Security And Malware Resources; Malware Analysis - McAfee GOLD - SUPPORT Handbook

Security and Malware Resources

McAfee offers a wide variety of resources and tools to help you understand and combat threats to your networks and
desktops.
Understanding DAT Files
Many McAfee products require definition files, or DATs. The DATs contain the information that the anti-malware
engine requires to properly detect threats and clean infections. The table below describes the various types of DAT
files and when they are issued or used.
DAT type Description
Daily DAT The daily DATs contain only the latest virus information (with no scan engine) and are
updated on a daily basis. Daily DAT files are downloaded automatically by your McAfee
products. If you need to download a copy of the latest daily DATs, go to
http://www.mcafee.com/apps/downloads/security_updates/dat.asp.
SuperDAT A SuperDAT is a one step executable update for your regular DAT files and the anti-
malware engine used by your product. A SuperDAT can be used to update the DATs and
engine when other update methods have failed or if a system must be taken off the network.
To download SuperDATs, go to
http://www.mcafee.com/apps/downloads/security_updates/superdat.asp.
Beta DAT Beta DATS are hourly builds of the daily DAT files with additional malware definitions that
have been received recently. Beta DATs receive limited false positive testing and are
recommended for use primarily on high risk systems or when an infection is not detected by
the daily DATs. To download Beta DATS, go to http://vil.nai.com/vil/averttools.aspx.
Extra.DAT Extra.DATs are temporary definition files delivered directly by McAfee Labs in response to
submitted malware that is not yet covered in the daily DAT files. Extra.DATs are intended to
provide emergency coverage until the new malware can be incorporated into the daily
DATs. Extra.DATs automatically expire and are deleted when the extra detections are
added to the daily DATs.

Malware Analysis

If you suspect that your system has been compromised by a virus, McAfee recommends that you submit the samples
of the suspect files for analysis by McAfee Labs.
For more information and instructions, see the articles below:
•
KB68030 - How to submit samples to McAfee Labs through the McAfee ServicePortal or Platinum Portal
•
KB53094 - Troubleshooting procedure for finding possible infected files (issue: when virus not detected)
•
KB67411 - How to submit a possible false or misclassified sample file to McAfee Labs
Gold Support Handbook
11