Moving Objects Into Quarantine - KAPERSKY ANTI-VIRUS 5.7 - FOR LINUX FILE SERVER Administrator's Manual

40

5.3. Moving objects into quarantine

You can configure Kaspersky Anti-Virus so that all infected objects will be moved
to a separate quarantine directory.
This ability can be used, for example, if the object could not be disinfected, but
the file itself contains valuable information. For example, only two viruses were
removed, of the three viruses with which the file is infected.
If you plan to keep the directory of these isolated objects within the computer's
file system, you are advised to exclude it from the scope of future scans by
specifying the full path to it as the value for setting ExcludeDirs in the
[scanner.options] section of the configuration file.
The rest of this section discusses the task of isolating infected objects detected
during scans of the computer's file system.
Task: scan all objects listed in file /tmp/download.lst for viruses, and
move any infected objects detected, with the full paths to these ob-
jects, to the directory /tmp/infected. Print information about infected,
suspicious and corrupted objects to the report file.
Solution: to perform this task, do the following:
1. To specify actions on the infected objects, enter the following line in
sections [scanner.object]
configuration file:
OnInfected=MovePath /tmp/infected
2. Turn off disinfection mode (Cure = no) if it is turned on.
3. Enter at the command line:
# /opt/kaspersky/kav4fs/bin/kav4fs-kavscanner –
@/tmp/download.lst –ePASBME –rq –i0 -o
/tmp/report.log –j3 –mCn
Now the task will be made more complex by imposing a requirement to restrict
access to the files in directory /tmp/infected to reading and writing only. This can
be achieved using standard Unix tools (command chmod). The task
implementation should be modified as follows:
Enter the following line in the sections [scanner.object] and
[scanner.container] of the application‟s configuration file, to specify the
rules for processing infected objects:
Kaspersky Anti-Virus ® 5.7 for Linux File Server
and [scanner.container] of the