This article applies to:
Question:
- How does WebMarshal scan archive files for viruses?
- How does WebMarshal virus scanning treat password protected archive files?
- How does WebMarshal unpacking treat password protected archive files?
Information:
WebMarshal unpacks archive files, such as .ZIP files, and scans all items according to the WebMarshal policy. Scanning includes virus and spyware scanning using third party scanners, if configured.
However, WebMarshal cannot unpack password protected archives. Therefore the contents of these archives cannot be scanned. This result does not cause the file to be blocked.
WebMarshal default rules include a separate rule to block encrypted archive files.
In order to ensure maximum protection against viruses, by default WebMarshal requests that the scanner unpack and scan the contents of all archive files. This behavior requires some additional processing time. The result for password protected archives differs depending on the scanner:
- McAfee for Marshal, Sophos SAVI, Sophos for Marshal, Bitdefender for Marshal: Password protected archives are blocked (but see notes below).
- Symantec: Password protected archives are not blocked.
To reduce processing time, you can configure WebMarshal to not request scanner level unpacking. This configuration is safe IF you have confirmed that a rule to block encrypted archive files is enabled.
To control the scanner unpacking behavior, add an entry in the WebMarshal Engine Configuration file (WMEngine.config.xml) as follows:
<WebMarshal>
<Engine>
<Config> <VirusScanners deepScan="false" /> </Config>
</Engine>
</WebMarshal>
To apply the change, restart the Engine service.
Notes:
- You cannot disable unpacking in Sophos for Marshal 1.1 and above (the setting is ignored).
- This change ensures that Sophos for Marshal returns correct information about password protected archives that cannot be scanned.
- When scanner unpacking is active (default), the Engine log file will include the following line:
Virus scanners will scan unpacked files and inside archives. - When scanner unpacking is disabled, the Engine log file will include the following line:
Virus scanners will scan unpacked files only. - The file WMEngine.config.xml is located on the processing server. If you have more than one processing server, you must make the changes on each server.
- Back up configuration before making changes.
- The file WMEngine.config.xml normally contains additional settings. The VirusScanners node can have multiple attributes. This node should only occur once.
- Only add (or remove) the specific attribute deepScan
- This article does not apply to WebMarshal 3.X. This version always requests the scanners to unpack archives.
