File Threat Protection
July 25, 2024
ID 12740
File Threat Protection prevents infection of the computer's file system. File Threat Protection starts automatically with the default settings upon Kaspersky Industrial CyberSecurity for Linux Nodes start. It resides in the computer operating memory and scans all files that are opened, saved, and launched.
File Threat Protection settings
Setting | Description |
---|---|
File Threat Protection enabled / disabled | This toggle button enables or disables File Threat Protection on all managed devices. The check toggle button is switched on by default. |
File Threat Protection mode | In this drop-down list, you can select the File Threat Protection mode:
|
First action | In this drop-down list, you can select the first action to be performed by the application on an infected object that has been detected:
|
Second action | In this drop-down list, you can select the second action to be performed by the application on an infected object, in case the first action is unsuccessful:
|
Scan scopes | Clicking the Configure scan scopes link opens the Scan scopes window. |
Scan archives | This check box enables or disables scan of archives. If the check box is selected, the application scans archives. To scan an archive, the application has to unpack it first, which may slow down scanning. You can reduce the archive scan duration by enabling and configuring the Skip object if scan takes longer than (sec) and Skip objects larger than (MB) settings. If the check box is cleared, the application does not scan archives. This check box is cleared by default. |
Scan SFX archives | This check box enables or disables scan of self-extracting archives. Self-extracting archives are archives that contain an executable extraction module. If the check box is selected, the application scans self-extracting archives. If the check box is cleared, the application does not scan self-extracting archives. This check box is available if the Scan archives check box is unchecked. This check box is cleared by default. |
Scan mail databases | This check box enables or disables scan of mail databases of Microsoft Outlook, Outlook Express, The Bat!, and other mail applications. If the check box is selected, the application scans mail database files. If the check box is cleared, the application does not scan mail database files. This check box is cleared by default. |
Scan mail format files | This check box enables or disables scan of files of plain-text email messages. If this check box is selected, the application scans plain-text messages. If this check box is cleared, the application does not scan plain-text messages. This check box is cleared by default. |
Skip text files | Temporary exclusion of files in text format from scans. If the check box is selected, Kaspersky Industrial CyberSecurity for Linux Nodes does not scan text files if they are reused by the same process within 10 minutes after the last scan. This setting makes it possible to optimize application log scans. If this check box is cleared, Kaspersky Industrial CyberSecurity for Linux Nodes will scan text files. This check box is cleared by default. |
Skip object if scan takes longer than (sec) | A field for specifying the maximum time to scan an object, in seconds. After the specified time, the application stops scanning the object. Available values: The default value is |
Skip objects larger than (MB) | The field for specifying the maximum size of an archive to scan, in megabytes. Available values: The default value is |
Log clean objects | This check box enables or disables logging of the ObjectProcessed event. If this check box is selected, the application logs the ObjectProcessed event for all scanned objects. If the check box is cleared, the application does not log the event. This check box is cleared by default. |
Log unprocessed objects | This check box enables or disables logging of the ObjectNotProcessed event if a file cannot be processed during scan. If this check box is selected, the application logs the ObjectNotProcessed event. If the check box is cleared, the application does not log the event. This check box is cleared by default. |
Log packed objects | This check box enables or disables logging of the PackedObjectDetected event for all packed objects that are detected. If this check box is selected, the application logs the PackedObjectDetected event. If the check box is cleared, the application does not log the event. This check box is cleared by default. |
Use iChecker technology | This check box enables or disables scan of only new and modified since the last scan files. If the check box is selected, the application scans only new files or the files modified since the last scan. If the check box is cleared, the application scans files regardless of creation or modification date. The check box is selected by default. |
Use heuristic analysis | This check box enables or disables heuristic analysis during an object scan. The check box is selected by default. |
Heuristic analysis level | If the Use heuristic analysis check box is selected, you can select the heuristic analysis level in the drop-down list:
|