Datasheet

McAfee Gold Support Handbook 7
McAfee and/or additional marks herein are registered trademarks or trademarks of McAfee, Inc. and/or its affiliates in the US and/or other countries. All other
registered and unregistered trademarks herein are the sole property of their respective owners. © 2011 McAfee, Inc. All rights reserved.
Online Access to Definition Files
Many McAfee products require definition files, or DATs. The DATs contain the information
that the anti-malware engine requires to properly detect threats and clean infections. The
table below describes the various types of DAT files and when they are issued or used.
DAT type Description
Daily DAT
The daily DATs contain only the latest virus information (with no scan engine) and are
updated on a daily basis. Daily DAT files are downloaded automatically by your McAfee
products. If you need to download a copy of the latest daily DATs, go to:
http://www.mcafee.com/apps/downloads/security-updates/security-updates.aspx
SuperDAT
A SuperDAT is a one step executable update for your regular DAT files and the anti-
malware engine used by your product. A SuperDAT can be used to update the DATs and
engine when other update methods have failed, or if a system must be taken off the
network. To download SuperDATs, go to:
http://www.mcafee.com/apps/downloads/security-updates/security-updates.aspx
Beta DAT
Beta DATs are hourly builds of the daily DAT files with additional malware definitions that
have been received recently. Beta DATs receive limited false positive testing and are
recommended for use primarily on high risk systems or when an infection is not detected by
the daily DATs. To download Beta DATS, go to:
http://www.mcafee.com/apps/mcafee-labs/beta/dat-file-updates.aspx
Extra.DAT
Extra.DATs are temporary definition files delivered directly by McAfee Labs in response to
submitted malware that is not yet covered in the daily DAT files. Extra.DATs are intended to
provide emergency coverage until the new malware can be incorporated into the daily
DATs. Extra.DATs automatically expire and are deleted when the extra detections are
added to the daily DATs.
In addition to the regular DAT files, several McAfee products such as VirusScan Enterprise
make use of our Global Threat Intelligence technology. Global Threat Intelligence
supplements detection in the DAT signatures with real-time behavior analysis. You can
reduce your company’s potential exposure to threats by enabling this feature.
How it works
1. A user receives a file that the scan agent deems suspicious (for example, an
encrypted or packed file) and for which there is no signature in the current local DAT
files.
2. Using Global Threat Intelligence, the agent sends a fingerprint of the file for instant
lookup in the comprehensive real-time database at McAfee Labs.
3. If the fingerprint is identified as malicious, an appropriate response is sent to the user
to block or quarantine the new threat.