How to create a user-defined Access Protection Rule for port blocking
 

VSE 8.x console

1. Click Start, Programs, McAfee, VirusScan Console.
2. Double-click Access Protection.
3. Under Categories, select User-Defined Rules, then New.
4. Select Port Blocking Rule and click OK.
5. In the network port access protection rule field, change the following:
   1. Rule Name. Provide a name for the Rule (Example: Block Port 1234)
   2. Process to Include. You can specify a specific process if needed. Example: example123.exe. If you want to apply this rule to all processes, use a wild card (*). A wild card is needed because a full path name does not work.
   3. Process to Exclude. Leave it blank, or if you require it, specify a specific process to exclude as well.
   4. Ports to block. Type either the port or the port range that you want to block. For example, to block port 65 only, type port 65 for the range.
   5. Direction. If you want this rule to apply for both inbound/outbound, select both options.
6. Click OK. The rule gets saved. 
7. Click Apply. The rule gets saved on the local system.
   After you have saved your rule, select Block and Report or Report, as required.
8. Click Apply, then OK.

Back to Contents
 

ePO 5.x console

NOTE: Before you edit an Access Protection rule in a VSE policy, ensure that VSE is also installed on the ePO server. Some VSE policies are dynamically displayed using information found in the local VSE installation (for example, path information). If VSE is not installed, you might see policies refer to process names with a (\:::) prefix, which corrupts the policy if you modify and apply the change. For details about this issue, see KB81980.

1. Log on to the ePO console.
2. Click Menu, Policy Catalog.
3. From the Product drop-down list, select VirusScan Enterprise 8.8 or VirusScan Enterprise 8.7.
4. From the Category drop-down list, select Access Protection Policies.
5. Click the policy where you want to add the new user-defined Access Protection Rule.
6. At the top, select either Workstation or Server from the drop-down list.
7. Under Categories, select User-Defined Rules, then click New.
8. Select Port Blocking Rule and click OK.
9. In the network port access protection rule field, edit the following sections:
   1. Rule Name. Provide a name for the Rule (Example: Block Port 1234)
   2. Process to Include. You can specify a specific process if needed. Example: example123.exe. If you want to apply this rule to all processes, use a wild card (*). A wild card is needed because a full path name does not work.
   3. Process to Exclude. Leave it blank, or if you require it, specify a specific process to exclude as well.
   4. Ports to block. Type either the port or the port range that you want to block. For example, to block port 65 only, type port 65 for the range.
   5. Direction. If you want this rule to apply for both inbound/outbound, select both options.
10. Click OK. The user-defined rule gets saved.
11. Click Apply. The rule gets saved.
    After you have saved the rule, select Block and Report or Report, as required.
12. Click Apply, then OK.

Back to Contents

How to create a user-defined Access Protection rule for file/folder blocking 
 

VSE 8.x console

1. Click Start, Programs, McAfee, VirusScan Console.
2. Double-click Access Protection.
3. Under Categories, click User-Defined Rules, then New.
4. Select File/Folder Blocking Rule, then click OK.
5. In the File/Folder Blocking rule field, changes the following:
   1. Rule name. Type the name of your rule.
   2. Processes to include. Type an asterisk (*) unless you want to prevent only specific processes. An asterisk (*) specifies all processes.
   3. Processes to exclude. Type the process to exclude. Separate each process with a comma and a space.
   4. File or Folder name to block. Type or browse to the file name or path name you want to protect. For more information about using wildcards, see KB54812.
   5. At the bottom, select the actions that you want to prevent.
6. Click OK.
   After you have saved your rule, select Block and Report or Report, as required 
7. Click Apply, then OK.

ePO 5.x console

NOTE: Before editing Access Protection rules for VirusScan Enterprise policies, make sure that VirusScan Enterprise is installed on the ePO server. Some VirusScan policies are dynamically displayed using information found in the local VirusScan installation, for example, path information. If VirusScan is not installed, you might see policies refer to process names with a "\:::" prefix, which corrupts the policy if you modify and apply the change.
 

1. Log on to the ePO console.
2. Click Menu, Policy Catalog.
3. From the Product drop-down list, select either VirusScan Enterprise 8.8 or VirusScan Enterprise 8.7.
4. From the Category drop-down list, select Access Protection Policies.
5. Click the policy where you want to add the new user-defined Access Protection Rule.
6. From the drop-down list at the top of the page, select either Workstation or Server.
7. Under Categories, click User-Defined Rules, then New.
8. Select File/Folder Blocking Rule, then click OK.
9. In the File/Folder Blocking rule field, changes the following:
   1. Rule name. Type the name of your rule.
   2. Processes to include. Type an asterisk (*) unless you want to prevent only specific processes. An asterisk (*) specifies all processes.
   3. Processes to exclude. Type the process to exclude. Separate each process with a comma and a space.
   4. File or Folder name to block. Type or browse to the file name or path name you want to protect. For more information about using wildcards, see KB54812.
   5. At the bottom, select the actions that you want to prevent.
10. Click OK.
    After you have saved your rule, select Block and Report or Report, as needed 
11. Click Apply, then OK.

Back to Contents

How to create a user-defined Access Protection Rule for registry blocking
 

VSE 8.x console

1. Click Start, Programs, McAfee, VirusScan Console.
2. Double-click Access Protection.
3. Under Categories, select User-Defined Rules, then New.
4. Select Registry Blocking Rule, then click OK.
5. In the Registry Blocking Rule section, edit the following fields:
   1. Rule name. Type in the name of your rule.
   2. Processes to include. Type an asterisk (*) unless you want to prevent only specific processes. An asterisk (*) specifies all processes.
   3. Processes to exclude. Type the process to exclude. Separate each process with a comma and a space.
   4. Registry Key or value to protect. Select the appropriate registry, and in the adjacent field type the registry location. For example: /Software/Microsoft/Windows/CurrentVersion/Policies/System/DisableRegistryTools
   5. Rule Type. Select either Key or Value.
      Where:
      • Key is an entire folder.
      • Value is an entry shown on the right side when using the registry editor.
   6. Registry actions to block. Select any of the options you want to block.
6. Click OK.
   After you have saved your rule, select Block and Report or Report, as needed 
7. Click Apply, then OK.

Back to Contents
 

ePO 5.x console

NOTE: Before you edit an Access Protection rule in a VSE policy, make sure that VSE is also installed on the ePO server. Some VSE policies are dynamically displayed using information found in the local VSE installation (for example, path information). If VSE is not installed, you might see policies refer to process names with a (\:::) prefix, which corrupts the policy if you modify and apply the change. For details about this issue, see KB81980.
 

1. Log on to the ePO console.
2. Click Menu, Policy Catalog.
3. From the Product drop-down list, select VirusScan Enterprise 8.8 or VirusScan Enterprise 8.7.
4. From the Category drop-down list, select Access Protection Policies.
5. Click the policy where you want to add the new user-defined Access Protection Rule.
6. At the top, select Workstation or Server from the drop-down list.
7. Under Categories, click User-Defined Rules, then New.
8. Select Registry Blocking Rule, then click OK.
9. In the Registry Blocking Rule section, edit the following fields:
   1. Rule name. Type in the name of your rule.
   2. Processes to include. Type an asterisk (*) unless you want to prevent only specific processes. An asterisk (*) specifies all processes.
   3. Processes to exclude. Type the process to exclude. Separate each process with a comma and a space.
   4. Registry Key or value to protect. Select the appropriate registry hive, and in the adjacent field type the registry location. For example: /Software/Microsoft/Windows/CurrentVersion/Policies/System/DisableRegistryTools
   5. Rule Type. Select either Key or Value.
      Where:
      • Key is an entire folder.
      • Value is an entry shown on the right side when using the registry editor.
   6. Registry actions to block. Select any of the options you want to block.
10. Click OK.
    After you have saved your rule, select Block and Report or Report, as needed 
11. Click Apply, then OK.

Back to Contents