Transcription
Product GuideMcAfee Endpoint Security 10.2
COPYRIGHT 2016 Intel CorporationTRADEMARK ATTRIBUTIONSIntel and the Intel logo are registered trademarks of the Intel Corporation in the US and/or other countries. McAfee and the McAfee logo, McAfee ActiveProtection, McAfee DeepSAFE, ePolicy Orchestrator, McAfee ePO, McAfee EMM, McAfee Evader, Foundscore, Foundstone, Global Threat Intelligence,McAfee LiveSafe, Policy Lab, McAfee QuickClean, Safe Eyes, McAfee SECURE, McAfee Shredder, SiteAdvisor, McAfee Stinger, McAfee TechMaster, McAfeeTotal Protection, TrustedSource, VirusScan are registered trademarks or trademarks of McAfee, Inc. or its subsidiaries in the US and other countries.Other marks and brands may be claimed as the property of others.LICENSE INFORMATIONLicense AgreementNOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETSFORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOUHAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOURSOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR AFILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SETFORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OFPURCHASE FOR A FULL REFUND.2McAfee Endpoint Security 10.2Product Guide
Contents1McAfee Endpoint Security7Introduction9Endpoint Security modules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .How Endpoint Security protects your computer . . . . . . . . . . . . . . . . . . . . . .How your protection stays up to date . . . . . . . . . . . . . . . . . . . . . . .Interacting with Endpoint Security . . . . . . . . . . . . . . . . . . . . . . . . . . .Accessing Endpoint Security tasks from the McAfee system tray icon . . . . . . . . . .About notification messages . . . . . . . . . . . . . . . . . . . . . . . . . .About the Endpoint Security Client . . . . . . . . . . . . . . . . . . . . . . . .2Using the Endpoint Security Client19Open the Endpoint Security Client . . . . . . . . . . . . . . . . . . . . . . . . . . .Get help . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Respond to prompts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Respond to a threat-detection prompt . . . . . . . . . . . . . . . . . . . . . .Respond to a scan prompt . . . . . . . . . . . . . . . . . . . . . . . . . . .Respond to a file-reputation prompt . . . . . . . . . . . . . . . . . . . . . . .Get information about your protection . . . . . . . . . . . . . . . . . . . . . . . . .Management types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Update protection and software manually . . . . . . . . . . . . . . . . . . . . . . . .What gets updated . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .View the Event Log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Endpoint Security log file names and locations . . . . . . . . . . . . . . . . . . .Managing Endpoint Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Log on as administrator . . . . . . . . . . . . . . . . . . . . . . . . . . . .Unlock the client interface . . . . . . . . . . . . . . . . . . . . . . . . . . .Disable and enable features . . . . . . . . . . . . . . . . . . . . . . . . . .Change the AMCore content version . . . . . . . . . . . . . . . . . . . . . . .Use Extra.DAT files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Configure common settings . . . . . . . . . . . . . . . . . . . . . . . . . .Configure update behavior . . . . . . . . . . . . . . . . . . . . . . . . . . .Client Interface Reference — Common . . . . . . . . . . . . . . . . . . . . . . . . .Event Log page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Common — Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Common — Tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .3Using Threat 3940414855Scan your computer for malware . . . . . . . . . . . . . . . . . . . . . . . . . . .Types of scans . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Run a Full Scan or Quick Scan . . . . . . . . . . . . . . . . . . . . . . . . .Scan a file or folder . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Manage threat detections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Manage quarantined items . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Detection names . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .McAfee Endpoint Security 10.2910101112131455555658595961Product Guide3
ContentsRescanning quarantined items . . . . . . . . . . . . . . . . . . . . . . . . .62Managing Threat Prevention . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62Configuring exclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . .63Protecting your system access points . . . . . . . . . . . . . . . . . . . . . . . 64Blocking buffer overflow exploits . . . . . . . . . . . . . . . . . . . . . . . .72Detecting potentially unwanted programs . . . . . . . . . . . . . . . . . . . . . 74Configure common scan settings . . . . . . . . . . . . . . . . . . . . . . . .76How McAfee GTI works . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76Configure On-Access Scan settings . . . . . . . . . . . . . . . . . . . . . . .77Configure On-Demand Scan settings . . . . . . . . . . . . . . . . . . . . . .81Configure, schedule, and run scan tasks . . . . . . . . . . . . . . . . . . . . . 85Client Interface Reference — Threat Prevention . . . . . . . . . . . . . . . . . . . . .86Quarantine page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87Threat Prevention — Access Protection . . . . . . . . . . . . . . . . . . . . . . 87Threat Prevention — Exploit Prevention . . . . . . . . . . . . . . . . . . . . .97Threat Prevention — On-Access Scan . . . . . . . . . . . . . . . . . . . . . . 101Threat Prevention — On-Demand Scan . . . . . . . . . . . . . . . . . . . . . 105Scan Locations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108McAfee GTI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110Add Exclusion or Edit Exclusion . . . . . . . . . . . . . . . . . . . . . . . .112Threat Prevention — Options . . . . . . . . . . . . . . . . . . . . . . . . . 112Roll Back AMCore Content . . . . . . . . . . . . . . . . . . . . . . . . . . 1144Using Firewall115How Firewall works . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Enable and disable Firewall from the McAfee system tray icon . . . . . . . . . . . . . . .Enable or view Firewall timed groups from the McAfee system tray icon . . . . . . . . . . .About timed groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Managing Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Modify Firewall options . . . . . . . . . . . . . . . . . . . . . . . . . . . .Configure Firewall rules and groups . . . . . . . . . . . . . . . . . . . . . . .Client Interface Reference — Firewall . . . . . . . . . . . . . . . . . . . . . . . . .Firewall — Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Firewall — Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .5Using Web Control141About Web Control features . . . . . . . . . . . . . . . . . . . . . . . . . . . . .How Web Control blocks or warns a site or download . . . . . . . . . . . . . . . .Web Control button identifies threats while browsing . . . . . . . . . . . . . . . .Safety icons identify threats while searching . . . . . . . . . . . . . . . . . . .Site reports provide details . . . . . . . . . . . . . . . . . . . . . . . . . .How safety ratings are compiled . . . . . . . . . . . . . . . . . . . . . . . .Access Web Control features . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Enable the Web Control plug-in from the browser . . . . . . . . . . . . . . . . .View information about a site while browsing . . . . . . . . . . . . . . . . . . .View site report while searching . . . . . . . . . . . . . . . . . . . . . . . .Managing Web Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Configure Web Control options . . . . . . . . . . . . . . . . . . . . . . . . .Specify rating actions and block site access based on web category . . . . . . . . . .Client Interface Reference — Web Control . . . . . . . . . . . . . . . . . . . . . . .Web Control — Options . . . . . . . . . . . . . . . . . . . . . . . . . . .Web Control — Content Actions . . . . . . . . . . . . . . . . . . . . . . . .6Using Threat 2143144144145145146147147147150151151153155How Threat Intelligence works . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1554McAfee Endpoint Security 10.2Product Guide
ContentsManaging Threat Intelligence . . . . . . . . . . . . . . . . . . . . . . . . . . . .About Threat Intelligence . . . . . . . . . . . . . . . . . . . . . . . . . . .Containing applications dynamically . . . . . . . . . . . . . . . . . . . . . . .Configure Threat Intelligence options . . . . . . . . . . . . . . . . . . . . . .Client Interface Reference — Threat Intelligence . . . . . . . . . . . . . . . . . . . .Threat Intelligence — Dynamic Application Containment . . . . . . . . . . . . . .Threat Intelligence — Options . . . . . . . . . . . . . . . . . . . . . . . . .IndexMcAfee Endpoint Security 10.2156156162169170170172177Product Guide5
Contents6McAfee Endpoint Security 10.2Product Guide
McAfee Endpoint Security McAfee Endpoint Security is a comprehensive security management solution that runs on networkcomputers to identify and stop threats automatically. This Help explains how to use the basic securityfeatures and troubleshoot problems.Getting started Endpoint Security modules on page 9 How Endpoint Security protects your computer on page 10 Interacting with Endpoint Security on page 11Frequently performed tasks Open the Endpoint Security Client on page 19 Update protection and software manually on page 23 Scan your computer for malware on page 55 Unlock the client interface on page 27More informationTo access additional information about this product, see: McAfee Endpoint Security Installation Guide McAfee Endpoint Security Migration Guide McAfee Endpoint Security Release Notes Endpoint Security Threat Prevention Help Endpoint Security Firewall Help Endpoint Security Web Control Help Endpoint Security Threat Intelligence Help McAfee supportMcAfee Endpoint Security 10.2Product Guide7
McAfee Endpoint Security8McAfee Endpoint Security 10.2Product Guide
1IntroductionEndpoint Security is a comprehensive security management solution that runs on network computersto identify and stop threats automatically. This Help explains how to use the basic security featuresand troubleshoot problems.If your computer is managed, an administrator sets up and configures Endpoint Security using one ofthese management servers: McAfee ePolicy Orchestrator (McAfee ePO ) McAfee ePolicy Orchestrator Cloud (McAfee ePO Cloud) For the latest Endpoint Security management license and entitlement information, see KB87057.Threat Intelligence isn't supported on McAfee ePO Cloud-managed systems.If your computer is self-managed, you or your administrator configure the software using the EndpointSecurity Client.ContentsEndpoint Security modulesHow Endpoint Security protects your computerInteracting with Endpoint SecurityEndpoint Security modulesThe administrator configures and installs one or more Endpoint Security modules on client computers. Threat Prevention — Checks for viruses, spyware, unwanted programs, and other threats byscanning items — automatically when users access them or on demand at any time. Firewall — Monitors communication between the computer and resources on the network and theInternet. Intercepts suspicious communications. Web Control — Displays safety ratings and reports for websites during online browsing andsearching. Web Control enables the site administrator to block access to websites based on safetyrating or content. Threat Intelligence — Provides context-aware adaptive security for your network environment.Endpoint Security Threat Intelligence is an optional Endpoint Security module. For additional threatintelligence sources and functionality, deploy the Threat Intelligence Exchange server. Forinformation, contact your reseller or sales representative.Threat Intelligence isn't supported on McAfee ePO Cloud-managed systems.In addition, the Common module provides settings for common features, such as interface securityand logging. This module is installed automatically if any other module is installed.McAfee Endpoint Security 10.2Product Guide9
1IntroductionHow Endpoint Security protects your computerHow Endpoint Security protects your computerTypically, an administrator sets up Endpoint Security, installs the software on client computers,monitors security status, and sets up security rules, called policies.As a client computer user, you interact with Endpoint Security through client software installed on yourcomputer. The policies set up by your administrator determine how the modules and features operateon your computer and whether you can modify them.If Endpoint Security is self-managed, you can specify how the modules and features operate. Todetermine your management type, view the About page.At regular intervals, the client software on your computer connects to a site on the Internet to updateits components. At the same time, it sends data about detections on your computer to themanagement server. This data is used to generate reports for your administrator about detections andsecurity issues on your computer.Usually, the client software operates in the background without any interaction on your part.Occasionally, however, you might need to interact with it. For example, you might want to check forsoftware updates or scan for malware manually. Depending on the policies set up by youradministrator, you might also be able to customize the security settings.If you are an administrator, you can centrally configure and manage client software using McAfee ePOor McAfee ePO Cloud.For the latest Endpoint Security management license and entitlement information, see KB87057.See alsoGet information about your protection on page 22How your protection stays up to dateRegular updates of Endpoint Security make sure that your computer is always protected from thelatest threats.To perform updates, the client software connects to a local or remote McAfee ePO server or directly toa site on the Internet. Endpoint Security checks for: Updates to the content files used to detect threats. Content files contain definitions for threats suchas viruses and spyware, and these definitions are updated as new threats are discovered. Upgrades to software components, such as patches and hotfixes.To simplify terminology, this Help refers to both updates and upgrades as updates.Updates usually occur automatically in the background. You might also need to check for updatesmanually. Depending on settings, you can manually update your protection from the Endpoint SecurityClient by clicking.See alsoUpdate protection and software manually on page 2310McAfee Endpoint Security 10.2Product Guide
1IntroductionInteracting with Endpoint SecurityHow content files workWhen searching files for threats, the scan engine compares the contents of the scanned files to knownthreat information stored in the AMCore content files. Exploit Prevention uses its own content files toprotect against exploits.AMCore contentMcAfee Labs finds and adds known threat information (signatures) to the content files. With thesignatures, content files include information on cleaning and counteracting damage that the detectedvirus can cause.If the signature of a virus isn't in the installed content files, the scan engine can't detect that virus,leaving your system vulnerable to attack.New threats appear regularly. McAfee Labs releases engine updates and new content files thatincorporate the results of ongoing threat research daily by 7:00 p.m. (GMT/UTC). If a new threatwarrants it, daily AMCore content files might be released earlier and, under some circumstances,releases might be delayed. To receive alerts regarding delays or important notifications, subscribe tothe Support Notification Service (SNS). See KnowledgeBase article KB67828.Endpoint Security stores the currently loaded content file and the previous two versions in theProgram Files\Common Files\McAfee\Engine\content folder. If required, you can revert to a previousversion.If new malware is discovered and extra detection is required outside of the regular content updateschedule, McAfee Labs releases an Extra.DAT file. For information about installing Extra.DAT files, seethe Threat Prevention Help.Exploit Prevention contentThe Exploit Prevention content includes: Memory protection signatures — Generic Buffer Overflow Protection (GBOP), caller validation,Generic Privilege Escalation Prevention (GPEP), and Targeted API Monitoring. Application Protection List — Processes that Exploit Prevention protects.McAfee releases new Exploit Prevention content files once a month.Threat Intelligence contentThreat Intelligence content contains rules to dynamically compute the reputation of files and processeson the endpoints. McAfee releases new Threat Intelligence content files every two months.Endpoint Security Threat Intelligence is an optional Endpoint Security module. For additional threatintelligence sources and functionality, deploy the Threat Intelligence Exchange server. For information,contact your reseller or sales representative.Interacting with Endpoint SecurityEndpoint Security provides visual components for interacting with the Endpoint Security Client. McAfee icon in the Windows system tray — Enables you to start the Endpoint Security Client andview security status. Notification messages — Alert you to scan and firewall intrusion detections, and files with unknownreputations, and prompt you for input.McAfee Endpoint Security 10.2Product Guide11
1IntroductionInteracting with Endpoint Security On-Access Scan page — Displays the threat detection list when the on-access scanner detects athreat. Endpoint Security Client — Displays the current protection status and provides access to features.For managed systems, the administrator configures and assigns policies to specify which componentsappear.See alsoAccessing Endpoint Security tasks from the McAfee system tray icon on page 12About notification messages on page 13Manage threat detections on page 59About the Endpoint Security Client on page 14Accessing Endpoint Security tasks from the McAfee system trayiconThe McAfee icon in the Windows system tray provides access to the Endpoint Security Client and somebasic tasks.Configuration settings determine if the McAfee icon is available.Right-click the McAfee system tray icon to:Check the securitystatus.Select View Security Status to display the McAfee Security Status page.Open EndpointSecurity Client.Select McAfee Endpoint Security.Update protectionand softwaremanually.Select Update Security.Disable orre-enable Firewall.Select Disable Endpoint Security Firewall from the Quick Settings menu.Enable, disable, orview Firewall timedgroups.Select an option from the Quick Settings menu:When Firewall is disabled, the option is Enable Endpoint Security Firewall. Enable Firewall Timed Groups — Enables timed groups for a set amount of time toallow access to the Internet b
McAfee Endpoint Security McAfee Endpoint Security is a comprehensive security management solution that runs on network computers to identify and stop threats automatically. This Help explains how to use the basic security features and troubleshoot problems.File Size: 2MB
