McAfee VirusScan On-Demand scan must be configured to scan boot sectors.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-6601	DTAM047	SV-55193r1_rule		Medium

Description
Boot sector viruses will install into the boot sector of a system, ensuring that they will execute when the user boots the system. This risk is mitigated by scanning boot sectors at each startup of the system.

STIG	Date
McAfee VirusScan 8.8 Managed Client STIG	2017-04-05

Details

Check Text ( C-48796r3_chk )
From the ePO server console System Tree, select the Systems tab, select the asset to be checked, select Actions, select Agent, and select Modify Tasks on a Single System. From the list of available tasks in the Task Name column, with the assistance of the ePO SA, identify the weekly on demand client scan task. In the same row as the client scan task under review, under the Task Type column, ensure it is an "On Demand scan" and in the Status column, ensure that the status is "Enabled". In the Actions column, select "Edit Assignment". In the Task to Schedule: area, verify the Product is "VirusScan Enterprise 8.8.0" and the Task Type is "On Demand Scan". In the Task name column, select "View Selected Task". Under the Scan Locations tab, locate the "Scan options:" label. Ensure the "Scan boot sectors" option is selected. Criteria: If "Scan boot sectors" is selected, this is not a finding. On the client machine, use the Windows Explorer to navigate to the following folder: %SystemDrive%\Documents and Settings\All Users\Application Data\McAfee\Common Framework\Task (32-Bit) %SystemDrive%\ProgramData\McAfee\Common Framework\Task (64-Bit) Multiple .ini files will be stored in this folder, one for each task defined on the ePO server for this client. The name for each task is identified in the first section of the file under the [Task] section on the TaskName= "" line. Additionally, a TaskType= line is provided to describe the type of scan. In this case, TaskType=VSC700_Scan_Task is expected. Information for this check is determined by examining the contents of this file. Criteria: If [Where] bSkipBootScan=0, this is not a finding.

Check Text ( C-48796r3_chk )

From the ePO server console System Tree, select the Systems tab, select the asset to be checked, select Actions, select Agent, and select Modify Tasks on a Single System. From the list of available tasks in the Task Name column, with the assistance of the ePO SA, identify the weekly on demand client scan task. In the same row as the client scan task under review, under the Task Type column, ensure it is an "On Demand scan" and in the Status column, ensure that the status is "Enabled". In the Actions column, select "Edit Assignment". In the Task to Schedule: area, verify the Product is "VirusScan Enterprise 8.8.0" and the Task Type is "On Demand Scan". In the Task name column, select "View Selected Task". Under the Scan Locations tab, locate the "Scan options:" label. Ensure the "Scan boot sectors" option is selected.

Criteria: If "Scan boot sectors" is selected, this is not a finding.

On the client machine, use the Windows Explorer to navigate to the following folder:
%SystemDrive%\Documents and Settings\All Users\Application Data\McAfee\Common Framework\Task (32-Bit)
%SystemDrive%\ProgramData\McAfee\Common Framework\Task (64-Bit)
Multiple .ini files will be stored in this folder, one for each task defined on the ePO server for this client. The name for each task is identified in the first section of the file under the [Task] section on the TaskName= "" line. Additionally, a TaskType= line is provided to describe the type of scan. In this case, TaskType=VSC700_Scan_Task is expected. Information for this check is determined by examining the contents of this file.

Criteria: If [Where] bSkipBootScan=0, this is not a finding.

Fix Text (F-48047r2_fix)
From the ePO server console System Tree, select the Systems tab, select the asset to be checked, select Actions, select Agent, and select Modify Tasks on a Single System. From the list of available tasks in the Task Name column, with the assistance of the ePO SA, identify the weekly on demand client scan task. In the same row as the client scan task under review, under the Task Type column, ensure it is an "On Demand scan" and in the Status column, ensure that the status is "Enabled". In the Task Name column, select the weekly on demand task. Under the Scan Locations tab, locate the "Scan options:" label. Select the "Scan boot sectors" option. Select Save.

Fix Text (F-48047r2_fix)