containing:
  • The name of the threat as it is listed in the Kaspersky Lab Virus Encyclopedia. The name of the program is given as a link to www.viruslist.com, where you can find more detailed information on the type of threat detected.
  • Full name of the file of the process that initiated the dialer attempt and a path to it.
  • Information on the phone number being called by the dialer. You can view complete information on the process that initiated the dial attempt in the window that opens when you click Details.
  • Possible responses:
    • Allow - allows the dial attempt to the given number, thereby establishing a network connection.
    • Block - blocks the dial attempt to that number.
If you authorized the call to that number, to avoid the program repeating false positives when dialing the number, we recommend adding it to the Anti-Dialer trusted numbers list. To do so, click Add to trusted numbers.


Quarantined object must be processed

If, when scanning quarantined objects with new versions of threat signatures, a file's status changes to infected, a special notification will pop up containing:
  • The threat type (for instance, virus, Trojan) and name of the malicious code as listed in the Kaspersky Lab Virus Encyclopedia. The name of the malicious object is given as a link to www.viruslist.com, where you can find more detailed information on the type of threat detected on your computer.
  • Full name of the malicious object and a path to it.
  • Brief description and a set of potential actions to take for the object. This description shows what sort of object the malicious program has infected.
You are asked to select one of the following responses to the object:
  • Disinfect - attempt to disinfect the malicious object. Before treatment, a backup copy is made of the object in case the necessity arise to restore it or a portrait of its infection.
  • Delete - delete the malicious object. Before deleting, a backup copy is made of the object in case the necessity arise to restore it or a portrait of its infection.
  • Skip - do not perform any actions in response to the object. If you select this option, the object will remain quarantined and will not be available to the user.

To apply the selected action to all objects with the same status detected during the current session of the protection component or task, check [image] Apply to all. The current session is the time from when the component is started until it is disabled or the application is restarted or the time from beginning a virus scan until it is complete.


When you cannot disinfect a quarantined object

If, when scanning quarantined objects with new versions of threat signatures, a file's status changes to infected, but it is impossible to disinfect it, a special notification will pop up containing:
  • The threat type (for instance, virus, Trojan) and name of the malicious code as listed in the Kaspersky Lab Virus Encyclopedia. The name of the malicious object is given as a link to www.viruslist.com, where you can find more detailed information on the type of threat detected on your computer.
  • Full name of the malicious object and a path to it.
  • Brief description and a set of potential actions to take for the object. This description shows what sort of object the malicious program has infected.
You are asked to select one of the following responses to the object:
  • Delete - delete the malicious object. Before deleting, a backup copy is made of the object in case the necessity arise to restore it or a portrait of its infection.
  • Skip - do not perform any actions in response to the object. If you select this option, the object will remain quarantined and will not be available to the user.

To apply the selected action to all objects with the same status detected during the current session of the protection component or task, check [image] Apply to all. The current session is the time from when the component is started until it is disabled or the application is restarted or the time from beginning a virus scan until it is complete.


Quarantined object is not infected

If, when scanning quarantined objects with new versions of threat signatures, a file's status changes to not infected or false positive, a special notification will pop up containing:
  • Full name of the object and a path to it.
  • Object status: not infected. It is possible that Kaspersky Internet Security mistakenly assigned the object the previous status of potentially infected.
  • Possible responses:
    • Restore - restore the files to a folder selected by the user or their original folder prior to Quarantine. When restoring quarantined objects from archives, mail databases, and mail format files, you must also select a restore destination directory.
    • Cancel - leave the object in Quarantine.


SSL connection detected

When attempting to connect securely to a website using SSL, a special notification will be displayed on screen.

The notification contains information on the program initiating the secure connection, along with the remote address and port. Select one of the options below to continue or discontinue scanning:

  • Process – scan traffic for viruses when connecting securely to the website.
  • Skip – continue connection with the web resourse without scanning traffic for viruses.

To apply the action selected in the future to all attempts to establish SSL connections in the current web browser session, check [image] Apply to all. However, note that when you choose for Kaspersky Internet Security to scan all secure connections automatically, in some cases this may cuase an error when trying to establish connections. If this occurs, disable SSL scanning for this connection.

Secure connection scans are enabled/disabled in the [image] Traffic monitoring section of the program settings window.


Working with the program from the command prompt

You can use Kaspersky Internet Security from the command prompt. You can execute the following operations:

  • Starting, stopping, pausing and resuming the activity of application components
  • Starting, stopping, pausing and resuming virus scans
  • Obtaining information on the current status of components and tasks and statistics on them
  • Scanning selected objects
  • Updating application databases and program modules
  • Calling up help on command prompt syntax
  • Calling up help on command syntax

Command prompt syntax is:

avp.com <command> [settings]
You must access the program from the command prompt from the program installation folder or by specifying the full path to avp.com.

The following may be used as <commands>:

ACTIVATE | Activates program via Internet using an activation code
ADDKEY | Activates program using a license key file (command can only be executed if the password assigned through the program interface is entered)
START | Starts a component or a task
PAUSE | Pauses a component or a task (command can only be executed if the password assigned through the program interface is entered)
RESUME | Resumes a component or a task
STOP | Stops a component or a task (command can only be executed if the password assigned through the program interface is entered)
STATUS | Displays the current component or task status on screen
STATISTICS | Displays statistics for the component or task on screen
HELP | Help with command syntax and the list of commands
SCAN | Scans objects for viruses
UPDATE | Begins program update
ROLLBACK | Rolls back to the last program update made (command can only be executed if the password assigned through the program interface is entered)
EXIT | Closes the program (you can only execute this command with a password assigned in the program interface)
IMPORT | Imports Kaspersky Internet Security settings (command can only be executed if the password assigned through the program interface is entered)
EXPORT | Exports Kaspersky Internet Security settings

Each command corresponds to its own set of parameters specific to that particular Kaspersky Internet Security component.

Also see:

Activating the program

Managing application components and tasks

Starting a Virus Search

Program Updates

Rolling back to the last program update

Exporting protection settings

Importing protection settings

Starting the program

Stopping the program

Creating a trace file

Viewing Help

Return codes from the command line interface


Activating the program

You can activate the program in two ways:

  • via Internet using an activation code (the ACTIVATE command)
  • using a license key file (the ADDKEY command)

Command syntax:

ACTIVATE <activation_code>
ADDKEY <file_name> /password=<your_password>

Parameter description:

<activation_code> | Program activation code provided when you purchased it.
<file_name> | Name of the license key file with the extension .key.
<your_password> | Password for accessing Kaspersky Internet Security assigned in the application interface.
Note that you cannot execute the ADDKEY command without entering the password.

Examples:

avp.com ACTIVATE 11AA1-11AAA-1AA11-1A111
avp.com ADDKEY 1AA111A1.key /password=<your_password>


Managing program components and tasks

Managing application components and tasks

Command syntax:

avp.com <command> <profile|task_name> [/R[A]:<report_file>]
avp.com STOP|PAUSE <profile|task_name> /password=<your_password> [/R[A]:<report_file>]

<command>

You can manage Kaspersky Internet Security components and tasks from the command prompt with the following commands:
START - load a real-time protection component or task.
STOP - stop a real-time protection component or task.
PAUSE - stop a real-time protection component or task.
RESUME - resume a real-time protection component or task.
STATUS - display the current status of the real-time protection component or task.
STATISTICS – outputs statistics to the screen on real-time protection component or task operation.

Note that you cannot execute the commands PAUSE or STOP without entering the password.

<profile|task_name>

You can specify any real-time protection component, modules in the components, on-demand scan tasks, or updates for the values of <profile> (the standard values used in the program are shown in the table below).
You can specify the name of any on-demand scan or update task as the value for <task_name>.

<your_password>

Kaspersky Internet Security password assigned in the program interface.

/R[A]:<report_file>

R:<report_file> – only log important events in the report.
/RA:<report_file> – log all events in the report.
You can use an absolute or relative path to the file. If the parameter is not defined, the scan results are displayed on screen, and all events are displayed.

One of the following values is assigned to <profile>:

RTP

All protection components

The command avp.com START RTP starts all real-time protection components if protection is fully disabled or paused. This command will also start any real-time protection component that was paused that was paused from the GUI or the PAUSE command from the command prompt.

If the component was disabled from the GUI or the STOP command from the command prompt, the command avp.com START RTP will not start it. In order to start it, you must execute the command avp.com START <profile>, with the value for the specific protection component entered for <profile>. For example, avp.com START FM.

FM

File Anti-Virus

EM

Mail Anti-Virus

WM

Web Anti-Virus

Values for Web Anti-Virus subcomponents:

httpscan – scans http traffic

sc – scans scripts.

BM

Proactive Defense

Values for Proactive Defense subcomponents:

pdm – application activity analysis.

ASPY

Privacy Control

Values for Privacy Control subcomponents:

antidial – Anti-Dialer

antiphishing – Anti-Phishing

PrivacyControl – Protects confidential data

AH

Firewall

Values for Firewall subcomponents:

fw – filtration system;

ids – Intrusion Detection System;

AdBlocker – AdBlocker;

popupchk – Popup Blocker

AS

Anti-Spam

ParCtl

Parental Control

Update

Update

Rollback

Rolls back to the previous update

SCAN_OBJECTS

"Virus scan" task

SCAN_MY_COMPUTER

"My Computer" task

SCAN_CRITICAL_AREAS

"Critical Areas" task

SCAN_STARTUP

"Startup Objects" task

SCAN_QUARANTINE

Task for scanning quarantined objects

SCAN_ROOTKITS

Rootkit scan task
Components and tasks started from the command prompt are run with the settings configured with the program interface.

Examples:

To enable File Anti-Virus, type this at the command prompt:
avp.com START FM
To view the current status of Proactive Defense on your computer, type the following text at the command prompt:
avp.com STATUS BM
To stop a My Computer scan task from the command prompt, enter:
avp.com STOP SCAN_MY_COMPUTER /password=<your_password>


Starting a Virus Search

Starting a scan of a certain area for viruses and processing malicious objects from the command prompt generally looks as follows:

avp.com SCAN [<object scanned>] [<action>] [<file types>] [<exclusions>] [<configuration file>] [<report settings>] [<advanced settings>]
To scan objects, you can also use the tasks created in Kaspersky Internet Security by starting the one you need from the command prompt. The task will be run with the settings from the program interface.

Parameter description.

<object scanned> - this parameter gives the list of objects that will be scanned for malicious code.

The parameter can include several values from the list provided, separated by spaces.

<files>

List of paths to the files and/or folders to be scanned.
You can enter absolute or relative paths. Items on the list are separated by a space.

Notes:

  • If the object name contains a space, it must be placed in quotation marks;
  • If you specify a concrete folder, all the files in it are scanned.

/MEMORY

RAM objects

/STARTUP

Startup objects

/MAIL

Mailboxes

/REMDRIVES

All removable media drives

/FIXDRIVES

All internal drives

/NETDRIVES

All network drives

/QUARANTINE

Quarantined objects

/ALL

Complete scan

/@:<filelist.lst>

Path to the file with a list of objects and catalogs included in the scan. The file should be in a text format and each scan object must start a new line.

You can enter an absolute or relative path to the file. The path must be placed in quotation marks if it contains a space.

<action> - this parameter determines actions on malicious objects detected during the scan. If this parameter is not defined, the default action is the one with the value for /i8.

/i0

take no actions on the object; simply record information about it in the report.

/i1

Treat infected objects, and if disinfection is impossible, skip

/i2

Treat infected objects, and if disinfection fails, delete, but do not delete infected objects from compound objects, and delete compound objects with executable headers (sfx archives) (this is the default setting).

/i3

Treat infected objects, and if disinfection fails, delete and delete all compound objects completely if the infected attachments cannot be deleted.

/i4

Delete infected objects, and if disinfection fails, delete and delete all compound objects completely if the infected attachments cannot be deleted.

/i8

Prompt the user for action if an infected object is detected.

/i9

Prompt the user for action at the end of the scan.

<file types> - this parameter defines the file types that will be subject to anti-virus scan. By default, if this parameter is not defined, only infected files by contents will be scanned.

/fe

Scan only infected files by extension

/fi

Scan only infected files by contents

/fa

Scan all files

<exclusions> - this parameter defines objects that are excluded from the scan.

The parameter can include several values from the list provided, separated by spaces.

-e : a

Do not scan archives

-e : b

Do not scan mailboxes

-e : m

Do not scan plain text e-mails

-e : <filemask>

Do not scan objects by mask

-e : <seconds>

Skip objects that are scanned for longer that the time specified in the <seconds> parameter

-es : <size>

Skip objects which size (in MB) exceeds the value specified in the : <size> parameter.

<configuration file> - defines the path to the configuration file that contains the program settings for the scan.

The configuration file is in text format, which contained the set of command line parameters for anti-virus scan.

You can enter an absolute or relative path to the file. If this parameter is not defined, the values set in the Kaspersky Internet Security interface are used.

/C:<file_name>

Use the settings values assigned in the file <file_name>.

<report settings> - this parameter determines the format of the report on scan results.

You can use an absolute or relative path to the file. If the parameter is not defined, the scan results are displayed on screen, and all events are displayed.

/R:<report_file>

Only log important events in this file

/RA:<report_file>

Log all events in this file

<advanced settings> - settings that define use of anti-virus scanning technologies.

/iChecker=<on|off>

Enable/ disable iChecker

/iSwift=<on|off>

Enable/ disable iSwift

Examples:

Start a scan of RAM, Startup programs, mailboxes, the directories My Documents and Program Files, and the file test.exe:
avp.com SCAN /MEMORY /STARTUP /MAIL "C:\Documents and Settings\All Users\My Documents" "C:\Program Files" "C:\Downloads\test.exe"
Pause scan of selected objects and start full computer scan, at the end of which continue to scan for viruses within the selected objects:
avp.com PAUSE SCAN_OBJECTS/password=<your_password>
avp.com START SCAN_MY_COMPUTER
avp.com RESUME SCAN_OBJECTS
Scan the objects listed in the file object2scan.txt. Use the configuration file scan_setting.txt for the job. Upon the results of the scan, generate a report in which all events are recorded:
avp.com SCAN /MEMORY /@:objects2scan.txt /C:scan_settings.txt /RA:scan.log

A sample configuration file :

/MEMORY /@:objects2scan.txt /C:scan_settings.txt /RA:scan.log


Program Updates

The syntax for updating Kaspersky Internet Security program modules and application databases from the command prompt is as follows:

avp.com UPDATE [<update_source>] [/R[A]:<report_file>] [/C:<file_name>] [/APP=<on|off>]

Parameter description:

<update_source>

HTTP or FTP server or network folder for downloading updates. You can specify the full path to the update source or a URL as the value for this parameter. If a path is not selected, the update source will be taken from the Update settings.

/R[A]:<report_file>

/R:<report_file> - only log important events in the report.

/R[A]:<report_file> - log all events in the report.

You can use an absolute or relative path to the file. If the parameter is not defined, the scan results are displayed on screen, and all events are displayed.

/C:<file_name>

Path to the configuration file that contains the settings for program updates.

The configuration file is in text format, which contained the set of command line parameters for application update.

You can enter an absolute or relative path to the file. If this parameter is not defined, the values for the settings in the Kaspersky Internet Security interface are used.

/APP=<on|off>

Enable / Disable application module updates

Examples:

Update application databases after recording all events in the report:
avp.com UPDATE /RA:avbases_upd.txt
Update the Kaspersky Internet Security program modules by using the parameters of the configuration file updateapp.ini:
avp.com UPDATE /APP=on /C:updateapp.ini

A sample configuration file:

"ftp://my_server/kav updates" /RA:avbases_upd.txt /app=on


Rolling back to the last program update

Command syntax:

ROLLBACK [/R[A]:<report_file>] [/password=<your_password>]

Parameter description:

/R[A]:<report_file> | /R:<report_file> – only log important events in the report. /RA:<report_file> – log all events in the report. You can use an absolute or relative path to the file. If the parameter is not defined, the scan results are displayed on screen, and all events are displayed.
<your_password> | Password for accessing Kaspersky Internet Security assigned in the application interface.

Note that you cannot execute this command without entering the password.

Example:

avp.com ROLLBACK /RA:rollback.txt /password=<your_password>


Exporting protection settings

Command syntax:

avp.com EXPORT <profile> <filename>

Parameter description:

<profile>

Component or task with the settings that are being exported.

You can use any value for <profile> that is listed in section Managing application components and tasks.

<filename>

Path to the file to which the Kaspersky Internet Security settings are being exported. You can use an absolute or relative path.

The configuration file is saved in binary format (.dat), and it can be used later to import application settings on other computers. The configuration file can be saved as a text file. To do so, specify the .txt extension in the file name.Note that you cannot import protection settings from a text file. This file can only be used to specify the main settings for program operation.

Example:

avp.com EXPORT c:\settings.dat


Importing protection settings

Command syntax:

avp.com IMPORT <filename> [/password=<your_password>]
<filename> | Path to the file from which the Kaspersky Internet Security settings are being imported. You can use an absolute or relative path.
<your_password> | Kaspersky Internet Security password assigned in the program interface.

Note that you cannot execute this command without entering the password.

Example:

avp.com IMPORT c:\settings.dat /password=<your_password>


Starting the program

Command syntax:

avp.com


Stopping the program

Command syntax:

EXIT /password=<your_password>

<your_password>

Kaspersky Internet Security password assigned in the program interface.
Note that you cannot execute this command without entering the password.


Creating a trace file

You might need to create a trace file if you have problems with the program to troubleshoot them more exactly with the specialists at Technical Support.
Command syntax:
avp.com TRACE [file] [on|off] [<trace_level>]

Parameter description:

[on|off]
Enable/disable trace creation.
[file]
Output trace to file.
<trace_level>
This value can be an integer from 0 (minimum level, only critical messages) to 700 (maximum level, all messages).
A Technical Support will tell you what trace level you need when you contact Technical Support. If it is not specified, we recommend setting the level to 500.
Warning: We only recommend creating trace files for troubleshooting a specific problem. Regularly enabling traces could slow down your computer and fill up your hard drive.
Examples:
To disable trace file creation:
avp.com TRACE file off
To create a trace file to send to Technical Support with a maximum trace level of 500:
avp.com TRACE file on 500


Viewing Help

To view the help for command prompt syntax, this command is available:

avp.com [ /? | HELP ]

To get help on the syntax of a specific command, you can use one of the following commands:

avp.com <command> /?
avp.com HELP <command>


Return codes from the command line interface

This section contains a list of return codes from the command line. The general codes may be returned by any command from the command line. The return codes include general codes as well as codes specific to a specific type of task.

General return codes
0 | Operation completed successfully
1 | Invalid setting value
2 | Unknown error
3 | Task completion error
4 | Task cancelled
Virus scan task return codes
101 | All dangerous objects processed
102 | Dangerous objects detected


Kaspersky Lab

Founded in 1997, Kaspersky Lab has become a recognized leader in information security technologies. It produces a wide range of data security software and delivers high-performance, comprehensive solutions to protect computers and networks against all types of malicious programs, unsolicited and unwanted e-mail messages, and hacker attacks.

Kaspersky Lab is an international company. Headquartered in the Russian Federation, the company has representative offices in the United Kingdom, France, Germany, Japan, USA (CA), the Benelux countries, China, Poland, and Romania. A new company department, the European Anti-Virus Research Centre, has recently been established in France. Kaspersky Lab's partner network incorporates more than 500 companies worldwide.

Today, Kaspersky Lab employs more than 450 specialists, each of whom is proficient in anti-virus technologies, with 10 of them holding M.B.A. degrees, 16 holding Ph.Ds, and senior experts holding membership in the Computer Anti-Virus Researchers Organization (CARO).

Kaspersky Lab offers best-of-breed security solutions, based on its unique experience and knowledge, gained in over 14 years of fighting computer viruses. A thorough analysis of computer virus activities enables the company to deliver comprehensive protection from current and future threats. Resistance to future attacks is the basic policy implemented in all Kaspersky Lab's products. The company's products consistently remain at least one step ahead of many other vendors in delivering extensive anti-virus coverage for home users and corporate customers alike.

Years of hard work have made the company one of the top security software manufacturers. Kaspersky Lab was one of the first businesses of its kind to develop the highest standards for anti-virus defense. The company's flagship product, Kaspersky Anti-Virus, provides full-scale protection for all tiers of a network, including workstations, file servers, mail systems, firewalls, Internet gateways, and hand-held computers. Its convenient and easy-to-use management tools ensure advanced automation for rapid virus protection across an enterprise. Many well-known manufacturers use the Kaspersky Anti-Virus kernel, including Nokia ICG (USA), F-Secure (Finland), Aladdin (Israel), Sybari (USA), G Data (Germany), Deerfield (USA), Alt-N (USA), Microworld (India) and BorderWare (Canada).

Kaspersky Lab's customers benefit from a wide range of additional services that ensure both stable operation of the company's products, and compliance with specific business requirements. Our databases are updated every hour. The company provides its customers with a 24-hour technical support service, which is available in several languages to accommodate its international clientele.

Also see:

Other Kaspersky Lab Products

Services provided for registered users

Contact Us


Other Kaspersky Lab Products

Kaspersky Lab News Agent

The News Agent is intended for timely delivery of news published by Kaspersky Lab, notifications about the current status of virus activity, and fresh news. The program reads the list of available news feeds and their content from the Kaspersky Lab news server at specified intervals.

News Agent enables users to:
  • See the current virus forecast in the taskbar notification area.
  • Subscribe to and unsubscribe from news feeds.
  • Retrieve news from each selected feed at the specified interval and receive notifications about fresh news.
  • Review news on the selected feeds.
  • Review the list of feeds and their status.
  • Open full article text in your browser.
News Agent is a stand-alone Microsoft Windows application that can be used independently or may be bundled with various integrated solutions offered by Kaspersky Lab Ltd.

Kaspersky® On-Line Scanner

This program is a free service provided to the visitors of Kaspersky Lab's corporate website. The service delivers an efficient online anti-virus scan of your computer. Kaspersky On-Line Scanner runs directly from your browser. This way, users receive quick responses to questions regarding potential infectionson their computers. Using the service, visitors can:

  • Exclude archives and e-mail databases from scanning.
  • Select standard/extended databases for scanning.
  • Save a report on the scanning results in .txt or .html formats.

Kaspersky® On-Line Scanner Pro

The program is a subscription service available to the visitors of Kaspersky Lab's corporate website. The service delivers an efficient online anti-virus scan of your computer and disinfects dangerous files. Kaspersky On-Line Scanner Pro runs directly from your browser. Using the service, visitors can:

  • Exclude archives and e-mail databases from scanning.
  • Select standard/extended databases for scanning.
  • Save a report on the scanning results in .txt or .html formats.

Kaspersky® Anti-Virus 7.0

Kaspersky Anti-Virus 7.0 is designed to safeguard personal computers against malicious software as an optimal combination of conventional methods of anti-virus protection and new proactive technologies.

The program provides for complex anti-virus checks, including:

  • Anti-virus scanning of e-mail traffic on the level of data transmission protocol (POP3, IMAP and NNTP for incoming mail and SMTP for outgoing messages), regardless of the mail client being used, as well as disinfection of e-mail databases.
  • Real-time anti-virus scanning of Internet traffic transferred via HTTP.
  • Anti-virus scanning of individual files, folders, or drives. In addition, a preset scan task can be used to initiate anti-virus analysis exclusively for critical areas of the operating system and start-up objects of Microsoft Windows.
Proactive protection offers the following features:
  • Controls modifications within the file system. The program allows users to create a list of applications, which it will control on a per component basis. It helps protect application integrity against the influence of malicious software.
  • Monitors processes in random-access memory. Kaspersky Anti-Virus 7.0 in a timely manner notifies users whenever it detects dangerous, suspicious or hidden processes or in case when unauthorized changes in active processes occur.
  • Monitors changes in OS registry due to internal system registry control.
  • Hidden Processes Monitor helps protect from malicious code concealed in the operating system using rootkit technologies.
  • Heuristic Analyzer. When scanning a program, the analyzer emulates its execution and logs all suspicious activity, such as, opening or writing to a file, interrupt vector intercepts, etc. A decision is made based on this procedure regarding possible infection of the program with a virus. Emulation occurs in an isolated virtual environment which reliably protects the computer of infection.
  • Performs system restore after malware attacks by logging all changes to the registry and computer file system and rolls them back at user's discretion.
Kaspersky® Anti-Virus Mobile

Kaspersky® Anti-Virus Mobile provides antivirus protection for mobile devices running Symbian OS and Microsoft Windows Mobile. The program provides comprehensive virus scanning, including:

  • On-demand scans of the mobile device's onboard memory, memory cards, an individual folder, or a specific file; if an infected file is detected, it is moved to Quarantine or deleted.
  • Real-time scanning - all incoming and outgoing files are automatically scanned, as well as files when attempts are made to access them.
  • Protection from text message spam.

Kaspersky Anti-Virus for File Servers

This software package provides reliable protection for file systems on servers running Microsoft Windows, Novell NetWare, Linux and Samba from all types of malware. The suite includes the following Kaspersky Lab applications:

  • Kaspersky® Administration Kit.
  • Kaspersky® Anti-Virus for Windows Server.
  • Kaspersky® Anti-Virus for Linux File Server.
  • Kaspersky® Anti-Virus for Novell Netware.
  • Kaspersky® Anti-Virus for Samba Server.
Features and functionality:
  • Protects server file systems in real time: All server files are scanned when opened or saved on the server.
  • Prevents virus outbreaks.
  • On-demand scans of the entire file system or individual files and folders.
  • Use of optimization technologies when scanning objects in the server file system.
  • System rollback after virus attacks.
  • Scalability of the software package within the scope of system resources available.
  • Monitoring of the system load balance.
  • Creating a list of trusted processes whose activity on the server is not subject to control by the software package.
  • Remote administration of the software package, including centralized installation, configuration, and administration.
  • Saving backup copies of infected and deleted objects in case you need to restore them.
  • Quarantining suspicious objects.
  • Send notifications on events in program operation to the system administrator.
  • Log detailed reports.
  • Automatically update program databases.

Kaspersky Open Space Security

Kaspersky Open Space Security is a software package withal new approach to security for today's corporate networks of any size, providing centralized protection information systems and support for remote offices and mobile users.
The suite includes four programs:
  • Kaspersky Work Space Security.
  • Kaspersky Business Space Security.
  • Kaspersky Enterprise Space Security.
  • Kaspersky Total Space Security.
Specifics on each program are given below.

Kaspersky WorkSpace Security is a program for centralized protection of workstations inside and outside of corporate networks from all of today's Internet threats (viruses, spyware, hacker attacks, and spam).

Features and functionality:

  • Comprehensive protection from viruses, spyware, hacker attacks, and spam.
  • Proactive Defense from new malicious programs whose signatures are not yet added to the database.
  • Personal Firewall with intrusion detection system and network attack warnings.
  • Rollback for malicious system modifications.
  • Protection from phishing attacks and junk mail.
  • Dynamic resource redistribution during complete system scans.
  • Remote administration of the software package, including centralized installation, configuration, and administration.
  • Support for Cisco® NAC (Network Admission Control).
  • Scanning of e-mail and Internet traffic in real time.
  • Blocking of popup windows and banner ads when on the Internet.
  • Secure operation in any type of network, including Wi-Fi.
  • Rescue disk creation tools that enable you to restore your system after a virus outbreak.
  • An extensive reporting system on protection status.
  • Automatic database updates.
  • Full support for 64-bit operating systems.
  • Optimization of program performance on laptops (Intel® Centrino® Duo technology).
  • Remote disinfection capability (Intel® Active Management, Intel® vPro™).

Kaspersky Business Space Security provides optimal protection of your company's information resources from today's Internet threats. Kaspersky Business Space Security protects workstations and file servers from all types of viruses, Trojans, and worms, prevents virus outbreaks, and secures information while providing instant access to network resources for users.

Features and functionality:

  • Remote administration of the software package, including centralized installation, configuration, and administration.
  • Support for Cisco® NAC (Network Admission Control).
  • Protection of workstations and file servers from all types of Internet threats.
  • iSwift technology to avoid rescanning files within the network.
  • Distribution of load among server processors.
  • Quarantining suspicious objects from workstations.
  • Rollback for malicious system modifications.
  • scalability of the software package within the scope of system resources available.
  • Proactive Defense for workstations from new malicious programs whose signatures are not yet added to the database.
  • Scanning of e-mail and Internet traffic in real time.
  • Personal Firewall with intrusion detection system and network attack warnings.
  • Protection while using Wi-Fi networks.
  • Self-Defense from malicious programs.
  • Quarantining suspicious objects.
  • Automatic database updates.

Kaspersky Enterprise Space Security

This program includes components for protecting linked workstations and servers from all today's Internet threats. It deletes viruses from e-mail, keeping information safe while providing secure access to network resources for users.

Features and functionality:

  • Protection of workstations and file servers from viruses, Trojans, and worms.
  • Protection of Sendmail, Qmail, Postfix and Exim mail servers.
  • Scanning of all e-mails on Microsoft Exchange Server, including shared folders.
  • Processing of e-mails, databases, and other objects for Lotus Domino servers.
  • Protection from phishing attacks and junk mail.
  • Preventing mass mailings and virus outbreaks.
  • Scalability of the software package within the scope of system resources available.
  • Remote administration of the software package, including centralized installation, configuration, and administration.
  • Support for Cisco® NAC (Network Admission Control).
  • Proactive Defense for workstations from new malicious programs whose signatures are not yet added to the database.
  • Personal Firewall with intrusion detection system and network attack warnings.
  • Secure operation while using Wi-Fi networks.
  • Scans Internet traffic in real time.
  • Rollback for malicious system modifications.
  • Dynamic resource redistribution during complete system scans.
  • Quarantining suspicious objects.
  • An extensive reporting system on protection system status.
  • Automatic database updates.

Kaspersky Total Space Security

This solution monitors all inbound and outbound data streams (e-mail, Internet, and all network interactions). It includes components for protecting workstations and mobile devices, keeps information safe while providing secure access for users to the company's information resources and the Internet, and ensures secure e-mail communications.

Features and functionality:

  • Comprehensive protection from viruses, spyware, hacker attacks, and spam on all levels of the corporate network, from workstations to Internet gateways.
  • Proactive Defense for workstations from new malicious programs whose signatures are not yet added to the database.
  • Protection of mail servers and linked servers.
  • Scans Internet traffic (HTTP/FTP) entering the local area network in real time.
  • Scalability of the software package within the scope of system resources available.
  • Blocking access from infected workstations.
  • Prevents virus outbreaks.
  • Centralized reporting on protection status.
  • Remote administration of the software package, including centralized installation, configuration, and administration.
  • Support for Cisco® NAC (Network Admission Control).
  • Support for hardware proxy servers.
  • Filters Internet traffic using a trusted server list, object types, and user groups.
  • iSwift technology to avoid rescanning files within the network.
  • Dynamic resource redistribution during complete system scans.
  • Personal Firewall with intrusion detection system and network attack warnings.
  • Secure operation for users on any type of network, including Wi-Fi.
  • Protection from phishing attacks and junk mail.
  • Remote disinfection capability (Intel® Active Management, Intel® vPro™).
  • Rollback for malicious system modifications.
  • Self-Defense from malicious programs.
  • Full support for 64-bit operating systems.
  • Automatic database updates.

Kaspersky Security for Mail Servers

This program is for protecting mail servers and linked servers from malicious programs and spam. The program includes application for protecting all standard mail servers (Microsoft Exchange, Lotus Notes/Domino, Sendmail, Qmail, Postfix and Exim) and also enables you to configure a dedicated e-mail gateway. The solution includes:
  • Kaspersky Administration Kit.
  • Kaspersky Mail Gateway.
  • Kaspersky Anti-Virus for Lotus Notes/Domino.
  • Kaspersky Anti-Virus for Microsoft Exchange.
  • Kaspersky Anti-Virus for Linux Mail Server.
Its features include:
  • Reliable protection from malicious or potentially dangerous programs.
  • Junk mail filtering.
  • Scans incoming and outgoing e-mails and attachments.
  • Scans all e-mails on Microsoft Exchange Server for viruses, including shared folders.
  • Processes e-mails, databases, and other objects for Lotus Notes/Domino servers.
  • Filters e-mails by attachment type.
  • Quarantines suspicious objects.
  • Easy-to-use administration system for the program.
  • Prevents virus outbreaks.
  • Monitors protection system status using notifications.
  • Reporting system for program operation.
  • Scalability of the software package within the scope of system resources available.
  • Automatic database updates.

Kaspersky Security for Internet Gateways

This program provides secure access to the Internet for all an organization's employees, automatically deleting malware and riskware from the data incoming on HTTP/FTP. The solution includes:
  • Kaspersky Administration Kit.
  • Kaspersky Anti-Virus for Proxy Server.
  • Kaspersky Anti-Virus for Microsoft ISA Server.
  • Kaspersky Anti-Virus for Check Point FireWall-1.
Its features include:
  • Reliable protection from malicious or potentially dangerous programs.
  • Scans Internet traffic (HTTP/FTP) in real time.
  • Filters Internet traffic using a trusted server list, object types, and user groups.
  • Quarantines suspicious objects.
  • Easy-to-use administration system.
  • Reporting system for program operation.
  • Support for hardware proxy servers.
  • Scalability of the software package within the scope of system resources available.
  • Automatic database updates.

Kaspersky® Anti-Spam

Kaspersky® Anti-Spam is a cutting-edge software suite designed to help organizations with small- and medium-sized networks wage war against the onslaught of unsolicited e-mail messages (spam). The product combines the revolutionary technology of linguistic analysis with modern methods of e-mail filtration, including DNS Black Lists and formal letter features. Its unique combination of services allows users to identify and wipe out up to 95% of unwanted traffic.

Installed at the entrance to a network, where it monitors incoming e-mail traffic streams for spam, Kaspersky® Anti-Spam acts as a barrier to unsolicited e-mail. The product is compatible with any mail system and can be installed on either an existing mail server or a dedicated one.

Kaspersky® Anti-Spam's high performance is ensured by daily updates to the content filtration database, adding samples provided by the Company's linguistic laboratory specialists. Databases are updated every 20 minutes.

Kaspersky® Anti-Virus for MIMESweeper for SMTP

Kaspersky® Anti-Virus for MIMESweeper provides high-speed scanning of traffic on servers running Clearswift MIMEsweeper for SMTP / Clearswift MIMEsweeper for Exchange / Clearswift MIMEsweeper for Web.

The program is a plug-in and scans for viruses and processes inbound and outbound e-mail traffic in real time.


Services provided for registered users

Kaspersky Lab provides its legal users with a great number of services that increase the effectiveness of using Kaspersky Internet Security.
After program activation, you become a registered program user and will have the following services available until the license expires:
  • new versions of the program;
  • consultation on matters related to installation, setup, and operation of that program, via telephone and e-mail;
  • notification on the release of new Kaspersky Lab programs and on new viruses that appear in the world(this service is provided for users that subscribe to the Kaspersky Lab newsletter).
Kaspersky Lab does not provide support on issues related to the performance and the use of operating systems or other technologies.
Also see:

Other Kaspersky Lab Products

Contact Us


Contact Us

If you have any questions, comments, or suggestions, please refer them to one of our distributors or directly to Kaspersky Lab. We will be glad to assist you in any matters related to our product by phone or via e-mail. Rest assured that all of your recommendations and suggestions will be thoroughly reviewed and considered.
Technical support | Please find the technical support information at http://www.kaspersky.com/supportinter.html Helpdesk: www.kaspersky.com/helpdesk.html
General information | WWW: http://www.kaspersky.com http://www.viruslist.com E-mail: info@kaspersky.com
Also see:

Other Kaspersky Lab Products

Services provided for registered users


Additional Firewall settings

At this stage of the Settings Wizard, you can configure advanced settings for Firewall:

    Disable DNS caching. Caching domain names drastically cuts down on the time your computer is connected to the needed Internet resource; however, it is at the same time a dangerous vulnerability, and by using it, malefactors can gain access to your data. Therefore, to increase the degree of security for your computer, we recommend disabling this feature, which saves information about domain names in the cache (this setting is selected by default).
    Enable Stealth Mode. This feature only allows network activity that the user or an allowed application initiates. This actually means that your computer becomes invisible to its surroundings. This mode does not affect your computer's performance on the Internet: The component guarantees standard transparency and information accessibility.
We do not recommend using Stealth Mode if the computer is being used as a server (for example, a mail or HTTP server). Otherwise, the computers that connect to the server will not see it as connected.


Banner ad blocking list

Kaspersky Lab specialists have compiled a banner ad mask list based on specially conducted research and have included it with the program. The program will block banner ads that fall under the masks on this list, unless banner ad blocking is disabled.
You can also create white and black lists for banner ads which will allow or block banner ads.
Note that if you have a domain mask on the list or blocked banners or on a black list, you will still be able to access the root site.

For example, if the blocked banner list includes a mask for truehits.net, you will be able to access http://truehits.net, but access to http://truehits.net/a.jpg will be blocked.

Also see:

Configuring the standard banner ad blocking list

Banner ad white lists

Banner ad black lists


General information about the program

You can view general information on the program in the [image] Service section of the main window.
All the information is broken into three sections:
  • Program version, date of last update, and the number of threats known to date are displayed in the Product info section.
  • Basic information on the operation system installed on your computer is shown in the System info box.
  • Basic information about the license you purchased for Kaspersky Internet Security is contained in the License info section.
You will need all this information when you contact Kaspersky Lab Technical Support.

Also see:

License prolongation


Creating update tasks

Kaspersky Internet Security has a built-in update task for updated program modules and threat signatures. However, you can create your own update tasks with various settings and start schedules.

For example, you installed Kaspersky Internet Security on a laptop that you use at home and at your office. At home, you update the program from the Kaspersky Lab update servers, and at the office, from a local folder that stores the updates you need. Use two different tasks to avoid having to change update settings every time you change locations.

To create an advanced update task:

  1. In the main program window, select the Update section and click New update task.
  2. Enter the name for the task in the window that opens and click OK. A task with that name will then appear in the Update section of the main program window.
Warning!
There is a limit to the number of update tasks that the user can create. The maximum is two tasks.

The new task inherits all the properties of the task on which you based it, except for the schedule settings. The default automatic scan setting for the new task is disabled.

After creating the task, configure advanced settings: select an update source, network connection settings, and, if necessary, enable running a task with permissions and configure the schedule.

To rename a task:

Select the task from the Update section of the main program window, open the context menu by right-clicking, and select Rename.

Enter the new name for the task in the window that opens and click OK. The task name will then be changed in the Update section.

To delete a task:

Select the task from the Update section of the main program window, open the context menu by right-clicking, and select Delete.

Confirm that you want to delete the task in the window that asks you for confirmation. The task will then be deleted from the list of tasks in the Update section.

Warning!
You can only rename and delete user tasks.


Info on process

The Info on process window displays data on the process that Proactive Defense intercepted as the initiator of dangerous activity in the system:

  • The Process section contains information on the process initiating dangerous activity (path to the process, time it was started and time it was closed, version of the program that started the process, manufacturer, and description of the program).
  • The Parent Processsection contains information on the process that that started the intercepted process (path to the process, time it was started and time it was closed, version of the program that started the process, manufacturer, and description of the program).
  • The Child Processes section contains information on the processes that the intercepted process started (name, time it was started and time it was closed, manufacturer, and description of the program).

Also see:

Proactive Defense verdicts

Dangerous activity detected in the system


Редактирование профилей

Editing Profiles

Preconfigured profile settings may be edited as needed.

To edit profile settings:
  1. Open the application settings window and select [image] Parental Control under Protection.
  2. Under Profiles select a preinstalled profile you would like to reconfigure.
  3. Edit Security Level , Action , and Time Limit as needed.

As the result of these changes, the selected preinstalled profile will have user customized settings .


Reports

When using the program, each protection component, virus search task, and program update creates a report. The reports contain information on completed operations and their results. By using the Reports feature, you will always stay up-to-date on the operation of all the Kaspersky Internet Security components. Should problems arise, you can send the reports to Kaspersky Lab so our specialists can study the situation in greater depth and help you as quickly as possible.

Kaspersky Internet Security sends all files suspected of being dangerous to a special Quarantine area. They are stored there in an encrypted form to avoid infecting the computer. You can scan these objects for viruses, restore them to their previous locations, delete them, or add files to Quarantine on your own. All files that turn out not to be infected upon completion of the virus scan are automatically restored to their former locations.

The Backup Storage holds copies of files disinfected and deleted by the program. These copies are created in case you need to restore the files or information on their infection. The backup copies of the files are also stored in an encrypted form to avoid further infections. You can restore a file from Backup to the original location and delete the copy.