Real-Time Anti-Virus Protection - KAPERSKY ANTI-VIRUS 5.7 - FOR LINUX FILE SERVER Administrator's Manual

32

4.3. Real-time anti-virus protection

Real-time anti-virus protection of the computer's file system is performed by the
kavmonitor component.
All settings of the kavmonitor component are contained in the [moni-
tor.*] sections of the application's configuration file.
The kavmonitor component is configured so that when another program requires
access to a file (opening, closing or executing), kavmonitor performs an anti-virus
scan: if the action is to close the file, it will be scanned only if it has been altered.
By default, all object types specified by the user will be scanned for viruses and
malware, except:

archives

self-extracting archives

mail databases

e-mail messages.
If a symbolic link is scanned, the link‟s target object will be checked.
This occurs even if the target object is excluded from protection.
If a symbolic link is added to the IncludeDirs list, then it will not be re-
solved by the kavmonitor component.
Based on the scan results, anti-virus object processing is performed using
settings specified in the application's configuration file.
By default, the disinfection of infected objects is disabled! To change
this option, assign the value Yes to the Cure setting in the section
[monitor.options] of the application's configuration file.
For objects with the status Infected, Suspicious, Warning, Error, Protected
and CureFailed, you can configure responses following scanning, including:

moving to a directory – moving objects with a certain status to a directory;
simple and recursive (with restoration of the full path) moving is available;

deleting object from the file system;

performing a command – processing of files using standard Unix script
files, or similar.
You can configure rules for processing objects in the application's configuration
file (section [monitor. actions]).
Kaspersky Anti-Virus ® 5.7 for Linux File Server