Configuration. Sophos Netware

Configuration

Configuring immediate or scheduled scanning

Configuring InterCheck (central reporting)

Configuring real-time scanning

Purging checksums (for real-time scanning)

Restoring or saving configuration settings

Command line options

Sophos Anti-Virus NetWare user manual

7 Configuring immediate or scheduled scanning

Immediate mode scans the server now. Scheduled mode scans the server at set times you specify.

You configure immediate and scheduled scanning separately.

1. On the Main menu, select Immediate mode or Scheduled mode and press

Return.

2. In the next screen, select Configuration and press Return.

3. The configuration screen is displayed.

22

You can specify

! which types of files are scanned (Files)

! which volumes are scanned (Volumes)

! whether DOS and Mac files are scanned (File types)

! how files are scanned (Scanning options)

Sophos Anti-Virus NetWare user manual

! whether Sophos Anti-Virus is run once or as a background process

(Repeat mode)

! whether to disinfect infected documents (Document viruses)

! whether to disinfect infected programs (Program viruses)

! how to remove infected files (Removal mode)

! specify what is included in the report file (Report mode)

! where to create the report file

! which users to notify of viruses (Notify group)

! when to notify users of viruses (Notify timing).

For details of all the options, see the following sections.

23

Sophos Anti-Virus NetWare user manual

7.1 Files

This option specifies the files or file types that will be scanned.

24

All executables

By default, Sophos Anti-Virus checks all the file types listed in the

‘Executables’ list.

To view or modify the executables list, go to the Administration menu, select

Executables and then View/Modify.

All files

If this option is selected, Sophos Anti-Virus scans all files regardless of their extension.

Specify files

If this option is selected, Sophos Anti-Virus scans a set of files specified by you. A list of the files currently selected is displayed.

To remove files from the list, select them and press ‘Delete’.

To add files to the list, press ‘Insert’ and enter the filename(s).

When adding new files, an entry such as USERS\*.DOC instructs Sophos

Anti-Virus to scan all .DOC files in the given directory. To scan in the given directory, and all subdirectories below it, use the recursion operator at the start of the entry, e.g. >USERS\*.DOC. Conventional wildcard characters are supported.

Sophos Anti-Virus NetWare user manual

7.2 Volumes

This option specifies the volumes to be scanned.

By default a list of the local or shared volumes is displayed. Volumes that are not mounted are marked by a * after the volume name. Press ‘Delete’ to remove volumes and ‘Insert’ to add new volumes.

Only mounted volumes in the list are scanned.

7.3 File types

This option specifies scanning for DOS or Macintosh files on the server.

You can configure Sophos Anti-Virus to examine

! DOS files (including Windows files) for DOS viruses.

! Macintosh files for Macintosh and document viruses.

! Both DOS and Macintosh files. This is the default setting.

25

Sophos Anti-Virus NetWare user manual

7.4 Scanning options

This set of options specifies the level and priority of scanning.

26

The options are as follows.

7.4.1 Scanning level

Quick scanning checks only the parts of a file that are likely to contain a virus.

Quick scanning is sufficient for normal operation and is the default setting.

Full scanning examines every part of a file. The Full level is more secure, but is slower than Quick scanning.

7.4.2 Priority

Low priority minimises impact on network performance. Use it when the server is likely to be busy.

Normal priority maximises scanning speed. This is the default setting.

Sophos Anti-Virus NetWare user manual

7.4.3 InterCheck checksums

This option is useful only if you run real-time scanning (see section 9 ).

When an immediate or scheduled scan checks a file and finds it to be virus-free, it can add the file’s checksum to a list. This list is used by real-time scanning, which checks the checksum of a file against this list, and only scans it if the checksum is different (i.e. if the file has been modified).

Select Generate to create a checksum list. This is the default setting.

7.4.4 Compressed files

Sophos Anti-Virus can look for viruses inside files compressed with PKLite,

LZEXE and Diet. The default setting is Yes.

Sophos Anti-Virus can also be configured to scan inside archive files. For

more details, see the -ARCHIVE option in section 13

.

7.4.5 Migrated files

You can configure Sophos Anti-Virus to avoid checking files that have been migrated (i.e. moved to another server or to other media) with Cheyenne’s

Hierarchical Storage Management system.

If the Migrated files option is set to Yes, Sophos Anti-Virus checks a file to see whether it is migrated or not. If the file is migrated, checking causes it to be demigrated. This is the default setting.

If the option is set to No, Sophos Anti-Virus passes over migrated files, so that running a virus check does not cause demigration. Sophos Anti-Virus will not report viruses in these files.

27

Sophos Anti-Virus NetWare user manual

7.5 Repeat mode

This option specifies whether Sophos Anti-Virus is run once or continuously.

It is available for immediate scanning only.

Single run

Select this if you want Sophos Anti-Virus to run once.

Continuous

Select this if you want Sophos Anti-Virus to run an immediate scan continuously. If the server will sometimes be busy, you can run this scan at low priority (see

section 7.4.2

).

7.6 Times

This option specifies the times when a scheduled job is run. It is available for scheduled scanning only.

28

To add a time, press ‘Insert’ and type a time. To remove a time, select it and press ‘Delete’.

Sophos Anti-Virus NetWare user manual

7.7 Days

This option specifies the day(s) when a scheduled job is run.

To remove a day, select it and press ‘Delete’. To add a day, press ‘Insert’, select a day from the menu and press Return.

7.8 Document viruses

This option specifies disinfection of files containing document viruses.

By default, Sophos Anti-Virus does not disinfect files containing document viruses.

Select Disinfect if you want Sophos Anti-Virus to attempt to disinfect documents automatically. If disinfection fails, the chosen removal mode (see

section 7.10

) is applied.

Occasionally a document can be infected with more than one document virus. In that case, you must scan it (with disinfection enabled) more than once, until you have eliminated all the document viruses.

29

Sophos Anti-Virus NetWare user manual

7.9 Program viruses

This option specifies disinfection of files containing program viruses.

By default, Sophos Anti-Virus does not disinfect files containing program viruses.

Select Disinfect if you want Sophos Anti-Virus to attempt to disinfect programs automatically. If disinfection fails, the chosen removal mode (see section 7.10) is applied.

Occasionally a program can be infected with more than one program virus.

In that case, you must scan it (with disinfection enabled) more than once, until you have eliminated all the program viruses.

7.10 Removal mode

This option specifies the action that Sophos Anti-Virus takes when a virus is found.

30

No action

Sophos Anti-Virus takes no action. This is the default setting.

Sophos Anti-Virus NetWare user manual

Rename infected files

The last character of the file extension is changed to a digit.

For example INFECTED.COM will be renamed to INFECTED.CO0, or if

INFECTED.CO0 already exists, INFECTED.COM will be renamed to

INFECTED.CO1 and so on. If more than 10 files with such extensions exist, an error will be reported.

Note that renaming a COM or EXE file to CO0 or EX0 will prevent it from being directly executed by the user.

Move infected files

The infected files are moved to the isolation directory and renamed to have extension 000, 001 etc.

It is important to set the access rights to this directory so that only authorised users are allowed to examine its contents (see Novell documentation for details on using utilities to set directory rights). This ensures that it acts as a ‘quarantine area’ from which users cannot recover data or run infected files.

Delete infected files

This deletes infected files. Deleted files can be recovered easily under NetWare.

Purge infected files

This purges infected files. Once a file is purged it cannot be recovered.

31

Sophos Anti-Virus NetWare user manual

7.11 Report mode

This option specifies what is included in the report file.

Suppress filenames

Select this if you want only infected items and errors to be recorded. This is the default setting.

List filenames

Select this if you want Sophos Anti-Virus to record in the report file the name of every item examined.

This option typically produces large report files because the name of every file checked is entered. This option is useful for periodic audit purposes.

7.12 Report file

This option specifies a report filename.

By default, the report file for immediate scans is SWEEP.REP in the server

SWEEP directory, and the file for scheduled scans is given the name of the job, with a .REP extension.

To specify a different report filename, enter the required filename.

32

Sophos Anti-Virus NetWare user manual

7.13 Notify group

This option specifies groups of users who receive virus reports.

If you are using a version of NetWare that does not support eDirectory, contact Sophos technical support.

Selecting Notify group displays any currently selected groups.

To add a group, press ‘Insert’, which displays the eDirectory browser.

Browse the tree and select a group.

To remove a group, highlight its entry in the Active groups screen and press

‘Delete’.

Sophos Anti-Virus attempts to deliver a virus message via connections on the local server. If it cannot do so, it attempts to send the message (along with any stored messages) via the user’s connections on their default server.

If the message cannot be delivered via connections on either server, Sophos

Anti-Virus will store the message and deliver it when the user next acquires a licensed connection on the local server.

To make use of this service, a user should set their default server field using

NWADMIN/NETADMIN and ensure that they have a licensed connection on this server. They will then be notified of viruses found by Sophos Anti-Virus for NetWare running on any server in the eDirectory tree, provided that an appropriate Notify group has been selected on each of these servers.

33

Sophos Anti-Virus NetWare user manual

7.14 Notification timing

This option specifies when users are notified of a virus discovery.

End of SWEEP

Select this if you want users to be notified of a virus discovery at the end of the scan. This is the default setting.

1st infected file

Select this if you want users to be notified on discovery of the first infected file.

Every infected file

Select this if you want users to be notified on discovery of every infected file.

34

Sophos Anti-Virus NetWare user manual

8 Configuring InterCheck (central reporting)

InterCheck mode enables the NetWare server to receive virus reports from client workstations that are running InterCheck on-access scanning.

You can configure InterCheck central reporting as follows.

1. On the Main menu, select InterCheck and press Return.

2. The InterCheck configuration screen is displayed.

You can specify

! whether InterCheck central reporting is enabled (Status)

! which groups of users are notified of virus finds (Notify group).

Scanning options and Removal mode refer to on-access scanning over the network, which is no longer used in Sophos Anti-Virus.

8.1 Status

This option enables or disables central virus reporting.

By default, central reporting is Inactive. Select Active to start it.

35

Sophos Anti-Virus NetWare user manual

8.2 Notify group

This option specifies which groups of users are notified of virus finds.

To add a group, press ‘Insert’ to display the eDirectory browser, and select a group. To remove a group, select the group in the list and press ‘Delete’. See

section 7.13

for details.

36

Sophos Anti-Virus NetWare user manual

9 Configuring real-time scanning

Real-time mode scans files on the server when they are accessed.

You should use Real-time scanning only if you have client workstations that cannot run InterCheck on-access scanning.

You can configure real-time scanning as follows.

1. On the Main menu, select Real-time mode and press Return.

2. The Real-time configuration screen is displayed.

You can specify

! whether Real-time scanning is enabled (Status)

! how each volume is scanned (Volumes)

! which client workstations activate real-time scanning when they access files on the server (Workstations)

! which processes on the server activate real-time scanning (Server processes)

! how files are scanned (Scanning options)

! whether to disinfect infected documents (Document viruses)

! whether to disinfect infected programs (Program viruses)

! how to remove infected files (Removal mode)

! which users to notify of viruses (Notify group).

37

Sophos Anti-Virus NetWare user manual

For details of all the options, see the following sections.

9.1 Status

This option enables or disables real-time scanning.

By default, real-time scanning is Inactive. Select Active to start real-time scanning.

You can exclude particular volumes from real-time scanning. See the

Volumes option below.

9.2 Volumes

This option specifies how real-time scanning is applied to each volume.

38

Read only

If this is selected, every time a file on the volume is read from, that file is scanned. This is the default setting.

Sophos Anti-Virus NetWare user manual

Write only

If this is selected, every time a file on the volume is written to, that file is scanned.

Read and write

If this is selected, every time a file on the volume is read from or written to, that file is scanned.

None

If this is selected, real-time scanning is not used for that volume.

Other volumes

This refers to volumes that don't usually appear in the list (e.g. virtual volumes created by backup software).

Only mounted volumes in the list are scanned.

You can delete from the list volumes that are not currently mounted and that are not represented by a Volume object in the eDirectory tree. To do this, select the volume and press ‘Delete’.

9.3 Workstations

This option enables you to specify which client workstations will activate real-time scanning when they access files on the server.

All

Select this if you want all workstations to activate real-time scanning. This is the default setting.

39

Sophos Anti-Virus NetWare user manual

Specify

Select this to restrict real-time scanning to any workstations, e.g. DOS clients, which are not protected by InterCheck on-access scanning.

9.4 Server processes

This option specifies whether processes running on the server activate real-time scanning or not.

Monitor file access

This activates real-time scanning for all file accesses, whether originating from other processes on the server itself (e.g. by another NLM), or from file operations from outside the server. This is the default setting.

Do not monitor file access

This activates real-time scanning only for file accesses originating from outside the server. This might be useful if, for example, a backup NLM is run on the server.

9.5 Scanning options

This set of options specifies the level and priority of scanning.

40

Sophos Anti-Virus NetWare user manual

The options are as follows.

9.5.1 Scanning level

Quick scanning checks only the parts of a file that are likely to contain a virus. Quick scanning is sufficient for normal operation and is the default setting.

Full scanning examines every part of a file. The Full level is more secure, but is slower than Quick scanning.

9.5.2 InterCheck checksums

When Sophos Anti-Virus scans a file on the server and finds it to be virus-free, it can add its checksum to a central list. This list is used by real-time scanning, which checks the checksum of a file against this list, and only scans that file if its checksum is found to differ from the checksum on the list.

Select Generate to create a checksum list. This is the default setting.

9.5.3 Compressed files

Sophos Anti-Virus is capable of looking for viruses inside files compressed with PKLite, LZEXE and Diet.

Sophos Anti-Virus can also be configured to scan inside archive files. For

more details, see the -ARCHIVEOA option in section 13 .

41

Sophos Anti-Virus NetWare user manual

9.6 Document viruses

This option specifies disinfection of files containing document viruses.

By default, Sophos Anti-Virus does not disinfect files containing document viruses.

Select Disinfect if you want Sophos Anti-Virus to attempt to disinfect documents automatically. If disinfection fails, the chosen removal mode

(see section 9.8

) is applied.

9.7 Program viruses

This option specifies disinfection of files containing program viruses.

42

By default, Sophos Anti-Virus does not disinfect files containing program viruses.

Select Disinfect if you want Sophos Anti-Virus to attempt to disinfect programs automatically. If disinfection fails, the chosen removal mode (see

section 9.8

) is applied.

Sophos Anti-Virus NetWare user manual

9.8 Removal mode

This option specifies how Sophos Anti-Virus deals with infected files.

No action

Sophos Anti-Virus takes no action. This is the default setting.

Move infected files

The infected files are moved to the isolation directory and renamed to have extension 000, 001 etc.

It is important to set the access rights to this directory so that only authorised users are allowed to examine its contents (see Novell documentation for details on using utilities to set directory rights). This ensures that it acts as a ‘quarantine area’ from which users cannot recover data or run infected files.

Purge infected files

This purges infected files. Once a file is purged it cannot be recovered.

43

Sophos Anti-Virus NetWare user manual

9.9 Notify group

This option specifies which groups of users are notified of virus finds.

To add a group, press ‘Insert’ to display the eDirectory browser, and select a group. To remove a group, select the group in the list and press ‘Delete’.

See section 7.13

for details.

44

Sophos Anti-Virus NetWare user manual

10 Purging checksums (for real-time scanning)

Central checksums are used only by real-time scanning.

When Sophos Anti-Virus scans a file and finds it to be virus-free, it can add its checksum to a list (see

section 9.5.2

). Real-time scanning checks the

checksum of a file against this list, and only scans the file if the checksum differs.

The list needs to be purged every time Sophos Anti-Virus is updated so that it always lists items authorised with the most recent version.

By default, the checksum list is purged when Sophos Anti-Virus is loaded, even if Sophos Anti-Virus has not been updated.

1. On the Main menu, select Central checksums and press Return.

2. The Central checksums screen is displayed.

Purge checksums

This purges the checksum file immediately. You are prompted for confirmation.

Automatic purging

If you select this, Sophos Anti-Virus purges the checksum file automatically.

You are prompted to specify when purging occurs.

Purge on virus detection enables the file to be purged every time a virus is detected. The default setting is No.

45

Sophos Anti-Virus NetWare user manual

11 Setting administration options

This section describes how to set administration options and how to view the virus library and the log file.

1. On the Main menu, click Administration and press Return.

2. The Administration menu is displayed.

You can

! reset on-screen counters, e.g. for files scanned, viruses etc (Zero counters)

! view the virus library (Virus library)

! view the currently loaded virus identity files (Virus identity files)

! specify the file types to be treated as executables (Executables)

! exclude files from scanning (Exclusions)

! administer the log file (Log file)

! specify auto-updating (Auto-updating).

11.1 Zero counters

This option zeroes the on-screen counters (such as the number of files checked and viruses detected).

46

Sophos Anti-Virus NetWare user manual

11.2 Virus library

This option displays a list of the viruses that Sophos Anti-Virus can detect.

After you have added new virus identities to the server, you can open the virus library view to check that the number of viruses detected has increased. This confirms that Sophos Anti-Virus is using the new identities.

11.3 Virus identity files

This option displays a list of the virus identity files that are currently loaded.

47

Sophos Anti-Virus NetWare user manual

11.4 Executables

This option enables you to modify the list of file types that Sophos

Anti-Virus treats as executable files.

View/modify

This displays a list of file extensions to be treated as executables. Press

‘Insert’ to insert a new entry and ‘Delete’ to delete a highlighted entry.

This list is used for immediate and scheduled scanning if the Files

configuration option is set to All Executables (see section 7.1

) .

The list is also used by real-time scanning.

Set default

This option replaces the existing list of file extensions, as shown by the

View/modify option, with the default list.

If you use the default list, it is automatically updated with new extensions when Sophos Anti-Virus is updated, if necessary. If you do not use the default list, you must apply any such updates to the list manually, by inserting or deleting entries.

11.5 Exclusions

This option specifies files and subdirectories to be excluded from virus-checking.

48

Press ‘Insert’ to insert a new entry and ‘Delete’ to delete an entry from the list.

Files may be specified by the full path (volume, directory and full filename), relative path or filename only. If filename only is used, files of that name will be excluded regardless of the directory they appear in. The wildcards ? and * can be used. For example

???.pdf

excludes all files with a three-character name and a .pdf extension.

Sophos Anti-Virus NetWare user manual

SYS:/MIKE/NEW excludes a file with this path or all files in this directory.

MIKE/NEW excludes all files whose path ends with MIKE/NEW .

SYS:/MIKE/B??A

excludes all files that match B??A in the SYS:/MIKE directory.

SYS:/MIKE/B??A/*.* excludes all files in all directories that match SYS:/MIKE/B??A.

When you use the recursion operator >, the last part of the path is always considered to be a filename, not a directory. For example

>SYS:/MIKE/INFO excludes all files that match INFO in the SYS:/MIKE directory and all its subdirectories.

Exclusions apply to all forms of scanning (immediate, scheduled and real-time).

49

Sophos Anti-Virus NetWare user manual

11.6 Log file

This option enables you to view and administer the log file.

View

This displays the log file. The latest entries are at the end of the file.

To go directly to the end of the log file, press Ctrl+PgDn (or, on versions of

RCONSOLE that do not support this key combination, press Ctrl+x).

50

Clear

This purges the log file.

Maximum size

This option specifies the maximum size of the log file. Enter a figure (in

KB). When the log file exceeds this size, the oldest entries in the file are discarded.

Sophos Anti-Virus NetWare user manual

11.7 Auto-updating

This option enables you to configure Sophos Anti-Virus to check for an updated version of the Sophos Anti-Virus for NetWare files on the server, and to perform an update automatically.

Status

By default, auto-updating is Active. To disable automatic updating, select

Inactive.

Directory

This configures the path in which Sophos Anti-Virus will check for an update of the Sophos Anti-Virus for NetWare files. By default, this is set to

SYS:SWEEP\NLMINST, but any path on any volume can be specified.

The auto-updating directory must be a directory other than the one from which Sophos Anti-Virus was loaded (typically SYS:SWEEP).

The auto-updating directory can only be set to a directory on the local server.

Timing

This option determines when Sophos Anti-Virus will check for the presence of an update.

If set to ‘On arrival’, Sophos Anti-Virus will check for an update every five minutes and initiate the updating process as soon as an update is detected.

If set to ‘Specified’, Sophos Anti-Virus will check for an update and initiate updating only at the specified time.

Sophos recommends that you select Specified and specify a time when

Sophos Anti-Virus will not be performing an immediate or scheduled job. If a scanning job is in progress when updating is initiated, the job will be terminated early.

51

Sophos Anti-Virus NetWare user manual

12 Restoring or saving configuration settings

The Configuration file option enables you to restore previous configuration settings for Sophos Anti-Virus, or save changes you have made in the settings, at any time.

1. On the Main menu, select Configuration file and press Return.

2. The Configuration file screen is displayed.

Read configuration

Select this option if you want Sophos Anti-Virus to read and use the settings already in the configuration file.

Sophos Anti-Virus does this by default whenever it is loaded.

When you update Sophos Anti-Virus for NetWare, you can restore the previous configuration settings by using this option.

Save configuration

Select this option to save any changes you have made to the configuration settings.

If you make changes to the configuration, you are prompted to save them when you unload Sophos Anti-Virus.

52

Sophos Anti-Virus NetWare user manual

13 Command line options

The command line options listed in this section enable you to configure scanning and alerts. They are case-insensitive.

-ARCHIVE Scan archive files (immediate and scheduled scans only)

If Sophos Anti-Virus is loaded with this option, it scans inside archive files when it performs immediate or scheduled scans. The archive types that can be scanned are listed in the release notes.

Alternatively, you can specify scanning of particular types of archive, e.g. to scan TAR archives, enter

LOAD SWEEP -TAR

Precede the option with an N to exclude an archive type from checking, e.g.

LOAD SWEEP -ARCHIVE -NTAR would scan all archive types except TAR.

Note that when -ARCHIVE is used in combination with individual options, later options override earlier ones.

-ARCHIVEOA Scan archive files (real-time scans only)

If Sophos Anti-Virus is loaded with this option, it scans inside archive files when it performs real-time scans. The archive types that can be scanned are listed in the release notes.

You can’t specify scanning of particular types of archive for real-time scans.

-BW Black and white display

If using a black and white or monochrome display, you can achieve better contrast if Sophos Anti-Virus is started with this option.

-I Start immediate scan

If Sophos Anti-Virus is loaded with this option, it starts an immediate scan.

Sophos Anti-Virus can load and start from the AUTOEXEC.NCF file, if the administrator wants it to do so.

-IDEDIR Use alternative directory for virus identity files (IDEs)

This option enables you to specify an alternative directory for individual

IDEs. For example

53

Sophos Anti-Virus NetWare user manual

LOAD SWEEP -IDEDIR=SYS:/SAVIDES directs Sophos Anti-Virus to read IDEs from the SAVIDES directory instead of the default directory (SYS:/SWEEP or the directory specified with -WD).

-PRESERVELAD Don’t restore “last accessed” date of files scanned

If you load Sophos Anti-Virus with the option -PRESERVELAD=NO,

Sophos Anti-Virus doesn't restore the “last accessed” date of files after it has scanned them. This is to avoid problems with certain backup software that would otherwise back up every file that has been scanned, regardless of whether it had changed.

-SSNA Scan files that Sophos Anti-Virus incorrectly identifies as “zip bombs”

By default, Sophos Anti-Virus stops scanning “zip bombs” when detected.

“Zip bombs” are malicious files that are designed to disrupt the action of anti-virus scanners. These files usually take the form of innocent looking archive files that, when unpacked in order to be scanned, require enormous amounts of time, disk space, or memory.

When a “zip bomb” is detected, Sophos Anti-Virus displays a message such as

Aborted scanning C:\TEMP\BOMB.ZIP - appears to be a 'zip bomb'.

Occasionally, Sophos Anti-Virus incorrectly identifies files that have complex and/or multiple levels of archiving as “zip bombs”, and stops scanning them. To scan such files, reload Sophos Anti-Virus using the option -SSNA, for example

LOAD SWEEP -SSNA and then rescan them.

Use this option only if absolutely necessary. If a genuine “zip bomb” is accessed with this option, Sophos Anti-Virus continues to scan it.

-WD Use non-standard directory

By default, Sophos Anti-Virus creates and uses the directory SYS:SWEEP for all file-based operations. By using

LOAD SWEEP -WD=<directory> it can be made to use the directory <directory>.

If this option is used, InterCheck on any client workstations that report to the NetWare server must be set up to use the same directory.

54