McAfee MOVE AntiVirus
Optimized security, virus protection, and management for virtualized environments

Features & Benefits:

Offload malware scanning
Get instant protection with low impact on memory and processing.

Prevent antivirus storms
Benefit from options that include on-access, scheduled, and selective scans.

Multi-vendor or agentless deployment options
Gain support for all major hypervisors.

Minimize setup and updates
Optimize your time with a dedicated, hardened virtual appliance.

Block zero-day, unknown threats
Leverage real-time file analysis through McAfee Global Threat Intelligence.

Add intrusion and web protection
Achieve desktop firewall, memory, and web application protection (included).

Leverage McAfee ePolicy Orchestrator (McAfee ePO) software
Realize at-a-glance visibility, control, and reporting across your endpoints, including your virtual machines in the cloud.

Optimized Scanning Architecture

The dynamic nature of guest desktops and virtual servers requires careful handling. Images must be malware-free while offline or scanned without delay when users initiate a session. Anti-malware isn’t the only service starting up, and users often begin work in groups, causing peak-demand “antivirus storms” that consume all resources and prevent users from obtaining a session.

To eliminate scanning bottlenecks and delays, McAfee MOVE AntiVirus offloads scanning, configuration, and .DAT update operations from individual guest images to a hardened virtual appliance/offload scan server. We build and maintain a global cache of scanned files to ensure that once a file is scanned and confirmed to be clean, subsequent virtual machines (VMs) accessing that file won’t have to wait for a scan. Memory resource allocation for each VM decreases and can be released back to the resource pool for more effective utilization. Intelligent scheduling of on-demand scans ensures that scans don’t interfere with hypervisor performance.

Complete Visibility over the Data Center

In data centers, maintaining visibility over the entire virtualized environment can be a struggle for security administrators. McAfee Data Center Connector provides a complete view into virtual data centers and populates key properties like servers, hypervisors, virtual machines, even the cloud, into the McAfee® ePolicy Orchestrator® (McAfee ePO™) console. Clients can register a vSphere or Amazon Web Services (AWS) account with McAfee ePO software to discover and gain visibility into all VMs, whether or not they have deployed McAfee protections. With complete visibility, the task of securing the data center becomes simplified. Administrators can monitor hypervisor-to-VM relationships, security status, and power status in near real-time. A customizable, at-a-glance dashboard displays security scan status, executive overviews, historical security data on assets, and administrative actions.

Fine-Grained Policy Management

The familiar McAfee ePO software console lets you configure policies and controls for McAfee MOVE AntiVirus behavior. Data from virtual desktops can be rolled up with data from other systems within unified dashboards and reports. Administrators are able to configure a unique policy per VM, resource pool, cluster, or data center through the McAfee Data Center Connector, adapting their security needs specifically to the makeup of the data center.

What’s New in McAfee MOVE AntiVirus

• Improves management and visibility:
  • Data Center Connector.
  • Data Center Dashboard.
  • Fine-grained policy management.
• Simplifies deployment and configuration:
  • Deploys and configures SVA on multiple hypervisors.
  • Supports SVA deployment in VM cluster environments.
• Supports highest VMware vShield addressable market:
  • Support ESXi 4.1 Patch 3.
• File quarantine and restore.

Leverage vShield for Efficiency

In agentless deployments, VMware vShield Endpoint uses the hypervisor as a high-speed connection to allow the McAfee MOVE AntiVirus security virtual appliance (SVA) to scan virtual machines from outside the guest image. As it scans, the SVA will direct vShield to cache good files and either delete, deny access to, or quarantine malicious files.

After you install and configure the SVA and the required vShield components on the ESX servers, along with installing the vShield driver on the guest VMs, every image is automatically protected at creation. There’s no requirement to install McAfee software on each client VM. Our vMotion-aware implementation means your virtual machines can move from one host to another and be seamlessly protected by the SVA on the target host, with no impact on scans or the user experience. McAfee integration allows you to monitor SVA status within vCenter and receive alerts if the SVA loses connectivity. McAfee ePO software receives event data detailing the specific VM affected in the event a VM is infected.

Multiplatform for Standards and Convenience

In multiplatform installations, the McAfee MOVE AntiVirus agent—a lightweight endpoint component—communicates to the offload scan server to broker the antivirus processing on behalf of each virtual desktop. A McAfee ePO software agent manages policies and scanning functions. You can designate and scan a gold image for use as a clean master. Pre-populating global caches with clean images delivers the fastest VM boot-up time.

When a user accesses a file, the McAfee MOVE AntiVirus offload scan server performs an on-access scan, providing a response back to the VM. Users can be notified of issues through a pop-up alert, and files can be moved to quarantine to await a decision.

Each virtual machine can be configured with unique, individual policies set in the McAfee ePO software console, or the VMs can be managed as a group.

Architecture	Multiplatform Deployment	Agentless Deployment
Hypervisor/platform support	Supports major hypervisors	VMware only
Scanning platform	Windows 2008	Linux
Deployment scalability	450 VMs per offload scan server	One security virtual appliance per ESX host
Communication to VMs	Network	VMware vShield: VMCI channel

Configurations:

McAfee MOVE AntiVirus for virtual desktops

• McAfee MOVE AntiVirus
  • Multiplatform deployment
  • Agentless deployment
• McAfee VirusScan Enterprise for Windows software
• McAfee VirusScan Enterprise for Linux software
• McAfee Host Intrusion Prevention System
• McAfee SiteAdvisor Enterprise technology
• McAfee ePolicy Orchestrator software

McAfee MOVE AntiVirus for Virtual Servers

• McAfee MOVE AntiVirus
  • Multiplatform deployment
  • Agentless deployment
• McAfee VirusScan Enterprise for Windows software
• McAfee VirusScan Enterprise for Linux software
• McAfee VirusScan Enterprise for Offline Virtual Images software
• McAfee ePolicy Orchestrator software
• McAfee MOVE Scheduler

System Requirements:

These are minimum system requirements. Actual requirements will vary depending on the nature of your environment.

MOVE AntiVirus (Agentless) v3.0

Supported Client Virtual Machine Operating Systems

• All operating systems supported by VMware’s vShield Endpoint Thin Agent

Supported Virtualization Technologies

• VMware View 5.0/5.1/5.2
• VMware ThinApp 4.6.2

Supported Virtualization Infrastructure

• vSphere 5.0 updated to include the following:
  • ESXi servers running 5.0 patch one (VUM Patch ID: ESXi500-201109401-BG)
  • ESXi servers with the vShield Loadable Kernel Module installed (version: 5.0.0-447150 or higher)
  • VMware Tools from the 5.0 patch one release (VUM Patch ID: ESX500-201109402-BG) with the vShield thin agent installed onto the client virtual machine
• vSphere 5.1

Virtual Machine Hosting the Security Virtual Appliance

• CPU: 2 vCPU, 1.6 GHz or higher
• Memory: 2 GB RAM or higher

MOVE AntiVirus Multi-Platform v2.6

Supported Virtualized Environments

• Hypervisors
  • Citrix XenServer 5.5/5.6/6.0/6.1/6.2
  • Citrix Kaviza 5.0 (VDI-In-a-Box)
  • VMware ESX/ESXi 4.0/4.1/5.0/5.1/5.5
  • Microsoft Windows Server 2008 Service Pack 2 (SP2) HyperV/2008 R2 SP1 HyperV/ 2012 Hyper-V

Virtual Desktop Infrastructure

• Citrix XenDesktop 5.5/5/6/7.0/7.1
• VMware View 4.0/5.0/5.1/5.2

Virtual Application Management

• Citrix XenApp 5.0/6.5
• VMware ThinApp 4.6.2

Supported Virtual Machine Operating Systems

• MOVE AntiVirus Offload Scan Server (appliance) requires a dedicated virtual (or physical) machine with McAfee VirusScan Enterprise and McAfee Agent. The machine must meet the following requirements:
  • OS: Windows 2008 R2 SP1 (64-bit) or Windows 2008 SP2 (64-bit) or Windows 2012
  • CPU: 1 vCPU, 2 GHZ or higher (4 vCPUs are recommended)
  • Memory: 1 GB RAM or higher (4 GB RAM is recommended)

MOVE AntiVirus Agent OS support

• Windows Vista (32-bit and 64-bit)
• Windows XP SP3 (32-bit)
• Windows 7 (32-bit and 64-bit)
• Windows 2003 R2 SP2 (32-bit)
• Windows 2008 SP2 (32-bit and 64-bit)
• Windows 2008 R2 SP1
• Windows 8 (32-bit and 64-bit)
• Windows 8.1 (32-bit and 64-bit)
• Windows 2012 R2

Documentation:

Download the McAfee MOVE AntiVirus Datasheet (PDF).