1. In the notification area, in the context menu of the application icon, select the Compact Diagnostic Interface.
2. In the Compact Diagnostic Interface window that opens, click the Create Portable Scanner link.

   A New Portable Scanner Wizard window opens at the welcome step.

   To proceed to the next step of the wizard, click Next.

3. If necessary, import the Portable Scanner settings from a previously created XML file.
   1. Click Import.
   2. In the window that opens, select the XML file containing the Portable Scanner settings.
   3. Click Open.
   4. The settings from the XML file will be displayed at the subsequent wizard steps.
4. Add the key file required for creating the Portable Scanner.
   1. Click Select license file.
   2. In the window that opens, select the key file for the Portable Scanner.
   3. Click Open.
   4. The license information will be displayed in the wizard window.
5. Enable the actions to be performed by the Portable Scanner when started on the device:
   • Scan selected area with anti-virus databases. A Portable Scanner scans a selected area for viruses and other threats. A Portable Scanner applies the default security level: Disinfect. Delete if disinfection fails.
   • Record traffic from all network interfaces. A Portable Scanner records inbound and outbound traffic from a device being scanned for a specified amount of time.
   • Scan the system with OVAL rules. Depending on the settings, a Portable Scanner can scan a device for vulnerabilities, assess device security and operating system compliance, or collect device configuration data using rules written in OVAL and XCCDF.
6. Set up a scan scope.
   1. Click Add.
   2. In the opened Scan scope window, select the type of object that you want to add:
      • Predefined scope, if you want the scan scope to include one of the predefined scopes on the protected device. Then in the drop-down list, select the desired scan scope.
      • Disk, folder or network location, to include a single drive or folder in the scan scope. Then select the required scope in the window, opened by the Browse button.
      • File, to include a single file in the scan scope. Then, in the Browse window that opens, select the file.
   3. Click the OK button in the Scan scope window.
   4. Enable or disable the scan scope items by selecting or clearing the check box to the left of the scan scope name.
7. Configure the scan.
   1. Click Scan settings.

      The Scan settings window opens.

   2. On the General tab, select the appropriate options:
      • Scan objects.

        The following options are available:

        • All objects
        • Objects scanned by format
        • Objects scanned by the list of extensions specified in anti-virus databases
        • Objects scanned by specified list of extensions
        • Scan disk boot sectors
        • Scan alternate NTFS streams.
      • Scan of compound objects.

        The following options are available:

        • Archives
        • SFX archives
        • Email databases
        • Packed objects
        • Plain email
        • Embedded OLE objects.
   3. On the Additional tab, select the appropriate options:
      • General settings.
        • Restore file attributes after scanning
          If a file is opened during the scan, the last accessed time for the file is updated. As a result, the archivers and cloud storages recalculate file data to transfer it to a cloud or to a backup. To avoid the recalculation process, you can restore the last accessed time after scanning is performed. By default, the option is disabled.
        • Limit CPU usage for scan tasks
          This setting is used to avoid making the computer hang during scanning. This option may be crucial for industrial systems, where the main software is not supposed to freeze. By default, the option is disabled.
      • Folder for temporary files created during scanning.

        Click the Browse button to specify the folder for temporary files that will be created during the scan. By default, temporary files are created on the USB drive.

      • Action to perform on detected objects.
        • Disinfect, delete if disinfection fails
          Quarantine is unavailable for the Portable Scanner, so leaving a probably infected object may be unsafe. Use this option to remove the detected file if disinfection fails. By default, the option is enabled.
        • Inform
          Use this option for a quick scan. The security officers take the security measures when receiving a notification about the detected objects. Use this option for systems, where the workflow is not supposed to be interrupted by removing the industrial software modules. By default, the option is disabled.
      • Actions on unmodifiable compound files.

        Select the following option if applicable.

        Entirely remove the compound file that cannot be modified by the application in case of embedded object detection.

   4. On the Performance tab, select the appropriate options:
      • Exclusions.
        • Exclude files
          Use this option to exclude the files from scan scope and not remove them if detected. You can both specify a full path and use a mask. By default, the option is disabled.
        • Do not detect objects by type
          Use this option to avoid detection and subsequent removal of the objects. You can both specify a full path and use a mask. By default, the option is disabled.
      • Advanced settings.
        • Stop scanning if it takes longer than (sec)
          Use this option for scanning large files and the network when scanning takes a long time to complete. If it takes too long to scan an object, the timeout terminates the frozen process and the scanner proceeds with the scan scope examination. By default, the option is disabled.
        • Do not scan compound objects larger than (MB)
          Use this option to accelerate scanning. For example, you may want to skip the 100 GB database archives and exclude them from the scan scope. By default, the option is disabled.
        • Use iChecker technology
          For more information about iChecker technology, please refer to the article. By default, the option is enabled.
8. If required, under Network traffic recording, change the period for the Portable Scanner to record inbound and outbound traffic from the device being scanned. The default is 300 seconds.
9. Under Source of scanning rules, select the rule source that the Portable Scanner will use to audit device security.
   • Kaspersky ICS CERT vulnerabilities database for SCADA. If this source is selected, the Portable Scanner scans the device for all vulnerabilities described in the OVAL rules, in the Kaspersky ICS CERT for ICS vulnerability database.
   • Rules for collecting host configuration data. When this source is selected, the Portable Scanner collects configuration data from the host.

     Rules collect the following host data:

     • running services
     • Installed drivers
     • Scheduled tasks
     • Installed applications and patches
     • Names of shared network resources
     • Startup items
     • Host information (IP address, DNS name)
     • Local users and groups
     • Host hardware.
   • Compliance and security configurations for operating systems. If this source is selected, the Portable Scanner checks the device operating system settings for compliance with the security standards described in the OVAL and XCCDF rules.

   Kaspersky ICS CERT vulnerabilities database for SCADA, Rules for collecting host configuration data, and Compliance and security configurations for operating systems are provided with the Portable Scanner databases. Therefore, before starting the Portable Scanner with at least one of the listed rule sources selected, make sure that the Portable Scanner databases are up to date.

   • Custom rule database. If this source is selected, the Portable Scanner checks the device for vulnerabilities described in custom OVAL and XCCDF rules.
10. Select the removable drive where the Portable Scanner will be created:
    • Connected removable drive. Removable USB drive. Select the removable drive from the drop-down list.
    • Secure removable drive. Rutoken removable USB drive protected from reading, copying, and writing by the administrator password. If you have selected this option, select a secure removable drive at the next wizard step.
11. If required, enable Verify scanner data after writing to the disk.

    This feature verifies the Portable Scanner data. For example, if you are planning to create several Portable Scanners in a row with the same settings, verifying data for the very first Portable Scanner and discovering the discrepancies at an early stage saves time.

12. If you selected Secure removable drive, select from the drop-down list the connected Rutoken removable drive where to set up the Portable Scanner.

    To have the Rutoken removable drive displayed in the list of connected removable media on a computer running Windows Server 2022, you must replace the UMDF2 driver for USB card readers with the WUDF driver.

13. Under Security settings, in the Enter the current administrator password field, enter the administrator password set on the Rutoken removable drive to protect its contents from being read, copied, or written by potential intruders.
14. Change current administrator password if required.
    1. Select the Change the current password of administrator (only digits and Latin symbols are allowed) check box.
    2. Enter a new password in the appropriate field.
    3. Retype the password in the appropriate field.
15. Click Next.

    A wizard window opens containing a description of the Portable Scanner configuration.

16. If required, export the current Portable Scanner settings to an XML file.
    1. Click Export.
    2. In the window that opens, select the path where you want to save the XML file containing the Portable Scanner settings.
    3. Enter a name for the XML file.
    4. Click the Save button.
17. Click Create to create a Portable Scanner with the specified settings.

The portable scanner will be written to the selected removable drive. A Kavscan folder will appear on the removable drive, containing the files and folders required for the Portable Scanner to work.

If there is already a Portable Scanner on the removable drive, the wizard overwrites its files, except for reports.

If you decide to abort writing, the installation wizard terminates write operation without rolling back the changes made.

After you complete the setup, the wizard prompts you to create another Portable Scanner.

1. On the device, run a command line interpreter (for example, Command Prompt cmd.exe) with the permissions of the local administrator.
2. Using the cd command, navigate to the folder where the kavshell.exe file is located.

   For example: cd C:\Program Files (x86)\Kaspersky Lab\Kaspersky Industrial CyberSecurity for Nodes 4.5.0

   You can also add the executable file path to the %PATH% system variable and run the command without navigating to the application folder.

3. Run the following command:

   KAVSHELL PORTABLESCANNER /drive=<Name of the removable drive or serial number of the Rutoken removable drive> /license=<path to the license key file> [/tokenpin=<password> [/newtokenpin=<password>]] [/verify] [/av <settings of the scan for viruses and other threatening programs>] [/traffic <settings for recording of incoming and outgoing traffic on the scanned device>] [/oval <settings of the security audit task>]

   Command parameters for creating a Portable Scanner

   Parameter	Description
   PORTABLESCANNER	Required argument. Initiates the creation of a Portable Scanner.
   /drive=<Name of the removable drive or serial number of the Rutoken removable drive>	Required argument. Select the removable drive on which you want to generate a Portable Scanner: If the Portable scanner is to be written to a Rutoken removable drive, you must enter a ten-digit serial number of the Rutoken drive.
   /license=<path to the license key file>	Required argument. Specifies the path to the key file that is necessary for creating a Portable Scanner.
   /tokenpin=<password>	Optional argument. Sets an administrator password for access to the Rutoken drive.
   /newtokenpin=<password>	Optional argument. Sets a new administrator password for access to the Rutoken drive.
   /verify	Optional argument. Verifies the Portable Scanner after it is written to the removable drive.
   /av <settings of the scan for viruses and other threatening programs>	Optional argument. Scans for viruses and other threatening programs.
   /traffic <settings for recording of incoming and outgoing traffic on the scanned device>	Optional argument. Records incoming and outgoing traffic on the scanned device.
   /oval <settings of the security audit task>	Optional argument. Enables the security audit task.

At least one of the /av, /oval, or /traffic arguments must be specified.