Product guide

Table 3-1 Scan Items
Option Definition
On-Access Scan
files
When an attempt is made to open, close, or rename a file, the scanner intercepts
the operation and takes these actions.
1
The scanner determines if the file should be scanned based on this criteria:
• The file’s extension matches the configuration.
• The file has not been cached, excluded, or previously scanned.
2
If the file meets the scanning criteria, the scanner compares the information in
the file to the known malware signatures in the currently loaded DAT files.
• If the file is clean, the result is cached and read, write, or rename operation is
granted.
• If the file contains a threat, the operation is denied and the configured action
is taken.
File types to scan
• All files — Select to scan all files.
• Following only — Select to specify a list of file extensions to scan. You can add,
edit, and remove file extensions that are included for scanning.
• Default + Additional files — Select to scan the default file types or any additional file
types. You can add, edit, and remove any additional file types, which are
included for scanning.
In version 3.6, this option is selected by default. However, when upgrading from
previous versions to 3.6, the last selected option is retained.
Compressed files
• Scan inside archives (e.g. .ZIP) — Examines archive (compressed) files (such
as .ZIP, .CAP. LZH, and .UUE files) and their contents.
• Decode MIME encoded files — Detects, decodes, and scans Multipurpose Internet Mail
Extensions (MIME) encoded files.
Heuristics
Uses heuristics to find unknown unwanted programs, Trojans, and macro threats.
McAfee Global
Threat Intelligence
file reputation
Configure the sensitivity level (between Very Low and Very High) when determining if
a detected sample is malware. By increasing the sensitivity level, you might also
get more false positive results.
Unwanted program
detection
Detect unwanted programs — The on‑access and on‑demand scanners detect unwanted
programs based on the Unwanted Programs Policy that you configured.
When a detection occurs, the scanner that detected the potentially unwanted
program applies the action that you configured on the Actions tab for that scanner.
8
In the Exclusions tab, configure the Path Exclusions by adding, editing, or removing a specific file path.
The MOVE Agentless allows you to fine-tune the list of file types scanned. For example, you can
exclude from scanning individual files, folders, and disks. These exclusions might be needed
because the scanners could scan and lock a file when that file is being used by a database or
server. This could cause the database or server to fail or generate errors.
Wildcards are supported, however, environment variables and UNC paths are not supported.
For more information on how to use wildcards when creating exclusions in MOVE AV Agentless 3.x,
see this McAfee KnowledgeBase article: KB82110.
3
Monitoring and managing your environment
Policy management
48
McAfee MOVE AntiVirus (Agentless) 3.6.0 Product Guide