Webwasher 6.0.1 Anti-Malware User's Guide - McAfee

Content Security
4–22
Windows Executables
The Windows Executables section allows you to configure actions for Windows
executables that are potentially malicious. These may be downloaded
in a stand-alone manner or attached to e-mails.
This code may be openly hostile, i .e. perform operations that are usually
and primarily performed by hostile mobile code, e. g. usage of vulnerable
functionality.
The code may also perform only operations that are performed by all kinds of
mobile code, i. e. including code that is not hostile. These operations may,
however, open the door for hostile operations that are performed at a later point
of time, e. g. write access to local files.
You can configure actions with regard to all of these operations.
You can also configure different actions according to whether the probability
that the code in question will perform these operations is medium or high.
If you want to use the options provided in this section, make sure the checkbox
next to the section heading is marked. The checkbox is marked by default.
After modifying this setting or any other setting in this section, click on Apply
Changes to make the modification effective.
Use the drop-down lists in the following areas to configure actions for Windows
executables:
• Operations primarily performed by hostile mobile
In this area, select actions with regard to the:
— Dynamic creation of program code
This includes the programmatic evaluation of (formerly obfuscated) program
code.
— Usage of vulnerable functionality
This functionality is located in the host environment, e. g. the Web
browser or the Java VM.
• Operations primarily performed by all kinds of mobile code
In this area, select actions with regard to:
— Read access to local files
This includes the programmatic evaluation of (formerly obfuscated) program
code.