Cisco Cisco Web Security Appliance S670 User Guide

Virus

Trojan Downloader

Trojan Horse

Trojan Phisher

Hijacker

System monitor

Commercial System Monitor

Dialer

Worm

Browser Helper Object

Phishing URL

Adware

Encrypted file

Unscannable

Other Malware

Suppose the McAfee scanning engine detects both adware and a virus in the 
scanned object, and that the appliance is configured to block adware and monitor 
viruses. According to the list above, viruses belong in a higher priority verdict 
category than adware. Therefore, the appliance monitors the object and reports the 
verdict as virus in the reports and logs. It does not block the object even though it 
is configured to block adware.

The Webroot scanning engine inspects objects to determine the malware scanning 
verdict to send to the DVS engine. The Webroot scanning engine inspects the 
following objects:

URL request. Webroot evaluates a URL request to determine if the URL is a 
malware suspect. If Webroot suspects the response from this URL might 
contain malware, the appliance monitors or blocks the request, depending on 
how the appliance is configured. If Webroot evaluation clears the request, the 
appliance retrieves the URL and scans the server response.