ESET REMOTE ADMINISTRATOR V1 Installation guide

Remote Administrator

Overview

Remote Administrator Overview

No part of this document may be reproduced or transmitted in any form or by any

means electronic or mechanical, for any purpose without the express written permission

of ESET LLC. Information in this document is subject to change without prior notice.

Certain names of program products and company names used in this document might

be registered trademarks or trademarks owned by other entities.

ESET, NOD32 and AMON are trademarks of ESET.

Microsoft and Windows are registered trademarks of Microsoft Corporation.

ESET, LLC

610 West Ash Street

San Diego, California 92101

http://www.eset.com

For Sales and Technical Support (US and Canada):

Tel: (619) 437-7037

Fax: +1 (619) 437-7045

Online purchase: http://www.eset.com/purchase/index.php

Sales email:

[email protected]

Technical Support Worldwide:

http://www.eset.com/support/index.php

This guide is frequently updated to reﬂect changes in the product. The latest version can

always be found at http://www.eset.com/download/manual.htm

This guide was prepared referring to NOD32 for Windows Version 2.7 (December 2006)

Remote Administrator Overview

iii

Table of Contents

ESET NOD32 Antivirus Overview __________________________________________ 1

Core ESET NOD32 Antivirus Technology 1

Traditional Signatures 2

Limitations for Signature-based Threat Scanning 2

Heuristics Explained 2

Generic Signatures 3

Passive Heuristics 3

Active Heuristics 4

ThreatSense® - Leveraging all detection 4

The Value of NOD32 5

ESET NOD32 Antivirus - Product Modules ________________________________ 6

NOD32 for Windows Workstations 6

What does ESET NOD32 Antivirus do? 6

Components – Standard Client 7

What is NOD32’s On-Demand Scanner? 8

What is AMON? 8

What is DMON? 9

What is EMON? 9

What is IMON? 10

ThreatSense.Net – Closing the Circle 11

NOD32 Control Center – NOD32 for Windows client 12

Updating ESET NOD32 Antivirus 13

Centrally Managing Clients with NOD32 Remote Administrator______________ 15

Remote Administrator Server (RAS) 17

Remote Administrator Console (RAC) 17

RA Console Capabilities 17

RA Console Panels 18

NOD32 Clients 19

Standard Client – NOD32 for Windows 19

NOD32 LAN Update Server 19

NOD32 Enterprise Edition 19

Remote Administrator Deployment Options for NOD32 ____________________ 20

Remote Installation 20

Remote Installation Process 20

Installation File Set 21

Installation Example 22

Communication among RA Components 23

Remote Administration and the Update Process 24

Updating with LAN Update Server 25

Updates and Server Bandwidth 26

Deployment Options in Larger Networks 26

Configuration and Remote Clients _______________________________________ 28

Configuration with Profiles 29

Scanning Profiles 29

Update Profiles 29

Implementing Configurations, Updates, or On-Demand Scans 30

Remote Administrator Reporting ________________________________________ 32

Index _________________________________________________________________ 35

Remote Administrator Overview

ESET NOD32 Antivirus Overview

ESET NOD32 Antivirus is an award-winning, multi-platform, unified anti-threat system

with a powerful graphical user interface. NOD32 stops more than just traditional viruses

-- it also detects, removes, and prevents these threats:

Adware

RATs (remote access tools)

Spyware

Trojan horses

Worms

Rootkits

Keyloggers

Potentially dangerous applications

These threats could affect the privacy, security, and confidentiality of the information on

a computer. Collectively, they are referred to as malicious software, or malware.

ESET NOD32 uses award-winning technology to detect tomorrow’s threats, in real-time,

by analyzing code execution for malicious intent – keeping you ahead of the malware

writers.

Core ESET NOD32 Antivirus Technology

ESET NOD32 Antivirus employs a unique technology called ThreatSense®, an optimized

scanning engine that looks for threats in four different ways in parallel:

Traditional signatures

Generic signatures

Passive heuristics

Active heuristics

First, let’s take a look at these methods as general concepts...

Remote Administrator Overview

Traditional Signatures

A specific threat has a specific set of bytes that uniquely identifies it.

Searching for that exact pattern of

bytes, an anti-threat tool can find and

identify that specific threat.

Though well suited to exploit

detection, signature scanning is

reactive and based on the

identification of a single object.

Because of this, it has limitations

against today’s advanced threats.

Limitations for Signature-based Threat Scanning

New threats are not detected until signatures are generated. PCs may be vulnerable

for hours, days, or weeks.

Malware writers use achiving and packing techniques to circumvent signature-

based detection. Compressing files hides the malware from signature-based tools.

Only some parts or forms of a complex virus may be detected initially. With a

polymorphic (dynamically changing) virus, some infected files might remain

undetected.

Pattern recognition techniques like signatures work effectively and efficiently for known

threats, but are ineffective for protecting against new threats. Heuristic scanning is the

solution to this problem...

Heuristics Explained

Heuristics is a method that uses rules to solve problems. For anti-threat software,

heuristics are a set of rules used to detect malicious behavior without needing to

uniquely identify the specific threat, as a classic signature-based “virus scanner” does.

Heuristics used by an anti-threat program might have rules to look for things like this:

Something that tries to copy itself into other programs

A program that decrypts itself when run

Code that binds to a TCP/IP port and listens for instructions over a network

connection

A process attempting to manipulate (copy, delete, modify, rename, etc.) files

required by the operating system or applications

Remote Administrator Overview

The advantage of heuristics is it can detect not just variants, or modified forms, of

existing malicious programs, but also new, previously unknown malicious programs.

Generic Signatures

One way to use heuristics to improve signature-based detection is to use generic

signatures. A generic signature is a scan pattern that matches more than one specific

piece of malware, possibly an entire family or set of variants.

Generic signatures help an anti-threat

system measure how similar something

is to known malware. Does it look like

anything we already know?

By looking for similarities, the anti-

threat tool can spot malware it hasn’t

seen before, without requiring a

definitive signature for that specific

threat.

However, Generic signatures may be

too restrictive, only finding threats that

have only minor differences.

Passive Heuristics

Passive Heuristics analyze a program as it is scanned, tracing through the instructions in

a program before passing the code to the processor for execution.

The idea is to analyze the suspicious

code to see what it appears to be

designed to do.

Passive heuristics rules look for

patterns, routines, or program calls that

indicate malicious behavior. This

approach is sometimes called

“code analysis.”

Passive heuristics, though a useful tool,

is very difficult to do well. There is no

single action that a malicious program

can perform that is not also allowed in

a “good” program.

Remote Administrator Overview

Active Heuristics

With active heuristics, the anti-threat system can execute the code to see what it actually

does. Execution occurs in a controlled, protected environment to avoid real damage.

The engine lets the code run in a

virtual environment and examines the

behavior performed in and changes

made to that virtual environment.

Active heuristics are useful in defeating

encryption, compression, and

polymorphic threats. It causes the

malware to “show” what it is designed

to do. This provides immediate

protection, not relying on signatures of

known threats for identification.

Since the code actually runs, it can’t

hide its malicious content.

ThreatSense® - Leveraging all detection

The best anti-threat solution is one that makes intelligent use of all viable detection

methods. That’s the idea behind NOD32’s ThreatSense® technology.

Viruses, worms, and spyware are constantly evolving as malware writers try to

circumvent security software. ThreatSense keeps NOD32 a few steps ahead.

The ThreatSense engine is a sophisticated, well-balanced system of advanced heuristics

and malware signatures, providing the best detection without compromising speed or

detection.

For most existing threats, ThreatSense includes a traditional form of malware signatures.

It also uses next-generation generic signatures to quickly detect known malware families

and their future variants.

Remote Administrator Overview

In addition to traditional and generic signatures, ThreatSense’s advanced heuristics

proactively decode and analyze executable code in a protected environment to identify

increasingly sophisticated malicious behavior, characteristic of today’s evolving threats.

What makes ThreatSense technology so accurate is its ability to perform all these types

of detections in parallel, not only improving its detection but also the speed with which

it operates. ThreatSense’s blended approach to detection leverages the benefits of each

technology and makes NOD32 the fastest, most accurate, and lowest impact solution in

the industry.

The Value of NOD32

If you’re managing thousands of workstations and servers across remote locations, you

need a robust, comprehensive solution you can rely on. NOD32 provides all-in-one

protection, small footprint, and fast performance, regardless of the size of the

organization. ESET NOD32 Antivirus products are advanced and easy on system

resources.

NOD32’s Remote Administrator makes it easy to deploy, monitor, and manage 10,000

machines from a single console. This powerful centralized management console installs

in minutes. An entire network of 500 machines can be installed in just a few hours.

Remote Administrator Overview

ESET NOD32 Antivirus

- Product Modules

NOD32’s broad product platform offers multiple solutions for organizations of all sizes:

Small, medium and large corporations

Government agencies

Educational institutions

Individual users

Proactive protection is available for Microsoft Windows, Linux, and MS DOS desktops and

servers, including file servers and mail gateways. Award-winning ThreatSense®

technology is at the core of each product ensuring the most-advanced protection

regardless of platform or network configuration.

Let’s begin by looking at the advanced protection available for individual workstations...

NOD32 for Windows Workstations

Desktop and mobile PC users can get the anti-threat protection they need with NOD32

without having to sacrifice detection or speed. And NOD32 is one of a very few products

that currently supports Windows® 64-bit systems

NOD32 was designed to perform anti-threat detection and prevention in two different

areas:

On-Access scanning – scanning files and data as they are accessed, safeguarding the

system at the most likely point of vulnerability. On-Access scanning also targets

operations with a specific type of data access (email, HTTP, etc.)

On-Demand scanning – scanning systems (storage, memory, boot sectors, etc.) as a

definitive task, either as desired or as a regularly scheduled operation.

What does ESET NOD32 Antivirus do?

ESET NOD32 Antivirus searches for threats within PCmemory, the system areas of disks,

files stored on those disks, and on HTTP and POP3 communication streams. A number of

different objects can hold viruses or other malware, such as files, archives, self-extracting

archives, run-time packers, and e-mail. NOD32 can open and inspect a variety of archive

file formats, including self-extracting files and files compressed with runtime packers.

NOD32 uses a variety of techniques to detect threats, which allow NOD32 to detect new,

unknown threats that may not have a name yet.

Other manuals for REMOTE ADMINISTRATOR V1

This manual suits for next models

Table of contents

Other ESET Software manuals

ESET

ESET REMOTE ADMINISTRATOR 3 User manual

ESET

ESET NOD32 ANTIVIRUS - FOR KERIO User manual

ESET

ESET NOD32 ANTIVIRUS POUR MS EXCHANGE User manual

ESET

ESET MOBILE SECURITY - ANNEXE 706 SYMBIAN User manual

ESET

ESET CYBERSECURITY - ANNEXE 794 User manual

ESET

ESET GATEWAY SECURITY User manual

ESET

ESET GATEWAY SECURITY User manual

ESET

ESET NOD32 ANTIVIRUS - FOR KERIO User manual

ESET

ESET REMOTE ADMINISTRATOR V1 User manual

ESET

ESET REMOTE ADMINISTRATOR 4 - ANNEXE 335 User manual

ESET

ESET NOD32 ANTIVIRUS - FOR KERIO User manual

ESET

ESET MOBILE ANTIVIRUS - FOR WINDOWS MOBILE User manual

ESET

ESET MAIL SECURITY User manual

ESET

ESET NOD32 ANTIVIRUS - FOR MICROSOFT WINDOWS... User manual

ESET

ESET NOD32 ANTIVIRUS - FOR KERIO User manual

ESET

ESET MOBILE SECURITY - FOR SYMBIAN User manual

ESET

ESET FILE SECURITY User manual

ESET

ESET SMART SECURITY 4 User manual

ESET

ESET FILE SECURITY - ANNEXE 22 User manual

ESET

ESET FILE SECURITY User manual

ESET

ESET NOD32 ANTIVIRUS - FOR KERIO User manual

ESET

ESET NOD32 ANTIVIRUS 4 - FOR MICROSOFT WINDOWS... User manual

ESET

ESET NOD32 ANTIVIRUS - FOR KERIO User manual

ESET

ESET SMART SECURITY 4 User manual

Popular Software manuals by other brands

COMPRO

COMPRO COMPROFM manual

Muratec

Muratec OFFICEBRIDGE ONLINE user guide

Oracle

Oracle Contact Center Anywhere 8.1 installation guide

Adobe

Adobe 65007312 - Photoshop Lightroom Programmer's guide

Avaya

Avaya NULL One-X for RIM Blackberry user guide

HP ProLiant BL420c user guide

PS Audio

PS Audio PowerPlay Programming manual

Brady

Brady LOCKOUT PRO 3.0 Administrator's guide

Avaya

Avaya Interaction Center user guide

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Guide book

Novell

Novell GROUPWISE 8 - INTERNET AGENT manual

Oracle

Oracle Application 9i Configuration guide

Acer

Acer RDM user guide

Canon

Canon Vixia HF21 instruction manual

Canon

Canon ZR950 instruction manual

Samsung

Samsung Auto Backup user manual

Polycom

Polycom Vortex EF2201 Application note

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c user manual