What changed in McAfee VirusScan 8.8 Local Client STIG V6R1V6R1 changes

McAfee VirusScan 8.8 Local Client STIG V6R1 (2022-01-27) replaced V5R16 (2018-07-27): 88 checks added, 87 removed. It has 88 checks, against 87 in V5R16.

V6R1 checklistV5R16 checklist Compare V5R16 and V6R1 in STIG Compare

  • 88 added
  • 87 removed
  • 0 updated

Added in V6R1 (88)

  • V-243355CAT IThe antivirus signature file age must not exceed 7 days.
  • V-243356CAT IMcAfee VirusScan On-Access Scanner General Settings must be configured to enable on-access scanning at system startup.
  • V-243357CAT IIMcAfee VirusScan On-Access Scanner General Settings must be configured to scan boot sectors.
  • V-243358CAT IIMcAfee VirusScan On-Access Scanner General Settings must be configured to scan floppy during shutdown.
  • V-243359CAT IIMcAfee VirusScan On-Access Scanner General Settings must be configured to notify local users when detections occur.
  • V-243360CAT IIMcAfee VirusScan On-Access Scanner General Settings must be configured to prevent users from removing messages from the list.
  • V-243361CAT IIMcAfee VirusScan On-Access Scanner General Settings must be configured to log the scan sessions.
  • V-243362CAT IIMcAfee VirusScan On-Access Scanner General Settings log file size must be restricted and be configured to at least 10MB.
  • V-243363CAT IIMcAfee VirusScan On-Access Scanner General Settings must be configured to log the session summary.
  • V-243364CAT IIMcAfee VirusScan On-Access Scanner General Settings must be configured to log any failure to scan encrypted files.
  • V-243365CAT IIMcAfee VirusScan must be configured to receive DAT and Engine updates.
  • V-243366CAT IIMcAfee VirusScan On Delivery Email Scanner Properties must be configured to enable on-delivery email scanning.
  • V-243367CAT IIMcAfee VirusScan On-Delivery Email Scanner must be configured to find unknown program threats and trojans.
  • V-243368CAT IIMcAfee VirusScan On Delivery Email Scanner Properties must be configured to find unknown macro threats.
  • V-243369CAT IIMcAfee VirusScan On Delivery Email Scanner Properties must be configured to decode MIME encoded files.
  • V-243370CAT IIMcAfee VirusScan On Delivery Email Scanner Properties must be configured to scan email message body.
  • V-243371CAT IIMcAfee VirusScan On Delivery Email Scanner Properties, When a threat is found, must be configured to clean attachments as the first action.
  • V-243372CAT IIMcAfee VirusScan On Delivery Email Scanner Properties must be configured to record scanning activity in a log file.
  • V-243373CAT IIMcAfee VirusScan On-Delivery Email Scanner log file size must be restricted and be configured to be at least 10MB.
  • V-243374CAT IIMcAfee VirusScan On Delivery Email Scanner Properties must be configured to clean attachments as the first action for When an unwanted program is found.
  • V-243375CAT IIMcAfee VirusScan On-Demand scan must be configured to scan all fixed, or local, disks and running processes.
  • V-243376CAT IIMcAfee VirusScan On-Demand scan must be configured to scan all subfolders.
  • V-243377CAT IIMcAfee VirusScan On-Demand scan must be configured to scan boot sectors.
  • V-243378CAT IIMcAfee VirusScan On-Demand scan must be configured to scan all files.
  • V-243379CAT IIMcAfee VirusScan On-Demand scan must be configured so there are no exclusions from the scan unless exclusions have been documented with, and approved by, the ISSO/ISSM/DAA.
  • V-243380CAT IIMcAfee VirusScan On-Demand scan must be configured to scan inside archives.
  • V-243381CAT IIMcAfee VirusScan On-Demand scan must be configured to decode MIME encoded files.
  • V-243382CAT IIMcAfee VirusScan On-Demand scan must be configured to find unknown program threats.
  • V-243383CAT IIMcAfee VirusScan On-Demand scan must be configured to find unknown macro threats.
  • V-243384CAT IIMcAfee VirusScan On-Demand scan actions, When a threat is found must be configured to clean files automatically as first action.
  • V-243385CAT IIMcAfee VirusScan On-Demand scan actions, When a threat is found must be configured to delete files automatically if first action fails.
  • V-243386CAT IIMcAfee VirusScan On-Demand scan must be configured to detect for unwanted programs.
  • V-243387CAT IIMcAfee VirusScan On-Demand scan must be configured to record scanning activity in a log file.
  • V-243388CAT IIMcAfee VirusScan On-Demand scan log file size must be restricted, but be configured to at least 10MB.
  • V-243389CAT IIMcAfee VirusScan On-Demand scan must be configured to log any failure to scan encrypted files.
  • V-243390CAT IIMcAfee VirusScan On-Demand scan must be scheduled to be executed at least on a weekly basis.
  • V-243391CAT IIMcAfee VirusScan On-Access Scanner General Settings must be configured to enable scanning of scripts.
  • V-243392CAT IIMcAfee VirusScan On-Access Scanner General Settings must be configured to block the connection when a threatened file is detected in a shared folder.
  • V-243393CAT IIMcAfee VirusScan On-Access Scanner General Settings must be configured to unblock connections after a minimum of 30 minutes.
  • V-243394CAT IIMcAfee VirusScan On-Access Scanner General Settings must be configured to block the connection when a file with a potentially unwanted program is detected in a shared folder.
  • V-243395CAT IIMcAfee VirusScan On-Access Scanner All Processes settings must be configured to use only one scanning policy for all processes, unless the use of Low-Risk Processes/High-Risk Processes has been documented with, and approved by, the IAO/IAM.
  • V-243396CAT IIMcAfee VirusScan On-Access Scanner All Processes settings must be configured to scan when writing to disk.
  • V-243397CAT IIMcAfee VirusScan On-Access Scanner All Processes settings must be configured to scan when reading from disk.
  • V-243398CAT IIMcAfee VirusScan On-Access Scanner All Processes settings must be configured to scan all files.
  • V-243399CAT IIMcAfee VirusScan On-Access Scanner All Processes settings must be configured to find unknown unwanted programs and trojans.
  • V-243400CAT IIMcAfee VirusScan On-Access Scanner All Processes settings must be configured to find unknown macro viruses.
  • V-243401CAT IIMcAfee VirusScan On-Access Scanner All Processes settings must be configured to scan inside archive files.
  • V-243402CAT IIMcAfee VirusScan On-Access Scanner All Processes settings actions, When a threat is found must be configured to clean files automatically as first action.
  • V-243403CAT IIMcAfee VirusScan On-Access Scanner All Processes settings actions, When a threat is found must be configured to delete files automatically if first action fails.
  • V-243404CAT IIMcAfee VirusScan Buffer Overflow Protection Buffer Overflow Settings must be configured to enable Buffer Overflow Protection.
  • V-243405CAT IIMcAfee VirusScan Buffer Overflow Protection Buffer Overflow Settings must be configured for Protection mode.
  • V-243406CAT IIMcAfee VirusScan Buffer Overflow Protection Buffer Overflow Settings must be configured to display a dialog box when a buffer overflow is detected.
  • V-243407CAT IIMcAfee VirusScan Buffer Overflow Protection Reports Settings must be configured to log buffer overflow protection scan activity.
  • V-243408CAT IIMcAfee VirusScan Buffer Overflow Protection Reports Settings log file size must be restricted, but be configured to at least 10MB.
  • V-243409CAT IIMcAfee VirusScan Unwanted Programs Policy must be configured to detect spyware.
  • V-243410CAT IIMcAfee VirusScan Unwanted Programs Policy must be configured to detect adware.
  • V-243411CAT IIMcAfee VirusScan On-Access Scanner General Settings Artemis Heuristic network check for suspicious files must be enabled and set to sensitivity level Medium or higher.
  • V-243412CAT IMcAfee VirusScan Access Protection Rules must be configured to prevent McAfee services from being stopped.
  • V-243413CAT IIMcAfee VirusScan Access Protection Reports settings must be configured to record scanning activity in a log file.
  • V-243414CAT IIMcAfee VirusScan Access Protection Reports log file size must be restricted and be configured to at least 10MB.
  • V-243415CAT IIMcAfee VirusScan Access Protection Rules Common Standard Protection must be set to prevent modification of McAfee files and settings.
  • V-243416CAT IIMcAfee VirusScan Access Protection Rules Common Standard Protection must be set to prevent modification of McAfee Common Management Agent files and settings.
  • V-243417CAT IIMcAfee VirusScan Access Protection Rules Common Standard Protection must be set to prevent modification of McAfee Scan Engine files and settings.
  • V-243418CAT IIMcAfee VirusScan Access Protection Rules Common Standard Protection must be set to prevent termination of McAfee processes.
  • V-243419CAT IIMcAfee VirusScan Access Protection Rules Common Standard Protection must be set to block and report when common programs are run from the Temp folder.
  • V-243420CAT IIMcAfee VirusScan Access Protection Rules Common Standard Protection must be set to prevent hooking of McAfee processes.
  • V-243421CAT IIMcAfee VirusScan Access Protection Rules Common Maximum Protection must be set to detect and log the launching of files from the Downloaded Programs Files folder.
  • V-243422CAT IIMcAfee VirusScan Access Protection Rules Anti-Spyware Maximum Protection must be set to block and log execution of scripts from the Temp folder.
  • V-243423CAT IIMcAfee VirusScan Access Protection Rules Anti-Virus Standard Protection must be set to prevent remote creation of autorun files.
  • V-243424CAT IIMcAfee VirusScan Access Protection Rules Anti-Virus Standard Protection must be set to prevent mass mailing worms from sending mail.
  • V-243425CAT IIMcAfee VirusScan Access Protection Rules Anti-Virus Standard Protection must be set to prevent IRC communication.
  • V-243426CAT IIMcAfee VirusScan On-Access Scanner General Settings must be configured to not exclude any script processes from being scanned unless the process exclusions have been documented with, and approved by, the ISSO/ISSM/DAA.
  • V-243427CAT IIMcAfee VirusScan On-Access Scanner All Processes settings must be configured to not exclude any files from being scanned unless exclusions have been documented with, but also be approved by the ISSO/ISSM/AO.
  • V-243428CAT IIMcAfee VirusScan On-Demand scan must be configured to scan memory for rootkits.
  • V-243429CAT IIMcAfee VirusScan On-Demand scan actions, When an unwanted program is found must be configured to clean files automatically as first action.
  • V-243430CAT IIMcAfee VirusScan On-Delivery Email Scanner Artemis sensitivity level must be configured to Medium or higher.
  • V-243431CAT IIMcAfee VirusScan On-Delivery Email Scanner must be configured to send a notification email to the IAO, IAM and/or ePO administrator when a threatening email message is detected.
  • V-243432CAT IIMcAfee VirusScan On-Delivery Email Scanner must be configured to log session summary and failure to scan encrypted files.
  • V-243433CAT IIMcAfee VirusScan On-Access Scanner All Processes settings must be configured to not exclude any script URLs from being scanned unless the URL exclusions have been documented with, and approved by the ISSO/ISSM/DAA.
  • V-243434CAT IIMcAfee VirusScan Access Protection Properties must be configured to enable access protection.
  • V-243435CAT IIMcAfee VirusScan On Delivery Email Scanner Properties, when a threat is found, must be configured to delete attachments if the first action fails.
  • V-243436CAT IIMcAfee VirusScan On Delivery Email Scanner Properties must be configured to delete attachments if the first action fails for when an unwanted attachment is found.
  • V-243437CAT IIMcAfee VirusScan On-Demand scan actions, When an unwanted program is found must be configured to delete files automatically if first action fails.
  • V-243438CAT IIMcAfee VirusScan On-Access Scanner All Processes settings must be configured to detect unwanted programs.
  • V-243439CAT IIMcAfee VirusScan On-Access Scanner All Processes settings actions, When an unwanted program is found must be configured to clean files automatically as first action.
  • V-243440CAT IIMcAfee VirusScan On-Access Scanner All Processes settings actions, When an unwanted program is found must be configured to delete files automatically if first action fails.
  • V-243441CAT IIMcAfee VirusScan Access Protection Rules Anti-spyware Maximum Protection must be set to block and report when block execution of all programs from temp folder.
  • V-251879CAT I(U) McAfee VirusScan must have the current security patches installed.

Removed since V5R16 (87)

  • V-6453CAT IMcAfee VirusScan On-Access Scanner General Settings must be configured to enable on-access scanning at system startup.
  • V-6467CAT IIMcAfee VirusScan On-Access Scanner General Settings must be configured to scan boot sectors.
  • V-6468CAT IIMcAfee VirusScan On-Access Scanner General Settings must be configured to scan floppy during shutdown.
  • V-6469CAT IIMcAfee VirusScan On-Access Scanner General Settings must be configured to notify local users when detections occur.
  • V-6470CAT IIMcAfee VirusScan On-Access Scanner General Settings must be configured to prevent users from removing messages from the list.
  • V-6474CAT IIMcAfee VirusScan On-Access Scanner General Settings must be configured to log the scan sessions.
  • V-6475CAT IIMcAfee VirusScan On-Access Scanner General Settings log file size must be restricted and be configured to at least 10MB.
  • V-6478CAT IIMcAfee VirusScan On-Access Scanner General Settings must be configured to log the session summary.
  • V-6583CAT IIMcAfee VirusScan On-Access Scanner General Settings must be configured to log any failure to scan encrypted files.
  • V-6585CAT IIMcAfee VirusScan must be configured to receive DAT and Engine updates.
  • V-6586CAT IIMcAfee VirusScan On Delivery Email Scanner Properties must be configured to enable on-delivery email scanning.
  • V-6587CAT IIMcAfee VirusScan On-Delivery Email Scanner must be configured to find unknown program threats and trojans.
  • V-6588CAT IIMcAfee VirusScan On Delivery Email Scanner Properties must be configured to find unknown macro threats.
  • V-6590CAT IIMcAfee VirusScan On Delivery Email Scanner Properties must be configured to decode MIME encoded files.
  • V-6591CAT IIMcAfee VirusScan On Delivery Email Scanner Properties must be configured to scan email message body.
  • V-6592CAT IIMcAfee VirusScan On Delivery Email Scanner Properties, When a threat is found, must be configured to clean attachments as the first action.
  • V-6596CAT IIMcAfee VirusScan On Delivery Email Scanner Properties must be configured to record scanning activity in a log file.
  • V-6597CAT IIMcAfee VirusScan On-Delivery Email Scanner log file size must be restricted and be configured to be at least 10MB.
  • V-6599CAT IIMcAfee VirusScan On-Demand scan must be configured to scan all fixed, or local, disks and running processes.
  • V-6600CAT IIMcAfee VirusScan On-Demand scan must be configured to scan all subfolders.
  • V-6601CAT IIMcAfee VirusScan On-Demand scan must be configured to scan boot sectors.
  • V-6602CAT IIMcAfee VirusScan On-Demand scan must be configured to scan all files.
  • V-6604CAT IIMcAfee VirusScan On-Demand scan must be configured so there are no exclusions from the scan unless exclusions have been documented with, and approved by, the ISSO/ISSM/DAA.
  • V-6611CAT IIMcAfee VirusScan On-Demand scan must be configured to scan inside archives.
  • V-6612CAT IIMcAfee VirusScan On-Demand scan must be configured to decode MIME encoded files.
  • V-6614CAT IIMcAfee VirusScan On-Demand scan must be configured to find unknown program threats.
  • V-6615CAT IIMcAfee VirusScan On-Demand scan must be configured to find unknown macro threats.
  • V-6616CAT IIMcAfee VirusScan On-Demand scan actions, When a threat is found must be configured to clean files automatically as first action.
  • V-6617CAT IIMcAfee VirusScan On-Demand scan actions, When a threat is found must be configured to delete files automatically if first action fails.
  • V-6618CAT IIMcAfee VirusScan On-Demand scan must be configured to record scanning activity in a log file.
  • V-6620CAT IIMcAfee VirusScan On-Demand scan log file size must be restricted, but be configured to at least 10MB.
  • V-6625CAT IIMcAfee VirusScan On-Demand scan must be configured to log any failure to scan encrypted files.
  • V-6627CAT IIMcAfee VirusScan On-Demand scan must be scheduled to be executed at least on a weekly basis.
  • V-14618CAT IIMcAfee VirusScan On-Access Scanner General Settings must be configured to enable scanning of scripts.
  • V-14619CAT IIMcAfee VirusScan On-Access Scanner General Settings must be configured to block the connection when a threatened file is detected in a shared folder.
  • V-14620CAT IIMcAfee VirusScan On-Access Scanner General Settings must be configured to unblock connections after a minimum of 30 minutes.
  • V-14621CAT IIMcAfee VirusScan On-Access Scanner General Settings must be configured to block the connection when a file with a potentially unwanted program is detected in a shared folder.
  • V-14622CAT IIMcAfee VirusScan On-Access Scanner All Processes settings must be configured to use only one scanning policy for all processes, unless the use of Low-Risk Processes/High-Risk Processes has been documented with, and approved by, the IAO/IAM.
  • V-14623CAT IIMcAfee VirusScan On-Access Scanner All Processes settings must be configured to scan when writing to disk.
  • V-14624CAT IIMcAfee VirusScan On-Access Scanner All Processes settings must be configured to scan when reading from disk.
  • V-14625CAT IIMcAfee VirusScan On-Access Scanner All Processes settings must be configured to scan all files.
  • V-14626CAT IIMcAfee VirusScan On-Access Scanner All Processes settings must be configured to find unknown unwanted programs and trojans.
  • V-14627CAT IIMcAfee VirusScan On-Access Scanner All Processes settings must be configured to find unknown macro viruses.
  • V-14628CAT IIMcAfee VirusScan On-Access Scanner All Processes settings must be configured to scan inside archive files.
  • V-14630CAT IIMcAfee VirusScan On-Access Scanner All Processes settings actions, When a threat is found must be configured to clean files automatically as first action.
  • V-14631CAT IIMcAfee VirusScan On-Access Scanner All Processes settings actions, When a threat is found must be configured to delete files automatically if first action fails.
  • V-14652CAT IIMcAfee VirusScan On Delivery Email Scanner Properties must be configured to clean attachments as the first action for When an unwanted program is found.
  • V-14654CAT IIMcAfee VirusScan On-Demand scan must be configured to detect for unwanted programs.
  • V-14657CAT IIMcAfee VirusScan Buffer Overflow Protection Buffer Overflow Settings must be configured to enable Buffer Overflow Protection.
  • V-14658CAT IIMcAfee VirusScan Buffer Overflow Protection Buffer Overflow Settings must be configured for Protection mode.
  • V-14659CAT IIMcAfee VirusScan Buffer Overflow Protection Buffer Overflow Settings must be configured to display a dialog box when a buffer overflow is detected.
  • V-14660CAT IIMcAfee VirusScan Buffer Overflow Protection Reports Settings must be configured to log buffer overflow protection scan activity.
  • V-14661CAT IIMcAfee VirusScan Buffer Overflow Protection Reports Settings log file size must be restricted, but be configured to at least 10MB.
  • V-14662CAT IIMcAfee VirusScan Unwanted Programs Policy must be configured to detect spyware.
  • V-14663CAT IIMcAfee VirusScan Unwanted Programs Policy must be configured to detect adware.
  • V-19910CAT IThe antivirus signature file age must not exceed 7 days.
  • V-35027CAT IIMcAfee VirusScan On-Access Scanner General Settings Artemis Heuristic network check for suspicious files must be enabled and set to sensitivity level Medium or higher.
  • V-42514CAT IIMcAfee VirusScan On Delivery Email Scanner Properties, when a threat is found, must be configured to delete attachments if the first action fails.
  • V-42515CAT IIMcAfee VirusScan On Delivery Email Scanner Properties must be configured to delete attachments if the first action fails for when an unwanted attachment is found.
  • V-42549CAT IMcAfee VirusScan Access Protection Rules must be configured to prevent McAfee services from being stopped.
  • V-42550CAT IIMcAfee VirusScan Access Protection Reports settings must be configured to record scanning activity in a log file.
  • V-42551CAT IIMcAfee VirusScan Access Protection Reports log file size must be restricted and be configured to at least 10MB.
  • V-42552CAT IIMcAfee VirusScan Access Protection Rules Common Standard Protection must be set to prevent modification of McAfee files and settings.
  • V-42553CAT IIMcAfee VirusScan Access Protection Rules Common Standard Protection must be set to prevent modification of McAfee Common Management Agent files and settings.
  • V-42554CAT IIMcAfee VirusScan Access Protection Rules Common Standard Protection must be set to prevent modification of McAfee Scan Engine files and settings.
  • V-42555CAT IIMcAfee VirusScan Access Protection Rules Common Standard Protection must be set to prevent termination of McAfee processes.
  • V-42556CAT IIMcAfee VirusScan Access Protection Rules Common Standard Protection must be set to block and report when common programs are run from the Temp folder.
  • V-42557CAT IIMcAfee VirusScan Access Protection Rules Common Standard Protection must be set to prevent hooking of McAfee processes.
  • V-42558CAT IIMcAfee VirusScan Access Protection Rules Common Maximum Protection must be set to detect and log the launching of files from the Downloaded Programs Files folder.
  • V-42559CAT IIMcAfee VirusScan Access Protection Rules Anti-Spyware Maximum Protection must be set to block and log execution of scripts from the Temp folder.
  • V-42560CAT IIMcAfee VirusScan Access Protection Rules Anti-Virus Standard Protection must be set to prevent remote creation of autorun files.
  • V-42561CAT IIMcAfee VirusScan Access Protection Rules Anti-Virus Standard Protection must be set to prevent mass mailing worms from sending mail.
  • V-42562CAT IIMcAfee VirusScan Access Protection Rules Anti-Virus Standard Protection must be set to prevent IRC communication.
  • V-42563CAT IIMcAfee VirusScan On-Access Scanner General Settings must be configured to not exclude any script processes from being scanned unless the process exclusions have been documented with, and approved by, the ISSO/ISSM/DAA.
  • V-42564CAT IIMcAfee VirusScan On-Access Scanner All Processes settings must be configured to not exclude any files from being scanned unless exclusions have been documented with, but also be approved by the ISSO/ISSM/AO.
  • V-42565CAT IIMcAfee VirusScan On-Demand scan must be configured to scan memory for rootkits.
  • V-42566CAT IIMcAfee VirusScan On-Demand scan actions, When an unwanted program is found must be configured to clean files automatically as first action.
  • V-42567CAT IIMcAfee VirusScan On-Demand scan actions, When an unwanted program is found must be configured to delete files automatically if first action fails.
  • V-42569CAT IIMcAfee VirusScan On-Delivery Email Scanner Artemis sensitivity level must be configured to Medium or higher.
  • V-42570CAT IIMcAfee VirusScan On-Delivery Email Scanner must be configured to send a notification email to the IAO, IAM and/or ePO administrator when a threatening email message is detected.
  • V-42571CAT IIMcAfee VirusScan On-Delivery Email Scanner must be configured to log session summary and failure to scan encrypted files.
  • V-42572CAT IIMcAfee VirusScan On-Access Scanner All Processes settings must be configured to not exclude any script URLs from being scanned unless the URL exclusions have been documented with, and approved by the ISSO/ISSM/DAA.
  • V-42573CAT IIMcAfee VirusScan Access Protection Properties must be configured to enable access protection.
  • V-42574CAT IIMcAfee VirusScan On-Access Scanner All Processes settings must be configured to detect unwanted programs.
  • V-42575CAT IIMcAfee VirusScan On-Access Scanner All Processes settings actions, When an unwanted program is found must be configured to clean files automatically as first action.
  • V-42576CAT IIMcAfee VirusScan On-Access Scanner All Processes settings actions, When an unwanted program is found must be configured to delete files automatically if first action fails.
  • V-59365CAT IIMcAfee VirusScan Access Protection Rules Anti-spyware Maximum Protection must be set to block and report when block execution of all programs from temp folder.

How these changes are found

Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V6R1 no longer has.

Comparing other releases, or this one against an older release? Pick any two in STIG Compare.