McAfee MAP-3300-SWG Product Guide - Page 107

Overview of Email features Email Policies Customized anti-virus settings Besides giving you the levels of scanning (such as default file types, which scans only the most susceptible files), the appliance also allows you to specify various options when scanning for viruses. Email | Email Policies | Scanning Policies [Anti-Virus] -- Anti-Virus | Basic options Web | Web Policies | Scanning Policies [Anti-Virus] -- Anti-Virus | Basic options Although more options can provide greater security, scanning will take longer. The scanning capabilities are: • Detect possible new viruses in programs and documents. Documents that carry a virus often have distinctive features such as a common technique for replicating themselves. Using heuristics, the scanner analyzes the document to detect these kinds of computer instructions. Program file heuristics scans program files and identifies potential new file viruses. Macro heuristics scans for macros in the attachments (such as those used by Microsoft Word, Microsoft Excel, and Microsoft Office) and identifies potential new macro viruses. • Scan inside archive files. By default, the scanner does not scan inside file archives such as .zip or .lzh files because any infected file inside them cannot become active until it has been extracted. • Scan default file types. Normally, the scanner examines only the default file types - it scans only those files that are susceptible to infection. For example, many popular text and graphic formats are not affected by viruses. Currently, the scanner examines over 100 file types by default, including .exe and .com. • Scan all files. This option ensures that every file is scanned. Some operating systems, such as Microsoft Windows, use the extension names of files to identify their type. For example, files with the extension .exe are programs. However, if an infected file is renamed with a harmless extension such as .txt, it can escape detection and the operating system can run the file as a program if it is renamed later. • Scan files according to file name extension. You can specify the types of files you want to scan according to their file name extensions. • Treat all macros as viruses. Macros inside documents are a popular target for virus writers. Therefore, for added security, consider scanning all files for macro viruses, and optionally removing any macros found, regardless of whether they are infected. • Scan compressed program files. This is used to scan compressed files such as those compressed using PKLITE. If you are scanning selected file extensions only, add the appropriate compressed file extensions to the list. Detection of new and unknown viruses An anti-virus scanner uses signatures and heuristic analysis to detect viruses. A virus signature is a binary pattern found in a virus-infected file. Using information in its anti-virus definition (DAT) files, the scanner searches for those patterns. Email | Email Policies | Scanning Policies [Anti-Virus] -- Anti-Virus | Basic options This approach cannot detect a new virus because its signature is not yet known. Therefore another technique, known as heuristic analysis, is employed. McAfee Email and Web Security Appliances 5.6.0 Product Guide 107