Ikarus Security Software

Language

IKARUS Shop

Take this way for our security solutions

Buy now...
umschalten

Blog

Smartphone-Sicherheit

Mobile Endgeräte sind im Fokus von Cyber-Kriminellen

Read more...

Hacking Prävention und Handling

Leitfaden zum Schutz und zum Verhalten bei Hacking-Angriffen

Read more...

Stuxnet - condensed report

This post is available in German only.

Read more...

joe-job on the social web (web 2.0)

This post is available in German only.

Read more...

IKARUS products FAQ

IKARUS virus.utilities

Quarantined files always appear on the quarantine list even if they are false positives. Will they be automatically restored after a corrected virus-database update has been received?

IKARUS virus.utilities basically does not actually move files; infected files found on a machine are blocked by IKARUS virus.utilities (i.e. they cannot be copied and executed) and will appear on the quarantine list. In case of a false positive, when a correcting database update is received, the quarantine status is automatically canceled. 

 

Which files are scanned when selecting the predefined Removable Media profile?

The Removable Media profile provides for scanning floppy, CD, DVD, HD-DVD, and BlueRay drives.

 

Which files are scanned when selecting the predefined Entire Computer profile?

 The Entire Computer profile provides for scanning all local and USB removable disks.

Which files are scanned when selecting the predefined System Partition profile?

The System Partition profile provides for scanning the system partition. The system partition is the volume containing all hardware-related files Windows requires at boot time.

Which files are scanned when selecting the predefined Fast System Scan profile?

The Fast System Scan profile provides for scanning the Windows\System32 folder on the system partition. In addition, all modules currently loaded are scanned.

I just have uploaded the new license details to IKARUS virus.utilities. The new licenses are now marked with an asterisk. What does that mean?

IKARUS virus.utilities has a built-in “get best license” feature, i.e. it automatically finds and uses the most appropriate license based on the date and runtime. That license is then marked with an asterisk.

Do all scanning profiles respect excluded files and folders, or are there certain profiles ignoring those settings (e.g. the Entire Computer profile).

Exclusions are globally applied, i.e. even when the entire computer is scanned.

Which files or folders should be excluded?

On servers, we recommend configuring exclusions for the paths and processes of databases and mail servers. In addition, we generally recommend adding items for the paths and processes of logging services to the exclusions.

Is it possible to scan network drives using IKARUS virus.utilities?

The live-scanning function provided by IKARUS virus.utilities does not scan network drives. Therefore, we recommend specifically protecting shared network drives using IKARUS virus.utilities.

 
Network drives can be checked by performing an on-demand scan using the following command: C:\Program Files (x86)\Ikarus\virus utilities\bin > virusutilities.exe -SCAN \\SERVER\DIR\. For this purpose, make sure that the GuardX service runs as the user having access permissions for the network drive.

I have just received an e-mail message with my license key for IKARUS virus.utilities. What do I have to do to unlock the software using that key?

Right-click the .IKKEY file attached to the e-mail message to save it to the desktop of your computer. Next, launch IKARUS virus.utilities and select the Licenses item from the Help menu. Click the Add License button and select the license-key file on your desktop. The Licenses dialog will then list the new license key including the owner, expiration date, and validity.

Is there a free test version of IKARUS virus.utilities?

Indeed there is. IKARUS virus.utilities setup is available in the Downloads section on our website. A test license can be selected during the installation process. The required test-license key can be ordered via Licenses section on the website. After you have entered the necessary details, license key will be sent to the specified e-mail address that can then be entered into the software.

IKARUS virus.utilities has reported a virus alert on a file that is known to me. May this be a false positive?

In order to verify whether the file is malware or a false positive, we need to get the physical file. To forward it, right-click the quarantined file and select the Send to Ikarus item from the pop-up menu. If the file has inappropriately been moved to quarantine, it will automatically be restored. If desired, you will also receive an e-mail message with more details.

I have temporarily unblocked a file. Why is that file blocked again after a restart?

When a file is temporarily unblocked, it will be removed from the quarantine list until the next restart only. If you want to permanently exclude that file from being scanned, use the Tools > Settings > Exclusions function. The function allows for excluding individual files as well as entire folders from live scanning and virus scans.

What does the message “A Virus was found on your computer!!” mean?

When a pop-up window containing that message is displayed, either your system has a virus or it is a false alarm. The quarantine list of IKARUS virus.utilities will include the concerned file and also has recommendations about what to do about it. (The recommended functions are available from the quarantine window.)

Which operating systems can IKARUS virus.utilities run on?

  • Windows XP
  • Windows 2003
  • Windows Vista
  • Windows Server 2008
  • Windows 7
 
32-bit and 64-bit systems are supported.

What does the Do Not Scan Files Bigger Than feature do that is accessed via Tools > Exclusions?

Files that are more than 8 MB in size will not be scanned. Virus analyses have shown that, with the exception of infected files, viruses are never larger than 2 MB; this is because otherwise virus distribution would take too much time. By default, the limit is set to 8 MB because this is a good tradeoff between scanning time and security requirements. The contents of archive files are always extracted, and the size limit relates to the sizes of the contained files and not to the compressed archive files.

What happens if a client machine is turned off at the time of a scheduled scan?

The next scan will be performed only the next time it is scheduled for.

Which e-mail programs are supported by the e-mail protection feature?

  • Microsoft Outlook
  • Microsoft Outlook Express
  • Windows Mail

What does the Clean Licenses function do?

Clean Licenses checks the validities (or potential validities if the start date is in the future) of all available licenses. Invalid licenses will be removed; afterwards, only valid licenses will be listed in IKARUS virus.utilities License Manager.

IKARUS security.manager

What does ISMx mean?

ISMx is short for IKARUS security.manager. It is a management tool use for administering a large number of IKARUS virus.utlities instances on client machines.

 

I have just installed ISMx. What do I have to do to deploy the software on the clients?

A number of requirements must be met for successful software deployment:

 

  • Simple File Sharing must be disabled on the client machines.
  • File and Printer Sharing must be enabled on the client machines.
  • TCP port 9887 must be open on the server if the graphical user interface is not run on the server.
  • TCP port 9888 must be open on the server if the clients are to receive updates via TCP.

 

To administer a client, right-click it and select Manage Computer from the pop-up menu. Next, select Install/Update VU to install the software on the client. Complete the process by following the on-screen instructions.

 

 

Which operating systems does ISMx support?

ISMx runs on Windows Server 2003 and Windows Server 2008. The software might run successfully on other systems, too; however, this is not officially supported.

 

When deploying or administering systems using IKARUS security.manager, would be possible to manually uninstall IKARUS virus.utilities, or is that automatically prevented? Is the IKARUS virus.utilities service protected?

IKARUS virus.utilities is protected since the client usually has no permission to terminate the process or on installing the software. To allow for that, a suitable condition must be specified in a relevant company security policy, and employees having appropriate permissions must sign and keep to that policy: They must not uninstall or disable virus protection or specify exclusions that are not covered by the security policy and/or have not been approved by the administrator using IKARUS security.manager.

 

In addition, IKARUS security.manager allows for identifying user groups that are allowed to administer IKARUS virus.utilities. For example, if Domain Admins is selected here, not even a local administrator is allowed to make changes to IKARUS virus.utilities or erase viruses. This can be achieved only using the IKARUS security.manager GUI. Appropriate permissions are required for killing Guardxservice.exe, too. Therefore, the problem should not occur on a “normal” client either.

 

The system does not provide for direct self-monitoring of the service. The Microsoft Services Manager is responsible for that task: Whenever the service has been terminated, it will automatically be relaunched within 60 seconds. 

Is it possible to manipulate the status icon of IKARUS virus.utilities? Users (and even administrators) should not be confused by the fact that the default policy of IKARUS security.manager disables e-mail scanning, which is reflected in the icon.

E-mail monitoring as such is a main feature of IKARUS virus.utilities. Therefore, e-mail monitoring as well as automatic updates are parts of full system protection. To make this more transparent to the user, IKARUS security.manager provides an option to show status messages in the taskbar; it is enabled by default but can be disabled at any time to hide most of the virus-scanner activities from the user.

Can the ISMx database be on a different server (SQL 2005)? And is it a problem if that server is momentarily not available (for example, when rebooting)?

Of course, the database can be moved to an existing SQL server. (That is also advantageous in that the creation of backups has normally already been configured on that SQL server – an aspect that must not be forgotten when using a standalone database.) This only requires changing the “dbconnstring” in the ismx.conf file (after stopping the ISMx service). If no ISMx database is found, ISMx automatically creates it and all required tables. When ISMx cannot access the database, responses to client queries may be delayed as the ISMx cannot detect whether the computer is served by ISMx. 

Shared folders for automatic installation: Which permissions are needed for the ISMx shared folder?

Sharing permissions (as well as NTFS permissions!) should be set to allow read access to all users while the user running the ISM service (which is normally the domain administrator) has write access. (ISM uses the share for access since the share can also be moved to a shared folder on a different server.)

What does the Allow Binary Updates option refer to?

The Allow Binary Updates option specifies whether product updates (in addition to the normal virus database updates) will be made available to the clients. We recommend leaving this option enabled to make sure that the clients always use the latest versions of the scanner, program, and update applications. Thanks to the smart update process, the client software automatically decides, which updates it needs, and is therefore capable of replacing itself. Thus, no user interaction is required even with more recent program versions. What is more, all components are delta updated, i.e. the virus-database, program, and scanner updates are always performed with differential update files to minimize file sizes.

Which external IP addresses does ISMx pull the updates from?

During the update process, ISMx establishes a connection to updates.ikarus.at. Then, an update server is automatically selected – currently one of the servers mirror01…mirror07.ikarus.at. Since the number of update servers may increase in the future, any firewall rules should reference *.ikarus.at.

The ISMx setup provides Administrator and Password text boxes option. What are these?

The Administrator and Password text boxes are provided for computers that are not include in the Active Directory tree of ISM. Normally, we recommend running the ISMx service as a Domain Admin, so the user has appropriate permissions for accessing the clients. Therefore, the boxes may be left empty. However, if you want to add a machine manually, filling in the boxes is required for installation as well as for authenticating communication between IKARUS security.manager and IKARUS virus.utilities.

Warn Error While installing Service ismxstartup on Host WS16: opening Servicemanager: :(1722) The RPC-Server is not available.

When deploying IKARUS virus.utilities clients via ISMx, this error occurs if one or more clients are not available on the network. This can be verified by making sure that the C$ share on the respective machine cannot be accessed.

I just have uploaded the new license details to ISMx. The new licenses are now marked with an asterisk. What does that mean?

ISMx has a built-in “get best license” feature, i.e. it automatically finds and uses the most appropriate license based on the date and runtime. That license is then marked with an asterisk.

What does the Clean Licenses function do?

Clean Licenses checks the validities (or potential validities if the start date is in the future) of all available licenses. Invalid licenses will be removed; afterwards, only valid licenses will be listed in the ISMx License Manager.

What does the string required to integrate a SQL server look like? Which inputs are possible?

DRIVER={SQL Server};SERVER=.\SQLEXPRESS;Trusted_Connection=Yes;

This is the default string used to integrate SQL Server 2005 Express and SQL Server 2008 Express.
 
DRIVER={SQL Server};SERVER=.\;Trusted_Connection=Yes;
This is the default string used to integrate SQL Server 2005 and SQL Server 2008. Specifying a MSSQLSERVER instance name is not neccessary.
 
DRIVER={SQL Server};SERVER=SERVERNAME\INSTANZNAME;Trusted_Connection=Yes;
This string is used to integrate a remote SQL Server over a network.

IKARUS my.mailwall

What is a sender policy framework (SPF) scan?

SPF checks are a protective means against spam mails. An SPF scan allows for verifying whether a sender (i.e. the corresponding IP address) is permitted to send e-mail from a specific domain. This prevents spamming from any domains or anonymous web servers.

An executable file has been falsely detected as a virus. What could be causing this?

The Executable File is Virus option on the Inbound Actions screen is enabled by default. If an executable has been detected as a virus though the function had been disabled, please contact the IKARUS support.

Is it possible to send outgoing e-mail via IKARUS my.mailwall?

To find out about sending outgoing mail through IKARUS my.mailwall, please contact the IKARUS support. If technically possible, the support staff will gladly enable that feature for you.

An e-mail message has been falsely detected as spam. How can that be avoided?

IKARUS my.mailwall performs numerous checks. A specific number of points are assigned during each of these checks. If an e-mail message reaches or exceeds the score configured on the user interface, the message will be marked as spam. To avoid false positives, we recommend excluding senders, whose messages are often marked as spam, from checking using the Inbound Spam Protection > Advanced Anti-Spam function. Note that excluded messages will still be checked for viruses.

A message I expect is listed neither in the Advanced E-Mail Search nor in Greylisting/spf – Blocked Mails. Was that message rejected by IKARUS?

Regardless of whether they have been accepted or rejected, all e-mail messages received by IKARUS my.mailwall will be listed in one of the above log files. If the log files do not contain any matching item, the message has never been received by IKARUS my.mailwall. In this case, please contact the sender to make sure that the message was sent without any problems.

The user interface displays the Delivery Error status for a regular message. Other messages have been accepted by the mail server. Is it possible to view the exact error message on the user interface?

In such case, please contact the IKARUS support. The support staff will provide you with detailed information on the e-mail traffic.

The customer mail server is temporarily unavailable. What about e-mail messages coming in in the meantime?

IKARUS guarantees a storage period of 7 days. Depending on our storage capacities, e-mail messages may be stored for an even longer period. We will repeatedly try to resend undelivered messages in increasing intervals.

A configuration error has occurred on the customer mail server. The mail server has rejected the messages destined to it. Is there a chance that they will still be delivered?

E-mail messages received during the last seven days can be viewed by selecting the Log Entries > Advanced E-Mail Search option on the user interface. Messages listed there can be redelivered. For this purpose, enable the checkbox on the left of the respective message, then click the Resend All Marked Mails item at the bottom of the page.

What does greylisting mean?

Greylisting is a technique for filtering spam messages. For this purpose, an incoming message that has specific characteristics is rejected temporarily with the error code 451 (“spam protection”). If the message is resent at least 40 seconds, but not more than 2 1/2 hours later, IKARUS my.mailwall will accept it and forward it to the target server. A known issue exists with Microsoft Exchange Server 2003 regarding messages that have been rejected using greylisting; however, Microsoft has released a hotfix solving that issue, which is available for download at http://support.microsoft.com/kb/950757/en.

IKARUS web.security

How can I avoid that employees surfing the Internet without using a proxy server?

Outgoing connections over port 80 can be blocked using a firewall. In addition, a rule allowing connections to proxy.mymailwall.com over port 8080 can be configured. All other connections over port 8080 can then be blocked.

IKARUS mobile.security LITE

Where can I get IKARUS mobile.security LITE?

You can search for it in the Android market or follow the link https://market.android.com/details?id=com.ikarus.mobile.security to install via your computer.

How much are the license fees for IKARUS mobile.security LITE?

It is available for FREE via the Android Market.

Which Version of Android is needed?

The application runs on Android OSs from 2.2 (Froyo).

Is it possible to install IKARUS mobile.security LITE on a rooted device?

We do not officially support rooted devices. Since copy protection is used, the application might not be installable on every rooted device.

How do I perform a scan?

Just choose the corresponding option in the menu and select the scan method of your choice. Please consider that a "full scan" could take a while.

How is the virus database being updated?

Updates can be installed manually by tapping the corresponding button, automatic update intervals can be set via "Settings" too.

© 2011 IKARUS Security Software GmbH
Website concept, layout and production by Iphos IT Solutions