Web Gateway 7.1.5 Product Guide - McAfee

Module for virus and malware filtering
Web filtering
Virus and malware filtering 6
The Anti-Malware module (also known as Anti-Malware engine) scans web objects for infections by
viruses and other malware. This section tells you how to configure this module and describes the
module settings.
The blocking rule of the virus and malware filtering process relies on the Anti-Malware module to find
out whether a web object is infected by viruses or other malware. By configuring settings for it, you can
let the module do its scanning job in different ways.
Note: This means that when you edit the module settings, you also modify the blocking rule that uses it. You
should therefore make sure you know which blocking rule uses the module whose settings you edit. You can
do this, for example, by reviewing the rule in the virus and malware filtering rule set to see which settings
name appears in the rule criteria.
The module has three submodules, which can run in different combinations. Each submodule uses
different methods to detect infections in web objects.
Note: Which of the submodules are available on your appliance depends on the licenses you have purchased.
• McAfee Gateway Anti-Malware — Uses proactive methods. You can configure several advanced
settings for this submodule, however not for the other two.
• McAfee Anti-Malware — Uses virus signatures. In contrast to the proactive methods, virus
signatures can only be applied to detect viruses that are already known.
• Avira — Provides the scanning methods of a third-party product.
The submodules and their methods can be combined into scanning modes as follows:
Mode a: proactive + signatures + third-party
Mode b: proactive + signatures
Mode c: signatures only
Other module settings are for the AV PreScan option, which reduces the scanning load, or the Mobile
Code Behavior option, which lets you set a level of strictness in classifying code.
For more information, see Configure the Anti-Malware module and Select a different mode for scanning
web objects.
Configure the Anti-Malware module
This section tells you how to configure settings for the Anti-Malware module.
Complete the following procedure to configure these settings:
1 Go to Policy | Settings.
2 On the settings tree, go to Engines | Anti-Malware and select a settings name, for example,
Gateway Antimalware.
3 Configure these settings as needed.
4 Click Save Changes.
For more information on these settings, see Anti-Malware engine settings.
McAfee Web Gateway 7.1.5 Product Guide 181