Configure malware scans

Malware scan configurations are reusable saved settings that you can apply when configuring Anti-Malware in a policy or for a computer. A malware scan configuration specifies what types of malware scanning Workload Security performs and which files it scans. Some policy properties also affect the behavior of malware scans.

Note that CPU usage and RAM usage varies by your Anti-Malware configuration. To optimize Anti-Malware performance on the agent, see Performance tips for Anti-Malware.

Create or edit a malware scan configuration

Create or edit a malware scan configuration to control the behavior of a real-time, manual, or scheduled scan (see Malware scan configurations). You can create multiple malware scan configurations as required.

• After you create a malware scan configuration, you can then associate it with a scan in a policy or computer (see Select the types of scans to perform).

• When you edit a malware scan configuration that a policy or computer is using, the changes affect the scans that are associated with the configuration.

To create a malware scan configuration that is similar to an existing one, duplicate the existing configuration and then edit it.

You can create two types of malware scan configurations according to the type of scan it controls (see Types of malware scans):

• Real-time scan configuration: Controls real-time scans. Some actions such as Deny Access are only available to real-time scan configurations.

• Manual/scheduled scan configuration: Controls either manual or scheduled scans. Some options such as CPU Usage are only available to manual or scheduled scan configurations.

Workload Security provides a default malware scan configuration for each type of scan.

1. Go to Policies > Common Objects > Other > Malware Scan Configurations.
2. To create a scan configuration, click New and then click New Real-Time Scan Configuration or New Manual/Scheduled Scan Configuration.
   1. Type a name to identify the scan configuration. You see the name in a list when configuring malware scans in a policy.
   2. Optionally, type a description that explains the use case for the configuration.
3. To view and edit an existing scan configuration, select it and click Properties.
4. To duplicate a scan configuration, select it and click Duplicate.

The policies and computers that are using a malware scan configuration are visible via the AssignedTo tab of the properties.

Test malware scans

Before continuing with further Anti-Malware configuration steps, test real-time and manual or scheduled scans to ensure they are working correctly.

You can test real-time scans as follows:

1. Make sure the real-time scan is enabled and that a configuration is selected.
2. Go to the EICAR site and download their anti-malware test file. This standardized file will test the real-time scan's anti-virus capabilities. The file should be quarantined.
3. In the Workload Security console, go to Events & Reports > Anti-Malware Events to verify the record of the EICAR file detection. If the detection is recorded, the Anti-Malware real-time scans are working correctly.

Before you start testing manual or scheduled scans, ensure the real-time scan is disabled.

You can test manual or scheduled scans as follows:

1. Go to Administration.
2. Click Scheduled tasks > New.
3. Select Scan Computers for Malware from the drop-down menu and select a frequency. Complete the scan configuration with your desired specifications.
4. Go to the EICAR site and download their anti-malware test file. This standardized file will test the manual/scheduled scan's anti-virus capabilities.
5. Select the scheduled scan and click Run Task Now. The test file should be quarantined.
6. In the Workload Security console, go to Events & Reports > Anti-Malware Events to verify the record of the EICAR file detection. If the detection is recorded, the Anti-Malware manual/scheduled scans are working correctly.

Scan for specific types of malware

• Scan documents for exploits
• Enable AMSI protection (real-time scans only)
• Scan for spyware and grayware
• Scan for compressed executable files (real-time scans only)
• Scan process memory
• Scan compressed files
• Scan embedded Microsoft Office objects

See also:

• Detect emerging threats using Predictive Machine Learning
• Enhanced Anti-Malware and ransomware scanning with behavior monitoring

Scan documents for exploits

In the modern data center, more and more security breaches are a result of targeted attacks using techniques such as phishing and spear-phishing. In these cases, malware writers can bypass traditional malware scanners by creating malware specifically targeted for your environment. Workload Security provides enhanced malware protection for new and emerging threats through its document exploit protection.

Document exploit protection uses heuristic detection and the Advanced Threat Scan Engine (ATSE) to analyze files on the protected computer and determine whether they are suspicious.

At this time, you can define the anti-malware monitoring level for Linux AMD64 and x86 agents, as follows:

1. Open the properties of the malware scan configuration.

2. On the General tab, under Anti-Malware Monitoring Level, use the Detection Level and Protection Level fields to configure the level of detection and protection by assigning the degree of vigilance and strictness that Predictive Machine Learning applies while responding to potential threats:

   • 1 - Cautious: Detection or prevention is executed only when Workload Security is highly confident that an activity is malicious in nature.

   • 2 - Moderate: Detection or prevention is executed when Workload Security is moderately confident that an activity is malicious in nature. Trend Micro recommends using this level for most cases. The Moderate level also detects and prevents activity that would be detected or prevented by the Cautious level.

   • 3 - Aggressive: Detection or prevention is executed when Workload Security has low confidence in the fact that an activity is malicious in nature. The Aggressive level also detects and prevents activity that would be detected or prevented by the Moderate and Cautious levels.

   • 4 - Extra Aggressive: Detection or prevention is executed when Workload Security has the lowest confidence in the fact that an activity is malicious in nature. The Extra Aggressive level also detects and prevents activity that would be detected or prevented by the Aggressive, Moderate, and Cautious levels.

Prevention level must be the same or less aggressive than the detection level.

Prevention level determines if the action should be taken while prevention level is more aggressive or as aggressive as the detection level of the scan result.

If a file is identified as malware on the Events & Reports > Events > Anti-Malware Events > Identified Files page, but you know it is not malware, you can add it to the Document Exploit Protection Rule Exceptions list on the Anti-Malware > Advanced tab of the Computer or Policy editor. To allow the file, right-click it, select Allow, and follow the steps in the series of dialogs that appear.

For macOS agents, scanning documents for exploits is not supported. Configuring the prevention and detection level for any operating system other than Linux AMD64 and x86 has no effect and always runs as level 2 - Moderate.

Enable Windows AMSI protection (real-time scans only)

The Windows Antimalware Scan Interface (AMSI) is an interface provided by Microsoft in Windows 10 and later. Workload Security uses AMSI to help detect malicious scripts. By default, this option is enabled in Workload Security malware scan configurations.

1. Open the properties of the malware scan configuration.

2. On the General tab, under Windows Antimalware Scan Interface (AMSI), select Enable AMSI protection.

3. Use the Detection Level and Protection Level fields to configure the level of detection and protection by assigning the degree of vigilance and strictness that Predictive Machine Learning applies while responding to potential threats:

   • 1 - Cautious: Detection or prevention is executed only when predictive machine learning is highly confident that an activity is malicious in nature.

   • 2 - Moderate: Detection or prevention is executed when predictive machine learning is moderately confident that an activity is malicious in nature. Trend Micro recommends using this level for most cases. The Moderate level also detects and prevents activity that would be detected or prevented by the Cautious level.

   • 3 - Aggressive: Detection or prevention is executed when predictive machine learning has low confidence in the fact that an activity is malicious in nature. The Aggressive level also detects and prevents activity that would be detected or prevented by the Moderate and Cautious levels.

   • 4 - Extra Aggressive: Detection or prevention is executed when predictive machine learning has the lowest confidence in the fact that an activity is malicious in nature. The Extra Aggressive level also detects and prevents activity that would be detected or prevented by the Aggressive, Moderate, and Cautious levels.

Prevention level must be the same or less aggressive than the detection level.

Prevention level determines if the action should be taken while prevention level is more aggressive or as aggressive as the detection level of the scan result.

1. Click OK.

Scan for spyware and grayware

When spyware and grayware protection is enabled, the spyware scan engine quarantines suspicious files when they are detected.

1. Open the properties of the malware scan configuration.
2. On the General tab, select Enable spyware/grayware protection.
3. Click OK.

To identify a file that the spyware scan engine should ignore, see Create Anti-Malware exceptions.

Scan for compressed executable files (real-time scans only)

Viruses often use real-time compression algorithms to attempt to circumvent virus filtering. The IntelliTrap feature blocks real-time compressed executable files and pairing them with other malware characteristics.

Because IntelliTrap identifies such files as security risks and may incorrectly block safe files, consider quarantining (not deleting or cleaning) files when you enable IntelliTrap. (See Configure how to handle malware.) If users regularly exchange real-time compressed executable files, disable IntelliTrap. IntelliTrap uses the virus scan engine, IntelliTrap Pattern, and IntelliTrap Exception Pattern.

1. Open the properties of the malware scan configuration.
2. On the General tab, select Enable IntelliTrap.
3. Click OK.

Note that IntelliTrap is not supported for macOS agents.

Scan process memory{#memory}

Monitor process memory in real time and perform additional checks with the Trend Micro Smart Protection network to determine whether a suspicious process is known to be malicious. If the process is malicious, Workload Security terminates the process. For more information, see Smart Protection in Workload Security

1. Open the properties of the malware scan configuration.

2. On the General tab, under Process Memory Scan, select Scan process memory for malware.

Use the Detection Level and Protection Level fields to configure the level of detection and protection by assigning the degree of vigilance and strictness that Predictive Machine Learning applies while responding to potential threats:

 - 1 - Cautious: Detection or prevention is executed only when predictive machine learning is highly confident that an activity is malicious in nature.

 - 2 - Moderate: Detection or prevention is executed when predictive machine learning is moderately confident that an activity is malicious in nature. Trend Micro recommends using this level for most cases. The Moderate level also detects and prevents activity that would be detected or prevented by the Cautious level.

 - 3 - Aggressive: Detection or prevention is executed when predictive machine learning has low confidence in the fact that an activity is malicious in nature. The Aggressive level also detects and prevents activity that would be detected or prevented by the Moderate and Cautious levels.

 - 4 - Extra Aggressive: Detection or prevention is executed when predictive machine learning has the lowest confidence in the fact that an activity is malicious in nature. The Extra Aggressive level also detects and prevents activity that would be detected or prevented by the Aggressive, Moderate, and Cautious levels.

Prevention level must be the same or less aggressive than the detection level.

Prevention level determines if the action should be taken while prevention level is more aggressive or as aggressive as the detection level of the scan result.

1. Click OK.

Deep Security Agent version 20.0.1-12510 and later allows you to use Action to take to select the remediation action that Deep Security takes when it detects malware. The recommended value is ActiveAction. Or you could select Pass. For more information, see ActiveAction actions and Customize malware remedial actions.

Note that scanning process memory is not supported for macOS agents.

Scan compressed files

Extract compressed files and scan the contents for malware. When you enable the scan, you specify the maximum size and number of files to extract (large files can affect performance). You also specify the levels of compression to inspect so that you can scan compressed files that reside inside compressed files. Level 1 compression is a single compressed file. Compressed files inside that file are level two. You can scan a maximum of 6 compression levels, however higher levels can affect performance.

1. Open the properties of the malware scan configuration.
2. On the Advanced tab, select Scan compressed files.
3. Specify the maximum size of content files to extract, in MB, the levels of compression to scan, and the maximum number of files to extract.
4. Click OK.

Scan embedded Microsoft Office objects

Certain versions of Microsoft Office use Object Linking and Embedding (OLE) to insert files and other objects into Office files. These embedded objects can contain malicious code.

Specify the number of OLE layers to scan to detect objects that are embedded in other objects. To reduce the impact on performance, you can scan only a few layers of embedded objects within each file.

1. Open the properties of the malware scan configuration.
2. On the Advanced tab, select Scan Embedded Microsoft Office Objects.
3. Specify the number of OLE layers to scan.
4. Click OK.

Note that scanning embedded Microsoft Office objects is not supported for macOS agents.

Enable a manual scan for the notifier application

Enabling a manual scan through the Trend Micro notifier application is supported for Deep Security Agents 20.0.0-5512 or later for Windows and 20.0.0-180 or later for macOS.

When enabled, this lets you trigger a scan through the notifier application:

• From the computer editor or the policy editor, select the Anti-Malware tab.
• Click the General horizontal tab.
• In the Manual Scan section, select Allow agent to trigger or cancel a manual scan from Trend Micro's notifier application.

Specify the files to scan

Identify files and directories to include in the scan and then identify any exclusions from those files and directories. You can also scan network directories:

• Inclusions
• Exclusions
• Scan a network directory (real-time scan only)

Inclusions

Specify the directories to scan as well as the files inside the directories to scan.

To identify the files to scan, use one of the following options:

• All files.
• File types that are identified by IntelliScan. IntelliScan only scans file types that are vulnerable to infection, such as .zip or .exe. IntelliScan does not rely on file extensions to determine file type but instead reads the header and content of a file to determine whether it should be scanned. Compared to scanning all files, IntelliScan reduces the number of files to scan and improves performance.
• Files that have a file name extension that is included in a specified list that uses patterns with a specific syntax (see Syntax of file extension lists).

To identify directories to scan, you can specify all directories or a list of directories, as follows:

1. Open the properties of the malware scan configuration.
2. Click the Inclusions tab.
3. To specify the directories to scan, select All directories or Directory List.
4. If you selected Directory List, from the menu either select an existing list or select New to create one.
5. To specify the files to scan, select either All files, File types scanned by IntelliScan, or File Extension List.
6. If you selected File Extension List, from the menu either select an existing list or select New to create one.
7. Click OK.

The directory list uses patterns with a specific syntax to identify the directories to scan (see Syntax for directory lists).

Exclusions

Exclude directories, files, and file extensions from being scanned. For real-time scans, you can also exclude process image files from being scanned.

Examples of files and folders to exclude:

• If you are creating a malware scan configuration for a Microsoft Exchange server, exclude the SMEX quarantine folder to avoid re-scanning files that have already been confirmed to be malware.
• If you have large VMware images, exclude the directory containing these images if you experience performance issues.

You can also exclude files from Anti-Malware scanning when they are signed by a trusted digital certificate. This type of exclusion is defined in policy or computer settings (see Exclude files signed by a trusted certificate).

To exclude directories, files, and process image files, create a list that uses patterns to identify the item to exclude:

1. Open the properties of the malware scan configuration.
2. Click the Exclusions tab.
3. Specify the directories to exclude:
   1. Select Directory List.
   2. Select a directory list or select New to create one (see Syntax for directory lists).
   3. If you created a directory list, select it in the directory list.
4. Similarly, specify the file list, file extension list, and process image file list to exclude (see Syntax of file lists, Syntax of file extension lists, and Syntax of process image file lists.
5. Click OK.

Test file exclusions

Before you begin, make sure the real-time scan is enabled and a configuration is selected.

Before continuing with further Anti-Malware configuration steps, test file exclusions to ensure they're working correctly:

1. Go to Policies > Common Objects > Other > Malware Scan Configurations.
2. Click New > New Real-time Scan Configuration.
3. Go to the Exclusions tab, and select New from the directory list.
4. Name the directory list.
5. Under Directory(s) specify the path of the directory you want to exclude from the scan. For example, c:\Test Folder\. Click OK .
6. Go to the General tab, name the manual scan, and click OK.
7. Go to the EICAR site and download their anti-malware test file. Save the file in the folder specified in the previous step. The file should be saved and undetected by the Anti-Malware module.

Syntax for directory lists

Note that directory list items accept either forward slash or backslash to support both Windows and Linux conventions.

Syntax of file lists

Syntax of file extension lists

Syntax of process image file lists

Scan a network directory (real-time scan only)

If you want to scan files and folders in network shares and mapped network drives that reside in a Network File System (NFS), Server Message Block (SMB) or Common Internet File System (CIFS), select Enable Network Directory Scan. This option is available only for real-time scans.

Resources accessed in ~/.gvfs via GVFS, a virtual file system available for the GNOME desktop, are treated as local resources, not network drives.

If a virus is detected when scanning a network folder on Windows, the agent may display clean failed (delete failed) events.

Specify when real-time scans occur

Choose between scanning files when they are opened for reading, when they are written to, or both, as follows:

1. Open the properties of the malware scan configuration.
2. On the Advanced tab, select one of the options for the Real-Time Scan property.
3. Click OK.

Configure malware handling

Configure how Workload Security behaves when malware is detected:

• Customize malware remedial actions
• Generate alerts for malware detection

Customize malware remedial actions

When Workload Security detects malware, it performs a remedial action to handle the file. Workload Security can take the following actions when it encounters malware:

• Pass: Allows full access to the infected file without doing anything to the file (an Anti-Malware Event is still recorded).

  The remedial action Pass should never be used for a possible virus.

• Clean: Cleans an infected file before allowing full access to it. If the file can't be cleaned, it is quarantined.

• Delete: On Linux, the infected file is deleted without a backup.

  On Windows, the infected file is backed up and then deleted. Windows backup files can be viewed and restored in Events & Reports > Events > Anti-Malware Events > Identified Files.

• Deny Access: This scan action can only be performed during Real-time scans. When Workload Security detects an attempt to open or execute an infected file, it immediately blocks the operation. The infected file is left unchanged. When the Access Denied action is triggered, the infected files stay in their original location.

  Do not use the remedial action Deny Access when Real-Time Scan is set to During Write. When During Write is selected, files are scanned when they are written and the action Deny Access has no effect.

• Quarantine: Moves the infected file to the quarantine directory on the computer. The quarantined file can be viewed and restored in Events & Reports > Events > Anti-Malware Events > Identified Files.

  Malware marked as Quarantined on Linux might be marked as Deleted on Windows, despite the malware being identical on both operating systems. In either case, the file can be viewed and restored in Events & Reports > Events > Anti-Malware Events > Identified Files.

  On Windows, infected non-compressed files (for example, .txt files) are quarantined, while infected compressed files (for example, .zip files) are deleted. On Windows, both quarantined or deleted files have a backup that can be viewed and restored in Events & Reports > Events > Anti-Malware Events > Identified Files. On Linux, all infected files (compressed or non-compressed) are quarantined, and can be viewed and restored in Events & Reports > Events > Anti-Malware Events > Identified Files.

The default remediation actions in the malware scan configurations are appropriate for most circumstances. However, you can customize the actions to take when Workload Security detects malware. You can either use the action that ActiveAction determines, or specify the action for each type of vulnerability, as follows:

1. Open the properties of the malware scan configuration.

2. On the Advanced tab, for Remediation Actions select Custom.

3. Specify the action to take:

   • To let ActiveAction decide which action to take, select Use action recommended by ActiveAction.

   • To specify an action for each type of vulnerability, select Use custom actions, and then select the actions to use.

4. Specify the action to take for Possible Malware.

5. Click OK.

ActiveAction is a predefined group of cleanup actions that are optimized for each malware category. Trend Micro continually adjusts the actions in ActiveAction to ensure that individual detections are handled properly (see ActiveAction actions).

For macOS agents, the supported custom actions are Virus, Trojans, and Spyware.

ActiveAction actions

The following table lists the actions that ActiveAction takes:

For more information about CVE Exploit and Aggressive Detection Rule, see Scan documents for exploits.

When the agent downloads virus pattern updates from an ActiveUpdate server or relay, it may change its ActiveAction scan actions.

Generate alerts for malware detection

When Workload Security detects malware, you can generate an alert, as follows:

1. Open the properties of the malware scan configuration.
2. On the General tab, for Alert select Alert when this Malware Scan Configuration logs an event.
3. Click OK.

Identify malware files by file hash digest

Workload Security can calculate the hash value of a malware file and display it on the Events & Reports > Events > Anti-Malware Events page. Because a particular piece of malware can go by several different names, the hash value is useful because it uniquely identifies the malware. You can use the hash value when looking up information about the malware from other sources.

1. Open the policy or computer editor that you want to configure.

2. Click Anti-Malware > Advanced.

3. Under File Hash Calculation, clear the Default or Inherited check box. Default is displayed for a root policy and Inherited is displayed for child policies.

   When Inherited is selected, the file hash settings are inherited from the current policy's parent policy.

   When Default is selected, Workload Security does not calculate any hash values.

4. Select the Calculate hash values of all anti-malware events.

5. By default, Workload Security produces SHA-1 hash values. If you want to produce additional hash values, you can select one or both of MD5 and SHA256.

6. You can also change the maximum size of malware files that will have hash values calculated. The default is to skip files that are larger than 128MB, but you can change the value to anything between 64 and 512 MB.

Configure notifications on the computer

On Windows-based agents, you might occasionally see onscreen notification messages alerting you of Workload Security actions you must take that are related to the anti-malware and web reputation modules. For example, you might see the message "A reboot is required for Anti-Malware cleanup task". You must click OK on the dialog to dismiss it.

If you don't want these notifications to appear, perform the following:

1. Go to the Computer or Policy editor.
2. Click Settings on the left.
3. Set Suppress all pop-up notifications on host to Yes. The messages still appear as alerts or events in Workload Security. For more information about the notifier, see Notifier.

Run scheduled scans when Workload Security is not accessible

On Windows, this feature is supported with Deep Security Agent version 20.0.3445 and later.

Scheduled scans for malware are typically queued when the agent is offline. To have a scheduled scan run even when the agent is unable to connect to Workload Security, perform the following:

1. Go to the Computer or Policy editor.

2. On the left, click Anti-Malware.

3. On the General tab, for Scheduled Scan select Enable agent to trigger scheduled scan for malware.

Troubleshooting

The following special cases may cause the agent not to trigger the offline scheduled scan:

1. If the computer is shut down, the upcoming scheduled scan may not be triggered if it times out when the computer is restarted.
2. If the computer is shut down during the scheduled scan, the interrupted scheduled scan does not continue when the computer is restarted.