KASPERSKY Anti-Virus 2012 User Manual

Kaspersky Anti-Virus 2012

User Guide

APPLICATION VERSION: 12.0

2

Dear User!

Thank you for choosing our product. We hope that you will find this documentation useful and that it will provide answers
to most of your questions that may arise.

Warning! This document is the property of Kaspersky Lab ZAO (herein also referred to as Kaspersky Lab): all rights to
this document are reserved by the copyright laws of the Russian Federation and by international treaties. Illegal
reproduction and distribution of this document or parts hereof will result in civil, administrative or criminal liability in
accordance with applicable law.

Any type of reproduction or distribution of any materials, including translations, is allowed only with the written permission
of Kaspersky Lab.

This document and related graphic images can be used exclusively for informational, non-commercial or personal use.

This document may be amended without prior notification. The latest version of this document can be found on the
Kaspersky Lab website at http://www.kaspersky.com/docs.

Kaspersky Lab assumes no liability for the content, quality, relevance, or accuracy of any materials used in this
document the rights to which are held by third parties, or for any potential damages associated with the use of such
documents.

This document uses registered trademarks and service marks which are the property of their respective owners.

Document revision date: 4/19/2011

© 1997-2011 Kaspersky Lab ZAO. All Rights Reserved.

http://www.kaspersky.com

http://support.kaspersky.com

3

CONTENT

ABOUT THIS GUIDE ..................................................................................................................................................... 8

In this guide .............................................................................................................................................................. 8

Document conventions ........................................................................................................................................... 10

SOURCES OF INFORMATION ABOUT THE APPLICATION ..................................................................................... 11

Sources of information for independent research ................................................................................................... 11

Discussing Kaspersky Lab applications on the Forum ........................................................................................... 12

Contacting the Sales Department ........................................................................................................................... 12

Contacting the Documentation Development Team by email ................................................................................. 12

KASPERSKY ANTI-VIRUS .......................................................................................................................................... 13

What's new ................................................................................................ ................................ ............................. 13

Distribution kit ......................................................................................................................................................... 13

Service for registered users .................................................................................................................................... 14

Hardware and software requirements ..................................................................................................................... 14

INSTALLING AND REMOVING THE APPLICATION .................................................................................................. 16

Standard installation procedure .............................................................................................................................. 16

Step 1. Searching for a newer version of the application .................................................................................. 17

Step 2. Making sure the system meets the installation requirements ............................................................... 17

Step 3. Selecting installation type ..................................................................................................................... 18

Step 4. Reviewing the license agreement ......................................................................................................... 18

Step 5. Kaspersky Security Network Data Collection Statement ...................................................................... 18

Step 6. Searching for incompatible applications ............................................................................................... 18

Step 7. Selecting the destination folder ............................................................................................................. 19

Step 8. Preparing for installation ....................................................................................................................... 19

Step 9. Installing ............................................................................................................................................... 20

Step 10. Finishing the installation ..................................................................................................................... 20

Step 11. Activating the application .................................................................................................................... 20

Step 12. Registering a user............................................................................................................................... 20

Step 13. Completing the activation ................................................................................................................... 21

Updating the previous version of Kaspersky Anti-Virus .......................................................................................... 21

Step 1. Searching for a newer version of the application .................................................................................. 22

Step 2. Making sure the system meets the installation requirements ............................................................... 22

Step 3. Selecting installation type ..................................................................................................................... 22

Step 4. Reviewing the license agreement ......................................................................................................... 22

Step 5. Kaspersky Security Network Data Collection Statement ...................................................................... 23

Step 6. Searching for incompatible applications ............................................................................................... 23

Step 7. Selecting the destination folder ............................................................................................................. 23

Step 8. Preparing for installation ....................................................................................................................... 24

Step 9. Installing ............................................................................................................................................... 24

Step 10. Wizard completion .............................................................................................................................. 24

Non-standard installation scenarios ........................................................................................................................ 25

Getting started ........................................................................................................................................................ 25

Removing the application ....................................................................................................................................... 25

Step 1. Saving data for reuse............................................................................................................................ 26

Step 2. Confirmation of application removal...................................................................................................... 26

U S E R G U I DE

4

Step 3. Removing the application. Completing removal .................................................................................... 26

LICENSING THE APPLICATION ................................................................................................................................. 27

About the End User License Agreement ................................................................................................................ 27

About data provision ............................................................................................................................................... 27

About the license .................................................................................................................................................... 27

About the activation code ....................................................................................................................................... 28

APPLICATION INTERFACE ........................................................................................................................................ 29

The notification area icon........................................................................................................................................ 29

The context menu ................................................................................................................................................... 30

The Kaspersky Anti-Virus main window ................................................................................................................. 31

Notification windows and pop-up messages ........................................................................................................... 32

The application settings window ............................................................................................................................. 34

The Kaspersky Gadget ........................................................................................................................................... 35

News Agent ............................................................................................................................................................ 36

STARTING AND STOPPING THE APPLICATION ...................................................................................................... 37

Enabling and disabling automatic launch ............................................................................................................... 37

Launching and closing the application manually ..................................................................................................... 37

MANAGING THE COMPUTER PROTECTION ............................................................................................................ 38

Diagnostics and elimination of problems in your computer protection .................................................................... 38

Enabling and disabling the protection ..................................................................................................................... 39

Pausing and resuming protection ........................................................................................................................... 40

SOLVING TYPICAL TASKS ......................................................................................................................................... 42

How to activate the application ............................................................................................................................... 42

How to purchase or renew a license ....................................................................................................................... 43

What to do when application notifications appear ................................................................................................... 44

How to update application databases and modules ............................................................................................... 44

How to scan critical areas of your computer for viruses ......................................................................................... 45

How to scan a file, folder, disk, or another object for viruses .................................................................................. 45

How to perform a full scan of your computer for viruses ................................................................ ......................... 47

How to scan your computer for vulnerabilities ........................................................................................................ 47

How to protect your personal data against theft ..................................................................................................... 47

Protection against phishing ............................................................................................................................... 48

Protection against data interception at the keyboard ........................................................................................ 48

What to do if you suspect an object is infected with a virus .................................................................................... 49

What to do if you suspect your computer is infected .............................................................................................. 50

How to restore a file that has been deleted or disinfected by the application ......................................................... 51

How to create and use a Rescue Disk .................................................................................................................... 52

Creating a Rescue Disk .................................................................................................................................... 52

Starting the computer from the Rescue Disk..................................................................................................... 54

How to view the report on the application's operation ............................................................................................. 55

How to restore default application settings ............................................................................................................. 55

How to transfer settings to Kaspersky Anti-Virus installed on another computer .................................................... 56

How to switch from Kaspersky Anti-Virus to Kaspersky Internet Security .............................................................. 57

Switching to the commercial version ................................................................................................................. 57

Temporary switching to the trial version ............................................................................................................ 58

How to use the Kaspersky Gadget ......................................................................................................................... 59

How to know the reputation of an application ......................................................................................................... 60

C O N T E N T

5

ADVANCED APPLICATION SETTINGS ...................................................................................................................... 62

General protection settings ..................................................................................................................................... 62

Restricting access to Kaspersky Anti-Virus ....................................................................................................... 63

Selecting a protection mode.............................................................................................................................. 63

Scan ....................................................................................................................................................................... 64

Virus scan ......................................................................................................................................................... 64

Vulnerability Scan ............................................................................................................................................. 72

Managing scan tasks. Task Manager ............................................................................................................... 72

Update .................................................................................................................................................................... 72

Selecting an update source............................................................................................................................... 73

Creating the update startup schedule ............................................................................................................... 75

Rolling back the last update .............................................................................................................................. 76

Running updates under a different user account .............................................................................................. 76

Using a proxy server ......................................................................................................................................... 76

File Anti-Virus ......................................................................................................................................................... 77

Enabling and disabling File Anti-Virus ............................................................................................................... 78

Automatically pausing File Anti-Virus ................................................................................................................ 78

Creating the protection scope of File Anti-Virus ................................................................................................ 78

Changing and restoring the file security level.................................................................................................... 80

Selecting file scan mode ................................................................................................................................... 80

Using heuristic analysis when working with File Anti-Virus ............................................................................... 80

Selecting file scan technology ........................................................................................................................... 81

Changing the action to take on infected files..................................................................................................... 81

Scan of compound files by File Anti-Virus ................................ ......................................................................... 81

Optimizing file scan ........................................................................................................................................... 82

Mail Anti-Virus ........................................................................................................................................................ 83

Enabling and disabling Mail Anti-Virus .............................................................................................................. 84

Creating the protection scope of Mail Anti-Virus ............................................................................................... 84

Changing and restoring the email security level ................................................................................................ 85

Using heuristic analysis when working with Mail Anti-Virus .............................................................................. 85

Changing the action to take on infected email messages ................................................................ ................. 86

Filtering attachments in email messages .......................................................................................................... 86

Scan of compound files by Mail Anti-Virus ........................................................................................................ 86

Email scanning in Microsoft Office Outlook ....................................................................................................... 87

Email scanning in The Bat! ............................................................................................................................... 87

Web Anti-Virus ........................................................................................................................................................ 88

Enabling and disabling Web Anti-Virus ................................................................................................ ............. 89

Changing and restoring the web traffic security level ........................................................................................ 89

Changing the action to take on dangerous objects from web traffic .................................................................. 90

Checking URLs on web pages .......................................................................................................................... 90

Using heuristic analysis when working with Web Anti-Virus ............................................................................. 92

Blocking dangerous scripts ............................................................................................................................... 92

Scan optimization .............................................................................................................................................. 93

Creating a list of trusted addresses ................................................................................................................... 93

IM Anti-Virus ........................................................................................................................................................... 94

Enabling and disabling IM Anti-Virus ................................................................................................................ 94

Creating the protection scope of IM Anti-Virus .................................................................................................. 95

Checking URLs in messages from IM clients .................................................................................................... 95

U S E R G U I DE

6

Using heuristic analysis when working with IM Anti-Virus ................................................................................. 95

Proactive Defense .................................................................................................................................................. 95

Enabling and disabling Proactive Defense ................................ ........................................................................ 96

Creating a group of trusted applications ........................................................................................................... 96

Using the dangerous activity list ........................................................................................................................ 97

Changing the action to be taken on applications' dangerous activity ................................................................ 97

System Watcher ..................................................................................................................................................... 97

Enabling and disabling System Watcher ........................................................................................................... 98

Using patterns of dangerous activity (BSS)....................................................................................................... 98

Rolling back a malicious program's actions ...................................................................................................... 99

Network protection .................................................................................................................................................. 99

Encrypted connections scan ........................................................................................................................... 100

Configuring the proxy server ........................................................................................................................... 102

Creating a list of monitored ports .................................................................................................................... 102

Trusted zone ......................................................................................................................................................... 103

Creating a list of trusted applications .............................................................................................................. 104

Creating exclusion rules ................................................................ ................................ .................................. 104

Performance and compatibility with other applications ................................................................ ......................... 105

Selecting detectable threat categories ............................................................................................................ 105

Battery saving ................................................................................................................................................. 106

Advanced Disinfection .................................................................................................................................... 106

Distributing computer resources when scanning for viruses ........................................................................... 106

Running tasks in background mode ................................................................................................................ 107

Full-screen mode. Gaming Profile ................................................................................................................... 108

Kaspersky Anti-Virus self-defense ........................................................................................................................ 108

Enabling and disabling self-defense ............................................................................................................... 109

Protection against external control .................................................................................................................. 109

Quarantine and Backup ........................................................................................................................................ 109

Storing files in Quarantine and Backup ........................................................................................................... 110

Working with quarantined files ........................................................................................................................ 110

Working with objects in Backup ...................................................................................................................... 112

Scanning files in Quarantine after an update .................................................................................................. 112

Additional tools for better protection of your computer ......................................................................................... 113

Privacy Cleaner ............................................................................................................................................... 113

Configuring a browser for safe work ............................................................................................................... 115

Rolling back changes made by Wizards ......................................................................................................... 116

Reports ................................................................................................................................................................. 117

Creating a report for the selected protection component ................................................................................ 117

Data filtering .................................................................................................................................................... 118

Events search ................................................................................................................................................. 119

Saving a report to file ...................................................................................................................................... 119

Storing reports ................................................................................................................................................ 120

Clearing application reports ............................................................................................................................ 120

Recording non-critical events into the report ................................................................................................... 120

Configuring the notification of report availability .............................................................................................. 121

Application appearance. Managing active interface elements .............................................................................. 121

Translucence of notification windows .............................................................................................................. 121

Animation of the application icon in the notification area ................................................................................ 121

Text on Microsoft Windows logon screen........................................................................................................ 122

C O N T E N T

7

Notifications .......................................................................................................................................................... 122

Enabling and disabling notifications ................................................................................................................ 122

Configuring the notification method ................................................................................................................. 123

Disabling news delivery .................................................................................................................................. 123

Kaspersky Security Network ................................................................................................................................. 124

Enabling and disabling participation in Kaspersky Security Network .............................................................. 124

Verifying connection to Kaspersky Security Network ...................................................................................... 124

TESTING THE APPLICATION'S OPERATION .......................................................................................................... 126

About the test file EICAR ...................................................................................................................................... 126

Testing the application's functioning using the test file EICAR ............................................................................. 126

About the types of the test file EICAR .................................................................................................................. 127

CONTACTING THE TECHNICAL SUPPORT SERVICE ........................................................................................... 129

How to get technical support ................................................................................................................................ 129

Using the trace file and the AVZ script ................................................................................................................. 129

Creating a system state report ........................................................................................................................ 130

Creating a trace file ......................................................................................................................................... 130

Sending data files ........................................................................................................................................... 130

AVZ script execution ....................................................................................................................................... 131

Technical support by phone .................................................................................................................................. 132

Obtaining technical support via My Kaspersky Account ....................................................................................... 132

APPENDIX ................................................................................................................................................................. 134

Working with the application from the command line ............................................................................................ 134

Activating the application ................................................................................................................................ 136

Starting the application ................................................................................................................................... 136

Stopping the application ................................................................................................ .................................. 136

Managing application components and tasks ................................................................................................. 136

Virus scan ....................................................................................................................................................... 138

Updating the application ................................................................................................................................. 140

Rolling back the last update ............................................................................................................................ 141

Exporting protection settings ........................................................................................................................... 141

Importing protection settings ........................................................................................................................... 141

Creating a trace file ......................................................................................................................................... 142

Viewing Help ................................................................................................................................................... 142

Return codes of the command line ................................................................................................................. 143

Kaspersky Anti-Virus notifications list ................................................................................................................... 144

Notifications in any protection mode ............................................................................................................... 144

Notifications in interactive protection mode ..................................................................................................... 149

GLOSSARY ............................................................................................................................................................... 157

KASPERSKY LAB ZAO ............................................................................................................................................. 166

INFORMATION ABOUT THIRD-PARTY CODE ........................................................................................................ 167

INDEX ........................................................................................................................................................................ 168

8

ABOUT THIS GUIDE

IN THIS SECTION:

In this guide ....................................................................................................................................................................... 8

Document conventions .................................................................................................................................................... 10

Greetings from Kaspersky Lab specialists!

This guide contains information about how to install, configure, and use Kaspersky Anti-Virus. We hope that information
provided by this guide, will help you work with the application with the maximum of ease.

This guide is intended to:

help you install, activate, and use Kaspersky Anti-Virus;

ensure a quick search of information on application-related issues;

describe additional sources of information about the application and ways of cooperating with the Technical

Support Service.

For proper use of the application, you should have basic computer skills: be acquainted with the interface of the
operating system that you use, handle the main techniques specific for that system, know how to work with email and the
Internet.

IN THIS GUIDE

This guide comprises the following sections.

Sources of information about the application

This section describes sources of information about the application and lists websites that you can use to discuss the
application's operation.

Kaspersky Anti-Virus

This section describes the application's features and provides brief information about the application's functions and
components. You will learn what items are included in the distribution kit, and what services are available for registered
users of the application. This section provides information about software and hardware requirements that a computer
should meet to allow a user to install the application on it.

Installing and removing the application

This section provides information about how to install the application on a computer and how to uninstall it.

Licensing the application

This section provides information about general terms related to the application activation. Read this section to learn
more about the purpose of the license agreement, license types, ways of activating the application, and the license
renewal.

A B O U T T H I S G U I D E

9

Application interface

This section provides information about basic elements of the graphic interface of the application: application icon and
application icon context menu, main window, settings window, and notification windows.

Starting and stopping the application

This section contains information on starting and shutting down the application.

Managing the computer protection

This section provides information about how to detect threats to the computer's security and how to configure the security
level. Read this section to learn more about how to enable, disable, and pause the protection when using the application.

Solving typical tasks

This section provides information about how to resolve the most common issues related to protection of the computer
using the application.

Advanced application settings

This section provides detailed information about how to configure each of the application components.

Testing the application's operation

This section provides information about how to ensure that the application detects viruses and their modifications and
performs the correct actions on them.

Contacting the Technical Support Service

This section provides information about how to contact the Technical Support Service at Kaspersky Lab.

Appendix

This section provides information that complements the document text.

Glossary

This section contains a list of terms mentioned in the document and their respective definitions.

Kaspersky Lab ZAO

This section provides information about Kaspersky Lab.

Information about third-party code

This section provides information about the third-party code used in the application.

Index

This section allows you to quickly find required information within the document.

U S E R G U I DE

10

DOCUMENT CONVENTIONS

SAMPLE TEXT

DOCUMENT CONVENTIONS DESCRIPTION

Note that...

Warnings are highlighted with red color and boxed.
Warnings provide information about probable unwanted actions that may lead to

data losses or failures in the computer's operation.

It is recommended to use...

Notes are boxed.
Notes may contain useful hints, recommendations, specific values, or important

particular cases in the application's operation.

Example:

...

Examples are set out on a yellow background under the heading "Example".

Update means...
The Databases are out of date event

occurs.

The following semantic elements are italicized in the text:

new terms;
names of application statuses and events.

Press ENTER.
Press ALT+F4.

Names of keyboard keys appear in a bold typeface and are capitalized.
Names of keys connected by a + (plus) sign indicate the use of a key

combination. Those keys should be pressed simultaneously.

Click the Enable button.

Names of application interface elements, such as entry fields, menu items, and
buttons, are set off in bold.

To configure a task schedule:

Introductory phrases of instructions are italicized and accompanied by the arrow
sign.

Enter help in the command line.
The following message then appears:

Specify the date in dd:mm:yy

format.

The following types of text content are set off with a special font:

text in the command line;
text of messages displayed on the screen by the application;
data that the user should enter.

<IP address of your
computer>

Variables are enclosed in angle brackets. Instead of a variable, the
corresponding value should be inserted, with angle brackets omitted.

The text herein is accompanied by semantic elements that should be given particular attention – warnings, hints,
examples.

Document conventions are used to highlight semantic elements. Document conventions and examples of their use are
shown in the table below.

Table 1. Document conventions

11

SOURCES OF INFORMATION ABOUT THE

IN THIS SECTION:

Sources of information for independent research ............................................................................................................ 11

Discussing Kaspersky Lab applications on the Forum .................................................................................................... 12

Contacting the Sales Department ................................................................................................................................... 12

Contacting the Documentation Development Team by email .......................................................................................... 12

APPLICATION

This section describes sources of information about the application and lists websites that you can use to discuss the
application's operation.

You can select the most suitable information source, depending on the issue's level of importance and urgency.

SOURCES OF INFORMATION FOR INDEPENDENT RESEARCH

You can use the following sources to find information about the application:

the application page on the Kaspersky Lab website;

the application page on the Technical Support Service website (Knowledge Base);

online help;

documentation.

If you cannot solve an issue on your own, we recommend that you contact the Technical Support Service at Kaspersky
Lab (see section "Technical support by phone" on page 132).

To use information sources on the Kaspersky Lab website, an Internet connection should be established.

The application page on the Kaspersky Lab website

The Kaspersky Lab website features an individual page for each application.

On such a page (http://www.kaspersky.com/kaspersky_anti-virus), you can view general information about an
application, its functions and features.

The page http://www.kaspersky.com features a URL to the eStore. There you can purchase or renew the application.

The application page on the Technical Support Service website (Knowledge Base)

Knowledge Base is a section of the Technical Support Service website that provides recommendations on how to work
with Kaspersky Lab applications. Knowledge Base comprises reference articles grouped by topics.

U S E R G U I DE

12

On the page of the application in the Knowledge Base (http://support.kaspersky.com/kav2012), you can read articles that
provide useful information, recommendations, and answers to frequently asked questions on how to purchase, install,
and use the application.

Articles may provide answers to questions that are out of scope of Kaspersky Anti-Virus, being related to other
Kaspersky Lab applications. They also may contain news from the Technical Support Service.

Online help

The online help of the application comprises help files.

The context help provides information about each window of the application, listing and describing the corresponding
settings and a list of tasks.

The full help provides detailed information about how to manage the computer's protection using the application.

Documentation

The application user guide provides information about how to install, activate, and configure the application, as well as
application operation data. The document also describes the application interface and provides ways of solving typical
user tasks while working with the application.

DISCUSSING KASPERSKY LAB APPLICATIONS

ON THE FORUM

If your question does not require an urgent answer, you can discuss it with Kaspersky Lab specialists and other users on
our Forum (http://forum.kaspersky.com).

In this forum you can view existing topics, leave your comments, create new topics.

CONTACTING THE SALES DEPARTMENT

If you have any questions on how to select, purchase, or renew the application, you can contact our Sales Department
specialists in one of the following ways:

By calling our HQ office in Moscow by phone (http://www.kaspersky.com/contacts).

By sending a message with your question to [e-mail].

The service is provided in Russian and English.

CONTACTING THE DOCUMENTATION DEVELOPMENT TEAM BY EMAIL

To contact the Documentation Development Team, send an email to [e-mail]. Please use
"Kaspersky Help Feedback: Kaspersky Anti-Virus" as the subject line in your message.

13

KASPERSKY ANTI-VIRUS

IN THIS SECTION:

What's new ................................ ................................................................ ...................................................................... 13

Distribution kit .................................................................................................................................................................. 13

Service for registered users ............................................................................................................................................ 14

Hardware and software requirements ............................................................................................................................. 14

This section describes the application's features and provides brief information about the application's functions and
components. You will learn what items are included in the distribution kit, and what services are available for registered
users of the application. This section provides information about software and hardware requirements that a computer
should meet to allow a user to install the application on it.

WHAT'S NEW

Kaspersky Anti-Virus provides the following new features:

The improved interface of the main window of Kaspersky Anti-Virus ensures quick access to the application's

functions.

The logic of operations with Quarantine and Backup (see page 109) has been improved: now they are

represented on two separate tabs, each of them with its respective unique scope.

The Task Manager has been added for an easy task management in Kaspersky Anti-Virus (see section

"Managing scan tasks. Task Manager" on page 72).

Participation in the Kaspersky Security Network (see page 124) allows us to identify the reputation of

applications and websites based on data received from users from all over the world.

When Web Anti-Virus is enabled, you can separately enable the heuristic analysis to check web pages for

phishing (see section "Using heuristic analysis when working with Web Anti-Virus" on page 92). When checking
pages for phishing, the heuristic analysis will be applied regardless of whether it has been enabled for Web Anti­Virus.

The appearance of Kaspersky Gadget has been redesigned (see page 35).

DISTRIBUTION KIT

You can purchase the application in one of the following ways:

Boxed. Distributed via stores of our partners.

At the online store. Distributed at online stores of Kaspersky Lab (for example, http://www.kaspersky.com,

section eStore) or via partner companies.

U S E R G U I DE

14

If you purchase the boxed version of the application, the distribution kit contains the following items:

sealed envelope with the setup CD that contains application files and documentation files;

brief User Guide with an activation code;

license agreement that stipulates the terms, on which you can use the application.

The content of the distribution kit may differ depending on the region, in which the application is distributed.

If you purchase Kaspersky Anti-Virus at an online store, you copy the application from the website of the store.
Information required for the application activation, will be sent to you by email on payment.

For more details on ways of purchasing and the distribution kit, contact the Sales Department.

SERVICE FOR REGISTERED USERS

On purchasing a user license for the application, you become a registered user of Kaspersky Lab applications and can
benefit from the following services during the entire validity term of the license:

updating databases and providing new versions of the application;

consulting by phone and by email on issues related to installation, configuration, and use of the application;

notifying you of releases of new applications by Kaspersky Lab and new viruses. To use this service, you should

be subscribed to the news delivery from Kaspersky Lab on the Technical Support Service website.

No consulting services are provided on issues related to the functioning of operating systems, third-party
software and technologies.

HARDWARE AND SOFTWARE REQUIREMENTS

To ensure the proper functioning of Kaspersky Anti-Virus, your computer should meet the following requirements:

General requirements:

480 MB free disk space on the hard drive (including 380 MB on the system drive).

CD / DVD-ROM (for installing Kaspersky Anti-Virus from a distribution CD).

Internet access (for the application activation and for updating databases and software modules).

Microsoft Internet Explorer 6.0 or higher.

Microsoft Windows Installer 2.0.

Requirements for Microsoft Windows XP Home Edition (Service Pack 2 or higher), Microsoft Windows XP Professional
(Service Pack 2 or higher), and Microsoft Windows XP Professional x64 Edition (Service Pack 2 or higher):

Intel Pentium 800 MHz 32-bit (x86) / 64-bit (x64) processor or higher (or a compatible equivalent);

512 MB free RAM.

K A S P E R S K Y A N TI -V I R U S

15

Requirements for Microsoft Windows Vista Home Basic, Microsoft Windows Vista Home Premium, Microsoft Windows
Vista Business, Microsoft Windows Vista Enterprise, Microsoft Windows Vista Ultimate, Microsoft Windows 7 Starter,
Microsoft Windows 7 Home Basic, Microsoft Windows 7 Home Premium, Microsoft Windows 7 Professional, and
Microsoft Windows 7 Ultimate:

Intel Pentium 1 GHz 32-bit (x86) / 64-bit (x64) processor or higher (or a compatible equivalent).

1 GB free RAM (for 32-bit operating systems); 2 GB free RAM (for 64-bit operating systems).

Requirements for netbooks:

Intel Atom 1.6 GHz processor or a compatible equivalent.

Intel GMA950 video card with at least 64 MB of video RAM (or a compatible equivalent).

Screen size no less than 10.1".

16

INSTALLING AND REMOVING THE

IN THIS SECTION:

Standard installation procedure ....................................................................................................................................... 16

Updating the previous version of Kaspersky Anti-Virus ................................ ................................................................... 21

Non-standard installation scenarios ................................................................................................................................ 25

Getting started ................................................................................................................................................................. 25

Removing the application ................................................................................................................................................ 25

APPLICATION

This section provides information about how to install the application on a computer and how to uninstall it.

STANDARD INSTALLATION PROCEDURE

Kaspersky Anti-Virus will be installed on your computer in an interactive mode using the Setup Wizard.
The Wizard consists of a series of screens (steps) that you can navigate through using the Back and Next buttons. To

close the Wizard once it has completed its task, click the Finish button. To stop the Wizard at any stage, click the
Cancel button.

If the application protects more than one computer (the maximum number of computers depends on your license), it will
be installed in the same manner on all computers. Note that in this case, according to the license agreement, the license
term begins from the date of the first activation. When you activate the application on the second computers and so on,
the license validity term decreases for the amount of time that has elapsed since the first activation. So, the license
validity term will expire simultaneously for all installed copies of the application.

To install Kaspersky Anti-Virus on your computer,

run the setup file (the file with an EXE extension) from the CD with the product.

Installation of Kaspersky Anti-Virus from a setup file downloaded online is identical to installation from the installation CD.

I N S T A L L I N G A N D R E M O V I N G T H E A P P L I C A T I O N

17

IN THIS SECTION:

Step 1. Searching for a newer version of the application ................................................................................................ 17

Step 2. Making sure the system meets the installation requirements .............................................................................. 17

Step 3. Selecting installation type ................................................................................................................................... 18

Step 4. Reviewing the license agreement ....................................................................................................................... 18

Step 5. Kaspersky Security Network Data Collection Statement ..................................................................................... 18

Step 6. Searching for incompatible applications .............................................................................................................. 18

Step 7. Selecting the destination folder ........................................................................................................................... 19

Step 8. Preparing for installation ..................................................................................................................................... 19

Step 9. Installing .............................................................................................................................................................. 20

Step 10. Finishing the installation .................................................................................................................................... 20

Step 11. Activating the application .................................................................................................................................. 20

Step 12. Registering a user ............................................................................................................................................. 20

Step 13. Completing the activation .................................................................................................................................. 21

STEP 1. SEARCHING FOR A NEWER VERSION OF THE APPLICATION

Before setup, the Setup Wizard checks the Kaspersky Lab update servers for a newer version of Kaspersky Anti-Virus.

If it does not find a newer product version on the Kaspersky Lab update servers, the Setup Wizard for the current version
will be started.

If the update servers offer a newer version of Kaspersky Anti-Virus, you will see a prompt to download and install it on
the computer. It is recommended that you install the new version of the application, because newer versions include
further enhancements that ensure you have the most reliable protection for your computer. If you cancel the new version
download, the Setup Wizard for the current version will be started. If you decide to install the newer version, product
distribution files will be downloaded to your computer and the Setup Wizard for that new version will be started
automatically. For a further description of the installation procedure for the newer version, please refer to the
corresponding documentation.

STEP 2. MAKING SURE THE SYSTEM MEETS THE INSTALLATION

REQUIREMENTS

Before installation of Kaspersky Anti-Virus on your computer, the installer checks the operating system and service
packs to make sure they meet the software requirements for product installation (see section "Hardware and software
requirements" on page 14). In addition, the installer checks for the presence of required software and the credentials
necessary to install applications. If any of the above-listed requirements is not met, a notification to that effect will be
displayed on the screen.

If the computer meets all the requirements, the Wizard searches for Kaspersky Lab applications which, when run
together with Kaspersky Anti-Virus, may result in conflicts. If such applications are found, you will be asked to remove
them manually.

U S E R G U I DE

18

If an earlier version of Kaspersky Anti-Virus or Kaspersky Internet Security is found, all data that can be used by
Kaspersky Anti-Virus 2012 (for example, activation information or application settings) will be saved and used when
installing the new application, while the one installed earlier will be automatically removed.

STEP 3. SELECTING INSTALLATION TYPE

At this stage, you can choose the most suitable type of Kaspersky Anti-Virus installation:

Standard installation. If you choose this option (the Change installation settings box is unchecked), the

application will be fully installed on your computer with the protection settings recommended by Kaspersky Lab
experts.

Custom installation. In this case (the Change installation settings box is checked), you will be asked to specify

the destination folder into which the application should be installed (see section "Step 7. Selecting the
destination folder" on page 19) and disable the installation process protection, if necessary (see section "Step 8.
Preparing for installation" on page 19).

To proceed with the installation, click the Next button.

STEP 4. REVIEWING THE LICENSE AGREEMENT

At this step, you should review the license agreement between you and Kaspersky Lab.
Read the agreement carefully and, if you accept all its terms, click the I agree button. The installation will continue.

If you cannot accept the license agreement, cancel the application installation by clicking the Cancel button.

STEP 5. KASPERSKY SECURITY NETWORK DATA COLLECTION STATEMENT

At this stage, you will be invited to participate in the Kaspersky Security Network. Participation in the program involves
sending information about new threats detected on your computer, running applications, and downloaded signed
applications, as well as your system information, to Kaspersky Lab. We guarantee that none of your personal data will be
sent.

Review the Kaspersky Security Network Data Collection Statement. To read the complete version of the Statement, click
the Full KSN agreement button. If you agree with all terms of the Statement, check the I accept the terms of
participation in Kaspersky Security Network box in the Wizard window.

Click the Next button if you have selected the custom installation (see section "Step 3. Selecting installation type" on
page 18). If performing the standard installation, click the Install button. The installation will continue.

STEP 6. SEARCHING FOR INCOMPATIBLE APPLICATIONS

At this step, the application checks whether any applications incompatible with Kaspersky Anti-Virus are installed on your
computer.

If no such applications are found, the Wizard automatically proceeds to the next step.

If any incompatible applications are detected, they are displayed in a list on the screen, and you will be prompted to
remove them. Applications that Kaspersky Anti-Virus cannot remove automatically should be removed manually. When
removing incompatible applications, you will need to reboot your operating system, after which installation of Kaspersky
Anti-Virus will continue automatically.

To proceed with the installation, click the Next button.

I N S T A L L I N G A N D R E M O V I N G T H E A P P L I C A T I O N

19

STEP 7. SELECTING THE DESTINATION FOLDER

This step of the Setup Wizard is only available if the custom installation is selected (see section "Step 3. Selecting
installation type" on page 18). When performing a standard installation, this step is skipped and the application is
installed to the default folder.

At this stage you are asked to choose the folder to which Kaspersky Anti-Virus will be installed. The following path is set
by default:

<disk>\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2012 – for 32-bit systems;

<disk>\Program Files (х86)\Kaspersky Lab\Kaspersky Anti-Virus 2012 – for 64-bit systems.

To install Kaspersky Anti-Virus to a different folder, specify the path to the desired folder in the input field or click the
Browse button and choose a folder in the window that opens.

Keep in mind the following restrictions:

The application cannot be installed on network or removable drives, or on virtual drives (those created using the

SUBST command).

We recommend that you avoid installing the application in a folder that already contains files or other folders,

because that folder will then become inaccessible for editing.

The path to the installation folder cannot be longer than 160 characters or contain the special characters

/, ?, :, *, ", >, < or |.

To find out if there is enough disk space on your computer to install the application, click the Disk Usage button. In the
window that opens you can view the disk space information. To close the window, click OK.

To proceed with the installation, click the Next button in the Wizard window.

STEP 8. PREPARING FOR INSTALLATION

This step of the Setup Wizard is only available if the custom installation is selected (see section "Step 3. Selecting
installation type" on page 18). For the standard installation, this step is skipped.

Since your computer may be infected with malicious programs that may impact the installation of Kaspersky Anti-Virus,
the installation process should be protected.

By default, installation process protection is enabled – the Protect the installation process box is checked in the
Wizard window.

You are advised to uncheck this box if the application cannot be installed (for example, when performing remote
installation using Windows Remote Desktop). Enabled protection may be the reason.

In this case, you should interrupt installation, restart it, check the Change installation settings box at the Select
installation type step (see section "Step 3. Selecting installation type" on page 18), and when you reach the Preparing for
installation step, uncheck the Protect the installation process box.

To proceed with the installation, click the Install button.

When installing the application on a computer running under Microsoft Windows XP, active network connections are
terminated. The majority of terminated connections are restored after a pause.

U S E R G U I DE

20

STEP 9. INSTALLING

Installation of the application can take some time. Wait for it to finish.

Once the installation is complete, the Wizard will automatically proceed to the next step.

If an installation error occurs, which may be due to malicious programs that prevent anti-virus applications from being
installed on your computer, the Setup Wizard will prompt you to download Kaspersky Virus Removal Tool, a special
utility for neutralizing infections.

If you agree to install the utility, the Setup Wizard downloads it from the Kaspersky Lab servers, after which installation of
the utility starts automatically. If the Wizard cannot download the utility, you will be asked to download it on your own by
clicking the link provided.

After you finish working with the utility, you should delete it and restart the installation of Kaspersky Anti-Virus.

STEP 10. FINISHING THE INSTALLATION

This window of the Wizard informs you of the successful completion of the application installation. To run Kaspersky Anti­Virus, make sure that the Run Kaspersky Anti-Virus box is checked and click the Finish button.

In some cases, you may need to reboot your operating system. If the Run Kaspersky Anti-Virus 2012 box is checked,
the application will be run automatically after you reboot your operating system.

If you unchecked the box before closing the Wizard, you should run the application manually (see section "Launching
and closing the application manually" on page 37).

STEP 11. ACTIVATING THE APPLICATION

Activation is the procedure of activating a license that allows you to use a fully functional version of the application until
the license expires.

You will need an Internet connection to activate the application.

You will be offered the following options for Kaspersky Anti-Virus activation:

Activate commercial version. Select this option and enter the activation code if you have purchased a

commercial version of the application.

If you specify an activation code for Kaspersky Internet Security in the entry field, the procedure of switching to
Kaspersky Internet Security starts after the completion of activation.

Activate trial version. Use this activation option if you want to install the trial version of the application before

making the decision to purchase a commercial version. You will be able to use the fully-functional version of the
application for the duration of a term limited by the license for the trial version of the application. When the
license expires, it cannot be activated for a second time.

STEP 12. REGISTERING A USER

This step is only available when activating the commercial version of the application. When activating the trial version,
this step is skipped.

You need to register in order to be able to contact Kaspersky Lab Technical Support Service in the future.
If you agree to register, specify your registration data in the corresponding fields and click the Next button.

I N S T A L L I N G A N D R E M O V I N G T H E A P P L I C A T I O N

21

IN THIS SECTION:

Step 1. Searching for a newer version of the application ................................................................................................ 22

Step 2. Making sure the system meets the installation requirements .............................................................................. 22

Step 3. Selecting installation type ................................................................................................................................... 22

Step 4. Reviewing the license agreement ....................................................................................................................... 22

Step 5. Kaspersky Security Network Data Collection Statement ..................................................................................... 23

Step 6. Searching for incompatible applications .............................................................................................................. 23

Step 7. Selecting the destination folder ........................................................................................................................... 23

Step 8. Preparing for installation ..................................................................................................................................... 24

Step 9. Installing .............................................................................................................................................................. 24

Step 10. Wizard completion ............................................................................................................................................ 24

STEP 13. COMPLETING THE ACTIVATION

The Wizard informs you that Kaspersky Anti-Virus has been successfully activated. In addition, information about the
license is provided: license type (commercial or trial), date of expiry, and number of hosts for the license.

If you have activated a subscription, information about the subscription status is displayed instead of the license expiry
date.

Click the Finish button to close the Wizard.

UPDATING THE PREVIOUS VERSION OF KASPERSKY ANTI-VIRUS

If Kaspersky Anti-Virus 2010 or 2011 is already installed on your computer, you should update the application to
Kaspersky Anti-Virus 2012. If you have an active license for Kaspersky Anti-Virus 2010 or 2011, you will not have to
activate the application: the Setup Wizard will automatically retrieve the information about your license for Kaspersky
Anti-Virus 2010 or 2011 and use it during the installation process.

Kaspersky Anti-Virus will be installed on your computer in an interactive mode using the Setup Wizard.
The Wizard consists of a series of screens (steps) that you can navigate through using the Back and Next buttons. To

close the Wizard once it has completed its task, click the Finish button. To stop the Wizard at any stage, click the
Cancel button.

If the application protects more than one computer (the maximum number of computers depends on your license), it will
be installed in the same manner on all computers. Note that in this case, according to the license agreement, the license
term begins from the date of the first activation. When you activate the application on the second computers and so on,
the license validity term decreases for the amount of time that has elapsed since the first activation. So, the license
validity term will expire simultaneously for all installed copies of the application.

To install Kaspersky Anti-Virus on your computer,

run the setup file (the file with an EXE extension) from the CD with the product.
Installation of Kaspersky Anti-Virus from a setup file downloaded online is identical to installation from the installation

CD.

U S E R G U I DE

22

STEP 1. SEARCHING FOR A NEWER VERSION OF THE APPLICATION

Before setup, the Setup Wizard checks the Kaspersky Lab update servers for a newer version of Kaspersky Anti-Virus.

If it does not find a newer product version on the Kaspersky Lab update servers, the Setup Wizard for the current version
will be started.

If the update servers offer a newer version of Kaspersky Anti-Virus, you will see a prompt to download and install it on
the computer. It is recommended that you install the new version of the application, because newer versions include
further enhancements that ensure you have the most reliable protection for your computer. If you cancel the new version
download, the Setup Wizard for the current version will be started. If you decide to install the newer version, product
distribution files will be downloaded to your computer and the Setup Wizard for that new version will be started
automatically. For a further description of the installation procedure for the newer version, please refer to the
corresponding documentation.

STEP 2. MAKING SURE THE SYSTEM MEETS THE INSTALLATION

REQUIREMENTS

Before installation of Kaspersky Anti-Virus on your computer, the installer checks the operating system and service
packs to make sure they meet the software requirements for product installation (see section "Hardware and software
requirements" on page 14). In addition, the installer checks for the presence of required software and the credentials
necessary to install applications. If any of the above-listed requirements is not met, a notification to that effect will be
displayed on the screen.

If the computer meets all the requirements, the Wizard searches for Kaspersky Lab applications which, when run
together with Kaspersky Anti-Virus, may result in conflicts. If such applications are found, you will be asked to remove
them manually.

If an earlier version of Kaspersky Anti-Virus or Kaspersky Internet Security is found, all data that can be used by
Kaspersky Anti-Virus 2012 (for example, activation information or application settings) will be saved and used when
installing the new application, while the one installed earlier will be automatically removed.

STEP 3. SELECTING INSTALLATION TYPE

At this stage, you can choose the most suitable type of Kaspersky Anti-Virus installation:

Standard installation. If you choose this option (the Change installation settings box is unchecked), the

application will be fully installed on your computer with the protection settings recommended by Kaspersky Lab
experts.

Custom installation. In this case (the Change installation settings box is checked), you will be asked to specify

the destination folder into which the application should be installed (see section "Step 7. Selecting the
destination folder" on page 19) and disable the installation process protection, if necessary (see section "Step 8.
Preparing for installation" on page 19).

To proceed with the installation, click the Next button.

STEP 4. REVIEWING THE LICENSE AGREEMENT

At this step, you should review the license agreement between you and Kaspersky Lab.
Read the agreement carefully and, if you accept all its terms, click the I agree button. The installation will continue.

If you cannot accept the license agreement, cancel the application installation by clicking the Cancel button.

I N S T A L L I N G A N D R E M O V I N G T H E A P P L I C A T I O N

23

STEP 5. KASPERSKY SECURITY NETWORK DATA COLLECTION STATEMENT

At this stage, you will be invited to participate in the Kaspersky Security Network. Participation in the program involves
sending information about new threats detected on your computer, running applications, and downloaded signed
applications, as well as your system information, to Kaspersky Lab. We guarantee that none of your personal data will be
sent.

Review the Kaspersky Security Network Data Collection Statement. To read the complete version of the Statement, click
the Full KSN agreement button. If you agree with all terms of the Statement, check the I accept the terms of
participation in Kaspersky Security Network box in the Wizard window.

Click the Next button if you have selected the custom installation (see section "Step 3. Selecting installation type" on
page 18). If performing the standard installation, click the Install button. The installation will continue.

STEP 6. SEARCHING FOR INCOMPATIBLE APPLICATIONS

At this step, the application checks whether any applications incompatible with Kaspersky Anti-Virus are installed on your
computer.

If no such applications are found, the Wizard automatically proceeds to the next step.

If any incompatible applications are detected, they are displayed in a list on the screen, and you will be prompted to
remove them. Applications that Kaspersky Anti-Virus cannot remove automatically should be removed manually. When
removing incompatible applications, you will need to reboot your operating system, after which installation of Kaspersky
Anti-Virus will continue automatically.

To proceed with the installation, click the Next button.

STEP 7. SELECTING THE DESTINATION FOLDER

This step of the Setup Wizard is only available if the custom installation is selected (see section "Step 3. Selecting
installation type" on page 18). When performing a standard installation, this step is skipped and the application is
installed to the default folder.

At this stage you are asked to choose the folder to which Kaspersky Anti-Virus will be installed. The following path is set
by default:

<disk>\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2012 – for 32-bit systems;

<disk>\Program Files (х86)\Kaspersky Lab\Kaspersky Anti-Virus 2012 – for 64-bit systems.

To install Kaspersky Anti-Virus to a different folder, specify the path to the desired folder in the input field or click the
Browse button and choose a folder in the window that opens.

Keep in mind the following restrictions:

The application cannot be installed on network or removable drives, or on virtual drives (those created using the

SUBST command).

We recommend that you avoid installing the application in a folder that already contains files or other folders,

because that folder will then become inaccessible for editing.

The path to the installation folder cannot be longer than 160 characters or contain the special characters

/, ?, :, *, ", >, < or |.

U S E R G U I DE

24

To find out if there is enough disk space on your computer to install the application, click the Disk Usage button. In the
window that opens you can view the disk space information. To close the window, click OK.

To proceed with the installation, click the Next button in the Wizard window.

STEP 8. PREPARING FOR INSTALLATION

This step of the Setup Wizard is only available if the custom installation is selected (see section "Step 3. Selecting
installation type" on page 18). For the standard installation, this step is skipped.

Since your computer may be infected with malicious programs that may impact the installation of Kaspersky Anti-Virus,
the installation process should be protected.

By default, installation process protection is enabled – the Protect the installation process box is checked in the
Wizard window.

You are advised to uncheck this box if the application cannot be installed (for example, when performing remote
installation using Windows Remote Desktop). Enabled protection may be the reason.

In this case, you should interrupt installation, restart it, check the Change installation settings box at the Select
installation type step (see section "Step 3. Selecting installation type" on page 18), and when you reach the Preparing for
installation step, uncheck the Protect the installation process box.

To proceed with the installation, click the Install button.

When installing the application on a computer running under Microsoft Windows XP, active network connections are
terminated. The majority of terminated connections are restored after a pause.

STEP 9. INSTALLING

Installation of the application can take some time. Wait for it to finish.

Once the installation is complete, the Wizard will automatically proceed to the next step.

If an installation error occurs, which may be due to malicious programs that prevent anti-virus applications from being
installed on your computer, the Setup Wizard will prompt you to download Kaspersky Virus Removal Tool, a special
utility for neutralizing infections.

If you agree to install the utility, the Setup Wizard downloads it from the Kaspersky Lab servers, after which installation of
the utility starts automatically. If the Wizard cannot download the utility, you will be asked to download it on your own by
clicking the link provided.

After you finish working with the utility, you should delete it and restart the installation of Kaspersky Anti-Virus.

STEP 10. WIZARD COMPLETION

This window of the Wizard informs you of the successful completion of the application installation. To run Kaspersky Anti­Virus, make sure that the Run Kaspersky Anti-Virus box is checked and click the Finish button.

In some cases, you may need to reboot your operating system. If the Run Kaspersky Anti-Virus 2012 box is checked,
the application will be run automatically after you reboot your operating system.

If you unchecked the box before closing the Wizard, you should run the application manually (see section "Launching
and closing the application manually" on page 37).

I N S T A L L I N G A N D R E M O V I N G T H E A P P L I C A T I O N

25

NON-STANDARD INSTALLATION SCENARIOS

This section describes application installation scenarios which differ from those of standard installation or update from
the previous version.

Installing Kaspersky Anti-Virus and activating later using a Kaspersky Internet Security activation
code

If, when installing Kaspersky Anti-Virus, at the Activating the application step, you enter a Kaspersky Internet Security
activation code, the upgrade process is launched then, which switches Kaspersky Anti-Virus to Kaspersky Internet
Security.

If, when installing Kaspersky Anti-Virus, at the Activating the application step, you select Activate later and then activate
the installed application with a Kaspersky Internet Security activation code, the upgrade process is also launched then,
which switches Kaspersky Anti-Virus to Kaspersky Internet Security.

Installing Kaspersky Anti-Virus 2012 over Kaspersky Internet Security 2010 or 2011

If you run the installation of Kaspersky Anti-Virus 2012 on a computer on which Kaspersky Internet Security 2010 or
2011 with an active license is already installed, the Installation Wizard detects the information about the license and
prompts you to select one of the following further actions:

Use the current license of Kaspersky Internet Security 2010 or 2011. In this case, the upgrade process is

launched, which results in Kaspersky Internet Security 2012 being installed on your computer. You will be able
to use Kaspersky Internet Security 2012 as long as the license for Kaspersky Internet Security 2010 or 2011
remains valid.

Proceed with installation of Kaspersky Anti-Virus 2012. In this case, the installation procedure will continue

according to the standard scenario, starting from the Activating the application step.

GETTING STARTED

The application is ready to be used after installation. To ensure proper protection of your computer, we recommend
performing the following immediately after installation and configuration:

Update application databases (see section "How to update application databases and modules" on page 44).

Scan your computer for viruses (see section "How to perform a full scan of your computer for viruses" on

page 47) and vulnerabilities (see section "How to scan your computer for vulnerabilities" on page 47).

Check the protection status of your computer and eliminate problems in protection, if necessary.

REMOVING THE APPLICATION

After uninstalling Kaspersky Anti-Virus, your computer and personal data will be unprotected!

Kaspersky Anti-Virus is uninstalled with the help of the Setup Wizard.

To start the Wizard,

in the Start menu, select Programs Kaspersky Anti-Virus 2012 Remove Kaspersky Anti-Virus 2012.

U S E R G U I DE

26

IN THIS SECTION:

Step 1. Saving data for reuse .......................................................................................................................................... 26

Step 2. Confirmation of application removal .................................................................................................................... 26

Step 3. Removing the application. Completing removal .................................................................................................. 26

STEP 1. SAVING DATA FOR REUSE

At this point you can specify which of the data used by the application you want to retain for reuse during the next
installation of the application (e.g., a newer version of the application).

By default, the application is completely removed from the computer.

To save data for reuse:

1. Choose the option Save application objects.

2. Check the boxes for the data types you want to save:

Activation data – data that eliminates the need to activate the application in the future by automatically

using the current license as long as it has not expired by the time of the next installation.

Backup and Quarantine files – files checked by the application and placed into backup storage or

quarantine.

Operational settings of the application – values of the application settings selected during configuration.

iChecker data – files which contain information about the objects that have already been scanned for

viruses.

STEP 2. CONFIRMATION OF APPLICATION REMOVAL

Since removing the application threatens the security of the computer and your personal data, you will be asked to
confirm your intention to remove the application. To do this, click the Remove button.

To stop removal of the application at any time, you can cancel this operation by clicking the Cancel button.

STEP 3. REMOVING THE APPLICATION. COMPLETING REMOVAL

At this step, the Wizard removes the application from your computer. Wait until removal is complete.

When removing the application, you may need to reboot your operating system. If you cancel the immediate reboot,
completion of the removal procedure will be postponed until the operating system is rebooted or the computer is turned
off and then restarted.

27

LICENSING THE APPLICATION

IN THIS SECTION:

About the End User License Agreement ......................................................................................................................... 27

About data provision ....................................................................................................................................................... 27

About the license ............................................................................................................................................................. 27

About the activation code ................................................................................................................................................ 28

This section provides information about general terms related to the application activation. Read this section to learn
more about the purpose of the license agreement, license types, ways of activating the application, and the license
renewal.

ABOUT THE END USER LICENSE AGREEMENT

License Agreement is a legal agreement concluded between you and Kaspersky Lab ZAO that stipulates the terms of
use for the application.

Read through the terms of the License Agreement carefully before you start using the application.

You can read through the terms of the License Agreement when installing the Kaspersky Lab application.

The terms of the License Agreement are regarded as accepted in the following cases:

Upon unsealing the box with the setup CD (only if you have purchased the application in the boxed version or at

a store of any of our partners).

Upon confirming your acceptance of the text of the License Agreement when installing the application.

If you do not accept the terms of the License Agreement, you have to interrupt the application installation.

ABOUT DATA PROVISION

In order to increase the level of real-time protection, accepting the terms of the License Agreement means that you agree
to send information about checksums of processed objects (MD5), information required to determine the reputation of
URLs, and statistical data for anti-spam protection, in automatic mode. Information retrieved does not contain any private
data and other types of confidential information. Information retrieved is protected by Kaspersky Lab pursuant to the
requirements stipulated by the existing legislation. You can obtain more details on the website:

http://support.kaspersky.com.

ABOUT THE LICENSE

License is a time-limited right to use the application provided to you in accordance with the License Agreement. The
license contains a unique code for the activation of your copy of Kaspersky Anti-Virus.

U S E R G U I DE

28

The license grants you the right to benefit the following services:

Using the application on one or several devices.

Number of devices, on which you can use the application, is specified in the License Agreement.

Contacting the Technical Support Service of Kaspersky Lab.

Enjoying the complete set of services provided to you by Kaspersky Lab or its partners during the validity term

of the license (see section "Service for registered users" on page 14).

The scope of services provided and the validity term of the application depend on the type of license used to activate the
application.

The following license types are provided:

Trial – a free license with a limited validity period, offered to allow you to become familiar with the application.

If you copy the application from the website http://www.kaspersky.com, you automatically become the owner of
the trial license. As soon as the license expires, all Kaspersky Anti-Virus features are disabled. To continue
using the application, you should purchase the commercial license.

Commercial – a paid license with a limited validity period, offered upon purchase of the application.

After the expiration of the commercial license, the application keeps on running in limited functionality mode.
You will still be able to scan your computer for viruses and use other application components but only with
databases installed before the license has expired. To continue using Kaspersky Anti-Virus, you should renew
the commercial license.

We recommend that you renew the license on the day the current license expires at the latest in order to ensure
the most comprehensible anti-virus protection of your computer.

ABOUT THE ACTIVATION CODE

Activation code is a code that you receive on purchasing the commercial license for Kaspersky Anti-Virus. This code is
required for activation of the application.

The activation code is an alphanumeric string of Latin characters in xxxxx-xxxxx-xxxxx-xxxxx format.

The activation code is provided in one of the following forms, depending on the way you purchase the application:

If you have purchased the boxed version of Kaspersky Anti-Virus, the activation code is specified in the

documentation or on the box containing the setup CD.

If you have purchased Kaspersky Anti-Virus at an online store, the activation code is sent to the email address

that you have specified when ordering the product.

The validity term of the license starts from the moment you have activated the application. If you have purchased a
license intended for the use of Kaspersky Anti-Virus on several devices, the validity term of the license starts counting
down from the moment you have entered the code on the first of those devices.

If you have lost or accidentally deleted your activation code after the activation, you should send a request to the
Technical Support Service at Kaspersky Lab from My Kaspersky Account (see section "Obtaining technical support via
My Kaspersky Account" on page 132).

On completion of the application activation with a code, you are assigned a client ID. Client ID is the personal ID for a
user, that is needed for receiving technical support by phone or via My Kaspersky Account (see section "Obtaining
technical support via My Kaspersky Account" on page 132).

29

APPLICATION INTERFACE

IN THIS SECTION:

The notification area icon ................................................................................................................................................ 29

The context menu ........................................................................................................................................................... 30

The Kaspersky Anti-Virus main window .......................................................................................................................... 31

Notification windows and pop-up messages ................................................................................................................... 32

The application settings window ...................................................................................................................................... 34

The Kaspersky Gadget.................................................................................................................................................... 35

News Agent ..................................................................................................................................................................... 35

This section provides information about basic elements of the graphic interface of the application: application icon and
application icon context menu, main window, settings window, and notification windows.

THE NOTIFICATION AREA ICON

Immediately after installation of the application, the application icon appears in the Microsoft Windows taskbar notification
area.

In the Microsoft Windows 7 operating system the application icon is hidden by default, but you can display it to access
the application more easily (see the operating system documentation).

The icon has the following purposes:

It is an indicator of the application's operation.

It provides access to the context menu, the main application window and the news window.

Indication of application operation

This icon serves as an indicator of the application's operation. It also indicates the protection status and displays the
basic functions currently being performed by the application:

– scanning an email message;

– scanning web traffic;

– updating databases and application modules;

– computer needs to be restarted to apply updates;

– a failure occurred in the operation of an application component.

U S E R G U I DE

30

The icon is animated by default: for example, during the email message scan, a tiny letter symbol blinks in front of the
application icon; when the update is in progress, you see a revolving globe. Animation can be deactivated (see section
"Translucence of notification windows" on page 121).

When the animation is disabled, the icon may take the following forms:

(colored symbol) – all or some protection components are activated;

(black-and-white symbol) – all protection components are disabled.

Access to the context menu and application windows

Using the icon, you can open the context menu (on page 30) (by right-clicking) and the main application window (see
section "The Kaspersky Anti-Virus main window" on page 31) (by left-clicking).

If news from Kaspersky Lab is available, the icon appears in the Microsoft Windows taskbar notification area. Double­click this icon to open the News Agent (see section "News Agent" on page 35).

THE CONTEXT MENU

Using the context menu, you can quickly take various actions on the application.

The Kaspersky Anti-Virus menu contains the following items:

Task Manager – opens the Task Manager window.

Update – runs the update of application databases and modules.

Virtual Keyboard – displays the Virtual Keyboard.

Kaspersky Anti-Virus – opens the main application window.

Pause protection / Resume protection – temporarily disables / enables real-time protection components. This

menu item does not affect the application's updates or the execution of virus scans.

Settings – opens the application settings window.

About – opens a window containing information about the application.

News – opens the News Agent window (see section "News Agent" on page 35). This menu item is displayed if

there is unread news.

Exit – closes Kaspersky Anti-Virus (when this item is selected, the application is unloaded from the computer’s

RAM).

Figure 1. The context menu

A P P L I C A T I O N I N T E R F A C E

31

If a virus scan or update task is running at the moment that you open the context menu, its name as well as its progress
status (percentage complete) is displayed in the context menu. If you select a menu item with the name of a task, you
can switch to the main window with a report of current task run results.

To open the context menu,

position the cursor over the application icon in the taskbar notification area and right-click it.

In the Microsoft Windows 7 operating system the application icon is hidden by default, but you can display it to access
the application more easily (see the operating system documentation).

THE KASPERSKY ANTI-VIRUS MAIN WINDOW

The main application window contains interface elements that provide access to all the main features of the application.

The main window can be divided into two parts:

The top part of the window provides information about the protection status of your computer.

Figure 2. Top part of the main window

In the bottom part of the window, you can quickly switch to using the main features of the application (for

example, running virus scan tasks, updating databases and software modules).

Figure 3. Bottom part of the main window

If you select any of the sections in the bottom part of the window, the window of the corresponding function opens. You
can return to selecting functions by clicking the Back button in the top left corner of the window.

You can also use the following buttons and links:

Cloud protection – to switch to information about Kaspersky Security Network (on page 124).

Settings – to open the application settings window (see section "The application settings window" on page 34).

Reports – to switch to the application operation reports.

U S E R G U I DE

32

News – to switch to viewing news in the News Agent window (see section "News Agent" on page 35). This link

is displayed after the application receives a piece of news.

Help – to view the Kaspersky Anti-Virus help system.

My Kaspersky Account – to enter the user's personal account on the Technical Support Service website.

Support – to open the window containing information about the system and links to Kaspersky Lab information

resources (Technical Support Service website, forum).

Manage License – to go to Kaspersky Anti-Virus activation and license renewal.

You can open the main application window using one of the following methods:

By left-clicking the application icon in the taskbar notification area.

In the Microsoft Windows 7 operating system the application icon is hidden by default, but you can display it to
access the application more easily (see the operating system documentation).

By selecting Kaspersky Anti-Virus from the context menu (see section "Context menu" on page 30).

By clicking the Kaspersky Anti-Virus icon located in the center of the Kaspersky Gadget (only for Microsoft

Windows Vista and Microsoft Windows 7).

NOTIFICATION WINDOWS AND POP-UP MESSAGES

Kaspersky Anti-Virus notifies you of important events occurring during its operation using notification windows and pop­up messages that appear over the application icon in the taskbar notification area.

A P P L I C A T I O N I N T E R F A C E

33

Notification windows are displayed by Kaspersky Anti-Virus when various actions can be taken in connection with an
event: for example, if a malicious object is detected, you can block access to it, delete it, or try to disinfect it. The
application prompts you to select one of the available actions. A notification window only disappears from the screen if
you select one of the actions.

Figure 4. Notification window

Pop-up messages are displayed by Kaspersky Anti-Virus in order to inform you of events that do not require you to select

an action. Some pop-up messages contain links that you can use to take an action offered by the application: for
example, run a database update or initiate activation of the application). Pop-up messages automatically disappear from
the screen soon after they appear.

Figure 5. Pop-up message

Depending on the importance of an event for the viewpoint of the computer's security, notifications and pop-up
messages are divided into three types:

Critical notifications – inform you of events that have a critical importance for the computer's security, such as

detection of a malicious object or a dangerous activity in the system. Windows of critical notifications and pop­up messages are red-colored.

U S E R G U I DE

34

Important notifications – inform you of events that are potentially important for the computer's security, such as

detection of a potentially infected object or a suspicious activity in the system. Windows of important
notifications and pop-up messages are yellow-colored.

Information notifications – inform you of events that do not have critical importance for the computer's security.

Windows of information notifications and pop-up messages are green-colored.

THE APPLICATION SETTINGS WINDOW

The Kaspersky Anti-Virus settings window (also referred to as "settings window") is designed for configuring the entire
application and separate protection components, scanning and update tasks, and for running other advanced
configuration tasks (see section "Advanced application settings" on page 62).

The application settings window consists of two parts:

Figure 6. The application settings window

in the left part of the window you can choose the application component, task or another item that should be

configured;

the right part of the window contains the controls that you can use to configure the item selected in the left part

of the window.

A P P L I C A T I O N I N T E R F A C E

35

The components, tasks and other items in the left part of the window are grouped in the following sections:

– Protection Center;

– Scan;

– Update;

– Advanced Settings.

You can open the settings window using one of the following methods:

by clicking the Settings link in the top part of the main application window (see section "The Kaspersky Anti-

Virus main window" on page 31);

by selecting Settings from the context menu (see section "Context menu" on page 30);

by clicking the button with the Settings icon in the Kaspersky Gadget interface (only for Microsoft Windows

Vista and Microsoft Windows 7 operating systems). The function of opening the settings window should be
assigned to the button (see section "How to use the Kaspersky Gadget" on page 59).

THE KASPERSKY GADGET

When using Kaspersky Anti-Virus on a computer running under Microsoft Windows Vista or Microsoft Windows 7, you
can also use the Kaspersky Gadget (hereinafter the gadget). The Kaspersky Gadget is designed for quick access to the
main features of the application (for example, protection status indication, virus scanning of objects, application operation
reports).

After you install Kaspersky Anti-Virus on a computer running under Microsoft Windows 7, the gadget appears on your
desktop automatically. After you install the application on a computer running under Microsoft Windows Vista, you should
add the gadget to the Microsoft Windows Sidebar manually (see the operating system documentation).

Figure 7. The Kaspersky Gadget

U S E R G U I DE

36

NEWS AGENT

Using News Agent, Kaspersky Lab informs you of all important events related to Kaspersky Anti-Virus and protection against computer threats.

The application will notify you of news by displaying a special icon in the taskbar notification area (see below) and a pop­up message. Information about the number of unread news items is also displayed in the main application window. A
news icon appears in the Kaspersky Anti-Virus gadget interface.

You can read the news in one of the following ways:

by clicking the icon in the taskbar notification area;

by clicking the Read news link in the pop-up news message;

by clicking the News link in the main application window;

by clicking the icon which is displayed in the center of the Gadget when a piece of news appears (only for

Microsoft Windows Vista and Microsoft Windows 7).

The above-listed methods of opening the News Agent window are only operable if any unread news is available.

If you do not want to receive any news, you can disable the news delivery.

37

STARTING AND STOPPING THE

IN THIS SECTION:

Enabling and disabling automatic launch ........................................................................................................................ 37

Launching and closing the application manually ............................................................................................................. 37

APPLICATION

This section contains information on starting and shutting down the application.

ENABLING AND DISABLING AUTOMATIC LAUNCH

Automatic launch of the application means that Kaspersky Anti-Virus launches after the operating system startup. This is
the default start mode.

To disable or enable automatic launch of the application:

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the General Settings subsection.

3. To disable automatic launch of the application, uncheck the Launch Kaspersky Anti-Virus at computer
startup box in the Autorun section in the right part of the window. Check this box to enable automatic launch of
the application.

LAUNCHING AND CLOSING THE APPLICATION MANUALLY

Kaspersky Lab specialists do not recommend that you stop Kaspersky Anti-Virus, because the protection of your
computer and personal data will then be at risk. It is recommended that you temporarily pause the computer's protection,
without closing the application.

Kaspersky Anti-Virus should be started manually if you have disabled automatic launch of the application (see section
"Enabling and disabling automatic launch" on page 37).

To launch the application manually,

in the Start menu, select Programs Kaspersky Anti-Virus 2012 Kaspersky Anti-Virus 2012.

To exit the application,

right-click to open the context menu of the application icon in the taskbar notification area and select Exit.

In the Microsoft Windows 7 operating system the application icon is hidden by default, but you can display it to
access the application more easily (see the operating system documentation).

38

MANAGING THE COMPUTER PROTECTION

IN THIS SECTION:

Diagnostics and elimination of problems in your computer protection ............................................................................. 38

Enabling and disabling the protection ............................................................................................................................. 39

Pausing and resuming protection .................................................................................................................................... 40

This section provides information about how to detect threats to the computer's security and how to configure the security
level. Read this section to learn more about how to enable, disable, and pause the protection when using the application.

DIAGNOSTICS AND ELIMINATION OF PROBLEMS IN YOUR

COMPUTER PROTECTION

Problems with computer protection are indicated by the computer indicator located in the left part of the main application
window (see section "The Kaspersky Anti-Virus main window" on page 31). The indicator is shaped as a monitor icon
that changes color depending on the protection status of the computer: green means that the computer is protected,
yellow indicates protection-related problems, red alerts of serious threats to the computer's security.

Figure 8. Protection status indicator

You are advised to fix the problems and security threats immediately.

M A N A G I N G T H E C O M P U T E R P R O T E C T I O N

39

Clicking the indicator in the main application window opens the Security Problems window (see the figure below)
containing detailed information about the status of computer protection and troubleshooting suggestions for the detected
problems and threats.

Figure 9. The Security Problems window

Problems with the protection are grouped by categories. For each problem, actions are listed that you can use to solve
the problem.

ENABLING AND DISABLING THE PROTECTION

By default, Kaspersky Anti-Virus is launched when the operating system loads and protects your computer until it is
switched off. All protection components are running.

You can fully or partially disable the protection provided by Kaspersky Anti-Virus.

Kaspersky Lab specialists strongly recommend that you do not disable protection, since this may lead to an infection of
your computer and data loss. It is recommended that you pause the protection for the required time interval (see section
"Pausing and resuming protection" on page 40).

The following signs indicate that the protection is paused or disabled:

inactive (gray) application icon in the taskbar notification area (see section "The notification area icon" on

page 29);

a red security indicator in the upper part of the main application window.

U S E R G U I DE

40

In this case, the protection is regarded as the set of protection components. Disabling or pausing protection components
does not affect the performance of virus scan tasks and Kaspersky Anti-Virus updates.

You can enable or disable the protection or individual application components from the application settings window (see
section "The application settings window" on page 34).

To completely enable or disable protection:

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the General Settings subsection.

3. Uncheck the Enable protection box if you need to disable protection. Check this box if you need to enable
protection.

To disable or enable a protection component:

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the component that should be enabled or
disabled.

3. In the right part of the window, uncheck the Enable <component name> box if you need to disable this
component. Check this box if you need to enable the component.

PAUSING AND RESUMING PROTECTION

Pausing protection means temporarily disabling all protection components for a period of time.

The following signs indicate that the protection is paused or disabled:

inactive (gray) application icon in the taskbar notification area (see section "The notification area icon" on

page 29);

a red security indicator in the upper part of the main application window.

In this case, the protection is regarded as the set of protection components. Disabling or pausing protection components
does not affect the performance of virus scan tasks and Kaspersky Anti-Virus updates.

If network connections were established at the moment protection was paused, a notification about the termination of
such connections is displayed.

When working on a computer running under Microsoft Windows Vista or Microsoft Windows 7, you can pause protection
using the Kaspersky Gadget. To do this, you should assign the protection pausing function to a button of the gadget (see
section "How to use the Kaspersky Gadget" on page 59).

M A N A G I N G T H E C O M P U T E R P R O T E C T I O N

41

To pause the protection of your computer:

1. Open the Pause protection window using one of the following methods:

select Pause protection from the context menu of the application icon (see section "The context menu" on

page 30);

click the button with the Pause protection icon in the Kaspersky Gadget interface (only for Microsoft

Windows Vista and Microsoft Windows 7 operating systems).

2. In the Pause protection window, select the time interval after which protection should be resumed:

Pause for the specified time – protection will be enabled on expiration of the time interval selected from

the dropdown list below.

Pause until reboot – protection will be enabled after the application is restarted or the operating system is

rebooted (provided that automatic application launch is enabled (see section "Enabling and disabling
automatic launch" on page 37)).

Pause – protection will be enabled when you decide to resume it (please see below).

To resume computer protection,

select Resume protection from the context menu of the application icon (see section "The context menu" on
page 30).

You can use this method to resume computer protection when the Pause option has been selected, or when you have
selected Pause for the specified time or Pause until reboot.

42

SOLVING TYPICAL TASKS

IN THIS SECTION:

How to activate the application ........................................................................................................................................ 42

How to purchase or renew a license ............................................................................................................................... 43

What to do when application notifications appear ........................................................................................................... 44

How to update application databases and modules ........................................................................................................ 44

How to scan critical areas of your computer for viruses .................................................................................................. 45

How to scan a file, folder, disk, or another object for viruses .......................................................................................... 45

How to perform a full scan of your computer for viruses ................................................................................................. 47

How to scan your computer for vulnerabilities ................................................................................................................. 47

How to protect your personal data against theft .............................................................................................................. 47

What to do if you suspect an object is infected with a virus............................................................................................. 49

What to do if you suspect your computer is infected ....................................................................................................... 50

How to restore a file that has been deleted or disinfected by the application .................................................................. 51

How to create and use a Rescue Disk ............................................................................................................................ 52

How to view the report on the application's operation ..................................................................................................... 55

How to restore default application settings ...................................................................................................................... 55

How to transfer settings to Kaspersky Anti-Virus installed on another computer ............................................................ 56

How to switch from Kaspersky Anti-Virus to Kaspersky Internet Security ....................................................................... 57

How to use the Kaspersky Gadget .................................................................................................................................. 59

How to know the reputation of an application .................................................................................................................. 60

This section provides information about how to resolve the most common issues related to protection of the computer
using the application.

HOW TO ACTIVATE THE APPLICATION

Activation is the procedure of activating a license that allows you to use a fully functional version of the application until
the license expires.

If you did not activate the application during installation, you can do so later. You will be reminded about the need to
activate the application by Kaspersky Anti-Virus messages appearing in the taskbar notification area.

S O L V I N G T Y P I C A L T A S K S

43

To run the Kaspersky Anti-Virus activation wizard, perform one of the following:

Click the Activate link in the Kaspersky Anti-Virus notice window that appears in the taskbar notification area.

Click the Insert your activation code here link in the bottom part of the main application window. In the

Manage License window that opens, click the Activate the application button.

When working with the application activation wizard, you should specify values for a collection of settings.

Step 1. Enter activation code

Enter the activation code in the corresponding field and click the Next button.

Step 2. Requesting activation

If the activation request is sent successfully, the Wizard automatically proceeds to the next step.

Step 3. Entry of registration data

User registration is necessary for the user to be able to contact the Technical Support Service. Unregistered
users receive only minimal support.

Specify your registration data and click the Next button.

Step 4. Activation

If the application activation has been successful, the Wizard automatically proceeds to the next window.

Step 5. Wizard completion

This window displays information on the activation results: the type of license used and the license expiry date.
Click the Finish button to close the Wizard.

HOW TO PURCHASE OR RENEW A LICENSE

If you have installed Kaspersky Anti-Virus without a license, you can purchase one after installation. When purchasing a
license, you receive an activation code that you should use to activate the application (see section "How to activate the
application" on page 42).

When your license expires, you can renew it. You can purchase a new license before the validity period of your current
activation code expires. To do this, you should add the new code as a reserve activation code. When the validity term of
the current license expires, Kaspersky Anti-Virus will be automatically activated using the reserve activation code.

To purchase a license:

1. Open the main application window.

2. Click the Manage License link in the bottom part of the main window to open the Manage License window.

3. In the window that opens, click the Buy activation code button.

The eStore web page opens, where you can purchase a license.

U S E R G U I DE

44

To add a reserve activation code:

1. Open the main application window.

2. Click the Manage License link in the bottom part of the main window to open the Manage License window.

The Manage License window opens.

3. In the window that opens, in the New activation code section, click the Enter activation code button.

The Application Activation Wizard opens.

4. Enter the activation code in the corresponding fields and click the Next button.

Kaspersky Anti-Virus then sends the data to the activation server for verification. If the verification is successful,
the Wizard automatically proceeds to the next step.

5. Select New code and click the Next button.

6. When you have finished with the Wizard, click the Finish button.

WHAT TO DO WHEN APPLICATION NOTIFICATIONS APPEAR

Notifications that appear in the taskbar notification area inform you of events occurring in the application's operation
which require your attention. Depending on how critical the event is, you may receive the following types of notification:

Critical notifications – inform you of events that have a critical importance for the computer's security, such as

detection of a malicious object or a dangerous activity in the system. Windows of critical notifications and pop­up messages are red-colored.

Important notifications – inform you of events that are potentially important for the computer's security, such as

detection of a potentially infected object or a suspicious activity in the system. Windows of important
notifications and pop-up messages are yellow-colored.

Information notifications – inform you of events that do not have critical importance for the computer's security.

Windows of information notifications and pop-up messages are green-colored.

If such a notification is displayed on the screen, you should select one of the options suggested in it. The optimal option
is the one recommended as the default by Kaspersky Lab experts.

HOW TO UPDATE APPLICATION DATABASES AND

MODULES

By default, Kaspersky Anti-Virus automatically checks for updates on the Kaspersky Lab update servers. If the server
stores a set of recent updates, Kaspersky Anti-Virus downloads and installs them in background mode. You can start
updating Kaspersky Anti-Virus manually at any moment.

To download updates from Kaspersky Lab servers, you should be connected to Internet.

To start an update from the context menu,

select Update from the context menu of the application icon.

S O L V I N G T Y P I C A L T A S K S

45

To start an update from the main application window:

1. Open the main application window and select the Update section in the lower part of the window.

2. In the Update window that opens, click the Run update button.

HOW TO SCAN CRITICAL AREAS OF YOUR COMPUTER

FOR VIRUSES

Critical areas scan means scanning the following objects:

objects loaded at the startup of the operating system;

system memory;

boot sectors of the disk;

objects added by the user (see section "Creating a list of objects to scan" on page 67).

You can start the scan of critical areas using one of the following methods:

using a shortcut created earlier (see page 71).

from the main application window (see section "The Kaspersky Anti-Virus main window" on page 31).

To start the scan using a shortcut:

1. Open the Microsoft Windows Explorer window and go to the folder where you created the shortcut.

2. Double-click the shortcut to start the scan.

To start a scan from the main application window:

1. Open the main application window and select the Scan section in the lower part of the window.

2. In the Scan window that opens, in the Critical Areas Scan section, click the button.

HOW TO SCAN A FILE, FOLDER, DISK, OR ANOTHER

OBJECT FOR VIRUSES

You can use the following methods to scan an object for viruses:

using the context menu for the object;

from the main application window (see section "The Kaspersky Anti-Virus main window" on page 31);

using the Kaspersky Anti-Virus Gadget (only for Microsoft Windows Vista and Microsoft Windows 7 operating

systems).

To start a virus scan task from the object context menu:

1. Open Microsoft Windows Explorer and go to the folder which contains the object to be scanned.

2. Right-click to open the context menu of the object (see the figure below) and select Scan for Viruses.

U S E R G U I DE

46

The process and the outcome of the task will be displayed in the Task Manager window.

Figure 10. The context menu of an object in Microsoft Windows

To start scanning an object from the main application window:

1. Open the main application window and select the Scan section in the lower part of the window.

2. Specify the object to scan using one of the following methods:

Click the specify link in the bottom right part of the window to open the Custom Scan window, and check

the boxes next to folders and drives that you need to scan.

If the window displays no object to be scanned:

a. Click the Add button.

b. In the Select object to scan window that opens, select an object to be scanned.

Drag an object to scan into the dedicated area of the main window (see figure below).

The progress of the task will be displayed in the Task Manager window.

Figure 11. An area of the Scan window, into which you should drag an object to scan

To scan an object for viruses using the gadget,

drag the object to scan onto the gadget.

The progress of the task will be displayed in the Task Manager window.

S O L V I N G T Y P I C A L T A S K S

47

HOW TO PERFORM A FULL SCAN OF YOUR COMPUTER

FOR VIRUSES

You can start a full scan for viruses using one of the following methods:

using a shortcut created earlier (see page 71);

from the main application window (see section "The Kaspersky Anti-Virus main window" on page 31).

To start a full scan using a shortcut:

1. Open the Microsoft Windows Explorer window and go to the folder where you created the shortcut.

2. Double-click the shortcut to start the scan.

To start a full scan from the main application window:

1. Open the main application window and select the Scan section in the lower part of the window.

2. In the Scan window that opens, in the Full Scan section, click the button.

HOW TO SCAN YOUR COMPUTER FOR VULNERABILITIES

Vulnerabilities are unprotected portions of software code which intruders may deliberately use for their purposes, for
example, to copy data used in unprotected applications. Scanning your computer for vulnerabilities helps you to reveal
any such weak points in your computer. You are advised to remove the detected vulnerabilities.

You can use the following methods to scan the system for vulnerabilities:

from the main application window (see section "The Kaspersky Anti-Virus main window" on page 31);

using a shortcut created earlier (see page 71).

To start the task using a shortcut:

1. Open the Microsoft Windows Explorer window and go to the folder where you created the shortcut.

2. Double-click the shortcut to start scanning the system for vulnerabilities.

To start the task from the main application window:

1. Open the main application window and select the Scan section in the lower part of the window.

2. In the Scan window that opens, in the Vulnerability Scan section, click the button.

HOW TO PROTECT YOUR PERSONAL DATA AGAINST THEFT

With Kaspersky Anti-Virus, you can protect your personal data against theft; this includes data such as:

passwords, usernames, and other registration data;

account numbers and bank card numbers.

U S E R G U I DE

48

Kaspersky Anti-Virus comprises the following components and tools that help you protect your private data:

IN THIS SECTION:

Protection against phishing ............................................................................................................................................. 48

Protection against data interception at the keyboard ...................................................................................................... 48

Anti-Phishing. Protects against data thefts involving the phishing.

Virtual Keyboard. Prevents interception of data entered at the keyboard.

PROTECTION AGAINST PHISHING

Protection against phishing is ensured by Anti-Phishing, implemented in the Web Anti-Virus and IM Anti-Virus
components. Kaspersky Lab recommends that you enable the checking for phishing for all protection components.

To enable protection against phishing when Web Anti-Virus is running:

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the Web Anti-Virus component.

3. Click the Settings button in the right part of the window.

4. The Web Anti-Virus window opens.

5. In the window that opens, on the General tab, in the Kaspersky URL Advisor section, check the Check web
pages for phishing box.

To enable protection against phishing when IM Anti-Virus is running:

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the IM Anti-Virus component.

3. In the right part of the window, in the Scan methods section, check the Check if URLs are listed in the
database of phishing URLs box.

PROTECTION AGAINST DATA INTERCEPTION AT THE KEYBOARD

When working on the Internet, you frequently need to enter your personal data or your username and password. This
happens, for example, during account registration on web sites, web shopping or Internet banking.

There is a risk that this personal information can be intercepted using hardware keyboard interceptors or keyloggers,
which are programs that register keystrokes.

The Virtual Keyboard tool prevents the interception of data entered via the keyboard.

The Virtual Keyboard cannot protect your personal data if the website requiring the entry of such data has been hacked,
because in this case the information is obtained directly by the intruders.

Many of the applications classified as spyware have the function of making screenshots which are then transmitted to an
intruder for further analysis and extraction of the user's personal data. The Virtual Keyboard prevents the personal data
being entered, from being intercepted through the use of screenshots.

S O L V I N G T Y P I C A L T A S K S

49

The Virtual Keyboard only prevents the interception of personal data when working with Microsoft Internet Explorer,
Mozilla Firefox and Google Chrome browsers.

The Virtual Keyboard has the following features:

You can click the Virtual Keyboard buttons using the mouse.

Unlike with real keyboards, there is no way to click several keys simultaneously on a Virtual Keyboard.

Therefore, to use combinations of keys (e.g., ALT+F4), you have to click the first key (e.g., ALT), then the next
key (e.g., F4), and then click the first key again. The second click of the key acts in the same way as the key
release on a real keyboard.

Input language for the Virtual Keyboard is toggled using the key combination CTRL+SHIFT (the SHIFT key

should be clicked using the right mouse button) or CTRL+LEFT ALT (the LEFT ALT key should be clicked
using the right mouse button), depending upon the specified settings.

You can open the Virtual Keyboard in the following ways:

from the context menu of the application icon;

from the main application window;

from the Microsoft Internet Explorer, Mozilla Firefox or Google Chrome browser windows;

using keyboard shortcuts.

To open the Virtual Keyboard from the context menu of the application icon,

select Virtual Keyboard from the context menu of the application icon.

To open the Virtual Keyboard from the main application window,

in the lower part of the main application window select Virtual Keyboard.

To open the Virtual Keyboard from the browser window,

click the Virtual Keyboard button in the toolbar of Microsoft Internet Explorer, Mozilla Firefox, or Google
Chrome.

To open the Virtual Keyboard using the computer keyboard,

press the CTRL+ALT+SHIFT+P shortcut.

WHAT TO DO IF YOU SUSPECT AN OBJECT IS INFECTED

WITH A VIRUS

If you suspect an object is infected, scan it using Kaspersky Anti-Virus (see section "How to scan a file, folder, disk, or
another object for viruses" on page 45).

If the application scans an object and then considers it as not infected although you suspect the contrary, you can
perform any of the following actions:

Move the object to Quarantine. Objects moved to Quarantine do not pose any threat to your computer. After the

databases are updated, Kaspersky Anti-Virus may be able to clearly identify and remove the threat.

Send the object to the Virus Lab. Virus Lab specialists scan the object. If it turns out to be infected with a virus,

they add the description of the new virus into the databases that will be downloaded by the application with an
update (see section "How to update application databases and modules" on page 44).

U S E R G U I DE

50

You can move a file to Quarantine using one of two methods:

by clicking the Move to Quarantine button in the Quarantine window;

using the context menu for the file.

To move a file to Quarantine from the Quarantine window:

1. Open the main application window.

2. In the lower part of the window, select the Quarantine section.

3. On the Quarantine tab click the Move to Quarantine button.

4. In the window that opens, select the file that you want to move to Quarantine.

To move a file to Quarantine using the context menu:

1. Open Microsoft Windows Explorer and go to the folder that contains the file that you want to move to
Quarantine.

2. Right-click to open the context menu of the file and select Move to Quarantine.

To send a file to the Virus Lab:

1. Go to the Virus Lab request page (http://support.kaspersky.com/virlab/helpdesk.html).

2. Follow the instructions on this page to send your request.

WHAT TO DO IF YOU SUSPECT YOUR COMPUTER IS

INFECTED

If you suspect your operating system of being corrupted due to malware activity or system failures, use Microsoft
Windows Troubleshooting, which removes any traces of malicious objects from the system. Kaspersky Lab recommends

that you run the Wizard after the computer has been disinfected to make sure that all threats and damage caused by
infections have been fixed.

Microsoft Windows Troubleshooting checks the system for modifications and faults (such as modifications of file
extensions, blockage of the network environment and control panel). Modifications and faults may be caused by malware
activity, an improper system configuration, system failures, or incorrect operation of system optimization applications.

After the review is complete, the Wizard analyzes the information to evaluate whether there is system damage which
requires immediate attention. Based on the review, a list of actions necessary to eliminate the problems is generated.
The Wizard groups these actions by category based on the severity of the problems detected.

To start the System Restore Wizard:

1. Open the main application window (see page 31).

2. In the lower part of the window, select the Tools section.

The Wizard consists of a series of screens (steps) that you can navigate through using the Back and Next buttons. To
close the Wizard once it has completed its task, click the Finish button. To stop the Wizard at any stage, click the
Cancel button.

3. In the window that opens, in the Microsoft Windows Troubleshooting section, click the Start button.

The Microsoft Windows Troubleshooting window opens.

S O L V I N G T Y P I C A L T A S K S

51

Step 1. Starting system restoration

Make sure that the Wizard option to Search for problems caused by malware activity is selected and click
the Next button.

Step 2. Problems search

The Wizard will search for problems and damage which should be fixed. Once the search is complete, the
Wizard will proceed automatically to the next step.

Step 3. Selecting troubleshooting actions

All damage found during the previous step is grouped on the basis of the type of danger it poses. For each
damage group, Kaspersky Lab recommends a sequence of actions to repair the damage. There are three
groups of actions:

Strongly recommended actions eliminate problems posing a serious security threat. You are advised to

perform all actions in this group.

Recommended actions eliminate problems presenting a potential threat. You are also advised to perform all

actions in this group.

Additional actions repair system damage which does not pose a current threat, but may pose a danger to

the computer's security in the future.
To view the actions within a group, click the + icon to the left of the group name.

To make the Wizard perform a certain action, check the box to the left of the corresponding action description.
By default, the Wizard performs all recommended and strongly recommended actions. If you do not wish to
perform a certain action, uncheck the box next to it.

It is strongly recommended that you not uncheck the boxes selected by default, as doing so will leave your
computer vulnerable to threats.

Having defined the set of actions which the Wizard will perform, click the Next button.

Step 4. Eliminating problems

The Wizard will perform the actions selected during the previous step. The elimination of problems may take
some time. Once the troubleshooting is complete, the Wizard will automatically proceed to the next step.

Step 5. Wizard completion

Click the Finish button to close the Wizard.

HOW TO RESTORE A FILE THAT HAS BEEN DELETED

OR DISINFECTED BY THE APPLICATION

Kaspersky Lab recommends that you avoid restoring deleted and disinfected files, as they may pose a threat to your
computer.

If you want to restore a deleted or disinfected file, you can use a backup copy of it which was created by the application
during the scan.

U S E R G U I DE

52

To restore a file that has been deleted or disinfected by the application:

IN THIS SECTION:

Creating a Rescue Disk................................................................................................................................................... 52

Starting the computer from the Rescue Disk ................................................................................................................... 54

1. Open the main application window.

2. In the lower part of the window, select the Quarantine section.

3. On the Storage tab, select the required file from the list and click the Restore button.

HOW TO CREATE AND USE A RESCUE DISK

After you install Kaspersky Anti-Virus and perform the first scan of your computer, it is recommended that you create the
Rescue Disk.

The Rescue Disk is an application named Kaspersky Rescue Disk and recorded on a removable medium (CD or USB
flash drive).

You will then be able to use Kaspersky Rescue Disk for scanning and disinfecting infected computers that cannot be
disinfected using other methods (e.g., with anti-virus applications).

CREATING A RESCUE DISK

Creating a Rescue Disk consists in creating a disk image (ISO file) with the up-to-date version of Kaspersky Rescue
Disk, and writing it on a removable medium.

You can download the original disk image from the Kaspersky Lab server or copy it from a local source.

The Rescue Disk is created using the Kaspersky Rescue Disk Creation Wizard. The rescuecd.iso file created by the
Wizard is saved on your computer's hard drive:

in Microsoft Windows XP – in the following folder: Documents and Settings\All Users\Application

Data\Kaspersky Lab\AVP12\Data\Rdisk\;

in Microsoft Windows Vista and Microsoft Windows 7 operating systems – in the following folder:

ProgramData\Kaspersky Lab\AVP12\Data\Rdisk\.

To create a Rescue Disk:

1. Open the main application window.

2. In the lower part of the window, select the Tools section.

3. In the window that opens, in the Kaspersky Rescue Disk section, click the Create button.

The Kaspersky Rescue Disk Creation Wizard window opens.

The Wizard consists of a series of screens (steps) that you can navigate through using the Back and Next buttons. To
close the Wizard once it has completed its task, click the Finish button. To stop the Wizard at any stage, click the
Cancel button.

Let us review the steps of the Wizard in more detail.

S O L V I N G T Y P I C A L T A S K S

53

Step 1. Starting the Wizard. Searching for an existing disk image

The first window of the Wizard contains information about Kaspersky Rescue Disk.
If the Wizard detects an existing Rescue Disk ISO file in the dedicated folder (see above), the Use existing ISO

image box will be displayed in the first window of the Wizard. Check the box to use the detected file as the
original ISO image and go directly to the Updating disk image step (see below). Uncheck this box if you do not
want to use the disk image that was detected. The Wizard will proceed to the Select disk image source
window.

Step 2. Selecting a disk image source

If you have checked the Use existing ISO image box in the first Wizard window, then this step will be skipped.

At this step, you should select a disk image source from the options suggested:

If you already have a recorded copy of the Rescue Disk or an ISO image saved on your computer or on a

local network resource, select Copy ISO image from local or network drive.

If you have no ISO image file created for the Rescue Disk, and you want to download one from the

Kaspersky Lab server (file size is about 175 MB), select Download ISO image from Kaspersky Lab

server.

Step 3. Copying (downloading) the disk image

If you have checked the Use existing ISO image box in the first Wizard window, then this step will be skipped.

If you have selected Copy ISO image from local or network drive at the previous step, click the Browse
button. After you have specified the path to the file, click the Next button. The progress of copying the disk
image is displayed in the Wizard window.

If you have selected Download ISO image from Kaspersky Lab server at the previous step, the progress of
downloading the disk image is displayed immediately.

When copying or downloading of the ISO image is complete, the Wizard automatically proceeds to the next
step.

Step 4. Updating the ISO image file

The updating procedure for the ISO image file comprises the following operations:

updating anti-virus databases;

updating configuration files.

Configuration files determine whether the computer can be booted from a removable medium (such as a
CD / DVD or a USB flash drive with Kaspersky Rescue Disk) created by the Wizard.

When updating anti-virus databases, those distributed at the last update of Kaspersky Anti-Virus are used. If
databases are out of date, it is recommended that you run the update task and launch the Kaspersky Rescue
Disk Creation Wizard again.

To begin updating the ISO file, click the Next button. The update's progress will be displayed in the Wizard
window.

U S E R G U I DE

54

Step 5. Recording the disk image on a medium

At this step, the Wizard informs you of a successful creation of a disk image and offers you to record it on a
medium.

Specify a data medium for recording Kaspersky Rescue Disk:

To record the disk image on a CD / DVD, select Record to CD / DVD and specify a medium, on which you

want to record the disk image.

To record the disk image on a USB flash drive, select Record to USB flash drive and specify a device, on

which you want to record the disk image.

Kaspersky Lab recommends that you do not record the ISO image on devices which are not designed

specifically for data storage, such as smartphones, cellphones, PDAs, and MP3 players. Recording ISO

images on these devices may lead to their functioning incorrectly in the future.

To record the disk image on the hard drive of your computer or on the hard drive of another one that you

can access via a network, select Save the disk image to file on local or network drive and specify a

folder, in which you want to record the disk image, and the name of the ISO file.

Step 6. Wizard completion

To close the Wizard once it has completed its task, click the Finish button. You can use the newly created
Rescue Disk to boot the computer (see page 54) if you cannot boot it and run Kaspersky Anti-Virus in normal
mode due to an impact caused by viruses or malware.

STARTING THE COMPUTER FROM THE RESCUE DISK

If the operating system cannot be booted as a result of a virus attack, use the Rescue Disk.

To boot the operating system, you should use a CD / DVD or a USB flash drive with Kaspersky Rescue Disk copied on it
(see section "Creating a Rescue Disk" on page 52).

Booting a computer from a removable media is not always possible. In particular, this mode is not supported by some
obsolete computer models. Before shutting down your computer for subsequent booting from a removable media, make
sure that this operation can be performed.

To boot your computer from the Rescue Disk:

1. In the BIOS settings, enable booting from a CD / DVD or a USB device (for detailed information, please refer to
the documentation for your computer's motherboard).

2. Insert a CD / DVD into the CD / DVD drive of an infected computer or connect a USB flash device with
Kaspersky Rescue Disk copied on it.

3. Restart your computer.

For detailed information about the use of the Rescue Disk, please refer to the Kaspersky Rescue Disk User Guide.

S O L V I N G T Y P I C A L T A S K S

55

HOW TO VIEW THE REPORT ON THE APPLICATION'S

OPERATION

Kaspersky Anti-Virus creates operation reports for each component. Using a report, you can obtain statistical information
about the application's operation (for example, learn how many malicious objects have been detected and neutralized for
a specified time period, how many times the application has been updated for the same period, how many spam
messages have been detected and much more).

When working on a computer running under Microsoft Windows Vista or Microsoft Windows 7, you can open reports
using the Kaspersky Gadget. To do this, the Kaspersky Gadget should be configured so that the option of opening the
reports window is assigned to one of its buttons (see section "How to use the Kaspersky Gadget" on page 59).

To view the application operation report:

1. Open the Reports window using any of the following methods:

click the Reports link in the top part of the main application window;

click the button with the Reports icon in the Kaspersky Gadget interface (only for Microsoft Windows

Vista and Microsoft Windows 7 operating systems).

The Reports window displays reports on the application's operation represented as diagrams.

2. If you want to view a detailed application operation report (for example, a report on the operation of each
component), click the Detailed report button in the bottom part of the Report window.

The Detailed report window will open, where data are represented in a table. For convenient viewing of reports,
you can select various entry sorting options.

HOW TO RESTORE DEFAULT APPLICATION SETTINGS

You can restore the default application settings recommended by Kaspersky Lab for Kaspersky Anti-Virus, at any time.
The settings can be restored using the Application Configuration Wizard.

When the Wizard completes its operation, the Recommended security level is set for all protection components. When
restoring the recommended security level, you can save the previously specified values for some of the settings of
application components.

To restore the default settings of the application:

1. Open the application settings window.

2. Run the Application Configuration Wizard using one of the following methods:

click the Restore link in the bottom part of the window;

in the left part of the window, select the Manage Settings subsection in the Advanced Settings section

and click the Restore button in the Restore default settings section.

Let us review the steps of the Wizard in more detail.

Step 1. Starting the Wizard

Click the Next button to proceed with the Wizard.

U S E R G U I DE

56

Step 2. Restore settings

This Wizard window shows which Kaspersky Anti-Virus protection components have settings that differ from the
default value because they were changed by the user. If special settings have been created for any of the
components, they will also be shown in this window.

Check the boxes for the settings that you want to save and click the Next button.

Step 3. Finishing restoration

To close the Wizard once it has completed its task, click the Finish button.

HOW TO TRANSFER SETTINGS TO KASPERSKY ANTI-VIRUS INSTALLED ON ANOTHER COMPUTER

Once you have configured the product, you can apply its settings to Kaspersky Anti-Virus installed on another computer.
Consequently, the application will be configured identically on both computers. This is a helpful feature when, for
example, Kaspersky Anti-Virus is installed on your home computer and in your office.

The application settings are stored in a special configuration file that you can transfer to another computer.

The settings of Kaspersky Anti-Virus can be transferred to another computer in three steps:

1. Saving the application settings in a configuration file.

2. Transferring a configuration file to another computer (for example, by email or on a removable medium).

3. Applying settings from a configuration file to the application installed on another computer.

To export the current settings of Kaspersky Anti-Virus:

1. Open the application settings window.

2. In the left part of the window, in the Advanced Settings section, select the Manage Settings subsection.

3. Click the Save button in the right part of the window.

4. In the window that opens, enter the name of the configuration file and the path where it should be saved.

5. Click the OK button.

To import the application's settings from a saved configuration file:

1. Open the application settings window.

2. In the left part of the window, in the Advanced Settings section, select the Manage Settings subsection.

3. Click the Load button in the right part of the window.

4. In the window that opens, select the file from which you wish to import the Kaspersky Anti-Virus settings.

5. Click the OK button.

S O L V I N G T Y P I C A L T A S K S

57

IN THIS SECTION:

Switching to the commercial version ............................................................................................................................... 57

Temporary switching to the trial version .......................................................................................................................... 58

HOW TO SWITCH FROM KASPERSKY ANTI-VIRUS

TO KASPERSKY INTERNET SECURITY

Kaspersky Anti-Virus allows you to switch to Kaspersky Internet Security without any additional downloads and
installation of software.

Kaspersky Internet Security is an application designed to ensure comprehensive protection of your computer. It provides
a whole range of advanced features implemented with the following modules and functions:

Application Control;

Parental Control;

Firewall;

Network Attack Blocker;

Geo Filter;

Blocking access to insecure websites;

Network Monitor;

Anti-Spam;

Anti-Banner;

Privacy Cleaner;

Safe Run.

You can temporarily switch to the trial version of Kaspersky Internet Security in order to appreciate its features, or
immediately begin using the commercial version of the application.

If you use the license with a subscription or handle the application in some specific regions, your copy of Kaspersky
Internet Security does not allow the temporary switching to the trial version.

SWITCHING TO THE COMMERCIAL VERSION

If you want to switch to the commercial version of Kaspersky Internet Security, you need an activation code for the
commercial version of the application that you can use to activate it (see section "How to activate the application" on
page 42).

U S E R G U I DE

58

To purchase an activation code for Kaspersky Internet Security:

1. Open the main application window.

2. In the bottom part of the window, select the Upgrade section.

3. In the window that opens, click the Buy activation code button.

You are redirected to the website of eStore, where you can purchase an activation code for Kaspersky Internet
Security.

If you purchase the application in some specific regions or use the license with subscription, the Upgrade
section is not represented in the main application window.

TEMPORARY SWITCHING TO THE TRIAL VERSION

You can temporarily switch to the trial version of Kaspersky Internet Security in order to appreciate its functionality. After
that, you can optionally purchase a license for further use of the application.

To temporarily switch to Kaspersky Internet Security:

1. Open the main application window.

2. In the bottom part of the window, select the Upgrade section.

3. In the window that opens, click the Trial version button.

The Application Configuration Wizard then opens.

If you purchase the application in some specific regions or use the license with subscription, the Upgrade
section is not represented in the main application window.

When working with the Application Configuration Wizard, you should specify values for a collection of settings.

Step 1. Requesting activation of the trial version of Kaspersky Internet Security

If the activation request for Kaspersky Internet Security is sent successfully, the Wizard automatically proceeds
to the next step.

Step 2. Starting the upgrade

At this step, the Wizard displays a message on the screen, which informs you that all upgrade prerequisites are
met. To proceed with the Wizard, click the Next button.

Step 3. Removing incompatible applications

At this step, the Wizard checks if any applications incompatible with Kaspersky Internet Security are installed on
your computer. If no such applications are found, the Wizard automatically proceeds to the next step. If such
applications are found, the Wizard lists them in the window and offers you to uninstall them.

After incompatible applications are uninstalled, you may need to restart the operating system. After the
operating system is restarted, the Wizard opens automatically to resume the upgrade process.

S O L V I N G T Y P I C A L T A S K S

59

Step 4. Upgrading

At this step, the Wizard connects upgrade modules, which may take some time. When the process is complete,
the Wizard automatically proceeds to the next step.

Step 5. Restarting the application

At the final step of the upgrade, the application should be restarted. To do this, click the Finish button in the
Wizard window.

Step 6. Completing the activation

After the application is restarted, the Wizard opens automatically. After a successful activation of the trial
version of Kaspersky Internet Security, the Wizard window displays information about the term, during which
you can use the trial version.

Step 7. System analysis

At this stage, information about Microsoft Windows applications is collected. These applications are added to
the list of trusted applications which have no restrictions imposed on the actions they perform in the system.

Once the analysis is complete, the Wizard will automatically proceed to the next step.

Step 8. Finishing the upgrade

To close the Wizard once it has completed its task, click the Finish button.

The application cannot be switched to the trial version of Kaspersky Internet Security for a second time.

HOW TO USE THE KASPERSKY GADGET

When using Kaspersky Anti-Virus on a computer running under Microsoft Windows Vista or Microsoft Windows 7, you
can also use the Kaspersky Gadget (hereinafter the gadget). After you install Kaspersky Anti-Virus on a computer
running under Microsoft Windows 7, the gadget appears on your desktop automatically. After you install the application
on a computer running under Microsoft Windows Vista, you should add the gadget to the Microsoft Windows Sidebar
manually (see the operating system documentation).

The Gadget color indicator displays your computer's protection status in the same manner as the indicator in the main
application window (see section "Diagnostics and elimination of problems in your computer protection" on page 38).
Green indicates that your computer is duly protected, while yellow indicates that there are protection problems, and red
indicates that your computer's security is at serious risk. Gray indicates that the application is stopped.

While updating the application databases and software modules, a revolving globe-shaped icon is displayed in the center
part of the gadget.

You can use the gadget to perform the following actions:

resume the application if it has been paused earlier;

open the main application window;

scan specified objects for viruses;

open the news window.

U S E R G U I DE

60

Also, you can configure the buttons of the gadget so that they could initiate additional actions:

run an update;

edit the application settings;

view application reports;

pause the protection;

open the Virtual Keyboard;

open the Task Manager window.

To start the application using the gadget,

click the icon Enable icon located in the center of the gadget.

To open the main application window using the gadget,

click the monitor icon in the center area of the gadget.

To scan an object for viruses using the gadget,

drag the object to scan onto the gadget.
The progress of the task will be displayed in the Task Manager window.

To open the news window using the gadget,

click the icon which is displayed in the center of the gadget when news is released.

To configure the gadget:

1. Open the gadget settings window by clicking the icon that appears in the upper right corner of the gadget
block if you position the cursor over it.

2. In the dropdown lists corresponding to gadget buttons, select actions that should be performed when you click
those buttons.

3. Click the OK button.

HOW TO KNOW THE REPUTATION OF AN APPLICATION

Kaspersky Anti-Virus allows you to learn the reputation of applications from users all over the world. Reputation of an
application comprises the following criteria:

name of the vendor;

information about the digital signature (available if a digital signature exists);

information about the group, in which the application has been included by a majority of users of Kaspersky

Security Network;

number of users of Kaspersky Security Network that use the application (available if the application has been

included in the Trusted group in Kaspersky Security Network database);

S O L V I N G T Y P I C A L T A S K S

61

SEE ALSO:

Kaspersky Security Network ......................................................................................................................................... 124

time, at which the application has become known in Kaspersky Security Network;

countries, in which the application is the most widespread.

To verify the reputation of an application, you should agree to participate in Kaspersky Security Network (see page 124)
when installing Kaspersky Anti-Virus.

To know the reputation of an application,

open the context menu of the executable file of the application and select Check reputation in KSN.

62

ADVANCED APPLICATION SETTINGS

IN THIS SECTION:

General protection settings ............................................................................................................................................. 62

Scan ................................................................................................................................................................................ 64

Update............................................................................................................................................................................. 72

File Anti-Virus .................................................................................................................................................................. 77

Mail Anti-Virus ................................................................................................................................................................. 83

Web Anti-Virus ................................................................................................................................................................ 88

IM Anti-Virus .................................................................................................................................................................... 94

Proactive Defense ........................................................................................................................................................... 95

System Watcher .............................................................................................................................................................. 97

Network protection .......................................................................................................................................................... 99

Trusted zone ................................................................................................................................................................. 103

Performance and compatibility with other applications .................................................................................................. 105

Kaspersky Anti-Virus self-defense ................................................................................................................................ 108

Quarantine and Backup................................................................................................................................................. 109

Additional tools for better protection of your computer .................................................................................................. 113

Reports.......................................................................................................................................................................... 117

Application appearance. Managing active interface elements ....................................................................................... 121

Notifications ................................................................................................................................................................... 122

Kaspersky Security Network ......................................................................................................................................... 124

This section provides detailed information about how to configure each of the application components.

GENERAL PROTECTION SETTINGS

In the application settings window, in the General Settings subsection of the Protection Center section, you can:

disable all protection components (see section "Enabling and disabling protection" on page 39);

select the interactive or automatic protection mode (see section "Selecting a protection mode" on page 63);

restrict users' access to the application by setting a password (see section "Restricting access to Kaspersky

Anti-Virus" on page 63);

A D V A N C E D A P P L I C A T I O N S E T T I N G S

63

IN THIS SECTION:

Restricting access to Kaspersky Anti-Virus ..................................................................................................................... 63

Selecting a protection mode ............................................................................................................................................ 63

disable or enable automatic launching of the application at operating system startup (see section "Enabling and

disabling automatic launch" on page 37);

enable a custom key combination for displaying the virtual keyboard on the screen (see section "Protection

against data interception at the keyboard" on page 48).

RESTRICTING ACCESS TO KASPERSKY ANTI-VIRUS

A computer may be used by several users with various levels of computer literacy. Unrestricted user access to
Kaspersky Anti-Virus and its settings may lead to a reduced level of computer protection.

To restrict access to the application, you can set a password and specify which actions should require the password to
be entered:

changing application settings;

closing the application;

removing the application.

Be careful when using a password to restrict access to application removal. If you forget the password, the application
will be difficult to remove from your computer.

To restrict access to Kaspersky Anti-Virus with a password:

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the General Settings subsection.

3. In the right part of the window, in the Password protection section, check the Enable password protection
box and click the Settings button.

4. In the Password protection window that opens, enter the password and specify the area to be covered by the
access restriction.

SELECTING A PROTECTION MODE

By default, Kaspersky Anti-Virus runs in automatic protection mode. In this mode the application automatically applies
actions recommended by Kaspersky Lab in response to dangerous events. If you wish Kaspersky Anti-Virus to notify you
of all hazardous and suspicious events in the system and to allow you to decide which of the actions offered by the
application should be applied, you can enable the interactive protection mode.

U S E R G U I DE

64

To select a protection mode:

IN THIS SECTION:

Virus scan ....................................................................................................................................................................... 64

Vulnerability Scan ........................................................................................................................................................... 72

Managing scan tasks. Task Manager .............................................................................................................................. 72

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the General Settings subsection.

3. In the Interactive protection section, check or uncheck the boxes depending on your choice of protection
mode:

to enable the interactive protection mode, uncheck the Select action automatically box;

to enable automatic protection mode, check the Select action automatically box.

If you do not want Kaspersky Anti-Virus to delete suspicious objects when running in automatic mode,
check the Do not delete suspicious objects box.

SCAN

Scanning the computer for vulnerabilities, viruses and other riskware is one of the most important tasks when ensuring
the computer's security.

It is necessary to regularly scan your computer for viruses and other riskware in order to rule out the possibility of
spreading malicious programs that have not been detected by protection components, for example, due to a low security
level set, or for other reasons.

The vulnerability scan performs diagnostics of operating system safety and detects software features that could be used
by intruders to spread malicious objects and obtain access to personal information.

This section contains information about scan task features and configuration, security levels, scan methods, and scan
technologies.

VIRUS SCAN

To detect viruses and other riskware, Kaspersky Anti-Virus comprises the following tasks:

Full Scan. Scan of the entire system. By default, Kaspersky Anti-Virus scans the following objects:

system memory;

objects loaded on operating system startup;

system backup;

email databases;

removable storage media, hard and network drives.

A D V A N C E D A P P L I C A T I O N S E T T I N G S

65

Critical Areas Scan. By default, Kaspersky Anti-Virus scans objects loaded at the startup of the operating

system.

Custom Scan. Kaspersky Anti-Virus scans objects selected by the user. You can scan any object from the list

below:

system memory;

objects loaded on operating system startup;

system backup;

email databases;

removable storage media, hard and network drives;

any file or folder that you have selected.

The Full Scan and the Critical Areas Scan tasks have their peculiarities. For these tasks, it is not recommended that you
edit the lists of objects to scan.

Each scan task is performed in a specified area and can be started according to a previously created schedule. Each
scan task is also characterized by a security level (a combination of settings that impact the depth of the scan). By
default, the signature mode (the one using records from application databases to search for threats) is always enabled.
You can also apply various scan methods and technologies.

After the full scan task or the critical areas scan task is started, the scan run progress is displayed in the Scan window, in
the section with the name of the task running, and in the Task Manager (see section "Managing scan tasks. Task
Manager" on page 72).

If a threat is detected, Kaspersky Anti-Virus assigns one of the following statuses to the found object:

Malicious program (such as a virus or Trojan).

Potentially infected (suspicious) status if the scan cannot determine whether the object is infected or not. The

file may contain a sequence of code characteristic of viruses, or modified code from a known virus.

The application displays a notification (see page 122) about the detected threat and performs the prescribed action. You
can change the actions to be taken when a threat is detected.

If you are working in automatic mode (see section "Selecting a protection mode" on page 63), when dangerous objects
are detected, Kaspersky Anti-Virus automatically applies the actions recommended by Kaspersky Lab specialists. For
malicious objects, this action is Disinfect. Delete if disinfection fails, for suspicious objects – Move to Quarantine. If
dangerous objects are detected when working in interactive mode (see section "Selecting a protection mode" on
page 63), the application displays a notification on the screen that you can use to select the required action the list of
available ones.

Before attempting to disinfect or delete an infected object, Kaspersky Anti-Virus creates a backup copy for subsequent
restoration or disinfection. Suspicious (potentially infected) objects are quarantined. You can enable automatic scanning
of quarantined objects after each update.

Information on the scan results and events which have occurred during the execution of the task is logged in a
Kaspersky Anti-Virus report (see page 117).

U S E R G U I DE

66

IN THIS SECTION:

Changing and restoring the security level ....................................................................................................................... 66

Creating the scan startup schedule ................................................................................................................................. 67

Creating a list of objects to scan ..................................................................................................................................... 67

Selecting a scan method ................................................................................................................................................. 68

Selecting scan technology ............................................................................................................................................... 68

Changing the actions to be performed when a threat is detected ................................................................................... 69

Running a scan under a different user account ............................................................................................................... 69

Changing the type of objects to scan .............................................................................................................................. 69

Scanning of compound files ............................................................................................................................................ 70

Scan optimization ............................................................................................................................................................ 70

Scanning removable drives on connection ...................................................................................................................... 71

Creating a task shortcut .................................................................................................................................................. 71

CHANGING AND RESTORING THE SECURITY LEVEL

Depending on your current needs, you can select one of the preset security levels or modify the scan settings manually.

When configuring scan task settings, you can always restore the recommended ones. These settings are considered
optimal, recommended by Kaspersky Lab, and grouped in the Recommended security level.

To change the established security level:

1. Open the application settings window.

2. In the left part of the window, in the Scan section, select the desired task (Full Scan, Critical Areas Scan, or
Custom Scan).

3. In the Security level section, set the desired security level for the task selected, or click the Settings button to
modify scan settings manually.

If you modify the settings manually, the name of the security level will change to Custom.

To restore the default scan settings:

1. Open the application settings window.

2. In the left part of the window, in the Scan section, select the desired task (Full Scan, Critical Areas Scan, or
Custom Scan).

3. In the Security level section, click the Default level button for the task selected.

A D V A N C E D A P P L I C A T I O N S E T T I N G S

67

CREATING THE SCAN STARTUP SCHEDULE

You can create a schedule to automatically start virus scan tasks: specify task run frequency, start time (if necessary),
and advanced settings.

If it is not possible to start the task for any reason (for example, the computer was not on at that time), you can configure
the skipped task to start automatically as soon as it becomes possible. You can automatically pause the scan when a
screensaver is inactive or the computer is unlocked. This functionality postpones launching the task until the user has
finished working on the computer. The scan will then not take up system resources during work.

The special Idle Scan mode (see section "Running tasks in background mode" on page 107) allows you to start
automatic updates when your computer is idle.

To modify the schedule for scan tasks:

1. Open the application settings window.

2. In the left part of the window, in the Scan section, select the desired task (Full Scan, Critical Areas Scan, or
Vulnerability Scan).

3. Click the Run mode button in the right part of the window.

4. In the window that opens, on the Run mode tab, in the Schedule section, select By schedule and configure
the scan run mode by specifying required values for the Frequency setting.

To enable automatic launching of a skipped task:

1. Open the application settings window.

2. In the left part of the window, in the Scan section, select the desired task (Full Scan, Critical Areas Scan or
Vulnerability Scan).

3. Click the Run mode button in the right part of the window.

4. In the window that opens, on the Run mode tab in the Schedule section, select By schedule and check the
Run skipped tasks box.

To launch scans only when the computer is not being used:

1. Open the application settings window.

2. In the left part of the window, in the Scan section, select the desired task (Full Scan, Critical Areas Scan, or
Vulnerability Scan).

3. Click the Run mode button in the right part of the window.

4. In the window that opens, on the Run mode tab, in the Schedule section, select By schedule and check the
Run scheduled scan when screensaver is active or computer is locked box.

CREATING A LIST OF OBJECTS TO SCAN

Each virus scan task has its own default list of objects. These objects may include items in the computer's file system,
such as logical drives and email databases, or other types of objects, such as network drives. You can edit this list.

If the scan scope is empty, or it contains no selected objects, a scan task cannot be started.

U S E R G U I DE

68

To create a list of objects for a custom scan task:

1. Open the main application window.

2. In the bottom part of the window, select the Scan section.

3. In the bottom part of the window that opens, click the specify link to open a list of objects to be scanned.

4. In the Custom Scan window that opens, click the Add button.

5. In the Select object to scan window that opens, select the desired object and click the Add button. Click the
OK button after you have added all the objects you need. To exclude any objects from the list of objects to be
scanned, uncheck the boxes next to them.

You can also drag files to be scanned directly into a marked area located in the Scan section.

To create a list of objects for Full Scan, Critical Areas Scan or Vulnerability Scan tasks:

1. Open the application settings window.

2. In the left part of the window, in the Scan section, select the desired scan task (Full Scan, Critical Areas Scan,
or Vulnerability Scan).

3. In the right part of the window, click the Scan scope button.

4. In the Scan scope window that opens, use the Add, Edit, and Delete buttons to create a list. To exclude any
objects from the list of objects to be scanned, uncheck the boxes next to them.

Objects which appear in the list by default cannot be edited or deleted.

SELECTING A SCAN METHOD

During a virus scan, signature analysis is always used: Kaspersky Anti-Virus compares the object found with the
database records.

You can use additional scan methods to increase scan efficiency: heuristic analysis (analysis of the actions an object
performs within the system) and rootkit scan (a scan for tools that can hide malicious programs in your operating
system).

To select which scan method to use:

1. Open the application settings window.

2. In the left part of the window, in the Scan section, select the desired task (Full Scan, Critical Areas Scan, or
Custom Scan).

3. In the Security level section, click the Settings button for the task selected.

4. In the window that opens, on the Additional tab in the Scan methods section, select the desired scan
methods.

SELECTING SCAN TECHNOLOGY

In addition to the scan methods you can use special object scan technologies which allow you to increase virus scan
speed by excluding the files that have not been modified since they were last scanned.

A D V A N C E D A P P L I C A T I O N S E T T I N G S

69

To specify the object scan technologies:

1. Open the application settings window.

2. In the left part of the window, in the Scan section, select the desired task (Full Scan, Critical Areas Scan, or
Custom Scan).

3. In the Security level section, click the Settings button for the task selected.

4. In the window that opens, on the Additional tab in the Scan technologies section, select the desired values.

CHANGING THE ACTIONS TO BE PERFORMED WHEN A THREAT IS DETECTED

If infected objects are detected, the application performs the selected action.

To change the action that should be performed when a threat is detected:

1. Open the application settings window.

2. In the left part of the window, in the Scan section, select the desired task (Full Scan, Critical Areas Scan, or
Custom Scan).

3. In the right part of the window, select the desired option in the Action on threat detection section.

RUNNING A SCAN UNDER A DIFFERENT USER ACCOUNT

By default, the scan tasks are run under your system account. However, you may need to run a task under a different
user account. You can specify an account to be used by the application when performing a scan task.

To start a scan under a different user's account:

1. Open the application settings window.

2. In the left part of the window, in the Scan section, select the desired task (Full Scan, Critical Areas Scan, or
Vulnerability Scan).

3. Click the Run mode button in the right part of the window.

4. In the window that opens, on the Run mode tab in the User account section, check the Run task as box.
Specify the user name and password.

CHANGING THE TYPE OF OBJECTS TO SCAN

When specifying the type of objects to scan, you establish which file formats will be scanned for viruses when the
selected scan task runs.

When selecting file types, please remember the following:

The probability of malicious code penetrating some file formats (such as TXT) and its subsequent activation is

quite low. However, there are formats that contain or may contain an executable code (such as EXE, DLL,
DOC). The risk of penetration and activation of malicious code in such files is quite high.

An intruder can send a virus to your computer in an executable file renamed as a TXT file. If you have selected

scanning of files by extension, such a file is skipped by the scan. If scanning of files by format is selected, then,
regardless of the extension, File Anti-Virus will analyze the file header and reveal that the file is an EXE file.
Such a file would be thoroughly scanned for viruses.

U S E R G U I DE

70

To change the type of objects to be scanned:

1. Open the application settings window.

2. In the left part of the window, in the Scan section, select the desired task (Full Scan, Critical Areas Scan, or
Custom Scan).

3. In the Security level section, click the Settings button for the task selected.

4. In the window that opens, on the Scope tab in the File types section, select the desired option.

SCANNING OF COMPOUND FILES

A common method of concealing viruses is to embed them into compound files: archives, installation packages,
embedded OLE objects, and mail file formats. To detect viruses that are hidden in this way, a compound file should be
unpacked, which can significantly decrease scanning speed.

For each type of compound file, you can choose to scan either all files or only new ones. To make your selection, click
the link next to the name of the object. It changes its value when you left-click it. If you select the scan new and changed
files only mode (see page 70), the links for choosing whether to scan all or only new files will not be available.

You can restrict the maximum size of a compound file to be scanned. Compound files larger than the specified value will
not be scanned.

When large files are extracted from archives, they will be scanned even if the Do not unpack large compound files box
is checked.

To modify the list of compound files to be scanned:

1. Open the application settings window.

2. In the left part of the window, in the Scan section, select the desired task (Full Scan, Critical Areas Scan, or
Custom Scan).

3. In the Security level section, click the Settings button for the task selected.

4. In the window that opens, on the Scope tab in the Scan of compound files section, select the desired types of
compound files to be scanned.

To set the maximum size of compound files to be scanned:

1. Open the application settings window.

2. In the left part of the window, in the Scan section, select the desired task (Full Scan, Critical Areas Scan, or
Custom Scan).

3. In the Security level section, click the Settings button for the task selected.

4. In the window that opens, on the Scope tab in the Scan of compound files section, click the Additional
button.

5. In the Compound files window that opens, check the Do not unpack large compound files box and specify
the maximum file size.

SCAN OPTIMIZATION

You can shorten the scan time and speed up Kaspersky Anti-Virus. This can be achieved by scanning only new files and
those files that have altered since the last time they were scanned. This mode applies both to simple and compound
files.

A D V A N C E D A P P L I C A T I O N S E T T I N G S

71

You can also set a restriction on scan duration for any one object. When the specified time interval expires, the object will
be excluded from the current scan (except for archives and files comprised of several objects).

To scan only new and changed files:

1. Open the application settings window.

2. In the left part of the window, in the Scan section, select the desired task (Full Scan, Critical Areas Scan, or
Custom Scan).

3. In the Security level section, click the Settings button for the task selected.

4. In the window that opens, on the Scope tab in the Scan optimization section, check the Scan only new and
changed files box.

To set a restriction on scan duration:

1. Open the application settings window.

2. In the left part of the window, in the Scan section, select the desired task (Full Scan, Critical Areas Scan, or
Custom Scan).

3. In the Security level section, click the Settings button for the task selected.

4. In the window that opens, on the Scope tab in the Scan optimization section, check the Skip objects
scanned longer than box and specify the scan duration for a single file.

SCANNING REMOVABLE DRIVES ON CONNECTION

Nowadays, malicious objects which use operating systems' vulnerabilities to replicate via networks and removable media
have become increasingly widespread. Kaspersky Anti-Virus allows you to scan removable drives when connecting them
to the computer.

To configure scanning of removable media on connection:

1. Open the application settings window.

2. In the left part of the window, in the Scan section, select General Settings.

3. In the Scan removable drives on connection section, select the action and define the maximum size of a
drive to be scanned in the field below, if necessary.

CREATING A TASK SHORTCUT

The application provides the option of creating shortcuts for the full, quick, and vulnerability scan tasks. This allows you
to start the required scan without opening the main application window or a context menu.

To create a shortcut to start a scan:

1. Open the application settings window.

2. In the left part of the window, in the Scan section, select General Settings.

3. In the right part of the window, in the Scan tasks quick run section, click the Create shortcut button next to
the name of the desired task (Critical Areas Scan, Full Scan, or Vulnerability Scan).

4. Specify the path for saving the shortcut and its name in the window that opens. By default, the shortcut is
created with the name of the task in the My Computer folder of the current computer user.

U S E R G U I DE

72

VULNERABILITY SCAN

Vulnerabilities may appear in the operating system, for example, due to programming errors, insecure passwords, or
actions of malicious programs. When performing the vulnerability scan, the application refers to various security
procedures, for example, examining the system, analyzing the settings of the operating system and the browser, and
searching for vulnerable services.

The diagnostics may take some time. When it is complete, detected problems are analyzed from the standpoint of the
danger they pose to the system.

After the vulnerability scan task is started (see page 47), its run progress is displayed in the Scan window (in the
Vulnerability Scan section) and in the Task Manager (see section "Managing scan tasks. Task Manager" on page 72).

Information about results of the vulnerability scan task run is recorded in a report of Kaspersky Anti-Virus (see page 117).

As with virus scan tasks, you can set a startup schedule for a vulnerability scan task, create a list of objects to scan (see
page 67), specify an account (see section "Running a scan under a different user account" on page 69) and create a
shortcut for quick start of the task. By default, the applications already installed on the computer are selected as scan
objects.

MANAGING SCAN TASKS. TASK MANAGER

Task Manager displays information about last scan tasks that have been run or that are currently running (for example,
virus scan, vulnerability scan, rootkit scan, or advanced disinfection).

You can use Task Manager to view the progress and the result of a task run, or stop a task. For some tasks, additional
actions are also available (for example, on completion of vulnerability scan, you can open the list of detected
vulnerabilities and fix them).

To open Task Manager:

1. Open the main application window.

2. In the bottom part of the window, select the Scan section.

3. In the Scan window that opens, click the Manage Tasks button in the top right corner of the window.

UPDATE

Updating the databases and program modules of Kaspersky Anti-Virus ensures up-to-date protection for your computer.
New viruses, Trojans, and other types of malware appear worldwide on a daily basis. Information about threats and ways
of neutralizing them is provided by Kaspersky Anti-Virus databases. For timely detection of new threats, you should
update databases and application modules on a regular basis.

Regular updates require an active license for application usage. If no license is installed, you can perform an update only
once.

When performing an update, the application downloads and installs the following objects on your computer:

Kaspersky Anti-Virus databases.

Protection of information is ensured by databases containing threat signatures, descriptions of network attacks,
and information about how to resist them. Protection components use this information to search for and disinfect
dangerous objects on your computer. The databases are supplemented every hour with records of new threats
and ways to fight them. Therefore, you are strongly advised to update databases on a regular basis.

In addition to the Kaspersky Anti-Virus databases, the network drivers that enable the application's components
to intercept network traffic are updated.

A D V A N C E D A P P L I C A T I O N S E T T I N G S

73

IN THIS SECTION:

Selecting an update source ............................................................................................................................................. 73

Creating the update startup schedule ............................................................................................................................. 75

Rolling back the last update ............................................................................................................................................ 76

Running updates under a different user account ............................................................................................................. 76

Using a proxy server ....................................................................................................................................................... 76

Application modules.

In addition to the Kaspersky Anti-Virus databases, you can also update the program modules. The updates for
the application modules fix Kaspersky Anti-Virus vulnerabilities and supplement or improve the existing
functionality.

During an update, the application modules and databases on your computer are compared with the up-to-date version at
the update source. If your current databases and application modules differ from those in the current version of the
application, the missing portion of the updates will be installed on your computer.

If the databases are outdated, the update package may be large, which may cause additional Internet traffic (up to
several dozen MB).

Prior to updating the databases, Kaspersky Anti-Virus creates backup copies of them in case you want to return to the
previous version of the databases (see section "Rolling back the last update" on page 76).

Information about the current condition of Kaspersky Anti-Virus databases is displayed in the Update section of the main
application window.

Information on the update results and events which occurred during the execution of the update task is logged in a
Kaspersky Anti-Virus report (see page 117).

You can select an update source (see section "Selecting an update source" on page 73) and configure the automatic
update startup.

SELECTING AN UPDATE SOURCE

An update source is a resource containing updates for databases and application modules of Kaspersky Anti-Virus.

The main update sources are the Kaspersky Lab update servers, where database updates and application module
updates for all Kaspersky Lab products are stored.

Your computer should be connected to the Internet for successful downloading of updates from our servers. By default,
the Internet connection settings are determined automatically. If you use a proxy server, you may need to adjust the
connection settings (see section "Configuring the proxy server" on page 102).

When updating Kaspersky Anti-Virus, you can copy database and program module updates received from Kaspersky
Lab servers into a local folder (see section "Updating the application from a shared folder" on page 74) and then provide
access to other networked computers. This saves Internet traffic.

If you do not have access to Kaspersky Lab's update servers (for example, Internet access is restricted), you can call the
Kaspersky Lab headquarters (http://www.kaspersky.com/contacts) to request the contact information of Kaspersky Lab
partners who can provide you with updates on removable media.

When ordering updates on removable media, please specify whether you also require updates for the application
modules.

U S E R G U I DE

74

ADDING AN UPDATE SOURCE

By default, the list of update sources contains only Kaspersky Lab's update servers. You can add a local folder or a
different server as update source. If several resources are selected as update sources, Kaspersky Anti-Virus tries to
connect to them one after another, starting from the top of the list, and retrieves updates from the first available source.

To add an update source:

1. Open the application settings window.

2. In the left part of the window, in the Update section, select the Update Settings component.

3. Click the Update source button in the right part of the window.

4. In the window that opens, on the Source tab, open the selection window by clicking the Add button.

5. In the Select update source window that opens, select the folder that contains the updates, or enter an
address in the Source field to specify the server from which the updates should be downloaded.

SELECTING THE UPDATE SERVER REGION

If you use Kaspersky Lab servers as the update source, you can select the optimal server location when downloading
updates. Kaspersky Lab servers are located in several countries.

Using the closest Kaspersky Lab update server allows you to reduce the time required for receiving updates and
increase operation performance speed. By default, the application uses information about the current region from the
operating system's registry. You can select the region manually.

To select the server region:

1. Open the application settings window.

2. In the left part of the window, in the Update section, select the Update Settings component.

3. Click the Update source button in the right part of the window.

4. In the window that opens, on the Source tab in the Regional settings section, select the Select from the list
option, and then select the country nearest to your current location from the dropdown list.

UPDATING THE APPLICATION FROM A SHARED FOLDER

To save Internet traffic, you can configure updates of Kaspersky Anti-Virus from a shared folder when updating the
application on networked computers. If you do this, one of the networked computers receives an update package from
Kaspersky Lab servers or from another web resource that contains the required set of updates. The updates received
are copied into a shared folder. Other networked computers access this folder to receive updates for Kaspersky Anti­Virus.

When logged on under a guest account in Microsoft Windows 7, updates are not copied into the shared folder. It is
recommended that you log on under a different account in order to allow copying updates.

To enable update distribution mode:

1. Open the application settings window.

2. In the left part of the window, in the Update section, select the Update Settings component.

3. Check the Copy updates to folder box in the Additional section and specify the path to a public folder where
all downloaded updates will be copied in the field below. You can also select a folder by clicking the Browse
button.

A D V A N C E D A P P L I C A T I O N S E T T I N G S

75

To download updates for your computer from a specified shared folder:

1. Open the application settings window.

2. In the left part of the window, in the Update section, select the Update Settings component.

3. Click the Update source button in the right part of the window.

4. In the window that opens, on the Source tab, open the selection window by clicking the Add button.

5. In the Select update source window that opens, select a folder or enter the full path to it in the Source field.

6. On the Source tab uncheck the Kaspersky Lab update servers box.

CREATING THE UPDATE STARTUP SCHEDULE

You can create a schedule to automatically start an update task: specify the frequency, start time (if necessary), and
advanced settings.

If it is not possible to start the task for any reason (for example, the computer was not on at that time), you can configure
the skipped task to start automatically as soon as it becomes possible.

You can also postpone automatic startup of the task after the application is started. Note that all scheduled tasks will be
run only after a specified time interval elapses from the startup of Kaspersky Anti-Virus.

The special Idle Scan mode (see section "Running tasks in background mode" on page 107) allows you to start
automatic updates when your computer is idle.

To configure the update task startup schedule:

1. Open the application settings window.

2. In the left part of the window, in the Update section, select the Update Settings component.

3. Click the Run mode button in the right part of the window.

4. In the window that opens, on the Run mode tab in the Schedule section, select the By schedule option and
configure the update run mode.

To enable automatic launching of a skipped task:

1. Open the application settings window.

2. In the left part of the window, in the Update section, select the Update Settings component.

3. Click the Run mode button in the right part of the window.

4. In the window that opens, on the Run mode tab in the Schedule section, select By schedule and check the
Run skipped tasks box.

To postpone running a task after application startup:

1. Open the application settings window.

2. In the left part of the window, in the Update section, select the Update Settings component.

3. Click the Run mode button in the right part of the window.

4. In the window that opens, on the Run mode tab in the Schedule section, select the By schedule option and fill
in the Postpone running after application startup for field to specify how long the task run should be
postponed.

U S E R G U I DE

76

ROLLING BACK THE LAST UPDATE

After the first update of Kaspersky Anti-Virus, the option of rolling back to the previous databases becomes available.

The update rollback feature is useful in case a new database version contains an invalid signature that makes Kaspersky
Anti-Virus block a safe application.

In the event of damage done to Kaspersky Anti-Virus databases, it is recommended that you run the update task to
download the up-to-date set of databases.

To roll back to the previous database version:

1. Open the main application window.

2. Select the Update section in the lower part of the window.

3. In the Update window that opens, click the button and select Roll back to the previous databases from
the menu that opens.

RUNNING UPDATES UNDER A DIFFERENT USER ACCOUNT

By default, the update procedure is run under your system account. However, Kaspersky Anti-Virus can update from a
source for which you have no access rights (for example, from a network folder containing updates) or authorized proxy
user credentials. You can run Kaspersky Anti-Virus updates on behalf of a user account that has such rights.

To start the update under a different user's account:

1. Open the application settings window.

2. In the left part of the window, in the Update section, select the Update Settings component.

3. Click the Run mode button in the right part of the window.

4. In the window that opens, on the Run mode tab in the User account section, check the Run task as box.
Specify the user name and password.

USING A PROXY SERVER

If you use a proxy server for Internet connection, you should reconfigure it to allow proper updating of Kaspersky Anti­Virus.

To configure the proxy server:

1. Open the application settings window.

2. In the left part of the window, in the Update section, select the Update Settings component.

3. Click the Update source button in the right part of the window.

4. In the window that opens, on the Source tab, click the Proxy server button.

5. Configure the proxy server settings in the Proxy server settings window that opens.

A D V A N C E D A P P L I C A T I O N S E T T I N G S

77

IN THIS SECTION:

Enabling and disabling File Anti-Virus ............................................................................................................................. 78

Automatically pausing File Anti-Virus .............................................................................................................................. 78

Creating the protection scope of File Anti-Virus .............................................................................................................. 78

Changing and restoring the file security level .................................................................................................................. 80

Selecting file scan mode ................................................................................................................................................. 80

Using heuristic analysis when working with File Anti-Virus ............................................................................................. 80

Selecting file scan technology ......................................................................................................................................... 81

Changing the action to take on infected files ................................................................................................................... 81

Scan of compound files by File Anti-Virus ....................................................................................................................... 81

Optimizing file scan ................................ ......................................................................................................................... 82

FILE ANTI-VIRUS

File Anti-Virus prevents infection of the computer's file system. The component launches at the startup of the operating
system, remains in the RAM of the computer, and scans all files opened, saved, or run on your computer and on all
connected drives for viruses and other riskware.

You can create a protection scope and set a security level (a collection of settings that determine the scan's
thoroughness).

When the user or a program attempts to access a protected file, File Anti-Virus checks whether iChecker and iSwift
databases contain information about this file, and makes a decision on whether the file should be scanned.

By default, the signature analysis – a mode that uses records from application databases to search for threats – is
always enabled. You can also enable heuristic analysis and various scan technologies.

If a threat is detected in a file, Kaspersky Anti-Virus assigns one of the following statuses to the file:

Status designating the type of the malicious program detected (for example, virus, Trojan).

Potentially infected (suspicious) status if the scan cannot determine whether the file is infected or not. The file

may contain a code sequence typical of viruses and other malware, or the modified code of a known virus.

After that, the application displays a notification (see page 122) of the detected threat on the screen and performs the
action specified in the File Anti-Virus settings. You can change the action (see page 81) that the application should
perform if a threat is detected.

If you are working in automatic mode (see section "Selecting a protection mode" on page 63), when dangerous objects
are detected, Kaspersky Anti-Virus automatically applies the actions recommended by Kaspersky Lab specialists. For
malicious objects, this action is Disinfect. Delete if disinfection fails, for suspicious objects – Move to Quarantine. If
dangerous objects are detected when working in interactive mode (see section "Selecting a protection mode" on
page 63), the application displays a notification on the screen that you can use to select the required action the list of
available ones.

Before attempting to disinfect or delete an infected object, Kaspersky Anti-Virus creates a backup copy for subsequent
restoration or disinfection. Suspicious (potentially infected) objects are quarantined. You can enable automatic scanning
of quarantined objects after each update.

U S E R G U I DE

78

ENABLING AND DISABLING FILE ANTI-VIRUS

By default, File Anti-Virus is enabled, running in a mode recommended by Kaspersky Lab specialists. You can disable
File Anti-Virus if necessary.

To disable File Anti-Virus:

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the File Anti-Virus component.

3. In the right part of the window, uncheck the Enable File Anti-Virus box.

AUTOMATICALLY PAUSING FILE ANTI-VIRUS

When doing resource-intensive work, you can pause File Anti-Virus. To reduce workload and ensure quick access to
objects, you can configure automatic pausing of the component at a specified time or when handling specified programs.

Pausing File Anti-Virus in case of a conflict with some applications is an emergency measure. If any conflicts arise when
working with the component, please contact Kaspersky Lab Technical Support Service (http://support.kaspersky.com).
The support specialists will help you resolve the simultaneous operation of Kaspersky Anti-Virus with other applications
on your computer.

To pause the component at a specified time:

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the File Anti-Virus component.

3. In the Security level section in the right part of the window click the Settings button.

4. In the window that opens, on the Additional tab in the Pause task section, check the By schedule box and
click the Schedule button.

5. In the Pause task window, specify the time (in 24-hour hh:mm format) for which protection will be paused (the
Pause task at and Resume task at fields).

To pause the component when running specified applications:

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the File Anti-Virus component.

3. In the Security level section in the right part of the window click the Settings button.

4. In the window that opens, on the Additional tab in the Pause task section, check the At application startup
box and click the Select button.

5. In the Applications window, create a list of applications which pause the component when running.

CREATING THE PROTECTION SCOPE OF FILE ANTI-VIRUS

The protection scope implies the location and type of files being scanned. By default, Kaspersky Anti-Virus scans only
potentially infectable files stored on any hard drive, network drive or removable media.

A D V A N C E D A P P L I C A T I O N S E T T I N G S

79

To create the protection scope:

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the File Anti-Virus component.

3. Click the Settings button in the right part of the window.

4. In the window that opens, on the General tab, in the File types section, specify the type of files that you want to
be scanned by File Anti-Virus:

If you want to scan all files, select All files.

If you want to scan files of formats that are the most vulnerable to infection, select Files scanned by

format.

If you want to scan files with extensions that are the most vulnerable to infection, select Files scanned by

extension.

When selecting type of files to be scanned, you should note that:

The probability of malicious code penetrating some file formats (such as TXT) and its subsequent activation

is quite low. However, there are formats that contain or may contain an executable code (such as EXE,
DLL, DOC). The risk of penetration and activation of malicious code in such files is quite high.

A hacker may send a virus or other riskware to your computer within an executable file renamed as one

with the TXT extension. If you have selected scanning files by extension, such a file is skipped by the scan.
If scanning of files by format is selected, then, regardless of the extension, File Anti-Virus will analyze the
file header and reveal that the file is an EXE file. Such file is thoroughly scanned for viruses and other
riskware.

5. In the Protection scope list, perform one of the following actions:

If you want to add a new object to the list of objects to be scanned, click the Add link.

If you want to change an object's location, select one from the list and click the Edit link.

The Select object to scan window opens.

If you want to delete an object from the list of objects to be scanned, select one from the list and click the

Delete link.

The deletion confirmation window opens.

6. Perform one of the following actions:

If you want to add a new object to the list of objects to be scanned, select one in the Select object to scan

window and click the OK button.

If you want to change an object's location, edit the path to one in the Object field in the Select object to

scan window and click the OK button.

If you want to delete an object from the list of objects to be scanned, click the Yes button in the deletion

confirmation window.

7. If necessary, repeat steps 6 – 7 to add, relocate, or delete objects from the list of objects to be scanned.

8. To exclude an object from the list of objects to be scanned, uncheck the box next to one in the Protection
scope list. However, the object remains on the list of objects to be scanned, though it is excluded from the scan
by File Anti-Virus.

U S E R G U I DE

80

CHANGING AND RESTORING THE FILE SECURITY LEVEL

Depending on your current needs, you can select one of the preset file/memory security levels or configure File Anti­Virus on your own.

When configuring File Anti-Virus, you can always restore the recommended values. These settings are considered
optimal, recommended by Kaspersky Lab, and grouped in the Recommended security level.

To change the file security level:

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the File Anti-Virus component.

3. In the right part of the window, in the Security level section, set the desired security level, or click the Settings
button to modify the settings manually.

If you modify the settings manually, the name of the security level will change to Custom.

To restore the default file security level:

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the File Anti-Virus component.

3. Click the Default level button in the Security level section in the right part of the window.

SELECTING FILE SCAN MODE

A scan mode means a condition, under which File Anti-Virus starts scanning files. By default, Kaspersky Anti-Virus runs
in smart mode. When running in this file scan mode, File Anti-Virus makes decisions on file scan based on the analysis
of actions that the user takes on files, and on the type of those files. For example, when working with a Microsoft Office
document, Kaspersky Anti-Virus scans the file when it is first opened and last closed. Intermediate operations that
overwrite the file do not cause it to be scanned.

To change the files scan mode:

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the File Anti-Virus component.

3. In the Security level section in the right part of the window click the Settings button.

4. In the window that opens, on the Additional tab in the Scan mode section, select the desired mode.

When selecting scan mode, you should take account of the types of files, with which you have to work with the
majority of time.

USING HEURISTIC ANALYSIS WHEN WORKING WITH FILE ANTI-VIRUS

During File Anti-Virus operation, signature analysis is always used: Kaspersky Anti-Virus compares the object found with
the database records.

To improve protection efficiency, you can use heuristic analysis (i.e., analysis of activity that an object performs in the
system). This analysis makes it possible to detect new malicious objects which are not yet described in the databases.

A D V A N C E D A P P L I C A T I O N S E T T I N G S

81

To enable heuristic analysis:

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the File Anti-Virus component.

3. In the Security level section in the right part of the window click the Settings button.

4. In the window that opens, on the Performance tab in the Scan methods section, check the Heuristic Analysis
box and specify the detail level for the scan.

SELECTING FILE SCAN TECHNOLOGY

In addition to the heuristic analysis, you can involve specific technologies that allow optimizing the file scan performance
due to excluding files from scan if they have not been modified since the last scan.

To specify the object scan technologies:

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the File Anti-Virus component.

3. In the Security level section in the right part of the window click the Settings button.

4. In the window that opens, on the Additional tab in the Scan technologies section, select the desired values.

CHANGING THE ACTION TO TAKE ON INFECTED FILES

If infected objects are detected, the application performs the selected action.

To change the action that should be taken on infected objects:

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the File Anti-Virus component.

3. In the right part of the window, select the desired option in the Action on threat detection section.

SCAN OF COMPOUND FILES BY FILE ANTI-VIRUS

A common method of concealing viruses is to embed them into compound files: archives, installation packages,
embedded OLE objects, and mail file formats. To detect viruses that are hidden in this way, a compound file should be
unpacked, which can significantly decrease scanning speed.

For each type of compound file, you can choose to scan either all files or only new ones. To make your selection, click
the link next to the name of the object. It changes its value when you left-click it. If you select the scan new and changed
files only mode, the links for choosing whether to scan all or only new files will not be available.

By default, Kaspersky Anti-Virus scans only embedded OLE objects.

When large compound files are scanned, their preliminary unpacking may take a long time. This period can be reduced
by enabling unpacking of compound files in background mode if they exceed the specified file size. If a malicious object
is detected while working with such a file, the application will notify you about it.

You can restrict the maximum size of a compound file to be scanned. Compound files larger than the specified value will
not be scanned.

U S E R G U I DE

82

When large files are extracted from archives, they will be scanned even if the Do not unpack large compound files box
is checked.

To modify the list of compound files to be scanned:

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the File Anti-Virus component.

3. In the Security level section in the right part of the window click the Settings button.

4. In the window that opens, on the Performance tab in the Scan of compound files section, select the desired
type of compound files to be scanned.

To set the maximum size of compound files to be scanned:

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the File Anti-Virus component.

3. In the Security level section in the right part of the window click the Settings button.

4. In the window that opens, on the Performance tab in the Scan of compound files section, click the Additional
button.

5. In the Compound files window, check the Do not unpack large compound files box and specify the
maximum file size.

To unpack large compound files in background mode:

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the File Anti-Virus component.

3. In the Security level section in the right part of the window click the Settings button.

4. In the window that opens, on the Performance tab in the Scan of compound files section, click the Additional
button.

5. In the Compound files window, check the Extract compound files in the background box and specify the
minimum file size.

OPTIMIZING FILE SCAN

You can shorten the scan time and speed up Kaspersky Anti-Virus. This can be achieved by scanning only new files and
those files that have altered since the last time they were scanned. This mode applies both to simple and compound
files.

To scan only new and changed files:

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the File Anti-Virus component.

3. Click the Settings button in the right part of the window.

4. In the window that opens, on the Performance tab in the Scan optimization section, check the Scan only new
and changed files box.

A D V A N C E D A P P L I C A T I O N S E T T I N G S

83

MAIL ANTI-VIRUS

Mail Anti-Virus scans incoming and outgoing messages for malicious objects. It starts when the operating system
launches and runs continually, scanning all email messages sent or received via the POP3, SMTP, IMAP, MAPI and
NNTP protocols, as well as over secure connections (SSL) via POP3 and IMAP (see section "Encrypted connections
scan" on page 100).

The indicator of the component's operation is the application icon in the taskbar notification area, which looks like
whenever an email message is being scanned.

Mail Anti-Virus intercepts and scans each email message received or sent by the user. If no threats are detected in an
email message, it becomes available for the user.

You can specify the types of messages which should be scanned and select the security level (see page 85)
(configuration settings affecting the scan intensity).

By default, the signature analysis – a mode that uses records from application databases to search for threats – is
always enabled. In addition, you can enable heuristic analysis. Furthermore, you can enable filtering of attachments (see
page 86), which allows automatic renaming or deletion of specified file types.

If a threat is detected in a file, Kaspersky Anti-Virus assigns one of the following statuses to the file:

Status designating the type of the malicious program detected (for example, virus, Trojan).

Potentially infected (suspicious) status if the scan cannot determine whether the file is infected or not. The file

may contain a code sequence typical of viruses and other malware, or the modified code of a known virus.

After that, the application blocks the email message, displays a notification (see page 122) of the detected threat on the
screen, and performs the action specified in the settings of Mail Anti-Virus. You can change the actions to be taken when
a threat is detected (see section "Changing the action to take on infected email messages" on page 86).

If you are working in automatic mode (see section "Selecting a protection mode" on page 63), when dangerous objects
are detected, Kaspersky Anti-Virus automatically applies the actions recommended by Kaspersky Lab specialists. For
malicious objects, this action is Disinfect. Delete if disinfection fails, for suspicious objects – Move to Quarantine. If
dangerous objects are detected when working in interactive mode (see section "Selecting a protection mode" on
page 63), the application displays a notification on the screen that you can use to select the required action the list of
available ones.

Before attempting to disinfect or delete an infected object, Kaspersky Anti-Virus creates a backup copy for subsequent
restoration or disinfection. Suspicious (potentially infected) objects are quarantined. You can enable automatic scanning
of quarantined objects after each update.

If disinfection is successful, the email message becomes available. If the disinfection fails, the infected object is deleted
from the email message. Mail Anti-Virus expands the subject of the email message by adding text that notifies the user
that this email message has been processed by Kaspersky Anti-Virus.

An integrated plug-in is provided for Microsoft Office Outlook that allows you to fine-tune the email client.

If you use The Bat!, Kaspersky Anti-Virus can be used in conjunction with other anti-virus applications. At that, the email
traffic processing rules are configured directly in The Bat! and have a higher priority than the mail protection settings of
Kaspersky Anti-Virus.

When working with other widespread mail clients, including Microsoft Outlook Express/Windows Mail, Mozilla
Thunderbird, Eudora, and Incredimail, Mail Anti-Virus scans email on the SMTP, POP3, IMAP, and NNTP protocols.

Note that when working with the Thunderbird mail client, email messages transferred via IMAP will not be scanned for
viruses if any filters moving messages from the Inbox folder are used.

U S E R G U I DE

84

IN THIS SECTION:

Enabling and disabling Mail Anti-Virus ............................................................................................................................ 84

Creating the protection scope of Mail Anti-Virus ............................................................................................................. 84

Changing and restoring the email security level .............................................................................................................. 85

Using heuristic analysis when working with Mail Anti-Virus............................................................................................. 85

Changing the action to take on infected email messages ............................................................................................... 86

Filtering attachments in email messages ........................................................................................................................ 86

Scan of compound files by Mail Anti-Virus ...................................................................................................................... 86

Email scanning in Microsoft Office Outlook ..................................................................................................................... 87

Email scanning in The Bat! .............................................................................................................................................. 87

ENABLING AND DISABLING MAIL ANTI-VIRUS

By default, Mail Anti-Virus is enabled, running in a mode recommended by Kaspersky Lab specialists. You can disable
Mail Anti-Virus if necessary.

To disable Mail Anti-Virus:

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the Mail Anti-Virus component.

3. In the right part of the window, uncheck the Enable Mail Anti-Virus box.

CREATING THE PROTECTION SCOPE OF MAIL ANTI-VIRUS

Protection scope comprises a type of email messages to be scanned, protocols with traffic scanned by Kaspersky Anti­Virus, and settings for integration of Mail Anti-Virus into the system.

By default, Kaspersky Anti-Virus is integrated into Microsoft Office Outlook and The Bat!, scans both incoming and
outgoing email messages, and scans traffic of POP3, SMTP, NNTP and IMAP email protocols.

To disable scanning of outgoing emails:

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the Mail Anti-Virus component.

3. Click the Settings button in the right part of the window.

4. Use the General tab in the Protection scope section of the displayed window to select the Incoming
messages only option.

If you have selected scanning incoming messages only, it is recommended that you scan outgoing mail when
first running Kaspersky Anti-Virus, since your computer may be infected with email worms that use your email to
breed and spread. Scanning outgoing mail allows you to avoid problems occurring due to uncontrolled sending
of email messages from your computer.

A D V A N C E D A P P L I C A T I O N S E T T I N G S

85

To select the protocols to scan and the settings for integrating Mail Anti-Virus into the system:

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the Mail Anti-Virus component.

3. Click the Settings button in the right part of the window.

4. In the window that opens, on the Additional tab in the Connectivity section, select the desired settings.

CHANGING AND RESTORING THE EMAIL SECURITY LEVEL

Depending on your current needs, you can select one of the preset email security levels or configure Mail Anti-Virus on
your own.

Kaspersky Lab advises you not to configure Mail Anti-Virus settings on your own. In most cases, it is sufficient to select a
different security level.

When configuring Mail Anti-Virus, you can always restore the recommended values. These settings are considered
optimal, recommended by Kaspersky Lab, and grouped in the Recommended security level.

To change the current email security level:

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the Mail Anti-Virus component.

3. In the right part of the window, in the Security level section, set the desired security level, or click the Settings
button to modify the settings manually.

If you modify the settings manually, the name of the security level will change to Custom.

To restore the default mail protection settings:

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the Mail Anti-Virus component.

3. Click the Default level button in the Security level section in the right part of the window.

USING HEURISTIC ANALYSIS WHEN WORKING WITH MAIL ANTI-VIRUS

During Mail Anti-Virus operation, signature analysis is always used: Kaspersky Anti-Virus compares the object found with
the database records.

To improve protection efficiency, you can use heuristic analysis (i.e., analysis of activity that an object performs in the
system). This analysis makes it possible to detect new malicious objects which are not yet described in the databases.

To enable heuristic analysis:

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the Mail Anti-Virus component.

U S E R G U I DE

86

3. In the Security level section in the right part of the window click the Settings button.

4. In the window that opens, on the General tab in the Scan methods section, check the Heuristic Analysis box
and specify the detail level for the scan.

CHANGING THE ACTION TO TAKE ON INFECTED EMAIL MESSAGES

If infected objects are detected, the application performs the selected action.

To change the action that should be taken on infected email messages:

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the Mail Anti-Virus component.

3. In the right part of the window, select the desired option in the Action on threat detection section.

FILTERING ATTACHMENTS IN EMAIL MESSAGES

Malicious programs may spread via email as attachments in email messages. You can configure filtering by type of
attachments in email messages, which allows the renaming or deleting files of specified types automatically.

To configure filtering of attachments:

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the Mail Anti-Virus component.

3. Click the Settings button in the right part of the window.

4. Use the Attachment filter tab of the displayed window to select the filtering mode for attachments. When you
select either of the last two modes, the list of file types (extensions) will be enabled; there you can select the
desired types or add a new type mask.

To add a mask of a new type to the list, click the Add link to open the Input file name mask window and enter
the required information.

SCAN OF COMPOUND FILES BY MAIL ANTI-VIRUS

A common method of concealing viruses is to embed them into compound files: archives, installation packages,
embedded OLE objects, and mail file formats. To detect viruses that are hidden in this way, a compound file should be
unpacked, which can significantly decrease scanning speed.

You can enable or disable scanning of compound files, and limit the maximum size of compound files to be scanned.

If your computer is not protected by any local network software (you access the Internet directly without a proxy server or
a firewall), it is not recommended that you disable the scanning of compound files.

To configure the scanning of compound files:

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the Mail Anti-Virus component.

A D V A N C E D A P P L I C A T I O N S E T T I N G S

87

3. Click the Settings button in the right part of the window.

4. Use the General tab in the window that opens to define the necessary settings.

EMAIL SCANNING IN MICROSOFT OFFICE OUTLOOK

While installing Kaspersky Anti-Virus, a special plug-in is integrated into Microsoft Office Outlook. It allows you to quickly
switch to configuration of Mail Anti-Virus from Microsoft Office Outlook, and determine when email messages should be
scanned for viruses and other riskware, whether this should be done when receiving, opening, or sending a message.

Configuration of Mail Anti-Virus from Microsoft Office Outlook is available if this option is selected in the protection scope
settings of Mail Anti-Virus.

To switch to the email scan settings in Microsoft Office Outlook:

1. Open the main Microsoft Office Outlook window.

2. Select Tools Options from the application menu.

3. In the Settings window that opens, select the Email protection tab.

EMAIL SCANNING IN THE BAT!

Actions with regard to infected email objects in The Bat! are defined using the application's own tools.

Mail Anti-Virus settings which determine whether incoming and outgoing messages should be scanned, which actions
should be performed in regard to dangerous objects in email, and which exclusions should apply are ignored. The only
thing that The Bat! takes into account is the scanning of attached archives.

The email protection settings extend to all the anti-virus components installed on the computer that support working with
the Bat!.

Note that incoming email messages are first scanned by Mail Anti-Virus and only then by the plug-in for The Bat!. If a
malicious object is detected, Kaspersky Anti-Virus immediately notifies you of this. If you select the Disinfect (Delete)
action in the Mail Anti-Virus notification window, actions aimed at eliminating the threat are performed by Mail Anti-Virus.
If you select the Ignore option in the notification window, the object will be disinfected by the plug-in for The Bat!. When
sending email messages, they are first scanned by the plug-in and then by Mail Anti-Virus.

The settings of Mail Anti-Virus are available from The Bat! if this option is selected in the protection scope settings of Mail
Anti-Virus.

To configure email scanning in The Bat! you must define the following criteria:

which mail stream (incoming, outgoing) should be scanned;

when mail objects should be scanned (when opening a message, before saving to disk);

what actions are to be performed by the mail client if dangerous objects are detected in email messages. For

example, you can select:

Attempt to disinfect infected parts – if this option is selected, the attempt is made to disinfect the infected

object; if it cannot be disinfected, the object remains in the message.

Delete infected parts – if this option is selected, the dangerous object in the message is deleted

regardless of whether it is infected or suspected to be infected.

U S E R G U I DE

88

By default, The Bat! places all infected email objects in Quarantine without attempting to disinfect them.

Email messages that contain dangerous objects are not marked with the special subject add-on when scanned by the
plug-in for The Bat!.

To switch to the email scan settings in The Bat!:

1. Open the main window of the The Bat!.

2. In the Properties menu, select Settings.

3. Select the Virus protection object from the settings tree.

WEB ANTI-VIRUS

Each time you work on the Internet, you endanger information stored on your computer, by exposing it to a risk of being
infected with viruses and other malware. They may penetrate your computer when you download free applications or
view information on websites that had been attacked by hackers before you have visited them. Moreover, network worms
may penetrate into your computer even before you open a web page or download a file, just at the moment your
computer establishes an Internet connection.

Web Anti-Virus protects information received by your computer and sent from it over HTTP, HTTPS and FTP protocols,
and prevents hazardous scripts from being run on your computer.

Web Anti-Virus only monitors web traffic transferred via ports specified on the list of monitored ports. A list of monitored
ports that are most commonly used for data transfer, is included in the Kaspersky Anti-Virus distribution kit. If you use
ports that are not included in the list of monitored ports, you should add them to the list of monitored ports (see section
"Creating a list of monitored ports" on page 102) to ensure protection of web traffic transferred via them.

Web Anti-Virus scans web traffic with regard for a specific collection of settings named security level. If Web Anti-Virus
detects a threat, it will perform the prescribed action. Malicious objects are detected using both Kaspersky Anti-Virus
databases and a heuristic algorithm.

Kaspersky Lab advises you not to configure Web Anti-Virus settings on your own. In most cases, it is sufficient to select
an appropriate security level.

Web traffic scan algorithm

Each web page or file that is accessed by the user or an application via the HTTP, HTTPS, or FTP protocols is
intercepted and scanned for malicious code by Web Anti-Virus:

If a web page or a file accessed by the user contains malicious code, access to it is blocked. A notification is

displayed that the requested file or web page is infected.

If the file or web page does not contain malicious code, the program immediately grants the user access to it.

Script scan algorithm

Each script run is intercepted by Web Anti-Virus and is analyzed for malicious code:

Web Anti-Virus intercepts only scripts based on the Microsoft Windows Script Host functionality.

If a script contains malicious code, Web Anti-Virus blocks it and displays a notification on the screen.

If no malicious code is discovered in the script, it is run.

A D V A N C E D A P P L I C A T I O N S E T T I N G S

89

IN THIS SECTION:

Enabling and disabling Web Anti-Virus ........................................................................................................................... 89

Changing and restoring the web traffic security level ...................................................................................................... 89

Changing the action to take on dangerous objects from web traffic ................................................................................ 90

Checking URLs on web pages ........................................................................................................................................ 90

Using heuristic analysis when working with Web Anti-Virus ............................................................................................ 92

Blocking dangerous scripts ............................................................................................................................................. 92

Scan optimization ............................................................................................................................................................ 93

Creating a list of trusted addresses ................................................................................................................................. 93

ENABLING AND DISABLING WEB ANTI-VIRUS

By default, Web Anti-Virus is enabled, running in a mode recommended by Kaspersky Lab specialists. You can disable
Web Anti-Virus, if necessary.

To disable Web Anti-Virus:

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the Web Anti-Virus component.

3. In the right part of the window, uncheck the Enable Web Anti-Virus box.

CHANGING AND RESTORING THE WEB TRAFFIC SECURITY LEVEL

Depending on your current needs, you can select one of the preset web traffic security levels or configure Web Anti-Virus
on your own.

When configuring Web Anti-Virus, you can always restore the recommended values. These settings are considered
optimal, recommended by Kaspersky Lab, and grouped in the Recommended security level.

To change the web traffic security level:

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the Web Anti-Virus component.

3. In the right part of the window, in the Security level section, set the desired security level, or click the Settings
button to modify the settings manually.

If you modify the settings manually, the name of the security level will change to Custom.

To restore the default web traffic security level:

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the Web Anti-Virus component.

3. Click the Default level button in the Security level section in the right part of the window.

U S E R G U I DE

90

CHANGING THE ACTION TO TAKE ON DANGEROUS OBJECTS

IN THIS SECTION:

Enabling and disabling the checking of URLs ................................................................................................................. 90

Using Kaspersky URL Advisor ........................................................................................................................................ 91

FROM WEB TRAFFIC

If infected objects are detected, the application performs the selected action.

Web Anti-Virus always blocks actions by dangerous scripts and displays messages that inform the user of the action
taken. You cannot change the action to be taken on a dangerous script; all you can do is disable script scan (see section
"Blocking dangerous scripts" on page 92).

To change the action to be performed with regard to detected objects:

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the Web Anti-Virus component.

3. In the right part of the window, select the desired option in the Action on threat detection section.

CHECKING URLS ON WEB PAGES

Scanning web pages for phishing allows you to prevent phishing attacks. Phishing attacks are, as a rule, email
messages from alleged financial organizations that contain URLs to websites of such organizations. The email message
convinces the reader to click the URL and enter private information in the window that opens, for example, the number of
a banking card or the login and the password of an online banking account. A phishing attack can be disguised, for
example, as a letter from your bank with a link to its official website. By clicking the link, you go to an exact copy of the
bank's website and can even see the bank site's address in the browser, even though you are on a counterfeit site. From
this point forward, all your actions on the site are tracked and can be used to steal your money.

Since links to phishing web sites may be received not only in email, but also from other sources, such as ICQ messages,
Web Anti-Virus monitors attempts to access a phishing web site on the level of web traffic and blocks access to such
locations.

In addition to Kaspersky Anti-Virus databases, heuristic analysis (see page 92) can also be used for scanning web pages
for phishing.

ENABLING AND DISABLING THE CHECKING OF URLS

To enable URL checks using the databases of suspicious web addresses and phishing addresses:

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the Web Anti-Virus component.

3. Click the Settings button in the right part of the window.

The Web Anti-Virus window opens.

4. On the General tab, in the Kaspersky URL Advisor section, check the Check if URLs are listed in the
database of suspicious URLs and Check web pages for phishing boxes.

A D V A N C E D A P P L I C A T I O N S E T T I N G S

91

USING KASPERSKY URL ADVISOR

Kaspersky URL Advisor is integrated into Microsoft Internet Explorer, Mozilla Firefox, and Google Chrome as a plug-in.

Kaspersky URL Advisor checks all URLs on a web page to find out if they are included in the list of suspicious URLs. It
also checks them for phishing, highlighting each one in the browser window.

You can create a list of websites, on which all URLs should be checked, check URLs on all websites except those
included in the list of exclusions, check URLs in search results only, or specify categories of websites with URLs that
should be checked.

Not only can you configure Kaspersky URL Advisor in the application settings window, but also in the Kaspersky URL
Advisor settings window, which is available from your web browser.

To specify websites, on which all URLs should be checked:

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the Web Anti-Virus component.

3. Click the Settings button in the right part of the window.

4. The Web Anti-Virus window opens.

5. On the Safe Surf tab, in the Kaspersky URL Advisor section, check the Check URLs box.

6. Select the websites on which the links need to be scanned:
a. If you want to create a list of websites, on which all URLs should be checked, select Only websites from

the list and click the Specify button. In the Checked URLs window that opens, create a list of websites to
be checked.

b. If you want to check URLs on all websites except those specified, select All but the exclusions and click

the Exclusions button. In the Exclusions window that opens, create a list of websites that do not need any
check of URLs on them.

To check URLs in search results only:

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the Web Anti-Virus component.

3. Click the Settings button in the right part of the window.

4. The Web Anti-Virus window opens.

5. On the Safe Surf tab, in the Kaspersky URL Advisor section, check the Check URLs box and click the
Settings button.

6. In the Kaspersky URL Advisor settings window that opens, in the Check mode section, select Only URLs in
search results.

To select categories of websites with URLs that should be checked:

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the Web Anti-Virus component.

3. Click the Settings button in the right part of the window.

4. The Web Anti-Virus window opens.

U S E R G U I DE

92

5. On the Safe Surf tab, in the Kaspersky URL Advisor section, check the Check URLs box and click the
Settings button.

6. In the Kaspersky URL Advisor settings window that opens, in the Websites categories section, check the
Show information on the categories of websites content box.

7. In the list of categories, check the boxes next to categories of websites with URLs that should be checked.

To open the Kaspersky URL Advisor settings window from your web browser,

click the button with the Kaspersky Anti-Virus icon in the browser toolbar.

USING HEURISTIC ANALYSIS WHEN WORKING WITH WEB ANTI-VIRUS

To improve protection efficiency, you can use heuristic analysis (i.e., analysis of activity that an object performs in the
system). This analysis makes it possible to detect new malicious objects which are not yet described in the databases.

When Web Anti-Virus is running, you can separately enable the heuristic analysis for scanning web traffic and for
checking web pages for phishing.

To enable the heuristic analysis for scanning web traffic:

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the Web Anti-Virus component.

3. Click the Settings button in the right part of the window.

The Web Anti-Virus window opens.

4. On the General tab in the Heuristic Analysis section, check the Use Heuristic Analysis box and set a scan
detail level.

To enable the heuristic analysis for checking web pages for phishing:

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the Web Anti-Virus component.

3. Click the Settings button in the right part of the window.

The Web Anti-Virus window opens.

4. On the General tab, in the Kaspersky URL Advisor section, click the Additional button.

5. In the Anti-Phishing settings window that opens, check the Use Heuristic Analysis to check web pages for
phishing box and set a scan detail level.

BLOCKING DANGEROUS SCRIPTS

Web Anti-Virus scans all scripts processed in Microsoft Internet Explorer, as well as any other WSH scripts (for example,
JavaScript, Visual Basic Script, etc.) launched when you are working on the computer. If a script presents a threat to
your computer, it will be blocked.

A D V A N C E D A P P L I C A T I O N S E T T I N G S

93

To disable blocking of dangerous scripts:

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the Web Anti-Virus component.

3. Click the Settings button in the right part of the window.

The Web Anti-Virus window opens.

4. On the General tab in the Additional section uncheck the Block dangerous scripts in Microsoft Internet
Explorer box.

SCAN OPTIMIZATION

To improve efficiency of detection of malicious code, Web Anti-Virus uses the caching of fragments of objects coming
from the Internet. Using the caching, Web Anti-Virus scans objects only after they are received on the computer in their
entirety.

The caching increases the amount of time required to process objects and pass it to the user for further operations.
Caching can cause problems when downloading or processing large objects, as the connection with the HTTP client may
time out.

You can solve this problem using the option of limiting the caching of fragments of objects coming from the Internet.
Upon expiration of a certain time interval, each fragment of an object is passed to the user unscanned. When copying is
complete, the object will be scanned entirely. This allows us to reduce the amount of time required to pass objects to the
user and solving the problem with connection losses. The Internet security level is not reduced.

Lifting restrictions on the duration of web traffic caching leads to improved efficiency of virus scans, though it may slow
down access to objects.

To set or remove a time limit for fragment buffering:

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the Web Anti-Virus component.

3. Click the Settings button in the right part of the window.

The Web Anti-Virus window opens.

4. On the General tab, in the Additional section, check the Limit traffic caching time to 1 sec to optimize scan
box.

CREATING A LIST OF TRUSTED ADDRESSES

Web Anti-Virus does not scan web traffic for dangerous objects if it comes from trusted URLs.

To create a list of trusted web addresses:

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the Web Anti-Virus component.

3. Click the Settings button in the right part of the window.

The Web Anti-Virus window opens.

4. On the Trusted URLs tab, check the Do not scan web traffic from trusted URLs box.

U S E R G U I DE

94

5. Create a list of websites / web pages with content that you trust. To do this:

IN THIS SECTION:

Enabling and disabling IM Anti-Virus ................................................................................................ ............................... 94

Creating the protection scope of IM Anti-Virus ................................................................................................................ 95

Checking URLs in messages from IM clients .................................................................................................................. 95

Using heuristic analysis when working with IM Anti-Virus ............................................................................................... 95

a. Click the Add button.

The Address mask (URL) window will open.

b. Enter the address of a website / web page or the address mask of a website / web page.
c. Click the OK button.

A new record appears on the list of trusted URLs.

6. If necessary, repeat steps from a to c.

IM ANTI-VIRUS

IM Anti-Virus scans the traffic of instant messaging clients (so-called Internet pagers).

IM messages may contain links to suspicious websites and to websites used by hackers to organize phishing attacks.
Malicious programs use IM clients to send spam messages and links to programs (or the programs themselves) which
steal users' ID numbers and passwords.

Kaspersky Anti-Virus ensures safe operation of various instant messaging applications, including ICQ, MSN, AIM,
Yahoo! Messenger, Jabber, Google Talk, Mail.Ru Agent and IRC.

Some IM clients, such as Yahoo! Messenger and Google Talk, use encrypted connections. To scan the traffic generated
by those programs, you have to enable encrypted connections scanning (see page 100).

IM Anti-Virus intercepts messages and scans them for dangerous objects or URLs. You can select the types of
messages to scan and various scanning methods.

If threats are detected in a message, IM Anti-Virus replaces this message with a warning message for the user.

Files transferred via IM clients are scanned by the File Anti-Virus component (on page 77) when attempts are made to
save them.

ENABLING AND DISABLING IM ANTI-VIRUS

By default, IM Anti-Virus is enabled and functions in normal mode. You can disable IM Anti-Virus if necessary.

To disable IM Anti-Virus:

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the IM Anti-Virus component.

3. In the right part of the window, uncheck the Enable IM Anti-Virus box.

A D V A N C E D A P P L I C A T I O N S E T T I N G S

95

CREATING THE PROTECTION SCOPE OF IM ANTI-VIRUS

The protection scope is the type of messages to be scanned. By default, Kaspersky Anti-Virus scans both incoming and
outgoing messages. If you are sure that messages you send cannot contain any dangerous objects, you may disable
scanning of outgoing traffic.

To disable scanning of outgoing messages:

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the IM Anti-Virus component.

3. In the right part of the window, in the Protection scope section, select the Incoming messages only option.

CHECKING URLS IN MESSAGES FROM IM CLIENTS

To scan messages for suspicious and phishing URLs:

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the IM Anti-Virus component.

3. In the right part of the window, in the Scan methods section, check the Check if URLs are listed in the
database of suspicious URLs and Check if URLs are listed in the database of phishing URLs boxes.

USING HEURISTIC ANALYSIS WHEN WORKING WITH IM ANTI-VIRUS

To improve protection efficiency, you can use heuristic analysis (i.e., analysis of activity that an object performs in the
system). This analysis makes it possible to detect new malicious objects which are not yet described in the databases.

When using heuristic analysis, any script included in an IM client's message is executed in a protected environment. If
the script's activity is typical of malicious objects, the object is likely to be classed as malicious or suspicious. By default,
heuristic analysis is enabled.

To enable heuristic analysis:

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the IM Anti-Virus component.

3. In the right part of the window, in the Scan methods section, check the Heuristic Analysis box and set the
necessary scanning intensity level.

PROACTIVE DEFENSE

Proactive Defense protects your computer against new threats which are not yet included in Kaspersky Anti-Virus
databases.

The functioning of Proactive Defense is based on proactive technologies. Proactive technologies allow you to neutralize
a new threat before it does any harm to your computer. Unlike responsive technologies, which analyze code based on
records in Kaspersky Anti-Virus databases, preventative technologies recognize a new threat on your computer by the
sequence of actions executed by a program. If, as a result of activity analysis, the sequence of an application's actions
arouses suspicion, Kaspersky Anti-Virus blocks the activity of this application.

For example, when actions such as a program copying itself to network resources, the startup folder and the system
registry are detected, it is highly likely that this program is a worm.

U S E R G U I DE

96

Hazardous sequences of actions also include attempts to modify the HOSTS file, hidden installation of drivers, etc. You

IN THIS SECTION:

Enabling and disabling Proactive Defense ...................................................................................................................... 96

Creating a group of trusted applications .......................................................................................................................... 96

Using the dangerous activity list ...................................................................................................................................... 97

Changing the action to be taken on applications' dangerous activity .............................................................................. 97

can turn off monitoring (see page 97) for any hazardous activity or edit its monitoring rules (see page 97).

You can create a group of trusted applications (see page 96) for Proactive Defense. You will not be notified of the
activities of these applications.

If your computer runs under Microsoft Windows XP Professional x64 Edition, Microsoft Windows Vista, Microsoft
Windows Vista x64, Microsoft Windows 7, or Microsoft Windows 7 x64, control will not apply to all events. This is due to
specific features of these operating systems. For example, control will not apply fully to the sending of data through
trusted applications and suspicious system activities.

ENABLING AND DISABLING PROACTIVE DEFENSE

By default, Proactive Defense is enabled, running in a mode recommended by Kaspersky Lab specialists. You can
disable Proactive Defense if necessary.

To disable Proactive Defense:

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the Proactive Defense component.

3. In the right part of the window, uncheck the Enable Proactive Defense box.

CREATING A GROUP OF TRUSTED APPLICATIONS

You can create a group of trusted applications exerting activity that should not be controlled by Proactive Defense. By
default, the list of trusted applications includes applications with verified digital signatures and applications that are
trusted in the Kaspersky Security Network database.

To change the settings of the trusted applications group:

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the Proactive Defense component.

3. In the right part of the window, in the Trusted applications section, perform the following actions:

If you want applications with verified digital signatures to be included in the group of trusted applications,

check the Applications with digital signature box.

If you want applications trusted by the Kaspersky Security Network database to be included in the group of

trusted applications, check the Trusted in Kaspersky Security Network database box.

A D V A N C E D A P P L I C A T I O N S E T T I N G S

97

USING THE DANGEROUS ACTIVITY LIST

The list of actions typical of dangerous activity cannot be edited. However, you can refuse to control a selected case of
dangerous activity.

To turn off monitoring for one dangerous activity or another:

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the Proactive Defense component.

3. Click the Settings button in the right part of the window.

4. In the Proactive Defense window that opens, uncheck the box next to the type of activity which you do not want
to be monitored.

CHANGING THE ACTION TO BE TAKEN ON APPLICATIONS'

DANGEROUS ACTIVITY

The list of actions typical of dangerous activity cannot be edited. However, you can change the action that Kaspersky
Anti-Virus takes when applications' dangerous activity is detected.

To change the action that Kaspersky Lab application takes on dangerous activity of another application:

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the Proactive Defense component.

3. Click the Settings button in the right part of the window.

4. In the Proactive Defense window that opens, in the Event column, select the desired event for which you want
to edit the rule.

5. Configure the settings for the selected event using the links in the Rule description section. For example:

a. Click the link with the preset action and select the desired action in the Select action window that opens.

b. Click the On / Off link to indicate that a report on operation execution should be created.

SYSTEM WATCHER

System Watcher collects data about application actions on your computer and provides information to other components
for improved protection.

Based on information collected by System Watcher, Kaspersky Anti-Virus can roll back actions performed by malicious
programs.

Rolling back actions performed by malicious programs can be initiated by one of the following protection components:

System Watcher - based on patterns of dangerous activity;

Proactive Defense;

File Anti-Virus;

when performing a virus scan.

U S E R G U I DE

98

If suspicious events are detected in the system, Kaspersky Anti-Virus protection components can request additional

IN THIS SECTION:

Enabling and disabling System Watcher ......................................................................................................................... 98

Using patterns of dangerous activity (BSS) ..................................................................................................................... 98

Rolling back a malicious program's actions ................................................................................................ ..................... 99

information from System Watcher. In interactive protection mode of Kaspersky Anti-Virus (see section "Selecting a
protection mode" on page 63), you can view data collected by the System Watcher component and presented as a report
on dangerous activity history. This data can help you make a decision when selecting an action in the notification
window. When the component detects a malicious program, the link to the System Watcher's report is displayed in the
top part of the notification window (see page 146), along with a prompt for action.

ENABLING AND DISABLING SYSTEM WATCHER

By default, System Watcher is enabled, running in a mode recommended by Kaspersky Lab specialists. You can disable
System Watcher if necessary.

You are advised not to disable the component unless it is absolutely necessary, since this inevitably decreases the
efficiency of Proactive Defense and other protection components that may request data collected by System Watcher in
order to identify the potential threat detected.

To disable System Watcher:

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the System Watcher component.

3. In the right part of the window, uncheck the Enable System Watcher box.

USING PATTERNS OF DANGEROUS ACTIVITY (BSS)

Patterns of dangerous activity (BSS – Behavior Stream Signatures) contain sequences of actions typical of applications
classified as dangerous. If an application's activity matches a pattern of dangerous activity, Kaspersky Anti-Virus
performs the prescribed action.

To provide real-time effective protection, Kaspersky Anti-Virus adds patterns of dangerous activity, which are used by
System Watcher, during the database updates.

By default, when Kaspersky Anti-Virus is running in automatic mode, if an application's activity matches a pattern of
dangerous activity, System Watcher moves this application to Quarantine. When running in interactive mode, System
Watcher prompts for action. You can specify the action that the component should perform when an application's activity
matches a pattern of dangerous activity.

In addition to exact matches between applications' activities and patterns of dangerous activity, System Watcher also
detects actions that partly match patterns of dangerous activity and are considered suspicious based on the heuristic
analysis. If suspicious activity is detected, System Watcher prompts for action regardless of the operation mode.

To select the action that the component should perform if an application's activity matches a pattern of dangerous

activity:

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the System Watcher component.

A D V A N C E D A P P L I C A T I O N S E T T I N G S

99

IN THIS SECTION:

Encrypted connections scan ......................................................................................................................................... 100

Configuring the proxy server ......................................................................................................................................... 102

Creating a list of monitored ports .................................................................................................................................. 102

3. In the right part of the window, in the Heuristic Analysis section, check the Use updatable patterns of
dangerous activity (BSS) box.

4. Click Select action and then specify the desired action on the dropdown list.

ROLLING BACK A MALICIOUS PROGRAM'S ACTIONS

You can use the option of rolling back the actions performed by malware in the system. To enable a rollback, System
Watcher logs the history of program activity. You can limit the volume of information that System Watcher stores for a
rollback.

By default, Kaspersky Anti-Virus rolls back relevant operations automatically when the protection components detect
malicious activity. When running in interactive mode, System Watcher prompts for action. You can specify an action that
should be taken if a rollback of actions performed by a malicious program is available.

The procedure of rolling back malware operations affects a strictly defined set of data. It causes no negative
consequences for the operating system or data integrity on your computer.

To select an action that should be taken if a rollback of actions performed by a malicious program is available:

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the System Watcher component.

3. In the right part of the window, in the Rollback of malware actions section, choose Select action, and then
select the required action from the dropdown list.

To limit the volume of information that System Watcher stores for a rollback:

1. Open the application settings window.

2. In the left part of the window, in the Protection Center section, select the System Watcher component.

3. In the right part of the window, in the Rollback of malware actions section, check the Limit data to be stored
for rollback box and specify the maximum data volume that System Watcher should store for a rollback.

NETWORK PROTECTION

The tools and settings of Kaspersky Anti-Virus together ensure security and control of your network activities.

The sections below contain detailed information about the verification of network connections, proxy server settings, and
monitoring of network ports.

U S E R G U I DE

100

ENCRYPTED CONNECTIONS SCAN

IN THIS SECTION:

Scanning encrypted connections in Mozilla Firefox ....................................................................................................... 100

Scanning encrypted connections in Opera .................................................................................................................... 101

Connecting using the SSL / TLS protocols protects the data exchange channel on the Internet. The SSL / TLS protocols
allow you to identify the parties exchanging data using electronic certificates, encode the data being transferred, and
ensure their integrity during the transfer.

These features of the protocol are used by hackers to spread malicious programs, since most antivirus applications do
not scan SSL / TLS traffic.

Kaspersky Anti-Virus scans encrypted connections using a Kaspersky Lab certificate.

If an invalid certificate is detected when connecting to the server (for example, if the certificate is replaced by an
intruder), a notification will pop up containing a prompt to either accept or reject the certificate.

If you are sure that connection with a website is always secure, in spite of an invalid certificate, you can add the website
into the list of trusted URLs. Kaspersky Anti-Virus will no longer scan the encrypted connection with this website.

You can use the Certificate Installation Wizard to install a certificate for scanning encrypted connections in semi­interactive mode in Microsoft Internet Explorer, Mozilla Firefox (if it is not launched) and Google Chrome, as well as to
get instructions on installing Kaspersky Lab's certificate for Opera.

To enable encrypted connections scanning and install Kaspersky Lab's certificate:

1. Open the application settings window.

2. In the left part of the window, in the Advanced Settings section, select the Network component.

3. In the window that opens, check the Scan encrypted connections box. When you first enable this setting, the
Certificate Installation Wizard starts automatically.

4. If the wizard does not start, click the Install certificate button. This will start a Wizard with instructions to follow
for successful installation of the Kaspersky Lab certificate.

SCANNING ENCRYPTED CONNECTIONS IN MOZILLA FIREFOX

The Mozilla Firefox browser does not use Microsoft Windows certificate storage. To scan SSL connections when using
Firefox, you should install the Kaspersky Lab certificate manually.

You can use the Certificate Installation Wizard, if the browser is not launched.

To install Kaspersky Lab's certificate:

1. In the browser menu, select Tools Settings.

2. In the window that opens, select the Additional section.

3. In the Certificates section, select the Security tab and click the View Certificates button.

4. In the window that opens, select the Authorities tab and click the Restore button.