AntiVir VSA Installation (Windows)
Downloading the Installation Files from the Internet You can find the current program files for AntiVir VSA on our website. They are packed: in ZIP format (you need a program to unpack it, for example WinZip) or in EXE format as a self-extracting archive (no unpacking program needed). Download the current version file from our website http://www.avira.com to your local computer. The file name is antivir_vsa_en.exe. Getting the Installation Files from CD-ROM On the AntiVir CD-ROM open /en/products/vsa/windows Save the file to the computer on which you want to run AntiVir VSA. The file is currently named antivir_vsa_en.exe.
You must have an AntiVir license in order to use AntiVir VSA (see Licensing Concept Page 8). This license file contains information regarding the scope and period of the license. Purchasing the License You may contact us by telephone or by email (sales@avira.com) to acquire a license file for AntiVir VSA. You will receive the license file by email.
Please check the following requirements in order for the software to perform efficiently: Make sure the System Requirements are met. Log in as administrator or as user with administrator rights. Make sure the Internet connection is available and it allows automatic Updates with the Internet Updater. Be sure to have the hbedv.key license file at hand. Open the folder containing the downloaded program file antivir_vsa_en.exe. Double-click the file antivir_vsa_en.exe. The setup starts in a dialog window. Click Setup. AntiVir VSA setup starts. The welcome window of the Install Shield Wizard appears:

Requirements

Click Next.
You can read the License agreement:
You must agree to these conditions in order to continue the installation.
Confirm with Yes. The window for selecting the Destination folder appears:
Confirm with Next if the path is correct OR Click Browse and select the path, then click Next.
The License file window follows:
Select the folder containing the hbedv.key license file and click Next. Then you will see Install Shield Wizard completed. Click Finish. The setup program imports and installs the necessary files in the target folder. AntiVir VSA installation is completed. You do not need to restart your computer.
During installation, the following actions have been performed in the background: Copying of the Virus Scan Adapter (VSA) file ANTIVIRVSA.DLL to the installation folder. Setting of the environment variable VSA_LIB in the absolute path for VSA; for example: VSA_LIB=C:\Program Files\Avira GmbH\AntiVir Savapi\ANTIVIRVSA.DLL Searching for the tool to unpack SAP archives (SAPCAR format); searching for the environment variable PATH of SAPCAR.EXE file. Adding a parameter in SAVAPI.INI which activates SAPCAR archive scanning; for example: SapCarProgram= (empty -> SAPCAR.EXE not found) - OR SapCarProgram=C:\SAPCAR\SAPCAR.EXE (program found)

Configuration (UNIX)

You can adjust AntiVir VSA for optimum performance. You can make the most important adjustments immediately after installation. The most common settings are suggested. You can modify these settings at any time to adapt the product to your requirements. After a short overview, you will be guided step by step through the configuration process: Information on the configuration files: - Parameters in the Configuration File avsapvsa.conf Page 20 and - Parameters in the Configuration File avupdater.conf Page 21. If you wish to use the configuration script, you can skip this Section. The procedure for using the configuration script: Configuration Script configantivir Page 23. Specific configuration for AntiVir VSA: - Configuring Regular Updates Page 24.

Overview

The configuration file avupdater.conf defines automatic software updates; the file avsapvsa.conf defines the scanning parameters and logging rules when viruses or unwanted programs are detected. You can make these settings directly in the configuration files. This is not very difficult. A more convenient way is to use the configuration script included in the program. It intercepts possible errors and restarts the necessary processes.

Configuration files

Configuration script
You can use the script configantivir, located in /usr/lib/AntiVir, to edit the settings in avupdater.conf (Updater settings).

Configuration Files

This section describes the structure of AntiVir VSA configuration files avsapvsa.conf and avupdater.conf. AntiVir reads these files on program start-up. It ignores empty lines and commented lines beginning with #. The program is provided with default values which are important for many procedures. Some options can be deactivated with a # at the beginning of the line (commented). These can be activated by removing the # character or by changing the values. You must restart the Internet Update Daemon if you modify any values manually in avupdater.conf, without using the configuration script. The changes will only take effect after a restart. Type: /usr/lib/AntiVir/avupdater restart
Parameters in the Configuration File avsapvsa.conf This section provides a short description of the settings in avsapvsa.conf. These settings affect the scanners behavior. You can edit most of these parameters using the SAP GUI. SAP NetWeaver applies them to the scanner, via the VSA. When inserting such a parameter in the file avsapvsa.conf, the scanner starts with the specified value, but the values in SAP GUI will immediately override it. This means that the settings made in SAP GUI for the AV scanner have a higher priority than those made in the configuration file avsapvsa.conf.

ArchiveScan

Scanning archives: When this option is active (value 1), all archived files are extracted and scanned. The zero value deactivates this option (not recommended). ArchiveScan 1

ArchiveMax Size

Maximum unpacked size of archived files: If the setting is 0, all archived files are unpacked, whatever their size. If the set value is >0, all archives that do not exceed the given value (in bytes) are unpacked and scanned. ArchiveMaxSize 1GB

ArchiveMax Recursion

Maximum archive recursion: If the setting is 0, recursive (nested) archives are unpacked, whatever their recursion depth. If the set value is >0, all archives that do not exceed the given recursion depth are unpacked. This saves processing time. ArchiveMaxRecursion 20

ArchiveMax Ratio

Blocking "mail bombs": Blocks so-called "mail bombs" with a very high compression ratio. You can set the maximum difference between packed and unpacked file size. The zero value deactivates this option (not recommended). The default is 150. ArchiveMaxRatio 150

LogFile

Logfile: AntiVir logs all important operations via the syslog daemon. It can also create an additional logfile. There is no default setting. You must enter the full path to the logfile in order to use this option: LogFile /var/log/avsapvsa.log Email messages: AntiVir can send emails, when detecting viruses or unwanted programs. There is no default setting. You must specify a recipient in order to send emails: EmailTo root@localhost Syslog settings: AntiVir sends messages for all important operations to the syslog daemon. You may specify the facility and priority for these messages. The default setting is: SyslogFacility user SyslogPriority notice

EmailTo

Syslog.

Detect.

Detection of other types of unwanted programs: Besides viruses, there are some other types of harmful or unwanted software, described in avsapvsa.conf. You can activate their detection using the following options: DetectADSPY yes DetectAPPL yes DetectBDC yes DetectDIAL yes DetectGAME no DetectHEUR-DBLEXT yes DetectJOKE no DetectPCK no DetectPHISH yes DetectSPR no

Heuristics Macro

Macrovirus Heuristics: Activates the heuristics for macroviruses in office documents. HeuristicsMacro yes

Heuristics Level

/usr/lib/AntiVir/configantivir Confirm every setting with Enter, until you reach the question about update frequency: AutoUpdateEvery2Hours/AutoUpdateDaily (3 of 4) ===================================== AntiVir is equipped with an Internet Update Daemon. At specified intervals, AntiVir will connect to an update server to check for newer versions of the AntiVir engine or the data files. If a newer version is available, AntiVir will automatically download and install the updates without requiring any special attention. This allows AntiVir to be kept current against attacks and problems. AntiVir can be configured to check for updates every 2 hours (2) or once a day (d). You can also choose to disable the Internet Update Daemon (n). Note: Updates can also be done manually from the command line: antivir --update You may prefer to disable the Internet Update Daemon and instead perform regular updates using a cron(8) job. Using the startup script for the Internet Update Daemon when it is disabled will result in an error. available options: 2 d n How often should AntiVir check for updates? [2] Type: - n, if you do not want to perform automatic updates - 2 for updates every two hours - d for daily updates If you select daily updates, you have to set the time: AutoUpdateTime (3-2 of 4) ============== The AntiVir Updater can be set to always check for updates at a particular time of day. This is specified in a HH:MM format (where HH is the hour and MM is the minutes). If you do not have a permanent connection, you may set it to a time when you are usually online. You may also let AntiVir choose a random time (r). If you have a permanent connection then a random time may be preferred because it will help to disperse the times when other users are getting updates. available options: HH:MM r What time should updates be done? [RANDOM] Type the time in HH:MM format OR type R for a random time. Confirm all other configuration questions with Enter.
The automatic updates via the Internet Update Daemon are now configured. The Daemon will automatically start (if not running already) or it restarts (if already running). Starting and Stopping Internet Updater Manually If you want to start Internet Update Daemon manually: Type: /usr/lib/AntiVir/avupdater start If you want to stop Internet Update Daemon manually: Type: /usr/lib/AntiVir/avupdater stop If you want to check the current status of the Internet Update Daemon: Type: /usr/lib/AntiVir/avupdater status Performing Cron Updates

Performing updates with cron is recommended!
If you are an experienced UNIX user, you can use cron daemon to perform automatic AntiVir updates. Cron daemon is used to run regular system processes. For more details, refer to your UNIX documentation. Using cron for updates, you have more configuration possibilities than with the Internet Updater.

Example:

Enter the following cron job in /etc/crontab: 45 */2 * * * root /usr/lib/AntiVir/antivir --update -q This command activates updates every 2 hours, but performs them 15 minutes ahead of the set time: 0:45, 2:45, 4:45 and so on. The -q parameter states that no report will be given.
Starting Internet Updater Automatically If you do not want to use cron, you can work with the Internet Update Daemon. If you have performed the installation as described in Installing AntiVir VSA Page 12, your system is correctly configured. If the Internet Update Daemon has not yet been automatically activated on system startup: Reinstall AntiVir with the necessary settings (see Reinstalling AntiVir VSA Page 14).
Verifying Updates Authenticity with GnuPG GnuPG is a free alternative to the encryption program PGP (Pretty Good Privacy). Using GnuPG you can verify the authenticity of the AntiVir Updates. It is highly recommended to use GnuPG. However, this procedure requires extensive knowledge of UNIX and GnuPG. In the event of configuration errors, there is the danger of deactivating AntiVir updates. The user running updates on the computer has to perform these steps. Usually it has to be a user with administrator rights. You can find more details of GnuPG at http://www.gnupg.org Follow these steps to activate GnuPG support: Download GnuPG from the website http://www.gnupg.org. Here you can also find the manual with further information on GnuPG and its features. Generate your own PGP key pair, as described in the documentation. Import the AntiVir public PGP key to your key-ring: gpg --import antivir.gpg OR Import the AntiVir public key directly from the key server: gpg --keyserver=wwwkeys.pgp.net --recv-keys 0F821C2E Display the fingerprint of the key to check if it really is the AntiVir PGP key: gpg --fingerprint build@avira.com The 40-character fingerprint is displayed. Check whether the fingerprint corresponds with the one on the AntiVir website (http://www.avira.com). Sign the AntiVir public key in order to certify its validity: gpg --sign-key build@vira.com Change to the /bin sub-directory of the AntiVir installation directory (example): cd /tmp/antivir-vsa-prof-<version>/bin Here you can find the files antivir and antivir.asc. Check the signature with: gpg --verify antivir.asc antivir If you do not get any error message, you can use GnuPG for AntiVir updates. Activate GnuPG for AntiVir. In /etc/avupdater.conf enter the path to GnuPG binaries, using the option GnuPGBinary: GnuPGBinary /usr/local/bin/gpg You can only edit this option in avupdater.conf manually. Setting in the configuration script is not possible in order to avoid the danger of configuration errors. Restart Internet Update Daemon to activate the new settings in avupdater.conf: /usr/lib/AntiVir/avupdater restart From now on, GnuPG authenticates the updates.

UpdateUrl=http://dl.antivir.de If you want to perform updates from a shared directory, you must specify the path to this directory for UpdateUrl. In the case of authentication, you have to write the username and password for NetworkUserName and NetworkPassword. Please note that Savapi Update Service must run under a user account (default, Local System Account) and access the shared directory through it. UpdateUrl=file://computername/sharedfolder NetworkUserName=fmeier NetworkPassword=password
Updates Interval This value sets the time interval for the Internet Updater to search for available updates on the server specified as UpdateURL. The value is given in minutes. Default: every 120 minutes. Savapi Service automatically performs an update of the engine and virus
signatures after the first action (scan for viruses and other malware). The zero value deactivates the search for updates.

UpdateInterval=120

Proxy Server for Updates If the option is activated (1), Savapi Service downloads the updates via the specified proxy server. By default, the Updater does not use a proxy.

ProxyEnabled=0

Proxy Server Address Type the full name or IP address of the server you use for updates. This value is applied only if ProxyEnabled is active.
ProxyUrl=proxy.mydomain.com
Username and Password for Proxy Server (Proxy Authentication) Type the username and password that the Internet Updater should use to access the proxy server. These values are applied only if ProxyEnabled is active.
ProxyUserName=fmeier ProxyPassword=password
Email Notifications If SmtpMailEnabled is active (1), Savapi Service sends email notifications to the address specified for SmtpRecipientAddress. The notifications can be sent in the event of errors or successful updates. Make sure that the parameters SmtpMailMode, SmtpHostName, SmtpSenderAddress and SmptReceipientAddress are correctly set. SmtpMailEnabled is by default inactive. SmtpMailMode parameter sets the case for sending emails.
SmtpMailEnabled=0 SmtpMailMode== sending emails only by update errors. 1 = sending emails in every case (Update successful or not).
SMTP Server Name Type the full name or IP address of your SMTP server. This value is used only if SmtpMailEnabled is active.
SmtpHostName=smtp.domain.net
Sender Email Address Type the email address you want to use when sending notifications. This value is used only if SmtpMailEnabled is active.
SmtpSenderAddress=sender@domain.net
Recipient Email Address Type the email address to which you want to send the notifications. This value is used only if SmtpMailEnabled is active.

Field Codepage

Possible Values

Comment
Enter the codepage valid for the virus scan Codepage that the CCMS sets when the server. It must correspond to the codepage virus scan server is started. of the application server that is communicating with the virus scan server: -If you are only using one codepage in your application servers, enter this codepage. -If you have application servers in different codepages, set up a virus scan server on each application server and specify the valid codepage in each case. -If your system uses UNICODE, do not enter anything. 0 or <empty>: no automatic reinitialization If the vendor of your virus scanner uses the interface provided by SAP with which an initialization from outside the system can be performed, you can leave the field empty. This interface is available to certified vendors of virus scanners. <n>: Interval in hours Specifies the number of hours after which the virus scan server is to be regularly reinitialized. For the virus scan server to load new virus definitions from the virus scan server, you must reinitialize it. The automatic reinitialization is performed during the periodic monitoring of the virus scan servers by the CCMS. Specifies the maximum number of scan instances provided by the virus scan server. A virus scan server may provide multiple scan instances. You can use the maximum number specified here to determine how many of these instances are provided. If this number is exceeded, the virus scanner is no longer available for scan requests. The number of instances should correspond to the number of work processes.

Init.Interv.

Max. Instances

Field Adapter Path

Possible Values Full path of the library that contains the virus scan adapter.
Comment Specifies the full path of the virus scan adapter. If you do not fill the field, the virus scan server uses the content of the environment variable VSA_LIB.

Configuration

Full path to the configuration file of the virus scan server.
Specifies the full path to the configuration file of the virus scan server. The configuration file can contain optional parameters of the virus scan server. For externally-started virus scan servers, the configuration file has already been defined at the virus scan server command line and you cannot therefore change it here.
Save your entries. Application-Server-Starter or Self-Starter When configuring a virus scan server for ABAP systems, instead of an application-serverstarter (started by the application server) you can install a self-starter (for example, started externally as a service under Microsoft Windows NT or a daemon under UNIX). In the case of application-server-starters, all components are on the same host. On the other hand, in the case of self-starters, the virus scan server and the SAP Web AS can be on different hosts. This means that you can use a virus scan server that is only available for a particular platform, even if the SAP Web AS is installed on a different platform. Virus Scan Server on One or Two Hosts:

To set a new value for the trace level, select the desired trace components and then choose Activate. You can completely deactivate the memory trace with the Deactivate button, but not the error output to the trace file. You can therefore not suppress the output of errors by setting the trace level for the file to the value 0. If you change the selection from Memory to File or vice versa, you can display the trace level already selected for this option for the individual components with the Copy button. The selection option is activated for each active component when you do this. To display the memory trace, choose the Execute option. The overview appears. It shows the availability of the anti-virus engine used, the utilization of the virus scan server, the current trace level for the memory and an HTML output of the current trace information. You have the following options in the overview: Refresh: Refreshes the list. Delete: Deletes the trace output. Export: Exports the list to a local file. Status: Displays the current status of the virus scan server used, even if the memory trace is deactivated. In addition to technical information on the virus scan server, this output also contains the configuration of the virus scan server and information on the loaded virus scan adapter including the anti-virus engine. Stop: Stops the virus scan server. Configuration: Branches to the display mode of the IMG activity Define Virus Scan Servers. Test: Branches to the transaction VSCANTEST.
Testing the Installation of the Virus Scan Server
You can use this procedure to check that your configured virus scan server is functioning correctly. Start transaction VSCANTEST. Specify the object to be checked, using either the test data provided or your own local file.
Select the virus scan profile, scanner group, or the virus scan server to be tested. Select an action.
- If you choose Check Only, the anti-virus product that you specified scans the data for viruses and displays a result:
- If you choose Check and Clean, the product also attempts to clean the data if a virus infection is diagnosed.
Commented Example Program
You can also find a Commented Example Program on the SAP website.
Java-Specific Configuration

Max Instances Adapter Path
To save your entries, press Set. You do not have to make any configuration on the Parameters and Trace tab at this point. To activate the virus scan provider, select it and choose Activate. It will be marked as active.
You have defined a virus scan provider and can define virus scan profiles in the next step.
Define a Virus Scan Profile
In the Visual Administrator, choose the cluster Virus Scan Provider. On the Profiles tab, create a new virus scan profile by choosing the New button. Type the name for the new profile (AVIRA). The name entered is automatically saved with the prefix Z_. Select the new profile.
On the Settings tab, activate the Default option, to set the profile as default and eventually adjust the values described in the table below.
Data for a SelfConfigured Profile
Field Default Name Description Use reference Name of the new profile
Comment When activated, the profile will be automatically selected. Description of the new profile Leave this inactive. When activated, the other input fields would be hidden. Since a virus scan profile can use another virus scan profile as a reference profile, it is possible to operate multiple applications using the same virus scan profile. To create a link to an existing reference profile, proceed as follows: Activate the option Use reference. Select a reference profile from the drop down list.

Field Linkage

Comment Linkage of the steps of this profile: All steps successful: AND linkage, with which every step must be successful for the overall result to be successful. (Default) At least one Step successful: OR linkage, with which only one step needs to be successful for the overall result to be successful.
Use the drop down list to select a group
To transfer the selection for the Group fields, choose Add. Configure the list with the buttons MOVE UP, MOVE DOWN and DELETE. When checking for viruses, the list is processed from top to bottom with the linkage from the Linkage field. To save the profile, press Set. To activate the profile, select it and choose Activate. You have defined a virus scan profile and therefore performed the last configuration step for the virus scan provider. Finally you can check the configuration (see Check the Configuration Page 64).

Check the Configuration

You can use the test applet provided by SAP NetWeaver, to check the functionality of the Virus Scan Service. Open an Internet browser and type the following address: http://[server IP address]:[port]/vscantest

Virus Scan Profile Path for Temporary Files

Operation

Reaction to Viruses/ Unwanted Programs Detected
If correctly configured, AntiVir has automatically completed all important tasks on your computer. In the case of detection of viruses or unwanted programs, you should do the following: Try to detect the way the virus/ unwanted program infiltrated your system. Perform targeted scanning on the data storage supports you used. Inform your team, superiors or partners. Submit Infected Files to Avira GmbH Please send us the viruses, unwanted programs and suspicious files that our product does not yet recognize or detect and also any suspicious files. Send us the virus or unwanted program packed in a password-protected archive (PGP, gzip, WinZIP, PKZip, Arj), attached to an email message, to virus@avira.com. When packing, use the password virus. In this way the file will not be deleted by virus scanners on an email gateway.

Service

10.1 Support

Support Service

Our website http://www.avira.com contains all the necessary information on our extensive support service. The expertise and experience of our developers is available to you. The experts of Avira answer your questions and help you with difficult technical problems. During the first 30 days after you have purchased a license, you can use our AntiVir Installation Support by phone, email or by online form. In addition we recommend that you also purchase our AntiVir Classic Support, with which you can contact and obtain advice from our experts during business hours when you encounter technical problems. The annual fee for this service, which includes eliminating viruses and hoax support, is 20 % of the list price of your purchased AntiVir program. Another optional service is the AntiVir Premium Support which, in addition to the scope of the AntiVir Classic Supports, allows you to contact expert partners at any time - even outside business hours in the event of an emergency. When virus alerts occur, you will receive an SMS on your cell phone.

Email Support

Support via email can be obtained at http://www.avira.com. We cannot provide support for configuration problems which do not directly concern AntiVir VSA. To answer your questions or to solve your problems, we can direct you to an SAP consultant with technical security know-how.

10.2 Contact

Address
Avira GmbH Lindauer Strasse 21 D-88069 Tettnang Germany You can find further information on us and our products by visiting http://www.avira.com.

Internet

Appendix

11.1 Glossary

Item ABAP Backdoor (BDC) Meaning Advanced Business Application Language: the SAP programming language, for application logic. A backdoor is a program that infiltrates the system in order to steal data from the computer without the users knowledge. This program is manipulated by third parties using remote backdoor control software via the Internet or network. Computing Center Management System A daemon which starts other programs at specified times. A background process for administration on UNIX systems. On average, there are about a dozen daemons running on a computer. These processes usually start up and shut down with the computer. Paid dialing program. When installed on your computer, this program sets up a premium rate number Internet connection, charging you at high rates. This can lead to huge phone bills. AntiVir detects Dialers. The scanning module of AntiVir software. The systematic process of solving a problem using general and specific rules drawn from previous experience. However, solution is not guaranteed. AntiVir uses a heuristic process to detect unknown macro viruses. When typical virus-like functions are found, the respective macro is classified as "suspicious". The basic component of a UNIX operating system, which performs elementary functions (e.g. memory and process administration). also: Report file. A file containing reports generated by the program during run-time when a certain event occurs. Generic term for "foreign bodies" of any type. These can be interferences such as viruses or other software which the user generally considers as unwanted (see also Unwanted Programs). Software that does not usually harm the computer. It is programmed to harm other users. For example, mail bombs: with such a program, the victim can be attacked by thousands of emails. AntiVir detects PMS. The user with unlimited access rights (such as system administrator on Windows).
CCMS cron (daemon) Daemon

Dialer

Engine Heuristics

Kernel Logfile Malware

PMS (Possibly Malicious Software)

Item SAVAPI

Meaning Secure AntiVirus Application Programming Interface: AntiVir SAVAPI ensures quick and simple integration of the latest Avira technology for detection and protection against malware in third-party programs and applications. A bytes-combination used to recognize a virus or unwanted program. A text file containing commands to be executed by the system (similar to batch files in DOS). Computer architecture with multiple similar CPUs working in parallel. Simple Mail Transfer Protocol: protocol for email communication on the Internet. A daemon used by programs for logging various information. These reports are written in different logfiles. The syslog daemon configuration is in /etc/syslog.conf. The name for programs that do not directly harm the computer, but are not wanted by the user or administrator. These can be backdoors, dialers, jokes and games. AntiVir detects various types of unwanted programs. A file with known signatures for viruses and unwanted programs. In many cases it is sufficient for an update to load the most recent version of this file. Virtual File System

Signature Script SMP (Symmetric Multi Processing) SMTP syslog daemon

Unwanted programs

VDF (Virus Definition File) VFS

11.2 Further Information

You can find further information on viruses, worms, macro viruses and other unwanted programs at http://www.avira.com.
11.3 Golden Rules for Protection Against Viruses
Always keep boot disks for your network server and for your workstations. Always remove floppy disks from the drive after finishing work. Even if they have no executable programs, disks can contain program code in the boot sector and these can serve to carry boot sector viruses. Regularly back up your files. Limit program exchange: particularly with other networks, mailboxes, the Internet and acquaintances. Scan new programs before installation and the disk after this. If the program is archived, you can detect a virus only after unpacking and during installation. If there are other users connected to your computer, you should define the following rules for protection against viruses: Use a test computer to check downloads of new software, demo versions or virussuspicious media (floppies, CD-R, CD-RW, removable drives). Disconnect the test computer from the network! Appoint a person responsible for virus infection operations and establish all steps for virus elimination. Draw up an emergency plan as a precaution for preventing damage due to destruction, theft, failure or loss/change due to incompatibility. You can replace programs and storage devices, but not your vital business data. Draw up a plan for data protection and recovery. Your network must be correctly configured and the access rights must be wisely assigned. This represents good protection against viruses.
Lindauer Str. Tettnang Germany Telephone: +49 (0) 7542-Fax: +49 (0) 7542-Internet: http://www.avira.com
Avira GmbH. All rights reserved. This manual was created with great care. However, errors in design and contents cannot be excluded. The reproduction of this publication or parts thereof in any form is prohibited without previous written consent from Avira GmbH. Errors and technical subject to change. Issued Q4-2008

Configuration VSA with SAP NetWeaver 2004(s) Java

Avira Support

August 2009

Content

SAP Requirements.... 3 SAP Platforms.... 3 OS System Requirements.... 3 Java specific Configuration with SAP NetWeaver 2004(s) and KMC.. 3 Configuration via the Visual Administrator.. 3 Define the Scanner Group... 4 Define a Virus Scan Provider.... 7 Define a Virus Scan Profile... 10 Check the Configuration... 12 Integration with the Enterprise Portal and the Knowledge Management Center. 15 Environment Variables VSA_LIB and VSA_DEBUG.. 25

SAP Requirements

SAP Platforms
SAP NetWeaver 6.40 with Support Package 7 or higher; for ABAP Engine with SAP_BASIS 640 Support Package 11 or higher; for J2EE Engine with Support Package 13 or SAP NetWeaver 2004s (7.0)

OS System Requirements

Operating Systems Linux/Unix (32 bit/64 bit): Red Hat Enterprise Linux 5 Server; Red Hat Enterprise Linux 4 Server; Novell SUSE Linux Enterprise Server 10 - 10.2; Novell SUSE Linux Enterprise Server 9; Debian GNU/Linux 4 (stable); Ubuntu Server Edition 8; Sun Solaris SPARC 9; Sun Solaris SPARC 10 Operating Systems Windows (only 32 bit): Windows 2000 Server, SP4 empfohlen Windows 2000 Advanced Server, SP4 empfohlen Windows 2003 Server Windows Server 2008 (nicht fr Core-Setup)
Java specific Configuration with SAP NetWeaver 2004(s) and KMC
Configuration via the Visual Administrator
Please, proceed the following steps: Define the scanner group Define the Virus Scan Provider Define the Virus Scan Profile

Define the Scanner Group

A scanner group combines multiple virus scanners of the same type. You need the Groups in order to specify virus scan profiles later. SAP does not supply any scanner groups. In the Visual Administrator, choose the cluster Virus Scan Provider.
If the service is not started, click the Start button (or right-click on Virus Scan Providers and select Start)
Create a scanner group by pressing the New button on the tab Groups.
Specify the name of the new group (AVIRA) in the dialog box and confirm your entry with OK. The group names are case sensitive. You have to use the same names later in the KMC.
Select the node for the newly created group.
- Activate the Default option on the Settings tab to set the group as default. - Enter a description of the group in the Description field. - To save you entries, press Set. You do not have to make any configuration on the Parameters tab at this point.
Define a Virus Scan Provider
- Choose the cluster Virus Scan Provider in the Visual Administrator. On the Provider tab page, select the Virus Scan Adapter node and press the New button, to create a new virus scan adapter.
Specify the name of the new provider (AVIRA) in the dialog box and confirm your entry with OK. The entered name is automatically saved with the prefex VSA_. The names are case sensitive. You have to use the same names later in the KMC.
Select the node for the newly created provider.
On the Settings tab, activate the Default option, to set the provider as default. Default: This adapter is selected if no other VSA is specified. Name: Name of the virus scan adapter. The name entered is automatically saved with the prefix VSA_. Description: Description of the current adapter. Group: The drop down list shows the available groups to which you can assign the current adapter. Init. Interval: The time interval (in hours) for the NetWeaver to end VSA and restart it. Values: 0 restart only when the Virus Scan Service ends/starts, or when the Virus Scan Provider is deactivated/activated. 1 for test environments. Advantage: the configuration is read hourly, without having to end the servlet engine.

Max Instances: The maximum scan instances allowed to the VSA by NetWeaver. Default: 10. In order to save you entries in the Settings tab, select Set. You do not have to make any configuration on the Parameters and Trace tab at this point. In order to activate the Virus Scan Provider, mark it and choose Activate. It will be marked as active.
Define a Virus Scan Profile
- In the Visual Administrator choose the cluster Virus Scan Provider. - On the Profiles tab create a new virus scan profile by choosing the New button. - Type the name for the new profile (AVIRA) and confirm that with OK. The entered name is automatically saved with the prefix Z_. - Mark the node of the new profile.
Activate the Default option on the Settings tab, to set the profile as default and eventually adjust the values described in the table below. Default: When activated, the profile will be automatically selected. Name: Name of the new profile. Description: Description of the new profile. Use reference: Leave this inactive. When activated, the other input fields would be hidden.
As a virus scan profile can use another virus scan profile as a reference profile, it is possible to operate multiple applications using the same virus scan profile. To create a link to an existing reference profile, proceed as follows: - Activate the option Use reference. - Select a reference profile form the drop down list. 74 Avira AntiVir Virus Scan Adapter Avira GmbH - To transfer the selection for the fields Group and Profile, choose Add. - Configure the list with the buttons MOVE UP, MOVE DOWN and DELETE. When checking for viruses, the list is processed from top to bottom with the linkage from the Linkage field. - To save the profile, press Set. To activate the profile, select it and choose Activate.

Check the Configuration

- You can use the test applet provided by SAP NetWeaver, to check the functionality of the Virus Scan Service. - Open an Internet browser and type the following address: http://[Server IPAdresse]:[Instanz-Port]/vscantest
Click the link to Test servlet.
- Select the EICAR Anti-Virus Test File under Object to Be Checked. - Select the (default) profile under Scanner Selection. - Leave selected the option Check Only under General Settings. - Press the button Execute the action. - The test should report the detection of the EICAR test file.
Integration with the Enterprise Portal and the Knowledge Management Center
- Open an Internet browser and connect to the SAP NetWeaver Portal as administrator. - Go to the menu System Administrator/ System Configuration. - On the left panel, select under Detailed Navigation the item Knowledge Management/ Content Management.

- On the right panel, go to the Mode menu and select Advanced. - Under Topic Area, select Global Services, then scroll down and select Virus Scanner Profiles.
Click on the link to Virus Scanner Groups.
Press New to create a new Scan Group.
- In the field Group Name write AVIRA and in the List of Providers write VSA_AVIRA. The values are case sensitive. You have to use the same names as in the Visual Administrator.

Confirm with Ok.

Select Virus Scanner Profiles in the Topic Area.
Activate the checkbox in front of SAPTest and click Edit.
- Deselect the checkbox for the option Is Default and press OK. - To create a new profile, click New.
In the field Profile Name write AVIRA. - Select the checkboxes for the options Is Active and Is Default. - The option Is Reference must remain inactive. - For the option Logical OR activate the value Not set. - Reference Profile must remain Not set. - From the Scanner Group drop down list select AVIRA. - The field Description is optional. - Type in the Package Name: com.sapportals.wcm.service.antivirus - Press OK to save the profile. - To activate the Virus Scan Service, return to the Topic Area, select Global Services and click Edit.
Make the necessary settings (see table below) and press OK.
- Restart the servlet engine, to activate the settings. Active: Select the checkbox to activate the Virus Scan Service in KMC. Check Write: Specifies if the virus scan should occur only at download, or at upload, too. Clean Viruses: When active, the antivirus tries to clean infected files. Positive List: When active, the virus scanner checks ONLY the selected repositories. File Count: Maximum number of files to be scanned simultaneously. (default: 10) Maximum File Size (MB): Maximum size of the files to be scanned. Bigger files cannot be loaded in the Knowledge Management, for safety reasons. It depends on the File Count and Path for Temporary Files. For example, if you set the maximum size to 1000 MB and the File Count is 10, the temp directory should be 10 GB.
Memory Count: Sets the number of memory blocks available to the scanner. Default: 10. Memory Limit (KB): Sets the maximum size of the memory space allowed for the files being scanned. Default: 1000. Repositories: When Positive List is active, the virus scanner checks ONLY the selected repositories. Otherwise, the scanner checks all repositories, EXCEPT the selected ones. Virus Scan Profile: Select the profile to be used (AVIRA). Path for Temporary Files: Specifies the temporary folder for the files to be scanned (C:\Windows\Temp). If this option is left empty, the default value of the Java engine is used (java.io.tmpdir).

Environment Variables VSA_LIB and VSA_DEBUG
Used environment variables (Windows) VSA_LIB: Refers to the antivirvsa.dll The variable isc reated automatically VSA_DEBUG Refers to the path of the debug log file of the VSA