This user manual explains how to use Sophos Anti-Virus for NetWare and
how to configure
virus scanning
virus alerts
disinfection
logging
reporting.
The manual also provides help in resolving common problems.
For information on automatically installing and updating Sophos
Anti-Virus, see one of the following documents:
If the network uses Microsoft networking, see the Sophos Endpoint
Security and Control network startup guide on the Sophos website or
the Sophos Network Install CD.
If the network uses NDS networking, see the Sophos Endpoint Security
and Control network startup guide: NetWare edition on the Sophos
website or the Sophos Network Install CD.
For information on manually installing and updating Sophos Anti-Virus, see
the Sophos Anti-Virus NetWare startup guide on the Sophos Anti-VirusSupplementary CD.
2
Sophos Anti-Virus NetWare user manual
Contents
Using Sophos Anti-Virus
1 Loading and unloading Sophos Anti-Virus6
2 Using the Sophos Anti-Virus screen7
3 Scanning the server9
4 Scheduled scanning11
5 Viewing the log file15
6 Disinfection16
Configuration
7 Configuring immediate or scheduled scanning22
8 Configuring InterCheck (central reporting)35
9 Configuring real-time scanning37
10 Purging checksums (for real-time scanning)45
11 Setting administration options46
12 Restoring or saving configuration settings52
13 Command line options53
Troubleshooting
14 Troubleshooting56
Glossary and index
Glossary60
Index62
Technical support64
3
Sophos Anti-Virus NetWare user manual
4
Using Sophos Anti-Virus
Loading and unloading Sophos Anti-Virus
Using the Sophos Anti-Virus screen
Scanning the server
Scheduled scanning
Viewing the log file
Disinfection
Sophos Anti-Virus NetWare user manual
1 Loading and unloading Sophos Anti-Virus
1.1 Loading Sophos Anti-Virus
At a workstation running RCONSOLE, or at the server console, enter
LOAD SWEEP
The main Sophos Anti-Virus screen is displayed. For information on using
this screen, see section 2 below.
The first time Sophos Anti-Virus is loaded, it prompts for the fully qualified
distinguished name of an administrator and a password.
1.2 Unloading Sophos Anti-Virus
To unload Sophos Anti-Virus at any stage, press ‘Esc’ repeatedly until the
Exit menu is displayed. Select Unload SWEEP and press Return. If you
have made changes to the configuration, you will be prompted to save them.
To unload Sophos Anti-Virus from the command line, enter
UNLOAD SWEEP
6
Sophos Anti-Virus NetWare user manual
2 Using the Sophos Anti-Virus screen
The Sophos Anti-Virus screen has a menu and three boxes.
!!
! Main menu enables you to configure and start scans (see section 2.1).
!!
!!
! InterCheck/Real-time shows whether InterCheck central reporting and
!!
Real-time (on-access) scanning are active, and shows details of real-time
activity.
!!
! Server shows the scanning job currently being run (if any), the next
!!
scheduled job, and details of files scanned and viruses found.
!!
! Last Virus shows details of the last virus discovered and the action
!!
taken.
2.1 The Main menu
The Main menu enables you to control and configure scanning and
reporting. The options include the following:
! Immediate mode scans files on the server now (see section 3).
! Scheduled mode runs scans on the server at set times and on set days
(see section 4).
! InterCheck receives reports from workstations (see section 8).
! Real-time mode checks files copied to or accessed on the server (see
section 9).
7
Sophos Anti-Virus NetWare user manual
2.2 Using menus and screens
To use menus and screens in Sophos Anti-Virus for NetWare, do as follows.
Selecting items
To select an option, position the selection bar on it (using the cursor
up/down keys) and press Return.
Closing a screen
To quit a screen and return to the previous one, press ‘Esc’.
Adding or removing items from a list
To add an item to a list, press ‘Insert’. To delete an item from a list, position
the selection bar on the item and press ‘Delete’.
8
Sophos Anti-Virus NetWare user manual
3 Scanning the server
This section describes immediate scanning. For details of Scheduled
scanning, see section 4. For details of Real-time scanning, see section 9.
3.1 To start a scan
To scan the server for viruses now (an immediate scan)
1. On the Main menu, select Immediate Mode and press Return.
2. In the Immediate Mode screen, select Start and press Return.
Sophos Anti-Virus checks the file server and displays the results in the
Server window. It also enters the results in the SWEEP.LOG file in the
SWEEP directory on the server.
To configure immediate scanning, in the Immediate Mode screen, select
Configuration. See section 7 for details.
If you want Sophos Anti-Virus to run a scan as soon as it is loaded, enter
LOAD SWEEP -I
If a scheduled scan is running and you try to start an immediate scan, a
menu is displayed containing options to postpone or cancel the immediate
scan. If you choose Postpone, the immediate scan runs when the scheduled
scan is finished.
9
Sophos Anti-Virus NetWare user manual
3.2 Stopping a scan
To stop an immediate scan that is in progress
1. On the Main menu, select Immediate Mode and press Return.
2. In the Immediate Mode screen, select Stop and press Return.
10
Sophos Anti-Virus NetWare user manual
4 Scheduled scanning
4.1 Creating a scheduled job
To schedule Sophos Anti-Virus to run at set times on specified days of the
week, do as follows.
1. On the Main menu, select Scheduled mode and press Return.
2. A list of Scheduled jobs is displayed. By default, there is a job called Daily
that runs at 21.00 each day. Press ‘Insert’ to add a new job.
3. In the Enter job name text box, type a name and press Return.
4. In the Scheduled jobs list, select the new job and press Return.
11
Sophos Anti-Virus NetWare user manual
5. In the Scheduled job: <jobname> screen, the configuration settings for
the job are displayed. The job is already Active by default (i.e. it will run at
the times shown). Select Times and press Return.
6. In the Times text box, press ‘Insert’, type a time and press Return.
7. In the Scheduled job: <jobname> screen, select Days. By default all the
days of the week are included. To remove a day, select it and press ‘Delete’.
To add a day, press ‘Insert’ and select a day from the menu that is
displayed.
For details of the other configuration options for scheduled jobs, see section
7.
12
If an immediate scan is taking place and a scheduled scan is due to start,
the immediate scan is stopped and a message written to the log file.
Sophos Anti-Virus NetWare user manual
4.2 Editing a scheduled job
To edit a scheduled job
1. On the Main menu, select Scheduled Mode and press Return.
2. In the Scheduled jobs list, select the job to be edited and press Return.
3. In the Scheduled job: <jobname> screen, specify the times and days as
described in section 4.1.
13
Sophos Anti-Virus NetWare user manual
4.3 Removing a scheduled job
To remove a scheduled job
1. On the Main menu, select Scheduled mode and press Return.
2. In the Scheduled jobs list, select the job to be removed and press ‘Delete’.
4.4 Stopping a scheduled job
To stop a scheduled job that has already started
1. On the Main menu, select Immediate mode (not Scheduled mode) and
press Return.
2. In the Immediate mode screen, select Stop and press Return.
14
Sophos Anti-Virus NetWare user manual
5 Viewing the log file
To view the Sophos Anti-Virus log file, do as follows.
1. On the Main menu, click Administration and press Return.
2. The Administration menu is displayed. Select Log file and press Return.
3. In the Log file screen, select View and press Return.
The log file is displayed. The latest entries are at the end of the file.
To go directly to the end of the log file, press Ctrl+PgDn (or, on versions of
RCONSOLE that do not support this key combination, press Ctrl+x).
15
Sophos Anti-Virus NetWare user manual
6 Disinfection
This section provides some general information about disinfection. It does
not explain how to disinfect a computer of specific viruses, as disinfection
methods are varied and can be virus-specific.
It is recommended that you get information about the virus (see below),
then either use the Sophos website for help with disinfection or contact
Sophos technical support.
This section describes how to disinfect infected items on a NetWare server.
For information on disinfecting client workstations, see the Sophos Anti-Virus
documentation for that platform.
6.1 Getting information about the virus
If Sophos Anti-Virus reports a virus, first isolate the infected computers from
the network and internet.
Write down the name of the virus, then, from an uninfected computer, look
up its virus analysis on the Sophos website. The virus analysis search page
is located at
www.sophos.com/virusinfo/analyses
The analysis tells you what types of files the virus infects, and provides
information about disinfection. It may also include a link to detailed
disinfection instructions.
If there are no instructions, or if the virus analysis tells you to seek advice,
contact Sophos technical support.
16
Sophos Anti-Virus NetWare user manual
6.2 Disinfection
Sophos Anti-Virus can automatically disinfect documents containing
document viruses and can automatically disinfect some infected programs.
Disinfected programs may be unstable, and put valuable data at risk. We
recommend that disinfection of programs is used only as a temporary
measure, and that you subsequently replace disinfected programs from
original installation disks, a clean computer or sound backups.
To attempt disinfection of documents or programs with an immediate scan,
do as follows.
1. On the Main menu, select Immediate mode and press Return.
2. In the Immediate mode screen, select Configuration and press Return.
3. To attempt disinfection of documents, in the Immediate modeconfiguration screen, select Document viruses and press Return.
To attempt disinfection of programs, in the Immediate mode configuration
screen, select Program viruses and press Return.
17
Sophos Anti-Virus NetWare user manual
4. To attempt disinfection of documents, in the Document viruses screen,
select Disinfect and press Return.
To attempt disinfection of programs, in the Program viruses screen, select
Disinfect and press Return.
5. Exit from the configuration screen. In the Immediate mode screen, selectStart and press Return.
6. In the Sophos Anti-Virus screen, watch the results of the scan in the Server
window. If the number of viruses reported in the on-screen log decreases,
continue running scans until no viruses are found.
If disinfection fails, you should carry out a manual disinfection, specific to
that virus. This is described on the Sophos website, either in its virus
analysis, or on the web page that describes how to disinfect that type of
virus.
18
6.3 Recovering from virus side-effects
How you recover from a virus infection depends on how the virus affected
the infected computer. Some viruses have no side-effects, whereas others
corrupt or delete data.
Some viruses gradually make minor changes to data. This type of corruption
can be very hard to detect. It is therefore very important that you read the
virus analysis on the Sophos website, and check documents carefully after
disinfection.
Sound backups are crucial. If you did not have them before you were
infected, ensure you create or obtain them in case of future infections.
Sometimes you can recover data from disks damaged by viruses. Sophos
can supply utilities for repairing the damage caused by some viruses.
Contact Sophos technical support for help.
Sophos Anti-Virus NetWare user manual
19
Sophos Anti-Virus NetWare user manual
20
Loading...
+ 44 hidden pages
You need points to download manuals.
1 point = 1 manual.
You can buy points or you can get point for every manual you upload.