McAfee MAP-3300-SWG - Web Security Appliance 3300, Product Manual

Page: 106 / 336

What is a potentially unwanted program (PUP)?
Potentially unwanted programs (PUPs) are not considered to be malware like viruses and Trojan horses.
Email
|
Email Policies
|
Scanning Policies [Anti-Virus] McAfee Anti-spyware
Some software programs written by legitimate companies might alter the security or privacy of the
computer where they are installed. This software can include spyware, adware, and dialers, and might
be downloaded unwittingly with a program that the user wants. Cautious users prefer to know about
such programs, and in some cases, remove them.
Types of anti-virus scanning
This topic discusses the different types of anti-virus scanning.
Email
|
Email Policies
|
Scanning Policies [Anti-Virus] -- Anti-Virus
|
Basic options
• Scanning default file types
Normally the scanner examines only the default file types — in other words, it concentrates its
efforts on scanning those files that are susceptible to viruses. For example, many popular text and
graphic formats are not affected by viruses. Currently the scanner examines over 100 types by
default, which includes .exe and .com.
• Scanning all files
Some operating systems such as Microsoft Windows use the extension name of a file to identify its
type. For example, files with the extension .exe are programs. However, if an infected file is
renamed with a harmless extension such as .txt, it can escape detection. The operating system
cannot run the file as a program, unless it is renamed later. This option ensures that every file is
scanned.
• Scanning files according to file type
Some operating systems such as Microsoft Windows use file name extensions to identify the type of
file. For example, files with the extension .exe are programs, files with the extension .txt are
simple text files. You can specify the types of files you want to scan according to their file name
extension.
• Scanning inside archive files
By default, the scanner does not scan inside file archives such as .zip or .lzh files because any
virus-infected file inside them cannot become active until it has been extracted.
• Finding unknown viruses
An anti-virus scanner typically detects viruses by looking for the virus signature, which is a binary
pattern that is found in a virus-infected file. However, this approach cannot detect a new virus
because its signature is not yet known, therefore the scanner uses another technique — heuristic
analysis. Program file heuristics scans program files and identify potential new file viruses. Macro
heuristics scans for macros in the attachments (such as those used by Microsoft Word, Microsoft
Excel, and Microsoft Office) and identify potential new macro viruses.
• Treating all macros as infected
Macros inside documents are a popular target for virus writers. Therefore for added security, you
might consider scanning all files for macro viruses, and optionally removing any macro that is
found, regardless of whether it is infected.
• Scanning compressed program files
Compressed files (such as those compressed with PKLITE). If you are scanning selected file
extensions only, include the needed compressed file extensions in the list of file extensions to be
scanned.
Overview of Email features
Email Policies
106 McAfee Email and Web Security Appliances 5.6.0 Product Guide