Introduction to Active Virus Shield Help

Welcome to Active Virus Shield. We hope that you will find the information in these Help files useful in protecting your computer against virus attacks.
Where to begin

Before getting started with the program, we recommend that you learn a little about the threats that your computer can be subjected to, how they penetrate your system, and what the consequences are.

Next, you can read about the key features of Active Virus Shield.

To start working with the program, we recommend that you read through the information in the Getting Started section. It contains a description of the first steps you need to take to ensure the security of your computer.

How to use Help

Help text is accompanied with warnings, tips, and examples. We encourage you to read them thoroughly. Warning text is red, and tips and comments are green.

Active Virus Shield is simple to use. Every operation described here links directly to the corresponding action in the program. Click on the [image] button to open a separate window from where you can perform that operation.

How to find Help information

You can search for Help information either by searching for keyword or the operation that you want to perform.

You can search by keyword on the Index and Search tabs.

    • The Index tab contains a list of keywords that are indicative of the basic functions of the program and terms that users may have questions about. When you select the appropriate keyword, you will see a list of sections where you can read information on that keyword.
    • On the Search tab, you can enter a keyword in the search field and you will see a list of sections containing that word.

You can search by operation using Help contents, which have been organized such that you can find the answers to your questions quickly. To make searching easier, descriptions are broken down by components, tasks, and support services found in Active Virus Shield. For each component:

    • A description of the component, as well as an explanation of how the component works, is provided.
    • The various statuses are explained
    • Operational detail on how to pause the component, disable it, or enable it again, is specified.
    • Settings are described, and examples are provided.
    • Operation statistics are discussed.
For example, if you want to know how to pause a component, go to Pause / Disable; if you want to learn how to change the security level, browse the information under Selecting a security level section, etc.


Threats to Computer Security

As information technology has rapidly developed and penetrated every aspect of human existence, the number of attempts to breach information security has increased exponentially. Cyber offenders often attempt to steal personal and confidential information to use it for their personal gains. Using various tools, they gain access to personal data (bank account and credit card numbers, passwords etc.), and misuse it. They can make your system malfunction or even gain complete access to your computer to use it as a part of a zombie network, a network of infected computers to attack servers, send out spam, harvest confidential information, or even spread new viruses and Trojans.
In light of these threats, a comprehensive information security software is needed. Active Virus Shield is designed to take account of all possible sources of threats and use a complete array of defensive measures.
Also see:

Sources of threats

How threats spread

Types of threats

Signs of infection

What to do if you show signs of infection

Preventing infection


Sources of Threats
A person, a group of people, or even some phenomena unrelated to human activity can serve as an information security threat. Following from this, all threat sources break down into three groups:
  • The human factor. This group of threats concerns the actions of people with authorized or unauthorized access to information. Threats in this group can be divided into:
    • External, including cyber criminals, hackers, internet scams, unprincipled partners, and criminal structures.
    • Internal, including actions of company staff and users of home PCs. Actions taken by this group could be deliberate or accidental.
  • The technological factor. This threat group is connected with technical problems - equipment used becoming obsolete and poor-quality software and hardware for processing information. This all leads to equipment failure and often to data loss.
  • The natural-disaster factor. This threat group includes any number of events brought on by nature and other events independent of human activity.

All three threat sources must be accounted for when developing a data security protection system. This User Guide only covers external threats involving human activity.

Also see:

How threats spread

Types of threats

Signs of infection

What to do if you show signs of infection

Preventing infection


How threats spread
As modern computer technology and communication tools develop, hackers have more opportunities for spreading threats. Let's take a closer look at them:
Internet

The Internet is unique, as it is neither owned by anyone, nor does it have any geographical boundary. Anyone can access or post data on the Internet.

However, this convenience is the very reason that hackers and cyber offenders are able to cause harm and pain to individuals or companies using the Internet. The diverse nature of the Internet is also the reason why many cyber-offenders escape detection and punishment.

Hackers place viruses and other malicious programs on Internet sites. Sometimes these programs are disguised as freeware and at other times they are hidden in scripts that run automatically when you open a webpage or an email. These programs can execute dangerous actions on your computer, including modifying the system registry, stealing personal data, and installing more malicious software.

Using network technologies, hackers can attack remote PCs and company servers. These attacks can cause parts of your system to malfunction or could provide hackers with complete access to your system and personal information.

Credit card usage, internet banking, and other electronic monetary transactions over the internet have made cyber-offence more attractive to offenders.

Intranet

Your intranet is your internal network, specially designed for handling information within a company or a home network. An intranet is a unified space for storing, exchanging, and accessing information for all computers on the network. This means that if one computer on the network is infected, the others run the risk of infection too. To avoid such situations, both the network perimeter and individual computers must be protected.

E-mail

Many computers have e-mail clients installed on them. Malicious programs exploit the features of these clients, like address book, to further spread themselves or other malicious programs. Oblivious to the fact, the user on an infected computer might send infected e-mails to friends or coworkers who in turn send more infected e-mails. Sometimes these programs infect business and personal documents and transmit them without a user’s knowledge. These documents then infect other people and the viruses spread through email chains.

Junk e-mails and spams also increases the load on mail servers, eating up bandwidth and filling up mailboxes. They also waste productive time and can cause financial harm.

Hackers have begun using mass mailing programs and social engineering methods to convince users to open e-mails or click a link to a certain website. Hence spam filtration capabilities should not only stop junk mail, but should also help encounter new types of online scans, such as phishing.

Removable storage media

Removable media (floppies, CD-ROMs, and USB flash drives) are widely used for storing and transmitting information.

When you open a file that contains malicious code from a removable storage device, you can damage data stored on your computer and spread the virus.

Also see:

Sources of threats

Types of threats

Signs of infection

What to do if you show signs of infection

Preventing infection


Types of Threats

Types of known threats
There are a vast number of threats that could affect your computer today. This section discusses how Active Virus Shield helps protect against them.
Worms

These are malicious programs that exploit operating system vulnerabilities to spread themselves. They are called “worms” because of the way they propagate, crawling from computer to computer, using networks, e-mail, and other data channels. This feature gives many worms the capability to spread rapidly.

Worms penetrate a computer, calculate the network addresses of other computers, and send a burst of self-made copies to these addresses. In addition to network addresses, worms often utilize data from e-mail client address books. Some of these malicious programs occasionally create working files on system disks, but they can run without any system resources at all (with the exception of RAM).

Viruses

These are programs that infect other programs, adding their own code to them to gain control of the infected files when they are opened. This is the basic way viruses infect and damage files and executables.

Trojans

These are programs that carry out unauthorized actions on computers, such as deleting information on drives, stalling the system, stealing confidential information, etc. This class of malicious program is not a traditional virus because it does not infect other computers or data. However trojans disguise themselves as regular software and cause damages that can be worse that the damages caused by traditional virus attacks.

Malicious programs can combine behaviors of worms, viruses and trojans.

Adware

This program code is included in software, unbeknownst to the user, and designed to display advertisements. These programs often also collect personal data on the user and send it back to the hackers. Adware can change browser settings (start page and search pages, security levels, etc.) and create internet traffic that the user cannot control. All this can lead to breach of security and financial losses.

Spyware

This is software that collects information about a particular user without his/her knowledge. Without proper software, a user may never even realize that spyware is installed on their computer. In general, spywares tend to:

    • trace user actions on a computer;
    • gather information on the contents of the hard drive by scanning directories and system registry, building a list of the software installed on the computer;
    • gather information on the quality of the connection, bandwidth, modem speed, etc.
Riskware

This is potentially dangerous software that does not have a malicious function but can be used by hackers as an auxiliary component for launching malicious code as it contains holes and errors. Having such programs on your computer can potentially put your data at risk. These programs include, for instance, remote administration utilities, keyboard layout toggles, IRC clients, FTP servers, and all-purpose utilities for stopping processes or hiding their operation. Riskwares are capable of plugging into your web browser and redirect traffic. It is highly likely that riskware is involved if you encountered a problem such as navigating to a completely different website than the one you intended to go to.

Jokes

Jokes do not do any direct damage but display false messages stating that damage has already been done or will be under certain conditions. These programs try to warn the user of dangers that do not exist, such as messages that pop up about formatting the hard drive (although no formatting actually takes place) or detecting viruses in uninfected files.

Rootkits

These are utilities used to conceal malicious activity. They mask malicious programs to keep anti-virus programs from detecting them. Rootkits modify the operating system on the computer and alter its basic functions to hide their own existence and behavior on the infected computer.

Other dangerous programs

Programs created to set up DoS (Denial of Service) attacks on remote servers, hacking into other computers, and programs that are part of the development environment for malicious programs. These programs include hacking tools, virus builders, vulnerability scanners, password-cracking programs, and other types of programs for cracking network resources or penetrating a system.

Active Virus Shield uses two methods for detecting and blocking these threats:
  • Reactive - methods based on searching for malicious files using a threat signature database that is regularly updated. This method involves adding threat signatures to the database and downloading updates.
  • Proactive - in contrast to reactive protection, this method is not built on analyzing code but behavior in the system. This method is aimed at detecting new threats that are still not defined in the signatures.
By employing both methods, Active Virus Shield provides comprehensive protection for your computer from known and new threats.
Also see:

Sources of threats

How threats spread

Signs of infection

What to do if you show signs of infection

Preventing infection


Signs of Infection
There are a number of signs that a computer is infected. It is likely that your computer is infected if you notice that your computer is doing strange things, specifically:
  • Unexpected messages or images appear on your screen or you hear unusual sounds;
  • The CD-ROM tray opens and closes unexpectedly;
  • The computer arbitrarily opens a program without your assistance;
  • Warnings pop up on the screen about a program on your computer attempting to access the Internet, even though you initiated no such action;
There are also several typical traits of a virus infection through e-mail:
  • Friends or acquaintances tell you about messages from you that you never sent;
  • Your inbox houses a large number of messages without return addresses or headers.
Some other signs that suggest your computer could be infected:
  • Your computer freezes or crashes frequently;
  • Your computer loads programs slowly;
  • You cannot boot up the operating system;
  • Files and folders disappear or their contents are distorted;
  • The hard drive is frequently accessed (the light blinks);
  • Microsoft Internet Explorer freezes up or behaves unexpectedly (for example, you cannot close the program window).
Although these problems can arise due to software or hardware malfunction, it is recommended that upon detecting them, you run a complete scan of your computer to ensure that you are not infected.


What to do if you show signs of infection
If you notice that your computer is behaving suspiciously...
  1. Don't panic! This is the golden rule, and it could save you from losing important data and from a lot of frustration.
  2. Disconnect your computer from the Internet or local network, if it is on one.
  3. If you cannot boot from the computer's hard drive (the computer displays an error message when you turn it on), try booting in safe mode or with the emergency Windows boot disk that you created when you installed the operating system on the computer.
  4. Before doing anything else, back up your work on removable storage media (floppy, CD, flash drive, etc.).
  5. Install Active Virus Shield, if you have not done so already.
  6. Update the program's threat signatures. If possible, get the updates from an uninfected computer. It is better to use a different computer, because when you connect to the Internet with an infected computer, there is a chance that the virus will send important information to hackers or spread the virus to others. The best thing to do, when you suspect a virus, is to immediately disconnect from the Internet. You can also get threat signature updates on a floppy disk or other removable storage device.
  7. Start a full computer scan.


Preventing Infection

No program or process can guarantee 100% protection. However, with a set of rules to follow, you will significantly lower the likelihood of virus attacks and potential damage.
Computer prophylactics involve a rather small number of rules that, if complied with, can significantly lower the likelihood of being infected with a virus and losing data.
The basic safety rules are given below. By following them, you can avoid virus attacks.
Rule No. 1: Use antivirus software and Internet security programs. To do so:
  • Install Active Virus Shield as soon as possible.
  • Regularly update the program's threat signatures. You can update the signatures several times per day. The threat signatures on Active Virus Shield update servers are frequently updated.
  • Keep the default security settings for your computer. You will be protected constantly from the time your computer is turned on, and it will be harder for viruses to get onto your computer.
Rule No. 2: Use caution when copying new data to your computer:
  • Scan all removable storage drives for viruses (floppies, CDs, flash drives, etc.) before using them.
  • Treat e-mails with caution. Do not open any e-mail attachments if you are uncertain about them, even if they were sent by people you know.
  • Be careful with information obtained from the Internet. If any web site suggests that you install a new program, ensure that it has a security certificate.
  • If you are copying an executable file from the Internet or local network, be sure to scan it with Active Virus Shield.
  • Use discretion when navigating internet sites. Many sites are infected with dangerous script viruses or Internet worms.
Rule No. 3: Pay close attention to new virus and malware information.

In most cases, new outbreaks are announced long before they peak. The likelihood of the infection in such a case is contained if you download the new threat signature updates.

Rule No. 4: Do not trust virus hoaxes, such as prank programs and e-mails about infection threats.
Rule No. 5: Use the Windows Update tool and regularly install Windows operating system updates.
Rule No. 6: Buy legitimate copies of software from official distributors..
Rule No. 7: Limit the number of people who are allowed to use your computer.
Rule No. 8: Lower the risk of unpleasant consequences of a potential infection:
    Back up data regularly. If you lose your data, the system can fairly quickly be restored if you have backup copies. Label and store distribution floppies, CDs, flash drives, and other storage media with software and valuable information in a safe place.
Rule No. 9: Regularly inspect the list of programs installed on your computer.
To do so, open Install/Remove Programs in the Control Panel or open the Program Files directory. You may discover software that was installed on your computer without your knowledge.


Active Virus Shield
Active Virus Shield utilizes a multifaceted approach to data security on the user's computer. The program provides comprehensive protection from numerous types of threats, both existing and new.
Also see:

What's new in Active Virus Shield

What is Active Virus Shield's defense built on


What's new in Active Virus Shield

Active Virus Shield ensures protection from not only known, but also from unknown threats; it provides you with full protection. The multifaceted defense covers all channels for data transmission and exchange. The flexible settings for any program component lets users maximally adapt Active Virus Shield to their specific needs. Unified configuration for all the protection components is also built-in.
Let's take closer look at the new features in Active Virus Shield:
New Protection Features
  • Active Virus Shield combines traditional antivirus defense methods with the latest detection technologies to provide dependable protection against viruses and malicious programs, stopping them before they can infect your computer. It uses a heuristic analyzer that can detect various types of malicious programs. In doing so, a history is kept, thereby supporting a rollback of the system to the state prior to the malicious activity.
  • An advanced File Anti-Virus technology is used: now you can lower the load and increase the speed of file scans. iCheck and iSwift help achieve this, along with only scanning new or altered files. By operating in this way, the program rules out repeat scans of files that have not been changed since the last scan.
  • The scan process now runs in the background while you work. A scan can take up a fair amount of time and system resources, but the user can perform his work simultaneously. If any operation requires system resources, the virus scan will be paused until that operation is completed. The scan then resumes from the point where it left off.
  • Scanning critical areas of the computer, which could lead to serious consequences if infected, are set aside for a separate task. You can configure this task to run every time the system is started.
  • Protection of mail on the user's computer from malicious programs has been significantly improved. The program scans e-mail sent on these protocols for viruses:
    • IMAP, SMTP, POP3, regardless of which mail client you use;
    • NNTP, regardless of the mail client;
    • MAPI, HTTP (using plugins for Microsoft Office Outlook and The Bat!).
  • Special plug-ins are available for widely used mail clients (such as Microsoft Office Outlook, Microsoft Outlook Express, and TheBat!) that can configure mail protection directly in the mail system from viruses.
  • The user notification function includes events that arise during program operation. You can select the method of notification yourselves for each of these events: e-mails, sound notifications, pop-up messages.
  • The program has self protection technology, protection against remote administration. Password protection program settings help keep malicious programs, malefactors, or unauthorized users from disabling protection.
New Program Interface Features
  • Active Virus Shield interface makes the functions of the program simple and easy to use.
  • When using the program, it regularly provides you with helpful informative messages, with comments and tips, on the level of protection. The product also includes a through help section.
New Program Update Features
  • Active Virus Shield watches out on its own for new updates and program modules necessary for its operation. Updates are automatically downloaded as soon as they are available and the software can connect to the internet.
  • Only updates that you do not yet have are downloaded from the update site. This lowers the download traffic.
  • The most effective update location is dynamically determined, and is used as the most preferred location for future.
  • A user can choose not to use a proxy server, if the program updates are downloaded from a local source. This noticeably reduces the traffic passing through the proxy server.
  • The program has an update rollback feature that can restore the last working version of the threat signatures, if, for example, the files are damaged or there is an error in copying.


What is Active Virus Shield's defense based on
Active Virus Shield is built with the sources of threats in mind. In other words, each threat is dealt with by a separate program component that monitors it and the takes the necessary actions to forestall the malicious effects of that source on the user's computer. This setup makes the security suite flexible as it is easy to configure any of the components to fit the needs of a user.
Active Virus Shield includes:

Protection Components that provide defense for covering all channels of data transmission and exchange on your computer.

Virus Scan Tasks with which the computer or individual files, folders, disks, or regions are scanned for viruses.

Support Features that provide information support for working with the program and expanding its capabilities.


Protection Components

The following protection components provide defense for your computer in real time:
File Anti-Virus

A file system can contain viruses and other dangerous programs. Malicious programs can reside in your computer’s file system once they get in. If you ever open or access the infected file (for example, try to copy it to a disk) the virus is instantly activated.

File Anti-Virus - the component that monitors the computer's file system. It scans all files that can be opened, executed or saved on your computer and all attached disk drives. Each file that you open will be intercepted by Active Virus Shield and scanned for known viruses. The file can only be used further if the file is not infected or is successfully treated by Active Virus Shield. If a file cannot be disinfected for any reason, it will be deleted, and a copy of the file will be saved in backup, or moved to quarantine.

Mail Anti-Virus

E-mail is widely used by malefactors to spread malicious programs. It is one of the chief means for spreading worms. Hence it is extremely important to monitor all mail messages.

Mail Anti-Virus - the component that scans all incoming and outgoing e-mails on your computer. It analyzes e-mails for malicious programs. The e-mail is available to the addressee only if it does not contain dangerous objects.


Virus scan tasks

In addition to the constant protection from malicious programs, it is extremely important to periodically scan your computer for viruses. This is necessary in order to rule out the possibility of spreading malicious programs that have not been discovered earlier.
Three tasks are included in Active Virus Shield for scanning for viruses:
Critical Areas

Scans all critical areas of the computer for viruses. This includes: system memory, programs loaded on startup, boot sectors on the hard drive, and the Windows and system32 system directories. The aim is to quickly detect active viruses in the system without fully scanning the computer.

My Computer

Search for viruses on your computer with a through scan of all disk drives, memory, and files.

Startup Objects

Scans all auto launched programs that are loaded when the operating system boots up. It also scans operating memory and boot disk sectors.

You also have the option of creating other virus search tasks and creating a performance schedule for them. By doing so, you can create your own list of virus search tasks for scanning specific objects. For example, you can create a mail database scan task and schedule it to run once per week.
Also see:

Protection status for My Computer

How to Scan your Computer for Viruses

How to scan critical regions of the computer


Support features of the program

Active Virus Shield includes a number of support features that are designed to provide software support in real time, expanding the capabilities of the program and for assisting you as you use it.
Updates

In order to always be on guard for any hacker attack, or detect and delete a virus, Active Virus Shield updates in real time. The Updates component is designed for this, and is responsible for updating the threat signatures and program modules of Active Virus Shield.

Data files

When using the program, each security component, virus search task, and program update creates a report, which contains information on completed operations and their results. By using the Reports feature, you will always stay up to date on the operation of any Active Virus Shield component. Should problems arise, you can send the reports to our support staff so that specialists can study the situation in greater depth and help you as quickly as possible.

Active Virus Shield sends all files that are potentially dangerous, to a special Quarantine storage. They are stored there in an encrypted form so that they cannot infect the computer. You can scan this storage for viruses, restore files to their previous locations, delete them, or add files on your own to the quarantine.

Files that are not infected are automatically restored to their former locations.

The Backup storage holds copies of files disinfected and deleted by Active Virus Shield. These copies are created in case it is necessary to restore the files. The backup copies of the files are also stored in an encrypted form to avoid further infections.

You can restore a file from the backup copy to the original location and delete the copy.

Support

All registered Active Virus Shield users can take advantage of our technical support service. Under the Support section in the product, you will also find a list of frequently asked questions, which may help you solve your problem. You will also be able to access the online support center, and report bugs or provide feedback via e-mail.


Program interface

Active Virus Shield has a simple and easy-to-use interface. In this section, you will find information on:
  • icon in the system tray
  • context menu
  • main window
  • program settings window
In addition to the main program interface, there are plugins for Microsoft Office Outlook, The Bat! and Microsoft Windows Explorer. The plugins expand the features of these programs by providing Active Virus Shield management and settings interface through these programs.


System tray icon

Once Active Virus Shield is installed, an icon appears in the system tray.
The icon states indicate Active Virus Shield operations and reflect the state of protection.
If the icon is active [image] (color), it means that protection is enabled on your computer. If the icon is inactive [image] (black and white), this means that your protection is either fully disabled or some protection components are temporarily disabled.
The Active Virus Shield icon changes in relation to the operation being performed:

e-mail being scanned.

script being scanned.

a file that you or some program are opening, saving, or running is being scanned.
The icon also provides access the basic program interface: context menu and the main window.
To open the context menu, right-click on the program icon.
To open the Active Virus Shield main window on the Protection section (this is the default first screen when you open the program), double-click the program icon. If you click once, the main window will open to the section that was active when you last closed it.


Context Menu

You can run basic protection tasks from the context menu.
Active Virus Shield menu contains the following items:
    Scan My Computer - start a complete scan of your computer for dangerous objects. The files on all drives, including removable storage media, will be scanned.
    Scan... - select objects and start a virus scan. By default, the list contains a number of files, such as the My Documents folder, the Startup folder, e-mail databases, all the drives on your computer, etc. You can add to the list, select files to be scanned, and launch virus scans.
    Update - download program module updates and Active Virus Shield threat signatures and install them on your computer.
    Activate - activate the program. This menu item is only available if the program is not activated.
    Settings - view and configure settings for Active Virus Shield.
    Open Active Virus Shield - open the main program window.
    Pause protection / resume protection - temporarily disable or enable protection components. This menu item does not affect program updates or virus scan tasks.
    Exit - close Active Virus Shield.
If a virus search task is running, its name will be displayed in the context menu with a percentage progress meter. By selecting the task you can go to the report window to view current performance results.


Main Program Window
Active Virus Shield main window provides you with a simple and easy-to-use interface for interacting with the program. It can be divided into two parts:
  • the left part of the window, the navigation panel, can switch quickly and easily to any component, virus scan task performance, or the program's help features;
  • the right part of the window, the information panel, contains information in the protection component selected in the left part and displays settings for each of them, giving you tools for carrying our virus scans, working with quarantined files and backup copies, managing license keys, etc.
After selecting a section or component in the left part of the window, you will find information in the right-hand part that matches your selection.
The elements in the main window navigation panel are described below in more details.
Main Window Section
Purpose
This window informs you of the protection status of your computer. The Protectionsection has individual tasks for this.

Here you will find general information about Active Virus Shield. You can verify that all the components are running correctly and examine the general statistics.
You can also enable/disable protection components here.
To view statistics and settings for a specific protection component, you need only select the name of the component about which you want information in the Protection section.
To scan your computer for malicious files or programs, use the special Scan section in the main window.

This section contains a list of objects that you can scan for viruses. These include the critical areas, startup programs, and a full computer scan.
The Service section includes additional features of Active Virus Shield.

Here you can update the program, view reports on the performance of any of the Active Virus Shield components, work with quarantined objects and backup copies, review technical support information, provide e-mail feedback, and report a bug.
The comments and tips section is always available as you use the program.

In this section, you can read tips on raising the level of protection on your computer. You will also find comments about the current performance of the program and its settings. Using the links in this section, you can easily take the recommended actions or view information in more detail.

Each element of the navigation panel is accompanied by a special context menu that contains information on protection components and tools which help the user quickly configure the components, manage them, and view reports. There is an additional menu item provided for custom defined virus scan tasks.


Program settings window

You can open the Active Virus Shield settings window from the main window. To do so, click Settings in the upper right side of the window.
The settings window resembles the main window:
  • the left part of the window gives you quick and easy access to the settings for each of the program components, virus search tasks, and program tools;
  • the right part of the window contains a list of settings for the component, task, etc. selected in the left part of the window.
When you select any section, component, or task in the left part of the settings window, the right part will display the basic settings for it. To configure advanced settings, you can open a second and third level settings window. You can find a detailed description of program settings in the corresponding Help sections.


Getting started

Your product ships with the optimum configuration as determined by our specialists. This makes it possible for any user to protect their computer right after installation without spending a lot of time on the settings. You may change this configuration later on, from the Settings tab.
After completing installation and starting the program, we recommend taking the following steps:
  • Check the current protection status to make sure that Active Virus Shield is operating on the appropriate level.
  • Update the program (if the Settings Wizard did not do so automatically after installing the program).
  • Scan the computer for viruses.
Also see:

Initial Settings Wizard

How to scan a file, folder, or drive for viruses


Initial Settings Wizard

Active Virus Shield settings Wizard starts automatically the end of program installation and configures your software with default application parameters. You may change this configuration later on, from the Settings tab. After changing settings, if you want to go back to defaults in the future, you can restore the default settings for Active Virus Shield.
Also see:

Activating the program

Configuring update settings

Configuring a virus scan schedule

Restricting program access

Application Integrity Control

Finishing the Setup Wizard


Activating the program

You can activate the program by entering the activation code that you received in your email. This activation key will get you a license key that contains system information necessary for all the program's features to operate.
Warning!
You must have an Internet connection to activate the program. If you are not connected to the Internet during installation, you can activate the program later from the program interface.
You have the following options:
Activate using the activation code. Select this option if you have the activation email with a code in it. Using this code, you will receive a license key that provides you with complete access to all the program's features until the license expires.
Activate later. If you choose this option, you will skip the activation stage. Active Virus Shield will be installed on your computer and you will have access to all program features except updates (you can only update the threat signatures once after installing the program). You will have the option to activate later using a program menu item.
Also see:

Entering the activation code

Obtaining a license key

Completing program activation


Entering the activation code

To activate the program, you must enter the activation code that was provided to you in an e-mail when you registered for the product.


Obtaining a license key

Active Virus Shield connects to the backend servers and sends them your activation. This code is then inspected by the server. If the activation code passes inspection, a license key is send to the installed software, and this key fully enables Active Virus Shield with all product features. The license key is installed automatically and an activation completion window with detailed information on the license is shown. If the activation code does not pass inspection, you will see a corresponding message on the screen. If this occurs, please contact us via the support portal.
It is important to keep in mind that activation is only possible when an internet connection is present. You cannot activate without being connected to the Internet.


Completing program activation

A confirmation window will inform you that the program has been successfully activated. Information on the installed license key will also be displayed.


Configuring update settings

Protection of your computer directly depends on updating the threat signatures and program modules regularly. By default, your software is configured to update automatically, which means that Active Virus Shield copies and installs updates as they are released on the update servers. After installation, if you need to configure updates (set up network properties, or select the resource from which updates will be downloaded), you can do so by clicking on Settings.


Configuring a virus scan schedule

Scanning selected areas of your computer for malicious objects is one of the key tasks in protecting your computer. By default, Active Virus Shield will automatically scan Startup objects every time you turn on your computer. Active Virus Shield is also scheduled, by default, to run a full scan as well as a critical area scan each day. After installation, if you need to edit these schedule or disable them, you can do so by clicking on Settings.
It is also recommended to run a full virus scan immediately after installation.


Restricting program access

Like any other program, Active Virus Shield can be disabled or stopped. If you make a conscious decision to stop the program, then this is the desired behavior. However, if other people like friends and family members use your computer you might want to prevent them from disabling protection. Similarly, malicious programs should not be able to turn off protection. To address these situations, Active Virus Shield provides a password-protection option. Although this option is inactive by default, a user can activate this option and provide a password which will be needed to make any setting changes or to disable Active Virus Shield. This protects the program from any unauthorized attempts to disable or downgrade protection.


Application Integrity Control

Active Virus Shield analyzes the applications installed on your computer (dynamic library files, digital manufacture signatures), counts application checksum files, and creates a list of programs that can be trusted. This information is later used to prevent malicious code from embedding themselves in these modules.
Application analysis is an intensive process and may take some time to complete.


Finishing the Setup Wizard

The last window of the Wizard will ask if you want to restart your computer to complete the program installation. You must restart for some of Active Virus Shield component drivers to register correctly.

You can wait to restart, but if you do, some program components will not work.


Restoring the default settings

You can always return to the recommended program settings. You can reset settings with the Program Settings Wizard.

In order to reset protection settings,
  1. Select the Protection section and click Settings to go to the program configuration window.
  2. Click the [image] Reset button in the Configuration management section.

The window that opens asks you to define which settings should be saved for which components and which not when the recommended security level is restored.

The list displays program components with settings that the user changed. If special settings were created for any of the components, they will also be shown on the list.

These lists are populated gradually by using the program, based on individual tasks and security requirements. This process often takes some time. Therefore, we recommend saving them when you reset program settings.

The program saves all the custom settings on the list by default (they are unchecked). If you do not need to save one of the settings, check the box next to it.

After you are done configuring the settings, click the Next button. Setup Wizard will open. Follow its instructions.

After you are finished with the Settings Wizard, the Recommended security level will be set for all components, except for the settings that you decided to save when you reset the settings. In addition, settings that you configured with the Settings Wizard will also be applied.

Also see:

Enabling and disabling protection on your computer

Selecting the programs monitored


What protection status does my computer have?

Composite information on your computer's protection is provided in the main window of Active Virus Shield, under the [image] Protection section. The current protection status of the computer and the general performance statistics of the program are displayed here.
Protection status displays the current state of protection for your computer using special indicators. Statistics contains the figures for current program operation.
Also see:
Current status of:

File Anti-Virus

Mail protection

Virus scan task

Program updates


Protection indicators

Protection status is determined by three indicators that reflect the degree of your computer's protection at the time and show you problems in program settings and performance.
These indicators can convey that:
- the indicator is of an informative nature; it is letting you know that your computer's protection is proper and no problems have been detected.
- the indicator is directing your attention to deviations in Active Virus Shield’s performance from the expected level, which could effect data security. The software will provide recommendations in these situations.
- the indicator is reflecting a critically important situation with respect to protection. Please follow the recommendations closely. They are aimed at better protecting your computer. The recommended actions are provided as links.
All indicators are provided with comments in the main window of the program. These indicators are discussed in more details below.
The first indicator reflects with the state of your computer with respect to presence of malicious files and programs. It has one of the following values:

No malicious objects detected

Active virus Shield did not detect any dangerous files or programs on your computer.

All malicious objects disinfected

Active Virus Shield has treated all files and programs infected with viruses and deleted those that could not be treated.

Threats have been detected

At this time, your computer is at risk of infection. Active Virus Shield has detected malicious programs (viruses, Trojans, worms, etc.) that must be neutralized. To do so, use the Neutralize all link. Click the Details link to see more detailed information about the malicious objects.

Must restart computer

In order to completely neutralize the malicious files or programs, you must restart your computer. Save and close all files that you are working with and use the Restart computer link.

The second indicator shows how effective you computer's protection is that moment. It has one of the following values:

Signatures are loaded (date, time)

The program does not need updates. All the databases used by Active Virus Shield are running the very latest information for protecting your computer.

Signatures are out of date

The program modules and Active Virus Shield database have not been updated for several days. You are running the risk of infecting your computer with new malicious programs that have appeared since you last updated the program. We highly recommend updating Active Virus Shield. To do so, use the Update link.

Must restart computer

You must restart your system for the program to run correctly. Save and close all files that you are working with and use the Restart computer link.

Signatures are obsolete

Active Virus Shield has not been updated for some time. Your data is at risk. Update the program as soon as possible. To do so, use the Update link.

The third indicator shows the current functionality of the program. It has one of the following values:

All protection components are enabled

Active Virus Shield is protecting your computer on all channels through which malicious programs could penetrate. All protection components are enabled.

Protection is not installed

No monitoring components of Active Virus Shield were installed. You can only scan for viruses. For maximum security, you should install protection components on your computer.

Some protection components are disabled

One or more protection components has been paused. In order to restore the inactive component, select it from the list and click.

All protection components are paused

All protection components have been paused. To restore the components, select Enable protection from the context menu by clicking on the system tray icon.

Some protection components are disabled

One or several protection components are disabled. This could result in a virus infection and possible data loss. It is strongly recommended that you enable protection. To do so, select an inactive component from the list and click [image].

All protection components are disabled

Protection is fully disabled. No protection components are running. To restore the components, select Enable protection from the context menu by clicking on the system tray icon.

Some protection components have encountered an error

One or more Active Virus Shield components have encountered errors. If this occurs, please restart your computer and reenable the component (it is possible that the component drivers have to be registered after being updated).


Program Performance Statistics

Program Statistics can be found in the [image] Statistics area of the Protection section of the main window. It displays general information on computer protection, recorded historically from the time you installed Active Virus Shield.
You can click anywhere in the area to view a report with detailed information. The corresponding tabs are displayed:
  • information on objects found and the status assigned to them;
  • event log;
  • general scan statistics for your computer;
  • program performance settings.


How to Scan Your Computer for Viruses

Active Virus Shield recommends a full scan system after install. By default, it is also configured to perform a full scan and a critical area scan automatically every day.
If you want to explicitly run a scan, you can do so anytime by selecting the Scan My Computer task. This window presents, on the right-hand side, statistics for the most recent computer scans. It also shows the level of protection and previous actions taken. From this window, click the Scan button on the right-hand side of the screen. This will launch the scan, and the details will be shown in a special window that you can hide, if you so desire. The window will close without stopping the scan.
Also see:

How to Scan Critical Areas

How to Scan a File, Folder or Disk for Viruses


How to scan critical regions of the computer

How to scan critical areas of your computer

Certain areas on your computer are critical from a security perspective. These are the targets of malicious programs aimed at damaging the operating system, processor, or memory. It is therefore extremely important to secure such critical areas. Active Virus Shield ships with a default virus scan task to address this issue. This task is located in the program's main window in the Virus scan section.
After selecting the Critical areas task, you will be able to view the statistics for the most recent scan in these areas. You can also see, in the right-hand part of the main window and the settings window, what level of protection was selected and what actions were taken to resolve these security threats. You can also select which critical areas you want to scan and then immediately start a virus scan process.
To scan, click the Scan button. As the scan progresses, the details will be shown in a special window. You can hide the scan information window. To do so, simply close it. This will not stop the scan.
Also see:

How to scan a file, folder, or drive for viruses

How to Scan Your Computer for Viruses


How to Scan a File, Folder or Disk for Viruses

Under certain circumstances, you may want to scan individual objects rather than the entire computer (for example, select hard drives, programs, games, e-mails etc).
To do so, select the object in Windows Explorer, or on the Desktop, right-click the mouse, and select Scan for viruses. A scan of the selected object will begin, and the details will be shown in a special window. You can hide the scan information window. To do so, simply close it. This will not stop the scan.
Also see:

How to Scan Your Computer for Viruses

How to Scan Critical Areas


How to Update the Program
Active Virus Shield updates the threats signatures using dedicated update servers. These servers are internet sites where the program updates are stored.
Warning!
You will need a connection to the Internet to update Active Virus Shield.
Active Virus Shield automatically checks for updates on the AOL servers. If new program updates have been released, they are downloaded and installed behind to keep the software current and up to date.
To manually update Active Virus Shield, select the Update component in the Service section of the main program window and click the [image] Update now! button.
The update will start and the details of the process with be displayed in a separate window.
Also see:

Updating the application


What to do with dangerous objects

If dangerous objects are detected in your mail, in files that you open, or in programs that you start, a special message will open on the screen.
The type of notification can be as follow:
  • Notice - a suspicious object detected. If possible, the name of the supposed malicious program is indicated that has possibly infected the file.
  • Warning - malicious program detected.
The notification contains:
  • Where possible, the short and full name of the malicious program which infected the object. The name is a hyperlink to www.viruslist.com,where more information on the malware can be found.
  • Brief description and a set of potential actions to remove the infection from the object. The description shows what type of malicious program infected the object and if it can be neutralized.
If the object can be disinfected, you will be given the choice of the following actions:
  • Disinfect - attempt to disinfect the infected object. Before treatment, a backup copy is made of the object in case the necessity arise to restore it or a portrait of its infection.
  • Delete - delete infected object. Before treatment, a backup copy is made of the object in case the necessity arise to restore it or a portrait of its infection.
  • Skip - take no actions on the object; simply record information about it in the report. If this action is selected, the object is made available for use.
If the object cannot be disinfected, Active Virus Shield asks if you want to delete or skip it.
If the object is suspected of being infected, you will be asked if you want to skip the object or send it to Quarantine.
To execute an action, click the appropriate button.
You can also apply the selected action to all objects with the same status detected in the current session of the program. To do so, check [image] Apply in all similar cases.


What to do if protection is not running

If problems or errors arise in the performance of any protection component, be sure to check its status.
If the component status is not running or operation error, try restarting the program.
If the problem isn't solved by restarting the program, please review the support information on the Support Portal. Please save the failure report on the component and send it to us by clicking on the appropriate support link.
To save the report to file,
  1. Select the component in the Protection section of the main window and click anywhere in the Statistics section.
  2. Click the Save as button in the window that appears, and provide a filename to save the report.
To save a report for all Active Virus Shield components (protection components, virus scan tasks, support features),
  1. Select the Protection section in the main window of the program and click anywhere in the Statistics section.

or

    Click List of all reports in the report window for any component. Then Reports tab will list reports for all program components.
  1. Click the Save as button in the window that appears, and provide a filename to save the report.


Multi-tasked protection management

Active Virus Shield can multi-task your management.
  • Enable, disable, and pause the program
  • Define the types of dangerous programs from which Active Virus Shield will protect your computer


Enabling and disabling protection on your computer

By default, Active Virus Shield boots at startup and protects your computer the entire time you are using it. The logo in the upper right corner of your screen lets you know this. All protection components are running.
You can disable, fully or partially, the protection provided by Active Virus Shield.

Warning!
It is strongly recommended that you do not disable protection, since this could lead to a virus infection and/or possible data loss due to malicious software.

Note that in this case protection is discussed in the context of the protection components. Disabling or pausing protection components does not effect the performance of virus search tasks and program updates.
Also see:

Pausing protection

Fully disabling protection

Restoring Protection on Your Computer

Shutting down the program


Pausing protection

Pausing protection means temporarily disabling all the protection components that monitor files on your computer, incoming and outgoing mail, executable scripts, application behavior.
To pause Active Virus Shield operation,
  1. Select [image] Pause protection in the program's context menu.
  2. In the disable protection window that opens, select the period of time for which you want protection to be enabled:
    • 1/3/5 hours - protection will be enabled this amount of time later.
    • At next internet connection - protection will be enabled as soon as the computer connects to the Internet.
    • Next restart - protection will be enabled if you open the program from the Start menu or after restarting your computer (provided the program is set to start automatically on startup).
    • Never - protection will be disabled until you start it yourself. To enable protection, select Enable protection from the program's context menu.

Tip: You can also disable protection on your computer until the next system reboot in one of the following ways:
  • Click the [image] button in the Protection section.
  • Select Exit from the context menu. The program will unload itself from your computer's memory.

    • When you temporarily disable protection, all protection components will be paused. This is indicated by:
    • Inactive (gray) names of the disabled components in the Protection section of the main window.
    • Inactive (black and white) system tray icon.
    • The third protection indicator on your computer, which states: No protection components are enabled.
    Also see:

    Fully disabling protection

    Restoring Protection on Your Computer

    Shutting down the program


Fully disabling computer protection

Fully disabling protection means stopping your protection components. Virus search tasks and updates continue to work in this mode.
If protection is fully disabled, it can be only be enabled by user demand. Protection components are not automatically enabled after restarting the system or the program in such a case. Remember that if Active Virus Shield is somehow in conflict with other programs installed on your computer, you can pause individual components.
In order to fully disable computer protection,
  1. Open the Active Virus Shield main window.
  2. Select the Protection section and click [image] Settings.
  3. In the program settings window, uncheck [image] Enable protection.
As a result of disabling protection, all protection components will be stopped. This is indicated by:
  • Inactive (gray) names of the disabled components in the Protection section of the main window.
  • Inactive (black and white) system tray icon.
  • The third protection indicator on your computer, which points to the fact that [image] No protection components are enabled.
Also see:

Pausing protection

Restoring Protection on Your Computer

Shutting down the program


Restoring Protection on Your Computer

If you paused or disabled protection, you can enable it in one of the following ways:
  • From the context menu select Enable protection.
  • From the program's main window click the [image] button on the status line in the Protection section of the main window.
The protection status immediately changes to running. The program's system tray icon becomes active (color). The third computer protection indicator states [image] All protection components are running .
Also see:

Pausing protection

Fully disabling protection


Shutting down the program

If you have to shut down Active Virus Shield, select Exit from the program's context menu. The program will unload itself. Please be aware the doing so may leave your computer unprotected.
Active Virus Shield monitors network connections. If these connections are active when you try to close the program, a notice will appear on the screen stating that active connections will be disabled. This is necessary for Active Virus Shield to shut down correctly. If you do not confirm, the connections are cut off automatically after ten seconds. Most connections that are terminated will be restored automatically after a brief interval.
Note that if you are downloading a file without a download manager when the connection is terminated, the file transfer may be interrupted and you may have to download the file again.
You can choose not to interrupt the connections by clicking No in the message window. If you do so, the program will continue running.
If you closed the program, you can enable computer protection again by opening Active Virus Shield (Start → Programs → Active Virus Shield→ Active Virus Shield).
Protection can also be resumed automatically after rebooting your computer. To enable this, select the [image] Protection section in the program settings window and check [image] Run Active Virus Shield at startup.


Selecting the programs monitored

Active Virus Shield protects you from various malicious programs. Regardless of your settings, the program always scans and neutralizes viruses, Trojans, and backdoor programs, which can do the most damage to your computer. To make your computer even more secure, you can expand the list of threats that the program will detect by enabling monitors for various potentially dangerous programs.
To choose which malicious programs Active Virus Shield will protect you from, select the [image] Protection section in the program settings window.
The Malware categories box contains threat types:
Viruses, worms, Trojans, rootkits. These are the most common and dangerous categories of malicious programs. Monitoring against these threats is the minimum security level, and disabling this will significantly increase the possibility of infection. Hence, to protect your computer, this option is unselectable.
Spyware, adware, dialers. These are potentially dangerous software that can steal your personal information and can cause damage to your computer and data.
Potentially dangerous software: remote access utilities, prank programs, jokes. These are not malicious or dangerous programs, but under certain circumstances they could be harmful to your computer.
The groups listed above govern the completeness of utilizing the threats signatures when scanning objects in real time and when searching for viruses on your computer.
If all groups are selected, Active Virus Shield provides full anti-virus protection for your computer. If the second and third groups are disabled, the program will only protect you from the most common malicious programs.
Also see:

Enabling and disabling protection on your computer


Anti-virus protection of the computer file system

File Anit-Virus is included in Active Virus Shield to enable Virus protection on your files. It loads when you start your operating system and runs in your computer's memory. It scans all files that you or programs open, save, or execute.
The indicator of the component's operation is the Active Virus Shield system tray icon, which looks like [image] whenever a file is being scanned.
By default, File Anti-Virus only scans NEW or ALTERED FILES; in other words, files that have been added or changed since the previous scan. The iChecker™ and iStreams™ technologies make this possible. A file check sum table is used for these technologies. Files are scanned according to the following algorithm:
  1. Each file that the user or a program deals with is intercepted by the component.
  2. File Anti-Virus scans the iChecker and iStreams databases for information on the file intercepted. At this point, the following actions are possible:
    • If there is no information on the file intercepted in the database, it is scanned in depth for viruses. The check sum of the file that is scanned is recorded in the database.
    • If there is information in the database about the file, File Anti-Virus compares the current status of the file with the status recorded in the database at the time of the previous scan. If the information is an exact match, the file can be accessed by the user without being scanned. If the file has somehow changed, it will be scanned in detail, and new information on it will be recorded in the database.
The scanning process includes the following steps:
  1. The file is analyzed for viruses. Malicious objects are detected by comparison with threat signatures used by the program. The signatures contain descriptions of all the malicious programs, threats, and network attacks known to date and methods for neutralizing them. The file is analyzed for viruses. Malicious objects are detected by comparison with the anti-virus database used by the program. The anti-virus database contains descriptions of all the malicious programs known to date and methods for neutralizing them.
  2. As a result of the analysis, the following behavior options are available:
    1. If malicious code is detected in the file, File Anti-Virus blocks the file, places a copy of it in backup, and attempts to neutralize the file. If the file is successfully disinfected, it becomes available again. If not, the file is deleted.
    2. If code is detected in a file that appears to be malicious but there is no guarantee, the file is sent to Quarantine.
    3. If no malicious code is discovered in the file, it is immediately restored.
Also see:

File Anti-Virus status

Pausing / disabling File Anti-Virus

Selecting a file security level

File Anti-Virus settings


File Anti-Virus status

In order to learn how Active Virus Shield is protecting your file system, all you have to do is open the corresponding section of the program's main window.
To view the current status, select the [image] File Anti-Virus section in the left-hand part of the program's main window. In the right-hand part, you will see composite information on File Anti-Virus.
The first and most important is the performance status of File Anti-Virus:
  • File Anti-Virus : running - File Anti-Virus is ensured for the level selected.
  • File Anti-Virus : paused - File Anti-Virus is disabled for a certain length of time. The component will resume operations automatically after the assigned period has expired or after restarting the program. You can also enable File Anti-Virus manually. To do so, click the [image] button located on the status line.
  • File Anti-Virus : disabled - the component has been stopped by the user. You can enable file protection. To do so, click the [image] button located on the status line.
  • File Anti-Virus : malfunction - File Anti-Virus is not available for some reason. For example, you do not have a license key to use the program.
  • File Anti-Virus : running (subsystem malfunction) - the component encountered an error. In such a case, contact Support.
The settings according to which a component operates are given in the Status section:
  • File Anti-Virus - current component status (running, not running, paused, etc.).
  • Security level - the set of parameters for component operation according to which the program protects files (for more details, see Selecting a file security level). By default, the Recommended security level will be selected, which scans only objects on the file system that are subject to infection. For example, executable (.exe) files.
  • Action, which is performed when a dangerous object is detected.
Using the Settings link, you can edit the current settings for File Anti-Virus.
The Statistics section displays some composite information on the performance of File Anti-Virus. Here you can see how many objects have been scanned since the program was opened, which object was scanned most recently, how many malicious programs have been detected among them, and how many could not be disinfected.
You can view more detailed information on component operation by left-clicking anywhere in that section.


Pausing / disabling File Anti-Virus

File Anti-Virus, and consequently the file protection on your computer, can be disabled in several ways. However, before doing so, we recommend that you establish the reason why you want to disable File Anti-Virus. It is possible that you could solve the problem using a different method, by changing the protection level or only disabling protection for certain files.
There are several ways of disabling File Anti-Virus. Let's look at them in more detail.
To pause File Anti-Virus,

select [image] File Anti-Virus in the Protection section of the main window and click [image] in the status field.

The component status will change to paused. File system protection from dangerous objects will be paused until you restart the program or enable the component using the [image] button.

To stop File Anti-Virus,

Click the [image] button on the status line. In this case, the component status will change to disabled. Protection will be disabled until you enable the component using the [image] button.

The differences between the options listed above for disabling the component are:
  • when you pause protection (the [image] button), the component is not emptied from the memory, and the component statistics for the current Active Virus Shield session are saved and will continue to be composed after the File Anti-Virus is updated;
  • when you stop protection (the [image] button), the component is emptied from the memory, all the statistics from previous work are cleared and when File Anti-Virus is started the statistics start over.
To disable protection for your file system from dangerous objects,
  1. Open the Active Virus Shield settings window by clicking Settings in the main program window.
  2. Select [image] File Anti-Virus in the settings tree.
  3. In the right-hand part of the window, uncheck the [image] Enable File Anti-Virus box.

Warning!
Remember that if you disabled File Anti-Virus in the settings window, it will NOT automatically be enabled after restarting the program. To restore file protection, you must check [image] Enable File Anti-Virus or use the [image] button on the component status line.

By disabling File Anti-Virus in the main window, the component status changes to disabled, and the component list in the Protection section its name will go inactive (gray).
File Anti-Virus can also be disabled by fully disabling protection on your computer.


Selecting a file security level

File Anti-Virus protects files that you work with on one of the following levels:

    High - the level with the most comprehensive monitoring of files being opened, saving, or run.

    Recommended – When set to recommended, Active Virus Shield will scan the following object categories:

      • programs and files by contents;
      • only new objects and objects altered since the last scan;
      • archives under 8 MB;
      • installer packages and embedded OLE objects.
    Low - lets you comfortably use applications that require significant system resources, since the set of files scanned is cut back.

By default, the File Anti-Virus is set to Recommended.

You can raise or lower the protection level by selected the level you want or changing the settings for the current level.
In order to change the security level,

Adjust the sliders. By adjusting the security level, you define the ratio of scan speed and the total number of files scanned: the fewer files are subject to analysis for viruses, the higher the scan speed.

If none of the file security levels listed meet your needs, you can customize the protection settings. To do so, create a User defined level by select the level that is closest to what you need as a starting point and edit its settings. We will examine an example of when user defined file security levels may be useful.
Example:

The work you do on your computer leads you to use a large number of different types of files, some of which may be fairly large. You would not want to run the risk skipping any files in the scan because of the size or extension, even if this would somewhat affect the productivity of your computer.

Tip for selecting a level:

The size and type of the files being handled is quite varied and skipping them in the scan would put the information on the computer at risk. The basic requirement for the scan is analyzing the files handled for the contents, not by extension.

In this case, you would use Recommended as your basic pre-installed security level, with the following changes: remove the restriction on the size of files scanned and optimize File Anti-Virus operation by only scanning new and changed files. In such a case, the load on the computer when scanning files will be reduced, so you can comfortably use other applications.

To modify the settings for the current security level,

click the Settings button in the File Anti-Virus settings window. Edit the File Anti-Virus settings in the window that opens and click OK.

As a result, a fourth security level will be created, User, which contains the protection settings that you assigned.

Also see:

Configuring File Anti-Virus

Restoring default protection settings

Selecting actions for objects


Configuring File Anti-Virus settings

A configuration set determines how File Anti-Virus will carried out on your computer. The settings can be broken down into the following groups:
  • the settings that define what object types are to be scanned for viruses;
  • the settings that form the protected area;
This Help section will examine the groups listed above in detail.
Also see:

Restoring default settings


Defining the types of objects to be scanned

When specifying the types of files to be scanned, you establish what file formats, sizes, and what drives will be scanned for viruses when opened, executed, or saved.

To make configuration easier, all files are divided into two groups: simple and compound. Simple files do not contain any objects. Compound objects can include several objects, each of which may also have several nesting levels. There are many examples: archives, files containing macros, tables, e-mails with attachments, etc.

The types of file to be scanned are defined in the [image] File types section. Select one of the three options:

    All. With this option selected, all file system objects that are opened, started, or saved will be subject to analysis without exceptions.

    Programs and documents (by contents). If you select this group of files, File Anti-Virus will scan only potentially infected files - files that a virus could imbed itself in.

    Note: There are files in which viruses cannot insert themselves, since the code of such files does not contain any "snags" for the virus. An example of such a file would be .txt format files.

    Before searching for viruses in a file, its internal header is analyzed for the file format (txt, doc, exe, etc.). If the results of the analysis show that the file format is type that cannot be infected, it is not scanned for viruses and is immediately restored for use. If the file format makes it possible for the file to be infected, the file is scanned for viruses.

    Programs and documents (by extension). In this case, File Anti-Virus will only scan potentially infected files, but the file format will be determined by extension. Using the extension link, you can review a list of file extensions that are scanned in this case.
    Tip: Do not forget that someone could send a virus to your computer with the extension .txt, although in reality it could be an executable file renamed as a .txt file.
    If you select the Scan Programs and documents (by extension) option, this file would be skipped by the scan. If the Scan Programs and documents (by contents) is selected, File Anti-Virus will analyze file headers, which will uncover that the file is an .exe file. Such a file would be thoroughly scanned for viruses.

In the [image] Productivity section, you can specify that only new files and those that have been modified since the previous scan or new files should be scanned for viruses. This mode of operation noticeably cuts down on scan time and increases the program's performance speed. To do so, you must check [image] Scan new and changed files only. This mode extends to simple and compound files.

In the [image] Compound files section, specify which compound files must be analyzed for viruses:

    Scan All/Only New archives - scan .zip, .cab, .rar, and .arj archives, including password-protected archives.
    Scan All/Only New installation packages - analyze self-extracting archives for viruses.
    Scan All/Only New embedded OLE objects - scan objects imbedded in files (for example, Excel spreadsheets or a macro imbedded in an MS Word file, e-mail attachments, etc.).

For each type of compound file, you can select and scan all files or only new ones. To do so, use the link next to the name of the object. It changes its value when you left-click it. If the Optimization section has been set up only to scan new and changed files, you will not be able to select the type of compound files to be scanned.

To specify what compound files should not be scanned for viruses, use the following settings:

    Extract archives in background if larger than ... MB. If the size of a compound object exceeds this restriction, the program will scan it as a single object (by analyze the header) and will return it to the user. The objects that it contains will be scanned later. If the box is not checked, access to files larger than the size indicated will be blocked until they have been scanned.
    Do not process archives larger than.. MB. In this case, files larger than the size specified will be skipped by the scan.
Also see:

Creating a protection area

Restoring default protection settings

Selecting actions for objects


List of files scanned by extension

If you selected [image] Scan programs and documents (by extension) for objects to scan for viruses, File Anti-Virus will scan files with these extensions in-depth for viruses:
    com - executable file for a program no larger than 64 KB
    exe - executable file or self-extracting archive
    sys - system file
    prg - program text for dBase, Clipper or Microsoft Visual FoxPro, or a WAVmaker program
    bin - binary file
    bat - batch file
    cmd - command file for Microsoft Windows NT (similar to a .bat file for DOS), OS/2.
    dpl - compressed Borland Delphi library
    dll - dynamic loading library
    scr - Microsoft Windows splash screen
    cpl - Microsoft Windows control panel module
    ocx - Microsoft OLE (Object Linking and Embedding) object
    tsp - program that runs in split-time mode
    drv - device driver
    vxd - Microsoft Windows virtual device driver
    pif - program information file
    lnk - Microsoft Windows link file
    reg - Microsoft Windows system register key file
    ini - initialization file
    cla - Java class
    vbs - Visual Basic script
    vbe - BIOS video extension
    js, jse - JavaScript source text
    htm - hypertext document
    htt - Microsoft Windows hypertext header
    hta - hypertext file used to update the operating system register
    asp - Active Server Pages script
    chm - compiled HTML file
    pht - HTML with built-in PHP scripts
    php - script built into HTML files
    wsh - Windows Script Host configuration file
    wsf - Microsoft Windows script
    the - Microsoft Windows 95 desktop wallpaper
    hlp - Win Help file
    eml - Microsoft Outlook Express e-mail file
    nws - Microsoft Outlook Express new e-mail file
    msg - Microsoft Mail e-mail file
    plg - e-mail
    mbx - extension for saved Microsoft Office Outlook e-mails
    doc - Microsoft Office Word document
    dot - Microsoft Office Word document template
    fpm - database program, start file for Microsoft Visual FoxPro
    rtf - Rich Text Format document
    shs - Shell Scrap Object Handler fragment
    dwg - AutoCAD blueprint database
    msi - Microsoft Windows Installer packet
    otm - VBA project for Microsoft Office Outlook
    pdf - Adobe Acrobat document
    swf - Shockwave Flash file
    jpg, jpeg - compressed image graphics format
    emf - Enhanced Metafile format Next generation of Microsoft Windows OS metafiles. EMF files are not supported by 16-bit Microsoft Windows.
    ico - icon file for a program (Windows, Unix, Gimp)
    ov? - MS DOC executable files
    xl* - Microsoft Office Excel documents and files, such as: xla - Microsoft Office Excel extension, xlc - diagram, xlt - document templates, etc.

    pp* - Microsoft Office PowerPoint documents and files, such as: pps - Microsoft Office PowerPoint slide, ppt - presentation, etc.

    md* - Microsoft Office Access documents and files, such as: mda - Microsoft Office Access work group, mdb - database, etc.

Remember that the actual format of a file may not correspond with the format indicated in the file extension.


Creating a protection area

File Anti-Virus by default scans all files when they are used, regardless of where they are stored, whether it be a hard drive, CD-ROM, or flash disk.
You can limit the scope of protection. To do so:
  1. Select File Anti-Virus in the main window and go to the component settings window by clicking Settings.
  2. Click the Customize button and select the [image] Protection scope tab in the window that opens.
The tab displays a list of objects that File Anti-Virus will scan. Protection is enable by default for al objects on hard drives, removable media, and network drives connected to your computer. You can add to and edit list using the Add, Edit, and Delete buttons.
If you want to narrow the range of the protected objects, you can do so using the following methods:
  • Specify only folders, drives, and files that need to be protected.
  • Combine methods one and two; in other words, create a protection scope from which a number of objects are excluded.

Warning!
Remember that File Anti-Virus will scan only the files that are included in the protection scope created. Files that are not included in that scope will be available for use without scanning. This increases the risk of infection on your computer.

Also see:

Selecting objects to scan

Restoring default protection settings


Selecting objects to scan

The Select objects to scan window displays a list of all the objects on your computer that you can scan for viruses.
In order to add one of the listed objects to the virus scan list, select it and click OK.
In order for the scan to be carried out recursively, check [image] Include subfolders.


Restoring default protection settings

When configuring File Anti-Virus, you can always return to the recommended performance settings.
In order to restore the default File Anti-Virus settings,
  1. Select File Anti-Virus in the main window and go to the component settings window by clicking Settings.
  2. Click the [image] Default button in the Security Level section.


Selecting actions for objects
If, a file is infected or suspected of being infected, the subsequent actions of File Anti-Virus depend on the objects status and the selected action.
File Anti-Virus can label an object with one of the following statuses:
  • status as a malicious program (for example, virus, Trojan).
  • Suspicious, when the scan cannot determine whether the object is infected. This means that the code in the file contains a section of code that resembles a known but altered virus, or is reminiscent of a the structure of a virus sequence.
By default, all infected files are subject to disinfection, and if they are suspicious, they are sent to Quarantine.
To change an action for an object,

select File Anti-Virus in the main window and go to the component settings window by clicking [image] Settings. All potential actions are displayed in the appropriate sections.

If the action selected was
When it detects a malicious or suspicious object
Prompt for action
File Anti-Virus issues a warning message containing information about what malicious program has infected or potentially infected the file and gives you the choice of one of the following actions. Depending on the status of the object, actions can vary.
Block access
File Anti-Virus blocks access to the object. Information about this is recorded in the report. You can try to treat this object later.
Block access
    Disinfect
File Anti-Virus will block access to the object and will attempt to disinfect it. If it is successfully disinfected, it is restored for regular use. If the object could not be treated, it is moved to Quarantine. Information about this is recorded in the report. Later you can attempt to disinfect this object.

Block access
    Disinfect
    Delete if disinfection fails
    File Anti-Virus will block access to the object and will attempt to disinfect it. If it is successfully disinfected, it is restored for regular use. If the object cannot be disinfected, it is deleted. A copy of the object will be stored in Backup.

    Block access

      Disinfect
      Delete
    File Anti-Virus will block access to the object and will delete it.

    Regardless of the status of the object (infected or suspicious), before attempting to treat the object or delete it, Active Virus Shield creates a backup copy and sends it to Backup in case the object needs to be restored or an opportunity arises to treat it.


File Anti-Virus statistics

All operations carried out by File Anti-Virus are recorded in a special report.
Total statistics are given in the main program window in the Statistics section. Here you can review the number of files scan since File Anti-Virus was started, what file was scanned last, how many files among those scanned had viruses found in them, how many of them were not disinfected for one reason or another, and which file is being scanned in the current moment.
To see more detailed information on component operation, left-click anywhere in the section. You will see a detailed report on the component operation, grouped on tabs:
  • All dangerous objects detected in the File system protection process are listed on the Detected tab. Here you will find the full path to the location of each object and the status assigned to it by File Anti-Virus: if themalicious program infected the object was successfully identified, it will be assigned the appropriate status. For example, virus, Trojan, etc. If the type of malicious effect cannot be identified, the object is assigned the status suspicious. Next to the status, the action taken for the object is specified (detected, not found, disinfected). In order for this tab not to contain information about disinfected objects, uncheck [image] Show treated files.
  • A complete list of events that have arisen while using File Anti-Virus is kept on the Events tab. The events can have the following statuses:
    • Informative event (for example: object not processed: skipped by type).
    • Warning (for example: a virus is detected).
    • Note (for example: the archive is password protected).

As a rule, the informative messages are for reference only. You can disable display of informative messages, by unchecking [image] Show non-critical events.

  • Scan statistics appear on the appropriate tab. Here you will find the total number of objects scanned, and separate columns that indicate how many objects out of the total number scanned are archives, how many are dangerous, how many have been disinfected, how many sent to Quarantine, etc.
  • The settings that File Anti-Virus is running with are displayed on the Settings tab. Use the Change settings link to quickly configure the component.
Also see:

Delayed object treatment

What to do if File Anti-Virus is not running


Delayed object treatment

If you selected as the action for malicious programs [image] Block access, the objects will not be treated and access to them will be blocked.
If the actions selected were:
      Block access
        Disinfect
all untreated objects will also be blocked.
In order to regain access to blocked objects, you first have to disinfect them. To do so:
  1. Select File Anti-Virus in the main window of the program and left-click anywhere in the Statistics section.
  2. Select the objects that interest you on the Detected tab and click the Action → Treat all button.
If it is successfully disinfected, it will restored for regular use. If the object cannot be treated, you will have the option to delete or skip it. In the latter case, access to the file will be restored. However, this significantly increases the risk of infection on your computer. It is strongly recommended not to skip dangerous objects.
Also see:

Selecting actions for objects


Mail Anti-Virus

Active Virus Shield includes a special component that protects incoming and outgoing mail from dangerous objects, E-mail Anti-Virus. It loads when the operating system is started and is always running and scans all e-mail on protocols POP3, SMTP, IMAP, MAPI1 and NNTP.
The indicator of the component's operation is the Active Virus Shield system tray icon, which looks like [image] whenever an e-mail is being scanned.
By default, e-mail protection is carried out as follows:
  1. Each e-mail received or sent by the user is intercepted by E-mail Anti-Virus.
  2. The e-mail is broken down into its parts: the e-mail heading, its body, and attachments.
  3. The body and attachments of the e-mail (including OLE attachments) are scanned for dangerous objects. Malicious objects are detected using the threat signatures included in the program and with the heuristic algorithm. The signatures contain descriptions of all the malicious programs known to date and methods for neutralizing them. The heuristic algorithm can detect new viruses that have not yet been entered in the threat signatures.
  4. After the virus scan, the following behavior options are available:
    • if the body or attachments of the e-mail contain malicious code, E-mail Anti-Virus will block the e-mail, place a copy of the infected object in back-up, and will try to disinfect the object. If the e-mail is successfully disinfected, it becomes available to the user again. If not, the infected object in the e-mail is deleted. After the anti-virus scan, special text is inserted in the subject line of the e-mail, stating that the e-mail has been processed by Active Virus Shield.
    • If code is detected in the body or an attachment that appears to be malicious but there is no guarantee, the suspicious part of the e-mail is sent to Quarantine.
    • If no malicious code is discovered in the e-mail, it is immediately made available again to the user.
When working with other mail programs (including Microsoft Outlook Express, Mozilla Thunderbird, Eudora, Incredimail), E-mail Anti-Virus scans mail on SMTP, POP3, IMAP, and NNTP protocols.
1. Note that e-mails transmitted on IMAP are not scanned in Thunderbird if you use filters that move them out of your Inbox.
2. It should be noted that e-mail messages transmitted on SSL protocol are not scanned by E-mail Anti-Virus.
Also see:

Mail protection status

Pausing and disabling e-mail protection

Selecting a security level

Configuring mail protection

Component operation statistics

1E-mails sent with MAPI are scanned using a special plug-in for Microsoft Office Outlook and The Bat!


Mail protection status

All the necessary information on mail protection can be found in the [image] Mail Anti-Virus subsection of the Protection section of the main program window.
The most important is E-mail Anti-Virus status:
  • Mail Anti-Virus : running -- protection is enabled for your e-mail against viruses.
  • E-mail Anti-Virus : paused - mail protection from spam is disabled for a certain period of time. The component refreshes its work automatically when the program is restarted or after the length of time has expired for which Active Virus Shield was paused. You can also enable E-mail Anti-Virus manually. To do so, click the [image] button in the status field.
  • Mail Anti-Virus : disabled - the component has been stopped by the user. You can enable e-mail protection. To do so, click the [image] button in the status field.
  • Mail Anti-Virus : malfunction - e-mail protection is not available for some reason. For example, you do not have a license key to use the program.
  • Mail Anti-Virus : running (subsystem malfunction) - the component encountered an error. In such a case, view the report on the operation of E-mail Anti-Virus. It is possible that you will find the reason for the error there. If you cannot work through the problem on your own, contact the Support.
Information on the level of e-mail protection that E-mail Anti-Virus is running on and on the action taken if dangerous objects are detected in your e-mail is available in the Status section. By left-clicking any place in the section, you can easily begin editing the current E-mail Anti-Virus settings.
The Statistics section displays composite information on the performance of the component. Here you can view the number of e-mail objects scanned since the program was opened and the number of malicious objects. You can view detailed information on component operation in the report by left-clicking anywhere in that area.


Pausing and disabling e-mail protection

E-mail protection is enabled by default. You can pause or disable Mail Anti-Virus completely or for a certain length of time.
To pause Mail Anti-Virus,

select [image] Mail Anti-Virus in the Protection section of the main window and click [image] the status field.

The component status will change to paused. E-mail protection from dangerous objects will be paused until you restart the program or enable the component using the [image] button in the status field.

To stop Mail Anti-Virus,

Click the [image] button in the status field. In this case, the component status will change to disabled. Protection will be disabled until you enable the component using the [image] button in the status field.

The differences between the options listed above for disabling E-mail Anti-Virus consist of the following:
  • when you pause protection (the [image] button), the component is not emptied from the memory, and the component statistics for the current Active Virus Shield session are saved and continue to be determined after the component is updated;
  • when you stop protection (the [image] button), the component is emptied from the memory, all the statistics from previous work are cleared and when E-mail Anti-Virus is started the statistics start over.
To disable e-mail protection,
  1. Open the Active Virus Shield settings window by clicking Settings in the main program window.
  2. Select [image] Mail Anti-Virus in the settings tree.
  3. In the right-hand part of the window, uncheck the [image] Enable Mail Anti-Virus box.

Warning!
Remember that if you disabled E-mail Anti-Virus in the settings window, it will not automatically be enabled after restarting the program. To resume e-mail protection, you must check [image] Enable Mail Anti-Virus.

By disabling E-mail Anti-Virus in the main window, the component status changes to disabled, and the component list in the Protection section its name will go inactive (gray).
E-mail Anti-Virus can also be disabled by fully disabling protection on your computer.


Selecting an e-mail security level

Active Virus Shield protects your e-mail on one of the following levels:
    High - the level with the most comprehensive monitoring of incoming and outgoing e-mails. When set to high, Active Virus Shield scans e-mail attachments in detail regardless of the time of the scan, including for archives.
    Recommended - When set to this level, Active Virus Shield scans the same objects as High, with the exception of attachments or e-mails that will take more than three minutes to scan. This is the default level of e-mail security.
    Low - When set to this level, Active Virus Shield only scans your incoming e-mail. Archives and e-mail attachments that take more than three minutes to scan are not scanned. It is recommended that you only use this level if you have additional e-mail protection software installed on your computer.
You can raise or lower the e-mail security level.
In order to change the security level,

Adjust the sliders. By altering the security level, you define the ratio of scan speed and the total number of objects scanned. The fewer e-mail objects that are scanned, the higher the scan speed.

If any of the pre-installed levels does not fully meet your needs, you can alter its settings and create a User defined security level.
Example:

Your computer is outside of the local network and uses a dial-up Internet connection. You use Microsoft Outlook Express as a mail client for receiving and sending e-mail, and one of the free e-mail services as a mail service. Your mail contains archived attachments. How do you maximally protect your computer from infection through e-mail?

Tip for selecting a level:

Because you have no centralized e-mail protection and are using a dial-up Internet connection, one can come to the conclusion that danger of a malicious program infecting your computer through e-mail in the scenario outline is high.

Therefore, it is recommended that you use High as your basic pre-installed security level, and reduce the scan time for attachments, for example, to 1-2 minutes.

To modify the settings for a preconfigured security level,

click the [image] Customize button in the E-mail Anti-Virus settings window. Edit the mail protection settings in the window that opens and click OK.

Also see:

Selecting a protected e-mail group

Selecting actions for dangerous e-mail objects


Configuring e-mail protection

The type of e-mail scan and the actions taken by Active Virus Shield after the scan are dependant on several settings. The settings can be broken down into the following groups:
  • settings that define the protected group of e-mails;
  • settings that define actions on dangerous e-mail objects.
This Help section will examine the settings listed above in detail.


Selecting a protected e-mail group

E-mail Anti-Virus allows you to select exactly what group of e-mails must be scanned for dangerous objects.
By default, Active Virus Shield protects e-mail in accordance with the Recommended protection level, which means that both incoming and outgoing mail is scanned. When you first begin using Active Virus Shield, it is recommended that you scan outgoing mail, since there may be worms on your computer that use e-mail as a channel for distributing themselves.
If you are certain that the e-mails that you are sending cannot contain dangerous objects, you can disable the outgoing mail scan. To do so:
  1. Click on the Customize button in the E-mail Anti-Virus configuration window.
  2. In the [image] Mail Anti-Virus settings window that opens, select [image] Incoming mail in the Scope section.
In addition to selecting an e-mail group, you can specify whether archived attachments should be scanned and also set the maximum amount of time for scanning one e-mail object. These settings are configured in the Do not scan section of the General tab.
If your computer is not protected by any local network software, and you do not use a proxy server or a firewall when connecting to the Internet, it is recommended that you do not disable the archived attachment scan and that you do not to set a time limit on scanning.
If you are working in a protected environment, you can change the time restrictions on scanning to increasing the e-mail scan speed.
You can configure the filtration conditions for objects connected to an e-mail in the Attachment filter section:
    Disable filtering - When this is set, Active Virus Shield will not use additional filtration for attachments.
    Rename selected file types - When this is selected, Active Virus Shield will filter out a certain attachments and replace the last character of the file name with an underscore. You can select the file type by clicking the File types button.
    Delete selected file types - When this is selected, Active Virus Shield will filter out and delete a certain attachments based on the file type. You can select the file type by clicking the File types button.
You add security to your computer by using a filter, since malicious programs spread through mail most frequently as attachments. By renaming or deleting certain attachment types, you protect your computer from automatically opening attachments when a message is received and also from other potential hazards.
Also see:

Attachment types

Configuring e-mail processing in Microsoft Office Outlook

Configuring e-mail scans in The Bat!


Attachment types

If you have enabled attachment filters, you will need to specify the extensions that will be renamed or deleted by the filter. You can select to rename any of the file types below:
    com - executable file for a program no larger than 64 KB.
    exe - executable file or self-extracting archive
    sys - system file
    prg - program text for dBase, Clipper or Microsoft Visual FoxPro, or a WAVmaker program.
    bin - binary file
    bat - batch file
    cmd - command file for Microsoft Windows NT (similar to a .bat file for DOS), OS/2.
    dpl - compressed Borland Delphi library
    dll - dynamic loading library
    scr - Microsoft Windows splash screen
    cpl - Microsoft Windows control panel module
    ocx - Microsoft OLE (Object Linking and Embedding) object
    tsp - program that runs in split-time mode
    drv - device driver
    vxd - Microsoft Windows virtual device driver
    pif - program information file
    lnk - Microsoft Windows link file
    reg - Microsoft Windows system register key file
    ini - initialization file
    cla - Java class
    vbs - Visual Basic script
    vbe - BIOS video extension
    js, jse - JavaScript source text
    htm - hypertext document
    htt - Microsoft Windows hypertext header
    hta - hypertext file used to update the operating system register
    asp - Active Server Pages script
    chm - compiled HTML file
    pht - HTML with built-in PHP scripts
    php - script built into HTML files
    wsh - Windows Script Host configuration file
    wsf - Microsoft Windows script
    the - Microsoft Windows 95 desktop wallpaper
    hlp - Win Help file
    eml - Microsoft Outlook Express e-mail file
    nws - Microsoft Outlook Express new e-mail file
    msg - Microsoft Mail e-mail file
    plg - e-mail
    mbx - extension for saved Microsoft Office Outlook e-mails
    doc - Microsoft Office Word document
    dot - Microsoft Office Word document template
    fpm - database program, start file for Microsoft Visual FoxPro
    rtf - Rich Text Format document
    shs - Shell Scrap Object Handler fragment
    dwg - AutoCAD blueprint database
    msi - Microsoft Windows Installer packet
    otm - VBA project for Microsoft Office Outlook
    pdf - Adobe Acrobat document
    swf - Shockwave Flash file
    jpg, jpeg - compressed image graphics format
    emf - Enhanced Metafile format Next generation of Microsoft Windows OS metafiles. EMF files are not supported by 16-bit Microsoft Windows.
    ico - icon file for a program (Windows, Unix, Gimp)
    ov? - MS DOC executable files
    xl* - Microsoft Office Excel documents and files, such as: xla - Microsoft Office Excel extension, xlc - diagram, xlt - document templates, etc.
    pp* - Microsoft Office PowerPoint documents and files, such as: pps - Microsoft Office PowerPoint slide, ppt - presentation, etc.
    md* - Microsoft Office Access documents and files, such as: mda - Microsoft Office Access work group, mdb - database, etc.

Remember that the actual format of a file may not correspond with the format indicated in the file extension.


Adding a file name mask

In this window, you can add a file name mask that will filter e-mail attachments.

File mask is a file name and extension represented with wildcards. The two basic wildcards used in file masks are * and ?, * standing for any number of characters, and ? standing for any one character. Using these wildcards, you can represent any file. Note that the name and extension are always separated by a period.


Configuring e-mail processing in Microsoft Office Outlook

If you use Microsoft Outlook as your mail client, you can set up custom virus scan configurations.
When you install Active Virus Shield, a special plug-in is installed in Microsoft Office Outlook. It will allow you to quickly review E-mail Anti-Virus settings and also determine at what time the e-mail will be scanned for dangerous objects.
The plug-in comes in the form of a special Active Virus Shield tab located under Tools ® Options within Microsoft Outlook.
Select the e-mail scan modes:
    Scan on delivery - analyze every e-mail when it enters your inbox.
    Scan on read - scan the e-mail when you open it to read it.
    Scan on send - analyze each e-mail you send for viruses at the time that you send it.

Warning!
If you connect to your mail service using the Microsoft Office Outlook IMAP protocol, it is recommended that you do not use the Scan upon Receiving mode. Enabling this mode will force e-mails to be copied to the local computer when delivered them to the server, and consequently the main advantage of IMAP, creating less traffic and dealing with unwanted e-mail on the server without copying them to the user's computer, is lost

You can configure the actions that will be taken when dangerous email objects are found by clicking here.
Also see:

Configuring e-mail scans in The Bat!

Selecting actions for dangerous e-mail objects


Configuring e-mail scans in The Bat!

The actions that are taken when an infected e-mail object is found when using The Bat! are defined with the program's own tools.

Warning!
The E-mail Anti-Virus settings that determine whether incoming and outgoing e-mail is scanned, as well as actions on dangerous e-mail objects and exclusions, are ignored. The only thing that The Bat! takes into account is scanning archived attachments and time limits on scanning one e-mail object.

To set up e-mail protection rules in The Bat!,
  1. Select Settings from the Properties menu.
  2. Select Virus protection from the settings tree.
The protection settings presented extend to all the anti-virus modules installed on the computer that support work with the Bat!
You must decide:
  • Which e-mails will be subject to anti-virus scans (incoming, outgoing);
  • When e-mail objects will be scanned for viruses (when opening an e-mail or before saving one to disk);
  • The actions taken by the mail client when dangerous objects are detected in e-mails. For example, you can select:
      • Attempt to disinfect infect parts - tries to treat the infected e-mail object, and if the object cannot be disinfected, it stays in the e-mail. Active Virus Shield will always inform you that the e-mail object is infected. But even if you select Delete in the E-mail Anti-Virus notice window, the object will remain in the e-mail, since the action selected in The Bat! takes precedent over the actions of E-mail Anti-Virus.
      Delete infected parts - deletes the dangerous object in the e-mail, regardless of whether it is infected or suspected of being infected.

By default, The Bat! places all infected e-mail objects in the Quarantine folder without treating them.

Warning!
The Bat! does not give e-mails containing dangerous objects special headers.

Also see:

Configuring e-mail processing in Microsoft Office Outlook

Selecting actions for dangerous e-mail objects


Restoring default Mail Anti-Virus settings

When configuring Mail Anti-Virus, you can always return to the recommended performance settings.

To restore the default Mail Anti-Virus settings:
  1. Select Mail Anti-Virus in the main window and go to the component settings window by clicking Settings.
  2. Click the [image] Default button in the Security Level section.


Selecting actions for dangerous e-mail objects

If an email virus scan shows that an e-mail or any of its parts (header, body, attachment) is infected or is suspected to be infected, the further operations of E-mail Anti-Virus depend on the status of the object and the action selected.
One of the following statuses can be assigned to the e-mail object after the scan:
  • status of a type of malicious program (for example, virus, Trojan).
  • Suspicious, when the scan cannot determine whether or not the object is infected. This means that the code in the object contains a section of code that resembles a known but altered virus, or is reminiscent of a the structure of a virus sequence.
By default, upon detection of a dangerous or suspicious object, E-mail Anti-Virus displays a warning on the screen and offers a choice of several actions for the object.
To change an action for an object,

open the Active Virus Shield settings window and select [image] E-mail Anti-Virus. All possible actions for dangerous objects are listed in the Action section.

Let's look at the possible options for processing dangerous e-mail objects in more detail.

If the action selected was
When a dangerous object is detected
Prompt for action
E-mail Anti-Virus will issue a warning message containing information about what malicious program has infected (potentially infected) the file and gives you the choice of one of the following actions.
Block access
Mail Anti-Virus will not process the object. Information about this is recorded in the report. You can attempt to disinfect this object later.
Block access
      Disinfect
E-mail Anti-Virus will block access to the object and take one of the following actions:
  • attempt to treat the infected object. If it is successfully disinfected, it will available for regular use. If the object cannot be disinfected, access to it will be blocked. Information about this is recorded in the report. You can attempt to disinfect this object later.
  • move the potentially infected object to Quarantine. You can attempt to disinfect this object or restore it to its original location.
Block access
      Disinfect
      Delete
      if disinfection fails1
E-mail Anti-Virus will take one of the following actions:
  • attempt to treat the infected object. If it is successfully disinfected, it will available for regular use. If the object cannot be disinfected, it is deleted.
  • move the potentially infected object to Quarantine.
Block access
      Disinfect
      Delete
When Mail Anti-Virus detects an infected or potentially infected object, it deletes it without informing the user.
1If The Bat! is used as a mail client and this action of Mail Anti-Virus is applied, dangerous objects will be either disinfected or deleted (depending on the type of action, selected in The Bat!).
Regardless of the status of the object (infected or suspicious), before attempting to treat the object or delete it, Active Virus Shield creates a backup copy and sends it to backup in case the object needs to be restored.
Also see:

Pausing and disabling e-mail protection

Selecting an e-mail security level


E-mail protection statistics

You will find general information on component operation in the main window of the program. In order to examine them, select [image] Mail Anti-Virus in the Protection section of the main window.
The Statistics section contains information on how many e-mails (e-mail body, headers, attachments) have been scanned since Active Virus Shield was loaded, how many of them were classified as dangerous objects, and how many dangerous objects were not processed, for whatever reason. To view detailed information, left-click anywhere in the section and you will be presented with a full report.
Composite statistics for E-mail Anti-Virus are found in the upper part of the report. This often overlaps with information in the Statistics section of the program's main window.
Basic information on component operation is grouped by tab in the middle of the window.
  • All the dangerous objects detected in your e-mails are listed on the Detected tab. In order for this tab not to contain information about disinfected e-mail objects, uncheck [image] Show neutralized objects.
  • A complete list of events that have arisen while using E-mail Anti-Virus is kept on the Event log tab. Events can be either informative or critical. As a rule, the informative events are for reference only. You can disable the display of informative events. To do so, uncheck [image] Show non-critical events.
  • Scan statistics appear on the appropriate tab. Here you will find the total number of e-mail objects scanned and then separate columns indicate how many objects out of the total number scanned are archives, how many are dangerous, how many have been disinfected, how many sent to Quarantine, etc.
  • All component operation settings are displaying on the Settings tab.
You should also pay attention to the status of E-mail Anti-Virus and confirm that it is currently enabled. If an error occurs in component operation, we recommend that you try restarting the component. To do so, use the [image] button in the status field. If the next attempt produces the error again, save the report on component operation in a file using the Save as button, contact Support.


Scanning for viruses on your computer

Scanning is one of the important parts of protecting your computer from viruses. Active Virus Shield can scan individual items, such as files, folders, disks, plug-and-play devices, for viruses or can scan the entire computer. Scanning for viruses helps prevent malicious code, that has escaped detected by protection, from spreading.
Active Virus Shield includes three default scan tasks.
Critical Regions

This task scans all critical areas of the computer for viruses. This critical areas that are scanned include: system memory, programs loaded on startup, boot sectors on the hard drive, and the Windows and system32 system directories. The goal of this scan is to quickly detect active viruses in the system without fully scanning the computer.

My Computer

This scan searches for viruses on your entire computer with a thorough scan of all disk drives, memory, and files.

Auto Launch Program

This scan searches all programs that are loaded when the operating system boots up for viruses.

The default settings for these tasks are the recommended ones. You can edit these settings or create a schedule for running tasks.
You also have the option of creating virus scan tasks and creating a schedule for each task. For example, you can create a task to scan the mail databases once per week or a task to scan the My Documents folder.
In addition, you can scan any object for viruses (for example, the hard drive where programs and games are stored, e-mail databases that you've brought home from work, an archive attached to an e-mail, etc.) without creating a special scan task. You can select an object to scan from the Active Virus Shield interface or with the standard tools of the Windows operating system (for example, in the Explorer program window or on your Desktop, etc.).
You can view a complete list of virus scan tasks for your computer in the Virus scan section in the left portion of the main program window.
Also see:
Virus scan task status
Managing virus scan tasks
Creating a list of objects to scan
Creating virus scan tasks
Configuring virus scan tasks
Virus scan statistics


Virus scan task status

To view the current status of a virus scan task, select the task name (for example, My Computer) in the left-hand part of the main program window in the [image] Scan section. The status line in the right-hand part of the window will display information on the task being performed:
  • Task name : running - the task is currently being performed. While the task is running, its name will be in green on the task list.
  • Task name : paused - the user has paused this task. To resume the scan, click the [image] button in the status field.
  • Task name : stopped - the user stopped this virus scan task before it was completed. The next time you run the task, the program will ask if you would like to continue the task where it stopped or begin it over.
  • Task name : completed - this virus scan task has finished successfully.
You will see the list of objects to be scanned during a given task in the upper part of the window under the status line. You can edit this list by adding or removing objects from it.
The Settings section displays the settings that have been applied to the current task. The security level and action indicated here are the actions that that the program will apply when it detects malicious objects. By left-clicking any place in the section, you can begin editing the current task settings.
The Statistics section contains composite information on the task execution, including the number of objects scanned during the last run, the number of malicious objects detected, the number of objects not processed, and the time that the task was last run. You can view detailed information on the scan results by left-clicking anywhere in that section.


Managing virus scan tasks

You can run a virus scan task manually or automatically using a schedule.
To start a virus scan task manually,

Select the task name in the Scan section of the main program window and click the [image] button on the status line.

To pause a task,

Click the [image] button in the status field. The task status will change to paused. This will pause the scan until you start the task again manually or it starts again automatically according to the schedule.

To stop a task,

Click the [image] button in the status field. The task status will change to stopped. This will stop the scan until you start the task again manually or it starts again automatically according to the schedule. The next time you run the task, the program will ask if you would like to continue the task where it stopped or begin it over.


Creating a lists of objects to scan

To view a list of objects to be scanned with a particular task, select the task name (for example, My computer) in the Virus scan section of main program window. The list of objects will be displayed in the right-hand part of the window of the status line.
Default object scan tasks are created when you install the program. When creating your own tasks you can create a list of objects.
You can add to and edit an object scan list using the buttons to the right of the list. To add a new scan object to the list, click the Add button, and in the window that opens select the object to be scanned. To delete an object, select it in the list (when you do so, the name of the object will be highlighted in gray) and click the Delete button. You can temporarily disable scanning for individual objects for any task without deleting them from the list. To do so, you only need to uncheck the object that you do not want scanned.
To start a scan task, click the Scan button, select Scan from the menu that opens when you click the Actions button.
In addition, you can select an object to be scanned with the standard tools of the Windows operating system (for example, in the Explorer program window or on your Desktop, etc.). To do so, place the cursor or the name of the selected object, open the Windows context menu by right-clicking, and select Scan for viruses.


Creating your own virus scan tasks

Creating virus scan tasks

To scan objects on your computer for viruses, you can use built-in scan tasks included with the program, as well as creating your own tasks. New tasks are created based on scan tasks that already exist.
To create a new virus scan task,
  1. Select the task with the settings closest to those you need in the Scan section of the main program window.
  2. Right-click or click the Actions button to the right of the scan object list and select Save as....
  3. Enter the name for the new task in the window that opens and click OK. A task with that name will then appear in the list of tasks in the Scan section of the main program window.
Warning!
The maximum number of tasks the user can create is four.
The new task inherits all of the properties of the task on which it was based. You need to continue setting it up by creating an scan object list, setting up properties that will govern the task, and, if necessary, configuring a schedule for running the task automatically.
To rename a task,

select the task in the Scan section of the main program window, right-click or click the Actions button on the right of the list of scan objects, and select Rename.

Enter the new name for the task in the window that opens and click OK. The task name will then be changed in the Virus scan section.
To delete a task,

select the task in the Scan section of the main program window, right-click or click the Actions button on the right of the list of scan objects, and select Delete.

Confirm that you want to delete the task in the window that asks you for confirmation. The task will then be deleted from the list of tasks in the Scan section.
Warning!
You can only rename and delete tasks that you have created.
Also see:
Configuring virus scan tasks


Configuring virus scan tasks

The methods you use to scan objects on your computer is determined by a set of properties assigned to each task.
To begin configuring task settings,

select the task name in the Scan of the main window and use the Settings link to open the task settings window.

You can use the settings window for each task to:
  • select a security level with the settings that the task will use;
  • edit advanced settings:
    • specify the settings that define what file types are to be scanned for viruses;
    • configure task start using a different user profile;
    • configure advanced scan settings;
  • restore default scan settings;
  • select an action that the program will apply when it detects an infected or suspicious object;
  • create a schedule to automatically run tasks.
In addition, you can configure universal settings for running all tasks.
This Help section will examine the task settings listed above in detail.


Selecting a security level

Each virus scan task scans objects on one of these levels:
High - the most complete scan of the entire computer or individual disks, folders, or files. We recommend using this level if you suspect that a virus has infected your computer.
Recommended – Scans the same items as High except for e-mail formatted files.
Low - Scans less files and therefore, lets you comfortably use applications that require significant system resources.
By default, the file protection is set to Recommended.
You can raise or lower the scan security level by selected the level you want or changing the settings for the current level.
In order to change the security level,

Adjust the sliders. By adjusting the security level, you define the ratio of scan speed and the total number of files scanned: the fewer files are subject to analysis for viruses, the higher the scan speed.

If none of the file security levels listed meet your needs, you can customize the protection settings. To do so, create a User Defined level by selecting the level that is closest to what you need as a starting point and edit its settings.
To modify the settings for the current security level,

click the Settings button in the task settings window. Edit the file scan settings in the window that opens and click OK.

As a result, a fourth security level will be created, User, which contains the protection settings that you assigned.

Also see:
Defining the types of objects to be scanned
Other virus scan settings
Restoring default scan settings


Defining the types of objects to be scanned
When specifying the types of objects to be scanned, you establish what file formats, sizes, and what drives will be scanned for viruses this task runs.
The types of file to be scanned is defined in the File types section. Select one of the three options:
All. With this option, all objects will be scanned without exception.
Programs and documents (by contents). If you select this group of programs, only potentially infected files will be scanned.
Note There are files in which viruses cannot insert themselves, because the code of these files does not contain any "snags" for the virus. An example of such a file would be .txt format files.

Before searching for viruses in an object, its internal header is analyzed for the file format (txt, doc, exe, etc.).

Programs and documents (by extension). In this case, the program will only scan potentially infected files, and in doing so, the file format will be determined by extension. Using the extension link, you can review a list of file extensions that are scanned in this case.
Tip: Do not forget that someone could send a virus to your computer with the extension .txt, although in reality it could be an executable file renamed as a .txt file. If you select the Scan Programs and documents (by extension) option, such a file would be skipped by the scan. If the Scan Programs and documents (by contents) is selected, ignoring extensions, the program will analyze file headers, which will uncover that the file is an .exe file. Such a file would be thoroughly scanned for viruses.
In the Productivity section, you can specify that only new files and those that have been modified since the previous scan or new files should be scanned for viruses. This mode of operation noticeably cuts down on scan time and increases the program's performance speed. To do so, you must check [image] Scan new and changed files only . This mode extends to simple and compound files.
You can also set time limits for scanning individual objects in the Productivity section. To do so, check [image] Skip if the scan takes longer than ... seconds and enter the maximum scan time for an object. Then, if this time is exceeded, this object will be removed from the scan queue.
In the Compound files section, specify which compound files must be analyzed for viruses:
Scan all/only new archives – scan .rar, .arj, .zip, .cab, .lha, .jar, and .ice archives.
Scan all/only new embedded OLE objects - scan objects imbedded in files (for example, Excel spreadsheets or a macro imbedded in a Microsoft Word file, e-mail attachments, etc.).
For each type of compound file, you can select and scan all files or only new ones. To do so, use the link next to the name of the object. It changes its value when you left-click it. If the Productivity section has been set up only to scan new and changed files, you will not be able to select the type of compound files to be scanned.
Parse e-mail formats - scan e-mail format files and e-mail databases. If this box is unchecked, the program will not scan e-mail formats, and the report will display information on the object with an ok status.
Please note these points of scanning password-protected e-mail databases:
  • Active Virus Shield detects malicious code in Microsoft Office Outlook 2000 databases but does not treat them;
  • the program does not support scans for malicious code in Microsoft Office Outlook 2003 protected databases.
Scan password-protected archives - scans password protected archives. With this feature, a window will request a password before scanned archived objects. If this box is not checked, password-protected archives will be skipped.
Also see:
Restoring default scan settings


Restoring default scan settings

When configuring scan task settings, you can always return to the recommended settings. These settings are considered to be optimal and are reflected in the Recommended security level.
In order to restore the default file protection settings,
  1. Select the task name in the Scan of the main window and use the Settings link to open the task settings window.
  2. Click the [image] Default button in the Security Level section.
Also see:
Selecting a security level


Selecting actions for objects
If, while scanning a file for viruses, it is discovered that the file is infected or suspected of being infected, the program's subsequent actions depend on the object's status and the action selected.
One of the following statuses can be assigned to the object after the scan:
  • status of a type of malicious program (for example, virus, Trojan).
  • Suspicious, when the scan cannot determine whether the object is infected. This means that the code in the file contains a section of code that resembles a known but altered virus, or is reminiscent of a the structure of a virus sequence.
By default, all infected files are subject to disinfection, and if they are suspicious, they are sent to Quarantine.
To change an action for an object,

select the task name in the Scan of the main program window and use the [image] Settings link to open the task settings window. All potential actions are displayed in the appropriate sections.

If the action selected was
When it detects a malicious or suspicious object
Prompt for action when the scan is complete
Active Virus Shield does not process the objects until the end of the scan. When the scan is complete, the statistics window will pop up with a list of objects detected, and you will be asked if you want to process the objects.
Prompt for action during scan
Active Virus Shield will issue a warning message containing information about what malicious code has infected (or potentially infected) the file and gives you the choice of one of the following actions.
Do not prompt for action
Active Virus Shield records information about objects detected in the report without processing them or notifying the user. This feature is not recommend using this feature, since infected and suspicious objects stay on your computer.
Do not prompt for action
Disinfect
Active Virus Shield attempts to treat the object detected without asking the user for confirmation. If the program cannot disinfect the object, it moves it to quarantine. Information about this is recorded in the report. You can attempt to disinfect this object later.
Do not prompt for action
Disinfect
Delete if disinfection fails
Active Virus Shield attempts to treat the object detected without asking the user for confirmation. If the object cannot be disinfected, it is deleted.
Do not prompt for action
Disinfect
Delete
Active Virus Shield automatically deletes the object.

Regardless of the status of the object (infected or suspicious), before attempting to treat the object or delete it, Active Virus Shield creates a backup copy and sends it to backup in case the object needs to be restored.


Starting scan tasks with a different user profile

Starting tasks with another user’s rights

Active Virus Shield has a feature that can start scan tasks under another profile. This feature is disabled by default, and tasks are run under the profile under which you are logged into the system.
If you need access rights to a certain object during a scan, you can configure tasks to run under a user that has the necessary privileges.
To configure a scan task that starts under a different user profile,
  1. Select the task name in the Scan of the main window and use the Settings link to open the task settings window.
  2. Click the Customize button in the task settings window and go to the Advanced tab in the window that opens.
To enable this feature, check [image] Run this task as. Enter the data for the login that you want to start the task as below: user name and password.

Also see:

Other virus scan settings


Other virus scan settings

In addition to configuring the basic virus scan settings, you can also use advanced settings:
Enable iChecker technology - uses technology that can increase the scan speed by skipping objects that have not been altered since the last scan, provided that scan settings (threat signatures and settings) have not changed. Information about this is stored in a special database.
If you have an archived file that the program scanned and assigned the status of not infected, the next time, the program will skip this archive, unless it has been altered or the scan settings have been changed. If the structure of the archive has changed, because a new object has been added to it, if the scan settings have changed, or if the threat signatures have been updated, the program will scan the archive again.
There are limitations to iChecker: it only applies to objects with a structure that Active Virus Shield recognizes (for example, .exe, .dll, .lnk, .ttf, .inf, .sys, .com, .chm, .zip, .rar).
Enable iSwift technology - use technology that can increase scan speed by only scanning new and altered objects. There are limitations to iSwift: it only applies to objects in NTFS file systems.
Using the iSwift technology is not possible on computers running Microsoft Windows 98SE/ME/XP64 operating system.
Show detected threats on the "Detected" report tab - display a list of threats detected during the scan on the Dangerous objects tab of the report window. Disabling this function may be appropriate for special scans or, for example, text collections to increase the scan speed.

Also see:

Starting scan tasks with a different user profile


Configuring a scan task schedule
You can run a virus scan task manually or schedule the task to run automatically.
There is no schedule installed with the program. Startup items are scanned every time you start your computer.
If the task settings do not meet your needs, you can edit the settings and enable automatic scans. To do so, select the task name in the main program window in the Scan section and open the settings window for that task by clicking Settings.
To establish a scanning schedule, check the automatic task start box in the Launch section. You can edit the conditions for starting the scan task in the Schedule window that opens when you click Edit.
The most important step is to determine the frequency of how often the virus scan task starts. You can select one of these options:
Once. The task will run once on the day and at the time that you specify.
Minutely. The time interval between scans is the number of that you specify It must not exceed 59 minutes.
Hourly. The interval between scans is calculated in hours. If you select this frequency, specify the interval in the schedule settings: Every n-th hour and enter the value for n. For example, enter Every 1 hour if you want the task to run hourly.
Daily - the task will run every several days. Specify how often the scan should run in the schedule settings:
  • Select the Every n-th day option and enter a value for n. Enter Every 2 day if you want to run the scan every other day.
  • Select Every weekday if you want the scan to run daily, Monday through Friday.
  • Select Every weekend for the task to run on Saturdays and Sundays only.

In addition to the frequency, specify what time of day or night the scan task will run in the Time field.

Weekly - the scan task will run on certain days of the week. If you select this option, check the days of the week that you want the scan to run. Also enter the time at which the scan task will run in the Time field.
Monthly - the scan task will run once per month at the specified time.
Note that the scan task for startup items has a specific schedule. You can configure how it runs automatically every time you turn on the computer and/or download threat signatures updates. To do so, check the corresponding boxes in the Launch section of the task settings window.

If a scan task is skipped for any reason (for example, the computer was not on at that time), you can configure the task that was missed to start automatically as soon as it can. To do so, check [image] Run task if skipped in the schedule window.

Also see:
Managing virus scan tasks


Designating universal scan settings for all tasks

Each scan task is executed according to its own settings. Active Virus Shield is installed with a default set of settings.
You can configure universal scan settings for all tasks. You will use a set of properties used to scan an individual object for viruses as a starting point.
To assign universal scan settings for all tasks:
  1. Select the Scan section in the left-hand part of the main program window and click Settings.
  2. In the settings window that opens, configure the scan settings: select the security level, configure advanced level settings, and select an action for objects.
  3. To apply these new settings to all tasks, click the Apply button in the [image] Other scan tasks section. Confirm the universal settings that you have select in the pop-up dialogue box.


Virus scan statistics

You can find general information about the operation of each virus scan task in the main window of the program. To review this information, select a task name in the Scan section of the main program window.
The right-hand part of the main window contains information in the Statistics section about how many objects have been scanned while performing this task, how many malicious objects it has detected, and how many objects have not been processed. In addition, the time that the scan was last run is displayed here.
To view detailed information, left-click anywhere in the section. You will see a complete report on the results of the last scan, if the scan is already complete, or about the progress of the task.
The upper portion of the report contains composite statistics on the results of the task, as well as information on the number of objects scanned, the number of malicious objects detected, and the number of objects to be processed. Information is also displayed on the time that the last task started and ended and how much time was required to complete the scan.
Basic information on scan results is grouped by tab in the middle of the window.
  • All dangerous objects detected while scanning are listed on the Detected tab. Here you will find the full path to the location of each object and the status assigned to it by the program. If the type malicious program that infected the object was successfully identified, it will be assigned the appropriate status. For example, virus, Trojan, etc. If the type of malicious program cannot be exactly established, the object is assigned the status suspicious. Next to the status, the action that was taken for the object is specified (detected, not found, disinfected).

In order to remove disinfected objects from this tab, uncheck [image] Show neutralized objects.

  • The Events tab displays a complete list of events that have arisen during the scan. The events can have the following statuses:
    • Informative event (for example: object not processed: skipped by type).
    • Warning (for example: a virus is detected).
    • Note (for example: archive is password-protected).

As a rule, the informative messages are for reference only. You can disable display of informative messages. To do so, uncheck [image] Show non-critical events.

  • Scan statistics appear on the appropriate tab. You will find the total number of objects scanned, and separate columns indicating how many objects out of the total number scanned are archives, how many are dangerous, how many have been disinfected, how many sent to Quarantine, etc.
  • The settings used for the scan with are displayed on the Settings tab. Use the Edit settings link to quickly configure the task.
    In addition, you can configure advanced settings for scan tasks:
    • Establish a scan task priority ranking to be used when the processor is weighed down. The default setting for [image] Do not suspend scan if CPU is utilized by other programs is unchecked. With this feature, the program tracks the load on the processor and disk subsystems for the activity of other applications. If the load on the processor increases significantly and prevents the user's applications from operating normally, the program reduces scanning activity. This increases scan time and frees up resources for the user's applications.
    • Enable the Do shut down the computer when finished feature. This feature is helpful if you run virus scans at the end of the work day and do not want to wait for it to finish.
      However, this feature requires a few additional steps: before launching the scan, you must disable password requests for objects being scanned, if enabled, and enable automatic processing of dangerous objects. The program's interactive features will be disabled. The program will not ask questions that require an answer from you, which interrupts the scanning process. To turn off the computer after completing the scan, check the appropriate box.
If any errors occur during the scan, try running it again. If the next attempt produces the error again, save the report file using the Save as button, and contact support.


Updating the application

Keeping protection updated is a prerequisite of reliable protection of your computer. Because new viruses, Trojans, and malicious software emerge daily, it is important to update regularly the application to keep your information constantly protected.
Updating of the application implies that the following components will be downloaded and installed on your computer:
  • Threat Signatures

The application uses threat signatures to protect information on your computer. The software components that provide protection use them to search for and disinfect harmful objects on your computer. The signatures are added to every hour with records of new threats and methods of how to fight them. Therefore, it is recommended that they be updated on a regular basis.

Active Virus Shield uses threat signatures that protect you both from various malicious and potentially dangerous objects and from hacker attacks.

  • Application Modules

In addition to the signatures, you can upgrade the modules for Active Virus Shield. New application updates appear regularly.

Updates can be downloaded in one of the following modes:
  • Automatically. In this case, Active Virus Shield downloads and installs updates as soon as they become available on the update servers.
  • By schedule. The application is updated in accordance with the specified schedule.
  • Manually. You launch the updating procedure manually.
During updating, the application compares the threat signatures and application modules on your computer with the versions available on the update server. If your computer has the latest version of the signatures and application modules, you will see a notification window confirming that the protection of your computer is up-do-date. If the signatures and modules on your computer and on the update server differ, the application downloads only the incremental part of the updates. Not all the signatures and modules are downloaded, which significantly increases the speed of copying files and saves Internet traffic.
Before updating threat signatures, Active Virus Shield creates backup copies of them. This backup copy can be used if you do not want to use the last version of the database for any reason.
You might need the rollback option, for example, if you update the threat signatures and they are damaged in the process. You can easily roll back to the previous version and try to update the signatures later.
Also see:

Update status

Starting the update process

Rolling back to the previous update

Configuring update settings

Viewing update statistics


Update status

Updates are important because they ensure that protection on your computer is up-to-date. If you have not installed updates for some time, the protection of your data provided by Active Virus Shield becomes less reliable as the time passes.
To check the protection status of your computer, view the current status of the application and database updates displayed by an indicator located in the application main window in the Protection section. This is the second protection indicator.
The indicator’s appearance depends on the update status:

Signatures are loaded (date, time). No update is needed. The signatures used by Active Virus Shield are up-to-date. The application modules are also up-to-date.

Signatures are not current. This may happen if automatic updating has been disabled on your computer. For more information, see the Protection indicators section.

Signatures are out-of-date. Active Virus Shield has not been updated for a long time or updating is impossible because the license has expired.
To view the details, click [image] Update in the Service section of the application main window.
Pay attention to the component activity status:
  • Update : running - the signatures and modules for Active Virus Shield are currently being updated.
  • Update : paused - updating has been stopped using the [image] button. To resume updating, click the [image] button.
  • Update : stopped - updating has been aborted using the [image] button. To launch updating again, click the [image] button.
  • Update : completed - updating has been successfully completed.
  • Update : error – there was an error during the update for some reason. If this occurs, we highly recommend reviewing the report and finding out what caused the error. This can be either a connection failure or wrong credentials (login and password) used for authorization. If you fail to find the reason by yourself, contact Support.
  • Update : malfunction - updating is impossible for some reason. For example, you do not have the license key for the application.
Updating launch mode of the program is provided in the Settings section. To select the updating mode and configure updating settings, click your left mouse button in any area of this section.
The Statistics section displays general statistics on application updating. Here you can view the date of the last update and the number of threat signatures in the current database. The number of records is the number of threats from which your computer is now protected. To view detailed information about the last update, click your left mouse button in any place in this section. A report will open on the screen for this procedure.
Click the Update now! button to update Active Virus Shield. Click the Rollback button to roll back to the previous version of the threat signatures.
Also see:

Starting the update process

Rolling back to the previous update

Configuring update settings


Starting the update process

You can begin the update process at any time. .
You can run updating from:
  • the shortcut menu
  • the program's main window
To begin the update process from the shortcut menu:
  1. Right click the application icon in the system tray to open the shortcut menu.
  2. Select Update.
To launch updating from the application main window:
  1. Select the Update component in the Service section.
  2. Click [image] Update now! in the right panel of the main window or use the [image] button in the status bar.
The program’s update progress will be displayed in a special window . You can hide with update progress window. To do so, click Close. The update will continue with the window hidden.
Also see:

Rolling back to the previous update


Rolling back to the previous update

Every time you begin updating, Active Virus Shield first creates a backup copy of the current threat signatures and after this starts downloading updates. This way you can return to using the previous version of signatures if an update fails.
The rollback option can be helpful if, for example, threat signature updates have failed because of a connection error. You can roll back to the previous threat signatures and try to update it again later.
To rollback to the previous database of known threats:
  1. Select the Update component in the Service section of the application main window.
  2. Click the [image] Rollback button in the right panel of the main application window.


Creating update tasks

Active Virus Shield has a built-in update task for updated program modules and threat signatures. However, you can create your own update tasks with various settings and start schedules.

For example, if you installed Active Virus Shield on a laptop that you use at home and at your office. At home, you update the program from the Active Virus Shield update servers, and at the office, from a local folder that stores the updates you need. Use two different tasks to avoid having to change update settings every time you change locations.

To create an advanced update task:

  1. Select Updates from the Service section of the main program window, open the context menu by right-clicking, and select Save as.
  2. Enter the name for the task in the window that opens and click OK. A task with that name will then appear in the Service section of the main program window.
Warning!
There is a limit to the number of update tasks that the user can create. The maximum is two tasks.

The new task inherits all the properties of the task on which you based it, except for the schedule settings. The default automatic scan setting for the new task is disabled. You need to continue setting it up by selecting an update source, network connection settings, and, if necessary, running a task with permissions and configuring the schedule.

To rename a task:

Select the task from the Service section of the main program window, open the context menu by right-clicking, and select Rename.

Enter the new name for the task in the window that opens and click OK. The task name will then be changed in the Service section.

To delete a task:

Select the task from the Service section of the main program window, open the context menu by right-clicking, and select Delete.

Confirm that you want to delete the task in the window that asks you for confirmation. The task will then be deleted from the list of tasks in the Service section.

Warning!
You can only rename and delete tasks that you have created.


Configuring update settings

Updating is performed in accordance with settings that define the following:
  • the mode of the updating procedure
  • what objects are updated
  • what actions you should perform after updating is complete
This section of the Active Virus Shield help describes these settings in detail.


Selecting the mode and objects to be updated

When configuring updating settings, it is important to define what objects will be updated and how updating will be performed (i.e. updating mode).
Objects to be updated are the components that will be updated: threat signatures, application modules. The threat signatures are always updated, whereas the application modules and information on network attacks are updated only if the corresponding mode is selected.
If you want to download and install updates for application modules:

select the [image] Update program modules checkbox in the Settings dialog box of the [image] Update component.

If there are currently program module updates on the update source, the program will download the updates it needs and apply them after the computer restarts. The module updates downloaded will not be installed until the computer is restarted.

If the next program update occurs before the computer is restarted and the before program module updates downloaded earlier are installed, only the threat signatures will be updated.

If you want information on new network attacks and means of blocking them to be copied to and installed on your computer,

check [image] Update network drivers in the settings window of the Update component.

Updating mode defines how updating is launched. You can select one of the following modes:
Auto. In this case, Active Virus Shield copies and installs updates as soon as they become available on the update servers. This mode is used by default.

If you have a dialup Internet connection and a network resource is specified as an update source, Active Virus Shield tries to launch updating each time the connection is established with that resource over after a certain amount of time has elapsed as specified in the previous update packet.

Every 1 day(s). Updating is scheduled to start at a specified time. By default, scheduled updates will occur daily. To edit the default schedule, click the Change... button near the mode title and make the necessary changes in the window that opens.
Manual. In this case, you launch the updating procedure manually. Active Virus Shield notifies you when updating is required:
  • A pop-up message informing you that updating is required appears above the application icon in the system tray (make a link to the notice section)
  • The second indicator in the main application window informs you that the protection of your computer is out-of-date
  • A recommendation that the application needs updating appears in the how-to section in the application main window
Also see:

Setting up the schedule

Actions after updating the program

Starting program updates on behalf of a different user


Setting up the schedule

If scheduled updating is selected as the updating mode, by default updating occurs every day. If this schedule is inconvenient for you, you can change it in the [image] Schedule dialog box.
You should first define the frequency for updating. The following options are available:
Once. The task will run once on the day and at the time that you specify.
Minutely. The program is updated on the number of minutes than you enter. The maximum is 59.
Hourly. The updating frequency is counted in hours. If you choose this option, in the schedule settings select Every Nth hour and specify the value of N. For example, to download updates every hour, select Every 1 hour.
Daily. The application is updated once in several days. In the schedule settings, select the following options:
  • Every day - if you want to run daily updates
  • Every Nth day and specify the value of N if you want to have an interval of several days between updating sessions. Thus, to start updating every two days, enter Every 2 days.
  • Every business day if you want to update the program Monday through Friday.
  • Every weekend to run updating only on Saturdays and Sundays.

In addition to the frequency, specify the start time in the Time field.

Weekly. The application is updated on certain days of the week. If this option is selected, in the schedule settings mark the days of the week when you need the application to download updates. Also specify the start time in the Time field.
Monthly. The scan task will run once per month at the specified time.
If an update is skipped for any reason (for example, the computer was not on at that time), you can configure the task that was missed to start automatically as soon as it can. To do so, check [image] Run missed task in the schedule window.


Configuring connection settings

If you set the application to retrieve updates from either AOL update servers or from other ftp- or http-sites, we recommend that you first check your connection settings.
By default, to establish an Internet connection, the application uses the settings of the browser (for example, Microsoft Internet Explorer). To change the connection settings, you should know whether a proxy is used and whether you are working behind a firewall. If you do not know this information, contact your system administrator or Internet provider.
All settings are grouped on a special tab - [image] LAN Settings.
Select the [image] Use passive FTP mode if possible checkbox if you download the updates from an FTP server in passive mode (for example, through a firewall). If you are working in the active FTP mode, clear this checkbox.
Check the [image] Use proxy server box if you are using a proxy server to access the Internet and, if necessary, specify the following settings:
  • Select the proxy server settings that will be used during updating:
      • Use IE proxy settings - Use the Internet Explorer settings when connecting through a proxy server.
      Use custom proxy settings - Use a proxy that is different from that specified in the browser connection settings. In the Address field, enter either the IP address or the symbolic name of the proxy server and specify the number of the proxy port used to update the application in the Port field.
  • Specify whether authentication is required on the proxy server. Authentication is a procedure of verifying your rights on the proxy server in accordance with your registration data. If authentication is required to establish an Internet connection, select the [image] Proxy requires authorization box.
  • Select how you will register on the proxy server when connecting to the Internet:
    • Use NTLM - Use the data of this user profile to connect to the Internet.
Note: Account information cannot be used if the application is installed on a computer running Microsoft Windows 9X/NT that is not included as a part of the domain.
      Specify user name and password. The authorization procedure requires user name and password. Enter the user login and password in the User name and Password fields.
To prohibit using a proxy when the update source is a local folder, select the [image] Bypass proxy server for local addresses.
This feature is unavailable under Windows 9X/NT 4.0. However, the proxy server is by default not used for local addresses.


Running updates with another user’s rights

Active Virus Shield has a feature that can start program updates for another profile. This feature disabled by default, and tasks are run under the profile under which you are logged into the system.
Since the program can be updated from a source that you do not have access to (for example, the network updates directory) or authorized user rights to the proxy server, you can use this feature to run program updates using the login of a user that has such privileges.
You can configure this feature on the [image] Additional tab.
To enable this feature, check [image] Run this tasks. Enter the data for the login that you want to start the task as below: account name and password.
Please pay attention that if you are not running the update with another user's rights, scheduled update will be performed with SYSTEM rights.


Actions after updating the program

Every update for the database of threat signatures contains new records that protect your computer from the latest threats.
It is recommended that you scan the quarantined objects and startup objects each time after the database is updated.
Why these objects should be scanned?
The quarantine contains objects that have been flagged by the application as suspicious or possibly infected. However, during that scan it was impossible to identify the malicious software that caused infection. Using the latest version of the threat signatures, Active Virus Shield may be able to identify the threat and eliminate it.
By default, the application scans quarantined objects after each threat signature update. We also recommend that you periodically view the quarantined objects because their status can change after several scans. Some objects can then be restored to the previous locations and you will be able to continue working with them.
To disable scans of quarantined objects, clear the [image] Rescan Quarantine box in the [image] Actions after Update section.
Startup objects are critical for the safety of your computer. If one of them is infected with a malicious application, this can cause even an operating system startup failure. To scan this area Active Virus Shield has a built-in startup objects scan task. We recommend that you set up a schedule for this task so that it is launched automatically after each threat signatures database update.


Update statistics

General statistics on threat signatures and its updating status are displayed in the application main window. To view the statistics, select [image] Update in the Service section of the main window.
The Threat signatures section provides information on the date of the last update and the number of threat signatures installed on your computer.
Note: If the application has never been updated, the detailed information is not available.
To view detailed information about the last update, click your left mouse button in any place of this section. You will see a detailed report on the last updating procedure.
An important parameter is the updating status, a parameter that shows whether updating completed successfully or failed. If updating failed or errors occurred during the update, try to launch updating again. You can do this directly from the report window by clicking the [image] button in the upper part of the window. If the second attempt to update also field, save the report on it to a file using the Save as button contact Support.
Brief update statistics are displayed in the upper part of the report window. You can see the size of copied and installed updates, downloading speed, duration of the updating procedure, and other information.
A description of all operations performed during updating is displayed in the main part of the report on the Event log tab. You can find exact files that were copied and replaced. To delete all events from the report, use the Clear link.
The settings that are used to run updates are listed on a tab with the same name. To quickly configure update settings, you can use the Change settings link.


Possible problems during the update

When you update the Active Virus Shield program modules or threat signatures, errors can occur due to incorrect update configurations, connection problems, and other factors. This Help section covers the majority of errors and gives tips for eliminating them.

Error 0x89478001 – protocol not supported.

This error occurs if the data transfer protocol for program updates is incorrect. For example, if you accidentally entered the address of a HTTPS server instead of an HTTP server when adding an update source. Make sure that the update settings are correct.

Error 0x89477007 – protocol not supported.

The program returns this error if the operating system does not support the data transfer protocol used for updates. For example, you might encounter this error if TCP/IP is not installed on your system.

Error 0x89478002 – file not found.

This error occurs if there are any files on the update list that are not on the update source.

Error 0x89478003 – authorization error on proxy server.

If, in configuring the program to update through a proxy server, you entered an incorrect name or password, the program will return this error. Edit the authorization settings and try to update the program again.

Error 0x89478004 – protocol error.

If all files downloaded on your computer are filtered by, for example, a firewall installed on it, a portion of the contents of any file could be changed. This pertains to the program updates you download as well. If this occurs, you will see this error message on the screen.

Error 0x89477001 – system not initialized.

This error occurs if you try to begin program updates and the update component is not running. Find out why the component is not working (it is possible that your program license has expired).

Error 0x89477002 – not connected to network.

If you receive this error, check your computer’s network connection.

Error 0x894770013 – network not found.

If you receive this error, check your computer’s network connection.

Error 0x99480009 – network not available.

If you receive this error, check your computer’s network connection.

Error 0x89477004 – operation in progress.

If you try to run the update process while the process is already running (for example, you started the update from the program’s context menu, and without waiting for it to finish you try to update the program from the command prompt), the screen will display this error message. Wait for the procedure to finish, and if necessary run it again.

Error 0x89477005 – too many files open.

The program returns this error if there are not enough system resources to update the program. As a rule this means that too many files were open on your computer when you attempted to start the update. Close any applications you have open and try to update the program again.

Error 0x8947700C – resource temporarily unavailable.

This error means that the source for program updates that you tried to contact is currently unavailable. This could be because, for example, your computer is not connected to the network or there are programs accessing the network resource where the program updates are located.

Error 0x89477014 – connection timed out.

When configuring the program’s update settings, you may have set a low time-out value for the connection with the update source. If your computer cannot connect to the server or the update folder within that time, the program returns this error. We recommend increasing the time-out value.

Error 0x89477018 – the program terminated the connection.

If you have to restart your computer because of a certain application (for example, you installed a program that requires the system to be rebooted, and you chose to restart the computer right now), all applications running will close.

This also applies to Active Virus Shield. If the program is updating when this happens, it will be forced to close, and this error will be recorded in the component report. Unfortunately, the program cannot always resume the update where it left off, and you may have to download and install a number of files over again. This increases the amount of downloads. Therefore, we recommend not using applications that might require you to restart the computer while updating the program.

Error 0x89477019 – connection terminated by the server.

This error occurs when the connection with the update source is terminated by the update server for any reason. Try using a different update source or contact AOL Technical Support with this error message.

Error 0x89477020 – no connection with the update source.

This error as a rule occurs if you entered an incorrect address when adding an update source. Check the address.

Error 0x89475001 – updates only partially installed.

This error message arises when only part of the files are downloaded and installed on your computer when you update it. This could occur because the update source does not contain the complete set of files or because the connection with the source was lost. We recommend rolling back program updates and trying to update again after some time has elapsed or from another update source.

Error 0x80000046 – incorrectly entered update settings.

If you entered any settings incorrectly when you configured updates, your screen will display this error message. Check and correct the update settings and attempt to update the program again.


Additional options

Beyond protecting your data, the program has other features that expand the possibilities for using Active Virus Shield.
While working the program places some objects in special repositories. The purpose of this is to ensure maximum protection of data with minimum losses.
  • Backup contains copies of objects that were changed or deleted by Active Virus Shield. If any object contained information that was important to you that could not be fully saved during anti-virus processing, you can always restore the object from its backup copy.
  • Quarantine contains potentially infected objects that could not be processed using the current threat signatures.
It is recommended that you periodically examine the list of objects. It is possible that some of them are already irrelevant, but some may be restored.
Some of the features are meant to aid you in working with the program. For example:
  • Technical Support Service provides a link to online help with Active Virus Shield.
  • Notifications will notify the user when key activities occur in Active Virus Shield. These could be either informative events or errors that must be eliminated immediately.
  • License Key Manager allows you to obtain detailed information on the license used, activate your copy of the program, and manage license key files.

The program also provides detailed reference information and detailed reports on the operation of all protection components and completing all virus scan tasks.


Program data files

Program data files are objects that Active Virus Shield places in quarantine and backup and report files on component operation and program tasks.

In order to work with program data files:

Open the Active Virus Shield main window and select [image] Data files in the Service section.

The file will display information for each of the storage areas: the number of files in them and the total size of the storage.

To view and work with stored files, left-click anywhere in the appropriate box. For example, if you want to view report files on program operation, select the Reports box.

If you want to empty the contents of storage, click Clean up.... A window will then open where you can select which storage areas you want to empty:

    Delete History Reports – empty the report archive, except for files currently being created.
    Delete files from Quarantine – empty Quarantine. Note that if you do this, all potentially infected objects will be deleted from your computer.

    Delete files from Backup – empty the backup archive of infected objects.

Also see:

Quarantine for potentially infected objects

Backup copies of dangerous objects

Reports


Quarantine for potentially infected objects

Quarantine is a special repository where objects that could be infected with viruses are placed.
Potentially infected objects are objects that are suspected of being infected with viruses.
Why potentially infected? It is not always possible to exactly determine when an object is infected. This could be for the following reasons:
  • The code of the object being analyzed resembles a known threat but is partially altered.

Threat signatures contain threats that have been identified to date by Active Virus Shield specialists. If a malicious program is altered and these changes have not yet been entered into the signatures, Active Virus Shield classifies the object as infected with the changed malicious program as a potentially infected object and without fail will indicated what threat this infection resembles.

  • The code of the object detected is reminiscent in structure of a malicious program; however, nothing similar is recorded in the threat signatures.

It is quite possible that this is a new type of threat, so Active Virus Shield classifies that object as a potentially infected object.

A heuristic code analyzer that contains up to 92% of new viruses determines which files may have a virus,. This mechanism is fairly effective and very rarely leads to false positives.
A potentially infected object can be detected and placed in the quarantine by File Anti-Virus, Mail Anti-Virus or in the course of a virus scan.
You can place an object in the quarantine by yourself by clicking Quarantine in the special notice that pops up when a potentially infected object is detected.
Files in the quarantine are saved in a special format and are not dangerous.
Also see:

Working with quarantined objects

Configuring Quarantine settings


Working with quarantined objects

The total number of objects placed in the quarantine is displayed in the [image] Data files in the Service. In the right-hand part of the screen there is a special Quarantine section that displays:
  • the number of potentially infected objects detected during Active Virus Shield operation;
  • the current size of the repository.
You can delete all objects in the quarantine with the Clean up... button.
In order to work with objects in quarantine,

left-click in any part of the Quarantine section.

You can take the following actions on the quarantine tab:
  • Move a file to quarantine that you suspect of being infected by the program did not detect. To do so, click Add and in the standard selection window select the file you need. It will be able to a list with the status moved by user.
  • Scan and disinfect all potentially infected objects in the quarantine using the current threat signatures. To do so, click Scan all.

By scanning and disinfecting any quarantined object, its status can change to infected, potentially infected, false positive, not infected, etc.

The status infected means that the object has been identified as infected but it could not be treated. We recommend that you delete such objects.

All objects with the status false positive can be restored without worries, since their former status as potentially infected was not confirmed by the program after being scanned again.

  • To restore an object, select it from a list and click Restore. When restoring objects placed in quarantine from archives, mail databases, and mail format files, you must specify the directory to which they will be restored.

Tip: We recommend that you only restore objects with a false positive status and not infected or disinfected, since restoring other objects could lead to infecting your computer.

  • Delete any quarantined object or group of selected objects. Only delete objects that cannot be disinfected. In order to delete the objects, select them in the list and click Delete.


Configuring Quarantine settings

You can configure the quarantine settings, specifically:
  • Assign the automatic scan mode for objects in quarantine after each update of the threat signatures (for more details, see section Actions after updating the program).
  • Set the maximum duration for storing objects in the quarantine.
Warning!
The program will not be able to scan quarantined objects immediately after updating the threat signatures, if you are working with quarantine.

By default, the duration for storing objects in quarantine is 30 days, at the end of which the objects will be deleted. You can change the maximum period for storing potentially infected objects or shut of this restriction altogether.

To change the configurations:

  1. Open the Active Virus Shield settings window by clicking Settings in the main program window.
  2. Select the [image] Data Files component in the settings tree.
  3. Set the duration for storing objects in quarantine in the Quarantine & Backup section on the right-hand part of the screen.


Backup copies of dangerous objects

Sometimes during disinfection of objects, their integrity cannot be saved. If the disinfected file contained important information, and after disinfection it became inaccessible in part or in full, you can attempt to restore the original object from its backup copy.
Backup is a special repository that contains backup copies of dangerous objects subject to processing or deletion. The main function of backup is the ability to restore an original object at any time. Files in backup are saved in a special format and are not dangerous.
Backup copy is a copy of the original dangerous object that is created when it is first disinfected or deleted. The backup copy is saved in backup.
Also see:

Working with backup copies

Configuring backup settings


Working with backup copies

The total number of backup copies of objects placed in the repository is displayed in the [image] Data files in the Service. In the right-hand part of the screen there is a special Backup section that displays:
  • the number of backup copies of objects created during Active Virus Shield operation;
  • the current size of Backup.
You can delete all of the copies in backup with the Clean up... button.
In order to work with copies of dangerous objects,

left-click in any part of the Backup section.

A list of backup copies is displayed in the central portion of the backup tab. The following information is given for every copy: the full name of the object with the path to the original location, the status of the object, and its size.
You can restore the selected copies using the Restore button. The object is restored from the backup copy with the same name that it had prior to disinfection.
If there is an object in the original location with that name (this situation is possible when a restored object with a copy created prior to disinfection), a corresponding warning will pop up. You can change the location of the restored object or rename it.
We recommend that you scan the object for viruses immediately after restoring it. It is possible that with updated signatures you will be able disinfect it without losing file integrity.

We do not recommend that you restore backup copies of objects unless absolutely necessary. This could lead to an infection on your computer.

We recommend that you periodically examine the repository and empty it using the Delete button. You can also set up the program so that it independently deletes the oldest copies from backup.


Configuring backup settings

You can define the maximum period for storing copies in backup.
By default, the duration for storing copies of dangerous objects in quarantine is 30 days, at the end of which the copies will be deleted. You can change the maximum period for storing copies or remove this restriction altogether. To do so:
  1. Open the Active Virus Shield settings window by clicking Settings in the main program window.
  2. Select the [image] Data Files component in the settings tree.
  3. Set the duration for storing backup copies in the repository in the Quarantine & Backup section on the right-hand part of the screen.


Working with reports

Performance of each Active Virus Shield component and performance of each virus scan and update is recorded in a report.
The total number of reports created by the program at a given point in time and their total size in bites is displayed in [image] Data files in the Service section of the main program window. This information is displayed in the Reports section.
To view reports,

left-click in any part of the Reports section.

As a result a window will open in the Reports tab. Here you will find the latest reports on all components and virus scan tasks run during the current session of Active Virus Shield. The results are shown across from each component or task. For example, stopped or completed. If you want to view the full history of report creation for the current session of the program, check [image] Show history reports.
To review all the events recorded in the report about component performance or task performance,

select the name of the component or task on the Reports tab and click the Details button.

As a result a window will pop up that contains detailed information on the performance of the selected component or task. The resulting statistics on performance are displayed in the upper part of the window, and detailed information is given on the various tabs in the central part. Depending on the component or task, the composition of the tabs can vary:
  • Detected tab contains a list of dangerous objects detected by the component.
  • Events tab displays events in component or task performance.
  • Statistics tab contains detailed statistics for all scanned objects.
  • Settings tab displays a collection of settings that are used by a protection component, a virus scan, or a threat signature update.
You can export the entire report as a text file. For example, this is helpful in cases where an error has occurred in component performance of task completion that you cannot eliminate on your own and you need assistance from our Support. In such a case, the report must be sent in text format to Support so our specialists can study the problem in detail and solve it as soon as possible.
To export the report as a text file,

click Save as and specify where you want to save the report file.

After you are done working with the report, click Close.


Configuring report settings

To configure settings for creating and saving reports:

  1. Open the Active Virus Shield settings window by following the Settings link in the main program window.
  2. Select [image] Data files from the settings tree.
  3. Set up the Reports section as follows:
    • allow or block logging informative events. As a rule, these events are not important for security. To allow logging, check [image] Log non-critical events;
    • choose only to save events in the report that have occurred since the last time the task was run. This saves disk space by reducing the report size. If [image] Keep only recent events option is checked, the information in the report will be updated every time you restart the task. However, only non-critical information will be overwritten;
    • set the storage term for reports. By default, the duration for storing reports is 30 days, at the end of which the copies will be deleted. You can change the maximum storage term or remove this restriction altogether.


Detected tab
This tab contains a list of dangerous objects detected by Active Virus Shield. The full name is indicated for each object, along with the status assigned to it by the program when it was scanned or processed.
For the list to contain not only dangerous objects but also those that were successfully neutralized, check [image] Show neutralized files.
You can perform a number of actions on objects from the list. To do so, click Actions and make a selection from the dropdown menu:
  • Disinfect - attempt to disinfect a dangerous object. If the object is not successfully disinfected, you can leave it on this list to scan later with updated threat signatures or delete it.
  • Delete from list – delete the object from the list.
  • Show file – open the folder where the object is located in Windows Explorer.
  • Treat all – neutralize all objects on the list. Active Virus Shield will attempt to process the objects using threat signatures.
  • Clear – clear the report on detected objects. When you use this function, all detected dangerous objects remain on your computer.
  • Search www.viruslist.com – got to a description of the object in the Virus Encyclopedia on the AOL website.
  • Search www.google.com – find information on the object using this search engine.
  • Search - enter search terms for objects on the list by name or status.
  • Select all – select all objects on the list. You might need this function to assign group actions to objects.
  • Copy – copy a line of the report to the clipboard. Then you can paste this information into a text file or e-mail.
In addition, you can sort the information displayed in the window by ascending and descending order for each of the columns.


Events tab
A complete list of all the important events is recorded on this tab.
The events can be of the following types:
    Critical events are events of a critical importance that point to problems in program operation or gaps in protection on your computer. For example, virus detected, error in operation.
    Important events are events that must be paid attention to, since they reflect important situations in the operation of the program. For example, stopped.
    Informative messages are reference-type messages which as a rule do not contain important information. For example, OK, not processed. These events are reflected in the Event Log only if [image] Show non-critical events is checked.
The format for displaying events in the Event Log may vary with the component or task. Thus, the following information is given for update tasks:
  • event name;
  • name of the object for which that event is recorded;
  • time at which the event occurred;
  • size of the loaded file.
For virus scan tasks, the Event Log contains the name of the object scanned and the status assigned to it as a result of the scan/processing.


Statistics tab
Detailed statistics on component operation or completion of a virus scan task are shown on this tab. Here you can learn:
  • How many objects were scanned for dangerous objects in this session of component operation or when the task is completed. The number of scanned archives, compressed files, and password protected and corrupted objects are displayed.
  • How many dangerous objects were detected, how many of them were not disinfected, deleted, and placed in quarantine.


Settings tab

The Settings tab displays a complete overview of the settings related to the protection component. You can learn what security level the component is running on or what level virus scans are running on, what actions are being taken with dangerous objects or what settings are being used for program updates, etc. Use the Edit settings link to configure the component.

You can configure advanced settings for virus scans:

  • Establish a scan task priority ranking to be used when the processor is weighed down. The default setting for [image] Pause virus scan when CPU is busy with other applications is unchecked. With this feature, the program tracks the load on the processor and disk subsystems for the activity of other applications. If the load on the processor increases significantly and prevents the user's applications from operating normally, the program reduces scanning activity. This increases scan time and frees up resources for the user's applications.
  • Set the computer’s mode of operation for after the virus scan is complete. You can set up the computer to shut down, restart, or go into standby or sleep mode. To select an option, left-click on the hyperlink until it displays the option you need.

    You may need this feature if, for example you start a virus scan at the end of the work day and do not want to wait for it to finish.

    However, to use this feature, you must take the following additional steps: before launching the scan, you must disable password requests for objects being scanned, if enabled, and enable automatic processing of dangerous objects. Then the program’s interactive features will be disabled. The program will not ask questions that require an answer from you, which interrupts the scanning process.


General information about the program

You can view general information on the program in the [image] Service section of the main window.
The information is broken up into three sections:
  • The Product info section displays the program version, date of last update, and the number of threats known to date.
  • The License info section contains basic information about the license your Active Virus Shield license
  • The System info section shows basic information on the operation system installed on your computer.
You will need all this information when you contact Support.

Also see:

License prolongation


Extending your license

Active Virus Shield needs a license key to operate. You are given the key based on an activation code and it gives you the right to use the program from the day you purchase it and install the key.
When the license key expires, the program will continue working, except that you will not be able to update threat signatures. As before, you will be able to scan your computer for viruses and use the protection components, but only using the threat signatures that you had when the license expired. We cannot guarantee that you will be protected from viruses that surface after your program license expires.
To avoid infecting your computer with new viruses, we recommend extending your Active Virus Shield license. The program will notify you two weeks prior to the expiration of your license. For two weeks the program will display this message every time you open it.
To extend your license, you must obtain a new activation code. To do so:
  1. Go to www.activevirusshield.com
  1. Activate the program using the activation code. To do so:
    1. Select the Tools section in the main window of the program and left-click anywhere in the License information section.
    2. If you have a program activation code, click the Activate button in the license manager window and activate the program with the Wizard.


User technical support
Active Virus Shield provides you several options to solve problems related to program operation. They are all located in [image] Support in the Service section.
Depending on the problem that you need to solve, we suggest that you take advantage of the following technical support services:
    Frequently Asked Questions - This will allow you to view frequently asked questions to determine if one of these can resolve your problem.
    Email Technical Support - This allows you to send an email to the technical support team with questions regarding Active Virus Shield.
    Submit a Bug Report - If you have a problem submit it via this link.
    Active Virus Shield Support Center - This takes you to a separate website that provides additional information regarding Active Virus Shield.


Using additional tools

Active Virus Shield provides you with the following additional features:
  • User e-mail notifications on certain events occurring in the program
  • Battery-saving mode when running on a laptop
To set up these services,
  1. Open the program setup window with the Settings link in the main window.
  2. Select the [image] Service point in the settings tree.
In the right-hand part of the screen, you can define whether to use additional features in program operation.


Messages about Active Virus Shield events

During Active Virus Shield operation, different kinds of events arise. They can be of an informative nature or contain important information. For example, an event can inform you on the successful completion of a program update or can record an error in the operation of a certain component that must be immediately eliminated.
In order to receive updates on Active Virus Shield operations, you can use the notification feature. This feature is designed for informing you on events that arise.
Notices can be delivered in one of the following way:
  • Pop-up messages above the program icon in the system tray.
  • Audio message.
  • E-mail messages.
To use this feature, you must:
  1. Check [image] Enable Notifications in the [image] Notifications section.
  2. Define the event types about which you want to be notified and the method of notification.
  3. Configure settings for sending notices by e-mail, if that is the notification method that is being used.


Types of events and ways of sending notifications
During Active Virus Shield operation, the following kinds of events arise:
    Critical events are events of a critical importance and are highly recommended to receive, since they point to problems in program operation or vulnerabilities in protection on your computer. For example, threat signatures corrupt or license expired.
    Important events are events that must be paid attention to, since they reflect important situations in the operation of the program. For example, protection disabled or computer has not been scanned for viruses for a long time.
    Informative messages are reference-type messages which as a rule do not contain important information. For example, all dangerous objects disinfected.

To specify which events the program should notify you of and how:

  1. Click the Settings link in the program’s main window.
  2. In the program settings window, select [image] Service, check [image] Enable Notifications, and edit detailed settings by clicking the Settings... button.

You can configure the following notification methods for the events listed above on the [image] Events tab of the window that opens:

  • Pop-up messages above the program icon in the system tray that contain an informative message on the event that occurred.
    To use this type of notice, check [image] in the Baloon section across from the event about which you want to be informed.
  • Audio message. If you want this notice to be accompanied by a sound file, check Sound [image] across from the event.
  • Notification by e-mail. To use this type of notice, check [image] in the E-mail section across from the event about which you want to be informed and configure settings for sending notices.


Configuring notification by e-mail
After you have selected the events about which you wish to receive a notification by e-mail, you must set up notifications. To do so:
  1. Open the program setup window with the Settings link in the main window.
  2. Select the Service point in the settings tree.
  3. Click Settings... in the Notifications section of the right-hand part of the screen.
  4. Define the following settings for sending messages on the [image] E-mail settings tab:
    • Assign the sending notification setting for From.
    • Specify the e-mail address to which notices will be sent in To.
    • Assign a mode for sending e-mail notifications in the Send mode. For the program to send an e-mail as soon as the event occurs, select [image] Immediately when events occur. For notifications about events within a certain period of time, fill out the schedule for sending informative e-mails by click Edit. Daily notices are the default.


Configuring an e-mail notification schedule

Schedule settings for e-mail event notifications are shown in the Schedule window.

The most important step is to determine the frequency of how often notifications are sent. You can select one of these options:

Once. Send the notification on program operation once at a specified time. If notification is skipped for any reason (for example, the mail client is not installed or the computer was not on at that time), you can configure the task that was missed to send the notification automatically as soon as it can. To do so, check [image] Run missed task in the schedule window.

Minutely. The time interval between notifications will be several minutes. Specify the number of minutes between notifications in the schedule settings. It must not exceed 59 minutes.

Hourly. The interval between notifications is calculated in hours. If you select this frequency, specify the interval in the schedule settings: Every n-th hour and enter the value for n. For example, enter Every 1 hour if you want to send notifications hourly.

Daily – the program will send notifications every several days. Specify how often the program should send notifications in the schedule settings:

  • Select the Every n-th day option and enter a value for n if you want to space out notifications by days.
  • Select Every weekday if you want to send notices daily, Monday through Friday.
  • Select Every weekend to receive notifications on Saturdays and Sundays only. In addition to the frequency, specify what time of day or night the program will send notifications in the Time field.

Weekly – the notices will be sent on certain days of the week. If you select this option, put checkmarks next to the days of the week that on which you need to send the notifications. You can also enter the send time for the notification in the Time field.

Monthly – the program will send notifications once per month at the specified time.


Password protection

You can password-protect access to the program in the [image] Password protection window.

If you want to set a password, fill in the New password and Confirm password fields. If you are already using a password and want to change it, you must also fill in the Old password field.

Below, specify the area that you want password protection to apply to:

    All features (except prompts). Request password if the user attempts any action with the program except for responses to notifications on detection of dangerous objects.
    Selected features
      Save settings – request password when a user attempts to save changes to program settings.
      Exit application – request password if a user attempts to close the program.
      Stop/pause tasks – request password if user attempts to pause or fully disable any protection component or virus scan task.


Power settings

To conserve the battery of your laptop computer, and to reduce the load on the central processor and disk subsystems, you can delay virus scans:

  • Since virus scans and program updates sometimes require a fair amount of resources and can take up time, we recommend that you disable these tasks by schedule. This will help you to save battery life. If necessary, you can update the program yourself or start a virus scan. To use the battery-saving feature, check the appropriate box in the [image] Power and Productivity Options section.
  • Virus scans increase the load on the central processor and disk subsystems, thereby slowing down other programs. By default, if such a situation arises, the program pauses virus scans and frees up system resources for user applications. However, there are a number of programs that can be launched as soon as the processor’s resources are freed and run in background mode. For virus scans not to depend on the operation of such programs, check [image] Pause virus scan when CPU is buzy with other applications.


Frequently asked questions

This chapter is devoted to the most frequently asked questions from users pertaining to installation, setup and operation of the Active Virus Shield; here we shall try to answer them here in detail.

Question: Is it possible to use Active Virus Shield with anti-virus products of other vendors?

We recommend uninstalling anti-virus products of other vendors prior to installation of Active Virus Shield to avoid software conflicts.

Question: Active Virus Shield does not rescan files that have been scanned earlier. Why?

This is true. Active Virus Shield does not rescan files that have not changed since the last scan.

That has become possible due to new iChecker™ and iStreams™ technologies. The technology is implemented in the program using a database of file checksums and file checksum storage in alternate NTFS streams.

Question: Why do I need the license key file? Will Active Virus Shield work without it?

Active Virus Shield will run without a license key, although you will not be able to access the Updater and Technical Support.

If you still have not decided whether to purchase Active Virus Shield, we can provide you with a trial license that will work for two weeks or a month. Once that time has elapsed, the key will expire.

Question: After the installation of Active Virus Shield the operating system started “behaving” strangely (“blue screen of death”, frequent restarting, etc.) What should I do?

Although rare, it is possible that Active Virus Shield and other software installed on your computer will conflict.

In order to restore the functionality of your operating system do the following:

  1. Press the F8 key when the computer just started loading until the boot menu is displayed.
  2. Select the Safe Mode item and load the operating system.
  3. Open Active Virus Shield.
  4. Use the Settings link in the main window and select the [image] Protection section in the program settings window.
  5. Uncheck Run Active Virus Shield on system startup and click OK.
  6. Reload the operating system in the regular mode.

After this contact the Technical Support Service through the AOL’s corporate website (Services а Technical Support). Describe in detail the problem and the circumstances in which this problem occurs.

Make sure that you attach to your question a file containing a complete dump of Microsoft Windows operating system. In order to create this file, do the following:

  1. Right-click My computer and select the Properties item in the shortcut menu that will open.
  2. Select the Advanced tab in the System Properties window and then press the Settings button in the Startup and Recovery section.
  3. Select the Complete memory dump option from the drop-down list in the Write debugging information section of the Startup and Recovery window. By default, the dump file will be saved into the system folder as memory.dmp. You can change the dump storage folder by editing the folder name in the corresponding field.
  1. Reproduce the problem related to the operation of Active Virus Shield.
  2. Make sure that the complete memory dump file was successfully saved.


Types of notifications
When events occur in Active Virus Shield operation, special messages pop up on the screen. Depending on the degree of criticality of the event regarding computer security, you might receive the following types of notifications:
Alert. A critical event has occurred. For instance, malicious code or dangerous activity has been detected on your system. You should immediately decide how the program should react. This type of notification is in red.
Warning. A potentially dangerous event has occurred. For instance, potentially infected files or suspicious activity has been detected on your system. You must instruct the program depending on how dangerous you think this event is. This type of notification is in yellow.
Info. This notification tells you about events that are not critical. This notification type includes, for example, notifications that pop up during Anti-Hacker training. Info notifications are in blue.


Malicious objects discovered
If File Anti-Virus, E-Mail Anti-Virus, or a virus scan detects malicious code, a special notification will pop up.
The notification will contain:
  • The name of the component that detected the object (for example, Virus scan).
  • The threat type (for instance, virus, Trojan) and name of the malicious code as listed in the Kaspersky Lab Virus Encyclopedia. The name of the malicious object is given as a link to www.viruslist.com, where you can find more detailed information on the type of threat detected on your computer.
  • Full name of the malicious object and a path to it.
  • Brief description and a set of potential actions to take for the object. This description shows what sort of object the malicious program has infected.
You are asked to select one of the following responses to the object:
  • Disinfect - attempt to disinfect the malicious object. Before treatment, a backup copy is made of the object in case the necessity arise to restore it or a portrait of its infection.
  • Delete - delete the malicious object. Before deleting, a backup copy is made of the object in case the necessity arise to restore it or a portrait of its infection.
  • Skip - block access to the object but take no actions on it; simply record information about it in the report .

You can later come back to skipped malicious objects in the report window. However, you cannot postpone processing objects detected in e-mails.

You can apply the selected action to all objects with the same status detected in the current session of the program. To do so, check [image] Apply in all similar cases.


When you cannot disinfect object
There are some cases when it is impossible to disinfect a malicious object. This could happen if a file is so damaged that it is impossible to delete malicious code from it and restore integrity. The treatment procedure cannot be applied to several types of dangerous objects, such as Trojans.
In such cases, a special notification will pop up containing:
  • The name of the component that detected the object (for example, Virus scan).
  • The threat type (for instance, virus, Trojan) and name of the malicious code as listed in the Kaspersky Lab Virus Encyclopedia. The name of the malicious object is given as a link to www.viruslist.com, where you can find more detailed information on the type of threat detected on your computer.
  • Full name of the malicious object and a path to it.
  • Brief description and a set of potential actions to take for the object. This description shows what sort of object the malicious program has infected.
You are asked to select one of the following responses to the object:
  • Delete - delete the malicious object. Before deleting, a backup copy is made of the object in case the necessity arise to restore it or a portrait of its infection.
  • Skip - block access to the object but take no actions on it; simply record information about it in the report .

You can later come back to skipped malicious objects in the report window. However, you cannot postpone processing objects detected in e-mails.

You can apply the selected action to all objects with the same status detected in the current session of the program. To do so, check [image] Apply in all similar cases.


Special treatment required
When you detect a threat that is currently active in the system, a message will pop up prompting you to run a special extended treatment procedure.
When you run the treatment procedure, the threat will be deleted, and registry key entries and startup objects will be scanned for traces of viruses. After this procedure, you will need to restart your computer.
After restarting your computer, we recommend running a full virus scan.
To start the extended treatment procedure, close all applications and click OK in the notification window. If you do not want to run the treatment procedure, click Cancel.


Suspicious objects discovered
If File Anti-Virus, E-Mail Anti-Virus, or a virus scan detects an object containing code from an unknown virus or modified code of a known virus, a special notification will pop up.
The notification will contain:
  • The name of the component that detected the object (for example, Virus scan).
  • The threat type (for instance, virus modification) and name of the object as listed in the Kaspersky Lab Virus Encycopedia. The name of the dangerous object is given as a link to www.viruslist.com, where you can find more detailed information on the type of threat detected on your computer.
  • Full name of the object and a path to it.
  • Brief description and a set of potential actions to take for the object. This description shows what sort of object the dangerous program has infected.
You are asked to select one of the following responses to the object:
  • Quarantine - Move the suspicious object to Quarantine. When you place an object in Quarantine, it is moved, not copied. The object is deleted from the disk or e-mail and is saved in the Quarantine folder. Files in Quarantine are saved in a special format and are not dangerous.

When you scan Quarantine later with updated threat signatures, the status of the object could change. For example, the object may be identified as infected and can be processed using an updated database. Otherwise, the object could be assigned the status not infected and could be restored.

  • Delete - delete the object. Before deleting, a backup copy is made of the object in case the necessity arise to restore it or a portrait of its infection.
  • Skip - block access to the object but take no actions on it; simply record information about it in the report.

You can later come back to skipped objects in the report window. However, you cannot postpone processing objects detected in e-mails.

You can apply the selected action to all objects with the same status detected in the current session of the program. To do so, check [image] Apply in all similar cases.


Quarantined object must be processed
If, when scanning quarantined objects with new versions of threat signatures, a file's status changes to infected, a special notification will pop up containing:
  • The threat type (for instance, virus, Trojan) and name of the malicious code as listed in the Kaspersky Lab Virus Encyclopedia. The name of the malicious object is given as a link to www.viruslist.com, where you can find more detailed information on the type of threat detected on your computer.
  • Full name of the malicious object and a path to it.
  • Brief description and a set of potential actions to take for the object. This description shows what sort of object the malicious program has infected.
You are asked to select one of the following responses to the object:
  • Disinfect - attempt to disinfect the malicious object. Before treatment, a backup copy is made of the object in case the necessity arise to restore it or a portrait of its infection.
  • Delete - delete the malicious object. Before deleting, a backup copy is made of the object in case the necessity arise to restore it or a portrait of its infection.
  • Skip - do not perform any actions in response to the object. If you select this option, the object will remain quarantined and will not be available to the user.
You can apply the selected action to all objects with the same status detected in the current session of the program. To do so, check [image] Apply in all similar cases.


When you cannot disinfect a quarantined object
If, when scanning quarantined objects with new versions of threat signatures, a file's status changes to infected, but it is impossible to disinfect it, a special notification will pop up containing:
  • The threat type (for instance, virus, Trojan) and name of the malicious code as listed in the Kaspersky Lab Virus Encyclopedia. The name of the malicious object is given as a link to www.viruslist.com, where you can find more detailed information on the type of threat detected on your computer.
  • Full name of the malicious object and a path to it.
  • Brief description and a set of potential actions to take for the object. This description shows what sort of object the malicious program has infected.
You are asked to select one of the following responses to the object:
  • Delete - delete the malicious object. Before deleting, a backup copy is made of the object in case the necessity arise to restore it or a portrait of its infection.
  • Skip - do not perform any actions in response to the object. If you select this option, the object will remain quarantined and will not be available to the user.
You can apply the selected action to all objects with the same status detected in the current session of the program. To do so, check [image] Apply in all similar cases.


Quarantined object is not infected
If, when scanning quarantined objects with new versions of threat signatures, a file's status changes to not infected or false positive, a special notification will pop up containing:
  • Full name of the object and a path to it.
  • Object status: not infected. It is possible that Active Virus Shield mistakenly assigned the object the previous status of potentially infected.
  • Possible responses:
    • Restore - restore the files to a folder selected by the user or their original folder prior to Quarantine. When restoring quarantined objects from archives, mail databases, and mail format files, you must also select a restore destination directory.
    • Cancel - leave the object in Quarantine.


Working with the program from the command prompt

You can use Active Virus Shield from the command prompt. You can execute the following operations:

  • Starting, stopping, pausing and resuming the activity of application components
  • Starting, stopping, pausing and resuming virus scans
  • Obtaining information on the current status of components and tasks and statistics on them
  • Scanning selected objects
  • Updating threat signatures and program modules
  • Calling up help on command prompt syntax
  • Calling up help on command syntax

Command prompt syntax is:

avp.com <command> [settings]

The following may be used as <commands>:

START | Starts a component or a task
PAUSE | Pauses a component or a task
RESUME | Resumes a component or a task
STOP | Stops a component or a task
STATUS | Displays the current component or task status on screen
STATISTICS | Displays statistics for the component or task on screen
HELP | Help with command syntax and the list of commands
SCAN | Scans objects for viruses
UPDATE | Begins program update
EXIT | Closes the program (you can only execute this command with a password assigned in the program interface)
IMPORT | Imports Active Virus Shield settings
EXPORT | Exports Active Virus Shield settings

Each command corresponds to its own set of parameters specific to that particular Active Virus Shield component.

Also see:

Managing protection components

Starting a Virus Search

Program Updates

Exporting protection settings

Starting the program

Stopping the program

Importing protection settings

Viewing Help


Managing application components and tasks

You can manage Active Virus Shield components and tasks from the command prompt with these commands:

  • START
  • PAUSE
  • RESUME
  • STOP
  • STATUS
  • STATISTICS

The task or component to which the command applies is determined by its parameter.

STOP and PAUSE can only be executed with a Active Virus Shield password assigned in the program interface.

Command syntax:

avp.com <command> <profile|taskid>
avp.com STOP
PAUSE <profile|taskid> /password=<password>

One of the following values is given to <profile|taskid>:

RTP | all protection components
FM | File Anti-Virus
EM | Mail Anti-Virus
ASPY | Anti-Spy
AH | Anti-Hacker
AS | Anti-Spam
UPDATER | Updater
SCAN_OBJECTS | Virus scan task
SCAN_MY_COMPUTER | Scan My Computer task
SCAN_CRITICAL_AREAS | Scan Critical Areas task
SCAN_STARTUP | Scan Startup Objects task
<task name> | User-defined task

Components and tasks started from the command prompt are run with the settings configured with the program interface.

Examples:

In order to enable File Anti-Virus, type the following line at the command prompt:
avp.com START FM
To stop a My Computer task from the command prompt, enter:
avp.com STOP SCAN_MY_COMPUTER
password=<your_password>


Starting a Virus Search

Starting a scan of a certain area for viruses and processing malicious objects from the command prompt generally looks as follows:

avp.com SCAN [<object scanned>] [<action>] [<prompt for action>] [<file types>] [<exclusions>] [<configuration file>] [<report settings>]
To scan objects, you can also use the tasks created in Active Virus Shield by start the one you need from the command prompt. The task will be run with the settings from the program interface.

Parameter description.

<object scanned> - this parameter gives the list of objects that will be scanned for malicious code.

The parameter can include several values from the list provided, separated by spaces.

<files>

List of paths to the files and/or folders to be scanned.
You can enter absolute or relative paths. Items on the list are separated by a space.

Notes:

  • If the object name contains a space, it must be placed in quotation marks;
  • If you specify a concrete folder, all the files in it are scanned.

/MEMORY

RAM objects

/STARTUP

Startup objects

/MAIL

E-mail databases

/REMDRIVES

All removable media drives

/FIXDRIVES

All internal drives

/NETDRIVES

All network drives

/QUARANTINE

Quarantined objects

/ALL

Complete scan

/@:<filelist.lst>

Path to the file with a list of objects and catalogs included in the scan. The file should be in a text format and each scan object must start a new line.

You can enter an absolute or relative path to the file. The path must be placed in quotation marks if it contains a space.

<action> - this parameter determines actions on malicious objects detected during the scan. If this parameter is not defined, the default action is the one with the value for /i2.

/i0

take no actions on the object; simply record information about it in the report.

/i1

Treat infected objects, and if disinfection is impossible, skip

/i2

Treat infected objects, and if disinfection fails, delete, but do not delete infected objects from compound objects, and delete compound objects with executable headers (sfx archives) (this is the default setting).

/i3

Treat infected objects, and if disinfection fails, delete and delete all compound objects completely if the infected attachments cannot be deleted.

/i4

Delete infected objects, and if disinfection fails, delete and delete all compound objects completely if the infected attachments cannot be deleted.

<prompt for action> - this parameter defines which actions will ask the user for a response during the scan. If the parameter is not defined, the action is requested by default at the end of the scan.

/a0

Do not prompt for action

/a1

Prompt for action if an infected object is detected

/a2

Prompt for action when the scan is complete

<file types> - this parameter defines the file types that will be subject to anti-virus scan. By default, if this parameter is not defined, only infected files by contents will be scanned.

/fe

Scan only infected files by extension

/fi

Scan only infected files by contents

/fa

Scan all files

<exclusions> - this parameter defines objects that are excluded from the scan.

The parameter can include several values from the list provided, separated by spaces.

/e : a

Do not scan archives

/e : b

Do not scan e-mail databases

/e : m

Do not scan plain text e-mails

/e : <mask>

Do not scan objects by mask

/e : <seconds>

Skip objects that are scanned for longer that the time specified in the <seconds> parameter

<configuration file> - defines the path to the configuration file that contains the program settings for the scan.

You can enter an absolute or relative path to the file. If this parameter is not defined, the values set in the Active Virus Shield interface are used.

/C:<settings_file>

Use the settings values assigned in the file <settings_file>.

<report settings> - this parameter determines the format of the report on scan results.

You can use an absolute or relative path to the file. If the parameter is not defined, the scan results are displayed on screen, and all events are displayed.

/R:<report_file>

Only log important events in this file

/RA:<report_file>

Log all events in this file

Examples:

Start a scan of RAM, Startup programs, e-mail databases, the directories My Documents and Program Files, and the file test.exe:
avp.com SCAN /MEMORY /STARTUP /MAIL "C:\Documents and Settings\All Users\My Documents" "C:\Program Files" "C:\Downloads\test.exe"
Pause scan of selected objects and start full computer scan, at the end of which continue to scan for viruses within the selected objects:
avp.com PAUSE SCAN_OBJECTS/password=<your_password>
avp.com START SCAN_MY_COMPUTER
avp.com RESUME SCAN_OBJECTS
Scan the objects listed in the file object2scan.txt. Use the configuration file scan_setting.txt for the job. Upon the results of the scan, generate a report in which all events are recorded:
avp.com SCAN /MEMORY /@:objects2scan.txt /C:scan_settings.txt /RA:scan.log


Program Updates

The syntax for updating Active Virus Shield program modules and threat signatures from the command prompt is as follows:

avp.com UPDATE [<path/URL>] [/R[A]:<report_file>] [/C:<settings_file>] [/APP]

Parameter description:

[<path/URL>] | HTTP or FTP server or network folder for downloading updates. If a path is not selected, the update source will be taken from the Updater settings.
/R[A]:<report_file> | /R:<report_file> - only log important events in the report. /R[A]:<report_file> - log all events in the report. You can use an absolute or relative path to the file. If the parameter is not defined, the scan results are displayed on screen, and all events are displayed.
/C:<settings_file> | Path to the configuration file that contains the settings for program updates. You can enter an absolute or relative path to the file. If this parameter is not defined, the values for the settings in the Active Virus Shield interface are used.
/APP | Update program modules

Examples:

Update threat signatures after recording all events in the report:
avp.com UPDATE /RA:avbases_upd.txt
Update the Active Virus Shield program modules by using the parameters of the configuration file updateapp.ini:
avp.com UPDATE /APP /C:updateapp.ini


Exporting protection settings

Command syntax:

avp.com EXPORT <profile|taskid> <settings_file>

Parameter description:

<profile> | Component or task with the settings that are being exported. One of the following values may be used: RTP - all protection components FM - File Anti-Virus EM - E-mail Anti-Virus
<settings_file> | Path to the file to which the Active Virus Shield settings are being exported. You can use an absolute or relative path. You can only use binary files (cfg).

Examples:

avp.com EXPORT c:\kis60settings.cfg


Importing protection settings

Command syntax:

avp.com IMPORT <settings_file>

<settings_file>

Path to the file from which the Active Virus Shield settings are being imported. You can use an absolute or relative path.

You can only use binary files (cfg).

Examples:

avp.com IMPORT c:\kis60settings.cfg


Viewing Help

To view the help for command prompt syntax, this command is available:

avp.com [ /? | HELP ]

To get help on the syntax of a specific command, you can use one of the following commands:

avp.com <command> /?
avp.com HELP <command>


Kaspersky Lab
Founded in 1997, Kaspersky Lab has become a recognized leader in information security technologies. It produces a wide range of data security software and delivers high-performance, comprehensive solutions to protect computers and networks against all types of malicious programs, unsolicited and unwanted email messages, and hacker attacks.
Kaspersky Lab is an international company. Headquartered in the Russian Federation, the company has representative offices in the United Kingdom, France, Germany, Japan, USA (CA), the Benelux countries, China, Poland and Romania. A new company department, the European Anti-Virus Research Centre, has recently been established in France. Kaspersky Lab's partner network incorporates more than 500 companies worldwide.
Today, Kaspersky Lab employs more than 450 specialists, each of whom is proficient in anti-virus technologies, with 10 of them holding M.B.A. degrees, 16 holding Ph.Ds, and senior experts holding membership in the Computer Anti-Virus Researchers Organization (CARO).
Kaspersky Lab offers best-of-breed security solutions, based on its unique experience and knowledge, gained in over 14 years of fighting computer viruses. A thorough analysis of computer virus activities enables the company to deliver comprehensive protection from current and future threats. Resistance to future attacks is the basic policy implemented in all Kaspersky Lab's products. At all times, the company's products remain at least one step ahead of many other vendors in delivering extensive anti-virus coverage for home users and corporate customers alike.
Years of hard work have made the company one of the top security software manufacturers. Kaspersky Lab was one of the first businesses of its kind to develop the highest standards for anti-virus defense. The company's flagship product, Active Virus Shield, provides full-scale protection for all tiers of a network, including workstations, file servers, mail systems, firewalls, Internet-gateways and hand-held computers. Its convenient and easy-to-use management tools ensure advanced automation for rapid virus protection across an enterprise. Many well-known manufacturers use the Active Virus Shield kernel, including Nokia ICG (USA), F-Secure (Finland), Aladdin (Israel), Sybari (USA), G Data (Germany), Deerfield (USA), Alt-N (USA), Microworld (India) and BorderWare (Canada).
Kaspersky Lab's customers benefit from a wide range of additional services that ensure both stable operation of the company's products, and compliance with specific business requirements. Kaspersky Lab's anti-virus database is updated every hour. The company provides its customers with a 24-hour technical support service, which is available in several languages to accommodate its international clientele.


Other Kaspersky Lab Products
Kaspersky Internet Security 6.0
Kaspersky Internet Security 6.0 is an integrated solution for protection of personal computers against the main information-related threats, i.e. viruses, hackers, spam and spyware. A common user interface allows configuration and management of all solution components.
The anti-virus protection feature includes:
  • Anti-virus scanning of e-mail traffic on the level of data transmission protocol (POP3, IMAP and NNTP for incoming mail and SMTP for outgoing messages) irrespectively of the mail client being used. The program includes plug-ins for popular e-mail clients (Microsoft Office Outlook, Microsoft Outlook Express and The Bat!) and supports disinfection of their e-mail databases.
  • Real-time anti-virus scanning of Internet traffic transferred via HTTP.
  • File system protection: anti-virus scanning of individual files, directories or drives. In addition, the application can perform anti-virus analysis exclusively for critical areas of the operating system and start-up objects of Microsoft Windows.
  • Proactive protection: the program performs constant monitoring of application activity and processes running in random-access memory preventing dangerous changes to the file system and registry, and restores the system after malicious influence.
Protection against Internet-fraud is guaranteed owing to the ability to recognize phishing attacks, which helps prevent confidential data leaks (first of all, your passwords, bank account and credit card numbers), and block execution of dangerous scripts on web pages, pop-up windows and advertisement banners. The feature blocking charged phone calls helps identify software that attempts to use your modem for hidden unauthorized connection to paid phone services and prevents such activity.
Kaspersky Internet Security 6.0 registers attempts to scan the ports of your computer, which frequently precede network attacks, and successfully defends against typical hacker attacks. The program uses defined rules as a basis for control over all network transactions tracking all incoming and outgoing data packets. Stealth mode (owing to the SmartStealth™ technology) prevents computer detection from outside. When you switch into that mode, the system will block all network activity except for a few transactions allowed in user-defined rules.
The program employs complex approach to anti-spam filtering of incoming e-mail messages:
  • Verification against black and white lists of recipients (including addresses of phishing sites).
  • Inspection of phrases in message body.
  • Analysis of message text using a self-learning algorithm.
  • Recognition of spam sent in image files.
Kaspersky Lab News Agent
The News Agent is intended for timely delivery of news published by Kaspersky Lab, for notifications about the current status of virus activity and fresh news. The program reads the list of available news channels and their content from news server of Kaspersky Lab with specified frequency.
The product performs the following functions:
  • It visualizes in the system tray the current status of virus activity.
  • The product allows the users to subscribe and unsubscribe from news channels.
  • It retrieves news from each subscribed channel with the specified frequency and notifies about fresh news.
  • It allows reviewing news on the subscribed channels.
  • It allows reviewing the list of channels and their status.
  • It allows opening pages with news details in your browser.
News Agent is a stand-alone Microsoft Windows application, which can be used independently or may be bundled with various integrated solutions offered by Kaspersky Lab Ltd.
Kaspersky OnLine Scanner
The program is a free service offered to the visitors of Kaspersky Lab's corporate website. The service allows an efficient online anti-virus check of your computer. Kaspersky OnLine Scanner runs within your web browser using Microsoft ActiveX® technology. Thus, users can quickly test their computers in case of a slightest suspicion of malicious infection. Using the service, visitors can:
  • Exclude archives and e-mail databases from scanning.
  • Select standard/extended anti-virus databases for scanning.
  • Save a report on the scanning results in txt or html formats.
Kaspersky OnLine Scanner Pro
This program is a subscription service available to visitors of the corporate website allowing to perform efficient anti-virus scan of your computer and disinfection of infected files online. Kaspersky OnLine Scanner Pro is executed in the web browser using the Microsoft ActiveX® technology. While scanning the user can:
  • Exclude archives and e-mail databases from scanning.
  • Select standard/extended anti-virus databases for scanning.
  • Save a report on the scanning results in txt or html formats.
Kaspersky Security for PDA
Kaspersky Security for PDA provides reliable anti-virus protection for data saved on various types of hand-held computers and smartphones. The program includes an optimal set of anti-virus defense tools:
  • anti-virus scanner that scans information (saved both in internal memory of PDA and smartphones or on memory cards of any type) on user demand;
  • anti-virus monitor to intercept viruses in files that are either copied from other handhelds or are transferred using HotSync™ technology.
Kaspersky Security for PDA protects your handheld (PDA) from unauthorized intrusion by encrypting both access to the device and data stored on memory cards.
Active Virus Shield Business Optimal
This package provides a unique configurable security solution for small- and medium-sized corporate networks.
Active Virus Shield Business Optimal guarantees full-scale anti-virus protection1 for:
  • Workstations running Microsoft Windows 98/ME, Microsoft Windows NT/2000/XP Workstation and Linux;
  • File servers running Microsoft Windows NT 4.0 Server, Microsoft Windows 2000/2003 Server/Advanced Server, Microsoft Windows 2003 Server, Novell Netware, FreeBSD and OpenBSD, Linux, Samba Servers;
  • E-mail clients, namely Microsoft Exchange 2000/2003, Lotus Notes/Domino, Postfix, Exim, Sendmail, and Qmail;
  • Internet-gateways: CheckPoint Firewall -1; Microsoft ISA Server 2000 Standard Edition.
The Active Virus Shield Business Optimal distribution kit includes Kaspersky Administration Kit, a unique tool for automated deployment and administration.
You are free to choose from any of these anti-virus applications, according to the operating systems and applications you use.
Kaspersky Corporate Suite
This package provides corporate networks of any size and complexity with comprehensive, scalable anti-virus protection. The package components have been developed to protect every tier of a corporate network, even in mixed computer environments. Kaspersky Corporate Suite supports the majority of operating systems and applications installed across an enterprise. All package components are managed from one console and have a unified user interface. Kaspersky Corporate Suite delivers a reliable, high-performance protection system that is fully compatible with the specific needs of your network configuration.
Kaspersky Corporate Suite provides comprehensive anti-virus protection for:
  • Workstations running Microsoft Windows 98/ME, Microsoft Windows NT/2000/XP Workstations and Linux;
  • File servers running Microsoft Windows NT 4.0 Server, Microsoft Windows 2000, 2003 Server/Advanced Server, Novell Netware, FreeBSD, OpenBSD, Linux and Samba Servers;
  • E-mail clients, including Microsoft Exchange Server 2000/2003, Lotus Notes/Domino, Sendmail, Postfix, Exim and Qmail;
  • Internet-gateways: CheckPoint Firewall -1; Microsoft ISA Server 2004 Enterprise Edition;
  • Hand-held computers (PDAs), running Microsoft Windows CE and Palm OS, and also smartphones running Microsoft Windows Mobile 2003 for Smartphone and Microsoft Smartphone 2002.
The Kaspersky Corporate Suite distribution kit includes Kaspersky Administration Kit, a unique tool for automated deployment and administration.
You are free to choose from any of these anti-virus applications, according to the operating systems and applications you use.
Kaspersky Anti-Spam
Kaspersky Anti-Spam is a cutting-edge software suite that is designed to help organizations with small- and medium-sized networks wage war against the onslaught of undesired e-mail (spam). The product combines the revolutionary technology of linguistic analysis with modern methods of e-mail filtration, including DNS Black lists and formal letter features. Its unique combination of services allows users to identify and wipe out up to 95% of unwanted traffic.
Installed at the entrance to a network, where it monitors incoming e-mail traffic streams for spam, Kaspersky Anti-Spam acts as a barrier to unsolicited e-mail. The product is compatible with any mail system and can be installed on either an existing mail server or a dedicated one.
Kaspersky Anti-Spam's high performance is ensured by daily updates to the content filtration database adding samples provided by the Company's linguistic laboratory specialists. Databases are updated every 20 minutes.
Kaspersky SMTP Gateway
Kaspersky SMTP-Gateway for Linux/Unix is a solution designed for anti-virus processing of e-mail transmitted via SMTP. The application contains a number of additional tools for filtering e-mail traffic by name and MIME type of attachments and a number of tools reducing the load on the mail system and preventing hacker attacks. DNS Black List support provides protection against e-mails coming from servers entered in these lists as sources distributing unwanted e-mail (spam).
Kaspersky Security for Microsoft Exchange 2003
Kaspersky Security for Microsoft Exchange performs anti-virus processing of incoming and outgoing mail messages as well as messages stored at the server, including letters in public folders and filters out unsolicited correspondence using "smart" spam recognition techniques in combination with Microsoft technologies. The application scans all messages arriving at an Exchange Server via SMTP protocol checking them for the presence of viruses using Kaspersky Lab's anti-virus technologies and for the presence of SPAM attributes. It filters out spam based on formal attributes (mail address, IP address, letter size, heading) and analyzes the content of messages and of their attachments using "smart' technologies, including unique graphic signatures for identifying graphic SPAM. The application scans both the message body and the attached files.
Kaspersky Mail Gateway
Kaspersky Mail Gateway is a comprehensive solution that provides complete protection for users of mail systems. This application installed between the corporate network and the Internet scans all components of e-mail messages for the presence of viruses and other malware (Spyware, Adware, etc.) and performs centralized anti-spam filtration of e-mail stream. This solution also includes some additional mail traffic filtration features.
1Depending on the type of distribution kit.


Contact Us

If you have any questions, comments, or suggestions, please refer them to one of our distributors or directly to AOL. We will be glad to assist you in any matters related to our product by phone or via email. All of your recommendations and suggestions will be thoroughly reviewed and considered.
Technical support | Please find the technical support information at http://www.activevirusshield.info
General information | WWW: http://www.activevirusshield.com E-mail: AVS_Feedback@listserv.aol.com Virus Encyclopedia http://www.viruslist.com


Starting the program

Command syntax:

avp.com


Stopping the program

Command syntax:

EXIT /password=<password>

<password>

Active Virus Shield password assigned in the program interface.

Not that you cannot execute this command without entering the password.