Views:
When all agents managed by the server detect virus/malware within compressed files during Manual Scan, Real-time Scan, Scheduled Scan and Scan Now, and the following conditions are met, agents clean or delete the infected files.
  • "Clean" or "Delete" is the action Trend Micro Apex One is set to perform. Check the action Trend Micro Apex One performs on infected files by going to Agents → Agent Management > Settings → Scan Settings → {Scan Type} → Action tab.
  • You enable this setting. Enabling this setting may increase endpoint resource usage during scanning and scanning may take longer to complete. This is because Trend Micro Apex One needs to decompress the compressed file, clean/delete infected files within the compressed file, and then re-compress the file.
  • The compressed file format is supported. Trend Micro Apex One only supports certain compressed file formats, including ZIP and Office Open XML, which uses ZIP compression technologies. Office Open XML is the default format for Microsoft Office 2007 applications such as Excel, PowerPoint, and Word.
    Note
    Note
    Contact your support provider for a complete list of supported compressed file formats.
For example, Real-time Scan is set to delete files infected with a virus. After Real-time Scan decompresses a compressed file named abc.zip and detects an infected file 123.doc within the compressed file, Trend Micro Apex One deletes 123.doc and then re-compresses abc.zip, which is now safe to access.
The following table describes what happens if any of the conditions is not met.

Compressed File Scenarios and Results

Status of "Clean/ Delete infected files within compressed files"
Action Trend Micro Apex One is set to perform
Compressed file format
Result
Enabled
Clean or Delete
Not supported
Example: def.rar contains an infected file 123.doc.
Trend Micro Apex One encrypts def.rar but does not clean, delete, or perform any other action on 123.doc.
Disabled
Clean or Delete
Supported/Not supported
Example: abc.zip contains an infected file 123.doc.
Trend Micro Apex One does not clean, delete, or perform any other action on both abc.zip and 123.doc.
Enabled/ Disabled
Not Clean or Delete (in other words, any of the following: Rename, Quarantine, Deny Access or Pass)
Supported/Not supported
Example: abc.zip contains an infected file 123.doc.
Trend Micro Apex One performs the configured action (Rename, Quarantine, Deny Access or Pass) on abc.zip, not 123.doc.
If the action is:
Rename: Trend Micro Apex One renames abc.zip to abc.vir, but does not rename 123.doc.
Quarantine: Trend Micro Apex One quarantines abc.zip (123.doc and all non-infected files are quarantined).
Pass: Trend Micro Apex One performs no action on both abc.zip and 123.doc but logs the virus detection.
Deny Access: Trend Micro Apex One denies access to abc.zip when it is opened (123.doc and all non-infected files cannot be opened).
Keywords: virus/malware,compressed files