ESET NOD32 Antivirus

for Kerio

Installation manual

Content

1. Introduction.. 3 2. Installation on Kerio Connect / Mailserver... 3
2.1. Installation on Kerio Connect 7.0 and newer and Kerio MailServer 6.7.x and newer. 3 2.2. Installation on Kerio MailServer 6.6.x and older. 3 2.3. Configuring ESET Mail Security for Kerio Connect / MailServer on the Linux platform.. 4
ESET NOD32 Antivirus for Kerio
Copyright 2010 by ESET, spol. sr. o. ESET NOD32 Antivirus was developed by ESET, spol. s r.o. For more information visit www.eset.com. All rights reserved. No part of this documentation may be reproduced, stored in a retrieval system ortransmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning, orotherwise without permission in writing from the author. ESET, spol. s r.o. reserves the right to change any of the described application software without prior notice. Customer Care Worldwide: www.eset.eu/support Customer Care North America: www.eset.com/support REV.20100621-007
3. Installation on Kerio Control / WinRoute Firewall..4
3.1. Installation on Kerio Control 7.0 and newer and Kerio WinRoute Firewall 6.6.x and newer. 4 3.2. Installation on Kerio WinRoute Firewall 6.5.x and older.. 4
4. Tips..5 5. Errors...6.

1. Introduction

ESET NOD32 Antivirus for Kerio Connect / MailServer provides antivirus protection for incoming and outgoing email. ESET NOD32 Antivirus for Kerio Control / WinRoute Firewall provides transparent antivirus protection of the HTTP, FTP, POP3 and SMTP protocols (only incoming connections). Kerio Connect / MailServer and Kerio Control / WinRoute Firewall include a plugin for ESET NOD32 Antivirus. Depending on the version of the Kerio product, the correct version of ESET NOD32 Antivirus for Windows (as specified below) must be installed on the same computer as the Kerio product.
2. Installation on Kerio Connect / MailServer
2.1. Installation on Kerio Connect 7.0 and newer and Kerio MailServer 6.7.x and newer Install ESET NOD32 Antivirus version 3.0 or later on the server. Open the main program window by clicking the ESET icon next to the system clock or by clicking Start > Programs > ESET > ESET NOD32 Antivirus and then press the F5 key to open the Advanced Setup window. From the Advanced Setup tree on the left, click Miscellaneous > Licenses and add the license key for Kerio Connect / MailServer (a file with a *.lic extension) that you received at the time of purchase. Click OK to save your settings. From the Advanced Setup tree, click Antivirus and antispyware > Web access protection > HTTP, HTTPS and deselect the Enable HTTP checking option. From the Advanced Setup tree, click Antivirus and antispyware > Email client protection > POP3, POP3S and deselect the Enable POP3 protocol checking option. From the Advanced Setup tree, click Update, and enter the username and password you received. We recommnend that you update your ESET security product before you run the Kerio console. From the Advanced Setup tree, click Antivirus and antispyware > Real-time file system protection and click Setup. In the ThreatSense engine parameter setup window, click Extensions and make sure the Scan all files option is selected (selected by default). Add the TMP and EML extensions (entered without a dot) to the list of extensions excluded from scanning. Click OK to save your settings. From the Advanced Setup tree, click Antivirus and antispyware > Exclusions and add a data storage folder for Kerio Connect / MailServer (default is C:\Program Files\Kerio\MailServer\store). Click OK to save your settings. Launch the Kerio console and connect to Kerio Connect / MailServer. Click Configuration > Content Filter > Antivirus, select the Use external antivirus option, select ESET NOD32 Antivirus 3 / 4 and save your settings.

This will activate the antivirus plug-in within Kerio Connect / MailServer. You can verify this by sending the eicar.zip test file, that can be found on the website http://www.eicar.com. 2.2. Installation on Kerio MailServer 6.6.x and older Kerio MailServer 6.6x and older requires ESET NOD32 Antivirus 2.7 (these KMS versions are not compatible with version 3.0 and later): Install ESET NOD32 Antivirus 2.7. During installation, select the Expert (Fully customized installation) mode. If the server will only run Kerio MailServer and there will not be users working on it directly (and/or it will not be used as a file sharing server), in the File system monitor - AMON installation window, deselect the I want to start the file system monitor automatically option. In the Internet Monitor (IMON) installation window, deselect the Register Internet monitor (IMON) to the system option. After installation is complete, open the main program window by clicking the ESET icon next to the system clock or by clicking Start > Programs > ESET > NOD32 Control Center. Make sure that the IMON module is turned off (it will be grey and when selected the Status message should read Internet protection is not running. Press Start to enable). If it is not
3. Installation on Kerio Control / WinRoute Firewall
disabled, click the Quit button in the IMON window. Click Update > Setup and enter the username and password you received. We recommnend that you update your ESET security product before you run the Kerio console. Click NOD32 System Tools > NOD32 System Setup > Setup and under the License Keys tab, add the license key for Kerio MailServer (a file with a *.lic extension) that you received at the time of purchase. Click OK to save your settings. If the AMON module must remain active, it will be necessary to exclude the Kerio MailServer data storage folder from scanning along with certain file extensions. Click the AMON module and select Setup. Under the Detection tab click Extensions and make sure that the Scan all files option is selected (selected by default). Add the TMP and EML extensions (entered without a dot) to the list of extensions excluded from scanning. Click OK to save your settings. Under the Exclusions tab click the Add button and add the Kerio MailServer data storage folder (default C:\Program Files\Kerio\MailServer\store). Click OK to save your settings. Launch the Kerio console and connect to Kerio MailServer. Click Configuration > Content Filter > Antivirus, select the Use external antivirus option, select ESET NOD32 Antivirus 2 and save your settings. If a notification about the detection of the eicar test file appears, select Close. 3.1. Installation on Kerio Control 7.0 and newer and Kerio WinRoute Firewall 6.6.x and newer Install ESET NOD32 Antivirus version 3.0 or later on the server. Open the main program window by clicking the ESET icon next to the system clock or by clicking Start > Programs > ESET > ESET NOD32 Antivirus and press the F5 key to open the Advanced Setup window. From the Advanced Setup tree on the left, click Miscellaneous > Licenses and add the license key for Kerio Control / WinRoute Firewall (a file with a *.lic extension) that you received at the time of purchase. Click OK to save your settings. From the Advanced Setup tree, click Antivirus and antispyware > Web access protection > HTTP, HTTPS and deselect the Enable HTTP checking option. From the Advanced Setup tree, click Antivirus and antispyware > Email client protection > POP3, POP3S and deselect the Enable POP3 protocol checking option. From the Advanced Setup tree, click Update, and enter the username and password you received. We recommnend that you update your ESET security product before you run the Kerio console. From the Advanced Setup tree, click Antivirus and antispyware > Real-time file system protection and click Setup. In the ThreatSense engine parameter setup window click Extensions and make sure the Scan all files option is selected (selected by default). Add the TMP and EML extensions (entered without a dot) to the list of extensions excluded from scanning. Click OK to save your settings. Launch the Kerio console and connect to Kerio Control / WinRoute Firewall. Click Configuration > Content Filter > Antivirus, select the Use external antivirus option, select ESET NOD32 Antivirus 3 / 4 and save your settings.

This will activate the antivirus plug-in within Kerio MailServer. You can verify this by sending the eicar.zip test file, that can be found on the website http://www.eicar.com. 2.3. Configuring ESET Mail Security for Kerio Connect / MailServer on the Linux platform To provide antivirus protection for incoming and outgoing email using Kerio Connect / MailServer on the Linux platform, you need to install the ESET Mail Security product first. You can find the installation package of the newest ESET Mail Security version and the relevant product manual under http://www.eset.eu/download1. Activating ESET Mail Security for Kerio Connect / MailServer: 1. Confirm that the process esets_daemon is running (command /etc/init.d/esets_daemon start). It can be detected by entering the command ps -C esets_daemon. Open the administrator console and connect to the Kerio Connect / MailServer. Click Configuration Content Filtering Antivirus, select Use an external antivirus program and choose NOD32 from the drop-down menu. Click Options and check the routes to the following libraries: NOD32 (ESET Mail Security), the license file and the working directory temp. The standard routes are: - NodModulesPath - /var/lib/esets - NodDll - /usr/lib/libesets.so - LicenseDirectory - /etc/esets/license - TmpDirectory - /tmp Click Apply to save the changes
This will activate the antivirus plug-in within the Kerio Control / WinRoute Firewall. You can verify this by downloading the eicar.zip test file, that can be found on the website http://www.eicar.com. 3.2. Installation on Kerio WinRoute Firewall 6.5.x and older Kerio WinRoute Firewall 6.5x and older requires ESET NOD32 Antivirus 2.7 (these Kerio WinRoute Firewall versions are not compatible with version 3.0 and later). Install ESET NOD32 Antivirus 2.7. During installation, select the Expert (Fully customized installation) mode. If the server will only run Kerio WinRoute Firewall and there will not be users working on it directly (and/or it will not be used as a file sharing server), in the File system monitor - AMON installation window, deselect the I want to start the file system monitor automatically option. In the Internet Monitor (IMON) installation window, deselect the Register Internet monitor (IMON) to the system option. After installation is complete, open the main program window by clicking the ESET icon next to the system clock or by clicking Start > Programs > ESET > NOD32 Control Center. Make sure that the IMON module is turned off (it will be grey and when selected the Status message should read Internet protection is not running. Press Start to enable). If it is not disabled, click the Quit button in the IMON window. Click Update > Setup and enter the username and password you received. We recommnend that you update your ESET security product before you run the Kerio console

If you have the Kerio MailServer version 6.1.1 patch1 or lower installed please refer to the activation procedure description contained on the Kerio webpages (http://support.kerio.com).

4. Tips

Click NOD32 System Tools > NOD32 System Setup > Setup and under the License Keys tab, add the license key for Kerio WinRoute Firewall (a file with a *.lic extension) that you received at the time of purchase. Click OK to save your settings. If the AMON module must remain active, it will be necessary to exclude certain file extensions from scanning. Click the AMON module and select Setup. Under the Detection tab click Extensions and make sure that the Scan all files option is selected (selected by default). Add the TMP and EML extensions (entered without a dot) to the list of extensions excluded from scanning. Click OK twice to save your settings. Launch the Kerio console and connect to Kerio WinRoute Firewall. Click Configuration > Content Filter > Antivirus, select the Use external antivirus option, select ESET NOD32 Antivirus 2 and save your settings. If a notification about the detection of the eicar test file appears, select Close. Under the Attachment filter tab, enable filtering and use the default settings, or define attachments that will not be delivered, regardless of whether they are infected or not. We recommend blocking at least the following extensions: *.PIF, *.SCR, *.VBS. We do not recommend, within the Kerio Connect / MailServer environment, activating the functionality to notify the sender about sending an infected message. Common email viruses can forge the senders address and so this functionality loses its purpose (the real sender of the infected message will not be notified). ESET NOD32 Antivirus for Kerio Connect / MailServer and ESET NOD32 Antivirus for Kerio Control / WinRoute Firewall use their own license keys. To use both products at the same time, you must have a license key for each product.
This will activate the antivirus plug-in within Kerio WinRoute Firewall. You can verify this by downloading the eicar.zip test file, that can be found on the website http://www.eicar.com.

5. Errors

Errors that may occur during installation and activation of ESET NOD32 Antivirus for Kerio. Error during initialization of the antivirus module. Error: Error loading scanner DLL (126) or AvPlugin failed to initialize (in newer versions) - this occurs when the license key is damaged or when there is no license key present.

ESET NOD32 Antivirus for IBM Lotus Domino

Installation

Copyright ESET, spol. s r. o. All rights reserved.
No part of this document may be reproduced or transmitted in any form or by any means electronic or mechanical, for any purpose without the express written permission of ESET,spol.sr.o. Information in this document is subject to change without prior notice. Certain names of program products and company names used in this document might be registered trademarks or trademarks owned by other entities. ESET, NOD32 and AMON are trademarks of ESET, spol. s r. o. Microsoft and Windows are registered trademarks of Microsoft Corporation.
ESET, spol. s r. o. Einsteinova 24, Bratislava, Slovak Republic http://www.eset.eu Customer Care Worldwide: www.eset.eu/support Customer Care North America: www.eset.com/support REV.20100927-006

1. Introduction

ESET NOD32 Antivirus for Lotus Domino (AMFE) is a Lotus Domino server addin, built upon the state-of-theart NOD32 scanning engine. It was designed to protect email communication from virus infiltrations propagating by e-mail, and to lower the e-mail traffic by filtering out undesired e-mail attachments. ESET NOD32 Antivirus for Lotus Domino utilizes the same engine as NOD32 2.7, including archive scanning, advanced heuristics, adware/spyware/riskware detection, etc.
Before you install Prior to installing ESET NOD32 Antivirus for Lotus Domino, make sure that NOD32 2.7 is already installed on the Lotus Domino server. NOD32 2.7 as well as ESET NOD32 Antivirus for Lotus Domino is available for download from Esets website http://www.eset.com/download/ using your username and password. For more information about installing NOD32, read the quick installation guide available at http://www.eset.com/download/manual.htm. After NOD32 installation set in the AMON module in Extension Editor the TMP files not to be checked. Before you start the installation (uninstallation) of ESET NOD32 Antivirus for Lotus Domino, quit the Lotus Domino Server. Installing ESET NOD32 Antivirus for Lotus Domino Installation process: 1. extract the installation package downloaded from Esets website or shipped on a CD 2. navigate to the temporary folder, and run the appropriate setup file for your oper. system: setup2k.exe for Windows 2000 / 2003 server setupnt.exe for Windows NT server 3. the installer will search for the current Lotus Domino notes.ini file and will offer to use the first file found. After the file has been found, confirm it by typing y and pressing ENTER to go ahead with the installation (img. 1) 4. if the found notes.ini file is not the right file, then type n and press ENTER to continue 5. type the path to the correct notes.ini and press ENTER (img. 2) 6. enter the name of a new subdirectory in the Lotus Domino data folder where you want the file to be cre-

2. Quick Installation

System requirements Supported operating systems Microsoft Windows NT 4.0 Microsoft Windows Server 2000 Microsoft Windows Server 2003 Supported versions of IBM Lotus Domino: IBM Lotus Domino R5 (5.0.9a & higher) IBM Lotus Domino R6 IBM Lotus Domino R6.5 IBM Lotus Domino R7 IBM Lotus Domino R8 IBM Lotus Domino R8.5 Supported ESET product: ESET NOD32 for Windows version 2.7 NOTE: ESET NOD32 Antivirus 2.7 does not support 64-bit installations of IBM Lotus Domino. (img. 1) (img. 2)

(img. 3)

(img. 4)

(img. 5)

(img. 6)
ated, and where the ESET NOD32 Antivirus for Lotus Domino databases will be copied to, and press ENTER (img. 3) 7. wait for the installation to complete 8. after the installation has completed, press any key to exit the installation dialog (img. 4) After installation, before Lotus Domino server startup, enter a license key for ESET NOD32 Antivirus for Lotus Domino product to NOD32 Control Center (NOD32 Control Center > NOD32 system tools > Settings > License Keys). The license key is sent to your contact address together with authorization data by ESET spol. s r. o. After entering the license key, start Lotus Domino server. At the server startup, ESET NOD32 Antivirus for Lotus Domino (AMFE) will be loaded. (img. 6) After a successful installation, the following files will be created in the specified folder (i.e. in the Lotus Domino data subfolder): AMFE help.nsf AMFE log.nsf AMFE Mail Review.nsf AMFE Quarantine.nsf AMFE Setup.nsf
Uninstalling ESET NOD32 Antivirus for Lotus Domino The steps 1 to 5 are identical with those for installation. 6. after the installer has recognized a previous installation of ESET NOD32 Antivirus for Lotus Domino, it will offer you to uninstall it from the computer. Type y and press ENTER (img. 5) 7. wait for the uninstallation to complete 8. after the uninstallation has completed, press any key to close the installation dialog

3. Setup

ESET NOD32 Antivirus for Lotus Domino Setup (AMFE Setup)
Text to append to bottom of message: - the text message appended at the end of infected e-mails. Setting up actions that are applied after successful or unsuccessful cleaning: Replace file in message cleans infected files (cleanable) Delete file from message deletes infected files (regardless of whether they are cleanable or non-cleanable) Place text into file body replaces the body of infected files with a text message (the text of the e-mail will be replaced with the text you enter here) Make log entry enables logging Append virus info to message adds information about detected threat to email Place infected file into quarantine database moves infected files to quarantine (img. 8). Mail Filter Setup: ESET NOD32 Antivirus for Lotus Domino enables email filtering based on specified criteria. The filtering can be accomplished by applying various rules. By adjusting the filters the proper way, it is possible to filter out spam effectively. To create a new filter, click the New Mail Filter button. To assign different priorities to the filters, move them up and down using the arrow keys. The higher a filter is listed, the higher priority it has. To switch a filter on/off, select a filter and click the Enable / Disable button. The Filter Settings are displayed after double-clicking

To configure ESET NOD32 Antivirus for Lotus Domino, open Domino Administrator or your Lotus Notes client (Workspace). To launch ESET NOD32 Antivirus for Lotus Domino, click the Enable button in the upper part of the AMFE Setup (Service status:). After ESET NOD32 Antivirus for Lotus Domino starts, Lotus Domino Server must be restarted (img. 7). The settings are divided into two groups: Antiviral Engine Setup: To display the Engine settings, double click on the setup document. By default, the settings are displayed in view mode. To edit the settings, click the Edit button. Settings: Status (Enabled/Disabled) toggles the checking on/off (img. 7)

(img. 8)

the filter. By default, the settings are displayed in view mode. To edit them, click the Edit Button. Settings Status (Enabled/Disabled) enables/disables the filter Description name of the filter. Filter settings From contains filters by sender To contains filters by addressee Subject contains filters by subject Body contains filters by text in the e-mail body Attachments size filters by the size of attachment Action to take actions applicable to e-mail messages Delete (reject) message deletes filtered messages Move message to mail review database moves messages to the review database Log Message to mail review database and
deliver the message delivers messages to their addressees and places a copy of the messages to the review database Remove attachments and deliver deletes attachments and delivers messages subsequently. Strings used for filtering email must commence and end with an asterisk (e.g. *viagra*). Wildcards can also be used. A question mark (?) substitutes any one character, while an asterisk (*) substitutes zero or more arbitrary characters. Use a semicolon (;) to delimit multiple strings, if necessary. Example: To filter out email from the hotmail.com and yahoo.com domains, enter **@hotmail.com*;**@yahoo.com* to the From contains field.
4. Log, Mail Review and Quarantine database maintenance

AMFE Log Database

contains a review of all infected e-mails detected. The database also provides information about the time an incident occurred, the name of the threat as well as the re6
cipient. The information in the database can be sorted by date or the name of the threats. To enable database logging, select Make log entry, which is located in the Mail Filter setup. Quarantine Database

the Quarantine database keeps track of all infected files detected. If needed, the files can be recovered. As in the previous case, items in quarantine can be arranged by date or name of infiltration. To store infected files in quarantine, select Place infected file into quarantine database, found in the Mail Filter Setup. Mail Review Database
contains all e-mails that have been filtered. Messages are divided into delivered and undelivered. E-mail messages delivered to their respective addressees are indicated by this icon (when displaying all messages). Undelivered e-mails can be sent back to their addressees to do so, select messages and click on the Deliver button.