Web Gateway 7.1.5 Product Guide - McAfee

Virus and malware filtering
Web filtering
Virus and malware filtering 6
The appliance filters web objects to block viruses and other malware. This section gives an overview of
the virus and malware filtering process and describes in detail how you can modify it.
Virus and malware filtering process
Several elements work together in the virus and malware filtering process on the appliance. These
include:
• Filtering rules that control the process
• Whitelists that are used by rules to exempt particular web objects from filtering
• The Anti-Malware module, which is called by a suitable rule to scan web objects for infections by
viruses and other malware
Filtering rules
The rules that control the virus and malware filtering process are usually contained in one rule set.
There is a rule that blocks web objects if infected by viruses and other malware. To find out about
infections, the rule calls the Anti-Malware module, which scans objects and lets the rule know about its
findings.
Whitelisting rules can be placed and processed in this rule set before the blocking rule. If any of them
applies, the blocking rule is skipped and no virus and malware filtering is done for the whitelisted
objects.
You can review these rules, modify or delete them, and also create your own rules.
For more information, see Rules for virus and malware filtering.
Whitelists
Whitelists are used by whitelisting rules to let particular web objects skip the blocking rule, which
means there is no virus and malware filtering for these objects. There can be different whitelists for
URLs, media types, and other types of objects.
Note: Blocking lists are typically not used in virus and malware filtering because here the blocking depends
not on lists, but on the findings of the Anti-Malware module.
You can add entries to these lists or remove entries. You can also create your own lists and let them be
used by the whitelisting rules.
For more information, see Whitelists for virus and malware filtering.
Anti-Malware module
The Anti-Malware module scans objects to detect infections by viruses and other malware. Based on the
findings of this module, the blocking rule blocks access to web objects or lets them pass through.
You can configure settings for this module, for example, to let it scan objects using only virus
signatures to detect infections or also proactive methods.
For more information, see Module for virus and malware filtering.
McAfee Web Gateway 7.1.5 Product Guide 171