DTAM151 - McAfee VirusScan Access Protection Rules Anti-Virus Standard Protection must be set to prevent IRC communication.

Information

Internet Relay Chat (IRC) is the preferred communication method used by botnet herders and remote-access trojans to control botnets (a set of scripts or an independent program that connects to IRC). IRC allows an attacker to control infected machines that are sitting behind network address translation (NAT), and the bot can be configured to connect back to the command and control server listening on any port.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Access the local VirusScan console by clicking Start->All Programs->McAfee->VirusScan Console.
Under the Task column, select Access Protection, right-click, and select Properties.

Under the Access Protection tab, locate the 'Access protection rules:' label. In the 'Categories' box, select 'Anti-Virus Standard Protection'. Select both 'Prevent IRC communication' (Block and Report) options.

Click OK to Save.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_McAfee_VirusScan88_Local_Client_V6R1_STIG.zip

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-18(4), CAT|II, CCI|CCI-001170, Rule-ID|SV-243425r722614_rule, STIG-ID|DTAM151, STIG-Legacy|SV-55227, STIG-Legacy|V-42514, Vuln-ID|V-243425

Plugin: Windows

Control ID: 33fc1b187579aada393ffa03e577c1e4eac5ce33cb1b4412ac390d7332884aab