McAfee MIS80E001RAI, MIS70E001RCA, Internet Security Suite User Manual

User Guide

Copyright © 2005 McAfee, Inc. All Rights Reserved. No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form or by any means without the written permission of McAfee, Inc., or its suppliers or affiliate companies.

TRADEMARK ATTRIBUTIONS

ACTIVE FIREWALL, ACTIVE SECURITY, ACTIVESECURITY (AND IN KATAKANA), ACTIVESHIELD, ANTIVIRUS ANYWARE AND DESIGN, CLEAN-UP, DESIGN (STYLIZED E), DESIGN (STYLIZED N), ENTERCEPT, ENTERPRISE SECURECAST, ENTERPRISE SECURECAST (AND IN KATAKANA), EPOLICY ORCHESTRATOR, FIRST AID, FORCEFIELD, GMT, GROUPSHIELD, GROUPSHIELD (AND IN KATAKANA), GUARD DOG, HOMEGUARD, HUNTER, INTRUSHIELD, INTRUSION PREVENTION THROUGH INNOVATION, M AND DESIGN, MCAFEE, MCAFEE (AND IN KATAKANA), MCAFEE AND DESIGN, MCAFEE.COM, MCAFEE VIRUSSCAN, NA NETWORK ASSOCIATES, NET TOOLS, NET TOOLS (AND IN KATAKANA), NETCRYPTO, NETOCTOPUS, NETSCAN, NETSHIELD, NETWORK ASSOCIATES, NETWORK ASSOCIATES COLLISEUM, NETXRAY, NOTESGUARD, NUTS & BOLTS, OIL CHANGE, PC MEDIC, PCNOTARY, PRIMESUPPORT, RINGFENCE, ROUTER PM, SECURECAST, SECURESELECT, SPAMKILLER, STALKER, THREATSCAN, TIS, TMEG, TOTAL VIRUS DEFENSE, TRUSTED MAIL, UNINSTALLER, VIREX, VIRUS FORUM, VIRUSCAN, VIRUSSCAN, VIRUSSCAN (AND IN KATAKANA), WEBSCAN, WEBSHIELD, WEBSHIELD (AND IN KATAKANA), WEBSTALKER, WEBWALL, WHAT'S THE STATE OF YOUR IDS?, WHO'S WATCHING YOUR NETWORK, YOUR E-BUSINESS DEFENDER, YOUR NETWORK. OUR BUSINESS. are registered trademarks or trademarks of McAfee, Inc. and/or its affiliates in the US and/or other countries. Red in connection with security is distinctive of McAfee brand products. All other registered and unregistered trademarks herein are the sole property of their respective owners.

LICENSE INFORMATION License Agreement

NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANIES YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEB SITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND.

Attributions

This product includes or may include:

 Software developed by the OpenSSL Project for use in the OpenSSL To olkit (http://www.openssl.org/).  Cryptographic software written by Eric A. Young and

software written by Tim J. Hudson. similar Free Software licenses which, among other rights, permit the user to copy, modify and redistribute certain programs, or portions thereof, and have access to the source code. The GPL requires that for any software covered under the GPL which is distributed to someone in an executable binary format, that the source code also be made available to those users. For any such software covered under the GPL, the source code is made available on this CD. If any Free Software licenses require that McAfee provide rights to use, copy or mo dify a softwa re program that ar e br oader th an the righ t s granted in this agreement, then such rights shall take precedence over the rights and restrictions herein.  Software originally written by Henry Spencer, Copyright 1992, 1993, 1994, 1997 Henry Spencer.  Software originally written by Robert Nordier, Copyright © 1996-7 Robert Nordier. Software written by Douglas W. Sauder. Software developed by the Apache Software Foundation (http://www.apache.org/). A copy of the license agreement for this software can be found at www.apache.org/licenses/LICENSE-2.0.txt.

 Outside In

Thai Open Source Software Center Ltd. and Clark Cooper, © 1998, 1999, 2000. Software copyrighted by Expat maintainers. Software copyrighted by The Regents of the University of California, © 1989.  Software copyrighted by Gunnar Ritter.  Software copyrighted by Sun Micros ystems®, Inc.© 2003.  Software copyrighted by Gisle Aas. © 1995-2003. Software copyrighted by Michael A. Chase, © 1999-2000. Software copyrighted by Neil Winton, © 1995-1996.

Koster, © 1995.  Software copyrighted by Brad Appleton, © 1996-1999.  Software copyrighted by Michael G. Schwern, © 2001.  Software copyrighted by Graham Barr, © 1998.  Software copyrighted by Larry Wall and Clark Cooper, © 1998-2000.  Software copyrighted by Frodo Looijaard, © 1997.  Software copyrighted by the Python Software Foundation, Copyright © 2001, 2002, 2003. A copy of the license agreement for this software can be found at www.python.org.

Notre Dame.  Software copyrighted by Simone Bordet & Marco Cravero, © 2002.  Software copyrighted by Stephen Purcell, © 2001.  Software developed by the Indiana University Extreme! Lab (http://www.extreme.indiana.edu/).  Software copyrighted by International Business Machines Corporation and others, © 1995-2003. Software developed by the University of California, Berkeley and its contributors. Software developed by Ralf S. Engelschall <rse@engelschall.com> for use in the mod_ssl project ( http://www.modssl.org/). Software copyrighted by Kevlin Henney, © 2000-2002. Software copyrighted by Peter Dimov and Multi Media Ltd. © 2001, 2002.  Software copyrighted by David Abrahams, © 2001, 2002. See http://www.boost.org/libs/bind/

Boost.org, © 1999-2002.  Software copyrighted by Nicolai M. Josuttis, © 1999.  Software copyrighted by Jeremy Siek, © 1999-2001.  Software copyrighted by Daryle Walker, © 2001. Software copyrighted by Chuck Allison and Jeremy Siek, © 2001, 2002. Software copyrighted by Samuel Krempp, © 2001. See

http://www.boost.org for updates, documentation, and revision history.

copyrighted by Cadenza New Zealand Ltd., © 2000. Software copyrighted by Jens Maurer, © 2000, 2001. Software copyrighted by Jaakko Järvi (jaakko.jarvi@cs.utu.fi), © 1999, 2000.  Software copyrighted by Ronald Garcia, © 2002.  Software copyrighted by David Abrahams, Jeremy Siek, and Daryle Walker, © 1999-2001.

copyrighted by Greg Colvin and Beman Dawes, © 1998, 1999.  Software copyrighted by Peter Dimov, © 2001, 2002.  Software copyrighted by Jeremy Siek and John R. Bandela, © 2001.  Software copyrighted by Joerg Walter and Mathias Koch, © 2000-2002.

 Some software programs that are licensed (or sublicensed) to the user under the GNU General Public License (GPL) or other

Issued January 2006 / McAfee® Internet Security Suite® software

Quick Start Card

If you are installing your product from a CD or a Web site, print this convenient reference page.

Are you installing your product from a CD?

Yes

1. Insert your product CD into your CD-ROM drive. If the installation does not start a u to matically, cli ck your Windows desktop, then click

Start on

Run.

Are you installing your product from a Web site?

Yes

1. Go to the McAfee Web site, and click

My Account.

2. In the Run dialog box, type D:\SETUP.EXE (where D is the letter of your CD-ROM drive).

2. If prompted, enter your subscribing e-mail address and password, then

3. Click OK.

McAfee reserves the right to change Upgrade & Support Plans a nd policies at any time without notice. McAfee and its

product names are registered trademarks of McAfee, Inc. and/or its affiliates in the US and/or other countries.

click page.

3. Locate your product in the list, and click the download icon.

User Guide iii

Quick Start Card

For more information

To view the User Guides on the product CD, ensure that you have Acrobat Reader installed; if not, install it now from the McAfee product CD.

1 Insert your product CD into your CD-ROM

drive.

2 Open Windows Explorer: Click Start on

your Windows desktop, and click

3 Locate the Manuals folder, and double- click

the User Guide .

PDF you want to open.

Search.

Registration benefits

McAfee recommends that you follow the easy steps within your product to transmit your registration directly to us. Registration ensures that you receive timely and knowledgeable technical assistance, plus the following benefits:

 FREE electronic support  Virus definition (.DAT) file updates for one

year after installation when you purchase VirusScan software

Go to http://www.mcafee.com/ for pricing of an additional year of virus signatures.

 60-day warranty that guarantees

replacement of your software CD if it is defective or damaged

 SpamKiller filter updates for one year after

installation when you purchase SpamKiller software

Go to http://www.mcafee.com/ for pricing of an additional year of filter updates.

 McAfee Internet Security Suite updates for

one year after installation when you purchase MIS software

Go to http://www.mcafee.com/ for pricing of an additional year of content updates.

Technical Support

For technical support, please visit

http://www.mcafeehelp.com/.

Our support site offers 24-hour access to the easy-to-use Answer Wizard for solutions to the most common support questions.

Knowledgeable users can also try our advanced options, which include a Keyword Search and our Help Tree. If a solution cannot be found, you can also access our FREE Chat Now! and E-mail Express! options. Chat and e-mail help you to quickly reach our qualified support engineers through the Internet, at no cost. Otherwise, you can get phone support information at

http://www.mcafeehelp.com/.

iv McAfee® Internet Security Suite®software

Contents

Quick Start Card . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . iii

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

McAfee Internet Security software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

System requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

Supported e-mail programs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

Toolbar plug-in requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

Supported instant messaging programs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

Using McAfee SecurityCenter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

Removing Internet Security Suite programs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

McAfee VirusScan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

New features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

Testing VirusScan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

Testing ActiveShield . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

Testing Scan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

Using McAfee SecurityCenter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

Using ActiveShield . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

Enabling or disabling ActiveShield . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

Configuring ActiveShield options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

Understanding security alerts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

Manually scanning your computer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

Manually scanning for viruses and other threats . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

Automatically scanning for viruses and other threats . . . . . . . . . . . . . . . . . . . . . . . . 38

Understanding threat detections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40

Managing quarantined files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

Creating a Rescue Disk . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

Write-protecting a Rescue Disk . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

Using a Rescue Disk . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

Updating a Rescue Disk . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

Automatically reporting viruses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

User Guide v

Contents

Reporting to the World Virus Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45

Viewing the World Virus Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46

Updating VirusScan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

Automatically checking for updates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

Manually checking for updates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

McAfee Personal Firewall Plus . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

New features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

Removing other firewalls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51

Setting the default firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51

Setting the security level . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52

Testing McAfee Personal Firewall Plus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54

Using McAfee SecurityCenter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54

About the Summary page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55

About the Internet Applications page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60

Changing application rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61

Allowing and blocking Internet applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61

About the Inbound Events page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62

Understanding events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63

Showing events in the Inbound Events log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65

Responding to inbound events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67

Managing the Inbound Events log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71

About alerts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72

Red alerts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73

Green alerts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78

Blue alerts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80

McAfee Privacy Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81

Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81

The Administrator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81

Setting up Privacy Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82

Setting up a Pre-installed version of Privacy Service . . . . . . . . . . . . . . . . . . . . . . . . 82

Retrieving the Administrator Password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83

Removing Privacy Service with Safe Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83

The Startup user . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84

Configuring the Administrator as Startup User . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84

Using McAfee SecurityCenter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84

Launching McAfee Privacy Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85

vi McAfee® Internet Security Suite® software

Contents

Launching and signing in to Privacy Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85

Disabling Privacy Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85

Updating McAfee Privacy Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85

Removing and Re-installing Privacy Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86

Removing Privacy Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87

Installing Privacy Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87

Setting the password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88

Setting the age group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88

Setting the cookie blocker . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88

Setting the Internet Time limits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89

Creating Web Site Permissions with Keywords . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89

Changing passwords . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90

Changing a user’s information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91

Changing cookie blocker setting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91

Editing the Accept and Reject Cookie List . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91

Changing the age group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92

Changing Internet time Limits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92

Changing the Startup user . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93

Removing users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93

Blocking Web sites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93

Allowing Web sites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93

Blocking information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94

Adding information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94

Editing information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94

Removing personal information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94

Blocking Web bugs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95

Blocking advertisements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95

Allowing cookies from specific Web sites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96

Date and time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96

User . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96

Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96

Event Details . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96

Saving the Current Log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96

Viewing Saved Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97

Erasing files permanently using McAfee Shredder . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97

Why Windows leaves file remnants . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98

What McAfee Shredder erases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98

Permanently erasing files in Windows Explorer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98

User Guide vii

Contents

Emptying the Windows Recycle Bin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98

Customizing Shredder settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98

Backing up the Privacy Service database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99

Restoring the Backup Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99

Changing your password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100

Changing your user name . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100

Clearing your cache . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101

Accepting cookies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101

If you need to remove a web site from this list: . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101

Rejecting cookies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102

If you need to remove a web site from this list: . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102

McAfee SpamKiller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103

User options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103

Filtering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103

Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104

Understanding the top pane . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104

Understanding the Summary page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105

Microsoft Outlook and Outlook Express integration . . . . . . . . . . . . . . . . . . . . . . . . . 105

Using McAfee SecurityCenter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106

Disabling SpamKiller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107

Adding e-mail accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107

Adding an e-mail account . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108

Pointing your e-mail client to SpamKiller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108

Deleting e-mail accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109

Deleting an e-mail account from SpamKiller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109

Editing e-mail account properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109

POP3 accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109

MSN/Hotmail accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112

MAPI accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113

Adding users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115

User passwords and protecting children from spam . . . . . . . . . . . . . . . . . . . . . . . . 116

Logging on to SpamKiller in a multi-user environment . . . . . . . . . . . . . . . . . . . . . . 117

Opening a Friends List . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119

Importing address books . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119

Importing an address book by automatic import . . . . . . . . . . . . . . . . . . . . . . . . . . . 120

Importing an address book manually . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120

Editing address book information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121

viii McAfee® Internet Security Suite® software

Contents

Deleting an address book from the automatic import list . . . . . . . . . . . . . . . . . . . . . 121

Adding friends . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122

Adding friends from the Blocked E-mail or Accepted E-mail page . . . . . . . . . . . . . . 122

Adding friends from the Friends page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123

Adding friends from Microsoft Outlook . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123

Editing friends . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123

Deleting friends . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124

Blocked E-mail page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125

Accepted E-mail page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127

Tasks for Blocked E-mail and Accepted E-mail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128

Rescuing messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129

From the Blocked E-Mail page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129

From the SpamKiller folder in Microsoft Outlook or Outlook Express . . . . . . . . . . . 129

Blocking messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129

From the Accepted E-mail page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129

From Microsoft Outlook . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130

Where are the blocked messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130

Deleting a message manually . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130

Modifying how spam messages are processed . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130

Tagging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130

Blocking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130

Modifying how SpamKiller processes spam messages . . . . . . . . . . . . . . . . . . . . . . 131

Using the AntiPhishing filter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131

Adding friends to a Friends List . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132

Adding filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132

Regular expressions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134

Reporting spam to McAfee . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137

Sending complaints manually . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137

Sending error messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137

Sending an error message manually . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138

SpamKiller is unable to communicate with its server . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138

Starting the SpamKiller server manually . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138

SpamKiller server is blocked by firewalls or internet filtering programs . . . . . . . . . . 138

Cannot connect to the e-mail server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139

Verifying your connection to the Internet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139

Verifying the POP3 server address for SpamKiller . . . . . . . . . . . . . . . . . . . . . . . . . 139

Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141

User Guide ix

Contents

x McAfee® Internet Security Suite® software

Introduction

The Internet provides a wealth of information and entertainment at your fingertips. However, as soon as you connect, your computer is exposed to a multitude of privacy and security threats. Protect your privacy and secure your computer and data with McAfee Internet Security award-winning technologies, Internet Security Suite is one of the most comprehensive sets of privacy and security tools available. McAfee Internet Security Suite destroys viruses, outwits hackers, secures your personal information, privatizes your Web browsing, blocks ads and pop-ups, manages your cookies and passwords, locks down your files, folders and drives, filters objectionable content, and puts you in control of your computer’s incoming and outgoing Internet connections.

McAfee Internet Security Suite is a proven security solu tion that provides powerful protection for today's Internet users.

McAfee Internet Security Suite comprises the following products:

Suite. Incorporating McAfee's

 McAfee VirusScan on page 17  McAfee Personal Firewall Plus on page 49  McAfee Privacy Service on page 81  McAfee SpamKiller on page 103

User Guide 11

Introduction

McAfee Internet Security software

 McAfee SecurityCenter — Assesses, informs, and warns you about your

computer’s security vulnerability. Each security index quickly evaluates your exposure to security and Internet-based threats, and then provides recommendations to quickly and securely protect your computer.

 McAfee VirusScan — Scans, detects, fixes, and removes Internet viruses. You can

customize virus scans and determine the response and action when a virus is detected. You can also configure VirusScan to log virus-related actions performed on your computer.

 McAfee Personal Firewall Plus — Protects your computer while it is connected to

the Internet, and secures your computer’s outgoing and incoming Internet connections.

 McAfee Privacy Service — Combines personal information protection, online

advertisement blocking, and content filtering. It secures your personal information while providing greater control over your family's Internet experience. McAfee's Privacy Service ensures that you do not expose confidential information to online threats and protects you and your family from inappropriate online content.

 McAfee SpamKiller — The rise of fraudulent, inappropriate and offensive e-mail

to adults, children and businesses makes spam protection an essential component of your computer’s security strategy.

System requirements

 Microsoft  Personal computer with Pentium-compatible processor

 Windows 98, 2000: 133 MHz or higher  Windows Me: 150 MHz or higher  Windows XP (Home and Pro): 300 MHz or higher

 RAM

 Windows 98, Me, 2000: 64 MB  Windows XP (Home and Pro): 128 MB

 100 MB hard disk space

Windows 98, Me, 2000, or XP

 Microsoft® Internet Explorer 5.5 or later

NOTE: To upgrade to the latest version of Internet Explorer, visit

12 McAfee® Internet Security Suite®software

the Microsoft Web site at http://www.microsoft.com/.

Supported e-mail programs

 POP3 (Outlook Express, Outlook, Eudora, Netscape)  MAPI (Outlook)  Web (MSN/Hotmail, or e-mail account with POP3 access)

Toolbar plug-in requirements

 Outlook Express 6.0 or later  Outlook 98, 2000 with SP3, 2003, or XP  Internet Explorer 6.0 or later

Supported e-mail programs

Supported instant messaging programs

 AOL Instant Messenger 2.1 or later  Yahoo Messenger 4.1 or later  Microsoft Windows Messenger 3.6 or later  MSN Messenger 6.0 or later

Using McAfee SecurityCenter

McAfee SecurityCenter is your one-stop security shop, accessible from its icon in your Windows system tray or from your Windows desktop. With it, you can perform these useful tasks:

 Get free security analysis for your computer.  Launch, manage, and configure all your McAfee subscriptions from one icon.  See continuously updated virus alerts and the latest product information.  Get quick links to frequently asked questions and account details at the

McAfee web site.

NOTE

For more information about SecurityCenter features, click

Help in the SecurityCenter dialog box.

User Guide 13

Introduction

While SecurityCenter is running and all of the McAfee features installed on your computer are enabled, a red

M icon displays in the Windows system tray. This

area is usually in the lower-right corner of the Windows desktop and contains the clock.

If one or more of the McAfee applications installed on your computer are disabled, the McAfee icon changes to black .

To open McAfee SecurityCenter:

1 Right-click the McAfee icon in the Windows system tray. 2 Click Open SecurityCenter.

To access your McAfee product:

1 Right-click the McAfee icon in the Windows system tray. 2 Point to the appropriate McAfee product and select the feature you want to

use.

14 McAfee® Internet Security Suite®software

Removing Internet Security Suite programs

In some situations, you might want to remove Internet Security Suite or some of its programs.

NOTE

Users must have Administrator rights to uninstall Internet Security Suite.

1 Save all your work and close any open applications. 2 Open Control Panel.

 On your Windows taskbar, select Start, point to Settings, and then click

Control Panel (Windows 98, ME, and 2000).

 On your Windows taskbar, select Start, and then click Control Panel

(Windows XP).

3 Click Add/Remove Programs. 4 Select the McAfee Uninstall Wizard, then one or more programs, and then click

Uninstall. To remove all the Internet Security products, click Select All, then Uninstall.

5 To proceed with the removal, click Yes. 6 If prompted, restart your computer.

User Guide 15

Introduction

16 McAfee® Internet Security Suite®software

McAfee VirusScan

Welcome to McAfee VirusScan. McAfee VirusScan is an anti-virus subscription service offering comprehensive,

reliable, and up-to-date virus protection. Powered by award-winning McAfee scanning technology, VirusScan protects against viruses, worms, Trojan horses, suspect scripts, hybrid attacks, and other threats.

With it, you get the following features:

ActiveShield — Scan files when they are accessed by either you or your computer. Scan — Search for viruses and other threats in hard drives, floppy disks, and

individual files and folders.

Quarantine — Encrypt and temporarily isolate suspect files in the quarantine folder

until an appropriate action can be taken.

Hostile activity detection — Monitor your computer for virus-like activity caused by

worm-like activity and suspect scripts.

New features

This version of VirusScan provides the following new features:

 Spyware and adware detection and removal

VirusScan identifies and removes spyware, adware, and other programs that jeopardize your privacy and slow down your computer performance.

 Daily automatic updates

Daily automatic VirusScan updates protect against the latest identified and unidentified computer threats.

 Fast background scanning

Fast unobtrusive scans identify and destroy viruses, Trojans, worms, spyware, adware, dialers, and other threats without interrupting you r work.

 Real-time security alerting

Security alerts notify you about emergency virus outbreaks and security threats, and provide response options to remove, neutralize, or learn more about the threat.

 Detection and cleaning at multiple entry points

VirusScan monitors and cleans at your computer’s key entry points: e-mail, instant message attachments, and Internet downloads.

User Guide 17

McAfee VirusScan

 E-mail monitoring for worm-like activity

WormStopper™ monitors suspect mass-mailing behaviors and stops viruses and worms from spreading through e-mail to other computers.

 Script monitoring for worm-like activity

ScriptStopper™ monitors suspect script executions and stops viruses and worms from spreading through e-mail to other computers.

 Free instant messaging and e-mail technical support

Live technical support provides prompt, easy assistance using instant messaging and e-mail.

18 McAfee® Internet Security Suite®software

Testing VirusScan

Before initial use of VirusScan, it’s a good idea to test your installation. Use the following steps to separately test the ActiveShield and Scan features.

Testing ActiveShield

NOTE

To test ActiveShield from the VirusScan tab in SecurityCenter, click

Test VirusScan to view an online Support FAQ

containing these steps.

To test ActiveShield:

1 Go to http://www.eicar.com/ in your web browser. 2 Click the The AntiVirus testfile eicar.com link. 3 Scroll to the bottom of the page. Under Download, you will see four links. 4 Click eicar.com.

Testing VirusScan

If ActiveShield is working properly, it detects the eicar.com file immediately after you click the link. You can try to delete or quarantine detected files to see how ActiveShield handles possible threats. See Understanding security alerts on page 32 for details.

Testing Scan

Before you can test Scan, you must disable ActiveShield to prevent it from detecting the test files before Scan does, then download the test files.

To download the test files:

1 Disable ActiveShield: Right-click the McAfee icon, point to VirusScan, then

2 Download the EICAR test files from the EICAR web site:

click

Disable.

a Go to http://www.eicar.com/. b Click the The AntiVirus testfile eicar.com link.

User Guide 19

McAfee VirusScan

Scroll to the bottom of the page. Under Download, you will see these links:

eicar.com contains a line of text that VirusScan will detect as a virus. eicar.com.txt (optional) is the same file, but with a different file name, for

those users who have difficulty downloading the first link. Simply rename the file “eicar.com” after you download it.

eicar_com.zip is a copy of the test virus inside a .ZIP compressed file (a

WinZip

eicarcom2.zip is a copy of the test virus inside a .ZIP compressed file,

which itself is inside a .

d Click each link to download its file. For each one, a File Download dialog

™

file archive).

ZIP compressed file.

box appears.

e Click Save, click the Create New Folder button, then rename the folder VSO

Scan Folder

f Double-click VSO Scan Folder, then click Save again in each Save As dialog

box.

3 When you are finished downloading the files, close Internet Explorer. 4 Enable ActiveShield: Right-click the McAfee icon, point to VirusScan, then

Enable.

click

To test Scan:

1 Right-click the McAfee icon, point to VirusScan, then click Scan. 2 Using the directory tree in the left pane of the dialog box, go to the VSO Scan

Folder

a Click the + sign next to the C drive icon. b Click the VSO Scan Folder to highlight it (do not click the + sign next to it).

where you saved the files:

This tells Scan to check only that folder. You can also put the files in random locations on your hard drive for a more convincing demonstration of Scan’s abilities.

3 In the Scan Options area of the Scan dialog box, ensure that all options are

selected.

4 Click Scan on the lower right of the dialog box.

VirusScan scans the that folder appear in the

You can try to delete or quarantine detected files to see how Scan handles possible threats. See Understanding threat detections on page 40 for details.

20 McAfee® Internet Security Suite®software

VSO Scan Folder. The EICAR test files that you saved to

List of Detected Files. If so, Scan is working properly.

Using McAfee SecurityCenter

McAfee SecurityCenter is your one-stop security shop, accessible from its icon in your Windows system tray or from your Windows desktop. With it, you can perform these useful tasks:

McAfee web site.

NOTE

For more information about its features, click Help in the

SecurityCenter dialog box.

While SecurityCenter is running and all of the McAfee features installed on your computer are enabled, a red M icon appears in the Windows system tray. This area is usually in the lower-right corner of the Windows desktop and contains the clock.

Using McAfee SecurityCenter

If one or more of the McAfee applications installed on your computer are disabled, the McAfee icon changes to black .

To open the McAfee SecurityCenter:

1 Right-click the McAfee icon . 2 Click Open SecurityCenter.

To access a VirusScan feature:

1 Right-click the McAfee icon . 2 Point to VirusScan, then click the feature you want to use.

Using ActiveShield

When ActiveShield is started (loaded into computer memory) and enabled, it is constantly protecting your computer. ActiveShield scans files when they are accessed by either you or your computer. When ActiveShield detects a file, it automatically tries to clean it. If ActiveShield cannot clean the virus, you can quarantine or delete the file.

Enabling or disabling ActiveShield

ActiveShield is started (loaded into computer memory) and enabled (denoted by the red icon in your Windows system tray) by default as soon as you restart your computer after the installation process.

User Guide 21

McAfee VirusScan

If ActiveShield is stopped (not loaded) or is disabled (denoted by the black icon), you can manually run it, as well as configure it to start automatically when Windows starts.

Enabling ActiveShield

To enable ActiveShield for this Windows session only: Right-click the McAfee icon, point to VirusScan, then click Enable. The McAfee icon

changes to red . If ActiveShield is still configured to start when Windows starts, a message tells you

that you are now protected from threats. Otherwise, a dialog box appears that lets you configure ActiveShield to start when Windows starts (Figure 2-1 on page 23).

22 McAfee® Internet Security Suite®software

Disabling ActiveShield

To disable ActiveShield for this Windows session only:

1 Right-click the McAfee icon, point to VirusScan, then click Disable. 2 Click Yes to confirm.

The McAfee icon changes to black .

If ActiveShield is still configured to start when Windows starts, your computer will be protected from threats again when you restart your computer.

Configuring ActiveShield options

You can modify ActiveShield starting and scanning options in the ActiveShield tab of the McAfee icon in your Windows system tray.

VirusScan Options dialog box (Figure 2-1), which is accessible via the

Using ActiveShield

Starting ActiveShield

ActiveShield is started (loaded into computer memory) and enabled (denoted by red ) by default as soon as you restart your computer after the installation process.

If ActiveShield is stopped (denoted by black ), you can configure it to start automatically when Windows starts (recommended).

Figure 2-1. ActiveShield Options

User Guide 23

McAfee VirusScan

NOTE

During updates to VirusScan, the Update Wizard might exit ActiveShield temporarily to install new files. When the

Wizard

prompts you to click Finish, ActiveShield starts again.

Update

To start ActiveShield automatically when Windows starts:

1 Right-click the McAfee icon, point to VirusScan, then click Options.

The

VirusScan Options dialog box opens (Figure 2-1 on page 23).

2 Select the Start ActiveShield when Windows starts (recommended) checkbox,

then click

3 Click OK to confirm, then click OK.

Apply to save your changes.

Stopping ActiveShield

WARNING

If you stop ActiveShield, your computer is not protected from threats. If you must stop ActiveShield, other than for updating VirusScan, ensure that you are not connected to the Internet.

To stop ActiveShield from starting when Windows starts:

1 Right-click the McAfee icon, point to VirusScan, then click Options.

The

VirusScan Options dialog box opens (Figure 2-1 on page 23).

2 Deselect the Start ActiveShield when Windows starts (recommended) checkbox,

then click

3 Click OK to confirm, then click OK.

Apply to save your changes.

Scanning e-mail and attachments

By default, e-mail scanning and automatic cleaning are enabled via the Scan e-mail

and attachments

When this option is enabled, ActiveShield automatically scans and attempts to clean inbound (POP3) and outbound (SMTP) detected e-mail messages and attachments for most popular e-mail clients, including the following:

 Microsoft Outlook Express 4.0 or later  Microsoft Outlook 97 or later  Netscape Messenger 4.0 or later

option (Figure 2-1 on page 23).

 Netscape Mail 6.0 or later  Eudora Light 3.0 or later  Eudora Pro 4.0 or later  Eudora 5.0 or later

24 McAfee® Internet Security Suite®software

 Pegasus 4.0 or later

NOTE

E-mail scanning is not supported for these e-mail clients: Web-based, IMAP, AOL, POP3 SSL, and Lotus Notes. However, ActiveShield scans e-mail attachments when they are opened.

Using ActiveShield

If you disable the

Scan e-mail and attachments option, the

E-mail Scan options and the WormStopper options (Figure 2-1

on page 26) are automatically disabled. If you disable

outbound e-mail scanning, the WormStopper options are automatically disabled.

If you change your e-mail scanning options, you must restart your e-mail program to complete the changes.

Inbound e-mail

If an inbound e-mail message or attachment is detected, ActiveShield performs the following steps:

 Tries to clean the detected e-mail  Tries to quarantine or delete an uncleanable e-mail  Includes an alert file in the inbound e-mail that contains information about the

actions performed to remove the possible threat

Outbound e-mail

If an outbound e-mail message or attachment is detected, ActiveShield performs the following steps:

 Tries to clean the detected e-mail  Tries to quarantine or delete an uncleanable e-mail

NOTE

For details about outbound e-mail scanning errors, see the online help.

Disabling e-mail scanning

By default, ActiveShield scans both inbound and outbound e-mail. However, for enhanced control, you can set ActiveShield to scan only inbound or outbound e-mail.

To disable scanning of inbound or outbound e-mail:

1 Right-click the McAfee icon, point to VirusScan, and then click Options. 2 Click Advanced, then click the E-mail Scan tab (Figure 2-1). 3 Deselect Inbound e-mail messages or Outbound e-mail messages, then click OK.

User Guide 25

McAfee VirusScan

Figure 2-1. Advanced ActiveShield Options - E-mail tab

Scanning for worms

VirusScan monitors your computer for suspect activity that might indicate a threat is present on your computer. While VirusScan cleans viruses and other threats, WormStopper

A computer “worm” is a self-replicating virus that resides in active memory and might send copies of itself through e-mail. Without WormStopper, you might notice worms only when their uncontrolled replication consumes system resources, slowing performance or halting tasks.

The WormStopper protection mechanism detects, alerts, and blocks suspect activity. Suspect activity might include the following actions on you r computer:

 An attempt to forward e-mail to a large portion of your address book  Attempts to forward multiple e-mail messages in rapid succession

If you set ActiveShield to use the default option in the for suspect patterns and alerts you when a specified number of e-mails or recipients has been exceeded within a specified interval.

prevents viruses and worms from spreading further.

Enable WormStopper (recommended)

Advanced Options dialog box, WormStoppe r monitors e-mail activity

To set ActiveShield to scan sent e-mail messages for worm-like activity:

1 Right-click the McAfee icon, point to VirusScan, then click Options. 2 Click Advanced, then click the E-mail tab.

26 McAfee® Internet Security Suite®software

Using ActiveShield

Click Enable WormStopper (recommended) (Figure 2-2).

By default, the following detailed options are enabled:

 Pattern matching to detect suspect activity  Alerting when e-mail is sent to 40 or more recipients  Alerting when 5 or more e-mails are sent within 30 seconds

NOTE

If you modify the number of recipients or seconds for monitoring sent e-mails, it might result in invalid detections. McAfee recommends that you click setting. Otherwise, click

Yes to change the default setting to

No to retain the default

your setting.

This option can be automatically enabled after the first time a potential worm is detected (see Managing potential worms on page 33 for details):

 Automatic blocking of suspect outbound e-mails

Figure 2-2. Advanced ActiveShield Options - E-mail tab

User Guide 27

McAfee VirusScan

Scanning inbound instant message attachments

By default, scanning of instant message attachments is enabled via the Scan

inbound instant message attachments

When this option is enabled, VirusScan automatically scans and attempts to clean inbound detected instant message attachments for most popular instant messaging programs, including the following:

 MSN Messenger 6.0 or later  Yahoo Messenger 4.1 or later  AOL Instant Messenger 2.1 or later

NOTE

For your protection, you cannot disable auto-cleaning of instant message attachments.

If an inbound instant message attachment is detected, VirusScan performs the following steps:

 Tries to clean the detected message

option (Figure 2-1 on page 23).

 Prompts you to quarantine or delete an uncleanable message

Scanning all files

If you set ActiveShield to use the default All files (recommended) option, it scans every file type that your computer uses, as your computer attempts to use it. Use this option to get the most thorough scan possible.

To set ActiveShield to scan all file types:

1 Right-click the McAfee icon, point to VirusScan, and then click Options. 2 Click Advanced, then click the Scanning tab (Figure 2-3 on page 29). 3 Click All files (recommended), then click OK.

28 McAfee® Internet Security Suite®software

Using ActiveShield

Figure 2-3. Advanced ActiveShield Options - Scanning tab

Scanning program files and documents only

If you set ActiveShield to use the Program files and documents only option, it scans program files and documents, but not any other files used by your computer. The latest virus signature file (

DAT file) determines which file types that ActiveShield

will scan.To set ActiveShield to scan program files and documents only:

1 Right-click the McAfee icon, point to VirusScan, and then click Options. 2 Click Advanced, then click the Scanning tab (Figure 2-3). 3 Click Program files and documents only, then click OK.

Scanning for new unknown viruses

If you set ActiveShield to use the default Scan for new unknown viruses

(recommended)

to the signatures of known viruses, while also looking for telltale signs of unidentified viruses in the files.

To set ActiveShield to scan for new unknown viruses:

option, it uses advanced heuristic techniques that try to match files

1 Right-click the McAfee icon, point to VirusScan, and then click Options. 2 Click Advanced, then click the Scanning tab (Figure 2-3). 3 Click Scan for new unknown viruses (recommended), then click OK.

User Guide 29

McAfee VirusScan

Scanning for scripts

VirusScan monitors your computer for suspect activity that might indicate a threat is present on your computer. While VirusScan cleans viruses and other threats, ScriptStopperTM prevents Trojan horses from running scripts that spread viruses further.

A “Trojan horse” is a suspect program that pretends to be a benign application. Trojans are not viruses because they do not replicate, but they can be just as destructive.

The ScriptStopper protection mechanism detects, alerts, and blocks suspect activity. Suspect activity might include the following action on your computer:

 A script execution that results in the creation, copying, or deletion of files, or

the opening of your Windows registry

If you set ActiveShield to use the default option in the

Advanced Options dialog box, ScriptStopper monitors script

Enable ScriptStopper (recommended)

execution for suspect patterns and alerts you when a specified number of e-mails or recipients has been exceeded within a specified interval.

To set ActiveShield to scan running scripts for worm-like activity:

1 Right-click the McAfee icon, point to VirusScan, then click Options. 2 Click Advanced, then click the Exploits tab (Figure 2-4). 3 Click Enable ScriptStopper (recommended), then click OK.

30 McAfee® Internet Security Suite®software

Figure 2-4. Advanced ActiveShield Options - Exploits tab

+ 115 hidden pages

McAfee MIS80E001RAI, MIS70E001RCA, Internet Security Suite User Manual

Specifications and Main Features

Frequently Asked Questions

User Manual