ServerProtect

Provide automatic virus protection for your servers

A virus infestation on a Windows NT server is a systems administrator's nightmare. One server can infect all the workstations on a network, and the cost of restoring the system is astronomical. Trend Micro's ServerProtect can help prevent such an infestation.

ServerProtect, a comprehensive virus detection and eradication tool for NT systems, uses a domain concept to manage servers. Each domain performs administrative functions (e.g., validates users) and contains one or more information servers that act as repositories for the software's configuration information.

The software uses a pattern file, which Trend Micro updates regularly, todetect viruses on your system. You can read the pattern file on the company'sWeb site and remain informed about the most recently discovered viruses. Whenyou run a virus scan (manually or automatically), ServerProtect compares fileinformation against the pattern file. If the software finds a match, youprobably have a virus on your system.

Straightforward Installation
Although installing ServerProtect is straightforward, the process is more complicated than the process of competing NT-based antivirus software. After youanswer the standard questions, you need to determine whether the installationwill operate as a standard server or an information server. You also need toprovide a domain name, choose the type of action to take (by default) if thesystem detects a virus, and provide the username and password that theServerProtect service will run under.

ServerProtect is easy to use. You can manage your domain withServerProtect's administration program while the background NT service checksfor viruses. When you launch the administration program, as Screen 1 shows, youopen a window that contains a list of domains and the servers they protect. Youcan lock and unlock domains (to prevent or permit configuration changes), addservers to domains, or move servers within domains.

To control how the software scans your servers, click Configure on the menubar. You can schedule a manual scan, adjust your realtime scan parameters,adjust the automated scans on your system, manage the exceptions list, or set upnotification rules in case the software detects a virus.

An Ounce of Prevention
ServerProtect helps you prevent virus infestations in several ways. Thesoftware can scan your NT servers' files automatically. ServerProtect scans thefiles you specify (you can restrict the types of files it scans) and performsone of several actions when it detects a virus. These actions include deletingthe file, moving the file to another location, cleaning the virus from theinfected file (if possible), leaving the file alone, or notifying the systemsadministrator (e.g., by email, printer, or pager). ServerProtect can also checkthe contents of other system areas (e.g., the Master Boot Record--MBR) andperform user-initiated scans on demand.

ServerProtect's realtime scanning feature verifies whether inbound oroutbound data traversing the server's network links is virus-free. But usingthis feature might negatively affect your system's performance. When I usedrealtime scanning during my test, I saw a 10 percent performance drop on myinstallation. However, this drawback is minor, considering the thousands ofdollars I would spend on reconstruction if a virus propagated a frequentlyaccessed file on my network before my automated or manual scans could find it.

Unlike other products, ServerProtect doesn't limit you to initiating oneautomated scan of the entire system. You can program multiple scans so that youdon't tax your servers. If you need to scan multiple servers for viruses, andyou like the concept of centralized scanning management, take a closer look atServerProtect.