Information Technology Services

• VirusScan Console
• A - Access Protection
• B - Buffer Overflow Protection
• C - On-Delivery E-mail Scanner
• D - Unwanted Programs Policy
• E - On-Access Scanner
• F - Scan All Fixed Disks
• G - AutoUpdate
• AutoUpdate Repository List

VirusScan Console

This is the McAfee VirusScan Console interface. It is the center to configuring McAfee AntiVirus software.

• It is accessed by right-clicking on the McAfee icon in the task bar and selecting VirusScan Console.
• Without performing any additional steps, McAfee AntiVirus is set up following the ITS-recommended configuration.
• **Please note: NDSU-ITS-supported computers (those that have the ZENworks client installed) will maintain the suggested configuration, regardless of modifications made to each local workstation.

(click to jump to information on each task)

The Access Protection feature is new from McAfee version 7.1 to version 8.0i.

• The access protection feature is similar to a firewall; it blocks ports commonly associated with viruses, trojans and worms.
• On a desktop computer, the ports blocked should not affect regular business computer use.
• If installed on a computer to be used as a server (not supported by ITS). For example, if a computer is acting as an FTP server, those ports would need to be unblocked in McAfee in addition to any other firewalls installed on the server.
  • To stop port blocking, uncheck the port/protocol to be opened.

By default, this feature is not enabled.

The buffer overflow protection feature of McAfee can prevent certain malicious programs/codes from causing your system to crash. According to ComputerWorld.com, "A buffer overflow occurs when a computer program attempts to stuff more data into a buffer (a defined temporary storage area) than it can hold. The excess data bits then overwrite valid data and can even be interpreted as program code and executed. "

This complex-sounding process is somewhat similar to trying to stuff more donuts into a storage container than the storage container can hold--the storage container might stretch or break and the donuts get all smashed. The same happens when too much data is stuffed into data storage.

This feature of McAfee AntiVirus Enterprise 8.0i scans your e-mail before download if you use the Microsoft Outlook e-mail client.

• If you have ever unknowingly opened an e-mail only to discover that it contains a virus, you may appreciate this feature.
• McAfee can prevent such mishaps by detecting the e-mail has a virus before you open it.

The Unwanted Programs Policy feature is new from McAfee version 7.1 to version 8.0i.

As the name implies, this feature can block programs that computer users do not want running.

Why don't we want these programs running?

• Spyware and Adware are hidden programs that can record what you type and send it to another computer.
  • This exposes passwords and other confidential information.
• Spyware and Adware can open other security holes on a computer.
• Spyware and Adware can track what web sites you visit (even if you delete the Internet history).
• Spyware and Adware can slow a computer down.
• Spyware and Adware can change your home page or add bookmarks to sites that you may find to be inappropriate for work.

An On-Access scanner is what prevents computer from being infected at all. Consider the following examples.

With On-Access Scanner You download a file from the Internet. It is a cool program that claims to give you cool desktop backgrounds. McAfee scans the file before it is downloaded and detects that it contains a virus. McAfee alerts you that the file is infected and deletes it before doing damage to your system. Computer use continues without interruption. You will have to select a different method of having new desktop backgrounds.

Without On-Access Scanner You download a file from the Internet. It is a cool program that claims to give you cool desktop backgrounds. You execute the file to install the program. The file is infected with a virus and by executing the file, the virus has infected your computer. Programs such as Microsoft Word and Eudora don't work correctly any more. Word crashes all the time and some of your documents won't open at all. What is wrong? You contact the Help Desk for help. They submit a ticket for someone to look at your computer. A computer technician looks at your computer and runs a virus scan using McAfee. A virus is detected. It is pretty bad--it looks like your system will need to be reinstalled. Reinstalling takes two days and once everything is done, you still don't have a cool new desktop background.

The Scan All Fixed Disks feature searches through a computer hard drive to find any files that might be infected with a virus.

Wait a minute--I thought McAfee would detect viruses before they infect my computer!

This is true except ...

• McAfee AntiVirus is only as good as the newest virus definition file it has.
• If a virus attacks your computer before McAfee releases new instructions for the program to remove the virus, a computer may be infected.
• Scanning hard disks catches any viruses that manage to infect a computer.

McAfee is configured to:

• Scan once a week
• If a computer is off when the scan is scheduled, the scan will start five minutes after the computer is turned on.
• Scan when virus definitions are updated.
  • In case the computer was infected while it was vulnerable to those new viruses.
• Use only 30% of the CPU.
  • This means you shouldn't notice the computer slow down during the scan.

The AutoUpdate feature is what keeps McAfee AntiVirus up-to-date. Without updates, McAfee cannot find the latest viruses.

If you don't know what you're looking for, you can't find it.

McAfee is the same way. If it doesn't know that something is a virus,

• it will not alert you.
• it will not clean or delete the virus.
• it will not protect your files.

Updates are the key to virus protection! AutoUpdate helps to ensure that you are not without updates.

McAfee is configured to:

• Update every two hours, daily.
• If a computer is off when the update is scheduled, the update will start five minutes after the computer is turned on.

In order for McAfee to automatically update its virus definitions, a site must be specified to download the updates from.

• By default, McAfee should be configured to connect back to McAfee's AutoUpdate site
• To view/modify the settings, click the Tools menu and select Edit AutoUpdate Repository List in the VirusScan Console.
• To edit a site, select it (single-click) and click Edit.

• Computers managed with ePO (e-Policy Orchestrator) will have an entry in the AutoUpdate Repository List that connects to the HECN antivirus.
• This entry is added by the ePO and should not be changed.
• Any changes will be automatically reversed by the ePO server.