mcafee security 1.0 user guide

McAfee Security 1.0User Guide

COPYRIGHT

Copyright © 2009 McAfee, Inc. All Rights Reserved.

No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any formor by any means without the written permission of McAfee, Inc., or its suppliers or affiliate companies.

TRADEMARK ATTRIBUTIONS

AVERT, EPO, EPOLICY ORCHESTRATOR, FOUNDSTONE, GROUPSHIELD, INTRUSHIELD, LINUXSHIELD, MAX (MCAFEE SECURITYALLIANCEEXCHANGE), MCAFEE, NETSHIELD, PORTALSHIELD, PREVENTSYS, SECURITYALLIANCE, SITEADVISOR, TOTAL PROTECTION, VIRUSSCAN,WEBSHIELD are registered trademarks or trademarks of McAfee, Inc. and/or its affiliates in the US and/or other countries. McAfee Red inconnection with security is distinctive of McAfee brand products. All other registered and unregistered trademarks herein are the sole propertyof their respective owners.

LICENSE INFORMATION

License Agreement

NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED,WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICHTYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTSTHAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET,A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOUDO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURNTHE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND.

License Attributions

Refer to the product Release Notes.

McAfee Security software version 1.0 User Guide2

ContentsIntroducing McAfee Security 1.0. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6

How McAfee Security works. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

Types of protection. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

New features in this release. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

Installing and managing McAfee Security on standalone computers. . . . . . . . . . . . . . . .9

Prerequisites. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

Methods of installation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

Standard installation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

Command-line (silent) installation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

Testing your installation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

Testing the Anti-malware feature. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

Testing the Application Protection feature. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

Testing the Desktop Firewall feature. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

Uninstalling McAfee Security. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

Integrating McAfee Security with McAfee ePolicy Orchestrator 4.0. . . . . . . . . . . . . . . .14

Deploying McAfee Security using ePolicy Orchestrator 4.0. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

Checking-in the McAfee Agent and McAfee Security package to ePolicy Orchestrator 4.0. . . . . . . . 14

Installing McAfee Agent on client computers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

Installing McAfee Security extensions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

Installing McAfee Security on client computers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

Setting policies using ePolicy Orchestrator 4.0. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

Creating policies. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

Enforcing policies. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

Scheduling tasks using ePolicy Orchestrator 4.0. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

On-demand scan task. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

Removing McAfee Security using ePolicy Orchestrator 4.0. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

Removing McAfee Security from the client computers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

Removing McAfee Security extensions from the ePolicy Orchestrator server. . . . . . . . . . . . . . . . . . . 18

Integrating McAfee Security with McAfee ePolicy Orchestrator 4.5. . . . . . . . . . . . . . . .19

Deploying McAfee Security using ePolicy Orchestrator 4.5. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

Checking-in the McAfee Agent and McAfee Security package to ePolicy Orchestrator 4.5. . . . . . . . 19

3McAfee Security software version 1.0 User Guide

Installing McAfee Agent on client computers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

Installing McAfee Security extensions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

Installing McAfee Security on client computers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

Setting policies using ePolicy Orchestrator 4.5. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

Creating policies. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

Enforcing policies. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

Scheduling tasks using ePolicy Orchestrator 4.5. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

On-demand scan task. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

Removing McAfee Security using ePolicy Orchestrator 4.5. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

Removing McAfee Security from the client computers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

Removing extensions from the ePolicy Orchestrator server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

Launching McAfee Security Console. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .24

Dashboard with the latest events. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

History of all events. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

Quarantining malware. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

Default activities in McAfee Security Console. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

Update Now. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

Scan Now. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

Configuring scan tasks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

Creating a new scan task. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

Modifying an existing scan task. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

Deleting a scan task. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

Configuring McAfee Security Preferences. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .30

General Preferences. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

Configuring Anti-malware Preferences. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

Configuring On-access Scan Preferences. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

Configuring On-demand Scan Preferences. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

Specifying Anti-malware Exclusions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

Configuring Application Protection Preferences. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

Configuring Application Protection Rules. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

Specifying Application Protection Exclusions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

Configuring Desktop Firewall Preferences. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

Configuring Desktop Firewall Rules. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

Specifying Trusted Networks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

Enhanced Reports. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

Update Preferences. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40

Default Preferences. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41


Contents

Help option in the menu bar. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42


Contents

Introducing McAfee Security 1.0McAfee Security 1.0 safeguards your Mac from malware, prevents execution of unwantedapplications, and denies unauthorized network access.

Topics covered in this chapter are:

Contents

How McAfee Security works

Types of protection

New features in this release

How McAfee Security worksMcAfee Security is suite-based and offers enhanced security for your Mac. In addition toanti-virus, it now includes anti-spyware, desktop firewall, and application protection features.

McAfee Security integrates with your Mac OS and works in real-time to detect malware. It scansfiles, folders, local or network mounted volumes, and other items for potentially unwanted codeand notifies you in case of malware detections. Scanning takes place every time you create oraccess an item. You can also schedule scans to run immediately, at a particular time, or atregular intervals.

Central to your McAfee Security software are the McAfee Security scanning engine and themalware definition files (DATs). The engine is a complex data analyzer. It identifies the type ofthe item being scanned and decodes the content of that object to understand what the itemis. It then scans items on your Mac comparing them with all known signatures stored in theDAT files. The DAT files contain a great deal of information including thousands of differentdrivers; each of which contain detailed instructions on how to identify malware (based on theirsignatures).

Additionally, you can configure application protection rules to prevent unwanted applicationsfrom executing or from accessing the incoming and/or outgoing network connections. Forexample, you can set rules such that the iTunes application can be launched (executed) andused for recreational purposes but cannot be used to access the Internet for downloading music.You can also specify path-based application exclusions to exclude applications from these rules.

McAfee Security also monitors network communications and allows or denies access to specificnetworks/hosts/IP addresses based on the firewall rules you configure. You can also specifytrusted networks in groups to exclude them from these rules.

Types of protectionMcAfee Security provides the following protections:


DescriptionProtection feature

Safeguards your Mac from viruses, spyware, Trojan horses, potentiallyunwanted programs, and other malware.

Protection from malware

Allows or denies access from/to a specific network/IP/host based on a setof configured rules.

Desktop firewall protection

Prevents applications on your Mac from:Application protection

• execution (launch).

• accessing the incoming or outgoing network connection.

New features in this releaseNew features of McAfee Security includes:

Core features

DefinitionOption

McAfee Security can allow or deny unauthorized access to specificnetworks,subnets, hosts, or IP addresses based on the firewall rulesyou configure.

TIP: For more information, refer to the Configuring Desktop FirewallPreferences section.

Desktop firewall protection

McAfee Security can prevent the execution of unwanted applicationsand/or restrict network access to them based on the applicationprotection rules you configure.

TIP: For more information, refer to the Configuring ApplicationProtection Preferences section.

Application protection

McAfee Security scans your Mac to ensure it is free from spyware.Protection from spyware

Click the McAfee menulet to launch McAfee Security Console,McAfee Security Preferences, and the About dialog box.

TIP: For more information, refer to the Menulet options section.

McAfee menulet for easy access of McAfeeSecurity

McAfee Security offers an enhanced dashboard that displays the securitystatus and the latest anti-malware and application protection events.

TIP: For more information, refer to the Dashboard section.

Enhanced dashboard

The History screen displays all anti-malware and application protectionevents.

History of all events

Click History on the left pane of the McAfee Security console to viewall anti-malware and application protection events.

TIP: For more information, refer to the History of all events section.

McAfee Security quarantines malware (or suspected malware-likebehavior) to a location you specified while installing McAfee Security,so that the item cannot be opened or executed.

TIP: For more information, refer to the Quarantining malware section.

Quarantine malware

Introducing McAfee Security 1.0New features in this release


DefinitionOption

You are notified of malware detections (resulting from on-access scan),prevention of application execution, and denial of network access toan application in the McAfee Notification screen.

Enhanced notification and alert mechanisms

McAfee Security displays the McAfee Alert screen if an unknown ormodified application tries to execute when you set the correspondingapplication protection setting as Prompt. In this case, you areprompted to select an appropriate action.

You can deploy and manage McAfee Security across multiple clientcomputers using McAfee ePolicy Orchestrator 4.0 or later.

ePolicy Orchestrator manageability(optional)

Additional features

Support for:

• Specifying extended set of primary and secondary actions for on-access and on-demandscans.

• Specifying regular expression based exclusions for on-access and on-demand scans separately.

• Specifying desktop firewall trusted networks.

• Whitelisting applications based on their locations.

• Running multiple on-demand scans immediately at the same time.

• Scheduling multiple on-demand scans to run simultaneously.

• Enhanced MER tool for collecting diagnostic data of the software.

Introducing McAfee Security 1.0New features in this release


Installing and managing McAfee Security onstandalone computers

McAfee Security can be installed on standalone systems using the standard installation orcommand-line (silent) installation method.


Contents

Prerequisites

Methods of installation

Testing your installation

Uninstalling McAfee Security

PrerequisitesHardware requirements

DefinitionOption

Intel or PowerPCProcessor

1 GB or higherRAM

Software requirements

DefinitionOption

Minimum 300 MB of free disk space (500 MB recommended)Disk space

Operating system • Mac OS X Leopard 10.5 or later

• Mac OS X Tiger 10.4.6 or later

Methods of installationYou can install McAfee Security using one of the following methods:

Tasks

Standard installation

Command-line (silent) installation


Standard installationStandard installation includes installing McAfee Security by running the user interface installer.During standard installation, a wizard appears leading the installation process through a seriesof instructions you must follow.

Prerequisite: You must have administrator rights to install McAfee Security.

1 Download McAfee Security for Mac-1.0-<release-type>-<build-number>.dmg toyour desktop and double-click it to mount.

2 Double-click McAfee Security.mpkg. The Welcome to the McAfee Security Installerscreen appears.

3 Click Continue and follow the on-screen instructions to install the software.

NOTE: The installer places the McAfee Security application in /Applications.

Command-line (silent) installationCommand-line installation involves installing McAfee Security locally on a computer without theneed for user intervention.

1 Download McAfee Security for Mac-1.0-<release-type>-<build-number>.dmg toyour desktop.

2 Locate the McAfee Security.mpkg file in the DMG file downloaded from the McAfeewebsite, then save it to a temporary location.

3 Open the Terminal window and change the working directory to the one where you savedthe McAfee Security.mpkg file.

4 Type the following command and press return:sudo installer -pkg McAfeeSecurity.mpkg –target /

5 Type the administrator password when prompted and press return. A message appearswhen the installation is complete.

Menulet options

After McAfee Security is installed, you can click the McAfee menulet to launch:

• McAfee Security Console — To view the five latest product events, security statusof your Mac, status of on-accessing scanning, spyware scanning, desktop firewall,application protection, instance of the last anti-malware update, history of all productevents, quarantined malware, and configure manual updates/scans.

• McAfee Security Preferences — To configure the general, anti-malware, desktopfirewall, application protection, and update preferences (settings).

• About dialog box — To get the following information:

• Version (and build) information of McAfee Security.

• Anti-malware information that includes the version (and build) information, Engineversion, DAT version, and the DAT creation date.

• Version (and build) information of application protection.

• Version (and build) information of desktop firewall.

Installing and managing McAfee Security on standalone computersMethods of installation


Testing your installationTo test your installation, perform the following instructions in this section. If these tests aresuccessful, you are ready to start using McAfee Security.

Prerequisite: You must have administrator rights to test the application protection and thedesktop firewall feature.

Tasks

Testing the Anti-malware feature

Testing the Application Protection feature

Testing the Desktop Firewall feature

Testing the Anti-malware featureYou can test McAfee Security by using the European Institute of Computer Anti-Virus Research(EICAR) standard anti-virus test file. This file is a combined effort by anti-virus vendorsthroughout the world to implement one standard by which customers can verify their anti-virussoftware.

1 Go to the EICAR.ORG website http://www.eicar.org and download the anti-virus test fileEicar.com.

2 Run the on-demand scanner on the downloaded ZIP file. McAfee Security will report findingthe EICAR test file.

Testing the Application Protection featureUse this task to test the Application Protection feature of McAfee Security.

Consider a scenario where you want to prevent iTunes from execution.

1 Click the McAfee menulet on the status bar, then select McAfee Security Preferences.Alternatively, you can launch the McAfee Security Console, click McAfee Security on thestatus bar, then select Preferences.

NOTE: For instructions on launching the McAfee Security Console, see the Launching McAfeeSecurity Console section.

2 Click Application Protection. Click the lock to make changes, type your administratorpassword, then click OK. The application protection preferences will have default settings.

TIP: For more information about the application protection default settings, see the Defaultpreferences section.

3 In Rules, click + at the bottom left corner of the console to create an application protectionrule to prevent iTunes from executing.

4 In Application Name, browse and add iTunes located in Finder | Applications.

5 In Action, select Deny Execution, then click OK to return to the Rules screen.

6 Launch Finder, go to Applications, double-click iTunes. The following message appearsin McAfee Notification screen.

Installing and managing McAfee Security on standalone computersTesting your installation


http://http://www.eicar.org

NOTE: For further information on configuring application protection preferences, see theConfiguring Application Protection Preferences section in the McAfee Security Preferenceschapter.

Testing the Desktop Firewall featureUse this task to test the Desktop Firewall feature of McAfee Security.

Consider a scenario where you want to deny accessing any IP address from your system.

1 Click the McAfee menulet on the status bar, then select McAfee Security Preferences.Alternatively, you can launch the McAfee Security Console, click McAfee Security on thestatus bar, then select Preferences.

NOTE: For instructions on launching the McAfee Security Console, see the Launching McAfeeSecurity Console section.

2 Click Desktop Firewall. Click the lock, type your administrator password, then click OK.The desktop firewall preferences will have default settings.

TIP: For more information about the desktop firewall default settings, see the Defaultpreferences section.

3 In Rules, click Custom, then click + at the bottom left corner of the console to create adesktop firewall rule.

4 Type a Rule Name, select Deny as Action, IP as Protocol, Both as Direction of thenetwork connection, and select an active network Interface as required.

5 In IP address, Subnet or Network, selectMe as the source IP and Any as the destinationIP address for which the access must be denied, then click OK to return to the Rulesscreen.

Access to any IP address from your system is blocked.

Uninstalling McAfee SecurityYou can uninstall McAfee Security from Finder or through command-line.

Prerequisites: You must have administrator rights to uninstall McAfee Security.

Installing and managing McAfee Security on standalone computersUninstalling McAfee Security


Uninstalling McAfee Security from Finder

1 Launch Finder, go to Applications, then double-click McAfeeSecurityUninstaller.

2 Type the administrator password when prompted and press return.

Uninstalling McAfee Security through command-line

1 In the Terminal window, type the following command and press return./usr/local/McAfee/uninstallMSC

2 When prompted, type your password and press return.When the uninstallation process completes, the Terminal displays a message stating thatMcAfee Security is uninstalled from your Mac.

Installing and managing McAfee Security on standalone computersUninstalling McAfee Security


Integrating McAfee Security with McAfeeePolicy Orchestrator 4.0

This chapter describes how to configure McAfee Security using McAfee ePolicy Orchestratormanagement software version 4.0. To use this chapter effectively, you need to be familiar withePolicy Orchestrator 4.0.

McAfee ePolicy Orchestrator 4.0 provides a scalable platform for centralized policy managementand enforcement on your McAfee security products and systems on which they reside. It alsoprovides comprehensive reporting and product deployment capabilities; all through a singlepoint of control.

NOTE: This document does not provide detailed information about installing or using ePolicyOrchestrator software. See the McAfee ePolicy Orchestrator 4.0 product documentation formore information.


Deploying McAfee Security using ePolicy Orchestrator 4.0

Scheduling tasks using ePolicy Orchestrator 4.0

Removing McAfee Security using ePolicy Orchestrator 4.0

Deploying McAfee Security using ePolicyOrchestrator 4.0

Topics covered in this section are:

Installing McAfee Agent on client computers

Installing McAfee Security extensions

Installing McAfee Security on client computers

Checking-in the McAfee Agent and McAfee Security package toePolicy Orchestrator 4.0

You can check-in the McAfee Agent package and McAfee Security package from the Repositorypage. Repository is the central location for all McAfee updates residing on the ePolicy Orchestratorserver. It retrieves user-specified updates from the McAfee site or user-defined source sites.

1 Copy the MSA-MAC 4.0.0 Build <build number> Package #4(ENU-LICENSED-RELEASE-PATCH1).zip and McAfee Security forMac-1.0-ePO-<build number>.zip files to a temporary location of your ePolicyOrchestrator computer.

2 Using an administrator account, log on to the ePolicy Orchestrator server.


3 Click Software | Check in Package. The Check In Package page appears.

4 Select the Package type as Product or Update (.ZIP). Browse in File path to locateand check-in the MSA-MAC 4.0.0 Build <build number> Package #4(ENU-LICENSED-RELEASE-PATCH1).zip file.

5 Click Next. The Package Options page appears with the package information.

6 Click Save.

NOTE: Repeat the same steps and in step 4, check-in the McAfee Security package McAfeeSecurity for Mac-1.0-ePO-<build number>.zip.

Installing McAfee Agent on client computersAfter checking-in the McAfee Agent package to the ePolicy Orchestrator server 4.0, you shouldmanually install McAfee Agent 4.0 on the client computers.

1 Copy install.sh file from the following location to the client computer(s):<ePO install directory>\DB\Software\Current\EPOAGENT3700MACX\Install\0409

2 Type sh install.sh -i in the Terminal window and press return.To upgrade the agent, you can type sh install.sh -u in the Terminal window and pressreturn.

Prerequisite: You must log on as a root user to execute the sh install.sh command.

The sh.install.sh file is created automatically after you check-in the Agent package in tothe ePolicy Orchestrator server.

Installing McAfee Security extensions1 Copy theMcAfee_Security_for_Mac_Anti_malware_AVAS.zip to a temporary location

of your ePolicy Orchestrator computer.

2 Using an administrator account, log on to the ePolicy Orchestrator server.

3 Click Configuration | Extensions | Install Extension. The Install Extension dialogbox appears.

4 Click Browse to install the anti-virus extension fileMcAfee_Security_for_Mac_Anti_malware_AVAS.zip, then click OK.

5 Click OK.

NOTE: Repeat the same steps to install the following extensions:

• McAfee_Security_for_Mac_Desktop_Firewall.zip (Desktop Firewall policyextension)

• McAfee_Security_for_Mac_Application_Protection.zip (Application Protectionpolicy extension)

• McAfee_Security_for_Mac_Reports.zip (Reports extension)

Installing McAfee Security on client computers1 Log on to the ePolicy Orchestrator server as an administrator.

2 Click Systems, select the required system(s), click Client Tasks tab, then New Task.The Client Task Builder page appears.

Integrating McAfee Security with McAfee ePolicy Orchestrator 4.0Deploying McAfee Security using ePolicy Orchestrator 4.0


3 In Description, type aName,Notes (optional), select the Type as Product Deployment(McAfee Agent), then click Next.

4 In Configuration, select Mac as Target Platforms, McAfee Security for Mac 1.0 asProducts and components, and Install as Action, then click Next.

5 Schedule the task to run immediately or as required, then click Next to view a summaryof the task.

6 Click Save, then send an agent wake-up call.

Setting policies using ePolicy Orchestrator 4.0You can create, edit, delete and enforce policies to a specific group/system(s) in the SystemTree.

Creating policies

Enforcing policies

Creating policies1 Log on to the ePolicy Orchestrator server as an administrator.

2 Click Systems | System Tree and choose a desired group/system(s).

3 Click Policies, select the following options from the Product drop-down list.

• McAfee Security for Mac 1.0.0:Application Protection

• McAfee Security for Mac 1.0.0:Desktop Firewall

• McAfee Security for Mac 9.0.0:Anti-malwareA list of policies managed by the chosen point product appears in the lower pane.

4 Locate a policy category, then click Edit Assignment. The Policy assignment for MyOrganization page appears.

5 Click New policy. The Create a new policy dialog box appears. Choose McAfee Defaultor My Default as required.

NOTE: The McAfee Default policy is read-only and cannot be edited, renamed, or deleted.

6 Type a New policy name, then click OK.

7 Configure the anti-malware, desktop firewall, and/or application protection preferences asrequired, then click Save.

8 Click Save again.

Enforcing policiesYou can enforce a policy to multiple managed nodes within a group.

1 Log on to the ePolicy Orchestrator server as an administrator.

2 Click Systems. In System Tree, select the required system(s).

3 Click Modify Policies on a Single System.

4 Select the required Product, click the policy link, and configure the appropriate policy asrequired.

Integrating McAfee Security with McAfee ePolicy Orchestrator 4.0Setting policies using ePolicy Orchestrator 4.0


5 Click Save, then Close.

6 Send an agent wake-up call.

NOTE: In step 2, if you select group(s):

1 Click the Policies tab, select the required Product, click the policy link, and configurethe appropriate policy as required.

2 Click Save.


Scheduling tasks using ePolicy Orchestrator 4.0ePolicy Orchestrator allows you to create, schedule and maintain client tasks that run on themanaged systems. You can define client tasks for the entire System Tree, a specific group, oran individual system.

On-demand scan taskYou can schedule multiple on-demand scan tasks to run immediately, at specific times, or atregularly-scheduled intervals across managed nodes.


2 Click Systems | System Tree | Client Tasks.

3 Select the desired group in the System Tree for which you want to create the on-demandscan task.

4 Click New Task. The Client Task Builder page appears.

5 Under Description, type a Name and Notes (optional) for the on-demand scan task.

6 Select OnDemand Scan (McAfee Security for Mac 9.0.0:Anti-malware) as the Typeof the task and click Next.

7 In Configuration, add the file(s) to be scanned.

8 Click Next and schedule the task as desired

9 Click Next to view the summary of the on-demand scan task.


Removing McAfee Security using ePolicyOrchestrator 4.0

This section provides instructions to uninstall McAfee Security from the client computers andremove the extensions from the ePolicy Orchestrator server.

Removing McAfee Security from the client computers

Removing McAfee Security extensions from the ePolicy Orchestrator server

Integrating McAfee Security with McAfee ePolicy Orchestrator 4.0Scheduling tasks using ePolicy Orchestrator 4.0


Removing McAfee Security from the client computers1 Click Systems, select the required system(s), click Client Tasks tab, then New Task.

The Client Task Builder page appears.

2 In Description, type aName,Notes (optional), select the Type as Product Deployment(McAfee Agent), then click Next.

3 In Configuration, select Mac as Target Platforms, McAfee Security for Mac 1.0 asProducts and components, Install as Remove and an appropriate Language, thenclick Next.



Removing McAfee Security extensions from the ePolicyOrchestrator server


2 Click Configuration | Extensions.

3 Select the following extension files (one at a time), then click Remove.



• McAfee Security for Mac 9.0.0:Anti-malware

• McAfee Security for Mac Reports

4 Select the option Force removal, bypassing any checks or errors.

NOTE: This step is not mandatory, but recommended.

5 Click OK.

Integrating McAfee Security with McAfee ePolicy Orchestrator 4.0Removing McAfee Security using ePolicy Orchestrator 4.0


Integrating McAfee Security with McAfeeePolicy Orchestrator 4.5

This chapter describes how to configure McAfee Security using McAfee ePolicy Orchestratormanagement software version 4.5. To use this chapter effectively, you need to be familiar withePolicy Orchestrator 4.5.

McAfee ePolicy Orchestrator 4.5 provides a scalable platform for centralized policy managementand enforcement on your McAfee security products and systems on which they reside. It alsoprovides comprehensive reporting and product deployment capabilities; all through a singlepoint of control.

NOTE: This document does not provide detailed information about installing or using ePolicyOrchestrator software. See the McAfee ePolicy Orchestrator 4.5 product documentation formore information.


Contents

Deploying McAfee Security using ePolicy Orchestrator 4.5

Setting policies using ePolicy Orchestrator 4.5

Scheduling tasks using ePolicy Orchestrator 4.5

Removing McAfee Security using ePolicy Orchestrator 4.5

Deploying McAfee Security using ePolicyOrchestrator 4.5

Topics covered in this section are:

Contents

Installing McAfee Agent on client computers

Installing McAfee Security extensions

Installing McAfee Security on client computers

Checking-in the McAfee Agent and McAfee Security package toePolicy Orchestrator 4.5

You can check-in the Agent package and McAfee Security package from the Packages inMaster Repository page.


1 Copy the MSA-MAC 4.0.0 Build <build number> Package #4(ENU-LICENSED-RELEASE-PATCH1).zip and McAfee Security forMac-1.0-ePO-<build number>.zip files (from the ePO Server Components folder)to a temporary location of your ePolicy Orchestrator computer.


3 Click Menu | Software | Master Repository. The Packages in Master Repositorypage appears.

4 Click Actions | Check In Package. The Package page appears.

5 Select the Package type as Product or Update (.ZIP). Browse in File path to locateand check-in the MSA-MAC 4.0.0 Build <build number> Package #4(ENU-LICENSED-RELEASE-PATCH1).zip file.

6 Click Next. The Package Options page appears with the package information.

7 Click Save.

NOTE: Repeat the same steps and check-in the McAfee Security package McAfee Securityfor Mac-1.0-ePO-<build number>.zip.

Installing McAfee Agent on client computersAfter checking-in the McAfee Agent package to the ePolicy Orchestrator server 4.5, you mustmanually install McAfee Agent 4.0 on the client computers.

1 Copy install.sh file from the following location to the client computer.<ePO install directory>\DB\Software\Current\EPOAGENT3700MACX\Install\0409

2 Type sh install.sh -i in the Terminal window and press return.

To upgrade the agent, you can type sh install.sh -u in the Terminal window and pressreturn.

Important: You must log on as a root user to execute the sh.install.sh command. Thesh.install.sh file is created automatically after you check-in the Agent package in to theePolicy Orchestrator server.

Installing McAfee Security extensions1 Copy theMcAfee_Security_for_Mac_Anti_malware_AVAS.zip to a temporary location

of your ePolicy Orchestrator computer.


3 Click Menu | Software | Extensions | Install Extension. The Install Extension dialogbox appears.

4 Click Browse to install the anti-virus extension fileMcAfee_Security_for_Mac_Anti_malware_AVAS.zip, then click OK.

5 Click OK.

NOTE: Repeat the same steps to install the following extensions:

• McAfee_Security_for_Mac_Desktop_Firewall.zip (Desktop Firewall policyextension)

• McAfee_Security_for_Mac_Application_Protection.zip (Application Protectionpolicy extension)

Integrating McAfee Security with McAfee ePolicy Orchestrator 4.5Deploying McAfee Security using ePolicy Orchestrator 4.5


• McAfee_Security_for_Mac_Reports.zip (Report extension)

Installing McAfee Security on client computers1 Log on to the ePolicy Orchestrator server as an administrator.

2 Click Menu | Systems | System Tree, then select the systems from on you want toinstall McAfee Security.

3 Click Client Tasks | Actions | New Task. The Client Task Builder page appears.

4 In Description, type a Name, Notes (optional), select the Type as ProductDeployment, then click Next.

5 In Configuration, select Mac as Target Platforms, McAfee Security for Mac 1.0 asProducts and components, Install as Action and the appropriate Language, thenclick Next.



Setting policies using ePolicy Orchestrator 4.5The ePolicy Orchestrator console allows you to enforce policies across mutliple Macs. Thesepolicies override configurations set on individual Macs. For information regarding policies andhow they are enforced, see the McAfee ePolicy Orchestrator 4.5 Product Guide.

After you have modified the appropriate policies and saved the changes for the intendedcomputer or group of computers, you are ready to deploy new settings via the McAfee Agent.

You can create, edit, delete, or assign a policy to a specific group/system.

Creating policies

Enforcing policies

Creating policiesYou can create, edit, delete, or assign a policy to a specific group in the System Tree.


2 Click Menu | Systems | System Tree | Assigned Policies.

3 Select the following options (one at a time) from the Product drop-down list:



• McAfee Security for Mac 9.0.0:Anti-malwareA list of policies managed by the chosen point product appears in the lower pane.

4 Locate the required policy, then click Edit Assignment.

5 Click New policy or Edit policy as required. The Create a new policy dialog box appears.Choose McAfee Default or My Default as required.

NOTE: The McAfee Default policy is read-only and cannot be edited, renamed, or deleted.

6 Type a New policy name, then click OK.

Integrating McAfee Security with McAfee ePolicy Orchestrator 4.5Setting policies using ePolicy Orchestrator 4.5


7 Configure the anti-malware, desktop firewall, and/or application protection preferences asrequired (based on the option you selected in step 3), then click Save.

8 Click Save again.

Enforcing policies1 Log on to the ePolicy Orchestrator server as an administrator.

2 Click Menu | Systems | System Tree select the required system(s).

3 Click Actions | Agent | Modify Policies on a Single System.

4 Select the required Product, click the policy link, and configure the appropriate policy asrequired.

5 Click Save, then Close.


NOTE: In step 2, if you select group(s):

1 Click the Assigned Policies tab, select the required Product, click the policy link,and configure the appropriate policy as required.

2 Click Save.


Scheduling tasks using ePolicy Orchestrator 4.5ePolicy Orchestrator allows you to create, schedule and maintain client tasks that run on themanaged systems. You can define client tasks for the entire System Tree, a specific group, oran individual system.

On-demand scan taskYou can schedule multiple on-demand scan tasks to run immediately, at specific times, or atregularly-scheduled intervals across managed nodes.


2 Click Menu | Systems | System Tree and select a required group or system(s).

3 Click Client Task | Actions | New Task. The Client Task Builder page appears.

4 In Description, type a Name and Notes (optional) for the on-demand scan task.

5 Select OnDemand Scan (McAfee Security for Mac 9.0.0:Anti-malware) as the Typeof the task and click Next.

6 In Configuration, add the file(s) to be scanned.

7 Click Next and schedule the task as desired

8 Click Next to view the summary of the on-demand scan task.


Integrating McAfee Security with McAfee ePolicy Orchestrator 4.5Scheduling tasks using ePolicy Orchestrator 4.5


Removing McAfee Security using ePolicyOrchestrator 4.5

This section provides instructions to uninstall McAfee Security from the client computers andremove the extensions from the ePolicy Orchestrator server.

Removing McAfee Security from the client computers

Removing extensions from the ePolicy Orchestrator server

Removing McAfee Security from the client computers1 Log on to the ePolicy Orchestrator server as an administrator.

2 Click Menu | Systems | System Tree, then select the systems from which you want touninstall McAfee Security.

3 Click Client Tasks | Actions | New Task. The Client Task Builder page appears.

4 In Description, type a Name, Notes (optional), select the Type as ProductDeployment, then click Next.

5 In Configuration, select Mac as Target Platforms, McAfee Security for Mac 1.0 asProducts and components, Remove as Action and the appropriate Language, thenclick Next.



Removing extensions from the ePolicy Orchestrator server1 Log on to the ePolicy Orchestrator server as an administrator.

2 Click Menu | Software | Extensions.

3 Click McAfee Security for Mac on the left pane.

4 Click the Remove link of the product extensions.

5 Select the option Force removal, bypassing any checks or errors, then click OK.

NOTE: This step is not mandatory, but recommended.

6 Click OK.

Integrating McAfee Security with McAfee ePolicy Orchestrator 4.5Removing McAfee Security using ePolicy Orchestrator 4.5


Launching McAfee Security ConsoleYou can launch McAfee Security Console using one of the following methods:

• Click the McAfee menulet on your status bar, then select McAfee Security Console.

• Launch Finder, go to Applications, then double-click McAfee Security.

From the left pane of the console, you can navigate to the enhanced McAfee SecurityDashboard, History screen displaying all product events, Quarantine screen that providesinformation on quarantined items, and the Update Now and Scan Now activities.


Contents

Dashboard with the latest events

History of all events

Quarantining malware

Default activities in McAfee Security Console

Configuring scan tasks

Dashboard with the latest eventsDashboard is the default screen that comes up when you launch McAfee Security Console.

McAfee Security has an enhanced dashboard that displays:

• Five latest events related to scanning, anti-malware updates, prevention of applicationexecution, and denial of network access to applications.

• Status of your Mac security, on-access scanning, spyware scanning, application protection,and desktop firewall.

• Instance of the last anti-malware update.


History of all eventsThe History screen displays all anti-malware and application protection events. You can usethe arrows at the bottom of the console to navigate through multiple History pages.

Launching McAfee Security ConsoleHistory of all events


Viewing event details

Double-click an event to view its details. Alternatively, you can click an event, click History onthe McAfee Security menu bar, then select View Details. A dialog box appears providing

the event details. Click to close the dialog box.

The events mainly include:

• Anti-malware Update — Double-clicking this event displays a dialog box that providesinformation on the DAT version, Engine version, and the status of the update.

• Blocked (Network access) — Double-clicking this event displays a dialog box that providesinformation on the IP and Port for which the access was denied, type of connection, pathof the application for which the network access was blocked, and the protocol involved inthe operation.

• Blocked (Application execution) — Double-clicking this event displays a dialog box thatprovides the path of the application that was prevented from execution.

• On-access Scan— Double-clicking this event displays a dialog box that provides informationon the process that accessed the item, status of the scan (whether an item was detectedor not), total number of detected items, name and location of the infected files, and theaction taken when they were detected.

• On-demand Scan — Double-clicking this event displays a dialog box that providesinformation on the number of files that were and were not scanned, name and location ofthe infected files, and the action taken when they were detected.

Sorting events

To sort events alphabetically, click the column headers on the screen. Alternatively, you canclick History on the McAfee Security menu bar, select Arrange By, then select Event,Type, or Date & Time as required.

Removing events

To remove an event, click the event, then click Delete (or press delete). You can also selectmultiple events, then click Delete (or press delete). To delete all the events from the Historyscreen, click History on the McAfee Security menu bar, then select Clear history.

NOTE: You must have administrator rights delete event(s) or clear the history of events.

Quarantining malwareThe quarantine functionality enforces an item (suspected of containing malware) to isolate toa quarantine location that you specified while installing McAfee Security, so that the item cannotbe opened or executed.

The Quarantine screen displays the original location of items that are quarantined and theinstance when they were quarantined. You can use the arrows at the bottom of the console tonavigate through multiple Quarantine pages.

Launching McAfee Security ConsoleQuarantining malware


Restoring and deleting quarantined item

Select a path and click Restore to restore the item to its original location. Click Delete (orpress delete) to remove the quarantined item.

NOTE: You must have administrator rights to restore or delete a quarantined item.

Default activities in McAfee Security ConsoleOn launching the McAfee Security console, you can use the following default activities:

Update Now

Scan Now

Update NowThis option helps you manually run an Update to keep your Mac up-to-date with the latestanti-malware DAT and Engine.

1 Click Update Now on the left pane of the console. Alternatively, you can click Activity |Start Anti-malware Update from the McAfee Security menu bar.

2 Click Start Update to initiate the anti-malware update task.After the update process is complete, the details of the update process are displayed, whichincludes the latest DAT and Engine versions, status of the last update, and the DAT creationdate.

TIP: You can view the details of the Update task on the History screen.

Launching McAfee Security ConsoleDefault activities in McAfee Security Console


Scan NowThis option helps you scan specific files, folders, local or network mounted volumes, and otheritems on your Mac immediately.

1 Click Scan Now on the left pane of the console.

2 In the What to scan section, select the items from the drop-down menu.Click + to include more items to be scanned.

Alternatively, you can drag-and-drop files for scanning.

3 Click Start Scan. A progress bar appears indicating the items being scanned.After scanning completes, a summary of the scan task is displayed, which includes thenumber of items scanned and threats detected.

TIP: You can view the details of the scan task on the History screen.

Configuring scan tasksUse the following instructions in this section to create, modify, and delete scan tasks.

Tasks

Creating a new scan task

Modifying an existing scan task

Deleting a scan task

Creating a new scan taskUse this task to create and run regular scan operations as required.

1 Launch the McAfee Security Console.

NOTE: For instructions, see the Launching McAfee Security Console section.

2 Click + on the bottom left corner of the McAfee Security console. Alternatively, you canpress command + N or you can click Activity | New Activity on the McAfee Securitymenu bar.

3 Type a Scan Name, then click Create. The scan task name appears on the left pane.

4 In the What to scan section, select the items from the drop-down menu. Alternatively,you can drag-and-drop items for scanning.

5 In the When to scan section, select an appropriate schedule for the scan task.

NOTE: If you select to scan items immediately, click Start Scan.

6 Click Schedule Scan. A message appears stating that the scan task is scheduled.

7 Click OK.

Modifying an existing scan taskUse this task to modify an existing scan task.

1 Click on an existing scan task name on the left pane of the console.

Launching McAfee Security ConsoleConfiguring scan tasks


2 If the existing scan task is:

• Scheduled task — ClickModify Task , select the required items for scanning, re-schedulethe scan as required, then click Schedule Scan.

• Scheduled to run immediately — To run this task immediately, select the required itemsfor scanning, then click Start Scan.

• Scheduled to run immediately — To re-schedule this task, select the required items forscanning, then click Schedule Scan.

Deleting a scan taskUse this task to delete a scan task.

1 Click on an existing scan task name on the left pane of the console.

2 Perform one of the following steps:

• Click - on the left bottom corner of the console.

• Click Activity | Delete Activity from the McAfee Security menu bar.

• Press delete.

Launching McAfee Security ConsoleConfiguring scan tasks


Configuring McAfee Security PreferencesMcAfee Security preferences enable you to configure the anti-malware, application protection,desktop firewall, and update preferences.

Prerequisite: You must have administrator rights to configure McAfee Security preferences.


Contents

General Preferences

Configuring Anti-malware Preferences

Configuring Application Protection Preferences

Configuring Desktop Firewall Preferences

Enhanced Reports

Update Preferences

Default Preferences

Help option in the menu bar

General PreferencesGeneral preferences allow you to enable or disable the on-access scan, spyware scan, applicationprotection, and desktop firewall protection features.

1 Click the McAfee menulet on the status bar, then select McAfee Security Preferences.Alternatively, you can launch the McAfee Security Console, then perform one of the followinginstructions:

• Click McAfee Security on the menu bar, then select Preferences.

• Press Command+,The General screen appears.

NOTE: For instructions on launching the McAfee Security console, see the LaunchingMcAfee Security console section.

2 Click the lock to make changes. Type your administrator password when prompted, thenclick OK.

3 Click ON or OFF to enable or disable the following features:

• On-access Scan

• Spyware Scan

• Application Protection

• Desktop Firewall


Configuring Anti-malware PreferencesAnti-malware preferences enable you to configure the on-access scan and on-demand scanpreferences, and specify items to be excluded from scanning. You can even specify regularexpression based exclusions for on-access and on-demand scanning separately.

NOTE: Click Reset to reset the anti-malware preferences to their default values.

To configure the anti-malware preferences, perform the following instructions in this section.

Configuring On-access Scan Preferences

Configuring On-demand Scan Preferences

Specifying Anti-malware Exclusions

Configuring On-access Scan PreferencesUse this task to configure on-access scan preferences. On-access scan consistently monitorsall items for malware. On-access scanning takes place whenever an item is read from the disk,written to the disk (or both) based on the configured preferences.



• Press Command+,

2 Click Anti-malware.

NOTE: By default, the On-access Scan preferences screen is displayed.

3 To configure the on-access scan preferences, click the lock, type your administratorpassword, then click OK. The on-access scan preferences will have default settings.

Configuring McAfee Security PreferencesConfiguring Anti-malware Preferences


4 Use the following options to configure the on-access scan preferences:

• From the Scan files while drop-down menu, select one of the following options:

• Read — To scan items that are only being read from the hard disk.

• Write — To scan items when they are written to the hard disk.

• Read & Write — To scan items that are being read from or written to the harddisk.

• In Maximum scan time (in seconds), specify a time after which the scanning ofeach file terminates. The minimum and maximum values you can specify are 10 and999 seconds respectively. Default value is 45 seconds.

• From the When a virus is found or When a spyware is found drop-down menu,select one of the following options:

• Clean — To clean (repair) the virus/spyware. If you select this option, the If cleanfails drop-down menu appears, which provides you the options to quarantine ordelete the item (infected with virus/spyware) or notify you of the virus/spywaredetection, when the cleaning process fails.

• Quarantine — To quarantine the item containing virus/spyware. If you select thisoption, the If quarantine fails drop-down menu appears, which provides you theoptions to delete the item (infected with virus/spyware) or notify you of thevirus/spyware detection, when the quarantine process fails.

• Delete — To delete the item containing virus/spyware.

• Notify — To notify you in case of a virus/spyware detection (no other actions beingtaken).

• You can also enable scanning for:



• Archives & Compressed Files

• Apple Mail Messages

• Network Volumes

Configuring On-demand Scan PreferencesUse this task to configure on-demand scan preferences. You can schedule on-demand scansto run immediately, at a particular time, or at regular intervals.



• Press Command+,

2 Click Anti-malware.

3 Click On-demand Scan.

4 To configure the on-demand scan preferences, click the lock, type your administratorpassword, then click OK. The on-demand scan preferences will have default settings.

5 Use the following options to configure the on-demand scan preferences:

• From the When a virus is found or When a spyware is found drop-down menu,select one of the following options:

• Clean — To clean (repair) the virus/spyware. If you select this option, the If cleanfails drop-down menu appears, which provides you the options to quarantine or



delete the item (infected with virus/spyware) or notify you of the virus/spywaredetection, when the cleaning process fails.

• Quarantine — To quarantine the item containing virus/spyware. If you select thisoption, the If quarantine fails drop-down menu appears, which provides you theoptions to delete the item (infected with virus/spyware) or notify you of thevirus/spyware detection, when the quarantine process fails.

• Delete — To delete the item containing virus/spyware.

• Notify — To notify you in case of a virus/spyware detection (no other actions beingtaken).

• You can also enable or disable scanning for:

• Archives & Compressed Files

• Apple Mail Messages

Specifying Anti-malware ExclusionsUse this task to specify anti-malware exclusions. You can exclude specific items from beingscanned.



• Press Command+,

2 Click Anti-malware then click Exclusions.

3 Click the lock to make changes. Type your administrator password when prompted, thenclick OK.

4 Click + at the bottom left corner of the screen. The Set Exclusions screen appears allowingyou to select and add items to the exclusion list.

5 Select the required items, then click OK to return to the Exclusions screen.

6 Select or deselect the On-access Scan and/or On-demand Scan options as required.By default, both options are enabled so that the items are excluded from both the scans.

NOTE: To modify the path/item of an existing exclusion, double-click it in the correspondingcell. The path/item becomes editable. Specify the new path/item. You can also specifyregular expression based exclusions.

To delete an exclusion, select it, then click - at the bottom left corner of the screen (orpress delete).

Configuring Application Protection PreferencesApplication Protection preferences enable you configure rules to prevent the execution ofunwanted applications and/or deny network access to specific applications. You can excludespecific applications from these rules.

NOTE: Application Protection preferences support only Mach-O executable binaries and notscripts or Rosetta based applications.

Configuring McAfee Security PreferencesConfiguring Application Protection Preferences


To configure the application protection preferences, perform the following instructions in thissection.

Configuring Application Protection Rules

Specifying Application Protection Exclusions

Configuring Application Protection RulesUse this task to configure application protection preferences. Using McAfee Security, you canprevent specific applications from execution or from accessing the network connection.



• Press Command+,

2 Click Application Protection.

3 To configure the application protection preferences, click the lock, type your administratorpassword, then click OK. The application protection preferences will have default settings.

4 In Rules, use the following options to configure the application protection preferences:

• Select or deselect the Allow All Apple Signed Binaries as required.



• Select Allow, Deny, or Prompt from the Unknown/Modified Applicationsdrop-down menu for configuring the application execution and network access settingsfor all unknown and modified applications.

NOTE: If you select Prompt for <n> seconds (minimum and maximum value of 'n' being10 and 300 respectively) and try launching an unknown and modified application, theMcAfee Alert screen appears for <n> seconds prompting you to select an appropriate actionfor the application execution that must be applicable Always or Once. The available actionsare:

• Allow execution with full network access — To allow the application to executeand access the network.

• Allow executionwithout network access— To allow the application only to executeand deny network access to it.

• Deny execution — To prevent the application execution.

Creating an Application Protection Rule1 Click + at the bottom left corner of the console.

2 In Application Name, browse and add an application/binary.

3 In Action, select one of the following options as required:

• Allow Execution With Full Network Access

• Allow Execution Without Network Access

• Allow Execution With Restricted Network Access

• Deny Execution

4 If you select Allow Execution With Restricted Network Access, you can click + onthe bottom left corner of the Application Protection screen and specify a Protocol, IPAddress/Subnet, Port/Range, and the Direction of network that can be allowed ordenied (in Action).

NOTE: If you do not click + to add these options, network access for the selectedapplication/binary is denied.

5 Click OK to return to the Rules screen.

Modifying an existing Application Protection Rule (To restrict networkaccess)

1 For an existing rule, click on the cell below Action, select Allow Execution WithRestricted Network Access, then click + at the bottom left corner of the console.

2 In Application Protection screen, you can again select the required Action. However,you cannot re-select the Application Name.

3 Click + on the bottom left corner of the Application Protection screen and specify aProtocol, IP Address/Subnet, Port/Range, and the Direction of network that canbe allowed or denied (in Action).

4 Click OK to return to the Rules screen.

NOTE: To delete a rule, select it then click - (or press delete).



Specifying Application Protection ExclusionsUse this task to configure application protection exclusions. You can exclude path-basedapplications from the application protection rules. The Exclusions option overrides theapplication protection rules you create.



• Press Command+,

2 Click Application Protection.

3 To specify application protection exclusions, click the lock, type your administrator password,then click OK.

4 Click Exclusions.

5 Click + at the bottom left corner of the screen to add an exclusion.

6 From the list, add the path of the application(s) you want to exclude from the applicationprotection rule(s), then click Open.

NOTE: To delete an exclusion, press delete.

Configuring Desktop Firewall PreferencesDesktop Firewall preferences enable you to configure rules to prevent unauthorized access tonetworks/subnet/IP addresses. You can exclude trusted networks (in groups) from these rules.

To configure the desktop firewall preferences, perform the following instructions in this section.

Configuring Desktop Firewall Rules

Specifying Trusted Networks

Configuring Desktop Firewall RulesUse this task to configure desktop firewall preferences. Desktop Firewall monitors network trafficand allows or restricts access to specific networks or IP addresses.



• Press Command+,

2 Click Desktop Firewall.

3 To configure the desktop firewall preferences, click the lock, type your administratorpassword, then click OK. The desktop firewall preferences will have default settings.

The Rules screen opens with Allow all Connections as the default configuration.

4 Use the following options to configure the firewall preferences:

• Allow All Connections — Select this option to allow all network connections.

Configuring McAfee Security PreferencesConfiguring Desktop Firewall Preferences


• Deny — Select this option to deny incoming and/or outgoing network connection.

• Custom — Selecting this option enables you to add custom firewall rules.

5 If you select Custom in step 4, click + at the bottom left corner of the screen to add arule.

6 Type a rule name.

7 In General, select an Action, Protocol, Direction of the network connection, and anetwork Interface for the rule from the drop-down lists.

8 In IP address, Subnet or Network, select the source and destination IPaddress/subnet/network and the port/port range for which the access must be providedor denied.

9 Click OK.

NOTE: To configure advanced firewall settings, click Advanced, select or deselect thefollowing options, then click OK:

• Firewall logging

• Stealth mode

• Block unknown trafficBy default, all options are deselected.

Editing rules

Double-click the rule, then perform step 6 to 9. You can also click on the cell below Actionor Direction to change the settings directly on the Rules screen.

Prioritizing and deleting rules

You can also use:

• -: to delete an existing desktop firewall rule. Select a repository, click - on the bottomleft corner of the screen (or press delete).

• ^ v: to prioritize rules.



• Press Command+,

Specifying Trusted NetworksUse this task to exclude groups of trusted networks from the firewall rules.

NOTE: You can configure a minimum of 50 groups and 15 IP addresses per group.



• Press Command+,

2 Click Desktop Firewall.

Configuring McAfee Security PreferencesConfiguring Desktop Firewall Preferences


3 Click the lock to make changes. Type your administrator password when prompted, thenclick OK. By default, the Rules screen opens.

4 Click Trusted Networks. Two panes are displayed beside each other; one for specifyinggroups and the other for specifying IP/subnet address(es)/host name(s) in a group.

5 Click + in the Groups pane to specify a trusted group, then type a group name.

6 Select the group, then click + in the IP/Subnet Address/Host Name pane to add thetrusted IP/subnet addresses, or host names to be excluded from the firewall rules.

Enhanced ReportsMcAfee Security creates reports in enhanced McAfee Alert and McAfee Notification screens.

McAfee Alert

McAfee Security displays a McAfee Alert screen if an unknown or modified application tries toexecute when the application protection rule is set as Prompt. In this case, you are promptedto select an appropriate action that must be applicable Always or Once as shown in thefollowing figure.

Configuring McAfee Security PreferencesEnhanced Reports


If you select Always, a new rule is added for that application in the Rules screen of theApplication Protection Preferences.

McAfee Notification

McAfee Security notifies you of the following scenarios in an enhanced McAfee Notificationscreen:

• Malware detected during on-access scanning. (Click the caret to find the detection details).

• Prevention of application execution.

• Denial of network access to an application.

Update PreferencesMcAfee Security is configured to access the McAfee FTP server, HTTP server and/or a localrepository to download the latest DAT files. After installing McAfee Security, it automaticallyconnects to a FTP, HTTP and/or a local repository (that you have configured) to download andupdate your DAT files while you are connected to the Internet.

If your organization uses proxy servers to connect to the Internet for retrieving packages, youcan use the Proxy Settings tab.



• Press Command+,

2 Click Update.

Configuring McAfee Security PreferencesUpdate Preferences


3 To configure the update preferences, click the lock, type your administrator password, thenclick OK. The Update preferences will have default settings.

By default, the Repository List screen opens.

4 In Repository name, you can use:

• + : to add a new repository. Click + on the bottom left corner of the screen and typea name for the new repository.

• - : to delete an existing repository that you create. Select a repository, click - on thebottom left corner of the screen or press delete.

• ^ v : to prioritize repositories. You can even drag-and-drop the repositories to prioritizethem.

5 In Repository Type, select FTP, HTTP, or a Local repository from where the latest DATscan be downloaded.

6 Specify a Repository URL, Port, User Name, and Password for the repository.

7 Click Proxy Settings.

NOTE: Click Do not use a proxy if you do not want to use a proxy server for connectingto the Internet.

8 To use a proxy server, click Configure proxy settings manually.

9 To specify the same IP address and port number for all the proxy types, select the Usethese settings for all proxy types option.

10 Select FTP or HTTP server as required. Type the IP Address and Port number of theselected server.

11 To specify username and password for FTP, HTTP, or a local repository, select the Useauthentication option.

12 To bypass a proxy server for specific domain(s), select the Specify exceptions option,then type the proxy server name.

13 Click the Schedule tab and schedule the task as required.

14 Click Apply.

Default PreferencesDefault preferencesFeatures

On-access Scan:Anti-malware

• Scan on write — Enabled.

• Maximum scan time for a file — 45 seconds.

• When a virus/spyware is found,

• Primary action — Clean.

• If primary action fails — Quarantine.

• Scan archives and compressed files — Disabled.

• Scan Apple Mail messages — Disabled.

• Scan network volumes — Disabled.

On-demand Scan:

Configuring McAfee Security PreferencesDefault Preferences


Default preferencesFeatures

• Scan archives and compressed files — Enabled.

• Scan Apple Mail messages — Enabled.

Application protection • All Apple signed binaries — Allowed (Not applicable for Tiger).

• Execution and network access of Unknown/Modified applications — Allow.

Desktop firewall protection • Allow All Connections — Enabled.

• Trusted Networks:

• Group — McAfee Servers.

• IP/Subnet Address/Host Name — www.mcafee.com, www.vil.com.

Update • Repository — McAfeeHttp, McAfeeFtp.

• Proxy settings — Do no use a proxy.

NOTE: You must have administrator rights to configure/modify McAfee Security preferences.

Help option in the menu barAfter launching McAfee Security, you can use the following options by clicking Help on themenu bar:

McAfee Security Help

Selecting this option helps you access the help pages of McAfee Security that provides high-leveland detailed instructions on how to use the software.

RUN MERTool

MER tool helps you collect the diagnostic data of McAfee Security. Selecting this option promptsyou to type your administrator password. Once you type your password, a diagnostic report ofall logs McAfeeMERTool.zip is created and located in your home directory.

McAfee Support

Selecting this option opens the McAfee Enterprise Support webpage that provides informationon McAfee Technical Support.

McAfee KnowledgeBase

Selecting this option opens the McAfee Technical Support ServicePortal webpage where thecorporate knowledge base articles are published.

McAfee HotFixes / Patches

Selecting this option opens the McAfee Technical Support ServicePortal webpage from whereyou can download the product hotfixes and patches.

Submit A Malware Sample

Selecting this option opens the McAfee Avert(r) Labs WebImmune webpage where you cansubmit potentially infected files to WebImmune for analysis.

Configuring McAfee Security PreferencesHelp option in the menu bar


http://www.mcafee.com

http://www.vil.com

McAfee Virus Information Lab

Selecting this option opens the McAfee Avert Labs Threat Library webpage that has detailedinformation on the origin of viruses, Trojans, hoaxes, vulnerabilities and potentially unwantedprograms.

Configuring McAfee Security PreferencesHelp option in the menu bar


Index

Aanti-malware feature

testing 11application protection

exclusions 37preferences 34rules 35

application protection featuretesting 11

Ccheck-in Agent package

ePO 4.5 19check-in McAfee Security package

ePO 4.5 19command-line installation 10configure

scan task 28configure preferences

on-access scanner 31on-demand scanner 33

createon-demand scan task 28

create new policy 16create policies

ePO 4.5 21

Ddashboard 24default activity

scan now 28update now 27

deleteon-demand scan task 29

deploy McAfee SecurityePO 4.0 14using ePO 4.5 19

desktop firewallpreferences 37

desktop firewall featuretesting 12

detection reports 39

Eenforce policies

ePO 4.0 16ePO 4.0

check-in McAfee Agent package 14check-in McAfee Security package 14enforce policies 16install McAfee Agent on clients 15schedule scan 17schedule task 17

ePO 4.0 (continued)setting up policies 16uninstall mcafee security 17

ePO 4.5install McAfee Security 19schedule task 22setting policies 21uninstall mcafee security from client 23

ePO4.0remove extensions 18remove product from client 18

ePO4.5create policies 21policy enforcement 22

exclusionsapplication protection 37scanning 34

Ffiles

exclude from scanning 34firewall

rules 37

Ggeneral preferences 30

Hhelp option

menubar 42history

all product events 25History screen 25

Iinstall

extensions 15, 20install McAfee Agent

using ePO 4.0 15install McAfee Agent on client

using ePO 4.5 20install McAfee Security

ePO 4.0 14install McAfee Security on client

using ePO 4.5 21installation methods 9introduction

McAfee Security 6

Llaunch

Mcafee Security console 24


Mmalware

quarantine 26McAfee Alert 39McAfee Notification 39McAfee Security

how it works 6install on client computers 15installation 9integrating with ePO 4.0 14integrating with ePO 4.5 19introduction 6launch console 24methods of installing 9new features 7preferences 30prerequisites for installing 9types of protection 6uninstall 12

McAfee Security dashboard 24McAfee Security extensions

install 15, 20menubar option

help 42modify

on-demand scan task 28scan task 28

Nnew policy

create using ePO 16

Oon-access scanner

configure preferences 31on-demand scan

schedule using ePO 4.0 17on-demand scan task

create 28delete 29modify 28

on-demand scannerconfigure preferences 33

Ppolicies

ePO 4.0 16policy enforcement

ePO 4.5 22preferences 30, 31, 34, 37

anti-malware 31application protection 34desktop firewall 37

prerequisites 9product

new features 7product installation

test 11protection types 6

Qquarantine

malware 26

Rremove extension

ePO 4.0 18remove McAfee Security extensions

ePO 4.5 23reports

McAfee Alert 39McAfee Notification 39

rulesapplication protection 35firewall 37

Sscan now 27, 28scan task

modify 28scanner

exclusions 34schedule scan 28schedule tasks

using ePO 4.0 17using ePO 4.5 22

set policiesePO 4.5 21

silent installation 10specify trusted networks 38standard installation 10system requirements 9

Ttest

product installation 11testing

anti-malware feature 11application protection feature 11desktop firewall feature 12

trusted networksgroups 38

Uuninstall

McAfee Security 12mcafee security using ePO 4.0 17

uninstall mcafee securityfrom client 18

uninstall McAfee SecurityePO 4.5 23

uninstall mcafee security from clientePO 4.5 23

update now 27

Wwhat's new 7

Index



Index

mcafee security 1.0 user guide

Documents