Web Gateway 7.1.5 Product Guide - McAfee

Web filtering
Virus and malware filtering 6
Anti-Malware engine settings
You can configure the Anti-Malware engine settings. These are settings of the module used in virus and
malware filtering to scan web objects.
Note: These settings can be configured on the Settings tab of the Policy top-level menu.
Gateway Antimalware
Settings for the scanning module used in virus and malware filtering
Select Scanning Engines
Settings for selecting a combination of submodules to determine the scanning mode
McAfee Gateway Anti-Malware including McAfee Anti-Malware — When selected, these two
submodules and Avira are active
Web objects are then scanned using:
proactive methods + virus signatures + third-party module functions
McAfee Gateway Anti-Malware including McAfee Anti-Malware without Avira — When
selected, only the first two submodules are active
Web objects are then scanned using:
proactive methods + virus signatures
McAfee Anti-Malware only — When selected, only this submodule is active
Web objects are then scanned using:
signatures only
Mobile Code Behavior
Settings for configuring a risk level in classifying mobile code
The risk level can take values from 60 to 100.
A low value means the risk in proactively scanning the behavior of mobile code and not detecting that it
is malware is low because the scanning methods are applied very strictly. Mobile code will then be
classified as malware even if only a few criteria of being potentially malicious have been detected.
This can lead to classifying mobile code as malware that is actually not malicious (“false positives”).
While more proactive security is achieved with a stricter setting, accuracy in determining which mobile
code is really malicious will suffer. Consequently, the appliance might block web objects that you want
to get through to your users.
A high value means the risk in not detecting malicious mobile code is high (more “false negatives”), but
more accuracy is achieved in classifiying mobile code correctly as malicious or not (fewer “false
positives”).
Classification threshold — Slider scale for setting a risk level as described above
• Minimum value (maximum proactivity): 60
• Maximum value (maximum accuracy): 100
Advanced Settings
Settings for all submodules
Enable AV PreScan — When selected, performance of the submodules is improved by reducing the
load sent to them for scanning
Note: This option is by default selected. It is generally recommended not to change this setting.
McAfee Web Gateway 7.1.5 Product Guide 183