Scan Targets and Actions for Security Agents

Target Tab

• All scannable files: includes all scannable files. Unscannable files are password protected files, encrypted files, or files that exceed the user-defined scanning restrictions.

  Note This option provides the maximum security possible. However, scanning every file requires a lot of time and resources and might be redundant in some situations. Therefore, you might want to limit the amount of files the agent includes in the scan.

• IntelliScan uses "true file type" identification: Scans files based on true-file type. See IntelliScan.
• Scan files with the following extensions: Manually specify the files to scan based on their extensions. Separate multiple entries with commas.

• Read: Scans files whose contents are read; files are read when they are opened, executed, copied, or moved.
• Write: Scans files whose contents are being written; a file’s contents are written when the file is modified, saved, downloaded, or copied from another location.
• Read or write

Scan Exclusions

• Enable or disable exclusions
• Exclude Trend Micro product directories from scans
• Exclude other directories from scans
  All subdirectories in the directory path you specify will also be excluded
• Exclude file names or file names with full path from scans
• Exclude file extensions
  Wildcard characters, such as “*”, are not accepted for file extensions

Note (Advanced only) If Microsoft Exchange Server is running on the client, Trend Micro recommends excluding all Microsoft Exchange Server folders from scanning. To exclude scanning of Microsoft Exchange server folders on a global basis, go to Administration → Global Settings → Desktop/Server {tab} → General Scan Settings, and then select Exclude Microsoft Exchange server folders when installed on Microsoft Exchange server.

Advanced Settings

Scan Type	Option
Real-time Scan	Scan POP3 messages: By default, Mail Scan can only scan new messages sent through port 110 in the Inbox and Junk Mail folders. It does not support secure POP3 (SSL-POP3). Microsoft Outlook 2007, 2010, or 2013 Mozilla Thunderbird 1.5 or higher Mail Scan cannot detect security risks in IMAP messages. Use the Messaging Security Agent (Advanced only) to detect security risks and spam in IMAP messages.
Real-time Scan	Scan floppy disks during system shutdown
Real-time Scan	Enable IntelliTrap: IntelliTrap detects malicious code, such as bots, in compressed files. See IntelliTrap.
Real-time Scan	Quarantine malware variants detected in memory: If Real-time Scan and Behavior Monitoring are enabled and this option is selected, running process memory is scanned for packed malware. Any packed malware that Behavior Monitoring detects is quarantined.
Real-time Scan, Manual Scan, Scheduled Scan	Scan compressed files up to layer __: A compressed file has one layer for each time it has been compressed. If an infected file has been compressed to several layers, it must be scanned through the specified number of layer to detect the infection. Scanning through multiple layers, however, requires more time and resources.
Real-time Scan, Manual Scan, Scheduled Scan	Modify Spyware/Grayware Approved List: This setting cannot be configured from the agent console.
Manual Scan, Scheduled Scan	CPU Usage/Scan Speed: The Security Agent can pause after scanning one file and before scanning the next file. Select from the following options: High: No pausing between scans Medium: Pause between file scans if CPU consumption is higher than 50%, and do not pause if 50% or lower Low: Pause between file scans if CPU consumption is higher than 20%, and do not pause if 20% or lower
Manual Scan, Scheduled Scan	Run advanced cleanup: The Security Agent stops activities by rogue security software, also known as FakeAV. The agent also uses advanced cleanup rules to proactively detect and stop applications that exhibit FakeAV behavior. Note While providing proactive protection, advanced cleanup also results in a high number of false-positives.

Spyware/Grayware Approved List

Action Tab

Virus/Malware Scan Actions

Action	Description
Delete	Deletes the infected file.
Quarantine	Renames and then moves the infected file to a temporary quarantine directory on the client. The Security Agents then sends quarantined files to the designated quarantine directory, which is on the Security Server by default. The Security Agent encrypts quarantined files sent to this directory. If you need to restore any of the quarantined files, use the VSEncrypt tool.
Clean	Cleans the infected file before allowing full access to the file. If the file is uncleanable, the Security Agent performs a second action, which can be one of the following actions: Quarantine, Delete, Rename, and Pass This action can be performed on all types of malware except probable virus/malware. Note Some files are uncleanable. For details, see Uncleanable Files.
Rename	Changes the infected file's extension to "vir". Users cannot open the renamed file initially, but can do so if they associate the file with a certain application. The virus/malware may execute when opening the renamed infected file.
Pass	Only performed during Manual Scan and Scheduled Scan. The Security Agent cannot use this scan action during Real-time Scan because performing no action when an attempt to open or execute an infected file is detected will allow virus/malware to execute. All the other scan actions can be used during Real-time Scan.
Deny Access	Only performed during Real-time Scan. When the Security Agent detects an attempt to open or execute an infected file, it immediately blocks the operation. Users can manually delete the infected file.

ActiveAction

• AntimalwareScanCore uses scan actions that are recommended by Trend Micro. You do not have to spend time configuring the scan actions.
• Virus writers constantly change the way virus/malware attack endpoints. AntimalwareScanCore settings are updated to protect against the latest threats and the latest methods of virus/malware attacks.

Note Some files are uncleanable. For details, see Uncleanable Files. AntimalwareScanCore is not available for spyware/grayware scan. The default values for these settings can change, when new pattern files become available.

Advanced Settings