Copyright: Copyright © 2001 Kaspersky Lab


Heuristic checking tool (Code Analyzer)

The heuristic detecting tool (Code Analyzer) checks file and sector codes down the various Kaspersky Anti-Virus algorithmic legs searching for virus-similar instructions (such as - to open a file, to write into it, to intercept the interrupt vectors or etc.) and generates appropriate alerts.

Of course, just like any other of the type the heuristic algorithm may occasionally produce false alarms, however Code Analyzer has been tested many times and checked a large number of files, and has not so far been actually deceived. If you do encounter a false alarm while checking files using Code Analyzer, please let us know and send us copies of the virus-free files that were identified as infected so that we could study them at Kaspersky Lab Ltd..

When scanning a code the heuristic detecting tool examines the structure of a program down to several sub-levels. This device detects 92 % of the viruses (including many encrypted ones) in the Kaspersky Lab’s database, and we believe that newfound viruses that aren’t yet in the database will be detected with the same degree of probability.

The current version of Code Analyzer does not remove viruses from files and sectors that are identified as suspicious. To remove a new virus from a file refer to a system programmer or directly to the anti-virus support department of Kaspersky Lab.

The Code Analyzer alerts’ format is the following:

Suspicion: <TYPE>

where <TYPE> is replaced by one of the following strings:

Com — the file seems to be infected by a virus that infects .COM files;

Exe — the file seems to be infected by a virus that infects .EXE files;

ComExe — the file seems to be infected by a virus that infects both .COM and .EXE files;

ComTSR, ExeTSR, SysTSR, ComExeTSR — the file seems to be infected by a resident virus that infects .COM, .EXE and .SYS files;

Boot — the file/sector seems to be infected by a boot virus or looks like a boot virus installer;

Trojan — the file looks like a Trojan;

Trivial — the file seems to be infected by an unknown virus replacing executable files in a current directory by its own codes (usually the virus size doesn’t exceed 300 bytes);

HLL — the file seems to be infected by an unknown virus infecting executable files. The virus is written in a high-level programming language (C, Pascal);

Win32 — the file seems to be infected by an unknown Windows virus;

Formula — the Excel file contains suspicious instructions;

Macro.Word97.Fs — the file seems to be infected with a Macro.Word97.Fs family virus.

RemoteTemplate — the document contains a link to the template which is automatically loaded when the file is opened;

HTML.SecurityBreach.2 — the HTML file or the HTML message is linked to a suspicious object;

IRC-Worm.generic — the file seems to be infected by an unknown worm transmitting itself via the IRC channels;

BAT — the file seems to be infected with an unknown virus infecting BAT files;

VBS.I-Worm — the file seems to be infected by an unknown worm transmitting itself with email messages.

  Contact us


Kaspersky Anti-Virus
Kaspersky Anti-Virus is a package of anti-virus programs developed by Kaspersky Lab for individual users as well as for corporate networks. For more details of Kaspersky Anti-Virus refer to http://www.kaspersky.com/products.asp. Besides, you can purchase Kaspersky Anti-Virus in the on-line shop at http://store.kaspersky.com/.


Defining the location to be monitored

The Objects frame in the work-area allows you to choose locations and objects to be monitored for viruses. You may do it by selecting appropriate options in the frame hierarchies. These options may be viewed in the following two modes: Standard and Expert. To switch between these modes use the corresponding buttons in the left frame of the window work-area.

With the Standard mode enabled the Objects frame is divided into two sub-frames: in the left sub-frame you may see the list of computer disks, and the right sub-frame displays settings for the item selected in the left sub-frame list.

With the Expert mode enabled the Objects frame is divided into three sub-frames: in the upper left sub-frame you may find the file-system hierarchy, the upper right sub-frame displays settings for the item selected in the upper left sub-frame hierarchy, and the lower sub-frame displays the list of files located in the root of the object selected in the upper left sub-frame. Besides in this mode the Network Neighborhood item is added to the file-system hierarchy.

Use the (upper) left sub-frame to define the location that must be monitored for viruses. Check a box [image] to define the corresponding object as to be checked. If you uncheck a box [image], the corresponding object will be defined as to be skipped during the monitoring.

For the program to monitor for viruses in a location within your filesystem, you must check a check box at the left of the area name.

For the program to monitor a group of disks, check the My Computer box in the (upper) left sub-frame and the required check-box in the (upper) right hierarchy:

Scan local removable disk drives — monitors all removable disks. This check-box is available, only if you checked the My Computer box in the (upper) left sub-frame. For the same result you may check boxes of all your removable disks in the (upper) left sub-frame.

Scan local hard disk drives — monitors all local hard disks. This check-box is available only if you checked the My Computer box in the (upper) left sub-frame. For the same result you may check boxes of all your local hard disks in the (upper) left sub-frame.

If you check a box of some certain location within your file system, boxes of all the locations included in the checked one will also be automatically checked. However, when in the Expert view mode you can mark the required sub-locations as to be excluded from the check.

For example, you defined the disks C: and D: as to be checked for viruses, but you do want the D:\public\archives directory to be excluded from the location defined as to be checked. In this case you must check the C: and D: check boxes, and then you must uncheck the archives box.

If you excluded a folder from the location defined as to be checked, a triangle will appear in the checked boxes of all the parent locations:  instead of [image]. If you excluded some location from the larger location that is defined as to be checked for viruses, it means that the monitor will not check it at all or will not check it using the rules defined for the parent location. You may eliminate (disable) this difference inside the larger location, or keep it for some certain period of time.

For every defined location within your file system you can specify separate monitoring settings. For every defined location-to-be-checked you can also specify the objects-to-be-checked by using the settings’ tree in the right-hand pane.

  Contact us


Unloading the program out of memory

You can unload the program out of your computer memory by selecting the Unload Kaspersky Anti-Virus Monitor command from the main window File menu or from the system menu.

  Contact us


Main window

The Kaspersky AV Monitor main window allows you to change the monitor settings, to disable/enable the monitor and to view the performance statistics. You may exit the window without unloading the program out of your computer memory.

The Kaspersky AV Monitor main window contains the following items:

menu;

toolbar;

work-area;

the OK, Cancel, Apply and Help buttons.

  Contact us


Handling infected and suspicious objects

Actions in case of virus detection — in case of detecting the infected or suspicious objects, the program will perform one of the following actions.

Ask user— Kaspersky AV Monitor will open up the dialog box. This dialog box contains a name of infected file, name of the detected virus and the list of possible actions to be performed with infected object, that is a list of all possible actions except for [image] Ask user. Besides, the appearing dialog box contains the Apply to all infected objects check box; by checking it, you can apply the selected action to all infected objects that will be detected later, and that you previously predefined as to be handled by opening the dialogue box. Then upon detecting the next infected object, the dialog box will not appear again. The following two buttons are located at the bottom of this dialog box: OK (accepts the selected action), Cancel (closes the dialog box and proceeds with monitoring).

Report only — the program will only report the infected and suspicious objects. The check report can be viewed by starting the report viewer, Kaspersky Report Viewer.

Disinfect — the program will try to cure all infected objects without asking first. As a result, the detected viruses will be removed, and the object will be restored as an operable one.

  Make backup file before disinfection –- to create a copy of the infected object before starting a cure. A directory where the copy will be created is specified in a settings’ tree of the Options category (see topic Renaming options). The copy will not be deleted upon completion of a treatment.

If disinfection is impossible — not all infected objects can be cured, because some viruses damage the computer data irreversibly. In this case, Kaspersky AV Monitor can operate using one of the following three methods:  Report only— that is to inform about unsuccessful attempt of treatment, [image] Rename object — that is to rename the unrecoverable file, [image] Delete object — that is to delete the damaged file.

Rename object — the program will rename all infected objects. The renaming rules are specified in a settings’ tree of the Options category (see topic Renaming options).

Delete object— the program will delete all infected objects without warning.

The Delete object and the Rename object options are applied to infected archives, only if you checked the Enable delete or rename non-disinfected archives box on the Options page. Otherwise, if you select those options, the program will not delete or rename infected archives.

  Contact us


Working with Settings' tree

Every joint of a settings’ tree may have branches. If a branch is visible the corresponding joint looks similar to this [image], and if the branch is hidden the corresponding joint will change for [image].

To change some certain setting you must make its branch visible.

To display and hide a branch, use the following methods::

What to do	How it might be done (By using…)
To display a branch (joint looks like [image])	the key [image] on your keyboard. the command [image] from the right-click menu. the key "*" on your keypad (all branches of the joint become visible).
To hide a branch  (joint looks like [image])	the key [image] on your keyboard. the command [image] from the right-click menu. the key "-" on your keypad (all branches of the joint disappear from your screen).
  Contact us


About dialog box

At the top of the About dialog box you can see the program details (version number, date when the program was last updated, number of viruses described in the anti-virus bases, registration data). The box also contains a table with the available key files. The table has the following columns: Key Number - the key number, License - the type of your license, Description — the license details, Expiration date — the license expiration date, Key file – name of the key file.

At the bottom of the dialog box you will see information about the program developers. By pressing the Support you will display the contact information of the Kaspersky Lab technical support service.

  Contact us


Advanced settings: Customize

The Customize frame contains options allowing you to define advanced settings of the program.

Use sound effects for the following events — check this box to play sounds when monitoring for viruses.

Infected object found— allows defining the sound file that is played every time an infected object is detected. While selecting files in the corresponding window you can use the Test button to listen to it.

Display attention messages — check this box to display other warning messages.

Check new updates — check this box to automatically start the anti-virus bases updating program on a regular basis. In the Check interval (days) dialog box, define the required interval between two automatic starts (the dialog box is displayed right after you checked this box).

If you are working with the program settings from Kaspersky AV Control Centre, you will not find some of the Customize settings. These settings make no sense, if you are using Kaspersky AV Control Centre.

  Contact us


Advanced monitoring tools

Monitoring compound objects

You can enable the advanced monitoring modes to check for viruses in archives, packed files, mail databases, plain mail formats and embedded objects. All these modes are united in the following single branch of the settings’ tree:

Scan compound files of the following types — check this box to process compound objects as folders containing a set of objects.

Monitoring archives and self-extracting files

It is absolutely essential for anti-virus software to be capable of checking archives. An infected file can stay in an archive for a long time, even years, with the virus inactive and therefore invisible to you, but when the day comes that you extract this file the virus may break loose and destroy your system.

Archives — check this box to search for viruses in files archived using ZIP, ARJ, LHA, RAR, CAB and some other archiving utilities.

Kaspersky Anti-Virus is not able to delete viruses from archives, it is able only to detect them. Besides, Kaspersky Anti-Virus does not extract password-protected archives.

Therefore, if you set your Kaspersky AV Monitor to delete or rename infected objects, it is advisable that you check the [image] Archives box and uncheck the [image] Enable delete or rename non-disinfected archives box on the Options page. In this case the program will only report the infected file detected within an archive, but it will not delete or rename the archive itself. Later, you will be able to extract the archive and delete viruses from extracted files by using your Kaspersky AV Scanner.

If the [image] Enable delete or rename non-disinfected archives box is checked, you can loose data that can be recovered later.

Archives with self-extractors— check this box to search for viruses in self-extracting archives, i.e. executable files that can be started to extract the archived files. Some self-extracting archives also immediately start one of the extracted files.

The extracting tool is able to correctly extract files that have been compressed multiple times. It can also deal with some versions of immunizers, programs protecting executable files from viruses by attaching checking code blocks (CPAV and F-XLOCK) and enciphering programs (CryptCOM) to them.

Monitoring mail databases and plain mail files

The program is able to search for viruses in mail databases and plain mail files.

Mail databases — check this box to search for viruses in mail databases of the following formats:

Microsoft Outlook, Microsoft Exchange (the .pst and the .pab extension files, the MS Mail archive type);

Microsoft Internet Mail (the .mbx extension files, the MS Internet Mail archive type).

Eudora Pro & Lite;

Pegasus Mail;

Netscape Navigator Mail;

JSMail SMTP/POP3 server (user database).

If the mail database monitoring mode is enabled, Kaspersky AV Monitor checks every entry in mail databases and scans attached files. The following formats are supported:UUEncode; XXEncode; btoa (up to 5.0); btoa 5.*; BinHex 4.0; ship; NETRUN 3.10; NETSEND 1.0 (not packed); NETSEND 1.0C (packed); MIME base64.

Plain mail— check this box to search for viruses in plain mail files of the formats: Eudora Pro & Lite, Pegasus Mail, Netscape Navigator Mail, JSMail, user database on the SMTP/POP3 server.

If the plain mail check mode is enabled, Kaspersky Anti-Virus checks every file for message header. If the message header is detected, the program searches for attached data (UUEncode, XXEncode and etc.) and checks it for viruses.

The mail database and plain mail modes noticeably slow down the Kaspersky AV Monitor performance rate. Therefore we do not recommend their use in a regular virus-monitoring.

Monitoring embedded objects

The program allows you to check for viruses not only in files, but also in the objects embedded to these files using the OLE technology.

Embedded objects — check this box to search for viruses in OLE objects embedded in the examined files.

Heuristic detecting tool

You can enable the built-in heuristic detecting tool to scan for viruses that are unknown to the program (they are not described in current anti-virus bases).

Enable Code analyzer— check this box to monitor for viruses using the heuristic detecting tool.

  Contact us


Kaspersky Lab Ltd.
About Kaspersky Lab

Kaspersky Lab Ltd. is an international, privately owned software-development company based in Moscow, with representative offices in Cambridge (United Kingdom), Walnut Creek (United States), and Johannesburg (South Africa). The company was founded in 1997. It concentrates its efforts on developing, marketing and distribution world-class data-security technologies and related computer software.

Kaspersky Lab's flagship product, known as Kaspersky Anti-Virus, has been in constant development since 1989, and has been rated consistently by numerous computer magazines and virus research centers as the best anti-virus product on the market.

Today Kaspersky Lab. is represented by more than 100 dealers and distributers from Russia and ex-USSR republics. Since 2000 Kaspersky Lab has provided Web site owners the opportunity to join its Affiliate program and generate revenues by distributing Kaspersky Anti-Virus via the Internet. For more details, please, refer to http://www.kaspersky.com.

  Contact us


How to start, disable and enable your AV Monitor
How to start, disable and enable your Kaspersky AV Monitor

There are several ways to start your anti-virus monitor:

using the Windows Start menu command;

from the StartUp menu (automatically);

from Kaspersky AV Control Centre (automatically);

by entering the appropriate command in the command line.

You can quickly start your anti-virus monitor using the appropriate Windows Start menu command. To do it, click the Start button on your Windows desktop, point to Programs, point to Kaspersky Anti-Virus, then click the Kaspersky AV Monitor command. The monitor icon [image] will appear next to the clock on the Windows taskbar. Click this icon with your mouse right button to display the monitor system menu.

If while installing Kaspersky Anti-Virus on your computer you added its icon to the Windows StartUp menu the program will be started automatically at Windows start.

If you installed Kaspersky AV Control Centre and used it to define your anti-virus monitor automatic start, the program will be started right after you start Kaspersky AV Control Centre. However in this case the monitor icon will not appear on the taskbar.

And finally, to start your anti-virus monitor from the command line, you must go to the Kaspersky Anti-Virus directory and execute the file avpm.exe.

If your anti-virus monitor is enabled,

you can see the icon [image] next to the clock on the Windows taskbar.

and you place your mouse cursor on the icon [image], the following prompt will pop-up: Kaspersky Anti-Virus Monitor is enabled;

the monitor system menu contains the following command: Disable Monitoring.

If your anti-virus monitor is disabled,

you can see the icon [image] next to the clock on the Windows taskbar.

and you place your mouse cursor on the icon [image], the following prompt will pop-up: Kaspersky Anti-Virus Monitor is disabled;

the monitor system menu contains the following command: Enable Monitoring.

We do not recommend you to run two anti-virus monitors from different manufacturers on the same computer, because it may results in conflicts and false alarms.

If you start your anti-virus monitor from Kaspersky AV Control Centre, its options become unavailable. In this case you must use Kaspersky AV Control Centre to change your monitor settings!

  Contact us


Loading, disabling and enabling Kaspersky AV Monitor

You can manually load your anti-virus monitor from Kaspersky AV Control Centre or from the Kaspersky AV Monitor main window. You can also use Kaspersky AV Control Centre to schedule your anti-virus monitor automatic start.

After the program is started to monitor for viruses you can disable it, and then resume the process.

	Main menu [image] command	System menu	Toolbar
Disabling	Monitor  Disable monitoring	Disable monitoring
Enabling	Monitor  Enable monitoring	Enable monitoring
  Contact us


Launching the anti-virus bases updating program

You may start the anti-virus bases updating program from your Kaspersky AV  Monitor main window. To do it, select the Update Now command from the Tools menu or click on the toolbar button [image].

  Contact us


Control indicators

When setting your anti-virus to check for viruses in the disk hierarchy (see topic  Defining the location to be monitored) you must use the so-called Rules of Succession, i.e. if you define some settings for the My computer item, they will be automatically assigned for all disks on your computer.

Every item of the hierarchy is associated with a control indicator (that can be enabled or disabled) and rules (applied to this item). A control indicator indicates whether the corresponding hierarchy item must or must not be checked for viruses, and the rules describe methods that will be applied when handling this item.

All the hierarchy items by default inherit rules of the group these are included in. If you change the rules to be applied to a group, the group item rules will change either.

You can assign independent rules to an item or change status of its control indicator. These items may have independent rules. If you change the rules to be applied to the group, these items will keep their processing rules. However, by changing the group indicator status you can restore these items as inheriting the group rules.

By selecting the Set Strict command from the right-click menu you can completely disable the rule-inheriting mode for the selected item. If you select this command, the corresponding control indicator will look like a red box with a black tick inside. Items with indicators in this condition have strictly independent rules assigned. These items will keep their rules even after you change the group indicator status. To restore these items as inheriting the group rules, you must select the Remove Strict command from the right-click menu.

The control indicator may look similar to the following:

Looks like	Description	Meaning
	A square with a tick inside. The square may be red or black.	The check mode is enabled. The square is red – the inheriting mode is disabled. The square is black – the inheriting mode is enabled.
	A square with the tick inside and the triangle in the right-bottom corner. The triangle may be red or black.	The inheriting mode is enabled, but some objects are excluded from the group and have their own settings. The triangle is red – for one or more objects the inheriting mode is disabled. The triangle is black – for one or more objects the rule is changed.
	A square without the tick and with the triangle in the right-bottom corner. The triangle may be red or black.	The check mode is disabled, but for one or more objects this mode is enabled. The triangle is red – for one or more objects the inheriting mode is disabled. The triangle is black – for one or more objects the rule is changed.
  Contact us


Objects, Options, Customize and Statistics categories

The main window work-area is divided into two frames. The left frame contains icons with the following names: Objects, Options, Customize and Statistics. The right frame displays settings corresponding to a left frame icon that is currently pressed.

The Objects frame allows you to define a location to be checked (the list of drives and folders), objects to be checked (e.g. sectors, files, mail databases), and rules to be followed while handling the infected objects (see topic Defining the location to be monitored). All these settings are arranged into the special control—objects' settings hierarchy.

The Options frame allows you to define certain general settings, and you may use a settings’ tree in the Customize frame to define advanced settings of your Kaspersky AV Monitor (see topics Reporting options, Renaming options, Advanced settings: Customize).

The Statistic frame displays a table with the monitor performance statistics.

  Contact us


Option button

The option button is a member of the group. A group of option buttons may consist of two and more buttons. You must use this group to select one of the options. The option button may be:

 — selected (enabled);

 — deselected (disabled).

You can select only one option button from the group.

To select and deselect an option button you must use the following methods:

What to do	How it might be done (By using…)
To select the option button	the SPACE key on your keyboard. the command [image] from the right-click menu. your mouse to click on it.
To deselect the option button	By selecting another option button from the group.
  Contact us


Buttons

At the bottom of the main window you can find the following buttons: OK, Cancel, Apply. Use these buttons to apply new settings or to cancel changes. Click the Help button to display the Help topics window.

  Contact us


Kaspersky Lab Ltd.
Kaspersky Lab Ltd. is an international, privately owned software-development company based in Moscow, with representative offices in Cambridge (United Kingdom), Walnut Creek (United States), and Johannesburg (South Africa). The company was founded in 1997. It concentrates its efforts on developing, marketing and distribution world-class data-security technologies and related computer software.

Kaspersky Lab's flagship product, known as Kaspersky Anti-Virus, has been in constant development since 1989, and has been rated consistently by numerous computer magazines and virus research centers as the best anti-virus product on the market.

Today Kaspersky Lab. is represented by more than 100 dealers and distributers from Russia and ex-USSR republics. Since 2000 Kaspersky Lab has provided Web site owners the opportunity to join its Affiliate program and generate revenues by distributing Kaspersky Anti-Virus via the Internet. For more details, please, refer to http://www.kaspersky.com.


Menu

At the top of the Kaspersky AV Monitor main window you can see a menu bar with drop-down menus. Some commands in these menus may be activated using appropriate key combinations or toolbar buttons. The key combination that may be used instead of a command is defined at the right of this command in the corresponding drop-down menu.

Menu [image] command	Function (The menu command allows you to…)
File [image] Unload Kaspersky Anti-Virus Monitor	unload Kaspersky AV Monitor from the computer memory
File [image] Close window	close the Kaspersky AV Monitor main window
Monitor [image] Enable monitoring / Disable monitoring	enable / disable the program to monitor for viruses
Monitor [image] View monitoring options	display your monitor settings in the form of a text
Tools [image] Update Now	allow you to update your anti-virus bases
Tools [image] Show Report	display the report window
Tools [image] Make Virus List	generate the list of currently known viruses
Help [image] Contents	display the Help topics window
Help [image] Kaspersky Anti-Virus on the Web	start your web browser and take you to the Kaspersky Lab site
Help [image] About Kaspersky Anti-Virus Monitor	display information about the program
  Contact us


Function and features

Kaspersky Anti-Virus Monitor (Kaspersky AV Monitor) is a memory resident program that monitors files when these are accessed. Whenever somebody refers to an object, the monitor checks the object to make sure that it is free of viruses. If the object is found to be infected, the program will attempt to disinfect the object, delete it, move it to a quarantine folder or allow it to be accessed, depending on the options that were selected. This way the anti-virus monitor allows you to detect and delete viruses before the system is actually infected.

Here we must note that there are more then one term describing programs similar to the Kaspersky Lab anti-virus monitor, for example, people call them resident scanners, or anti-virus filters, or on access scanners and etc.

  Contact us


Contact us
If you have any questions, comments or suggestions related to these Help topics please email them to Kaspersky Lab at support@kaspersky.com.


General settings: Options

The Options frame contains options allowing you to choose how the monitor should report the performance statistics and rename the infected files it detected.

See.	Reporting options,

Renaming options.

  Contact us


Defining objects to be monitored

For locations that correspond to different levels of the file-system hierarchy the (upper) right frame displays different groups of settings. The maximum quantity of settings is displayed for the My Computer location. Here you can set your monitor to check your computer memory, boot sectors and groups of disks. When defining settings for a disk you can enable the check of boot sectors and file-system located on this disk. For a folder you cannot disable the check of file-system. But you can define how the monitor must process infected and suspicious objects, in what type of files it must check for viruses. You can also enable/disable the advanced monitoring tools to be used for all the locations in the (upper) left frame.

Scan files of following types — monitors files in the corresponding location (including System, Hidden and Read Only files). This check-box is available if you checked the My Computer or a disk box in the (upper) left sub-frame. You cannot uncheck it for a folder or file. If you checked this box, you must define file types to be checked for viruses:

All infectable — monitors all files that are able to carry a virus.

All — monitors every file of every type.

By mask — monitors the file types defined by user in the text fields below. You can specify the unlimited quantity of file types, but make sure that one text field contains only one file type.

Exclude by mask — excludes from the check the file types defined by user in the text fields below. You can specify the unlimited quantity of file types, but make sure that one text field contains only one file type.

Scan sectors — monitors boot sectors (Master Boot Record and boot sectors). This check-box is available only if you checked the My Computer or a disk box in the (upper) left sub-frame.

Scan memory — monitors RAM. This check-box is available only if you checked the My Computer box in the (upper) left sub-frame.

If you check the Scan sectors and Scan memory check boxes sectors and memory will be checked only once, when the monitoring is started. Besides, if you check the Scan memory check box the program will monitor for viruses in the memory of launched programs. Kaspersky AV Monitor performs this check, right after it is loaded, and also every time you update your anti-virus bases. If the infected memory of a program cannot be disinfected, this program is forced to abort the performance.

  Contact us


Toolbar

The Kaspersky AV Monitor main window toolbar contains the following buttons.

Button	Menu [image] command	Function (The button and the menu command allow you to…)
	Monitor [image] Enable monitoring / Disable monitoring	enable/disable the program to monitor for viruses
	Monitor [image] Preview Monitoring	display your monitor settings in the form of a text
	Tools [image] Show Report	display the report window
	Tools [image] Update Now	start the anti-virus bases updating program
	File [image] Unload Kaspersky Anti-Virus Monitor	unload Kaspersky AV Monitor from the computer memory
  Contact us


Reporting options

 Save report file — check this box to save the report to a file. If you check the box, you will be able to monitor the performance of Kaspersky AV Monitor using Kaspersky Report Viewer. When displaying the performance results, this program will use settings defined in the Save report file branch.

Report file name – use this field to define the report file name.

By default the report file is created in a directory that you specified during the program installation. If the program is not launched from Kaspersky AV Control Centre, you can re-define this directory by specifying the full path to your report file. If the program is controlled by Kaspersky AV Control Centre, you cannot re-define this directory.

Show pack info in the report — check this box to be reported about packed and archived objects. These messages have the following format in the Kaspersky Report Viewer table: the Object column shows the object name, the Result column shows the Packed or Archive strings and the Description column shows a name of the corresponding compressing or archiving utility.

Show clean object info in the report — check this box to be reported about virus-free objects. These messages have the following format in the Kaspersky Report Viewer table: the Object column shows the object name, the Result column shows the OK string.

Append — check this box to append new reports to the existing report file. This is useful if you want to keep reports on several or all the previous checks. If the box is not checked, every time Kaspersky AV Monitor is started it will create a new report file.

Limit size to (Kb) — check this box to limit size of the report file to the value specified in the below field. The default value is 2048 Kb.

  Contact us


Object monitoring settings
Object monitoring settings.

The Objects frame allows you to define the locations and the objects that must be monitored for viruses, to specify how the monitor and handle infected and suspicious objects, and also to enable/disable the advanced monitoring tools.

See	Defining the location to be monitored,

Defining objects to be monitored,

Handling infected and suspicious objects,

Advance monitoring tools.

  Contact us


Renaming options

 For renaming or copying of infected objects use — these option buttons allow you to choose between moving infected objects to a special folder and renaming them. The program will apply this setting to those objects for which you selected the Rename object option in the Objects settings’ tree.

Special folder — this option button moves infected objects to a special directory defined in the below text field. In this case, infected objects are moved to the folder with their names and extensions unchanged.

The object folder — this option button renames infected objects, i.e. changes their extensions for the one defined in the Extension of infected file field.

Enable delete or rename non-disinfected archives – check this box to allow the program to delete or rename infected archives. This check box is used only for those objects for which you selected the Delete object or the Rename object options (respectively) in the Objects settings’ tree. It is not advisable to check this box, since you may loose data that can be recovered later.

  Contact us


Check box

A check-box may be

 — unchecked meaning that this type of virus-monitoring will not be performed.

 — checked meaning that the program will perform this type of virus-monitoring.

To check and uncheck a box you must use the following methods:

What to do	How it might be done (By using…)
To check the box	the SPACE key on your keyboard. the command [image] from the right-click menu. your mouse to click on it.
To uncheck the box	the SPACE key on your keyboard. the command [image] from the right-click menu. your mouse to click on it.
  Contact us


Text field

To edit value of the text field you must use your keyboard. You may see the text field current value enclosed with angle brackets at the right of the field name.

 — the text field.

To edit a text field value use the following methods:

What to do	How it might be done (By using…)
To edit the field value	your mouse to click on the field icon.  the command [image] from the right-click menu. the F2 key on your keyboard. The text field will change its appearance for: .
After you finish editing the text field value press the ENTER key on your keyboard or click with your mouse outside of this text field. You can cancel changing this text field and return to the previous value by pressing the ESC key on your keyboard.

  Contact us


Input field defining the path to…

To edit value of the path field you must use the conventional Windows dialog allowing to select the directory or file.

 — the path input field.

To edit a path field value use the following methods:

What to do	How it might be done (By using…)
To edit the field value	your mouse to click on the field icon.  the command [image] from the right-click menu. the F2 key on your keyboard.
  Contact us


 Input field defining the number of …

To input new value in the number field you must type it in from your keyboard or use the courser controlling keys to change the current value. You may see the number field current value enclosed with angle brackets at the right of the field name.

 — the number input field.

To edit a number in the field use the following methods:

What to do	How it might be done (By using…)
To edit the field value	your mouse to click on the field icon.  the command [image] from the right-click menu. the F2 key on your keyboard.
  Contact us


Previewing settings before the monitoring

You can review your monitor settings in the form of a text. This kind of text describes rules specified for all the objects of your file system: from My Computer to separate files. For example, if the rules that your Kaspersky AV Monitor uses to check and process the autoexec.bat file differ from those used for the parent object - System disk (C:), a list of these rules will be displayed separately.

To review the text describing your Kaspersky AV Monitor settings, select the View monitoring options command from the File menu or click the toolbar button [image].

The Monitoring Options windows containing values of the Objects and Options settings will appear on your screen. You can view and copy the setting values. When you finished working with this window click OK.

The monitor settings in the form of a text are also recorded in the beginning of your report file.

  Contact us


Viewing the performance statistics

If you enabled Kaspersky AV Monitor to report its performance, you can view the performance statistics in progress in the Statistics frame.

The frame table is divided into the following two sections: Scanned and Found. The Scanned section displays numbers of checked sectors, files, folders, archives and compressed files. The Found section displays the numbers of:

viruses detected;

virus bodies (that is, the number of files infected by a known virus);

disinfected objects (that is, the number of objects from which viruses were correctly deleted);

deleted objects;

renamed objects;

warnings, i.e. messages about objects containing codes similar to known virus modifications;

suspicious objects (that is, Code Analyzer notifications);

corrupted objects;

I/O errors.

  Contact us


Work-area

Work-area of the main window is divided into two frames. The left frame contains icons with the following names: Objects, Options, Customize and Statistic. The right frame displays settings that correspond to a left frame icon that is currently pressed.

The Objects frame allows you to define the locations and the objects that must be checked for viruses, and to specify how the monitor must process objects that have been defined as infected. All these settings are arranged into the special control—objects' settings hierarchy.

The Options frame allows you to define certain general settings, and you can use a settings' tree in the Customize frame to define advanced settings of your Kaspersky AV Monitor.

The Statistic frame displays a table with the monitor performance statistics.

Every item of the settings’ tree has a right-click menu with commands applicable to this certain item.

To display the right-click menu of an item in the settings’ tree,

1.	Place your mouse cursor on the required item.

2.	Click your mouse right button. The appropriate right-click menu will appear on your screen.

  Contact us


Drop-down list

Drop-down list allows you to select one of the items from this list. To browse the list you must use the [image] and [image] keys on your keyboard. To automatically scroll down/up the list you must use the CTRL+ [image] and CTRL+ [image] key combinations.

Drop-down list

  Contact us


Help desk for registered users

Kaspersky Lab offers a large service package enabling its legal customers to efficiently employ Kaspersky Anti-Virus.

If you register and purchase a subscription you will be provided with the following services for the period of your subscription:

anti-virus database weekly updates;

new versions of Kaspersky AV Monitor;

phone or e-mail advising on matters related to the operation of our anti-virus software;

information about the Kaspersky Lab new products and about new computer viruses.

For more information about our services refer to your README.TXT.

Kaspersky Lab does not provide information related to operation and use of your operating system, and various technologies.

  Contact us


System menu

When you start your monitor the program main window will appear on your screen, and you will see the monitor icon [image] next to the clock on the Windows taskbar. Click this icon with your mouse right button to display the monitor system menu. The system menu contains the following commands:

Kaspersky Anti-Virus Monitor Settings – displays the program main window.

Disable monitoring / Enable monitoring – disables/enables the program to monitor for viruses in files.

Show Report – displays a window containing the program performance report.

Update Now – starts the anti-virus bases updating program, Kaspersky AV Updater.

About Kaspersky Anti-Virus Monitor – displays a box containing information about the program.

Unload Kaspersky Anti-Virus Monitor – unloads the program out of your computer memory.

  Contact us


Monitoring the performance progress

If you enabled Kaspersky AV Monitor to report its performance, you can use the Kaspersky Report Viewer program to monitor the performance in progress. To start the program, select the Show report command from the Tools menu, or click the toolbar button [image]. The Kaspersky Report Viewer main window allowing you to monitor your Kaspersky AV Monitor progress will appear on your screen.

  Contact us


Contents


Generating the list of currently known viruses

You can generate and review the list of currently known computer viruses. To do this, follow these steps:

1.	Select the Make Virus List command from the Tools menu. This command starts Kaspersky Virus List Generator.

2.	In the Kaspersky Virus List Generator dialog box on your screen, define the file name for the list to be saved to. To do this, use the Browse button.

3.	Press the Generate button.

To display the list, press the Show list button. This button starts Report Viewer that can be used to review the generated list of viruses.

To exit the Kaspersky Virus List Generator dialog box press the Exit button.

You can start Kaspersky Virus List Generator directly from the Windows main menu. To do this, press the Start button in the left bottom corner of your Windows screen, point to Programs, point to Kaspersky Anti-Virus and click the Kaspersky Virus List Generator command.

  Contact us


Technical support

If you have any questions, comments or suggestions please refer them to our distributors or directly to Kaspersky Lab. We will be glad to advise you on any matters related to our product installation and management by telephone or e-mail and all your recommendations and suggestions will be thoroughly reviewed and considered.

Technical Support	France:  Tel: +33 (0)3-87-18-78-00  supptech@wska.com	E-Mail:	sales@kaspersky.com	Sales Department
	Germany: Tel: +49 (0)190-88-44-33 support@softline.de		newvirus@kaspersky.com	Anti-virus lab (only for archived virus copies)
	Great Britain: Tel: +44 (0)1889-564601 support.wska@ttp.co.uk		info@kaspersky.com	Marketing and Advertising Department
	Spain: Tel: +34 91 623-94-99 atusuarios@teleline.es	WWW:	http://www.kaspersky.com http://www.viruslist.com
  Contact us


Conventions

Convention	Meaning
To do this,  1. Step 1. 2. …	Actions that must be taken
The monitor settings in the form of a text are also recorded….	Critical information and notes
File	Menu titles, commands, window titles, dialog elements, etc.
deleted objects...;  renamed objects...;	Listed items
  Contact us


What is Settings' tree
What is Settings’ tree

The Kaspersky Anti-Virus interface frequently uses the so-called Settings’ tree which presents data in the form of a tree with conventional controls as joints (buttons, drop-down lists, check-boxes and etc.).

This technology provides the clear and easy-to-understand picture of interrelations between various settings and makes it easy to study the program.

In this book, all the controls are illustrated by pictures. So that you could see how do they look like in the program windows.

  Contact us


Asking how to handle the infected object detected

The Ask user dialog box appears on your screen, if Kaspersky Anti-Virus Monitor (with the Ask user option selected in the Actions in case of virus detection branch) detected an infected object.

At the top of this dialog box you can see the infected object and the virus names. Under the names there is a list of actions that can be performed with infected object.

Report only — the program will only report the infected and suspicious objects. The check report can be viewed by starting the report viewer, Kaspersky Report Viewer.

Disinfect — the program will try to cure all infected objects without asking first. As a result, the detected viruses will be removed, and the object will be restored as an operable one.

Make backup file before disinfection –- to create a copy of the infected object before starting a cure. A directory where the copy will be created is specified in a settings’ tree of the Options category (see topic Renaming options). The copy will not be deleted upon completion of a treatment.

 If disinfection is impossible — not all infected objects can be cured, because some viruses damage the computer data irreversibly. In this case, Kaspersky AV Monitor can operate using one of the following three methods:  Report only— that is to inform about unsuccessful attempt of treatment, [image] Rename object — that is to rename the unrecoverable file, [image] Delete object — that is to delete the damaged file.

Rename object — the program will rename all infected objects. The renaming rules are specified in a settings’ tree of the Options category (see topic Renaming options).

Delete object— the program will delete all infected objects without warning.

The Delete object and the Rename object options are applied to infected archives, only if you checked the Enable delete or rename non-disinfected archives box on the Options page. Otherwise, if you select those options, the program will not delete or rename infected archives.

At the bottom of the dialog box the Apply to all infected objects check box is located. By checking it, you can apply the selected action to all infected objects that will be detected later, and that you previously predefined as to be handled by opening the dialogue box. Then upon detecting the next infected object, the dialog box will not appear again.

The following two buttons are also located at the bottom of the dialog box: OK (accepts the selected action), Cancel (closes the dialog box and proceeds with monitoring).

  Contact us


Infected object detected alert

The infected object alert appears on your screen when Kaspersky Anti-Virus Monitor detected an infected object. In this case the program blocks object and informs the user about it.

At the top of the message box you can see the infected object and the virus names.

If you check the Don't show this message later check box, next time when an infected object is detected the program will not display this message.

Press the ÎÊ button to proceed with your work.

In this case it is advisable that you check your computer for viruses using Kaspersky Anti-Virus Scanner.

  Contact us