Configuring Macro Scanning Parent topic

IM Security uses the virus pattern file to identify known malicious macro codes during regular virus scanning. IM Security takes action against malicious macro code depending on the action that you configure from the Security Risk Scan screen. Use advanced macro scanning to gain additional protection against malicious macro code.
Advanced macro scanning supplements regular virus scanning. It uses heuristic scanning to detect macro viruses/malware or strips all detected macro codes. Heuristic scanning is an evaluative method of detecting viruses that uses pattern recognition and rules-based technologies to search for malicious macro code. This method excels at detecting undiscovered viruses and security risks that do not have a known virus signature. When a malicious macro code is detected using heuristic scanning, IM Security takes action against the malicious code based on the action that you configured from the Security Risk Scan screen. When you select Delete all macros detected by advanced macro scan, then IM Security strips all macro code from the scanned files.

Procedure

  1. Go to File Transfer Scan → Virus Scan → Action.
  2. Click Advanced Options and then click Macros.
  3. Select Enable advanced macro scan.
  4. Select a detection type:
    1. Select Heuristic level and configure a level for the heuristic rules.
      • Level 1 uses the most specific criteria, but detects the least macro codes.
      • Level 4 detects the most macro codes, but uses the least specific criteria and may falsely identify safe macro code as harboring malicious macro code.
      Tip
      Tip
      Trend Micro recommends a heuristic scan level of 2. This level provides a high detection level for unknown macro viruses, a fast scanning speed, and it uses only the necessary rules to check for macro virus/malware strings. Level 2 also has a low level of falsely identifying malicious code in safe macro code.
    2. Select Delete all macros detected by advanced macro scan to have IM Security delete all of the macro codes that it detects.
  5. Click Save.