Fortinet FortiGate FortiGate-100A, Administration Manual

Page: 312 / 388

312
01-28006-0068-20041105 Fortinet Inc.
heuristic Antivirus
CLI configuration
heuristic
The FortiGate heuristic antivirus engine performs tests on files to detect virus-like
behavior or known virus indicators. Heuristic scanning is performed last, after file
blocking and virus scanning have found no matches. In this way, heuristic scanning
may detect new viruses, but may also produce some false positive results.
The heuristic engine is enabled by default to pass suspected files to the recipient and
send a copy to quarantine. Once configured in the CLI, heuristic is enabled in a
protection profile when Virus Scan is enabled.
P2P Select enable to block peer to peer communications programs. P2P,
while a legitimate protocol, is synonymous with file sharing programs
that are used to swap music, movies, and other files, often illegally.
Spy Select enable to block spyware programs. Spyware, like adware, is
often included with freeware. Spyware is a tracking and analysis
program that can report your activities, such as web browsing habits, to
the advertiser’s web site where it may be recorded and analyzed.
Keylog Select enable to block keylogger programs. Keylogger programs can
record every keystroke made on a keyboard including passwords, chat,
and instant messages.
Hijacker Select enable to block browser hijacking programs. Browser hijacking
occurs when a ‘spyware’ type program changes web browser settings,
including favorites or bookmarks, start pages, and menu options.
Plugin Select enable to block browser plugins. Browser plugins can often be
harmless Internet browsing tools that are installed and operate directly
from the browser window. Some toolbars and plugins can attempt to
control or record and send browsing preferences.
NMT Select enable to block network management tools. Network
management tools can be installed and used maliciously to change
settings and disrupt network security.
RAT Select enable to block remote administration tools. Remote
administration tools allow outside users to remotely change and monitor
a computer on a network.
Misc Select enable to block any programs included in the miscellaneous
grayware category.
BHO Select enable to block browser helper objects. BHOs are DLL files that
are often installed as part of a software package so the software can
control the behavior of Internet Explorer 4.x and higher. Not all BHOs
are malicious, but the potential exists to track surfing habits and gather
other information.
Toolbar Select enable block custom toolbars. While some toolbars are
harmless, spyware developers can use these toolbars to monitor web
habits and send information back to the developer.
Download Select enable to block download programs. Download components are
usually run at Windows startup and are designed to install or download
other software, especially advertising and dial software.
Note: This guide only covers Command Line Interface (CLI) commands that are not
represented in the web-based manager. For complete descriptions and examples of how to use
CLI commands see the
FortiGate CLI Reference Guide .