Product guide

2 If the file meets the scanning criteria, it is scanned by comparing the information in the
file to the known malware signatures in the currently loaded DAT files.
• If the file is clean, the result is cached and read, write, or rename operation is granted.
• If the file contains a threat, the operation is denied and the configured action is taken.
For example:
• If the file needs to be cleaned, that cleaning process is determined by the currently
loaded DAT files.
• The results are recorded in the activity log, if the scanner was configured to do so.
• The On-Access Scan Messages alert appears describing the file name and the
action taken, if the scanner was configured to do so.
3 If the file does not meet the scanning requirements, it is not scanned. It is cached and the
operation is granted.
NOTE: The scan file cache is flushed and all files are rescanned whenever, for example,
the on-access scan configuration is changed, an EXTRA.DAT file is added, or when the
cache is full.
Scanning comparison: writing to disk vs. reading from disk
The on-access scanner performs scans differently, depending on whether the user is writing to
disk or reading from disk.
When files are being written to disk, the on-access scanner scans these items:
• Incoming files being written to the local hard drive.
• Files being created on the local hard drive or a mapped network drive (this includes new
files, modified files, or files being copied or moved from one drive to another).
NOTE: To scan mapped network drives, you must enable the On Network Drives option.
Refer to Enabling on-network drives .
These scans are only accessible by the same client where VirusScan Enterprise is installed.
It does not detect access to the mapped network drive by other systems.
When files are being read from disk, the on-access scanner scans these items:
• Outgoing files being read from the local hard drive or mapped network drives.
NOTE: To scan mapped network drives, select the On network drives option, described
in the previous bullets, to include remote network files.
• Any file attempting to execute a process on the local hard drive.
• Any file opened on the local hard drive.
• Any file being renamed on the local hard drive, if the file properties have changed.
Scanning comparison: scanning all files vs. scanning default +
additional file types
The on-access scanner scans files differently depending on whether it is configured to scan all
files, or to scan default files plus additional file types.
When scanning All files, the scanner examines every file type for all possible threats.
Part II - Detection: Finding Threats
Scanning items on-access
McAfee VirusScan Enterprise 8.8 Product Guide52