Cisco Cisco Web Security Appliance S690 User Guide

460

I R O N P O R T A S Y N C O S 6 . 3 F O R W E B U S E R G U I D E

M A L W A R E S C A N N I N G VE R D I C T VA L U E S

A malware scanning verdict is a value assigned to a URL request or server response that
determines the probability that it contains malware. The scanning engines return the malware
scanning verdict to the DVS engine so the DVS engine can determine whether to monitor or
block the scanned object.

They are the result of proprietary calculations that associate a numerical value to the
probability that either the URL request or the response content contains malware. Each
malware scanning verdict corresponds to a malware category listed on the “Access Policies:
Reputation and Anti-Malware Settings” page when you edit the Web Reputation and Anti-
Malware Filtering for a particular Access Policy.

Both the Webroot and McAfee scanning engines can return malware scanning verdicts to the
DVS engine. For more information about how the DVS engine handles malware scanning
verdicts, see “IronPort DVS™ (Dynamic Vectoring and Streaming) Engine” on page 322.

Table 20-13 lists the different malware scanning verdict values and each malware category
with which they correspond.

Table 20-13 Malware Scanning Verdict Values

Malware Category

Malware Scanning Verdict Value

Unscannable

Other Malware

Browser Helper Object

Adware

System Monitor

Commercial System Monitor

Dialer

Hijacker

Phishing URL

Trojan Downloader

Trojan Horse

Trojan Phisher

Worm

Encrypted File