Table of contents

To the table of contents

Contents

About this Guide

  • In this document
  • Document conventions

Sources of information about the application

  • Sources of information for independent research
  • Discussing Kaspersky Lab applications on the Forum
  • Contacting Technical Writing & Localization

Kaspersky Rescue Disk 10.0

  • What's new
  • Hardware and software requirements

Writing Kaspersky Rescue Disk to a removable drive

Loading Kaspersky Rescue Disk

  • Preparing to load
  • Kaspersky Rescue Disk loading procedure

Working with Kaspersky Rescue Disk in graphic mode

  • Kaspersky Rescue Disk interface
    • Quick Launch Toolbar
    • Application start menu
    • The Kaspersky Rescue Disk main window
    • The application settings window
    • Notification windows and pop-up messages
    • Additional tools
      • File manager
      • Web browser
      • Kaspersky Registry Editor
      • Terminal
      • Screenshot
      • Network setup
  • starting and stopping the application;
    • Starting the application manually
    • Stopping the application manually
  • Computer protection status
  • Objects scan
    • Scanning objects for viruses
    • Starting and stopping the objects scan
    • Creating a list of objects to scan
    • Configuring objects scan settings
      • Changing security level
      • Changing the type of objects to scan
      • Restricting scan duration
      • Scan of compound files
      • Selecting the scan method
      • Changing actions to be performed on detected objects
      • Restoring default scan settings
  • Updates
    • About the update
    • Starting and stopping the update
    • Rolling back the last update
    • Configuring update settings
      • Selecting an update source
      • Selecting the update server region
      • Configuring settings to connect to proxy server
  • Quarantine and Backup
    • About Quarantine
    • About Backup
    • Actions with quarantined objects
    • Storing quarantine and backup objects
  • Reports
    • About reports
    • Selecting task to create a report
    • Managing information grouping in the report
    • Selecting event type
    • Configuring the display of data on the screen
    • Using complex filtering
    • Events search
    • Saving report into file
    • Extended statistics display
    • Configuring report settings
      • Recording non-critical events into the report
      • Storing reports
      • Clearing application reports
  • Threats and exclusions Trusted zone
    • About detected threats
    • Selecting the detectable threat categories
    • About trusted zone
    • Creating trusted zone
    • Creating an exclusion rule
    • Allowed file exclusion masks
    • Allowed exclusion masks according to Virus Encyclopedia
  • Notifications
    • Configuring notification settings
    • Disabling notifications

Working with Kaspersky Rescue Disk in text mode

  • About text mode
  • Working with file manager
    • Network setup
    • Starting the Kaspersky Rescue Disk console
    • Virus scan
    • Kaspersky Rescue Disk update
    • Rolling back the last update
    • Viewing Help
    • Closing Kaspersky Rescue Disk
  • Working with command line
    • Command line syntax
    • Virus scan
    • Kaspersky Rescue Disk update
    • Rolling back the last update
    • Viewing Help
    • Closing Kaspersky Rescue Disk

Restrictions in the application operation

Hardware information

Contacting the Technical Support Service

  • How to get technical support
  • Technical support by phone
  • Obtaining technical support via My Kaspersky Account
  • Creating and saving the trace file

Kaspersky Lab ZAO

Information about third-party code

Notifications about trademarks
© 2011 Kaspersky Lab ZAO. All Rights Reserved.


About this Guide

This document is a Kaspersky Rescue Disk deployment, customization and usage guide. The document is designed for a wide audience. Users need to have basic computer literacy, be familiar with the Microsoft® Windows® operating system and its essential features, and be able to use common software applications.

This guide is intended to:

  • Help user start up Kaspersky Rescue Disk and configure the application based on specific user tasks;
  • Ensure a quick search of information on Kaspersky Rescue Disk-related issues;
  • Describe additional sources of information about the application and ways of cooperating with the Technical Support Service.

In this help section

In this document

Document conventions


In this document

The Kaspersky Rescue Disk User Guide contains information on how to load, configure and work with Kaspersky Rescue Disk.

This document contains the following sections:

Sources of information about the application

This section describes sources of information about the application and lists websites that you can use to discuss the application's operation.

Kaspersky Rescue Disk 10.0

This section describes the application's features and provides brief information about the application's functions and components. This section provides information about software and hardware requirements that a computer should meet to allow a user to install the application on it.

Writing Kaspersky Rescue Disk to a removable drive

This section contains information about how to write Kaspersky Rescue Disk to a removable drive.

Loading Kaspersky Rescue Disk

This section contains instructions which will allow you to download the application and prepare it for work with Kaspersky Rescue Disk.

Working with Kaspersky Rescue Disk in graphic mode

This section describes how to use Kaspersky Rescue Disk in graphic mode. This section contains information about the interface and additional tools in Kaspersky Rescue Disk, and about how to start and stop the application. Here you can find information on computer protection, and how to scan objects for viruses and update anti-virus databases on your computer. Here you can find information about the Quarantine, Backup, and reports, and how to work with them. The section also describes how to configure Kaspersky Rescue Disk.

Working with Kaspersky Rescue Disk in text mode

This section describes how to use Kaspersky Rescue Disk in text mode with Midnight Commander File Manager (© Free Software Foundation, Inc). It contains information about how to scan objects for viruses and update anti-virus databases on your computer. Information about network configuration is also provided.

Hardware information

This section describes how to save information on your system's hardware in electronic form for subsequent transfer to Kaspersky Lab.

Restrictions in the application operation

This section contains information about restrictions in the operation of Kaspersky Rescue Disk.

Contacting the Technical Support Service

This section provides information about how to obtain technical support and what conditions should be met to receive help from the Technical Support Service.

Glossary

This section contains a list of terms mentioned in the document and their respective definitions.

Kaspersky Lab ZAO

This section provides information about Kaspersky Lab ZAO.

Information about third-party code

This section provides information about third-party code used in the application.

Notifications about trademarks

This section presents a list of trademarks owned by the third-party developers that are used in the document.


Document conventions

The text herein is accompanied by semantic elements that should be given particular attention – warnings, hints, examples.

Document conventions are used to highlight semantic elements. Document conventions and examples of their use are shown in the table below.

Document conventions

Sample text

Document conventions description

Note that...

Warnings are highlighted with red color and boxed.

Warnings contain information about possible undesirable actions that could lead to loss of data or hardware or software failure.

It is recommended to use...

Notes are boxed.

Notes may contain useful hints, recommendations, specific values, or important particular cases in the running of the application.

Example:

...

Examples are set out on a yellow background under the heading "Example".

Update means...

The Databases are out of date event occurs.

The following semantic elements are italicized in the text:

  • new terms;
  • names of application statuses and events.

Press ENTER.

Press ALT+F4.

Names of keyboard keys appear in a bold typeface and are capitalized.

Names of keys connected by a + (plus) sign indicate the use of a key combination. Those keys should be pressed simultaneously.

Click the Enable button.

Names of application interface elements, such as entry fields, menu items, and buttons, are set off in bold.

To configure a task schedule:

Introductory phrases of instructions are italicized and accompanied by the arrow sign.

Enter help in the command line.

The following message then appears:

Specify the date in dd:mm:yy format.

The following types of text content are set off with a special font:

  • text in the command line;
  • text of messages displayed on the screen by the application;
  • data that the user should enter.

<User name>

Variables are enclosed in angle brackets. Instead of a variable, the corresponding value should be inserted, with angle brackets omitted.


Sources of information about the application

This section describes sources of information about the application and lists websites that you can use to discuss the application's operation.

You can select the most suitable information source, depending on the issue's level of importance and urgency.

In this help section

Sources of information for independent research

Discussing Kaspersky Lab applications on the Forum

Contacting Technical Writing & Localization


Sources of information for independent research

You can use the following sources to find information about the application:

  • the application page on the Kaspersky Lab website;
  • the application page on the Technical Support Service website (Knowledge Base);
  • help system;
  • documentation.

If you cannot solve an arisen issue on your own, we recommend that you contact the Technical Support Service at Kaspersky Lab.

To use information sources on the Kaspersky Lab website, an Internet connection should be established.

The application page on the Kaspersky Lab website

The Kaspersky Lab website features an individual page for each application.

On such a page, you can view general information about an application, its functions and features.

The application page on the Technical Support Service website (Knowledge Base)

Knowledge Base is the section of the Technical Support Service website that provides recommendations on how to work with Kaspersky Lab applications. Knowledge Base comprises reference articles grouped by topics.

On the page devoted to the application in the Knowledge Base, you can read articles that provide useful information, recommendations, and answers to frequently asked questions on how to purchase, install, and use the application.

The articles may provide answers to questions related not only to Kaspersky Rescue Disk, but to other Kaspersky Lab applications. They also may contain news from the Technical Support Service.

Help system

The online help of the application comprises help files.

The context help provides information about each window of the application, listing and describing the corresponding settings and a list of tasks.

The full help provides detailed information about how to manage the computer's protection using the application.

To open the electronic help files, click the Help link.

Documentation

The Kaspersky Rescue Disk User Guide contains detailed information required for working with the application. The file is supplied with Kaspersky Rescue Disk in PDF format.


Discussing Kaspersky Lab applications on the Forum

If your question does not require an urgent answer, you can discuss it with Kaspersky Lab specialists and other users on our Forum.

In this forum you can view existing topics, leave your comments, create new topics.


Contacting Technical Writing & Localization

Please address any questions regarding the documentation of the application to the Technical Writing Group. For example, you can send feedback and comments on the documentation.

Send an email message with your comments and questions to the Technical Writing Group: docfeedback@kaspersky.com. Specify "Kaspersky Help Feedback: Kaspersky Rescue Disk 10.0" as the subject of the message.


Kaspersky Rescue Disk 10.0

Kaspersky Rescue Disk scans and cures infections on computers running a 32 or 64-bit version of Microsoft Windows. The application should be used when the infection is at such level that it is impossible to disinfect the computer using anti-virus applications or malware removal utilities (such as Kaspersky Virus Removal Tool) running under the operating system. In this case, a higher degree of efficiency of the disinfection is achieved since malware programs do not gain control when the operating system is being loaded.

In system rescue mode only object scans and database updates are available as well as update rollback and viewing of statistics. You can perform the following actions:

  • Configure settings to scan objects for viruses:
    • change security level
    • change an action to be performed when a threat is detected;
    • Create a list of objects to scan;
    • change the type of objects to scan;
    • restrict scan duration;
    • specify settings for scanning compound files;
    • select a scan method;
    • restore default scan settings.
  • Configure update settings:
    • select update source;
    • configure proxy-server connection settings;
    • select the region of the update server;
    • roll back to the previous update.
  • Configure additional settings:
    • select categories of threats to detect;
    • create trusted zone;
    • configure notification settings;
    • set period for storing report files;
    • configure settings for storing objects in Quarantine and Backup.
  • Generate report on scan and update tasks.
  • View application statistics.

In this help section

What's new

Hardware and software requirements


What's new

Kaspersky Rescue Disk contains the following innovative features:

  • Network settings, including Wi-Fi, have been simplified.
  • The operating system loader has been modified.
  • The operating system kernel has been modified.
  • The third-party application packages have been updated.
  • A set of third-party application packages has been added.
  • Kaspersky Registry Editor has been added.


Hardware and software requirements

For Kaspersky Rescue Disk to run properly, the computer should meet the following minimum requirements:

General requirements:

  • CD-ROM / DVD (to install Kaspersky Rescue Disk from the installation CD).
  • USB socket (to install Kaspersky Rescue Disk from a removable boot drive).
  • Writing CD-ROM / DVD (for writing Kaspersky Rescue Disk image).
  • Support for booting from USB and CD / DVD.
  • Support for file systems FAT32/NTFS/Ext2/Ext3/Ext4/Reiser.
  • VESA-compatible video card.

Requirements for Microsoft Windows XP Home Edition (Service Pack 2 or higher), Microsoft Windows XP Professional (Service Pack 2 or higher), and Microsoft Windows XP Professional x64 Edition (Service Pack 2 or higher):

  • Intel® Pentium 300 MHz processor or higher (or a compatible equivalent).
  • 256 MB free RAM.

Operating system requirements for Microsoft Windows Vista® Home Basic (32/64-bit), Microsoft Windows Vista Home Premium (32/64-bit), Microsoft Windows Vista Business (32/64-bit), Microsoft Windows Vista Enterprise (32/64-bit), Microsoft Windows Vista Ultimate (32/64-bit):

  • Intel Pentium 800 MHz 32-bit (x86) / 64-bit (x64) processor or higher (or a compatible equivalent);
  • 512 MB free RAM.

Operating system requirements for Microsoft Windows 7 Starter (32/64-bit), Microsoft Windows 7 Home Basic (32/64-bit), Microsoft Windows 7 Home Premium (32/64-bit), Microsoft Windows 7 Professional (32/64-bit), Microsoft Windows 7 Ultimate (32/64-bit):

  • Intel Pentium 1 GHz 32-bit (x86) / 64-bit (x64) processor or higher (or a compatible equivalent).
  • 1 GB free RAM (for 32-bit operating systems); 2 GB free RAM (for 64-bit operating systems).


Writing Kaspersky Rescue Disk to a removable drive

To write Kaspersky Rescue Disk to a USB device, we recommend the Create Rescue Disk Wizard, which is bundled with Kaspersky Anti-Virus and Kaspersky Internet Security versions 2011, 2012 and 2013. Users unable to use these applications should refer to the relevant article on Kaspersky Lab's Technical Support website at: http://support.kaspersky.com/usb.

Preparing to write

Kaspersky Rescue Disk can write an .iso image to a CD / DVD or to a removable drive. To write Kaspersky Rescue Disk, format your removable drive in the Fat16 or Fat32 file system and make it a boot drive.

Even on small capacity USB drives, formatting takes some time (the larger the capacity, the longer the scan takes). Wait until formatting is finished.

To create a bootable removable drive, use the following applications (for example, you can use Diskpart (© Microsoft Corporation) for Microsoft Windows XP, and HP USB Disk Storage Format Tool (© Hewlett-Packard Development Company, L.P) for Microsoft Windows Vista / Microsoft Windows 7 .


Loading Kaspersky Rescue Disk

This section contains instructions on how to download the application and run it with Kaspersky Rescue Disk.

In this help section

Preparing to load

Kaspersky Rescue Disk loading procedure


Preparing to load

Before booting Kaspersky Rescue Disk:

  1. Enable booting from CD/DVD-ROM or a removable drive in BIOS settings (for more details please refer to the documentation for the motherboard installed on your computer).
  2. Insert the disk / removable drive with the Kaspersky Rescue Disk image into the CD/DVD-ROM drive or USB port.
  3. Restart your computer. After reboot, a message will appear on the screen: Press any key to enter the menu.
  4. Press any key. A loading Wizard will start.

    If you do not press any key in 10 seconds, the computer boots from hard drive automatically.


Kaspersky Rescue Disk loading procedure

To continue loading Kaspersky Rescue Disk:

  1. In the Startup Wizard window that opens, use the cursor keys to select the language of the interface. Press ENTER.
  2. Carefully read the License Agreement. You must accept the terms and conditions of the License Agreement to continue. To do so, press 1 on the keyboard.
  3. In the Wizard window, select one of the following operating modes and press ENTER:
    • Kaspersky Rescue Disk. Graphic mode

      In this mode, the application loads a graphic subsystem.

    • Kaspersky Rescue Disk. Text mode

      In this mode, the application loads Midnight Commander, a console file manager with a text user interface.

    • Boot from Hard Disk.

      For some hardware and software configurations booting from hard drive is not available. In this case, remove your removable drive from the USB socket, reboot and make sure that in BIOS settings the hard drive with operating system is specified as a boot device.

    • Hardware information

      Get and save information about hardware installed on your computer.

    • Restart computer
    • Shutdown computer

If you opted to load Kaspersky Rescue Disk in graphic or text mode, pressing the ENTER key boots the Linux® operating system; all devices are detected, and file systems on hard disk and removable devices are searched. The names used in the installed operating system are assigned to all file systems and removable drives.

If you are running Microsoft Windows and it is in sleep mode or did not shut down properly, Kaspersky Rescue Disk prompts you to mount the file system or reboot the computer. Select one of the following three actions:

  • Continue. Kaspersky Rescue Disk continues to mount the computer's file system. However, this could damage the file system.
  • Skip. Kaspersky Rescue Disk does not mount the file system. Only boot sectors and autorun elements will be scanned.

    Some file systems can be mounted.

  • Restart computer. The computer restarts from the hard disk so that the operating system can be shut down properly.

Kaspersky Rescue Disk continues to load as follows:

  1. Searching the Microsoft Windows swap file pagefile.sys. If it is missing, the volume of the virtual memory is limited by the size of the RAM.
  2. Folders for anti-virus databases, reports, Quarantine and additional files are created.
  3. Network connections are configured based on data found in system files of the computer being loaded.
  4. If graphic mode was selected, Kaspersky Rescue Disk starts; if text mode was selected, Midnight Commander starts with an open user menu.


Working with Kaspersky Rescue Disk in graphic mode

This section describes how to use Kaspersky Rescue Disk in graphic mode.

In this help section

Kaspersky Rescue Disk interface

Starting and stopping the application

Computer protection status

Objects scan

Update

Quarantine and Backup

Reports

Threats and exclusions Trusted zone

Notifications


Kaspersky Rescue Disk interface

This section contains information about the interface and additional tools in Kaspersky Rescue Disk.

In this section:

Quick Launch Toolbar

Application start menu

The Kaspersky Rescue Disk main window

The application settings window

Notification windows and pop-up messages

Additional tools


Quick Launch Toolbar

The Quick Launch Toolbar is a panel located in the bottom part of the desktop that contains the following icons:

  • – clicking this icon opens the Kaspersky Rescue Disk application start menu.
  • – clicking this icon opens the web browser window.
  • – clicking this icon opens the File manager window.
  • – clicking this icon opens theKaspersky Rescue Disk main window.
  • – clicking this icon opens the Network setup window.


Application start menu

The Application start menu (see the figure below) contains the following items:

  • Kaspersky Rescue Disk – starts Kaspersky Rescue Disk.
  • Kaspersky Registry Editor – starts the registry editor of the operating system installed on the computer.
  • Web browser – starts the Konqueror web browser (© KDE e.V).
  • File manager – starts the Dolphin file manager (© KDE e.V).
  • Terminal – starts the Linux operating system console.
  • Screenshot – copies the screen as it is displayed on the monitor and indicates the path to the saved file.
  • Network setup – opens the Network setup window.
  • About Kaspersky Rescue Disk – opens the window containing information on Kaspersky Rescue Disk version.
  • Restart – starts the process to reboot the computer.
  • Shut down – opens the computer shutdown confirmation window.

    Kaspersky Rescue Disk Application start menu

    Kaspersky Rescue Disk Application start menu

To open the Application start menu,

click the


The Kaspersky Rescue Disk main window

The main application window contains interface elements that provide access to all the main features of the application.

The main window can be divided into two parts:

  • The top part of the window contains the protection status indicator, which informs you of your current computer protection status.

    Current computer protection status

    Current computer protection status

    There are three possible protection status values: each one is indicated by a color. Green indicates that your computer’s protection is at the correct level, while yellow and red indicate that there are various security threats. In addition to malicious programs, threats include obsolete application databases, protection settings are at minimum, etc.

    Security threats must be eliminated as they appear.

  • The central part of the window allows you to switch between tasks to scan objects for viruses or update databases and application modules. To do so, select the Objects scan or Update tab.

    On the Objects Scan tab (see the figure below), you can:

    • start / stop the objects scan;
    • Create a list of objects to scan;
    • monitor the progress of the scan task and view the results.

    The main window. The Objects Scan tab

    The main window. The Objects Scan tab

    On the Update tab (see the figure below), you can:

    • start / stop the update task;
    • view the virus activity report, by clicking the corresponding link.
    • roll back the updates;
    • get status reports and database release information.
    • monitor the progress of the database or module update task.

    The main window. The Update tab

    The main window. The Update tab

You can also use the following buttons and links:

  • Settings – open the application settings window.
  • Quarantine – switch to Quarantine.
  • Report – enable operational reports in diagram format.
  • Help – open the Kaspersky Rescue Disk help files.
  • Exit – exit Kaspersky Rescue Disk.

To open the main application window, perform one of the following actions:

  • Select Kaspersky Rescue Disk in the Application start menu.
  • Click the [image] icon in the Quick Launch Toolbar.


The application settings window

The Kaspersky Rescue Disk settings window is used to configure the scan and update settings, and to configure settings to run other tasks.

The application settings window consists of two parts:

  • in the left part of the window, you can choose the task or other component to be configured.
  • the right part of the window contains the controls that you can use to configure the item selected in the left part of the window.

The tasks and other components in the left part of the window are grouped into the following sections:

Objects scan;

Update;

Settings;

Threats and exclusions;

Notifications;

Reports and Storages;

To open the configuration window,

click the Settings link in the top part of the main application window.


Notification windows and pop-up messages

Kaspersky Rescue Disk notifies you of any significant events that occur during its operation using notification windows and pop-up messages.

Kaspersky Rescue Disk displays notification windows on screen when you are required to select an action in connection with the event. The application prompts you to select one of the available actions. A notification window only disappears from the screen if you select one of the actions.

Pop-up messages are displayed by Kaspersky Rescue Disk in order to inform you of events that do not require you to select an action. Pop-up messages automatically disappear from the screen soon after they appear.

Depending on how critical the event is for computer security, you might receive the following types of notifications:

  • Critical notifications – inform you of events of critical importance from a computer security standpoint: for example, detection of a malicious object or dangerous activity in the system. Pop-up messages of this type are displayed in red.
  • Important notifications – inform you of events which are potentially important from a computer security standpoint: for example, detection of a potentially infected object or suspicious activity in the system. Pop-up messages of this type are displayed in yellow.
  • Information notifications – inform you of events that are non-critical from a security standpoint. Pop-up messages of this type are displayed in green.


Additional tools

To ensure maximum operability, Kaspersky Rescue Disk incorporates various additional tools.

In this section:

File manager

Web browser

Kaspersky Registry Editor

Terminal

Screenshot

Network setup


File manager

The integrated Dolphin file manager is developed by K Desktop Environment incorporated society (KDE e.V.). It features an intuitive user interface. Dolphin provides many useful functions for working with files.

Project homepage: http://dolphin.kde.org


Web browser

The Konqueror web browser, bundled with Kaspersky Rescue Disk, is developed by K Desktop Environment incorporated society (KDE e.V.). It provides convenient viewing of local and network folders, and online web pages. Pages can be saved and reloaded after you finish working with Kaspersky Rescue Disk.

Project homepage – http://www.konqueror.org

To access web pages via the integrated Konqueror web browser, a local network connection is required (Local Area Network connection). You can configure a proxy-server connection in the web browser settings. By default, the browser window opens at Kaspersky Lab's official website.


Kaspersky Registry Editor

Kaspersky Registry Editor is used to edit the registry of the Microsoft Windows operating system.


Terminal

The Terminal is a Linux operating system console for working with the command line in graphic mode.


Screenshot

This tool can be used to save a screenshot of the desktop as it appears on the monitor, and to view the path to the saved file.


Network setup

KNetworkManager, bundled with Kaspersky Rescue Disk, is developed by K Desktop Environment incorporated society (KDE e.V.). It allows you to configure a local network, Wi-FI network, or DSL and PPP connections.

You can also configure individual settings for a proxy-server connection to run task updates and to access web pages using the Konqueror web browser.


Starting and stopping the application

After Kaspersky Rescue Disk is loaded in graphic mode, the application starts automatically.

In this section:

Starting the application manually

Stopping the application manually


Starting the application manually

To start Kaspersky Rescue Disk manually:

  • Click the [image] icon located in the Quick Launch Toolbar.
  • Click the [image] icon located in the Quick Launch Toolbar. In the Application start menu that opens, select [image] Kaspersky Rescue Disk.


Stopping the application manually

To stop Kaspersky Rescue Disk manually:

  1. Open the main application window and click the Exit button.
  2. Confirm the action in the prompt window.


Computer protection status

Problems with computer protection are indicated by the computer protection status indicator located in the top part of the main application window. The indicator changes color depending upon the computer's protection status: green means that the computer is protected, yellow indicates protection-related problems, red warns of serious threats to computer security. You are advised to fix the problems and security threats immediately.

Current computer protection status

Current computer protection status

Clicking the indicator icon in the main application window opens the Protection state window (see the figure below) containing detailed information about the status of computer protection and troubleshooting suggestions for the detected problems and threats.

The Protection state window. The Status tab

The Protection state window. The Status tab

The Status tab of the Protection state window lists protection-related problems, including those caused by deviations from normal product operation (for example, outdated databases). To address the issues, the product offers the following options:

  • Eliminate immediately. Clicking the corresponding buttons will take you to the appropriate problem solution. This is the recommended action.
  • Postpone elimination. If, for whatever reason, immediate removal of the problem is not possible, you can postpone this action and return to it later. To do this, click the Hide message button.

    Note that postponing the removal is not available for serious problems. Such problems include, for example, the presence of uncured malicious objects, operational glitches, and damage to program files.

To display the notifications hidden earlier in the common list, check the Show hidden messages box, which appears in the bottom part of the tab when there are hidden messages.

You can use the Detected threats tab to view the list of revealed malware and riskware and select the operation which will be performed with regard to these objects (e.g., move to Quarantine). To select an operation, use the controls below the list or the context menu for the listed records.

On the Report tab you can review the application activity report.


Object scan

This section contains information about how objects on your computer are scanned for viruses using Kaspersky Rescue Disk and how to configure scan task settings.

In this section:

Scanning objects for viruses

Starting and stopping the objects scan

Creating a list of objects to scan

Configuring objects scan settings


Scanning objects for viruses

To the table of contents

About scanning objects for viruses

Virus scan is one of the most important tools for protecting your computer. It is necessary to scan your computer for viruses on a regular basis in order to rule out the possibility of spreading malicious programs that have not been discovered by protection components, for example, because of a low security level set, or for other reasons.

By default, when a scan task is started, Kaspersky Rescue Disk scans only boot sectors and hidden autorun objects for viruses. You can edit this list as necessary. Kaspersky Rescue Disk can be used to scan any file system object on the computer for viruses.

Logical drives which are not assigned a name in Microsoft Windows will be displayed in the following way: sdbN, where N – is a number assigned to disk by Kaspersky Rescue Disk (see the figure below).

Displaying logical drives in Microsoft Windows without an assigned drive name

Displaying logical drives in Microsoft Windows without an assigned drive name

By default, the objects scan task is executed in accordance with the optimal settings recommended by Kaspersky Lab. These settings make up the Recommended security level. You can perform the following actions:

  • raise or lower the security level;
  • define types of files to scan;
  • restrict scan duration;
  • specify settings for scanning compound files;
  • select a scan method;
  • select an action to be performed when a threat is detected.

    When configuring scan task settings, you can always return to the recommended settings.

The progress of the scan task is displayed on the Objects scan tab in the main window and in the Objects scan window.

Kaspersky Rescue Disk also generates a progress report on the scan task, which can be viewed by clicking the Report link in the top part of the main window.


Starting and stopping the objects scan

To start an objects scan task:

  1. Open the main application window.
  2. On the Objects Scan tab, click the Start Objects Scan button.

To stop the objects scan task:

  1. Open the main application window.
  2. On the Objects Scan tab, click the Stop Objects Scan button.

In the window that opens, you can monitor the progress of the scan task and view the results.


Creating a list of objects to scan

To create a list of objects for an object scan task:

  1. Open the main application window.
  2. On the Objects Scan tab, click the Add link.
  3. In the Select object to scan window that opens, select the desired object and click the Add button. Click the OK button after you have added all the objects you need.

    If an object to be added contains subfolders that also need to be scanned, check the Include subfolders box.

On the Objects Scan tab, you can also:

  • Change a list object (only for objects added by users).

    Select the object and click the Change link. In the Select object to scan window that opens, make the necessary changes.

  • Temporarily disable scanning of a list object.

    Select the object and uncheck the adjacent box. The scan task is not performed for this object until the box is rechecked.

  • Delete an object (only for objects added by users).

    Select the object and click the Delete link. Confirm the action in the prompt window.

Objects which appear on the list by default cannot be edited or deleted. If the list of objects to scan is empty or the boxes next to all the objects are unchecked, the objects scan task cannot be started.

F


Configuring objects scan settings

To configure the settings of the objects scan task, you can:

  • Change security level.

    The security level is a preset collection of scan settings. The objects scan task is executed at one of the following security levels:

    • High – at this security level the whole computer or an individual disk, folder or file is scanned in full. Recommended if you suspect that your computer is infected with a virus.
    • Recommended – the security level recommended by Kaspersky Lab.
    • Low – at this security level the number of files to scan is reduced, allowing you to work with resource-heavy applications that require a considerable amount of RAM.

    By default, the objects scan task is executed at the Recommended security level. You can raise or lower the security level by selecting High or Low, respectively, or by changing the settings of the existing security level.

  • Specify the types of objects to scan.

    Specifying the type of objects to scan establishes which file formats and sizes are to be scanned for viruses when the selected scan task runs.

  • Restrict scan duration.

    You can set a restriction on the scan duration for any one object. When the specified time interval expires, the object will be excluded from the current scan (except for archives and files comprised of several objects).

  • Specify settings for scanning compound files.

    A common method of concealing viruses is to embed them into compound files: archives, installation packages, embedded OLE objects, and mail file formats. To detect viruses that are hidden this way a compound file should be unpacked, which can significantly lower the scan speed.

    You can select the type of compound files to be scanned. Besides, you can specify a maximum size for a compound file to be scanned. Compound files with the size larger than the specified value will not be scanned.

  • Select a scan method.

    During a virus scan, signature analysis is always used: Kaspersky Rescue Disk compares the object found with the database records.

    To enhance the scan, heuristic analysis is used to examine the activity of the object in the system.

  • Select an action to be performed when a threat is detected.

    If a threat is detected, Kaspersky Rescue Disk assigns it one of the following statuses:

    • malicious program (such as a virus or a Trojan);
    • potentially infected status when the scan cannot determine if the object is infected.

    Kaspersky Rescue Disk will notify you if it detects infected or potentially infected objects during a virus scan. You should react to an emerging threat by selecting an action to be performed on the object. Kaspersky Rescue Disk selects the Prompt when the scan is complete option as the action on a detected object which is the default setting. You can change the actions to be performed when a threat is detected.

  • Return to the recommended scan task settings.

    These settings are considered optimal, recommended by Kaspersky Lab, and grouped in the Recommended security level.


Changing security level

To change the defined security level, perform the following actions:

  1. Open the main application window.
  2. Click the Settings link in the top part of the main window and open the Settings window.
  3. In the left part of the window, select the Objects scan section.
  4. In the right part of the window, in the Security level section, set the desired security level, or click the Settings button to modify the settings manually.

    If you modify the settings manually, the name of the security level will change to Custom.


Changing the type of objects to scan

To change the type of scanned objects:

  1. Open the main application window.
  2. Click the Settings link in the top part of the main window and open the Settings window.
  3. In the left part of the window, select the Objects scan section.
  4. In the Security level section in the right part of the window click the Settings button.
  5. In the Objects scan window that opens, on the Scope tab in the File types section, select the desired option.

When selecting file types, please remember the following:

  • The probability of malicious code penetrating some file formats (such as TXT) and its subsequent activation is quite low. However, there are formats that contain or may contain an executable code (such as EXE, DLL, DOC). The risk of penetration and activation of malicious code in such files is quite high.
  • An intruder can send a virus to your computer in an executable file renamed as a TXT file. If you have selected scanning of files by extension, such a file is skipped by the scan. If scanning of files by format is selected, then, regardless of the extension, Kaspersky Rescue Disk will analyze the file header and reveal that the file is an EXE file. Such a file would be thoroughly scanned for viruses.


Restricting scan duration

To set a restriction on scan duration:

  1. Open the main application window.
  2. Click the Settings link in the top part of the main window and open the Settings window.
  3. In the left part of the window, select the Objects scan section.
  4. In the Security level section in the right part of the window click the Settings button.
  5. In the window that opens, on the Scope tab in the Scan optimization section, check the Skip files scanned longer than box and specify the scan duration for a single file.


Scanning of compound files

To modify the list of scanned compound files:

  1. Open the main application window.
  2. Click the Settings link in the top part of the main window and open the Settings window.
  3. In the left part of the window, select the Objects scan section.
  4. In the Security level section in the right part of the window click the Settings button.
  5. In the window that opens, on the Scope tab in the Scan of compound files section, select the desired types of compound files to be scanned.

To set the maximum size of compound files to be scanned, please do the following:

  1. Open the main application window.
  2. Click the Settings link in the top part of the main window and open the Settings window.
  3. In the left part of the window, select the Objects scan section.
  4. In the Security level section in the right part of the window click the Settings button.
  5. In the window that opens, on the Scope tab in the Scan of compound files section, click the Additional button.
  6. In the Compound files window that opens, check the Do not unpack large compound files box and specify the maximum file size.

    When large files are extracted from archives, they will be scanned even if the Do not unpack large compound files box is checked.


Selecting the scan method

To the table of contents

Selecting a scan method

To change the scan method:

  1. Open the main application window.
  2. Click the Settings link in the top part of the main window and open the Settings window.
  3. In the left part of the window, select the Objects scan section.
  4. In the Security level section in the right part of the window click the Settings button.
  5. In the window that opens, on the Additional tab in the Scan methods section, check the boxes next to the names of the required scan methods and select the level of detail.


Changing actions to be performed on detected objects

To the table of contents

Changing the actions to be performed when a threat is detected

Prior to disinfecting or deleting an object, Kaspersky Rescue Disk creates its backup copy and places it in backup against a future need to recover or disinfect the object if that should become possible.

To change the action to be performed with regard to detected objects:

  1. Open the main application window.
  2. Click the Settings link in the top part of the main window and open the Settings window.
  3. In the left part of the window, select the Objects scan section.
  4. In the right part of the window, select the desired option in the Action section.


Restoring default scan settings

To restore the default scan settings:

  1. Open the main application window.
  2. Click the Settings link in the top part of the main window and open the Settings window.
  3. In the left part of the window, select the Objects scan section.
  4. Click the Default level button in the Security level section in the right part of the window.


Update

This section contains information about how anti-virus databases and Kaspersky Rescue Disk modules are updated on your computer, and how to configure update settings.

In this section:

About the update

Starting and stopping the update task

Rolling back the last update

Configuring update settings


About the update

Updating the databases and program modules of Kaspersky Rescue Disk ensures up-to-date protection for your computer. New viruses, Trojans, and other types of malware appear worldwide on a daily basis. The Kaspersky Rescue Disk databases contain information about threats and ways of eliminating them, so regular application updates are required to ensure your computer's security and for the timely detection of new threats.

Application update downloads and installs the following updates on your computer:

  • Kaspersky Rescue Disk databases.

    The protection of information is based on databases which contain signatures of threats and network attacks, and the methods used to fight them. Protection components use these databases to search for and disinfect dangerous objects on your computer. The databases are supplemented every hour with records of new threats and ways to fight them. Therefore, you are advised to update them on a regular basis.

  • Application modules.

    In addition to the Kaspersky Rescue Disk databases, you can also update the program modules. The update packages fix Kaspersky Rescue Disk vulnerabilities and supplement or improve the existing functionality.

To update the application's anti-virus databases and modules, start the update task. The main Kaspersky Rescue Disk update source are Kaspersky Lab's special servers.

Your computer should be connected to the Internet for successful downloading of updates from our servers. By default, the Internet connection settings are determined automatically. If you use a proxy server, you may need to adjust the connection settings.

During an update, the application modules and databases on your computer are compared with the up-to-date version at the update source. If your current databases and modules differ from those in the actual version of the application, the missing portion of the updates will be installed on your computer.

If the databases are outdated, the update package may be large, which may cause additional Internet traffic (up to several dozen MB).

Prior to updating the databases, Kaspersky Rescue Disk creates backup copies of them in case you want to return to the previous version of the databases.

Kaspersky Rescue Disk is updated according to a preset combination of settings. You can perform the following actions:

  • select a different update source;
  • change update source regional settings;
  • configure proxy-server connection settings.

Information about the current status of the Kaspersky Rescue Disk databases is displayed on the Update tab in the main window and in the Update window.

Information about update results and all events that occurred during the update task is logged in the Kaspersky Rescue Disk report, which can be viewed by clicking the Report link in the top part of the main window. In addition, you can take a look at a virus activity report by clicking the Virus activity report link at www.kaspersky.com.


Starting and stopping the update task

To the table of contents

Starting and stopping the update

To start an update task, perform the following actions:

  1. Open the main application window.
  2. On the Update tab, click the Start update button.

To stop the update task:

  1. Open the main application window.
  2. On the Update tab, click the Stop update button.

You can monitor the update progress and view the results in the window that opens.


Rolling back the last update

After the first update of Kaspersky Rescue Disk databases and program modules, the option of rolling back to the previous databases becomes available.

Each time you start the update process, Kaspersky Rescue Disk creates a backup copy of the current databases and application modules. If necessary, you can restore the previous databases. The update rollback feature is useful in case a new database version contains an invalid signature that makes Kaspersky Rescue Disk block a safe application.

In the event of damage to Kaspersky Rescue Disk databases, it is recommended that you launch an update to download a valid set of databases for up-to-date protection.

To rollback to the previous database version:

  1. Open the main application window.
  2. On the Update tab, click the Roll back to the previous databases button.
  3. In the Roll back update window that opens, click the Roll back to previous update button.


Configuring update settings

To configure the update task settings:

  • Select update source.

    An update source is a resource containing updates for databases and application modules of Kaspersky Rescue Disk. You can specify HTTP/FTP servers, local and network folders as update sources. The main update sources are the Kaspersky Lab update servers, where database updates and application module updates for all Kaspersky Lab products are stored. If you do not have access to Kaspersky Lab's update servers (for example, Internet access is restricted), you can call the Kaspersky Lab headquarters to request the contact information of Kaspersky Lab partners who can provide you with updates on removable media.

    When ordering updates on removable media, please specify whether you also require updates for the application modules.

    By default, the list of update sources contains only Kaspersky Lab's update servers. If several resources are selected as update sources, Kaspersky Rescue Disk will try to connect to them in turn, starting at the top of the list and retrieving the updates from the first available source.

    If you select a resource outside the LAN as an update source, you must have an Internet connection to update.

  • Select the region of the update server.

    If you use Kaspersky Lab servers as the update source, you can select the optimal server location when downloading updates. Kaspersky Lab servers are located in several countries.

    Using the closest Kaspersky Lab update server allows you to reduce the time required for receiving updates and increase operation performance speed. By default, the application uses information about the current region from the operating system's registry. You can select the region manually.

  • Configure proxy-server connection settings.

    If you use a proxy server for Internet connection, you should reconfigure it to allow proper updating of Kaspersky Rescue Disk.


Selecting an update source

To choose an update source:

  1. Open the main application window.
  2. Click the Settings link in the top part of the main window and open the Settings window.
  3. Select the Update section in the left part of the window, and click the Settings button in the right part of the window.
  4. Click the Add link on the Source tab in the displayed window.
  5. In the Select update source window that opens, select the folder that contains the updates, or enter an address in the Source field to specify the server from which the updates should be downloaded.


Selecting the update server region

To select the update server region:

  1. Open the main application window.
  2. Click the Settings link in the top part of the main window and open the Settings window.
  3. Select the Update section in the left part of the window, and click the Settings button in the right part of the window.
  4. In the window that opens, on the Source tab in the Regional settings section, select the Select from the list option, and then select the country nearest to your current location from the dropdown list.


Configuring settings to connect to proxy server

To configure the proxy server settings:

  1. Open the main application window.
  2. Click the Settings link in the top part of the main window and open the Settings window.
  3. Select the Update section in the left part of the window, and click the Settings button in the right part of the window.
  4. In the window that opens, on the Source tab, click the Proxy server button.
  5. In the Proxy server settings window that opens, specify the required settings to connect to a proxy server.


Quarantine and Backup

This section contains information about Quarantine and Backup and how to configure settings to store objects.

In this section:

About Quarantine

About Backup

Actions with quarantined objects

Storing quarantine and backup objects


About Quarantine

Quarantine is a special repository that stores the objects possibly infected with viruses. Potentially infected objects are objects that are suspected of being infected with viruses or their modifications.

Such objects may be detected and quarantined when scanning for viruses.

An object is placed in Quarantine if its code is similar to a known threat, but partially modified, or if its structure resembles malware, but is not contained in the database. In such case, objects are placed in Quarantine as a result of heuristic analysis during a virus scan. Heuristic analysis rarely causes false alarms.

When you place an object in Quarantine, it is moved, not copied: the object is deleted from the disk or email, and saved in the Quarantine folder. Files in Quarantine are saved in a special format and are not dangerous. You can modify the Quarantine settings. You can perform the following actions:

  • manually quarantine files that you suspect are infected.
  • scan and cure quarantined objects using the latest versions of the Kaspersky Rescue Disk databases.
  • restore files to the folders from which they were moved to quarantine, or to the folders selected by the user;
  • delete any quarantined object or a group of selected objects.

It is possible that after the next database update, Kaspersky Rescue Disk will be able to identify the threat unambiguously and neutralize it. Due to this fact, the application scans quarantined objects after each update.


About Backup

Sometimes the integrity of objects cannot be maintained during disinfection. If the disinfected file contained important information, and after disinfection it became inaccessible in part or in full, you can attempt to restore the original object from its backup copy.

Backup copy is a copy of the original dangerous object that is created when first disinfecting or deleting the object, and it is saved in backup.

Backup is a special repository that contains backup copies of dangerous objects after processing or deletion. The main function of a backup storage is the ability to restore the original object at any time. Files in backup are saved in a special format and are not dangerous. You can change the settings for storing objects in Backup.


Actions with quarantined objects

Kaspersky Rescue Disk allows you to perform the following operations with Quarantine:

  • manually quarantine files that you suspect are infected.
  • scan and cure quarantined objects using the latest versions of the Kaspersky Rescue Disk databases.
  • restore files to the folders from which they were moved to quarantine, or to the folders selected by the user;
  • delete any quarantined object or a group of selected objects.

To place an object in Quarantine:

  1. Open the main application window.
  2. Click the Quarantine link in the top part of the main window to open the Protection state window on the Detected threats tab.
  3. Click the Move to Quarantine link and in the file manager window that opens select the object to be placed in Quarantine.

To scan a quarantined object:

  1. Open the main application window.
  2. Click the Quarantine link in the top part of the main window and open the Protection status window.
  3. In the window that opens, on the Detected threats tab, select the object that needs to be scanned.
  4. Right-click to open the context menu and select Scan.

To disinfect all quarantined objects:

  1. Open the main application window.
  2. Click the Quarantine link in the top part of the window and open the Protection status window.
  3. On the Detected threats tab in the window that opens, click the Cure all link.

To restore a quarantined object:

  1. Open the main application window.
  2. Click the Quarantine link in the top part of the window and open the Protection status window.
  3. In the window that opens, on the Detected threats tab, select the object that needs to be restored.
  4. Right-click to open the context menu and select Restore.

To delete quarantined objects:

  1. Open the main application window.
  2. Click the Quarantine link in the top part of the window and open the Protection status window.
  3. On the Detected threats tab in the window that opens, select the object whose record is to be removed from the list of detected threats.
  4. Right-click the object to open the context menu and select Delete from the list. You are prompted to delete the object record from the list and the copy of the object from Backup. Confirm the action in the prompt window.


Storing Quarantine and Backup objects

The default maximum storage period of objects in Quarantine and copies of objects in Backup is 30 days. After that the objects will be deleted. You can cancel the time restriction or change the maximum object storage duration.

In addition, you can specify the maximum size of Quarantine and Backup. If the maximum size value is reached, the content of Quarantine and Backup is replaced with new objects. By default, the maximum size restriction is disabled.

To modify the object maximum storage time:

  1. Open the main application window.
  2. Click the Settings link in the top part of the main window and open the Settings window.
  3. In the left part of the window, in the Settings section, select the Reports and Storages subsection.
  4. In the right part of the window in the Quarantine and Backup section, check the Store objects for no longer than box and specify the maximum storage period of objects in Quarantine and copies of objects in Backup.

To configure the maximum Quarantine and Backup size:

  1. Open the main application window.
  2. Click the Settings link in the top part of the main window and open the Settings window.
  3. In the left part of the window, in the Settings section, select the Reports and Storages subsection.
  4. In the right part of the window, in the Quarantine and Backup section, check the Maximum size box and specify the maximum Quarantine and Backup size.


Reports

This section contains information about Kaspersky Rescue Disk reports and how to use them, and about settings for report files.

In this section:

About reports

Selecting task to create a report

Managing grouping of information in the report

Selecting event types

Configuring the display of data on the screen

Using complex filtering

Events search

Saving report into file

Extended statistics display

Configuring report settings


About reports

Events that occur during every scan and update task are logged in a report.

You can create a detailed report for each task and configure the display of data in the most convenient form. Additionally, you can filter data, as well as search all events included in the report. You can save report data in a text file, if necessary.

Statistical information about the execution of Kaspersky Rescue Disk scan and update tasks is available in graphic or table form (depending on the task). Extended statistics can be selected using the [image] button in the top part of the Detailed report window.


Selecting task to create a report

You can view a detailed report on events that occurred during tasks executed by Kaspersky Rescue Disk.

For added convenience when working with reports, you can change the data display on the screen: group events by various parameters, select the report period, sort events by column or by importance, and hide columns.

To view a report for a task executed by Kaspersky Rescue Disk:

  1. Open the main application window.
  2. Click the Report link in the top part of the main window and open the Protection status window.
  3. In the window that opens, on the Report tab, click the Detailed report button.
  4. In the Detailed report window that opens in the drop-down list located in the top left corner, select a task for which a report should be created (see the figure below).

    Selecting a Kaspersky Rescue Disk task to generate a report

    Selecting a Kaspersky Rescue Disk task to generate a report


Managing grouping of information in the report

To the table of contents

Managing information grouping in the report

You can manage the data group represented in the report. The information can be grouped by various criteria.

To group events in the report:

  1. Open the main application window.
  2. Click the Report link in the top part of the main window and open the Protection status window.
  3. In the window that opens, on the Report tab, click the Detailed report button.
  4. From the dropdown list in the Detailed report window that opens (see the figure below), select the criteria by which to group events in the report:
    • Do not group – the events will not be grouped.
    • Group by result – data will be grouped based on the results of scan or object processing.

    Selecting criteria to group events in the report

    Selecting criteria to group events in the report


Selecting event types

To the table of contents

Selecting event type

The report logs a full list of all events that occur during scan tasks or database and module updates. You can select the types of events to be logged in the report.

To select an event type to be logged in the report:

  1. Open the main application window.
  2. Click the Report link in the top part of the main window and open the Protection status window.
  3. In the window that opens, on the Report tab, click the Detailed report button.
  4. In the Detailed report window that opens from the drop-down list on the right (see the figure below), select the event type:
    • Critical events
    • Important events
    • All events – if a report on all events needs to be created.

    Selecting types of events to display in the report

    Selecting types of events to display in the report

    If All events is selected, the report displays all events, including informational ones, but only if the box in the Reports and Repositories configuration window in the Reports section is checked to enable records on non-critical events to be logged in the report. If this box is not checked, a warning icon and the Disabled link are displayed near the event type selection drop-down list. Click the specified link to open the Reports and Repositories configuration window and check the corresponding boxes.


Configuring the display of data on the screen

Events included in the report are displayed as a table. You can select events by specifying a restricting condition.

To configure the data displayed on the screen:

  1. Open the main application window.
  2. Click the Report link in the top part of the main window and open the Protection status window.
  3. In the window that opens, on the Report tab, click the Detailed report button.
  4. In the Detailed report window that opens, configure the display of data:
    • To set a restriction, left-click the area to the left of the heading of the table column for which you want to set a restriction (see the figure below). Select a required restriction from the dropdown list. If the Custom item is selected, you can specify complex filtering conditions. If necessary, you can view all data by selecting All in the restrictions list.

    Selecting a restricting condition

    Selecting a restricting condition

    • To view detailed information about an event, click the [image] icon located on the left of the event header. You can change the way that data are displayed on the screen. To do so, select the event in the list, right-click to open the context menu, and in the menu select the type of grouping (see the figure below).

    Selecting the data display mode

    Selecting the data display mode

    • In order to hide / show table columns, in the window that opens, right-click the area to the right of the heading of any table column and uncheck the boxes with the corresponding names in the context menu (see the figure below). The context menu of the column provides quick access to any attribute which allows grouping and selecting events.

    Grouping and event querying menu

    Grouping and event querying menu

    • To display all elements of the table column, left-click the [image] icon to the right of the name of the required column (see the figure below). In the opened columns headers an arrow is displayed which indicates the filter order. You can modify the filter by clicking the arrow icon.

    Displaying hidden table columns

    Displaying hidden table columns


Using complex filtering

You can specify data search criteria for any table column. A data query using a complex filter is based on the logical conjunction (Logical AND) function and disjunction (Logical OR) function which can be used to control the query.

To specify complex filtering conditions:

  1. Open the main application window.
  2. Click the Report link in the top part of the main window and open the Protection status window.
  3. In the window that opens, on the Report tab, click the Detailed report button.
  4. In the Detailed report window that opens, left-click to the left of the heading of the table column for which you want to set complex filtering conditions, and select Complex in the menu (see the figure below).

    Selecting a restricting condition

    Selecting a restricting condition

    You can also select Filter in the context menu that opens on right-clicking to the right of the column header in the table.

  5. In the Complex filter window that opens, set the filtering conditions (see the figure below).
    1. Define the query limits in the right part of the window.
    2. In the left part of the window, select the necessary query condition from the Condition dropdown list (e.g., is greater or less than, equals or does not equal the value specified as the query limit).
    3. If necessary, add a second condition using logical conjunction (logical AND) or disjunction (logical OR) operations. If you wish your data query to satisfy both specified conditions, select AND. If only one of the two conditions is required, select OR.

    The Custom filter window

    The Custom filter window

    For several types of columns the search interval limit is not a numeric or a temporal value, but a word (for example, the query could pick out the OK value for the Result column). In this case the word specified as the limit will be compared against other word-conditions in alphabetic order.


Events search

You can search a report for the desired event using a keyword in the special search window.

To use events search:

  1. Open the main application window.
  2. Click the Report link in the top part of the main window and open the Protection status window.
  3. In the window that opens, on the Report tab, click the Detailed report button.
  4. In the Detailed report window that opens, right-click to the right of the heading of any table column and select Search in the context menu.
  5. In the Search window that opens, set the search criteria (see the figure below):
    1. In the String field, enter a key word to be searched for.
    2. In the Column dropdown list, select the name of the column that should be searched for the specified key word.
    3. If necessary, check the boxes for additional search settings.
  6. Click the Find next button.

    The Search window

    The Search window


Saving report into file

To the table of contents

Saving a report to file

The report obtained can be saved to a text file.

To save the report to file:

  1. Open the main application window.
  2. Click the Report link in the top part of the main window and open the Protection status window.
  3. In the window that opens, on the Report tab, click the Detailed report button.
  4. In the Detailed report window that opens, create the desired report and click the Save button.
  5. In the file manager window that opens, select the folder where you want to save the report file and enter the file name.


Extended statistics display

Extended statistics on tasks executed by Kaspersky Rescue Disk are displayed in the bottom part of the Detailed report window.

To view extended statistics on tasks executed by Kaspersky Rescue Disk:

  1. Open the main application window.
  2. Click the Report link in the top part of the main window and open the Protection status window.
  3. In the window that opens, on the Report tab, click the Detailed report button.
  4. From the dropdown list in the top-left corner of the Detailed report window that opens, select the task which you want to view extended statistics for and click the [image] button in the top-right part of the window.


Configuring report settings

You can perform the following actions:

  • Log non-critical events in the report.

    By default, the product does not add non-critical events or registry and file system events to its reports. You can add records of such events to the report.

  • Change settings for storing reports.

    The default maximum report storage duration is 30 days. After that the reports will be deleted. You can cancel the time restriction or change the maximum report storage duration.

    In addition, you can also define the maximum report file size. By default, the maximum size is 1024 MB. Once the maximum size has been reached, the content of the file is replaced with new records. You can cancel any limits imposed on the report's size, or enter another value.

  • Delete information from the reports.

    You can clear the reports containing data that you no longer need.


Recording non-critical events into the report

To include an entry in a log of non-critical events:

  1. Open the main application window.
  2. Click the Settings link in the top part of the main window and open the Settings window.
  3. In the left part of the window, in the Settings section, select the Reports and Storages subsection.
  4. In the right part of the window, in the Reports section, check the Log non-critical events box.


Storing reports

To modify the report maximum storage time:

  1. Open the main application window.
  2. Click the Settings link in the top part of the main window and open the Settings window.
  3. In the left part of the window, in the Settings section, select the Reports and Storages subsection.
  4. In the right part of the window in the Reports section, check the Store reports no longer that box and specify the maximum period for storing reports.

To configure the maximum report file size:

  1. Open the main application window.
  2. Click the Settings link in the top part of the main window and open the Settings window.
  3. In the left part of the window, in the Settings section, select the Reports and Storages subsection.
  4. In the Reports section in the right part of the window, check the Maximum file size box and specify the maximum size for a report file.


Clearing application reports

To clear application reports:

  1. Open the main application window.
  2. Click the Settings link in the top part of the main window and open the Settings window.
  3. In the left part of the window, in the Settings section, select the Reports and Storages subsection.
  4. In the right part of the window, in the Reports section click the Clear button.
  5. In the Clearing reports window that opens, check the boxes for the reports you wish to clear.


Threats and exclusions. Trusted zone

This section contains information about how to protect your computer from various types of malware by extending the list of detected threats, how to create a trusted zone, and how to configure exclusion rules.

In this section:

About detected threats

Selecting the detectable threat categories

About trusted zone

Creating trusted zone

Creating an exclusion rule

Allowed file exclusion masks

Allowed exclusion masks according to Virus Encyclopedia


About detected threats

Threats detected by Kaspersky Rescue Disk are divided into categories based on various attributes. The application always searches for viruses, Trojan programs, and malicious utility tools. These programs can bring significant damage to your computer. To ensure a more reliable protection to your computer, you can extend the list of detected threats by enabling control of actions performed by legal applications that may be exploited by an intruder to do harm to the user's computer and data.


Selecting the detectable threat categories

To select the detectable threat categories:

  1. Open the main application window.
  2. Click the Settings link in the top part of the main window and open the Settings window.
  3. In the left part of the window, in the Settings section, select the Threats and Exclusions subsection.
  4. In the right part of the window, in the Threats section click the Settings button.
  5. In the Threats window that opens, check the boxes for the categories of threats that should be detected.


About trusted zone

Trusted zone is the user-created list of objects which should not be controlled by the application. In other words, it is a set of exclusions from the scope of Kaspersky Rescue Disk protection.

The Trusted zone is created based on the list of trusted applications and exclusion rules, depending on the features of the objects you work with and applications installed on the computer. Including objects in the trusted zone may be required if, for example, Kaspersky Rescue Disk blocks access to an object or application, even though you are certain that this object / application is absolutely harmless.

For example, if you think objects used by Microsoft Windows Notepad are harmless and require no scanning, that is, you trust this application, add Notepad to the list of trusted applications to exclude scanning of objects used by this process.

Some actions classified as dangerous may be safe in the framework of certain applications. For instance, applications that automatically toggle keyboard layouts, such as Punto Switcher, regularly intercept text being entered on your keyboard. To take into account the specifics of such applications and disable the monitoring of their activity, you are advised to add them to the list of trusted applications.

When an application is added into the list of trusted ones, its file and network activities (including suspicious ones) become uncontrolled. So do its attempts to access the system registry. At the same time, the executable file and the trusted application's process are scanned for viruses as they were before. To completely exclude an application from a scan, you should use exclusion rules.

Excluding trusted applications from scanning avoids problems related to the application's compatibility with other programs (e.g. the problems of double scanning of network traffic on a third-party computer by Kaspersky Rescue Disk and by another anti-virus application), and also increases the computer's performance rate, which is critical when using server applications.

In its turn, exclusion rules for the trusted zone ensure the option of working with legal applications which may be used by intruders to do harm to the user's computer or data. These applications have no malicious features, but they may be used as auxiliary components of a malicious program. This category includes remote administration applications, IRC clients, FTP servers, various utility tools for halting or concealing processes, keyloggers, password-hacking programs, dialers, and others. Such applications may be blocked by Kaspersky Rescue Disk. To avoid blockage, you can configure exclusion rules.

Exclusion rules are sets of conditions that Kaspersky Rescue Disk uses to verify if it can skip the scan of an object. In all other cases, the object is scanned according to its respective protection settings.

Exclusion rules for a trusted zone can be used in running tasks to scan for viruses.


Creating trusted zone

To create a trusted zone:

  1. Open the main application window.
  2. Click the Settings link in the top part of the main window and open the Settings window.
  3. In the left part of the window, in the Settings section, select the Threats and Exclusions subsection.
  4. In the right part of the window, in the Exclusions section click the Settings button.
  5. On the Exclusion rules tab in the window that opens, you can:
    • Create a new exclusion rule.

      Click the Add link, and in the Exclusion rule window that opens set its conditions.

    • Change an existing exclusion rule.

      Select the exclusion rule in the list. Click the Change link, and in the Exclusion rule window that opens change its conditions.

    • Temporarily disable an exclusion rule.

      Select the exclusion rule in the list and uncheck the box next to it. The exclusion rule is now disabled until the box is rechecked.

    • Delete an exclusion rule.

      Select the exclusion rule in the list and click the Delete link.


Creating an exclusion rule

To create an exclusion rule:

  1. Open the main application window.
  2. Click the Settings link in the top part of the main window and open the Settings window.
  3. In the left part of the window, in the Settings section, select the Threats and Exclusions subsection.
  4. In the right part of the window, in the Exclusions section click the Settings button.
  5. Click the Add link on the Exclusion rules tab in the displayed window.
  6. In the Exclusion rule window that opens, edit the exclusion rule settings.


Allowed file exclusion masks

Let's look at some examples of allowed masks that you can use when create file exclusion lists:

  1. Masks without file paths:
    • *.exe – all files with the .exe extension;
    • *.ex? – all files with the .ex? extension where ? can represent any single character;
    • *test* – all files with the name test.
  2. Masks with absolute file paths:
    • /discs/C:/dir/*.*, or /discs/C:/dir/*, or /discs/C:/dir/ – all files in the folder with the name /discs/C:/dir/;
    • /discs/C:/dir/*.exe – all files with the .exe extension in the folder with the name /discs/C:/dir/;
    • /discs/C:/dir/*.ex? – all files with the .ex? extension in the /discs/C:/dir/ folder where ? may represent any single character
    • /discs/C:/dir/test* – all files in the /discs/C:/dir/ folder, with names starting with test.

      If you want the application to exclude files in all nested subfolders of the specified folder from a scan, check the Include subfolders box when creating the mask.

  3. Masks with relative file paths:
    • dir/*.*, or dir/*, or dir/ – all files in all folders with dir/;
    • dir/*test* – all files named 'test' in all dir/ folders and all their subfolders
    • dir/*.exe – all files with the exe extension in all folders with dir/;
    • dir/*.ex? – all files with the .ex? extension in all dir/ folders, where ? can represent any single character.

      If you want the application to exclude files in all nested subfolders of the specified folder from a scan, check the Include subfolders box when creating the mask.

The *.* and * exclusion masks can only be used if you specify the type of excluded threat according to the Virus Encyclopedia. In this case the specified threat will not be detected in any objects. Using this mask without specifying the type of threat is equivalent to disabling protection.


Allowed exclusion masks according to Virus Encyclopedia

To the table of contents

Verdict exclusion masks permitted according to Virus Encyclopedia

When adding threats with a certain verdict from Virus Encyclopedia classification as exclusions, you can specify:

  • The full name of the threat as given in the Virus Encyclopedia (e.g. not-a-virus:RiskWare.RemoteAdmin.RA.311 or Flooder.Win32.Fuxx).
  • Name of the threat by mask, for example:
    • not-a-virus* – exclude legal programs that may be used by an intruder to do harm to the user's computer or data from the scan, as well as joke programs;
    • *Riskware.* – exclude all legal programs that may be used by an intruder to do harm to the user's computer or data from the scan;
    • *RemoteAdmin.* – exclude all remote administration programs from the scan.


Notifications

This section contains information on how to configure notification settings on your computer.

In this section:

Configuring notification settings

Disabling notifications


Configuring notification settings

By default, if any events occur during operation, Kaspersky Rescue Disk notifies you of them. If you are required to select further actions, notification windows will be displayed on the screen. The application uses pop-up messages to notify you of events that do not require action.

You can disable the delivery of notifications.

You can select not to be notified by Kaspersky Rescue Disk about any event that does not require action. To do this:

  1. Open the main application window.
  2. Click the Settings link in the top part of the main window and open the Settings window.
  3. In the left part of the window, in theSettings section, select the Notifications subsection.
  4. Click the Settings button in the right part of the window.
  5. In the Notifications window that opens, uncheck the boxes for the events that you do not want to notified about.


Disabling notifications

By default, Kaspersky Rescue Disk notifies you of important events related to the running of the application. You can disable the delivery of notifications.

Regardless of whether notification delivery is enabled or disabled, information about events that occur during the operation of Kaspersky Rescue Disk is logged in an application operation report.

To disable notification delivery, please do the following:

  1. Open the main application window.
  2. Click the Settings link in the top part of the main window and open the Settings window.
  3. In the left part of the window, in theSettings section, select the Notifications subsection.
  4. In the right part of the window, uncheck the Enable events notifications box.


Working with Kaspersky Rescue Disk in text mode

This section describes how to use Kaspersky Rescue Disk in text mode.

In this help section

About text mode

Working with file manager

Working with command line


About text mode

Text mode provides a user interface that employs only alphanumeric and pseudographic symbols for the input-output and display of information. Text mode typically uses few input-output resources (particularly memory) and has a very short response time in displaying information.

Text mode in Kaspersky Rescue Disk includes a command line interface and the console mode of Midnight Commander, a visual file manager.

In text mode, you can:

  • configure network settings (network adapter, proxy server).
  • run the Kaspersky Rescue Disk console.
  • scan objects (autorun objects, boot sectors, disks, disk directories, all objects).
  • update the application's anti-virus databases.
  • roll back the previous update.
  • view help files on command syntax.
  • restart the computer.
  • closing Kaspersky Rescue Disk followed by automatic shutdown of the computer.

In text mode, you can only start object scans and updates. To configure the task settings, you must start the application in graphic mode.


Working with file manager

This section describes the features of Kaspersky Rescue Disk file manager in text mode.

In this section:

Network setup

Starting the Kaspersky Rescue Disk console

Virus scan

Kaspersky Rescue Disk update

Rolling back the last update

Viewing Help

Closing Kaspersky Rescue Disk


Network setup

To configure the network adapter:

  1. Open the User Menu and select Network settings.
  2. In the Network adapter settings window that opens, select Configure network adapter.
  3. In the window that opens, select the network adapter whose settings you want to change, and click the ОК button.
  4. Confirm the changes to the network adapter settings in the window that opens b y clicking the Yes button.
  5. In the TCP / IP settings window, select one of the following options:
    • DHCP – to configure the network adapter automatically.
    • Manual configuration – to specify the network adapter settings manually.

    After configuring the network adapter settings, click the OK button.

To modify connection with a proxy server:

  1. Open the User Menu and select Network settings.
  2. In the Network adapter settings window that opens, select Configure proxy server.
  3. In the Proxy server settings window that opens, specify the settings of the proxy server in the Address, Port, User name and Password fields. Click the OK button.


Starting the Kaspersky Rescue Disk console

To start the Kaspersky Rescue Disk console,

open the User Menu and select Kaspersky Rescue Disk console.

See also

Working with command line


Virus scan

To start an objects scan task,

open the User Menu and select one of the following items:

  • Scan: <Disk> – Kaspersky Rescue Disk scans each disk object (file) for viruses. If the object is classified as infected or potentially infected, the application prompts the user to take action on it.

    After treating the infected or potentially infected object, Kaspersky Rescue Disk removes all hyperlinks to this object from the registry and Windows service directory files.

  • Scan all objects – Kaspersky Rescue Disk scans all files in all drives, including autorun objects and boot sectors.
  • Scan startup object – Kaspersky Rescue Disk scans the registry and files with .inf, .ini and .bat extensions in Windows service directories on all connected drives. Each object is scanned for viruses. If the object is classified as infected or potentially infected, the application prompts the user to take action on it.

    After treating the infected or potentially infected object, Kaspersky Rescue Disk removes all hyperlinks to this object from the registry and Windows service directory files.

  • Scan disk boot sectors – Kaspersky Rescue Disk scans each disk boot sector for malicious objects. If a malicious object is found, the application prompts the user to take action on it.

    After treating the malicious object, Kaspersky Rescue Disk removes all hyperlinks to this object from the registry and Microsoft Windows service directory files.

See also

Scanning objects for viruses


Kaspersky Rescue Disk update

To start the update task,

open the User Menu and select Start update.

See also

About the update


Rolling back the last update

To roll back to the previous update,

open the User Menu and select Roll back to previous databases.

See also

Rolling back the last update
© 2011 Kaspersky Lab ZAO. All Rights Reserved.


Viewing Help

To view Kaspersky Rescue Disk Help in text mode,

open the User Menu and select Help.


Closing Kaspersky Rescue Disk

To close Kaspersky Rescue Disk,

open the User Menu and select one of the following items: Shut down the computer or Restart the computer.


Working with command line

This section describes how to use Kaspersky Rescue Disk from the command line in text mode.

In this section:

Command line syntax

Virus scan

Kaspersky Rescue Disk update

Rolling back the last update

Viewing Help

Closing Kaspersky Rescue Disk


Command line syntax

You can work with Kaspersky Rescue Disk from the command line.

Command line syntax

<command> [settings]

<command> can take the following values:

  • help – help with command syntax; display list of commands
  • scan – objects scan for malicious programs
  • update – start update task
  • rollback – roll back to previous update
  • exit – close application

Each command has its own unique parameters.


Virus scan

The syntax for starting a scan of a certain area for viruses and processing malicious objects from the command line generally looks as follows:

scan [<scan object>] [<action>] [<filetypes>] [<exclusions>] [<report settings>]

Disk names must be specified in upper-case, for example C:/file.txt, where C is the disk name.

Settings description

<object to scan> – this parameter gives the list of objects to be scanned for malicious code.

The parameter may include several space-separated values from the list provided.

<files>

List of paths to the files and / or folders to be scanned.

You can enter an absolute or relative path to the file. Items on the list are separated by a space.

Comments:

  • if the object name or path contains a space or special characters ($, &, @, etc.), it must be enclosed in single quotes or the exclusion symbol must be separated on the left by a backslash.
  • if a specific folder is designated, all files and folders inside it are scanned.

<disc_name>:/<folder>

Scan the specified disk where <disc_name> is the name of the disk, and <folder> is the path to the folder to be scanned.

<action> – this parameter determines what action will be taken with malicious objects detected during the scan. If this parameter has not been defined, the default action is the one with the value of -i8.

-i0

Take no action on the object; simply record information about it in the report.

-i1

Treat infected objects; if disinfection is impossible, skip.

-i2

Treat infected objects; if disinfection is impossible, delete. Do not delete containers, except containers with executable headers (sfx archives).

-i3

Treat infected objects and if disinfection fails, delete. Delete all compound objects completely if infected parts cannot be deleted.

-i4

Delete infected objects. Delete all compound objects completely if the infected parts cannot be deleted.

-i8

Prompt the user for action if an infected object is detected. This action is selected by default.

-i9

Prompt the user for action at the end of the scan.

<file types> – this parameter defines the file types that will be subject to an anti-virus scan. By default, if this parameter is not defined, only infected files by contents will be scanned.

-fe

Scan only infected files by extension.

-fi

Scan only infected files by content (default).

-fa

Scan all files.

<exclusions> – this parameter defines objects that are excluded from the scan.

Several parameters from the following list can be applied, separated by a space.

-e:a

Do not scan archives.

-e:b

Do not scan email databases.

-e:m

Do not scan email messages in text format.

-e:<filemask>

Do not scan objects, which match the mask

-e:<seconds>

Skip objects that are scanned for longer than the time specified in the <seconds> parameter.

-es:<size>

Skip objects that exceed the size specified in the <size> parameter in megabytes.

<report settings> – this parameter determines the format of the report on scan results.

The file path used to save the report can be absolute or relative. If the parameter is not defined, scan results are displayed on screen, and all events are shown.

-r:<report_file>

Log important events in this file only.

-ra:<report_file>

Log all events in this file.

Example:

To run a scan of the Documents and Settings folder and the <D> disk:

scan D: 'C:/Documents and Settings'


Kaspersky Rescue Disk update

The command to update the application modules and anti-virus databases has the following syntax:

update [<update_source>] [<report_settings>]

Disk names must be specified in upper-case, for example C:/file.txt, where C is the disk name.

Settings description

<update_source> | HTTP / FTP server or network or local folder to load the updates. The value for the parameter may be in the form of a full path to an update source or a URL. If a path is not selected, the update source will be taken from the update settings.
<report_settings> | This parameter defines the format of the report on the update. You can use an absolute or relative path to the file. If the parameter is not defined, scan results are displayed on screen, and all events are shown. The following values are possible: -r:<report_file> – record only important events in the specified report file. -ra:<report_file> – record all events in the specified report file.
Example: To update the application databases by default, logging all events in the report: update -ra:C:/avbases_upd.txt


Rolling back the last update

Command syntax:

rollback [<report_settings>]

Disk names must be specified in upper-case, for example C:/file.txt, where C is the disk name.

Settings description

<report_settings>

This parameter defines the format of the report on the update rollback. You can use an absolute or relative path to the file. If the parameter is not defined, scan results are displayed on screen, and all events are shown. The following values are possible:

-r:<report_file> – record only important events in the specified report file.

-ra:<report_file> – record all events in the specified report file.

Example:

Roll back to the previous update, logging all events in the report:

rollback -ra:rollback.txt


Viewing Help

Use this command to view the application Command line syntax:

help

To get help on the syntax of a specific command, you can use one of the following commands:

<command> -?

help<command>


Closing Kaspersky Rescue Disk

Command syntax:

exit


Restrictions in the application operation

The application currently has the following limitations:

  • If the graphic mode is selected, the computer shuts down and Kaspersky Rescue Disk is not loaded. The most common problem that may be encountered when loading the graphic subsystem is that the driver of a video adapter or output device cannot be detected.
  • Kaspersky Rescue Disk does not display logical drives when selecting the scan area, only boot sectors are displayed. The most likely problem that may be encountered is that file systems on hard drives and USB devices that had been connected, have not been detected – probably due to the use of RAID.


Hardware information

The Hardware information mode should be used if Kaspersky Rescue Disk could not be started either in graphic or text mode because the hardware is not supported. This may be due to incompatibility with the hardware requirements.

The Hardware information mode allows you to save information about system hardware in electronic form. Before starting Kaspersky Rescue Disk in this mode, insert a removable drive to be used to save information about the hardware.

The hardware information cannot be saved using the CD / DVD-RW removable drive.

In the Hardware information window, you can:

  • save hardware information;
  • reboot the computer;
  • shut down the computer.

To switch between options, press the TAB key. To confirm the selection, press the ENTER key.

When the hardware information is saved on a removable drive, you can contact the Technical Support Service and send the information to our team of specialists.


Contacting the Technical Support Service

This section provides information about how to obtain technical support and what conditions should be met to receive help from the Technical Support Service.

In this help section

How to get technical support

Technical support by phone

Obtaining technical support via My Kaspersky Account

Creating and saving the trace file


How to get technical support

If you do not find a solution to your problem in the application documentation or in one of the sources of information about the application, we recommend that you contact Kaspersky Lab's Technical Support Service. Technical Support Service specialists will answer any of your questions about installing and using the application.

Before contacting the Technical Support Service, please read the support rules.

You can contact the Technical Support Service in one of the following ways:

  • By telephone. This method allows you to consult with specialists from our Russian-language or international Technical Support Service.
  • By sending a query from your Kaspersky Account on the Technical Support Service website. This method allows you to contact our specialists using the query form.

To get technical support on using Kaspersky Rescue Disk, you must possess a commercial license for any Kaspersky Lab product for home or small business. Technical support is not available to users of trial and beta versions of applications.


Technical support by phone

If an urgent issue arises, you can call specialists from the Russian-speaking or international Technical Support Service by phone.

Before contacting the Technical Support Service, please read the support service rules. This will allow our specialists to help you more quickly.


Obtaining technical support via My Kaspersky Account

My Kaspersky Account is your personal area on the Technical Support Service website.

To obtain access to My Kaspersky Account, you should go through the registration procedure on the registration page. Enter your email address and a password to log in to My Kaspersky Account.

In My Kaspersky Account, you can perform the following actions:

  • contact the Technical Support Service and Virus Lab;
  • contact the Technical Support Service without using email;
  • track the status of your request in real time;
  • view a detailed history of your requests to the Technical Support Service;
  • receive a copy of the key file if it has been lost or removed.

Technical Support by email

You can send an online request to the Technical Support Service in Russian, English, German, French, or Spanish.

You should specify the following data in the fields of the online request form:

  • request type;
  • application name and version number;
  • request description;
  • customer ID and password;
  • email address.

A specialist from the Technical Support Service sends an answer to your question to your My Kaspersky Account and to the email address that you have specified in your online request.

Online request to the Virus Lab

Some requests should be sent to the Virus Lab instead of the Technical Support Service.

You can send requests of the following types to the Virus Lab:

  • Unknown malicious program – you suspect that a file contains a virus but Kaspersky Rescue Disk has not identified it as infected.

    Virus Lab specialists analyze malicious code sent. If they detect a previously unknown virus, they add a corresponding description to the database, which becomes available when updating anti-virus applications.

  • False alarm – Kaspersky Rescue Disk classifies a file as a virus, yet you are sure that the file is healthy;
  • Request for description of malicious program – you want to receive the description of a virus detected by Kaspersky Rescue Disk, using the name of the virus.

You can also send requests to the Virus Lab from the page with the request form without being registered in My Kaspersky Account. On this page, you do not have to specify the application activation code.


Creating and saving the trace file

After you notify Technical Support Service specialists of a problem encountered, they may ask you to create a report that should contain information about your operating system, and send it to the Technical Support Service. Also, Technical Support Service specialists may ask you to create a trace file. The trace file allows you to trace the process of executing the application's commands step-by-step and find out on which stage of the application's operation an error has occurred.

To create and save the trace file:

  1. In the Startup Wizard window that opens, use the cursor keys to select the language of the graphic interface. Press ENTER.
  2. Carefully read the License Agreement. You must accept the terms and conditions of the License Agreement to continue. To do so, press 1 on the keyboard.
  3. In the Startup Wizard window, select the application mode.
  4. Press the E key.
  5. At the end of the first line after quiet following a space insert trace.
  6. Press the CTRL+X key combination to save the trace file.

When working with Kaspersky Rescue Disk, you can access the file using the file manager. The path to the file is:

/discs/<drive name>:/Kaspersky Rescue Disk 10.0/avp<unique combination of date, time and internal data>.log

When you exit Kaspersky Rescue Disk, the path to the trace file is:

<drive name>:/Kaspersky Rescue Disk 10.0/avp<unique combination of date, time and internal data>.log


Glossary

Application settings

Application settings which are common for all task types, regulating the application's operation as a whole, such as application performance settings, report settings, and backup storage settings.

Archive

One or several files compressed into a single file. To archive and unarchive data, a special archiver utility is required.

Backup storage

Special storage designed to save backup copies of objects created before their first disinfection or deletion.

Database update

A function used by Kaspersky Lab applications to keep the computer's protection status up to date. During an update, the application copies database and module updates from Kaspersky Lab's update servers onto the computer and automatically installs and applies them.

Databases

Databases that contain descriptions of security threats known to Kaspersky Lab at the time of release. Database records are used to detect malicious code in scanned objects. The databases are maintained by Kaspersky Lab and updated every hour.

Deleting an object

The method of processing objects which ends in it being physically deleted from its original location (hard drive, folder, network resource). We recommend that this method be applied to dangerous objects which, for whatever reason, cannot be disinfected.

Disk boot sector

A boot sector is a particular area on a computer's hard drive, floppy, or other data storage device. It contains information on the disk's file system and a boot loader program that is responsible for starting the operating system.

There exist a number of viruses that infect boot sectors, which are thus called boot viruses. The Kaspersky Lab application allows scanning of boot sectors for viruses and disinfecting them if an infection is found.

Exclusion

An Exclusion is an object excluded from the scan by a Kaspersky Lab application. You can exclude files of certain formats, file masks, a certain area (for example, a folder or a program), application processes, or objects by threat type, according to the Virus Encyclopedia classification from the scan. Each task can be assigned a set of exclusions.

File mask

The name of a file represented as common characters. The two standard wildcards used in file masks are * and ?, where * represents any number of any characters and ? stands for any single character.

Heuristic analyzer

A technology designed to detect threats on which there is no information in Kaspersky Lab's databases. The heuristic analyzer can detect objects whose behavior in the system resembles a threat. Objects detected by the heuristic analyzer are classified as potentially infected. For example, an object could be classified as potentially infected if it contains a sequence of commands characteristic of malware (file open, file write).

Infected object

An object containing a section of code that fully matches a section of code in a known threat. Kaspersky Lab does not recommend that you work with such objects.

Kaspersky Lab's update servers

Kaspersky Lab's HTTP and FTP from which the application downloads database and module updates.

Moving objects to quarantine

A method of processing a potentially infected object by blocking access to the file and moving it from its original location to the Quarantine folder, where the object is saved in encrypted form, which rules out the threat of infection.

Object disinfection

A method used to process infected objects that results in the complete or partial recovery of data. Not all infected objects can be disinfected.

Potentially infected object

An object that contains modified code from a known threat or code that resembles a threat by its behavior.

Protection state

The current status of protection, summarizing the degree of security of the computer.

Proxy server

A computer network service which allows users to make indirect requests to other network services. First, a user connects to a proxy server and requests a resource (e.g., a file) located on another server. Then the proxy server either connects to the specified server and obtains the resource from it or returns the resource from its own cache (if the proxy has its own cache). In some cases, a user's request or a server's response can be modified by the proxy server for certain purposes.

Quarantine

A folder used by Kaspersky Lab applications to store potentially infected objects. Quarantined objects are stored in encrypted form to prevent them from affecting the computer.

Recommended level

The level of security based on application settings recommended by Kaspersky Lab experts and providing an optimal level of protection for your computer. This level is set to be used by default.

Restoration

Moving an original object from Quarantine or Backup to the folder where it was originally found before being moved to Quarantine, disinfected, or deleted, or to a different folder specified by the user.

Startup objects

The set of programs needed to start and correctly operate the operating system and software installed on your computer. These objects are executed every time the operating system is started. There are viruses capable of infecting such objects specifically, which may lead, for example, to blocking of operating system startup.


Kaspersky Lab

Kaspersky Lab software is internationally renowned for its protection against viruses, malware, spam, network and hacker attacks, and other threats.

In 2008, Kaspersky Lab was rated among the world’s top four leading vendors of information security software solutions for end users (IDC Worldwide Endpoint Security Revenue by Vendor). Kaspersky Lab is the preferred developer of computer protection systems among home users in Russia, according to the COMCON survey "TGI-Russia 2009".

Kaspersky Lab was founded in Russia in 1997. Today, it is an international group of companies headquartered in Moscow with five regional divisions that manage the company's activity in Russia, Western and Eastern Europe, the Middle East, Africa, North and South America, Japan, China, and other countries in the Asia-Pacific region. The company employs more than 2000 qualified specialists.

Products. Kaspersky Lab’s products provide protection for all systems—from home computers to large corporate networks.

The personal product range includes anti-virus applications for desktop, laptop, and pocket computers, and for smartphones and other mobile devices.

Kaspersky Lab delivers applications and services to protect workstations, file and web servers, mail gateways, and firewalls. Used in conjunction with Kaspersky Lab’s centralized management system, these solutions ensure effective automated protection for companies and organizations against computer threats. Kaspersky Lab's products are certified by the major test laboratories, are compatible with the software of many suppliers of computer applications, and are optimized to run on many hardware platforms.

Kaspersky Lab’s virus analysts work around the clock. Every day they uncover hundreds of new computer threats, create tools to detect and disinfect them, and include them in the databases used by Kaspersky Lab applications. Kaspersky Lab's Anti-Virus database is updated hourly; and the Anti-Spam database every five minutes.

Technologies. Many technologies that are now part and parcel of modern anti-virus tools were originally developed by Kaspersky Lab. It is no coincidence that many other developers user the Kaspersky Anti-Virus kernel in their products, including: SafeNet (USA), Alt-N Technologies (USA), Blue Coat Systems (USA), Check Point Software Technologies (Israel), Clearswift (UK), CommuniGate Systems (USA), Critical Path (Ireland), D-Link (Taiwan), M86 Security (USA), GFI (Malta), IBM (USA), Juniper Networks (USA), LANDesk (USA), Microsoft (USA), NETASQ (France), NETGEAR (USA), Parallels (Russia), SonicWALL (USA), WatchGuard Technologies (USA), ZyXEL Communications (Taiwan). Many of the company’s innovative technologies are patented.

Achievements. Over the years, Kaspersky Lab has won hundreds of awards for its services in combating computer threats. For example, in 2010 Kaspersky Anti-Virus was given several top Advanced+ awards after a series of tests held by AV-Comparatives, a renowned Austrian anti-virus lab. But Kaspersky Lab's main achievement is the loyalty of its users worldwide. The company’s products and technologies protect more than 300 million users, and its corporate clients number more than 200,000.

Kaspersky Lab official site: | http://www.kaspersky.com
Virus Encyclopedia: | http://www.securelist.com/
Anti-Virus Lab: | newvirus@kaspersky.com (only for sending probably infected files in archive format) http://support.kaspersky.ru/virlab/helpdesk.html?LANG=en (for virus analysts queries)
Kaspersky Lab web forum: | http://forum.kaspersky.com


Information about third-party code

Third-party code was used during application development.

In this help section

Program code

Development tools

Distributed program code

Other information


Program code

Information on the third-party code used when creating an application, is collected in the rescue/help/License_notice_1.txt file.


Development tools

Information on developer tools and other third-party means used when creating an application, is collected in the /rescue/help/License_notice_2.txt file.


Distributed program code

The application includes the independent binary third-party program code. The license texts of a program code, distributed on the conditions of GNU GPL and GNU LGPL licenses, are collected in the /rescue/help/License_notice_3.txt file.


Other information

The Agava-C program library, developed by OOO "R-Alpha", is used to check digital signatures.

The Software may include some software programs that are licensed (or sublicensed) to the user under the GNU General Public License (GPL) or other similar free software licenses which, among other rights, permit the user to copy, modify and redistribute certain programs, or portions thereof, and have access to the source code (“Open Source Software”). If such licenses require that for any software, which is distributed to someone in an executable binary format, that the source code also be made available to those users, then the source code should be made available by sending the request to source@kaspersky.com or the source code is supplied with the Software.

Additional information on the third-party code is collected in the /rescue/help/License_notice_4.txt file.


Notifications about trademarks

Registered trademarks and service marks are the property of their rightful owners.

Microsoft, Windows and Windows Vista are trademarks of Microsoft Corporation, registered in the United States of America and other countries.

Intel and Pentium are trademarks of Intel Corporation, registered in the United States of America and other countries.

Linux is a trademark of Linus Torvalds, registered in the United States of America and other countries.


The Exclusion rule window

In the Properties section, you can set the type of exclusion.

Object

The box enables / disables the feature which excludes the selected object from scanning.

You can specify a file, folder or file mask as an object.

If the Object and the Threats type boxes are checked, Kaspersky Rescue Disk will create a rule for the specified object using the precise threat type based on its Virus Encyclopedia classification. In such a case, the following rules apply:

  • If you specify a certain file as the Object and select a certain status in the Threat type section, the specified file is excluded only if it is classified as a selected threat during the scan.
  • If you select an area or folder as the Object and a status (or a mask) as the Threat type, then only the objects with that status which are located in that area or folder are excluded from the scan.

By default, the Object box is checked for each rule.

Threats type

Threat type is the status which Kaspersky Rescue Disk assigns to an object after scanning based on the classification of malicious objects offered in the Kaspersky Lab Virus Encyclopedia.

This box enables / disables exclusion from the scan scope for certain objects based on their status according to the Virus Encyclopedia classification.

If the Object and the Threats type boxes are checked, Kaspersky Rescue Disk will create a rule for the specified object using the precise threat type based on its Virus Encyclopedia classification. In such a case, the following rules apply:

  • If you specify a certain file as the Object and select a certain status in the Threat type section, the specified file is excluded only if it is classified as a selected threat during the scan.
  • If you select an area or folder as the Object and a status (or a mask) as the Threat type, then only the objects with that status which are located in that area or folder are excluded from the scan.

The Threat type box is unchecked by default.

Comment

Additional information on an exclusion rule.

In the Rule description section located in the bottom part of the window, you can view information about a rule and specify values for the selected type of exclusion. You can modify the settings of the rule using links in this section.

Object: select object

Clicking this link allows you to specify exclusion by object name. You can specify a file, folder or file mask as an object.

The link is accessible if the Object box is checked.

Threats type: enter threat name

Clicking this link allows you to specify exclusion by threat type. You can specify a complete threat name in accordance with the classification in the Virus Encyclopedia, or a threat name mask.

This link is accessible if the Threats type box is checked.

Use these settings in the following tasks

Creating an exclusion rule


The Object name window

Object name

Path to a file, folder or a filename mask.

Browse

Opens the Select folder window for you to select a file or folder.

Include subfolders

This box enables / disables the option of recursively excluding the specified object from the scan scope.

For example, if you have specified the file C:\Program Files\winword.exe as an exclusion and checked the Include subfolders box, Kaspersky Rescue Disk does not scan the winword.exe file in any subfolder of the C:\Program Files directory.


The Notifications window

Notifications list

Contains the events of which Kaspersky Rescue Disk is to notify a user.

Event

Column in which the type of event is specified. Events are filtered by severity level.

Severity level – this information about the event is logged by the Kaspersky Lab application. There are four severity levels:

  • Critical event.
  • Functional failure.
  • Warning.
  • Information message.

Events of the same type may have different severity levels, depending on the situation when the event occurred.

When operating, Kaspersky Rescue Disk sends the following types of notifications:

  • Critical notifications. Notifications about critical events indicating problems with Kaspersky Rescue Disk or vulnerabilities in your computer's protection (for example, application databases are damaged).
  • Functional failure. Notifications about events that could cause the application to become inoperable (for example, no anti-virus databases are available for the application).
  • Important notifications. Notifications about events which should be attended to without fail, since they reflect important situations in the operation of Kaspersky Rescue Disk.
  • Minor notifications. Reference-type notifications (for example, all dangerous objects have been disinfected).

Screen

The box in this column enables / disables the use of pop-up messages for the event specified in the line.

Use these settings in the following tasks

Configuring notification settings


The Clearing reports window

Scan tasks report

This box enables / disables deletion of information about executed scan tasks.

The space occupied by a report on the hard drive is displayed in brackets.

This box is checked by default.

Update report

The box enables / disables deletion of update-related information in Kaspersky Rescue Disk.

The space occupied by a report on the hard drive is displayed in brackets.

This box is checked by default.

Use these settings in the following tasks

Clearing application reports


The Detected threats tab

The tab displays a list of dangerous objects detected and actions performed on them. Objects are grouped according to the approved classification of computer security threats. You can filter the list of detected objects by the following criteria:

  • All. The list contains all hazardous objects that have been detected.
  • Active. The list contains hazardous objects that have been detected by the application but with regard to which no action has been taken. Such objects impose a threat to the security of your computer. You are advised to take steps in order to eliminate the threats.
  • Quarantine. The list contains objects that have been moved to Quarantine by the user for subsequent disinfection. To move an infected object to Quarantine, you can use the Move to Quarantine link.
  • Disinfected. The list contains objects that have been successfully disinfected by Kaspersky Rescue Disk.

Move to Quarantine

Opens a standard file manager window to move the selected file to Quarantine.

Disinfect all

This button allows you to send all objects from the list of detected threats for disinfection.

Save

This button allows you to open a standard window to save the list of detected threats in a TXT or CSV file.

Time

This column displays the time when a dangerous object was detected. You can use the filter menu for this column.

Status

This column displays the status of the detected object assigned by the application after it is scanned / processed. You can use the filter menu for this column.

Detected

Column which displays the type of a threat detected within an object. You can use the filter menu for this column.

Object

This column displays the path to the object in which a threat has been detected. You can use the filter menu for this column and display the elements of the column.

Criticality

This column displays the severity level of the object.

Available values:

  • medium;
  • high;
  • low.

Icon filter menu icon

Appears to the left of the column name when the cursor points to the column; the filter menu opens:

The filter menu contains the following items:

  • Custom – allows you to open the Custom filter window, where you can specify a condition for data query;
  • All – cancels report data filtering;
  • <Column value> – allows you to filter report data by the selected column value.

Icon

Appears to the left of the column name when the cursor points to the column; it enables all elements of the column to be displayed: object type, its full path and name.

Use these settings in the following tasks

Computer protection status

Actions with quarantined objects


The Status tab

This tab displays a list of security problems, a description of each, and possible solutions. The problems are listed in order of priority: the most important first, then less important ones, and finally informational messages.

Neutralize all

This can be used to eliminate threats directly.

Details.

This allows you to switch to the Detected threats tab, which displays detailed information about each detected threat.

Update now

This allows you to switch to the Update tab in the main window to run an update task.

Hide message

This allows you to postpone the immediate elimination of the security problem.

Show hidden messages

The box enables / disables the display of previously hidden messages in the list of detected problems.

Use these settings in the following tasks

Computer protection status


The Select update source window

Source

In this field you need to specify the path to the update source manually or select a folder in the tree in the upper part of the window.

You can specify as the source an FTP or HTTP site, network or local folder. If you select a resource outside the LAN as an update source, you must have an Internet connection to update.

To specify paths to update sources, the following formats are used:

  • For an FTP or HTTP website – URL address, IP address.

    For an FTP resource, you can specify authentication settings in the URL address, in the following format: ftp://<user name>:<password>@<host>:<port> (for example, URL http://dnl-01.geo.kaspersky.com/, IP 93.191.13.103).

  • For a local folder – its full path.

When an HTTP resource is selected as an update source, the authentication settings cannot be specified.


The Objects Scan window

The window displays the following information about the execution of the scan task:

  • expected time of completion
  • duration
  • number of objects scanned and threats found
  • progress

    Detailed report

    Opens the Detailed report window, which provides detailed information about the execution of the scan task.

    Close

    Closes the window.


The Custom filter window

Condition

Data querying condition.

Available values:

  • is greater than – selects all data whose values are greater than the value specified in the field on the right;
  • is less than – selects all data whose values are less than the value specified in the field on the right;
  • equals – selects all data whose values equal the value specified in the field on the right;
  • does not equal – selects all data whose values do not equal the value specified in the field on the right.

And

Data querying is performed using the logical conjunction (logical AND) operation. Thus, all data that meet the two conditions are queried. You can specify the second condition in the field below.

Or

Data querying is performed using the logical disjunction (logical OR) operation. Thus, all data that meet at least one condition are queried. You can specify the second condition in the field below.

Use these settings in the following tasks

Using complex filtering


The Search window

Line

Key word or word combination by which data should be found.

Column

Column of the list in which the key word or word combination should be searched for.

Available values:

  • All – search is performed in all columns of the list.
  • <Column name> – search is performed in a specified column. In this case, the search requires less time.

Match case

This box enables / disables regard for the case of a key word or word combination when searching for it.

This box is unchecked by default.

Match whole word only

This box enables / disables searching for a whole key word or word combination.

This box is unchecked by default.

Find next

Clicking this button allows you to start / continue searching for a key word or word combination.

Mark all

Clicking this button allows you to mark all data found that match the keyword you have specified.

Use these settings in the following tasks

Events search


The Report tab

The tab displays a report on the execution of scan tasks. The report contains statistics on the detection of malicious objects. Objects are grouped according to the approved classification of computer security threats.

Detailed report

This opens the Detailed report window which can be used to view detailed reports on the execution of Kaspersky Rescue Disk tasks.


The Scope tab

In the File types section, you can select types of objects that Kaspersky Rescue Disk should scan. The default settings in this section depend on the selected level of security.

All files

Kaspersky Rescue Disk scans files of all formats and extensions.

This is the default setting.

Files scanned by format

If you select this option, Kaspersky Rescue Disk only scans files, into which a virus may penetrate. Prior to scanning an object for viruses, its internal header is analyzed in order to determine the file format. The application also takes the file extension into account when scanning.

Files scanned by extension

In this case, Kaspersky Rescue Disk only scans files, into which a virus may penetrate. The file format is determined based on its extension.

Files without extensions are always scanned, regardless of the file type selected in the File types section.

Icon

This opens the Kaspersky Rescue Disk help window at the section describing the extensions of files scanned by Kaspersky Rescue Disk.

The Scan optimization section can be used to reduce the scan time.

Skip objects scanned longer than

This box enables / disables a restriction on scan duration for one object. When the specified time interval passes, file scanning will be discontinued, and Kaspersky Rescue Disk will skip the file.

This box is unchecked by default.

If you check the box, the scan stops in 30 seconds by default.

The Scan of compound files section contains the list of compound file types which Kaspersky Rescue Disk checks for viruses. The default settings in this section depend on the selected level of security.

Scan archives

This box enables / disables scanning of RAR, ARJ, ZIP, CAB, LHA, JAR and ICE archives.

The box is checked by default.

Scan installation packages

The box enables / disables scanning of installation files.

The box is checked by default.

Scan embedded OLE objects

This box enables / disables scanning of OLE-objects embedded in files (such as Microsoft Office Excel spreadsheets or macros embedded in Microsoft Office Word files, email attachments) by Kaspersky Rescue Disk.

The box is checked by default.

Parse email formats

This box enables / disables the option for Kaspersky Rescue Disk to scan files in email formats and mail databases.

If this box is checked, Kaspersky Rescue Disk deconstructs the email format file and analyzes each component (body, attachments) for viruses.

If this box is unchecked, Kaspersky Rescue Disk scans the email format file as a single object.

By default, the box is not checked.

Additional

This open the Compound files window. In the window you can change the maximum size of the compound file to be scanned.

Use these settings in the following tasks

Changing the type of objects to scan

Restricting scan duration

Scanning of compound files


The Compound files window

In the Size limit section, you can set restrictions on the size of compound files that Kaspersky Rescue Disk should unpack and scan.

Do not unpack large compound files

If the box is unchecked, Kaspersky Rescue Disk excludes from scan compound files of size exceeding the specified value (except large-sized files extracted from archives). If this box is not checked, Kaspersky Rescue Disk scans files of all sizes.

This box is unchecked by default.

Maximum file size

Kaspersky Rescue Disk only scans files with size, which does not exceed the specified value. The value is specified in megabytes.

By default, a maximum file size of 100 MB is set.


The Select object to scan window

The window displays a tree diagram of all objects on the computer than can be scanned for viruses.

Object

Path to the selected folder / file for scanning.

Add

This adds the selected object to the list for scanning.

Include subfolders

This box enables / disables scanning of subfolders inside the selected folder. If a subfolder contains more subfolders, they will be scanned as well. Kaspersky Rescue Disk scans subfolders at all levels.

This box is checked by default.


Roll back update window

Roll back to the previous update

This starts the process of rolling back the anti-virus databases to the previous update.

Cancel

Closes the window.

Use these settings in the following tasks

Rolling back the last update


The Threats window

This window displays a list of detected threats. You can select threats that Kaspersky Rescue Disk must detect.

Regardless of the settings configured in this window, Kaspersky Rescue Disk always detects viruses, worms and Trojans.

The boxes next to the names of the threats enable / disable detection of the threat by Kaspersky Rescue Disk.

Use these settings in the following tasks

Selecting the detectable threat categories


The Threats type window

Threats type

Full name of a threat in accordance with the classification given by the Virus Encyclopedia, or the name of a threat defined by a mask.


The Proxy server settings window

Use proxy server

This box enables / disables use of a proxy server for connection to the Internet. Kaspersky Rescue Disk uses these settings to update databases and program modules.

This box is checked by default.

Address

Contains the IP address or symbol name (URL address) of a proxy server.

The field is editable if the Use specified proxy server setting is selected (for example, IP 192.168.0.1).

Port

The port of the proxy used to update Kaspersky Rescue Disk.

The field is editable if the Use proxy server setting is selected.

By default, port number 80 is specified.

Use proxy server authentication

Authentication is verification of the user's registration data.

This box enables / disables use of authentication on the proxy server.

If the box is checked, Kaspersky Rescue Disk will first attempt to perform NTLM authentication, and then BASIC authentication.

If the box is unchecked or the settings of a proxy server are not specified, Kaspersky Rescue Disk will attempt to perform NTLM authentication using the account, under which the task has been run (for example, an update task).

If the proxy server requires authentication and you did not enter the username and password or the data specified were not accepted by the proxy server for some reason, a window will pop up, asking for username and password for authentication. If the authentication is successful, Kaspersky Rescue Disk will then use the specified name and password in the future. Otherwise, Kaspersky Rescue Disk will request the authentication settings again.

This box is unchecked by default.

User name

Contains user name used for authentication on the proxy server.

Password

The password for the specified user name.

Bypass proxy server for local addresses

If the box is checked, Kaspersky Rescue Disk will not use a proxy while updating from a local or network folder.

If the box is unchecked, Kaspersky Rescue Disk will use a proxy for updates from a local or network folder.

This box is unchecked by default.

Use these settings in the following tasks

Configuring settings to connect to proxy server


The Additional tab

In the Scan methods section, you can select methods that Kaspersky Rescue Disk should use when scanning the computer.

Signature Analysis

When performing signature analysis, Kaspersky Rescue Disk uses databases that contain descriptions of known threats and ways of neutralizing them. Protection using signature analysis provides a minimal level of security.

Following the recommendations of Kaspersky Lab's experts, this method is always enabled.

Heuristic Analysis

This box enables / disables heuristic analysis during virus scanning.

Heuristic analysis - technology designed for detecting threats that cannot be identified using the Kaspersky Lab application databases. It allows detection of objects suspected of being infected with an unknown virus or a new modification of known viruses.

The use of a heuristic analyzer detects up to 92% of threats. This mechanism is fairly effective and very rarely leads to false positives.

Files detected by the heuristic analyzer are classified as potentially infected.

The slider

The slider allows you to adjust the detail level of heuristic analysis. The scanning intensity level sets the balance between the thoroughness of searches for new threats, the load on the operating system's resources and the time required for scanning.

The following scanning intensity levels are available:

  • Light scan. Heuristic analyzer performs fewer operations found inside executable files. The probability of threat detection in that mode is somewhat lower. Scanning is faster and less resource-intensive.
  • Medium scan. Heuristic analyzer performs the number of instructions found within executable files recommended by the experts of Kaspersky Lab.
  • Deep scan. Heuristic analyzer performs more operations found in executable files. The probability of threat detection in that mode is higher. Scanning consumes more system resources and takes longer.

The slider is available if the Heuristic analysis box is checked.

Use these settings in the following tasks

Selecting the scan method


The Exclusion rules tab

In this window you can create a trusted zone, which is a list of objects that Kaspersky Rescue Disk does not monitor.

An object may be represented by a file of a certain format, a group of files defined by mask, a specified area (for example, a folder), or an object defined by type of threat according to the Virus Encyclopedia classification.

Trusted zone should be created with regard for the properties of files that you handle, and for applications installed on the computer. You may be required to create a trusted zone if, for example, Kaspersky Rescue Disk blocks access to an application that you are sure is safe.

List of exclusion rules

Located in the top part of the window, it allows you to create a list of objects that Kaspersky Rescue Disk will not monitor.

An Exclusion rule is a set of conditions under which an object should not be scanned by Kaspersky Rescue Disk. An object may be represented by a file of a certain format, a group of files determined by mask, a specified area (for example, a folder), a program process, or an object determined by type of threat according to the Virus Encyclopedia classification.

If the box in the string with a rule is checked, Kaspersky Rescue Disk excludes objects from scan according to this rule.

If the box in the string with a rule is unchecked, Kaspersky Rescue Disk scans objects, ignoring this rule.

Object

Column, which specifies the path to an object excluded from scan.

You can specify a file name, folder or filename mask as an object.

File mask is a file name and extension represented with wildcards.

The two standard wildcards used in file masks are * and ?, where * represents any number of any characters and ? stands for any single character. Using these wildcards, you can represent any file. Note that the name and extension are always separated by a period.

Threats type

Column, which specifies the mask of a threat type. If a threat, which corresponds to the mask, is detected, Kaspersky Rescue Disk applies the rule.

Add

This opens the Exception rule window, in which you can add an exception to the list of exceptions.

Edit

This opens the Exception rule window, in which you can change the settings of the exclusion selected in the list.

Delete

This deletes the exception rule from the list

In the Rule descriptions section located in the bottom part of the window, you can view information about a rule selected from the list. When selecting a rule, this section displays links that you can use to edit the settings of the selected rule.

Object: select object

The link opens the Object name window, in which you can set an exclusion by object name. You can specify a file, folder or file mask as an object.

The link is available if the Object box in the Properties field in the Exclusion rule window is checked.

Threats type: enter threat name

The link opens the Threats type window, in which you can set an exclusion by type of threat. You can specify a complete threat name in accordance with the classification in the Virus Encyclopedia, or a threat name mask.

The link is available if the Threats type box in the Properties field in the Exclusion rule window is checked.

Use these settings in the following tasks

Creating trusted zone


The Source tab

The Source list

Contains the addresses of locations from which Kaspersky Rescue Disk downloads and installs updates for its databases. Supported locations include FTP or HTTP servers and network or local folders.

During the update process, Kaspersky Rescue Disk calls this list, selects the address of the first server, and tries to download updates from this server. If updates cannot be downloaded from the first server, Kaspersky Rescue Disk tries to connect and retrieve the updates from the next server. The address of the server from which the update is performed is automatically placed at the head of the list. During the next update from Kaspersky Lab’s servers, Kaspersky Rescue Disk first accesses the server from which the update was successfully performed.

If the box in the update source string is checked, Kaspersky Rescue Disk uses this update source.

If the box in the update source string is unchecked, Kaspersky Rescue Disk does not use this update source.

By default, the list contains only Kaspersky Lab's update servers. This update source cannot be edited or removed.

Add

Opens the Select update source window. In the window you can select the update source.

Edit

Opens the Select update source window. In the window you can change the selected update source.

Delete

Removes the selected update source from the list.

Move up

Moves the selected update source one line higher.

Move down

Moves the selected update source one line lower.

Proxy server

Opens the Proxy server settings window In the window you can configure the settings to access the Internet via a proxy server.

In the Regional settings section you can select the location of the update server that suits you the best if you use Kaspersky Lab update servers as an update source.

Detect automatically

Information about your location is copied from your operating system's registry when the update is being performed.

This is the default setting.

Select from the list

During the update procedure, Kaspersky Rescue Disk contacts the update server of the specified country.

For this setting, a dropdown list is available from which to select the nearest country.

Use these settings in the following tasks

Selecting an update source

Selecting the update server region


The Update window

The window displays the following information about the execution of the task to update Kaspersky Rescue Disk anti-virus databases and modules:

  • task execution time;
  • path to the downloadable file;
  • amount of downloaded information;
  • data transfer rate;
  • address of update server.

    Detailed report

    Opens the Detailed report window, which provides detailed information about the execution of the scan task.

    Close

    Closes the window.


List of objects scanned by extension

If you selected Files scanned by extension as objects to be scanned for viruses, the scan task analyzes in detail files with the following extensions:

com – executable file for a Microsoft Windows program no larger than 64 KB;

exe – executable file, Microsoft Windows self-extracting archive;

sys – Microsoft Windows system file;

prg – program text for dBase, Clipper or Microsoft Visual FoxPro®, or a WAVmaker program;

bin – Microsoft Windows binary file;

bat – Microsoft Windows batch file;

cmd – command file for Microsoft Windows NT (similar to a bat file for MS-DOS®), OS/2;

dpl – compressed Borland Delphi library;

dll – Microsoft Windows dynamic link library;

scr – Microsoft Windows splash screen;

cpl – Microsoft Windows control panel module;

ocx – Microsoft OLE (Object Linking and Embedding) object;

tsp – Microsoft Windows program running in split-time mode;

drv – Microsoft Windows device driver;

vxd – Microsoft Windows virtual device driver;

pif – Microsoft Windows program information file;

lnk – Microsoft Windows link file;

reg – Microsoft Windows system register key registration file;

ini – Microsoft Windows initialization file;

cla – Java class;

vbs – Visual Basic script;

vbe – BIOS video extension;

js, jse – JavaScript source text;

htm – hypertext document;

htt – Microsoft Windows hypertext header;

hta – hypertext program for Microsoft Internet Explorer®;

asp –Active Server Pages script;

chm – compiled HTML file;

pht – HTML file with integrated PHP scripts;

php – script integrated into HTML files;

wsh – Microsoft Windows Script Host file;

wsf – Microsoft Windows script;

the – Microsoft Windows 95 desktop wallpaper file;

hlp – Win Help file;

eml – Microsoft Outlook® Express email message;

nws – new Microsoft Outlook Express email message;

msg – Microsoft Mail email message;

plg – email message;

mbx – extension for saved Microsoft Office Outlook email;

doc* – Microsoft Office Word document, for example: doc – Microsoft Office Word document, docx – Microsoft Office Word 2007 document with XML support, docm – Microsoft Office Word 2007 document with macro support;

dot* – Microsoft Office Word document template, for example, dot – Microsoft Office Word document template, dotx – Microsoft Office Word 2007 document template, dotm – Microsoft Office Word 2007 document template with macro support;

fpm – database program, Microsoft Visual FoxPro start file;

rtf – Rich Text Format document;

shs – Shell Scrap Object Handler fragment;

dwg – AutoCAD drawing database;

msi – Microsoft Windows Installer packet;

otm – VBA project for Microsoft Office Outlook;

pdf – Adobe Acrobat document;

swf – Shockwave Flash packet object;

jpg, jpeg, png – file format to save compressed images;

emf – Enhanced Metafile format file. Next generation of Microsoft Windows OS metafiles;

ico – object icon file;

ov? – MS Word executable files;

xl* – Microsoft Office Excel® documents and files, such as: xla – Microsoft Office Excel extension, xlc – diagram, xlt – document template, xlsx – Microsoft Office Excel 2007 workbook, xltm – Microsoft Office Excel 2007 workbook with macros support, xlsb – Microsoft Office Excel 2007 workbook in binary (not XML) format, xltx – Microsoft Office Excel 2007 template, xlsm – Microsoft Office Excel 2007 template with macros support, xlam – Microsoft Office Excel 2007 plug-in with macros support;

pp* – Microsoft Office PowerPoint® documents and files, such as: pps – Microsoft Office PowerPoint slide, ppt – presentation, pptx – Microsoft Office PowerPoint 2007 presentation, pptm – Microsoft Office PowerPoint 2007 presentation with macro support, potx – Microsoft Office PowerPoint 2007 presentation template, potm – Microsoft Office PowerPoint 2007 presentation template with macro support, ppsx – Microsoft Office PowerPoint 2007 slide show, ppsm – Microsoft Office PowerPoint 2007 slide show with macro support, ppam – Microsoft Office PowerPoint 2007 plug-in with macro support;

md* – Microsoft Office Access® documents and files, such as: mda – Microsoft Office Access workgroup, mdb – database, etc;

sldx – a Microsoft PowerPoint 2007 slide;

sldm – a Microsoft PowerPoint 2007 slide with macro support;

thmx – a Microsoft Office 2007 theme.

The actual format of a file may not match its file name extension.


The Objects Scan window

Resume scan

Resumes the scan task at the point where it was suspended.

Start new scan

Restarts the scan task.

Cancel

Closes the window.


The Objects Scan tab

On the Objects scan tab, you can create a list of objects to scan, start a scan task, and monitor its progress.

Start objects scan

Starts the objects scan task.

The button is active if the list of objects to scan is not empty.

Stop objects scan

Stops the objects scan task.

The button is active if the objects scan task is in progress.

List of objects

The list of objects includes disks, files and folders that should be scanned by Kaspersky Rescue Disk when the Objects Scan task is run.

By default, Kaspersky Rescue Disk scans only Boot sectors and Hidden autorun objects.

If the box next to the object is checked, Kaspersky Rescue Disk scans the object when executing the task.

If the box next to the object is not checked, Kaspersky Rescue Disk temporarily excludes this object from scanning.

Add

Opens the scan object selection window.

Edit

Opens the Select object to scan window, in which the object selected in the list can be changed.

Delete

Deletes the selected object from the list.

Use these settings in the following tasks

Starting and stopping the objects scan

Creating a list of objects to scan


The Update tab

On the Update tab, you can start an update of the Kaspersky Rescue Disk anti-virus databases and modules, roll back to the previous update, and view information about the current status of the databases:

  • database status;
  • database release date;
  • information about the number of records in the anti-virus databases.

    Run update

    Runs the task to update the anti-virus databases and modules.

    Stop update

    Stops the task to update the anti-virus databases and modules.

    The button is active if the update is in progress.

    Roll back to the previous databases

    Rolls back to the previous version of the anti-virus databases.

    The button is active if the application has been updated.

    Virus activity review

    Opens a browser window at www.kaspersky.com with a review of virus activity.

Use these settings in the following tasks

Starting and stopping the update task


The Objects Scan section

In the Security level section you can select preset scan settings. You can select one of the three security levels created by Kaspersky Lab specialists, or adjust the scan settings on your own.

High

Security level which should be selected if probability of computer infection is very high.

As opposed to the default scan settings, the scan settings of this security level make Kaspersky Rescue Disk scan all types of files. When scanning compound files, Kaspersky Rescue Disk also scans mail-format files.

Recommended

Security level which is suitable in most cases and recommended by Kaspersky Lab specialists.

This is the default security level.

Low

Security level which is the best option for handling applications with significant RAM requirements, as the number of files to scan is reduced at this level.

As opposed to the default scan settings, the scan settings of this security level make Kaspersky Rescue Disk scan only new and changed files. If more than 180 seconds are required to scan files, Kaspersky Rescue Disk excludes those files from scan.

Custom

The level of security is set if you adjusted the scan settings on your own.

Settings

Opens the Configure scan settings window.

Default level

Sets the Recommended security level.

In the Action section, you can select an action that Kaspersky Rescue Disk should perform if any infected or potentially infected objects are detected. By default, if Kaspersky Rescue Disk detects infected or potentially infected objects, it notifies you of detection and prompts you to select an action to be taken with regard to the object.

Prompt when the scan is complete

When Kaspersky Rescue Disk finishes a scan, it notifies you of detected threats and prompts the user for action to take on them.

This is the default option.

Prompt on detection

If Kaspersky Rescue Disk detects a threat when scanning, it immediately notifies the user of this event and prompts the user for action to take on detected object.

Select action: Inform

If Kaspersky Rescue Disk detects an infected or potentially infected object, it notifies you of this event. Kaspersky Rescue Disk moves detected objects to Quarantine.

This action is performed if the Perform action option is selected and the Disinfect and Delete boxes are unchecked.

Select action: Disinfect

Kaspersky Rescue Disk automatically attempts to disinfect each infected or potentially infected object that it has detected. Before attempting to disinfect an infected object, Kaspersky Rescue Disk creates a backup copy for subsequent restoration or disinfection.

This action is performed if the Perform action option is selected, the Disinfect box is checked, and the Delete if disinfection fails box is unchecked.

Select action: Delete

Kaspersky Rescue Disk deletes infected objects without attempting to disinfect them. Before deleting an infected object, Kaspersky Rescue Disk creates a backup copy for subsequent restoration or disinfection.

This action is performed if the Perform action option is selected, the Disinfect box is unchecked, and the Delete box is checked.

Select action: Disinfect, if not possible - delete

Kaspersky Rescue Disk automatically attempts to disinfect each infected or potentially infected object that it has detected. If disinfection fails, Kaspersky Rescue Disk deletes the object. Before attempting to disinfect or delete an infected object, Kaspersky Rescue Disk creates its backup copy for subsequent restoration or disinfection.

This action is performed if the Perform action option is selected and the Disinfect and Delete if disinfection fails boxes are checked.

Use these settings in the following tasks

Changing security level

Changing actions to be performed on detected objects

Restoring default scan settings


The Update Center section

In the Update source section, you can view information about the update source used by Kaspersky Rescue Disk.

Settings

Opens the Configure update settings window.


Threats and Exclusions subsection

In the Threats section, you can select which threats are to be detected.

Settings

Opens the Threats window.

In the Exceptions section, you can create a list of objects that Kaspersky Rescue Disk does not process.

Settings

Opens the Trusted zone window.


Notifications subsection

Enable events notifications

The box enables / disables user notifications about events that occur in the running of Kaspersky Rescue Disk.

The box is checked by default.

Settings

Allows notification settings to be configured.

The button is active if the Enable events notifications box is checked.

Use these settings in the following tasks

Disabling notifications


Reports and Storages subsection

In the Reports section, you can enable logging of non-critical events in reports. By default, the product does not add non-critical events or registry and file system events to its reports. You can also configure the settings to create and save reports.

Log non-critical events

The box enables / disables the function to add information to reports about non-critical events that occur in the running of Kaspersky Rescue Disk.

This box is unchecked by default.

Store reports no longer than

The box enables / disables the option that defines the maximum duration for report storage. Storage duration is defined in days.

If the box is checked, reports are stored no longer than 30 days, by default. When this time interval expires, Kaspersky Rescue Disk clears reports.

If the box is unchecked, storage duration for reports is not restricted.

This box is checked by default.

Maximum file size

This box enables / disables the option that defines the maximum report file size. Maximum file size is specified in megabytes.

If the box is checked, the default maximum report size is 1024 MB. When the maximum size is exceeded, the oldest records are removed from the file, while new ones are added.

If the box is unchecked, the report file size is not restricted.

This box is checked by default.

Clear all

Opens the Clearing reports window In the window you can select reports to be deleted.

By default, Kaspersky Rescue Disk deletes scan and update task reports.

In the Quarantine and Backup section, you can configure the settings for storing objects in Quarantine and copies of objects in Backup.

Store objects no longer than

The box enables / disables the option that defines the maximum storage duration for quarantined objects and object copies in Backup. Storage duration is defined in days.

If the box is checked, the default storage duration is 30 days; then Kaspersky Rescue Disk deletes the stored objects.

If the box is unchecked, storage duration for objects is not restricted.

This box is checked by default.

Maximum size

The box enables / disables the option that defines the maximum data storage size. Storage size is specified in megabytes.

If the box is checked, the default maximum storage size is 100 MB. When the maximum size is exceeded, the oldest objects are removed from the storage, while new ones are added.

If the box is unchecked, storage size is not restricted.

This box is unchecked by default.

Use these settings in the following tasks

Storing quarantine and backup objects

Recording non-critical events into the report

Storing reports


The Detailed report window

To the table of contents

Detailed report window

List of tasks

This allows you to select a task to view a report.

Available values:

  • Objects scan
  • Updates

View

This allows you to select criteria for grouping events in the report.

Available values:

  • Do not group – report data are displayed without grouping.
  • Group by result – report data are grouped by the results of event processing performed by Kaspersky Rescue Disk.

List of events

This allows you to select types of objects to display in the report.

Available values:

  • Critical events – report data is filtered by critical events.
  • Important events – report data is filtered by important events.
  • All events – all events are displayed in the report.

Save

This button allows you to open a standard window to save the list of detected threats in a TXT or CSV file.

Columns of the list of events:

  • Time

    This column displays the time when the event occurred. You can use the filter menu for this column.

  • Result

    Column displays the result of event processing performed by Kaspersky Rescue Disk. You can use the filter menu to display the elements of this column: description, type of threat detected, name, severity level, accuracy.

  • Object

    This column displays the full path to the object on which the suspicious action was taken. You can use the filter menu to display the elements of this column: object type, its full path and name.

  • Size

    This column displays the size of the update file download.

  • Reason

    This column displays the reason why the event occurred. You can use the filter menu for this column.

  • Detectable threat categories

    This column displays statistics on the detection of malicious objects. Objects are grouped according to the approved classification of computer security threats.

  • Total

    This column displays the number of records in the anti-virus databases.

  • Database release date

    This column displays the release date of the anti-virus databases.

Icon filter menu icon

Appears to the left of the column name when the cursor points to the column; the filter menu opens:

The filter menu contains the following items:

  • Custom – allows you to open the Custom filter window, where you can specify a condition for data query;
  • All – cancels report data filtering;
  • <Column value> – allows you to filter report data by the selected column value.

Icon

Appears to the right of column name when the cursor points to the column; it can be used to display all the column elements.

Icon

This is located to the left of the event header; it can be used to view detailed information about the event.

Button

This enables/ disables the display of extended statistics.

Use these settings in the following tasks

Selecting task to create a report

Managing grouping of information in the report

Selecting event types

Configuring the display of data on the screen

Saving report into file

Extended statistics display