
                      AntiVir for UNIX - Version 2.0.7

                 Copyright 2002 by H+BEDV Datentechnik GmbH

                 http://www.hbedv.com           <-- english
                 deutsch -->          http://www.antivir.de



============
 Disclaimer
============

AntiVir for UNIX utilizes Dazuko (http://dazuko.org), a
free software project that provides a simple interface for
3rd-party file access control. Dazuko is used as the basis
for AvGuard, the on-access scanner available with the
AntiVir for UNIX package. H+BEDV Datentechnik GmbH
will take no responsibility for ANY problems related to
Dazuko itself. By building and/or installing Dazuko in
order to utilize AvGuard's on-access features, you are
choosing to do so at your own risk.



===========================
 What is AntiVir for UNIX?
===========================

AntiVir for UNIX is an anti-virus package for your UNIX
system. It is also able to identify unwanted software
on your system. It is comprised of a resident (on-access)
scanner, an automatic internet updater, and a command line
scanner. The resident scanner is referred to as AntiVir Guard
(or AvGuard for short).

AvGuard is based on Dazuko, a free software project under
the GNU General Public License. Dazuko consists of a kernel
module that captures file access system calls and passes
this information to one of the running AvGuard daemons. The
daemon scans the file and if no viruses are found and if
the file is not an unwanted file, allows the system call to
proceed.

You can configure AvGuard to scan files as they are opened,
closed, and/or executed. Concerning files can be cleaned,
renamed or moved to another directory for further analysis.
All scanning activity is logged through syslog, sent as a
notification through email, logged into a specified file,
or a combination thereof. If a virus or unwanted file is found
and cannot be removed, access to the file is blocked.

The automatic internet updater runs as a daemon and has
the responsibility of making sure your AntiVir software is
up-to-date (internet access is required). The automatic
internet updater can be configured to check for updates at
specific times and intervals. It can also be configured to
send email or simple log update activity. Updates include
both data files and the AntiVir programs themselves.

Although the automatic internet updater is provided with
AntiVir for UNIX, it is also possible to make manual
update checks using the command line scanner. This is
done with the --update argument. Checking for updates
manually is EXACTLY the same as using the automatic
internet updater. This means that users may choose to
use the command line scanner in a crontab as opposed to
using the automatic internet updater. Cron is a much
more flexible and configurable scheduling daemon than
the automatic internet updater.

The features of AntiVir for UNIX include:
  + scan files on OPEN/CLOSE/EXECUTE (requires Dazuko)
  + configurable path protection (requires Dazuko)
  + block access to concerning files (requires Dazuko)
  + log/email alert notification
  + repair/move/rename concerning files
  + automatic internet updates (requires internet access)
  + command line scanner

Extra Server-specific features include:
  + scanning within compressed files (requires Dazuko)

NOTE: Without a valid key, AntiVir for UNIX will run in DEMO
      mode. This means that it will only report concerning files
      through syslog and will not block access or handle the
      concerning files in any way. Compressed files will not be
      scanned and updates will not be available.



==========================
 AntiVir Personal Edition
==========================

An estimated 57 percent of virus infections within companies can
be traced back to an unprotected data transfer between private
and business environments. The resulting data losses and computer
system failures take a high annual toll on firms and authorities.

The number of virus infections on systems used for business
purposes can be reduced by catching them in time on private
computers.

For this reason, we offer AntiVir for UNIX Workstation
free of charge for private (individual, non-commercial) use.
To activate your Personal Edition, you must register to receive
a valid key. Registration can be done over the internet from:

(english) http://www.antivir.de/order/privreg/order_e.htm

(german) http://www.antivir.de/order/privreg/linux.htm

A key will be sent to you via email. The key must then be
placed within the same directory as the AntiVir program files
(typically /usr/lib/AntiVir). Make sure that the appropriate
rights are given to the file so that your AntiVir software
can read the key.

NOTE: Only the Workstation edition is available free of
      charge for non-commercial use.

If a key is not found or has expired, the AntiVir software
will run in DEMO mode. This is described above.



==============
 Installation
==============

If you have any key files, you can put them in the same
directory as the AntiVir for UNIX install files and they
will be copied into /usr/lib/AntiVir automatically. Make
sure that the permissions of the key files are correct.

Login as root, change to the directory containing the
AntiVir for UNIX install files and run the install script.

./install

The script will do the following
- copy files to /usr/lib/AntiVir
- copy configuration files to /etc
- create a link in /usr/bin (if desired)
- create links in rc.d directory (if desired)
- run a configuration script (if desired)

AvGuard:
In order to install AvGuard, you first need to compile
a Dazuko module. Information on how to do this can be
found in the src/HOWTO-Dazuko file.



===========
 Upgrading
===========

If you are upgrading from a previous installation,
simply run the install script (as if you were
installing for the first time).

./install

The install script will identify a previous
installation and automatically update necessary
components.



==============================
 Running/Configuring Software
==============================

The automatic internet updater is started and stopped by
running the avupdater script with the "start" and "stop"
arguments. Using the "status" argument will show the
current status of the automatic internet updater.

/usr/lib/AntiVir/avupdater start
/usr/lib/AntiVir/avupdater stop
/usr/lib/AntiVir/avupdater status

You can configure the automatic internet updater at any
time using the provided script:

/usr/lib/AntiVir/configantivir

NOTE: You do not need to install the automatic internet
      updater in order to make internet updates. It is
      also possible to make internet updates using the
      --update argument with the command line scanner.
      This gives users the freedom to use scripts and/or
      cron jobs for updates.

AvGuard is started and stopped by running the avguard script
with the "start" and "stop" arguments. Using the "status"
argument will show the current status of AvGuard.

/usr/lib/AntiVir/avguard start
/usr/lib/AntiVir/avguard stop
/usr/lib/AntiVir/avguard status

**********************************************************
* NOTE: You need to configure AvGuard to fit your needs. *
*       The default settings are more than likely not    *
*       what you want. During installation you will have *
*       an opportunity to configure AvGuard. You can     *
*       also manually run the configuration script       *
*       anytime with the command:                        *
*       /usr/lib/AntiVir/configavguard                   *
**********************************************************



======================
 Manual Configuration
======================

Although there are two scripts available for
configuration of AntiVir for UNIX, users may choose
to manually set options.

configuration scripts:
    /usr/lib/AntiVir/configantivir
    /usr/lib/AntiVir/configavguard

If you prefer to manually configure AntiVir for UNIX
instead of using the provided configuration scripts, it
is very simple. Two configuration files are read by the
AntiVir programs on startup. Empty lines and lines
starting with "#" are ignored.

- /etc/antivir.conf
  This file contains all the general flags and options
  that affect all AntiVir software. You should edit this
  file to suit your needs. Important directives to
  change would be:

  EmailTo - specifies where email notifications are sent
            (your server must be configured as a mail
            server if you want to use external email
            addresses)

  LogTo   - specifies a specific file for log data

  There are also additional directives for proxy
  support. If your machine is behind an HTTP proxy,
  you will need to set these options.

- /etc/avguard.conf
  This file contains all the flags and options specific
  to AvGuard. You should edit this file to suit your
  needs. Important directives to change would be:

  AccessMask  - specifies what events cause a scan

  IncludePath - specifies a path for AvGuard to watch
                (all sub-dirs are also watched)

  ExcludePath - specifies a path under the included paths
                that AvGuard should ignore (all sub-dirs
                are also ignored)

If you change any of the configuration files, the AntiVir programs
must be restarted. This can be done by restarting the AntiVir for
UNIX software.

/usr/lib/AntiVir/avupdater restart
/usr/lib/AntiVir/avguard restart



========
 Output
========

AntiVir for UNIX can generate scan output in several ways.
Currently these are through syslog, mail, and a specified log file.
These options can be specified during the configuration process or
manually in the /etc/antivir.conf file.

- syslog
  All output from AntiVir is always generated through syslog.
  By default, messages are generated with the following
  facility and priority:

    user.notice

  You will need to refer to your syslog.conf settings to see which
  files these messages will be stored in. You may change the
  facility and/or priority during the configuration process or
  manually in the /etc/antivir.conf file.

- mail
  You can specify to have alerts sent via email to a
  specific address. Each email message has the same content
  as output to syslog. For manual configurations this is
  the EmailTo directive in the /etc/antivir.conf file.

- specified logfile
  You may have AntiVir log output directly to a specified
  file. The output has the same content as output to syslog.
  This has the advantage of placing all AntiVir-related activity
  into a single log file. For manual configurations this is
  done using the LogTo directive in the /etc/antivir.conf file.



===================
 Supported Kernels
===================

In order to use AvGuard you will need Dazuko. The
Dazuko Project is a free software project that is 
developing a kernel module to provide 3rd-party
file access control. At the moment Dazuko only works
for Linux kernels. However, efforts will soon be
underway to port Dazuko to other operating systems
such as FreeBSD and OpenBSD. Once Dazuko has been
ported to these other UNIX variants, AvGuard will
also be available.

Dazuko currently supports all 2.2.x and 2.4.x
Linux kernels. You will need to compile Dazuko
yourself in order to make use of AvGuard.
Information on how to do this can be found at
the Dazuko Project website:

http://dazuko.org/howto-install.shtml



======================
 Command Line Scanner
======================

The command line scanner can be run with the command:

antivir

For a list of available options, use the --help flag.
Important options include:

--help      print help
--version   print version information
-q          quiet mode
-s          recursive scan
-z          scan within compressed files
-e          repair concerning files (if possible)
--allfiles  scan all files (instead of just program files)
--update    check for a newer version of AntiVir or the
            data files

The command line scanner was designed such that it could
be used with scripts by returning useful exit codes. This
allows users to write their own scripts and/or create
cron jobs with AntiVir. Using --help will show the list
of exit codes.

If --update is used while root, then the full path should
be given for the command (i.e. /usr/lib/AntiVir/antivir
and not ./antivir). When --update is given as root, then
the command line scanner will also properly (and safely)
reload any AvGuard, SAVAPI, and AvMailGate (version 2.0)
daemons that are running if a new version is installed.
If an update is done when the process is NOT root, then
any daemons must be manually restarted.

Keep in mind that if you are using AvGuard (i.e. you are
already scanning files as they are opened, closed, and/or
executed) then using the command line scanner could cause
the files to be scanned twice. The file would first be
scanned by AvGuard as the command line scanner tries to
open the file. Then the command line scanner would scan
the file.

If a key is not found or has expired, the AntiVir software
will run in DEMO mode. This is described above.



==================
 Internet Updates
==================

Internet updates are done using HTTP. If your machine is
running behind an HTTP proxy server, you can configure
AntiVir to use proxy (and other updater options) by
running:

     /usr/lib/AntiVir/configantivir

or manually by editing the /etc/antivir.conf file. Updates
can be handled in two different ways.

1) Automatic Internet Updater
   During installation you had the option of installing
   the Automatic Internet Updater. This is a very simple
   daemon that runs in the background. It sleeps until
   a certain time, calls 'antivir --update' and then
   goes back to sleep. This program was designed for
   people who do not want to worry about configuring
   scripts or cron jobs in order to have updates. You
   can manually start, stop, and see the status of the
   updater daemon with:

   /usr/lib/AntiVir/avupdater start
   /usr/lib/AntiVir/avupdater stop
   /usr/lib/AntiVir/avupdater status

2) Manual Updates (or cron jobs)
   Another way of doing updates is manually using
   'antivir --update'. This command will give you visual
   feedback so you can see what the update is doing.
   However, you can also automate it by putting the
   command in a cron job or within a script. A typical
   cron job entry (in /etc/crontab) would look like this:

   45 6 * * * root /usr/lib/AntiVir/antivir --update -q

   This would cause AntiVir to check for updates every
   day at 6:45 (the -q is so that it runs in quiet mode,
   without any output). You could also write your own
   scripts, which look at the exit code to know if an
   update was successful. Here is a simple script to
   demonstrate this:

------------------ BEGIN SCRIPT -------------------
#!/bin/sh

/usr/lib/AntiVir/antivir --update -q
case $? in
  0)
    echo "AntiVir is up-to-date"
    ;;
  1)
    echo "AntiVir has updated itself"
    ;;
  *)
    echo "AntiVir had an error trying to update"
    ;;
esac
------------------- END SCRIPT --------------------

   If the updater is run as root, then it will do
   more than simply download updated software. It will
   also safely and securely reload any AvGuard, SAVAPI,
   or AvMailGate (version 2.0) processes. This is
   important because although you may have the latest
   AntiVir files, it is important that your
   AntiVir daemons are RUNNING the newest versions.

   You COULD manually restart AvGuard, AvMailGate, and
   SAVAPI, but this would leave a small window in time
   where files would not be scanned. By running the
   AntiVir updater as root, all daemons are updated
   WITHOUT ANY FILES GOING UNSCANNED.

   Note: When running --update as root, it is best to
         give the full path for the command. For example,
         you should call:

             /usr/lib/AntiVir/antivir --update

         and NOT:

             antivir --update

         If you do not include the full path, you
         may get a warning from AntiVir that it could
         not determine the true path of AntiVir and
         it will assume /usr/lib/AntiVir is the
         true path.

   If you do not want the process to always run as
   root, you could use the --check option as a
   regular user (to check for updates):

   /usr/lib/AntiVir/antivir --check --update
   
   Then if an update is available, you could log in
   as root and manually run the updater:

   /usr/lib/AntiVir/antivir --update

   Whenever AntiVir makes an update, it logs this
   information using syslog. If you have specified a
   custom log file, it is also logged into this
   file. Furthermore, if you have specified email
   notifications, it will send an email message
   each time an update was successful or if there
   was an error (email messages are not sent if an
   update was not needed).



==========================
 Testing AntiVir for UNIX
==========================

In order to test your AntiVir installation and configuration,
you can download a test virus. The test virus can be downloaded
from eicar, an organization formed to unite efforts against the
proliferation of malicious code.

http://www.eicar.com

You can test your AvGuard by copying the test virus and seeing
if it successfully detected the event.

example: cp eicar.com eicar2.com

This example would work as long as your AccessMask directive
is set to detect opening and/or closing files. The current
path must also be included as a path that AvGuard will watch.



==============================
 Known and potential problems
==============================

- AvGuard uses a kernel module (Dazuko) to allow on-access
  scanning. Dazuko must be compiled for the specific
  kernel that is running on the system. Be aware that if
  you do a system upgrade, you may also have a new kernel.
  This means that the Dazuko module must be re-compiled
  for this new kernel. Otherwise AvGuard will no longer
  function after the system upgrade.

- If you are running AvMailGate and AvGuard, it is critical
  that AvGuard does NOT watch AvMailGate's SpoolDir and
  TemporaryDir. If AvGuard watches the SpoolDir, then it will
  block access to all concerning files that AvMailGate
  temporarily unpacks from attachments. AvMailGate will
  then be unable to scan the attachments and allow the
  mail to pass through. You can solve this problem by setting
  your AvMailGate SpoolDir and TemporaryDir to a directory
  that is NOT watched by AvGuard.

- It is possible that AvGuard can hang your system during
  shutdown. This occurs if AvGuard is watching system
  directories AND you do not properly shutdown AvGuard
  using the avguard script. When shutting down, Linux usually
  issues a SIG_STOP to all processes. This will freeze all the
  AvGuard daemons, thus not permitting them to do scanning.
  However, the kernel module (Dazuko) is not aware that
  the daemons are stopped and will wait forever (hang) until a
  daemon becomes available. In short, always use the avguard
  script to properly shutdown AvGuard before doing a system
  shutdown. This is a problem with Dazuko that will hopefully
  be resolved soon.

  NOTE: The installation program will ask if you want AvGuard
        to run automatically at startup. If you choose "yes"
        then you should not have to worry about this problem.

- Using multiple kernel modules that intercept file system
  calls can be very dangerous. It is highly recommended that
  AvGuard is NOT used in conjunction with other kernel
  modules that intercept filesystem calls.



============
 Contact us
============

Technical support is available at:
   linux_support@antivir.de

or check out our user forums at:
   http://www.free-av.de/forum

Personal Edition users are encouraged to use the forums.
Please do not hesitate to contact us if you have
discovered any problems or have any suggestions.



==================
 Acknowledgments
==================

This product includes code developed by the
Apache Software Foundation (http://www.apache.org/).
Specifically, the base64 encoding function is used
in proxy authentication. See legal/LICENSE.apache
for Apache licensing information.

This product includes code that was derived from the
RSA Data Security, Inc. MD5 Message-Digest Algorithm.
Specifically, the algorithm is used to partially verify
downloaded files and as a name-hashing algorithm.

The Linux glibc version of this product is a statically
linked binary, meaning that the functionality of the
following libraries has been incorporated into this
product:
   libstdc++-libc6.1-2.so.3
   libm.so.6
   libc.so.6
See legal/LICENSE.lgpl for LGPL licensing information.

The FreeBSD version of this product is a statically
linked binary, meaning that the functionality of the
following libraries has been incorporated into this
product:
   libstdc++.so.3
   libm.so.2
   libc.so.4
See legal/LICENSE.freebsd for licensing information.

The OpenBSD version of this product is a statically
linked binary, meaning that the functionality of the
following libraries has been incorporated into this
product:
   libstdc++.so.30.0
   libm.so.0.1
   libc.so.26.2
See legal/LICENSE.bsd for licensing information.

* By linking this product statically, we are able
  to easily support C++ software (a language that
  has not yet been cleanly adapted by the many
  UNIX versions). In compliance with the various
  licenses, we also offer a dynamically linked
  version of this product that can be provided on
  request. Please direct all inquiries to
  support@antivir.de

