User Guide

460
IRONPORT ASYNCOS 6.3 FOR WEB USER GUIDE
MALWARE SCANNING VERDICT VALUES
A malware scanning verdict is a value assigned to a URL request or server response that
determines the probability that it contains malware. The scanning engines return the malware
scanning verdict to the DVS engine so the DVS engine can determine whether to monitor or
block the scanned object.
They are the result of proprietary calculations that associate a numerical value to the
probability that either the URL request or the response content contains malware. Each
malware scanning verdict corresponds to a malware category listed on the “Access Policies:
Reputation and Anti-Malware Settings” page when you edit the Web Reputation and Anti-
Malware Filtering for a particular Access Policy.
Both the Webroot and McAfee scanning engines can return malware scanning verdicts to the
DVS engine. For more information about how the DVS engine handles malware scanning
verdicts, see “IronPort DVS™ (Dynamic Vectoring and Streaming) Engine” on page 322.
Table 20-13 lists the different malware scanning verdict values and each malware category
with which they correspond.
Table 20-13 Malware Scanning Verdict Values
Malware Category Malware Scanning Verdict Value
Unscannable 3
Other Malware 10
Browser Helper Object 12
Adware 13
System Monitor 14
Commercial System Monitor 18
Dialer 19
Hijacker 20
Phishing URL 21
Trojan Downloader 22
Trojan Horse 23
Trojan Phisher 24
Worm 25
Encrypted File 26