F-SECURE CLIENT SECURITY 9.01 - S Manual de instrucciones

RELEASE NOTES

F-Secure Client Security 9.01 Release To Manufacturing (9.01

build 122)

1. General

This document contains late-breaking information about F-Secure Client Security 9.01 product

release, managed with F-Secure Policy Manager 9.00. We strongly recommend you read the

entire document.

Please refer to the on-line help for more information.

There are additional release notes distributed with the F-Secure Policy Manager Setup kit.

Please consult them for the latest information about those components.

What's in This File

-Installation and System Requirements

-Product Contents

-Dropped and Unsupported Features

-New Features

-Fixed Issues

-Known Issues

-Contact Information

2. Installation and System Requirements

2.1.Recommended system requirements

The recommended hardware for F-Secure Client Security 9.01 is:

Microsoft Windows 7 and Vista

-Processor: Intel Pentium 4 2GHz or higher

-Memory: 1GB or more

-Disk space: 800 MB free HD space (500 MB for Anti-virus for Workstations)

-Internet Connection: An Internet connection is required in order to receive updates

Microsoft Windows XP

-Processor: Intel Pentium III 1Gz or higher

-Memory: 512 MB or more

-Operating System: Microsoft Windows XP SP2 or newer

-Disk space: 800MB free HD space (500 MB for Anti-virus for Workstations)

-Internet Connection: An Internet connection is required in order to receive updates

3. Product Contents

This product enables you to install:

-Virus & Spy Protection with Virus protection, Anti-spyware, Email Scanning and Web

Traffic Scanning for viruses, Blacklight scanning for hidden malware and the proactive

0-hour protection technology DeepGuard™.

-Firewall, Application Control, Intrusion Prevention and Dial-up Control.

-Automatic updates enabling you to keep both the databases and the software up-to-

date against the latest threats.

-Browsing Protection with protection against browser exploits and rogue sites.

Supported languages are: English, Czech, Danish, Dutch, Finnish, French, German, Greek,

Hungarian, Italian, Japanese, Norwegian, Polish, Portuguese, Brazilian Portuguese, Slovenian,

Spanish, Swedish and Turkish.

4. Dropped and Unsupported Features

Features that have been dropped since F-Secure Anti-Virus Client Security 8.01 include:

-Security News removed

The security news feature has been removed, since it has not been in active use for

several years.

-System Control: ActiveX protection removed

The ActiveX protection that was part of System Control had been removed. It has been

made completely obsolete by the new Browsing Protection feature.

-Tivoli plug-in and SNMP support removed

The Tivoli plug-in and SNMP support has been removed, to simplify product installation

and to increase performance.

-Removed Virus & Spy protection options

Scanning inside compressed files can no longer be enabled for real-time scanning.

Enabling this setting is not useful in practice, because when a compressed file is

unpacked, the unpacked files will be scanned by real-time scanning and malware

will be detected.

Scanning for spyware can no longer be disabled in real-time scanning settings.

The amount of action options for malware detected by real-time scanning has been

reduced; the new “Handle automatically” (default) is recommended, as it will allow

the product to choose the best action appropriate for a given malware. Also, action

options for viruses and spyware have been merged into a single action option.

5. New Features

New features since release of F-Secure Client Security 8.01 include:

-Windows 7 support

The product can be natively installed on Windows 7.

-New user interface

The look and feel of the whole user interface has been renewed, and the main user

interface has been completely redesigned. It simplifies many of the functions that the

user can perform. By reorganizing the interface into more logical areas, the user is able

to perform related actions more easily.

Similarly, the design of the advanced settings has been restructured into more logical

areas.

-Automatic removal of malware

The user is no longer prompted for actions when malware is found. Instead malware is

automatically removed and the user is notified of this. This behavior can be configured

in “Settings - Virus and spyware scanning”. There are now only two available options

when virus or spyware is found:

oIf unclear, ask me

oAlways ask me

-Action taken when scanning viruses and spyware is unified

Only one decision about the treatment of malware is required. This affects both manual

scans and scheduled scans.

-Removal of Virus and spyware security levels

There are no longer any Virus and spyware security levels. All settings can be

configured individually.

-Refined infection cleaning dialog

The dialog which is presented when a virus is being removed has been refined so it’s

possible to minimize it and use the computer while the infection is being cleaned. The

look and feel of the dialog has also been updated, and an accurate progress bar has

been added.

-Virus and spyware history

From Virus and spyware history, the user can see what has been done to viruses and

spyware that have been found on their computer.

-Scanning performance improvements without sacrificing security

F-Secure's multi-engine protection has been upgraded to offer faster malware scanning

and smaller memory usage while keeping the detection rate on highest possible level.

-Browsing Protection

Browsing Protection protects users from web-based malicious exploits and stops

malware at the first point of infection. All malicious, exploit-hosting URLs it detects are

automatically reported back to F-Secure's Real-time Protection Network, which helps

our Security Labs discover new exploits on the Internet and react to protect all our

existing customers. Browsing Protection also protects against rogue web sites, by

showing the rating of sites directly in the browser.

The Browsing Protection feature can be configured in “Settings - Internet - Browsing

Protection”.

Browsing Protection is supported when using Internet Explorer 6 or newer, or Firefox 2

or newer. Other browsers are not supported at this time.

-DeepGuard no longer dependent on Real-Time Scanning

DeepGuard (previously sometimes referred to as System Control) can now be enabled

even when Real-Time Scanning is disabled.

-DeepGuard Advanced Process Monitoring

Many Trojans and malware try to infect the user’s browser to steal information like

passwords, bank credentials or even money from the user’s online banking session.

DeepGuard has been extended to provide protection against these threats. This can be

configured in “Settings - Computer - DeepGuard - Use advanced process monitoring”.

Advanced Process Monitoring also offers:

oprotection against common browsing control commands

DeepGuard offers protection against controlling browser with OLE and DDE

commands.

oprotection against stopping of F-Secure services

DeepGuard will ask for authorizing the stopping of F-Secure services.

-Real-time Protection Network connectivity

The status of the Real-Time Protection Network connectivity is visible in the Settings –

Other Settings –Connection.

-Possibility to enter Real-time Protection Network proxy server

It’s now possible to configure a specific HTTP proxy for accessing the Real-time

Protection Network.

If no proxy server is configured, the HTTP proxy server configured for AUA will be used

for accessing the Real-time Protection Network (the same behavior as in the Client

Security 8 series). If no AUA HTTP proxy is configured, a direct connection to the Real-

time Protection Network will be used.

Note that there is no local UI support. The setting can only be configured through Policy

Manager Console, Advanced view, Real-time Protection Network Client –Settings –

HTTP proxy.

-Possibility to turn off/on the Real-time Protection Network Client

Access to the Real-time Protection Network can now be turned on or off. Note that any

sub-components that are relying on this (such as DeepGuard and Browsing Protection)

will have either limited functionality or will not work at all.

Note that there is no local UI support. The setting can only be configured through Policy

Manager Console, Advanced view, Real-time Protection Network Client –Settings –

Client is enabled.

-Limited amount of DeepGuard block dialogs per application

Some malware launchers can launch the same malware an infinite amount of times,

which from now on only results in a maximum of 5 blocked dialogs. After this, the

application is blocked silently. At reboot, the counter is reset.

-Fewer Application Control prompts

Application Control now uses the real-time protection network to reduce the amount of

prompts when trusted applications try to connect to the Internet.

-Boot-up optimization

Some components that are active during the boot-up phase have been re-designed to

be less CPU intensive. This results in faster boot-up time.

-Several processes removed

The functionality of the following processes has been merged into other processes:

FSMB32.EXE, FSGUIDLL.EXE, FCH32.EXE, FAMEH32.EXE, fsaua.exe, fsus.exe, and

fsqh.exe.

One new process, FSHDLL32.EXE (and FSHDLL64.EXE on 64-bit operating systems),

has been created for hosting some of the functionality that the above processes used to

offer.

This frees up memory and reduces the total thread count. The end result is 6 processes

less compared to the previous release.

-Dial-up Control is disabled by default

Dial-up Control is now disabled by default. It can still be enabled through the “Settings -

Network connections - Dial-up Control”.

-Participating in Real-time Protection Network

By participating in the Real-time Protection Network, the user contributes anonymous

data to further improve the service.

-Improved interoperability with Web Traffic Scanning

Web Traffic Scanning no longer scans the traffic of all networking applications, and only

the following web browsers are supported by the Web Traffic Scanning feature:

-Microsoft Internet Explorer

-Mozilla Firefox

-Google Chrome

-Opera

-LSP on-demand installation

-The F-Secure LSP (Layered Service Provider) is now only hooked into the TCP/IP stack

if Web Traffic Scanning is enabled. This reduces the likelihood of incompatibility issues

with other software utilizing LSP technology when Web Traffic Scanning is disabled

-Support for remote quarantine management

The clients quarantine repository can now be remotely viewed and managed through

Policy Manager Console.

-AUA Fallback Options

The system administrator can now control whether client tries to connect directly to

Policy Manager Server if Policy Manager Proxy is inaccessible.

The fallback options can be configured through Policy Manager Console, Advanced

view, Automatic Update Agent –Settings –Communications

-Allow fetching updates from F-Secure Update Server

-Allow falling back to PMS if PMP is inaccessible

-AUA Support for PAC and WPAD

Support for automatic configuration of HTTP Proxy using PAC (Proxy Auto

Configuration) scripts or WPAD (Web Proxy Auto-Discovery) has been added.

6. Fixed Issues

Following lists contain all issues reported in maintenance requested by customers that are

included in this version since F-Secure Anti-Virus Client Security 9.00 release.

Disabling local alerting no longer works in CS9 |70739]

ORSP client issues with connecting to the cloud, depending on how http-proxy is configured

[71111]

ORSP not working without DNS resolution of public IPs [70996]

IMAP connections hang in some systems [61452]

Sidegrade false positives in East-Asian Language Windows [62940]

F-Secure cannot be uninstalled by control panel without MSI [71193]

No F-icon in use for "F-Secure Browsing Protection" component in Add/Remove programs list

[69109]

Upgrading Client Security Does not remove old Add/Remove entry [71589]

CS9 not updated properly after upgrade AV4WKS7.11 to CS9 [71425]

Excluded extensions: final restriction has no effect (GUI-issue) [71476]

Ascendancy component System File Update cannot be installed [71617]

Local GUI cannot be opened because of the problem with MS runtime libraries [69914]

No shield on 'Open Event Viewer...' button [71727]

POP3 Emails not received if a RETR command is issued [71728]

7. Known Issues

7.1.Installation and Uninstallation

In some circumstances, the newly installed client does not receive policies immediately

after reboot.

The client will usually recover automatically after some time, and receive the new policy. If not,

a reboot can help.

Unused databases are still visible for some time after upgrade.

In case of an upgrade, some databases and engines used by the previous version might not be

needed anymore. These are still visible in “Settings – Other settings –Downloads”, marked as

“Not Installed”. This is normal, and after 7 days they will be automatically removed.

System might be slow for several minutes after the first reboot while the installation

finishes.

The system might be starting slowly after the initial reboot after installation. This is because the

installation if being finalized in the background, by downloading and installing various updates,

etc.

The effect is more visible during the first reboot after a fresh installation, where more updates

need to be downloaded. The local UI will inform about this if opened by having a blue status

indicator, and a “Completing Installation” status text.

Sub-sequent reboots are not affected.

Check for updates task might be slow if using Internet browser proxy settings [68097]

In case the Automatic Updated Agent is configured to use the browser’s HTTP proxy settings

and the browser is set to automatically detect proxy settings, the “Check for updates” task might

be slow to show the initial dialog.

7.2.Virus & Spy Protection

Counters of scanned and clean files in Statistics not always correct [65977]

The Statistics page in the product’s user interface displays the “Scanned files” and “Cleaned

files” counters under the “Virus and spyware scanning” header. These counters are not always

updated correctly, so the values shown do not correspond to the actual number of files scanned

or cleaned.

Some scenarios where the counters are incorrect include:

When “Quick malware scan” finds multiple infected files and the infected files are quarantined,

the “Cleaned files” counter will only increase by one regardless of how many files were

quarantined.

When spyware is found with manual scanning and quarantined, the “Cleaned files” counter will

not be updated.

When spyware is found by real-time scanning and quarantined, the “Scanned files” and

“Cleaned files” counters will not be updated.

To find out how many files were actually scanned or cleaned, refer to the scanning report and

the “Virus and spyware history” list.

E-mail scanning remains active when real-time scanning is disabled [65735]

When the user disables real-time scanning from the product’s user interface, the “Scan and

remove viruses from e-mails” checkbox will be grayed, indicating that e-mail scanning is also

disabled. In fact, e-mail scanning remains active independently from real-time scanning.

Workaround: in case it is required to disable both real-time and e-mail scanning, first uncheck

the “Scan and remove viruses from e-mails” checkbox, and only then uncheck the “Turn off

real-time scanning checkbox”. Now both features will be disabled. Note that from the product’s

system tray icon it is also possible to select the “Unload” command that will disable all the

product’s protection features.

Multiple entries in “Virus and spyware history” log [65384]

When real-time scanning detects an infected file on the system and it is automatically cleaned,

two or more entries of the same file may appear in the “Virus and spyware history” log. This

happens because an application or the operating system may try to open the same infected file

multiple times, and the event of detecting the infection is logged multiple times. The extra

entries in the log can be ignored.

Files downloaded with MS Internet Explorer (IE) are reported as two files when

scanned [65082]

When a file has been downloaded with MS Internet Explorer (IE) and then scanned with manual

scanning, the number of scanned files may be reported two instead of one (as would be

expected).

This behavior is by design. It occurs because IE attaches an alternative data stream (ADS) to

the downloaded file. This ADS is invisible to the user, but the scanner also scans all ADSes of

files because they may contain malware, and the scanned ADSes are added to the scanned

files counter.

Deleted or quarantined file may remain visible [64229]

Sometimes after the product has reported of a successful removal of an infected file, the file

may still remain visible in Windows Explorer for a while.

This occurs because the file may be opened by another application or the operating system.

The file will become invisible once the other application or the operating system has closed the

file. If this does not happen, the file will be removed after restarting the computer the latest.

Command-line scan may not start while another scan is in progress, with unclear error

message [61247]

When scanning the system is already in progress (e.g. a task “Perform full computer check” is

running), attempt to start a command-line scanning task (with fsav.exe) may fail with error

messages "Error: Cannot start the scan, try again" and "Error: Unknown error".

Due to the design of scanning the system, certain portions of the scanning task cannot be run

simultaneously. As a workaround, try running the scan a few minutes later.

Quarantining action only available for files on local hard disk [61034]

The quarantining action for infected files is only designed to work for files on the local hard disk.

Files on removable media (e.g. USB memory sticks) or remote (network) drives cannot be

quarantined. For example, when manual scanning setting has been set to “Quarantine

automatically” and an infected file is scanned on a USB memory stick, no action will be done

with the file. To remove an infected file from removable media or remote drives, select the

“Delete” action or remove the files manually.

Infected files from restored folder may not get detected [59875]

When a previously deleted folder (as moved to “Recycle Bin”, not permanently deleted)

contained infected files, and the whole folder is being restored, the infected files may remain

undetected when being restored.

This may occur because restoring a folder from “Recycle Bin” is implemented as a simple folder

rename operation, if the folder is located on the same hard disk as the “Recycle Bin” folder.

Real-time scanning does no scan files upon folder rename operations because this would make

such operations much slower. The infected files will be detected and blocked in any case when

being opened or executed from the restored folder, so malware cannot activate on the

computer regardless of this problem.

Progress bar does not account for files scanned inside archives [59503]

Files scanned as packed inside archive files (e.g. zip) are not taken into account in the progress

indicator. For example, if the scanning target includes two equally large zip archives then the

progress bar will remain at 0% until the first of the archives has been completely scanned, at

which point the progress bar will jump to 50%. It will remain at 50% and will jump directly to

100% when the scanning of the second archive file has been completed. If the scanning target

includes a single archive file only then the progress bar will remain at 0% until the scan is

completed.

Infected files dragged and dropped from VMWare host not detected [59093, 59147]

This problem is specific to the product running inside a virtual machine, under the VMWare for

Workstations product.

When a folder with infected files is dragged and dropped from the host computer to the

VMWare guest computer with the Anti-Virus product, infected files thus copied to the virtual

machine may not get detected by real-time scanning. This only happens when complete

folders are copied to the virtual machine: when individual files are copied then real-time

scanning detects the infected files.

Attempts to open or execute the infected files previously copied to the virtual machine will get

detected and blocked by real-time scanning, so malware cannot activate on the computer

regardless of this problem.

Only a single file can be scanned when its shortcut is right-clicked [57568]

In Explorer, the user may select multiple files, then right-click the mouse, and scan the selected

files from the right-click menu. In case one of the selected files is a shortcut file to another file,

and mouse is clicked on top of this shortcut, the right-click menu only allows the single file (to

which the shortcut points) to be scanned, and the other selected files will not be scanned.

Windows Vista: Real-time scanning does not scan files being backed up with the block-

level backup method [56759]

When the hard disks are being backed up with the block-level backup method, the backup

process will not back up the disk file by file, but will read the disk “raw”, sector by sector.

Because of this, real time scanning will not scan the files as they are being backed up, and

infected files will end up in the backup store. Similarly, the infected files may not be detected

by real-time scanning when they are restored from backup.

On Windows Vista, the block-level backup method is used if the user chooses to use the

“Complete PC Backup” option. If the "Back Up Files” option is selected, the chosen files/folders

will be backed up file by file: in this case, real-time scanning will block access to the infected

files, and the backup process will be aborted.

Real-time scanning may interfere with System Restore [56695]

In case virus or spyware infections are present or have previously been present on the system,

the System Restore feature may fail to restore the system to a previous restore point. This may

happen because the real-time scanning feature will block any access to infected files. This

applies both in case System Restore tries to delete an existing infected file, and in case it tries

to restore an infected file from the previous restore point. As System Restore fails to open the

infected file, it will treat this error condition as a fatal error and will abort the restore process.

As a workaround, disable real-time scanning before starting the restore process, and re-enable

it after its completion.

More information about how System Restore is affected by Anti-Virus products is available in

Microsoft’s KB article at http://support.microsoft.com/kb/831829.

Command-line scanner and scheduled scanning tasks may find more spyware than

scanning tasks executed from user interface [55119]

In some cases, the command-line scanner and scheduled scans may find more spyware than

manual scanning task executed from user interface (UI). These two scanning methods are

related because the scheduled scanning tasks actually use the command-line scanner

(fsav.exe). There reason for this is that the scheduled scans run under a different user account

(Local System, as opposed to the currently logged on user account used for UI-started

scanning tasks). The Local System account has access to some folders where the user does

not have access, like the System Restore folder.

Tabla de contenidos

Otros manuales de Software de F-SECURE

F-SECURE

F-SECURE PSB Manual de usuario

F-SECURE

F-SECURE ANTI-VIRUS - FOR MICROSOFT EXCHANGE Guía de referencia rápida

F-SECURE

F-SECURE MOBILE SECURITY FOR S60 - Manual de usuario

F-SECURE

F-SECURE MOBILE SECURITY 6 FOR WINDOWS MOBILE - Manual de usuario

F-SECURE

F-SECURE PSB - ADMINISTRATORS GUIDE FOR RESELLERS Manual de usuario

F-SECURE

F-SECURE MOBILE SECURITY 3.1 FOR SYMBIAN Manual de usuario

F-SECURE

F-SECURE ONLINE BACKUP - WEB USER INTERFACE HELP Manual de usuario

F-SECURE

F-SECURE ANTI-VIRUS FOR MICROSOFT EXCHANGE 9.00 Manual de servicio

F-SECURE

F-SECURE ONLINE BACKUP Manual de usuario

F-SECURE

F-SECURE ANTI-VIRUS FOR MICROSOFT EXCHANGE 8.00 - Manual de usuario

F-SECURE

F-SECURE MOBILE SECURITY 6 FOR WINDOWS MOBILE - Manual de usuario

F-SECURE

F-SECURE CLIENT SECURITY 9.00 - QUICK Manual de usuario

F-SECURE

F-SECURE POLICY MANAGER PROXY 2.0 - Manual de servicio

F-SECURE

F-SECURE ANTI-VIRUS - FOR MICROSOFT EXCHANGE Manual de servicio

F-SECURE

F-SECURE LINUX SECURITY Manual de usuario

F-SECURE

F-SECURE PSB Manual de servicio

F-SECURE

F-SECURE ANTI-VIRUS LINUX CLIENT SECURITY - Manual de servicio

F-SECURE

F-SECURE ANTI-VIRUS FOR MICROSOFT EXCHANGE 6.62 - Manual de servicio

F-SECURE

F-SECURE ANTI-VIRUS FOR MICROSOFT EXCHANGE 9.00 Guía de referencia rápida

F-SECURE

F-SECURE POLICY MANAGER 8.0 Manual de servicio

F-SECURE

F-SECURE INTERNET GATEKEEPER WINDOWS 2000-2003 SERVER 6.61... Manual de servicio

F-SECURE

F-SECURE PSB Manual de usuario

F-SECURE

F-SECURE ANTI-VIRUS FOR MIMESWEEPER - Manual de servicio

F-SECURE

F-SECURE PSB - ADMINISTRATORS GUIDE FOR CUSTOMERS Manual de usuario

Manuales populares de Software de otras marcas

COMPRO

COMPRO COMPROFM Manual de usuario

Muratec

Muratec OFFICEBRIDGE ONLINE Manual de usuario

Oracle

Oracle Contact Center Anywhere 8.1 Manual de usuario

Adobe

Adobe 65007312 - Photoshop Lightroom Manual

Avaya

Avaya NULL One-X for RIM Blackberry Manual de usuario

HP ProLiant BL420c Manual de usuario

PS Audio

PS Audio PowerPlay Manual del propietario

Brady

Brady LOCKOUT PRO 3.0 Manual de servicio

Avaya

Avaya Interaction Center Manual de usuario

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Manual

Novell

Novell GROUPWISE 8 - INTERNET AGENT Manual de usuario

Oracle

Oracle Application 9i Manual de usuario

Acer

Acer RDM Manual de usuario

Canon

Canon Vixia HF21 Manual de usuario

Canon

Canon ZR950 Manual de usuario

Samsung

Samsung Auto Backup Manual de usuario

Polycom

Polycom Vortex EF2201 Instrucciones de instalación y funcionamiento

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Manual de usuario