McAfee MTP08EMB3RUA Product Guide - Page 70

4 Using Virus and Spyware Protection How detections are handled How detections are handled The type of threat and the policy settings determine how virus and spyware protection handles a detection. Items with detections Files and programs How virus and spyware protection handles the detections Virus detections: Virus and spyware protection attempts to clean the file. If it can be cleaned, the user is not interrupted with an alert. If it cannot be cleaned, an alert appears, and the detected file is deleted. A copy is placed in the quarantine folder. Potentially unwanted program detections: In Protect mode, detections are cleaned or deleted. In Prompt mode, users must select the response. In all cases, a backup copy of the original item is saved in a quarantine folder, in a proprietary binary format. Data for all activity is uploaded to the SecurityCenter for use in reports. Files are placed into the quarantine folder in a format that is no longer a threat to the client computer. It is not necessary to view or delete them, but you might occasionally want to do so. In these situations, you must view files on the client computer by using the Quarantine Viewer. Only users logged on as an administrator can access the Quarantine Viewer. After 30 days, these files are deleted. Registry keys and cookies Detections initially appear as Detected. Cleaning detected files also cleans their associated registry keys and cookies. Their status is then reported as Cleaned. Spyware protection mode and detections Spyware protection monitors programs that attempt to install or run on client computers. When it detects an unrecognized program, it either allows or blocks it. The response is based on the spyware protection mode selected in the policy assigned to the client computer. In this mode... Protect Prompt Report Spyware protection does this... Checks the list of allowed and blocked programs created by the administrator for computers using the policy. If the program is not on the list, spyware protection blocks the potentially unwanted program. Checks the list of approved and blocked programs created by the administrator for computers using the policy. Checks the list of programs the user has approved. If the program is not on either list, spyware protection displays a prompt with information about the detection and allows the user to select a response. This setting is the default. Checks the list of approved and blocked programs created by the administrator for computers using the policy. If the program is not on the list, it sends information about the potentially unwanted program to the SecurityCenter and takes no additional action. For all modes, detections are reported to the SecurityCenter, where you can view information about them in reports. To prevent popup prompts from appearing on client computers when potentially unwanted programs are detected, and for highest security, we recommend using Protect mode. 70 McAfee Total Protection Service 5.1.5 Product Guide