Configure malware scans

Create or edit a malware scan configuration

• After you create a malware scan configuration, you can then associate it with a scan in a policy or computer (see Select the types of scans to perform)
• When you edit a malware scan configuration that a policy or computer is using, the changes affect the scans that are associated with the configuration.

Tip To create a malware scan configuration that is similar to an existing one, duplicate the existing configuration and then edit it.

• Real-time scan configuration: Controls real-time scans. Some actions such as Deny Access are only available to real-time scan configurations.
• Manual/scheduled scan configuration: Controls either manual or scheduled scans. Some options such as CPU Usage are only available to manual/scheduled scan configurations.

1. Go to Policies → Common Objects → Other → Malware Scan Configurations.
2. To create a scan configuration, click New and then click New Real-Time Scan Configuration or New Manual/Scheduled Scan Configuration.
   1. Type a name to identify the scan configuration. You see the name in a list when configuring malware scans in a policy.
   2. (Optional) Type a description that explains the use case for the configuration.
3. To view and edit an existing scan configuration, select it and click Properties.
4. To duplicate a scan configuration, select it and click Duplicate.

Tip To see the policies and computers that are using a malware scan configuration, see the AssignedTo tab of the properties.

Test malware scans

1. Make sure the real-time scan is enabled and that a configuration is selected.
2. Go to the EICAR site and download their anti-malware test file. This standardized file will test the real-time scan's anti-virus capabilities. The file should be quarantined.
3. In the Server & Workload Protection console, go to Events & Reports → Anti-Malware Events to verify the record of the EICAR file detection. If the detection is recorded, the Anti-Malware real-time scans are working correctly.

Note Before you begin, make sure the real-time scan is disabled before testing manual/scheduled scans.

1. Go to Administration.
2. Click Scheduled tasks → New.
3. Select Scan Computers for Malware from the drop-down menu and select a frequency. Complete the scan configuration with your desired specifications.
4. Go to the EICAR site and download their anti-malware test file. This standardized file will test the manual/scheduled scan's anti-virus capabilities.
5. Select the scheduled scan and click Run Task Now. The test file should be quarantined.
6. In the Server & Workload Protection console, go to Events & Reports → Anti-Malware Events to verify the record of the EICAR file detection. If the detection is recorded, the Anti-Malware manual/scheduled scans are working correctly.

Configure malware scanning capabilities and features

• Configure Anti-Malware Monitoring Level
• Enable AMSI protection (real-time scans only)
• Scan for spyware and grayware
• Scan for compressed executable files (real-time scans only)
• Scan process memory (real-time scans only)
• Scan compressed files
• Scan embedded Microsoft Office objects

• Detect emerging threats using Predictive Machine Learning
• Enhanced Anti-Malware and ransomware scanning with behavior monitoring

Configure Anti-Malware Monitoring Level

Important Monitoring Level only supports agent version 20.0.1.25770 and later. Unsupported versions use the default level of 2 - Moderate and cannot be changed. Support for Linux agents is limited to 64-bit (x86-64) and 32-bit (x86) systems. Agents deployed to other Linux architectures use the default level of 2 - Moderate and cannot be changed.

1. Open the properties of the malware scan configuration.
2. On the General tab, under Anti-Malware Monitoring Level, configure the settings for Detection level and Prevention level.

   Important The Prevention level must be the same or lower than Detection level.

3. Click OK.

Tip If you want Anti-Malware Scan and Behavior Monitoring to exclude certain detection rules, you can add the rule ID to the Rule Exceptions list by going to the Anti-Malware → Advanced tab of the Computer or Policy editor. You can find rule IDs by viewing events in Events & Reports. For more information, see Create Anti-Malware exceptions.

Enable Windows AMSI protection (real-time scans only)

1. Open the properties of the malware scan configuration.
2. On the General tab, select Enable AMSI protection.
3. Configure the settings for Detection level and Prevention level.

   Important Adjusting Detection and Prevention levels only supports agent version version 20.0.1.25770 and later. Unsupported versions use the default level of 2 - Moderate and cannot be changed. Higher levels provide greater sensitivity but might generate a large number of nonessential logs and impact endpoint performance. Trend Micro recommends selecting 2 - Moderate for more relevant data with minimal impact on your endpoints. The Prevention level must be the same or lower than Detection level. The Action to take selection might affect the prevention actions taken for the selected prevention level.

4. For Action to take, choose the remediation action that you want Server & Workload Protection to take when it detects malware:
   • Terminate (recommended): Stops execution or running of the detected process.
   • Pass: Server & Workload Protection records an Anti-Malware Event without taking action on the process.
5. Click OK.

Scan for spyware and grayware

1. Open the properties of the malware scan configuration.
2. On the General tab, select Enable spyware/grayware protection.
3. Click OK.

Scan for compressed executable files (real-time scans only)

Note Because IntelliTrap identifies such files as security risks and may incorrectly block safe files, consider quarantining (not deleting or cleaning) files when you enable IntelliTrap. (See Configure how to handle malware.) If users regularly exchange real-time compressed executable files, disable IntelliTrap. IntelliTrap uses the virus scan engine, IntelliTrap Pattern, and IntelliTrap Exception Pattern.

Note For macOS agents, IntelliTrap is not supported.

1. Open the properties of the malware scan configuration.
2. On the General tab, select Enable IntelliTrap.
3. Click OK.

Scan process memory (real-time scans only)

Important Scan process memory does not support Linux and macOS agents.

1. Open the properties of the malware scan configuration.
2. On the General tab, select Scan process memory for malware.
3. Configure the settings for Detection level and Prevention level.

   Important Adjusting Detection and Prevention levels only supports agent version version 20.0.1.25770 and later. Unsupported versions use the default level of 2 - Moderate and cannot be changed. Higher levels provide greater sensitivity but might generate a large number of nonessential logs and impact endpoint performance. Trend Micro recommends selecting 2 - Moderate for more relevant data with minimal impact on your endpoints. The Prevention level must be the same or lower than Detection level. The Action to take selection might affect the prevention actions taken for the selected prevention level.

4. Click OK.

Scan compressed files

1. Open the properties of the malware scan configuration.
2. On the Advanced tab, select Scan compressed files.
3. Specify the maximum size of content files to extract, in MB, the levels of compression to scan, and the maximum number of files to extract.
4. Click OK.

Scan embedded Microsoft Office objects

Note For macOS agents, scanning embedded Microsoft Office objects is not supported.

1. Open the properties of the malware scan configuration.
2. On the Advanced tab, select Scan Embedded Microsoft Office Objects.
3. Specify the number of OLE layers to scan.
4. Click OK.

Enable a manual scan for the notifier application

• From the computer editor or the policy editor, click the Anti-Malware tab.
• Click the General horizontal tab.
• In the Manual Scan section, click to select the checkbox for Allow agent to trigger or cancel a manual scan from Trend Micro's notifier application.

Specify the files to scan

• Inclusions
• Exclusions
• Scan a network directory (real-time scan only)

Inclusions

• All files
• File types that are identified by IntelliScan. IntelliScan only scans file types that are vulnerable to infection, such as .zip or .exe. IntelliScan does not rely on file extensions to determine file type but instead reads the header and content of a file to determine whether it should be scanned. Compared to scanning all files, Intelliscan reduces the number of files to scan and improves performance.
• Files that have a file name extension that is included in a specified list: The file extension list uses patterns with a specific syntax. (See Syntax of file extension lists.)

1. Open the properties of the malware scan configuration.
2. Click the Inclusions tab.
3. To specify the directories to scan, select All directories or Directory List.
4. If you selected Directory List, from the drop-down menu either select an existing list or select New to create one.
5. To specify the files to scan, select either All files, File types scanned by IntelliScan, or File Extension List.
6. If you selected File Extension List, from the drop-down menu either select an existing list or select New to create one.
7. Click OK.

Exclusions

• If you are creating a malware scan configuration for a Microsoft Exchange server, exclude the SMEX quarantine folder to avoid re-scanning files that have already been confirmed to be malware.
• If you have large VMware images, exclude the directory containing these images if you experience performance issues.

Tip You can also exclude files from Anti-Malware scanning when they are signed by a trusted digital certificate. This type of exclusion is defined in policy or computer settings. (See Exclude files signed by a trusted certificate.)

1. Open the properties of the malware scan configuration.
2. Click the Exclusions tab.
3. Specify the directories to exclude:
   1. Select Directory List.
   2. Select a directory list or select New to create one. (See Syntax for directory lists.)
   3. If you created a directory list, select it in the directory list.
4. Similarly, specify the file list, file extension list, and process image file list to exclude. (See Syntax of file lists, Syntax of file extension lists, and Syntax of process image file lists (real-time scans only):.)
5. Click OK.

Test file exclusions

Note Before you begin, make sure the real-time scan is enabled and a configuration is selected.

1. Go to Policies → Common Objects → Other → Malware Scan Configurations.
2. Click New → New Real-time Scan Configuration.
3. Go to the Exclusions tab, and select New from the directory list.
4. Name the directory list.
5. Under Directory(s) specify the path of the directory you want to exclude from the scan. For example, c:\Test Folder\. Click OK .
6. Go to the General tab, name the manual scan, and click OK.
7. Go to the EICAR site and download their anti-malware test file. Save the file in the folder specified in the previous step. The file should be saved and undetected by the Anti-Malware module.

Syntax for directory lists

Note Directory list items accept either forward slash "/" or backslash "" to support both Windows and Linux conventions.

c:\abc #Exclude the abc directory

Syntax of file lists

        Matches:
         ac.ap  a123c.ap  ac.a456p  a123c.a456p Does not match: ad.aa</td>
</tr>
<tr>
    <td>Environment variable</td>
    <td>${ENV VAR}</td>
    <td>Excludes files specified by an environment variable with the format ${ENV VAR}. These can be defined or overridden using <term>Policy or Computer Editor &gt; Settings &gt; General &gt; Environment Variable Overrides.</term></td>
    <td>
        <term>
            ${myDBFile}
        </term>
         Excludes the file "myDBFile".</td>
</tr>
<tr>
    <td>Comments</td>
    <td>FILEPATH #Comment</td>
    <td>Adds a comment to your exclusion definitions.</td>
    <td>
        <codeblock>C:\Documents\abc.doc #This is a comment
    </codeblock>
    </td>
</tr>

Syntax of file extension lists

doc #This a comment

Syntax of process image file lists (real-time scans only)

Scan a network directory (real-time scan only)

Note Resources accessed in "~/.gvfs" via GVFS, a virtual file system available for the GNOME desktop, will be treated as local resources, not network drives.

Note If a virus is detected when scanning a network folder on Windows, the agent may display some "clean failed" (delete failed) events.

Specify when real-time scans occur

1. Open the properties of the malware scan configuration.
2. On the Advanced tab, select one of the options for the Real-Time Scan property.
3. Click OK.

Configure how to handle malware

• Customize malware remedial actions
• Generate alerts for malware detection

Customize malware remedial actions

• Pass: Allows full access to the infected file without doing anything to the file. (An Anti-Malware Event is still recorded.)

  Note The remedial action Pass should never be used for a possible virus.

• Clean: Cleans an infected file before allowing full access to it. If the file can't be cleaned, it is quarantined.
• Delete: On Linux, the infected file is deleted without a backup.
  On Windows, the infected file is backed up and then deleted. Windows backup files can be viewed and restored in Events & Reports → Events → Anti-Malware Events → Identified Files.
• Deny Access: This scan action can only be performed during Real-time scans. When Server & Workload Protection detects an attempt to open or execute an infected file, it immediately blocks the operation. The infected file is left unchanged. When the Access Denied action is triggered, the infected files stay in their original location.

  Note Do not use the remedial action Deny Access when Real-Time Scan is set to During Write. When During Write is selected, files are scanned when they are written and the action Deny Access has no effect.

• Quarantine: Moves the infected file to the quarantine directory on the computer or Virtual Appliance. The quarantined file can be viewed and restored in Events & Reports → Events → Anti-Malware Events → Identified Files.

  Note Malware marked as Quarantined on Linux might be marked as Deleted on Windows, despite the malware being identical on both operating systems. In either case, the file can be viewed and restored in Events & Reports → Events → Anti-Malware Events → Identified Files.

  Note On Windows, infected non-compressed files (for example, .txt files) are quarantined, while infected compressed files (for example, .zip files) are deleted. On Windows, both quarantined or deleted files have a backup that can be viewed and restored in Events & Reports → Events → Anti-Malware Events → Identified Files. On Linux, all infected files (compressed or non-compressed) are quarantined, and can be viewed and restored in Events & Reports → Events → Anti-Malware Events → Identified Files.

Note For macOS agents, the supported custom actions are Virus, Trojans, and Spyware.

1. Open the properties of the malware scan configuration.
2. On the Advanced tab, for Remediation Actions select Custom.
3. Specify the action to take:
   • To let ActiveAction decide which action to take, select Use action recommended by ActiveAction.
   • To specify an action for each type of vulnerability, select Use custom actions, and then select the actions to use.
4. Specify the action to take for Possible Malware.
5. Click OK.

ActiveAction actions

Note When the agent downloads virus pattern updates from an ActiveUpdate server or relay, it may change its ActiveAction scan actions.

Generate alerts for malware detection

1. Open the properties of the malware scan configuration.
2. On the General tab, for Alert select Alert when this Malware Scan Configuration logs an event.
3. Click OK.

Identify malware files by file hash digest

1. Open the policy or computer editor that you want to configure.
2. Click Anti-Malware → Advanced.
3. Under File Hash Calculation, clear the Default or Inherited check box. (Default is displayed for a root policy and Inherited is displayed for child policies).

   Note When Inherited is selected, the file hash settings are inherited from the current policy's parent policy.

   Note When Default is selected, Server & Workload Protection does not calculate any hash values.

4. Select the Calculate hash values of all anti-malware events.
5. By default, Server & Workload Protection will produce SHA-1 hash values. If you want to produce additional hash values, you can select one or both of MD5 and SHA256.
6. You can also change the maximum size of malware files that will have hash values calculated. The default is to skip files that are larger than 128MB, but you can change the value to anything between 64 and 512 MB.

Configure notifications on the computer

1. Go to the Computer or Policy editor.
2. Click Settings on the left.
3. Set Suppress all pop-up notifications on host to Yes. The messages still appear as alerts or events in Server & Workload Protection. For more information about the notifier, see Notifier.

Run scheduled scans when Server & Workload Protection is not accessible

Note This feature is supported with version 20.0.3445+ agents on Windows.

1. Go to the Computer or Policy editor.
2. On the left, click Anti-Malware.
3. On the General tab, for Scheduled Scan select Enable agent to trigger scheduled scan for malware.

Note When the checkbox is selected: The Run Task Now button on the Scheduled Tasks page will be disabled for this agent. Server & Workload Protection manager will not proactively queue any scheduled scan task when agent is offline.

Troubleshooting

1. If the computer is shut down, the upcoming scheduled scan may not be triggered if it times out when the computer is restarted.
2. If the computer is shut down during the scheduled scan, the interrupted scheduled scan will not continue when the computer is restarted.