FTP Virus Scan Rule

FTP > Scan Rules | Virus Scan Rule

Click Enable FTP Scanning at the top of the page to have IWSVA check incoming and/or outgoing FTP traffic for viruses, malicious code, and other Internet threats. Note: Disabling FTP scanning will not interrupt Internet traffic.

• Scan Direction—You can have IWSVA scan FTP upload, download, or both.

• Block These File Types—You can have IWSVA block certain file types, before starting the transfer; blocked files are not delivered to the client and are not scanned. MORE>>

  • Check the box of a category to select all file types in that category

  • Click "Show Details" and uncheck the file types that should be allowed within a check category.

   

• Scan these file types—For the greatest protection against Internet threats, Trend Micro recommends that you scan all file types. MORE>>

  • All scannable files:  All files are scanned; determination of file type is based on file name only, but since all files are scanned, type is largely irrelevant.

  • IntelliScan: Only files of a type known to be potentially harmful are scanned; determination of file type is based on the internal file property.

  • Selected file extensions:  Only files of the type you specify are scanned; determination of file type is based on file name only.

   

• Compressed File Handling—Compressed files can pose a special security risk. They often contain numerous files any one of which may be harmful and may be password protected to thwart scanning. They can contain hundreds of compression layers, which can slow or stall processing. Malicious hackers can use them to smuggle harmful code past the scanner or take control of the system.

• Large file handling—When transferring large files, users may notice a lag, or the FTP client may time out while IWSVA is scanning the file. The impact is not usually noticed on transfers of less than 100MB, but the exact tipping point obviously depends on bandwidth, hardware, proxy performance, compression layers, and file size.
  
  A percentage of external data received by IWSVA is sent to the FTP client in chunks without scanning.  The last chunk is sent to the FTP client to complete the download only after the entire set of data is received and scanned.  Sending smaller chunks not only maintains the IWSVA - FTP client connection, but also keeps end-users posted of the download progress.

• Quarantined File Handling—Trend Micro recommends that you encrypt quarantined files. The default quarantine directory is:

/var/iwss/quarantine

You can change the location in the Administration > IWSVA Configuration > Quarantine Management page.

See also

• Spyware/Grayware Scan Rule

• Action

• About IntelliScan