Scanning compressed files

PortalProtect can scan and block compressed files according to how you configure the scanning options. When PortalProtect detects a virus, it blocks the file or executes a pre-configured action.

• PortalProtect cannot clean a virus if the compression layer is greater than 1. However, you can configure PortalProtect to block and quarantine or scan and delete compressed files.

Compression and archiving are among the most common methods of file storage, especially for file transfers - like email attachments, FTP, and HTTP. Compressed files must first be decompressed before any virus detection can occur.

Recognizing the importance of decompression for detecting viruses, Trend Micro is committed to supporting all major decompression routines, present and future.

PortalProtect currently supports the following compression types:

• Extraction: used when multiple files have been compressed or archived into a single file:

PKZIP, LHA, LZH, ARJ, MIME, MSCF, TAR, GZIP, BZIP2, RAR, AMG, and ACE.

• Expansion: when only a single file has been compressed:

PKLITE, PKLITE32, LZEXE, DIET, ASPACK, UPX, MSCOMP, LZW, MACBIN, Petite, PEPack, and WWPack.

• Decoding: used when a file has been converted from binary to ASCII, a method that is widely employed by email systems:

UUCODE and BINHEX.

For other compression file types, PortalProtect scans the entire compressed file, rather than each individual file contained within the compressed file.

Scan Compressed Files for Real-time Virus Scan

The following explains the steps required to scan compressed files for real-time virus scan:

To scan compressed files for real-time virus scans:

1. On the left menu, click Virus Scan and select the Target tab.

2. From the Target tab, under Advanced Options, expand the Scan Restrictions Criteria.

3. Select and type values for Do not scan compressed files if, according to the following:

4. Decompressed file count exceeds [xxxxx]—type the total decompressed file count (1-10000) that should not be exceeded. When PortalProtect encounters a number of files equal to or greater than this number it will not scan the files.

5. Size of Decompressed file exceeds [xxxx]—type a value in megabytes (1-2048) to set a limit for the size of the compressed files PortalProtect will scan. When PortalProtect encounters a compressed file that is equal to or greater than this size, it will not scan the file.

6. Number of layers of compression exceeds [xx]—type a number (1-20) to set a limit for the number of layers of compression to which PortalProtect will scan. When PortalProtect encounters a file of a compression layer equal to or greater than this number it will not scan the files.

7. Size of decompressed file is "x" times the size of compressed file—decompressed files must not exceed the multiple entered according to the compressed file size. Type a multiple (100-1000000) that the decompressed file must not exceed. Decompressed files that exceed the value: decompressed size is "x" times larger than the compressed size, will not be scanned.

4. Click Save.

5. Office 2007 files are compressed files. If an office 2007 file exceeds the scan restriction criteria, PortalProtect will treat it as an unscannable file.

Scan Compressed Files for Manual Scan

The following explains the steps required to scan compressed files for manual scan:

To scan compressed files for manual scan:

1. On the left menu, click Manual Scan.

2. Under Select the scan type, click the Virus scan link.

3. Select the Target tab. Under Advanced Options, expand the Scan Restrictions Criteria.

4. Select and type values for Do not scan compressed files if, according to the following:

5. Decompressed file count exceeds [xxxxx]—type the total decompressed file count (1-10000) that should not be exceeded. When PortalProtect encounters a number of files equal to or greater than this number it will not scan the files.

6. Size of Decompressed file exceeds [xxxx]—type a value in megabytes (1-2048) to set a limit for the size of the compressed files PortalProtect will scan. When PortalProtect encounters a compressed file that is equal to or greater than this size, it will not scan the file.

7. Number of layers of compression exceeds [xx]—type a number (1-20) to set a limit for the number of layers of compression to which PortalProtect will scan. When PortalProtect encounters a file of a compression layer equal to or greater than this number it will not scan the files.

8. Size of decompressed file is "x" times the size of compressed file—decompressed files must not exceed the multiple entered according to the compressed file size. Type a multiple (100-1000000) that the decompressed file must not exceed. Decompressed files that exceed the value: decompressed size is "x" times larger than the compressed size, will not be scanned.

5. Click Save.

Scan Compressed Files for Scheduled Scan

The following explains the steps required to scan compressed files for scheduled scan:

To scan compressed files for scheduled scan:

1. On the left menu, click Scheduled Scan.

2. Click Add, to create a new scheduled scan, or click the Task Name to edit an existing one.

3. Under Select scan type, click the Virus scan link.

4. Select the Target tab. Under Advanced Options, expand the Scan Restrictions Criteria.

5. Select and type values for Do not scan compressed files if, according to the following:

6. Decompressed file count exceeds [xxxxx]—type the total decompressed file count (1-10000) that should not be exceeded. When PortalProtect encounters a number of files equal to or greater than this number it will not scan the files.

7. Size of Decompressed file exceeds [xxxx]—type a value in megabytes (1-2048) to set a limit for the size of the compressed files PortalProtect will scan. When PortalProtect encounters a compressed file that is equal to or greater than this size, it will not scan the file.

8. Number of layers of compression exceeds [xx]—type a number (1-20) to set a limit for the number of layers of compression to which PortalProtect will scan. When PortalProtect encounters a file of a compression layer equal to or greater than this number it will not scan the files.

9. Size of decompressed file is "x" times the size of compressed file—decompressed files must not exceed the multiple entered according to the compressed file size. Type a multiple (100-1000000) that the decompressed file must not exceed. Decompressed files that exceed the value: decompressed size is "x" times larger than the compressed size, will not be scanned.

6. Click Save.