Creating Anti-Virus Configuration

Complete the following steps create a new Anti-Virus configuration:

1.	Launch the Enterprise Console.

2.	In the Network and Groups Pane, go to Available Configurations > AntiVirus.

3.	Right-click and select Create new configuration.

4.	Specify settings in the Workstation Settings node:

•	User Actions pane

>	Show taskbar icon – Select the checkbox to display Faronics Anti-Virus icon on the taskbar at the workstation(s). If this checkbox is not selected, Faronics Anti-Virus will be hidden to the user.

~	Allow manual scanning – Select the checkbox to allow users to manually initiate Faronics Anti-Virus scanning at the workstation(s).

~	Allow user to take action on scan results – Select the checkbox to allow the workstation user to take action on the scan results.

~	Allow user to abort a scan initiated locally – Select the checkbox to allow users to abort the scan initiated locally at the workstation.

•	Log Actions pane

>	Logging Level – Select the logging level. Select None for no logging. Select Error to log the error message. Select Trace for trace. Select Verbose for detailed logging.

>

Number of logging files – Specify the number of logging files. The logging information is stored in the files serially. For example, if there are 3 files A, B and C, Faronics Anti-Virus first writes the error logs to file A. Once file A is full, it starts writing to file B and finally file C. Once file C is full, the data in file A is erased and new logging data is written to it.

>	File size – Select the size of each file in MB.

•	Windows Security Center pane

>	Integrate into Windows Security Center – Select the checkbox to integrate Faronics Anti-Virus into the Windows Security Center. Windows Security Center will notify you via the System Tray if Faronics Anti-Virus is active or inactive.

•	Updates pane

>

Connect to Updates Web Server if there is no communication with Faronics Core Server in the last x hours – Select the checkbox to connect to the Updates Web Server and download Virus Definitions if the workstation loses contact with Faronics Core Server. If you do not select this checkbox, the Virus Definitions will not be updated if the workstation loses the connection with the Faronics Core Server.

•	Proxy pane

>	Enable Proxy – Select the checkbox if the workstation(s) require a proxy to reach Faronics Core Server or Updates Web Server.

>	Proxy Server Information – Specify the Address and Port.

>	User Authentication

My proxy server requires authorization (logon credentials) – If the server requires authentication, specify values for the following fields:

~	Authentication Type – Select the authentication type.

~	Username – Specify the username.

~	Password – Specify the password.

~	Domain – Specify the domain.

5.	Specify settings in the Scanning Settings node:

•	Scanning Types pane

Faronics Anti-Virus provides three types of scans:

>	Quick Scan – Scans the commonly affected areas of your computer. This is shorter in duration than the Deep System Scan. Quick Scan also uses less memory than the Deep System Scan.

>	Deep System Scan – Performs a through scan of all areas of the computer. The time taken for the scan depends on the size of your hard drive.

>	Custom Scan – Performs a scan based on the selections made in the Policy Details dialog.

For each type of scan, select the following options (some options may be grayed out depending on the type of scan):

>	Enable rootkit detection – Detects if the computer is infected with a rootkit.

>

Scan inside of archives – Scans the contents of a zip file. Select for the scan to include archive files, such as .RAR and .ZIP files. When a .RAR file is found to contain an infected file, the .RAR file will be quarantined. If a .ZIP file is found to contain an infected file, the infected file is quarantined and replaced by a .TXT file with text indicating that it was infected and that it has been quarantined. Specify the File Size Limit.

>	Exclude removable drives (e.g USB) – Excludes the removable drives from the scan process. Any external hard disks, USB drives etc will not be scanned.

>	Scan the registry – Scans the registry.

>	Scan running process – Scans all running processes.

•	USB Devices pane

Select the checkbox to scan USB drives upon insertion and select one of the following options:

>	Do not perform USB scan if another scan is already in progress – Select this option to ensure that an active scan is not interrupted when a USB drive is inserted. The USB drive must be manually scanned once the active scan is complete.

>	Interrupt active scan for USB scan – Select this option to interrupt an active scan to scan the USB drive when it is inserted. Once the active scan is interrupted, it will not resume automatically and must be restarted manually.

>

Suppress USB scan in progress dialogue – Select this option to hide indications that Anti-Virus is scanning USB drives when they are inserted; no Anti-Virus interface will open, and the system tray icon will not display tooltips indicating a scan in progress. Users will be notified at the end of a scan if a virus was found, but if no viruses were detected there will be no notification that the scan occurred.

Note that if the Scan USB drives upon insertion option is not selected, this option is ignored.

If the Allow Manual Scanning checkbox is selected in the Workstation Settings tab > User Actions pane, the USB device is scanned automatically. If the Allow Manual Scanning checkbox is not selected, the USB device is not scanned automatically.

•	Schedule pane

Quick Scan:

>	Enable Quick Scan – Select the checkbox to enable Quick Scan.

>	Start – Specify the start time.

>

Stop – Specify the end time. The maximum duration between the Start time and Stop time is 23.59 hours. The scan ends if all the files are scanned before the Stop time. If the scan is not complete before the Stop time, it is aborted at the Stop time. Alternatively, select When scan is complete to ensure that scan is completed.

>	Days – Select the days when the scheduled Quick Scan will take place.

Deep Scan:

>	Enable Deep scan – Select the checkbox to enable Deep Scan.

>	Start – Specify the start time.

>

Stop – Specify the end time. The maximum duration between the Start time and Stop time is 23.59 hours. The scan ends if all the files are scanned before the Stop time. If the scan is not complete before the Stop time, it is aborted at the Stop time. Alternatively, select When scan is complete to ensure that scan is completed.

>	Days – Select the days when the scheduled Deep Scan will take place.

Options:

>

Randomize scheduled scan start times by x minutes – Specify the number of minutes. The scheduled scan start time is randomized to reduce the impact on network traffic. Faronics Anti-Virus reports to Faronics Core when the scanning starts. This might impact the network traffic if the scan for multiple systems start at the same time.

Missed scan options at start-up – Select one of the following options on how a scan will be performed if the workstation was not ON during a scheduled scan:

>	Do not perform quick scan – Select this option if you do not want to perform quick scan on startup.

>	Perform quick scan approximately x minutes after start-up – Specify the number of minutes after start-up when Faronics Anti-Virus must perform a quick scan.

>	Prompt user to perform Quick Scan – Select this option to prompt the user to perform a quick scan.

•	Scan Exceptions pane

Folders or files that are known to the safe and free of infections can be added to the Scan Exceptions tab. Files added to the Scan Exceptions tab will always be scanned by Faronics Anti-Virus. However, Faronics Anti-Virus will never report the files as malicious or infected. This feature is useful since files and folders that are known to be safe by the Administrator will not be reported as malicious.

A.	Click Add.

B.	In the Add dialog, select File by full path or Entire folder. Click Browse to select the file or folder and click OK.

C.	The File by full path is added to the Scan Exceptions pane.

•	Cleanup Action pane

>	Clean/Quarantine – When a threat is detected, attempt to disinfect the file and quarantine if unsuccessful. If the file could not be disinfected, it will be quarantined and will not be deleted.

>	Clean/Delete – When a threat is detected, attempt to disinfect the file and delete if unsuccessful. If the file could not be disinfected, it will be deleted from the computer.

>	Delete items from quarantine that are older than – Specify the number of days to retain items in quarantine. The default is 3 days.

6.	Specify settings in the Active Protection pane:

•	Enable Active Protection – Select this option to enable real-time protection. Active Protection is the real-time scanning by Faronics Anti-Virus in the background without any impact on system performance. If there is a risk of real-time virus infection from the Internet, select this option.

>	Allow users to switch off Active Protection – Select this option to allow users to switch off Active Protection. If users install or use software that might be mistaken from a virus (for example, running advanced Macros in Microsoft Office or complex batch files), select this option.

>	Show Active Protection alert – Select this option to display an alert if a threat is detected during Active Protection. Do not select this checkbox if you do not want an alert to be displayed.

7.	Specify settings in the Firewall Protection node:

The Firewall Protection node provides bi-directional protection, protecting you from both incoming and outgoing traffic. You can create customized rules to protect your network. You can either Allow or Block the communication.

•	Settings pane

Firewall Protection Settings

>	Enable Firewall Protection – Select the checkbox to enable Firewall Protection. Firewall Protection prevents hackers or malicious software from gaining access to your computer through the Internet or the network.

~	Allow users to disable firewall – Select this option to allow users to disable the firewall at the computer.

Firewall Logging

>	Enable Firewall Logging – Select this option to log all actions related to the Firewall.

•	Program Rules pane

Program Rules define the action taken by the firewall on the network activity to and from an application. Program Rules have priority over the default rules. Default rules can be edited but cannot be deleted.

Click Add to add a new Program Rule. Specify or select the options and click OK. The following parameters are displayed:

>	Name – Name of the rule.

>	Program – Name of the program, including full path and extension.

>	Trusted Zone Inbound – The action to be taken for inbound communication to the program in a Trusted Zone (Allow or Block).

>	Trusted Zone Outbound – The action to be taken for outbound communication from the program in a Trusted Zone (Allow or Block).

>	Untrusted Zone Inbound – The action to be taken for inbound communication to the program in an Untrusted Zone (Allow or Block).

>	Untrusted Zone Outbound – The action to be taken for inbound communication from the program in an Untrusted Zone (Allow or Block).

•	Network Rule pane

Network Rules define the action taken by the firewall on the network activity. Network Rules can be edited but cannot be deleted.

 

Select the Network Rules for the following:

 

Name	Description	Trusted Zone Inbound	Trusted Zone Outbound	Untrusted Zone Inbound	Untrusted Zone Inbound
IGMP	Internet Group Management Protocol	Select Allow or Block	Select Allow or Block	Select Allow or Block	Select Allow or Block
Ping	Ping and Tracert	Select Allow or Block	Select Allow or Block	Select Allow or Block	Select Allow or Block
OtherIcmp	Other ICMP packets	Select Allow or Block	Select Allow or Block	Select Allow or Block	Select Allow or Block
DHCP	Dynamic Host Configuration Protocol	Select Allow or Block	Select Allow or Block	Select Allow or Block	Select Allow or Block
DNS	Domain Name System	Select Allow or Block	Select Allow or Block	Select Allow or Block	Select Allow or Block
VPN	Virtual Private Network	Select Allow or Block	Select Allow or Block	Select Allow or Block	Select Allow or Block
BCAST	Broadcast	Select Allow or Block	Select Allow or Block	Select Allow or Block	Select Allow or Block
LDAP	Lightweight Directory Access Protocol	Select Allow or Block	Select Allow or Block	Select Allow or Block	Select Allow or Block
Kerberos	Kerberos Protocols	Select Allow or Block	Select Allow or Block	Select Allow or Block	Select Allow or Block
NETBIOS	Microsoft File and Printer Sharing	Select Allow or Block	Select Allow or Block	Select Allow or Block	Select Allow or Block

•	Advanced Rules pane

Advanced Rules define the action taken by the firewall for the specified application, port or protocol. This may include a single or a combination of protocol, local or remote ports, and direction of traffic. You can add, edit or delete an advanced rule.

Click Add to add a new Advanced Rule. Specify or select the options and click OK. The following parameters are displayed in the Advanced Rules pane:

>	Name – Name of the rule.

>	Program – Name of the program and path.

>	Action – The action taken by the Firewall for communication from the specified application, port or protocol (Allow or Block).

>	Direction – The direction of communication (Both, In or Out).

>	Protocol – The name of the protocol.

>	Local Port – Details of the local port.

>	Remote Port – Details of the remote port.

•	Trusted Zones pane

Trusted Zones specify computers, networks and IP addresses that are trusted. Trusted Zones and Internet (Non-Trusted) Zones can be treated differently by Program and Network Rules.

Click Add to add a new Trusted Zone. Specify or select the options and click OK. The following parameters are displayed:

>	Name – Name of the Trusted Zone.

>	Description – Description of the Trusted Zone.

>	Type – Type of the Trusted Zone (IP Address or Network).

8.	Click OK. The new policy, New Policy 1 is displayed below the Anti-Virus node.