For networks with Servers Windows 2000 Workstations Windows NT/2000/XP Windows 95/98/Me
Technical support
UK (24 hours): USA (24 hours): (+44) 1235 559933 (+1) 888 767 4679 support@sophos.com supportus@sophos.com support@sophos.com.au support@sophos.fr support@sophos.de support@sophos.it support@sophos.co.jp supportasia@sophos.com
Germany (24 hours): (+49) 6136 91193 Italy: Japan (24 hours): (+39) 02 662810 0 (+81) 45 227 1800
FAQs and virus information are available on the Sophos website www.sophos.com If you contact technical support, provide as much information as possible, including Sophos software version number(s), operating system(s) and patch level(s), and the exact text of any error messages.
Copyright 2002, 2003 by Sophos Plc All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording or otherwise without the prior permission in writing of the copyright owner. Any name should be assumed to be a trademark unless stated otherwise. InterCheck and Sophos are registered trademarks of Sophos Plc. 2
Contents
Before you begin Creation of central installation directories 1 Creating the Windows NT/2000/XP central installation directory 2 Creating the Windows 95/98/Me central installation directory 3 Downloading the latest virus identity files (IDEs) Installation on Windows NT/2000/XP 4 Creating the auto-update account 5 Installing Sophos Anti-Virus on the server 6 Using Sophos Anti-Virus 7 Installing Sophos Anti-Virus on the Windows NT/2000/XP workstations Installation on Windows 95/98/Me workstations 8 Installing Sophos Anti-Virus on the Windows 95/98/Me workstations Appendices Appendix 1 Creating a login script Appendix 2 Notes about the installation 52 55 44 16 23 29 31 6 10 14 3
3. If you havent already, write the server name and domain in Appendix 2.
4
5. In the SOPHOS Setup - Installation Type dialog box, click Central installation/update. Click Next.
6. In the SOPHOS Setup - Folder Selection dialog box, click Next to accept the default folders.
7. In the SOPHOS Setup - Installation Options dialog box, ensure Auto-update is selected. Click Next.
8. In the SOPHOS Setup - Auto-Update Mode dialog box, click Non-interactive. Deselect Allow users to postpone auto-update, and ensure the Auto-update check frequency is set to 60 minutes. Click Next.
9. In the SOPHOS Setup - Configuration Details dialog box, click Finish to copy the files to the central installation directory.
You have created the Windows NT/2000/XP CID. If you want to install Sophos Anti-Virus on Windows 95/98/Me workstations on the network, create the Windows 95/98/Me CID (section 2). Otherwise, download the latest virus identity files (IDEs) from the Sophos website (section 3).
9
10
5. In the SOPHOS Setup - Installation Type dialog box, click Central installation/update. Ensure InterCheck for Windows 95/98/Me and InterCheck Monitor are selected. Click Next.
6. In the SOPHOS Setup - Folder Selection dialog box, click the lower Browse button. Browse to the C:\Program Files\Sophos SWEEP for NT folder and click it. Click OK to return to the SOPHOS Setup - Folder Selection dialog box. Type \W95Inst at the end of the path under Sophos Anti-Virus destination folder. Then click Next.
11
7. In the Share Selection dialog box, click OK. In the SOPHOS Setup - Folder Selection dialog box, click Next. 8. In the SOPHOS Setup - Central Installation Options dialog box, select Auto-update and Prevent removal. Click Next.
9. In the SOPHOS Setup - Auto-Update Mode dialog box, click Non-interactive. Click Next.
12
10.In the SOPHOS Setup - Configuration Details dialog box, click Finish to copy the files to the central installation directory.
You have created the Windows 95/98/Me CID. Now download the latest virus identity files (IDEs) from the Sophos website (section 3).
13
14
16
3. In the Administrative Tools window, double-click Active Directory Users and Computers.
4. In the Active Directory Users and Computers window, in the Tree pane, right-click the Users folder to display a menu. Select New, then User.
17
5. In the New Object - User dialog box, in the Full name text box, type SweepUpdateAccount. In the User logon name text box, type SWEEPUPD in capital letters. Click Next.
6. In the next New Object - User dialog box, in the Password text box, type a password. In the Confirm password text box, confirm the password. It is case-sensitive. Deselect User must change password at next logon. Select User cannot change password and Password never expires. Click Next. If this installation guide is stored in a secure place, make a note of the password in Appendix 2.
18
8. In the Active Directory Users and Computers window, you can now see SweepUpdateAccount in the Users list. Close the window.
19
10. In the Local Security Settings window, in the Tree pane, click the plus sign next to Local Policies, then click User Rights Assignment. In the Policy list, double-click Log on as a service.
20
11. In the Local Security Policy Setting dialog box, click Add.
12. In the Select Users or Groups dialog box, in the Name list, click SweepUpdateAccount. Click Add. It is displayed in the lower pane. Click OK.
21
13. In the Local Security Policy Setting dialog box, click OK.
14. Close all windows. You have created the auto-update account. Now install Sophos Anti-Virus from the central installation directory onto the Windows 2000 server (section 5).
22
5. In the SOPHOS Setup dialog box, click Next to continue the installation.
23
6. In the SOPHOS Setup - Folder Selection dialog box, click Next to accept the default folders.
7. In the SOPHOS Setup - InterCheck Support and Network Access dialog box, select InterCheck Client and InterCheck Server. Click Next.
24
8. In the SOPHOS Setup - Installation Options dialog box, ensure Auto-update is selected. Click Next.
9. In the SOPHOS Setup - Auto-Update Account Details dialog box, in the Domain text box, type the domain name. In the Account name text box, type SWEEPUPD in capital letters. In the Password text box, type the case-sensitive password you used in section 4 (see Appendix 2). In the Confirm password text box, confirm the password. Click Next.
25
10. In the SOPHOS Setup - Auto-Update Mode dialog box, click Non-interactive. Deselect Allow users to postpone auto-update, and ensure the Auto-update check frequency is set to 60 minutes. Click Next.
11. In the SOPHOS Setup - Configuration Details dialog box, click Finish to complete the installation. If you see a message about error number 1069, click Back and check you have entered the correct details in the SOPHOS Setup - Auto-Update Account Details dialog box.
26
12. In the SOPHOS Setup message box, click Run Sophos Anti-Virus.
13.In the Sophos Anti-Virus window, click the IC Client tab. InterCheck Client (on-access scanning) is shown as active. In future, you may need it to help with disinfection. However, such scanning can affect server performance. To disable it until it is needed, click STOP.
27
14.Close the Sophos Anti-Virus window. You have installed Sophos Anti-Virus on the server. The central installation directory has been shared automatically as InterChk. Using Sophos Anti-Virus is described in section 6. Installation of Sophos Anti-Virus on Windows NT/2000/XP workstations is described in section 7. Installation of Sophos Anti-Virus on Windows 95/98/Me workstations is described in section 8.
28
The Immediate tabbed page enables you to carry out a virus scan on the computer. Click the GO button to start the scan, and the STOP button to stop it. Drive names that have an illuminated light (i.e. Local hard drives in the screenshot above) are scanned. Click the light to toggle it on and off.
29
By default a virus scan is scheduled for 21.00 every day. If the computer is switched on, Sophos Anti-Virus will scan it for viruses at that time. Use the Add, Remove and Edit buttons to change the times at which a scan takes place. To find out more about the Sophos Anti-Virus window, see the Sophos Anti-Virus Windows NT/2000/XP user manual. Installation of Sophos Anti-Virus on Windows NT/2000/XP workstations is described in section 7. Installation of Sophos Anti-Virus on Windows 95/98/Me workstations is described in section 8.
30
31
5. In the SOPHOS Setup dialog box, click Next to continue the installation.
6. In the SOPHOS Setup - Folder Selection dialog box, click Next to accept the default folders.
32
7. In the SOPHOS Setup - InterCheck Support and Network Access dialog box, select InterCheck Client. Ensure that InterCheck Server and Enable scheduled scanning of network resources are deselected. Click Next.
8. In the SOPHOS Setup - Installation Options dialog box, ensure Auto-update is selected. Click Next.
33
9. In the SOPHOS Setup - Auto-Update Account Details dialog box, in the Domain text box, type the domain name. In the Account name text box, type SWEEPUPD in capital letters. In the Password text box, type the case-sensitive password you used in section 4 (see Appendix 2). In the Confirm password text box, confirm the password. Click Next.
10. In the SOPHOS Setup - Auto-Update Mode dialog box, click Non-interactive. Deselect Allow users to postpone auto-update, and ensure the Auto-update check frequency is set to 60 minutes. Click Next.
34
11. In the SOPHOS Setup - Configuration Details dialog box, click Finish to complete the installation. If you see a message about error number 1069, click Back and check you have entered the correct details in the SOPHOS Setup - Auto-Update Account Details dialog box.
12. In the SOPHOS Setup message box, click Run Sophos Anti-Virus if you wish to view the Sophos Anti-Virus window, or click Exit.
35
SavTest32 creates a file that simulates a virus. Sophos Anti-Virus reports a virus find to the workstation and the server, and confirms that on-access detection/prevention is working. On-access detection/prevention is also known as InterCheck.
If SavTest32 reports that on-access detection/prevention is not functioning correctly, contact Sophos technical support. When you exit from SavTest32, the test file is deleted. You have tested Sophos Anti-Virus.
36
Remember to update Sophos Anti-Virus every month. In addition, you must update Sophos Anti-Virus whenever there is a significant new virus threat. Updating is described in the Sophos Anti-Virus Windows NT/2000 server update guide. You have installed Sophos Anti-Virus on this workstation. Now, either copy Sophos Anti-Virus to multiple Windows NT/2000/XP workstations using SAVAdmin (section 7.3) or install Sophos Anti-Virus on the other workstations one at a time (repeat sections 7.1 and 7.2 at each workstation). To install Sophos Anti-Virus on any Windows 95/98/Me workstations on the network, go to section 8.
37
6. In the SAVAdmin for Windows NT/2000 Self-Extractor dialog box, click Unzip.
7. In the WinZip Self-Extractor message box, click OK to display the SAVAdmin window.
8. In the SAVAdmin window, in the left-hand pane, locate your domain and click it. The computers in the domain are shown in the right-hand pane. The server and the workstation on which you installed Sophos Anti-Virus show Installed in the SAV Installed column.
9. Right-click the name of the workstation on which you installed Sophos Anti-Virus in section 7.1 to display a menu. Select Copy SAV Config.
38
10. In the SAVAdmin message box, click Yes to save the configuration.
11. In the bottom right-hand corner of the Current Copy/Paste SAV Config dialog box, ensure the Domain text box contains your domain name, and that the User name text box contains SWEEPUPD in capital letters. Click OK.
12. In the SAVAdmin window, hold down the Ctrl key and click the names of all the Windows NT/2000/XP workstations on which you would like to install Sophos Anti-Virus. Ensure you click only Windows NT/2000/XP workstations. 13. Right-click one of the selected workstations to display a menu. Select Paste SAV Config.
39
14. In the Task Settings: Install SAV dialog box, click the Account details tab. Click Current login domain. Check that the Domain name is correct. In the User name text box, type SWEEPUPD in capital letters. In the Password text box, type the case-sensitive password you used in section 4 (see Appendix 2). In the Confirm password text box, confirm the password.
If you are copying a configuration to computers outside the current domain, or if they are not part of a domain, you should select a different Domain option. See the SAVAdmin user manual. 15. Click the CID list tab and ensure the correct path to the central installation directory is shown (see Appendix 2 if you are not sure of the path). Click Apply, then click Create. 16. In the SAVAdmin message box, click Yes to start the installation. In the SAVAdmin window you can see the workstations updating. Users see the files being copied onto the workstations. When installation is complete, SAVAdmin shows that the workstations have Sophos Anti-Virus installed. They are protected by InterCheck, which means all files are checked for viruses as they are accessed by the workstations.
40
If the installation is unsuccessful and you tried to install Sophos Anti-Virus on more than one version of Windows (e.g. NT and 2000), try repeating steps 916 for only the workstations that use the same version of Windows as the workstation you used in section 7.1. Then repeat sections 7.17.3 for each of the other Windows versions as necessary. You can use SAVAdmin to monitor workstation installations of Sophos Anti-Virus at any time. Savadmin.exe is located at C:\Program Files\Sophos\SAVAdmin\Ver2.20 For more information about SAVAdmin, see the SAVAdmin user manual. Remember to update Sophos Anti-Virus every month. In addition, you must update Sophos Anti-Virus whenever there is a significant new virus threat. Updating is described in the Sophos Anti-Virus Windows NT/2000 server update guide. You have installed Sophos Anti-Virus on the Windows NT/2000/XP workstations. Now install Sophos Anti-Virus on any Windows 95/98/Me workstations on the network.
41
42
where [servername] is the name of the Windows 2000 server on which you created the central installation directory (CID). 3. If you have installed the SAVAdmin administration tool and want to use it to monitor the Windows 95/98/Me workstations, type the following text as well:
start /wait \\[servername]\InterChk\Savagent.exe -update -poll=3600
and, after installing and testing Sophos Anti-Virus, complete section 8.3.
44
4. Save the file and close Notepad. The next time users log in, installation will take place and InterCheck will scan their workstations. Workstations will automatically check the CID for updates every 60 minutes. Now test Sophos Anti-Virus (section 8.2).
The Sophos Anti-Virus files are copied onto the workstation. When they have been copied, Sophos Anti-Virus warns you that the workstation will restart. When the workstation restarts, InterCheck scans the workstation. Workstations will automatically check the CID for updates every time they reboot. Now test Sophos Anti-Virus (section 8.2).
45
SavTest32 creates a file that simulates a virus. Sophos Anti-Virus reports a virus find to the workstation and the server, and confirms that on-access detection/prevention is working. On-access detection/prevention is also known as InterCheck.
If SavTest32 reports that on-access detection/prevention is not functioning correctly, contact Sophos technical support. When you exit from SavTest32, the test file is deleted. You have tested Sophos Anti-Virus. Remember to update Sophos Anti-Virus every month. In addition, you must update Sophos Anti-Virus whenever there is a significant new virus threat. Updating is described in the Sophos Anti-Virus Windows NT/2000 server update guide.
46
If you installed Sophos Anti-Virus using the method explained in section 8.1.2, and you want to install it on other Windows 95/98/Me workstations on the network, repeat sections 8.1.2 and 8.2 at each workstation. If you have installed the SAVAdmin administration tool and want to use it to monitor the Windows 95/98/Me workstations, go to section 8.3.
47
8.3.1 To copy SAVAgent to the server and run it using the login script
1. At the workstation on which you installed SAVAdmin, at the taskbar, click Start|Programs|Windows NT Explorer (Windows NT) or Start|Programs|Accessories|Windows Explorer (Windows 2000). 2. In Windows Explorer, locate C:\Program Files\Sophos\SAVAdmin\Ver 2.20 and click it. Single-click Savagent.
48
3. On the Edit menu, click Copy. 4. In Network Neighborhood (Windows NT) or My Network Places (Windows 2000), locate \\[servername]\InterChk where [servername] is the name of the Windows 2000 server on which you created the central installation directory (CID). Open the InterChk shared folder. 5. On the Edit menu, click Paste. The file is copied to the InterChk shared folder. The next time users log in, the login script that you edited earlier will place the SAVAgent utility on the Windows 95/98/Me workstations, enabling SAVAdmin to monitor them. For more information about SAVAdmin, see the SAVAdmin installation guide or the SAVAdmin user manual.
11.Locate C:\Windows\Start Menu\Programs\StartUp (Windows 95) or C:\Windows\All Users\Start Menu\Programs\StartUp (Windows 98/Me) and click it. 12. On the Edit menu, click Paste. The file is copied to the StartUp folder. The next time Windows starts, the SAVAgent utility is run on the workstation, enabling SAVAdmin to monitor the workstation. Repeat steps 712 for any other Windows 95/98/Me workstations you would like to monitor using SAVAdmin. For more information about SAVAdmin, see the SAVAdmin installation guide or the SAVAdmin user manual.
50
Appendices
where [servername] is the name of the Windows 2000 server on which you created the central installation directory (CID). If you have installed the SAVAdmin administration tool and want to use it to monitor the Windows 95/98/Me workstations, type the following text as well:
start /wait \\[servername]\InterChk\Savagent.exe -update -poll=3600
52
4. On the File menu, click Save As. In the Save As dialog box, change Save as type to All Files and save the file with the name login.bat. 5. Close Notepad and Windows Explorer (or My Computer).
53
6. In the [user] Properties dialog box (where [user] is the name of the user you right-clicked), click the Profile tab. In the Logon script text box, type login.bat. Click OK.
The next time the user logs in, installation will take place. They will see InterCheck scanning their workstation. Now repeat this procedure for each user to whom you want to assign the login script. Workstations will automatically check the CID for updates every 60 minutes. Now test Sophos Anti-Virus (section 8.2).
54
200206 - g
55